oh so the signatures themselves are malleable... but that's a feature, not a bug..  From: https://gist.github.com/sipa/8907691Several sources of malleability are known: - Inherent ECDSA signature malleability
ECDSA signatures themselves are already malleable: taking the negative of the number S inside (modulo the curve order) does not invalidate it. - Non-DER encoded ECDSA signatures
Right now, the Bitcoin reference client uses OpenSSL to validate signatures. As OpenSSL accepts more than serializations that strictly adhere to the DER standard, this is a source of malleability. Since v0.8.0, non-DER signatures are no longer relayed already. - Superfluous scriptSig operations
Adding extra data pushes at the start of scripts, which are not consumed by the corresponding scriptPubKey, is also a source of malleability. - Non-push operations in scriptSig
Any sequence of script operations in scriptSig that results in the intended data pushes, but is not just a push of that data, results in an alternative transaction with the same validity. - Push operations in scriptSig of non-standard size type
The Bitcoin scripting language has several push operators (OP_0, single-byte pushes, data pushes of up to 75 bytes, OP_DATAPUSH, OP_DATAPUSH2, OP_DATAPUSH4). As the later ones have the same result as the former ones, they result in additional possibilities. - Zero-padded number pushes
In cases where scriptPubKey opcodes use inputs that are interpreted as numbers, they can be zero padded.
Inputs ignored by scripts If a scriptPubKey starts with an OP_DROP, for example, the last data push of the corresponding scriptSig will always be ignored. - Sighash flags based masking
Sighash flags can be used to ignore certain parts of a script when signing.
|
|
|
|
Do you know where these 28k for "nonstandard transactions come from? Normal nodes do not relay them. At least that is what I thought.
Hm. I'm unable to draw any conclusions based on the debug.log, but I extracted some lines and put it up on pastebin.com: "version" : 80500,
"protocolversion" : 70001,
"walletversion" : 60000 (nonstandard transaction type) http://pastebin.com/raw.php?i=D1xzU0FU (inputs already spent) It appears that those non standard tx are not relayed, as you mentioned. Edit: Spam marketing/advertisement via dust transactions has nothing to do with the mallability spam bot.  |
|
|
|
I don't know how to get the stats from bitcoind, but looking into my debug.log I see a bunch of messages containing "was not accepted into the memory pool"Many of those may be mutated transactions. You can get a feel of how many there are by executing this (on a unix box): grep "was not accepted into the memory pool" debug.log | wc -l This did not yield any result, however there are more than 58k appearances of "ERROR: CTxMemPool::accept() : inputs already spent" and 28k for "nonstandard transaction type" since Jan 07, 2014. Maybe I'll give it a try later and group those by date. Thanks. |
|
|
|
Is there a way to calculate how many btcs were stolen through these malled / assumed malled transactions?
This is not an useful stat to determine the amount of lost-due-to-whatever-reason coins and you'd need to ask the exchange or service provider for any data. Don't worry, the amount of attempted double spends is irrelevant. |
|
|
|
|
Hey Jan,
thanks for sharing. Is there a way to get those stats without any modifications from bitcoind? Would be nice, if you could keep this thread updated as it looks like the amount of attempted double spends still increases.
|
|
|
|
nobody picked up on his play on bangbus? wangbus?
This is the first thing that came into my mind.. Wondering, if this is only a coincidence or has something to do with Matthew N. Wright's in the meantime deleted Reddit post ( mirror). |
|
|
|
No signatures, no nothing, people just step up? Well, it's not like some random litecointalk.org user just appeared out of nowhere and made a statement. To clarify: Giles aka. evilscope is executive officer / operations manager and Kate's original partner in CipherMine. (source: CM plan p. 5) |
|
|
|
Received an unpleasant update from Malwarebytes: Jacob Colagrossi, Feb 04 11:10 AM:
Hi dexx,
It seems that crypto-trade is blocked as confirmed for hosting malicious content.
dexx, Jan 31 05:16 PM:
Hi Jacob,
were you able to get some information about the block of crypto-trade.com?
------------------------------------------------------------------------
*Jacob Colagrossi, Jan 07 10:28 AM:*
Hi Dexx,
I will forward the crypto-trade site on over as well.
Thank you
------------------------------------------------------------------------
*dexx, Jan 04 03:03 PM:*
Hi Jacob,
it's quite a pleasant surprise to hear from you again.
The block of bitcointalk.org was removed. Thanks for that!
I noticed crypto-trade.com is blocked, too. It's another cryptocoin
related website. You may want to forward a request for unblocking,
because I think there is no threat.
Thanks again and have a great day!
------------------------------------------------------------------------ |
|
|
|
HardwareCipherMine received the first two out of eight ordered HashFast BabyJets. The miners are set up and running stable. It also appears that CoinTerra started to ship it's first units, see an article on coindesk.com or theregister.co.uk.  The state of CipherMine, dividends and KateDue to the recent, temporary absence of Kate dividend payments are somewhat delayed. I politely raised my concerns in the CipherMine thread on litecointalk.org regarding this issue. Giles aka. evilscope stepped up and mentioned that he currently acts as operation manager. According to him CipherMine does not relay on Kate and dividend payments are sorted out as soon as possible. Ongoing hardware shippings are also not affected. This was further confirmed by another Wood Technology staff member. As what regards CipherTrade, it's currently in an ongoing beta and access can be obtained on beta.ciphertrade.com. There is a dedicated forum to submit bug reports, feature requests and comments.
|
|
|
|
13 pages now.. kinda makes me wonder, if the whole thread and jimmothy is part of some kind of "create attention and awareness for MPEx" PR stunt? |
|
|
|
|
I would actually like to see more alternatives to MPEx, Havelock and Crypto-Stocks.
FYI: Malwarebytes Anti-Malware blocks crypto-trade.com. I was in contact with an employee who was very helpful right after bitcointalk.org was blocked, too, but I did not yet hear back from him about this particular block.
|
|
|
|
great job putting all this together and continuing to develop it!
Thanks, very appreciated. Looks interesting, i'll take a look.
Unfortunally your bitcointalk.org account is too new. You need an activity score above 10 as well as at least 10 posts and furthermore your account needs to be older than August 1, 2013..  Maybe you are able to redeem some MSC via the other available methods: Reddit, GitHub or Twitter.  |
|
|
|
The Mastercoin protocol is an additional layer on top of the Bitcoin protocol. Multi signature Bitcoin transactions are used to encode data and to enable a whole set of new possibilities without bloating the blockchain with unspendable outputs. Mastercoins facilitate the creation and trading of smart properties and user currencies, as well as other types of smart contracts. They serve as the exchange point between Bitcoin, smart properties and smart contracts created on top of the Mastercoin protocol. If you never heard about Mastercoin before, please visit mastercoin.org, the Mastercoin thread on bitcointalk.org or /r/Mastercoin. A detailed Mastercoin specification is available here. The Mastercoin faucetThe Mastercoin faucet rewards users with free Mastercoin and Test Mastercoin. Four authentication methods are available to claim a reward: Reddit, GitHub, bitcointalk.org and Twitter. Distributed exchange testing specialIn the light of the broader testing of the distributed exchange, the first 100 Test Mastercoin rewards are doubled and users can receive up to 0.0025 MSC and 0.1 TMSC. Authentication via bitcointalk.org:To claim a reward via bitcointalk.org visit mastercoin-faucet.com/bitcointalk-intro:  Copy the verification token and go to your bitcointalk.org profile. Click on "Forum Profile Information" in the left navigation:  Paste the verification token in one of the fields: Personal Text, Location, Signature, Website title, Skype, Bitcoin address or other contact info. Confirm:  Copy any URL to your bitcointalk.org profile and paste it into the box on the Mastercoin faucet website:  Insert a Bitcoin address you fully control (no shared one) to finish the process and receive the reward.  Additional resources and more information about sending MastercoinThe tutorial Sending and Receiving MasterCoins for Dummies or the Mastercoin Wiki is probably a good follow up to learn more about sending Mastercoin. More general talk, discussion and information about Mastercoin is available in the Mastercoin thread on bitcointalk.org or the subreddit /r/Mastercoin. The Mastercoin Blog is definitely also worth a read and there is Google+, Twitter, LinkedIn and a group on Facebook.
|
|
|
|
Nice idea, but I'm not sure about your commitment. So here's a question: did you find your bride? |
|
|
|
To the admins of mastercoin-explorer.com, masterchest.info, masterchain.info and mymastercoins.com: Please take a look at transaction: https://blockchain.info/tx/e1633c9e0515cb027a6f2736bec02f0de8753e6b7c3303597ac01582de2d7041It was rendered as invalid due to insufficient balance. To quote the spec: Amount to transfer = 100,000,000 (1.00000000 Mastercoins) (64-bit unsigned integer, 8 bytes, should not exceed number owned, but if it does, assume user is transferring all of them) How do you plan to handle such things in the future? Balance of 15og4WXZPwkMnnsb3dj6HqgTUfcRLx4J9b: 364.84328263 TMSC, tried to send: 9999.0 TMSC to 1xC6gPa4QTM18cPKKPutcEkfmZvabY38j. |
|
|
|
Protip: don't use password managers.
Besides some potentially faulty features like auto fill-ins and such, what's your reasoning? And what solution do you suggest otherwise? |
|
|
|
i still get no dividends since Oct, 2013.
kate, can you explain why?
According to evilscope ( #1, #2 and #3) there was a family related incidend and she will be back next week. Kate is solely in control of any dividends. Will be forwarded ASAP. |
|
|
|
Really nice post! Liquid already came forward, but I still need to ask: Reviewing the wallet.dat file with strings discloses the phisher’s BTC wallet addresses. A team of 4-people: Liquid, Kaz, Abz, and Frosty. Why would a reasonable villain do such a thing in the first place? The exact role of the wallet is unknown to me, but I assume it's used as bait, to make users want to open the malicious password.txt.ink file. Using the attackers own wallet file for that seems very unlikely.. The malicious file is probably a wallet stealer and with some luck it might indeed be possible to extract some information about the attacker. Somehow this malware will phone home. |
|
|
|
|
Show Posts
