Show Posts
|
Pages: [1] 2 »
|
I'm a security researcher and for the past 45 days i've been researching on bitcoin protocol and how it is secured. I found that each and every single bitcoin in the universe is in danger cuz i found a critical security flaw in bitcoin protocol that would give me infinity private keys and all that private keys work.
If you really are serious that you found a vulnerability then you had better follow the instructions at https://bitcoincore.org/en/contact/ to securely email the developers. Do not open a Github issue or post a proof of concept publicly so that you don't reveal it to hackers. But the general gist of this thread seems to be that you are bluffing so you should prove otherwise if you want to be taken seriously. No, they never reply, I've already sent a mail coupe months ago for finding an xss ,still I did not get any reply from them and also it is not patched.
|
|
|
Any ideas or methods to check private keys and their balance?
Is this a list of private keys you already have that you want to check... or are you wanting to someone magically find private keys that have a balance so you can "steal" it? ![Huh](https://bitcointalk.org/Smileys/default/huh.gif) If it's the first... how many private keys are you wanting to check? No I don't want to steal just check a list of keys may be 10M keys
|
|
|
It's like you're saying: counting from 0000000000000000000000000000000000000000000000000000000000000001 to FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364140 is a "security flaw" because "all those private keys work" Wait until t3xoff discovers he can find all creditcards in existence by counting from 00000000000000001 to 9999999999999999 ![](https://bitcointalk.org/Smileys/default/afro.gif) ! Even if your computer can only generate 1 million numbers per second, you'll find many valid cards per minute! I'm not sure if OP is a troll, dumb, or really just clueless (or all of the above), but the size of large random numbers usually go straight against the intuition of the average person. We're all so used to create accounts online and have someone verify them for us, that it's really hard to believe Bitcoin allows you to create a private key on your own without connecting to the internet. It's really an amazing thing if you think about it ![Smiley](https://bitcointalk.org/Smileys/default/smiley.gif) I think you're really dumb I've said many times that I don't generate keys random like you said, the keys I generate has more probability of getting keys with balance.
|
|
|
Can problems in bitcoin protocol ever changed or modified. (I do not mean bitcoin core or something). If yes where can those problems reported.
|
|
|
It's been almost a month since you found a " security flaw" in Bitcoin ( BITCOIN SECURITY). Please let us know if you already found any balance from the " infinite private keys" that you've found. Yes I would share it soon once it is 100% completed. I have more work on it and I need to make some tools. I will surely first post it on here. And I think that there's no use of that security flaw it can only give some private keys with balance but can never be resolved.
|
|
|
Any ideas or methods to check private keys and their balance?
|
|
|
All other tools that I use requires python 3.
You can have both Python 2 and 3 on your system at the same time. Depending on if you are running Windows or linux the method is a bit different, but both are easy to do. If you want it in it's own bubble, just spin up a VM and put the other version there. This is programming 101. All of our programmers have to setup their PCs with PHP versions 7.3.x, 7.4.x and 8.0.x so they can bounce code off of any of them. If you can't figure out how to do it, you probably should not be working with code. -Dave OKAY LET ME TRY
|
|
|
I tried before to convert 2-3 it showed some errors. Why don't you just install Python 2? All other tools that I use requires python 3.
|
|
|
I tried before to convert 2-3 it showed some errors.
|
|
|
Can you guys tell which wallet is safest according to your experience.
|
|
|
If I generate much keys would all be valid. But when i tested some thousands all are valid. This is not a weakness and you have not found some big security flaw. This is exactly how bitcoin is supposed to work. Anyone in the world can generate thousands of even millions of valid private keys if they want. It's as simple as starting at 1 and counting up. Pick any number between the two numbers in BlackHatCoiner's reply, and you have found a valid private key. The reason you can't find anyone else's coins is because of the sheer size of that second number. Even if every computer on the planet did nothing but grind private keys for the rest of time, the sun would die and humans would be extinct before you found a collision. I dont generate those kind of keys, I generate keys on the basis on vulnebrity i did not generate some unknown keys. I generate keys which is dependent on a vulnebrity, so it gives me more accuracy. So it don't take years to get keys with balance. ![Grin](https://bitcointalk.org/Smileys/default/grin.gif)
|
|
|
Have you studied how things work in cryptography? Or just in Bitcoin? You've registered recently and you keep trying to find a way to cheat the system. Cheating the system isn't as easy as it seems. It's way harder than you thing and infeasible if each user was cautious enough. I found that each and every single bitcoin in the universe is in danger cuz i found a critical security flaw in bitcoin protocol that would give me infinity private keys and all that private keys work. This isn't a nice wording. First off, you'll have to define us what you mean by saying “infinity”. Infinite different keys? If yes, then that's impossible, because there's a specific number of available private keys. Specifically, you cannot pick a number outside the following range as a private key: [1, 115792089237316195423570985008687907852837564279074904382605163141518161494336] 1. Who maintains and develop bitcoin and its technology? You're probably referring to the developers. They don't maintain Bitcoin; this task is being managed collectively by the network. They're the ones who contribute by coding. Here they are: https://github.com/bitcoin/bitcoin/graphs/contributors2. Can the developer modify the bitcoin protocol? Anyone can. 3. To whom can I report this security flaw? (I'm always white hat) To whoever you report it, if it's indeed a security flaw, we'll all gonna learn it. yeah I cant really understand it gives 9x99x99999999x999x9x99x9x99999x9999x99x9x99 and it's your wish you can get as much you want. I too have same question, If I generate much keys would all be valid. But when i tested some thousands all are valid. I just manualy operate my tool, still I did not automate it. The reason I'm not showing any proofs is because i don't want my project leaked. I'm just a noob in cryptography, not a legend.
|
|
|
Why don't devs give attention to it, why people are investing in bitcoin, hackers can just take it all?
Yes, of course. All you have to do is find my private key on the list. I wish you luck. No... my post was a joke. It doesn't matter if you can generate 2^256 private-keys (and of course you can generate as many as you want). The thing is that it would take billions and billions of years before you could find the private key of a funded address. I got 61 hits out of 83103.......... ![Grin](https://bitcointalk.org/Smileys/default/grin.gif) If I were you, if you really make money through that. I'd rather just hide that. You will earn a lot just in case. The hardest thing is i did not take anything from it. Seems so dramamtic but it's the truth.
|
|
|
Why don't devs give attention to it, why people are investing in bitcoin, hackers can just take it all?
Yes, of course. All you have to do is find my private key on the list. I wish you luck. No... my post was a joke. It doesn't matter if you can generate 2^256 private-keys (and of course you can generate as many as you want). The thing is that it would take billions and billions of years before you could find the private key of a funded address. I got 61 hits out of 83103.......... ![Grin](https://bitcointalk.org/Smileys/default/grin.gif)
|
|
|
You're late, my friend. The flaw was already found out and it's out there. Unfortunately, devs don't care. ![Sad](https://bitcointalk.org/Smileys/default/sad.gif) Proof: https://keys.lol/bitcoin/1Why don't devs give attention to it, why people are investing in bitcoin, hackers can just take it all?
|
|
|
You're late, my friend. The flaw was already found out and it's out there. Unfortunately, devs don't care. ![Sad](https://bitcointalk.org/Smileys/default/sad.gif) Proof: https://keys.lol/bitcoin/1I knew it before, but what I found is something different.
|
|
|
I'm a security researcher and for the past 45 days i've been researching on bitcoin protocol and how it is secured. I found that each and every single bitcoin in the universe is in danger cuz i found a critical security flaw in bitcoin protocol that would give me infinity private keys and all that private keys work.
I have some questions, 1. Who maintains and develop bitcoin and its technology? (I think bitcoin.org) 2. Can the developer modify the bitcoin protocol? 3. To whom can I report this security flaw? (I'm always white hat) 4. Do they give me bounty?
|
|
|
The error in your script says invalid literal for int() with base 16: '' which means that the Bitcoin script that you, or the program, is trying to parse has an out-of-range start and/or end index (because the input passed to int() is the empty string). pubLen = int(script[2+sigLen*2:2+sigLen*2+2], 16) The only way that something like this can result in an empty string is if the script passed is way too short. So some of your rawtx's may be too short, maybe you mistakenly truncated them when passing them as input? So what's the solution?
|
|
|
|