 Show Posts
|
|
Pages: [1] 2 3 »
|
|
I was offered a bug bounty for finding vulnerabilities on ALTS.trade. In the past I've participated in other bug bounty programs offered by different Bitcoin exchanges and services, such as Coinbase.
I have found 2 minor weaknesses in their service, and the ALTS.trade team has fixed those in a timely manner.
|
|
|
|
I've set up this service, it's completely non-profit: http://fullnode.coIt's still under 'beta' or even 'alpha' but it's working. Reddit thread: http://www.reddit.com/r/Bitcoin/comments/262vvi/contribute_back_to_the_bitcoin_network_by/FAQ: Q: Why are you working with only one hosting provider, centralization is always bad A: I know, I'm working on adding other providers such as DigitalOcean Q: $20? That's too much, you can find cheaper VPS providers! A: I know, but servers with less than 2GB of RAM tend to crash the bitcoind daemon Q: How can I know you're deploying a server for each $20? A: A full list of the deployed servers is available on the website and you can calculate the donated amount divided by $20 per server Q: How can I know you're not using the servers for other stuff? A: I'm not sure how to prove this part, if anyone has any suggestions I would be more than happy to implement them. Q: How can I check if the deployed servers are actually running the bitcoin daemon and are currently connected to the bitcoin network? A: Take any server IP and paste it in the box that can be found in the middle of this page Q: Are you going to opensource this project? A: Yes, in the next few days you will be able to deploy an entire clone of fullnode.co and also everyone would benefit from contributions to the project's code |
|
|
|
|
Please proceed with caution, no offense but installers for applications that are not open sourced and from an unknown source should not be installed on machines with wallets or any sensitive data.
|
|
|
|
The Cold Pi image can now be downloaded freely, please have a look here: http://coldpi.com/manuals/install-image.htmlRegarding the security issues that were raised earlier in this thread, I've also included bitaddress.org's source code (that can be verified via md5 checksum against the current version on github) so you can now basically generate a new key via the bitaddress.org HTML file and import it into Armory.
By doing so you eliminate my ability to mess around with the Armory key generation function and my ability affect the randomness of the process. Since the device is not intended and should never be connected to the internet, other than to mess around with the randomness of the genkey function I cannot do much more to gain profit. Just to state the obvious, I have not infected the Raspberry Pi with any malicious software and have not made any code changes to either the Armory client, Raspbian OS or bitaddress.org HTML file. Correct me if i'm wrong but you CANT import a wallet created by other client to Amory. To do what you said above, you have to make a new wallet in Armory then import the privatekey/address to that wallet. So what happens if that wallet was created not by random key generator? can you touch those imported addresses? You can import a private key into your Armory wallet. Even if I had generated the wallet myself (which I don't, and if you install the image you can see that you'll get the 'create your new armory wallet' splash screen. Also you can check and see that there's no ~/.armory directory before you launch Armory for the first time). If you choose to import a private key from bitaddress.org's html, as far as I know, there's nothing I could do beforehand to get your coins. However if you choose to 'sweep' the address, that will move the funds to the Armory generated address which is something you would like to avoid if you do not trust me. |
|
|
|
Anybody receive their refund yet? Still waiting here....
Guess the guys name is Chris Sweeting?
How do you know his name? can you provide some resources? |
|
|
|
|
Did anyone receive a refund? They said they will start refunding on Jan 10th but no word since. They have been inactive on bitcointalk and reddit, not answering emails.. are we screwed?
|
|
|
|
Since the device is not intended and should never be connected to the internet, other than to mess around with the randomness of the genkey function I cannot do much more to gain profit.
You, or someone else, could theoretically alter the code in such a way that every address the code generates is actually from the same master seed. So to a regular user it might look random and fair, but in reality you would have the master seed and thus access to everyone who ever generates addresses with it. Not saying that you did, but it's possible. Yes but if you use the bitaddress.org HTML file that I've included (and can be verified via md5 checksum) you can generate the private key there and import it into Armory. So I can't control the master seed or anything else.. |
|
|
|
Trezor can be used as either hot or cold storage. You can easily move coins to trezor's address and use it as cold storage but also allows you to plug the trezor to an internet machine and safely transfer coins as a hot wallet. The cold pi is intended for cold storage only. Of course you can still spend coins on the Cold Pi address but the way to do it is a bit more complicated than trezor. You will need to export the watch only address from your cold pi to an internet machine, create a transaction using the watch only address, move the transaction data via USB, sign it on the cold pi and move it back to the internet machine. |
|
|
|
The Cold Pi image can now be downloaded freely, please have a look here: http://coldpi.com/manuals/install-image.htmlRegarding the security issues that were raised earlier in this thread, I've also included bitaddress.org's source code (that can be verified via md5 checksum against the current version on github) so you can now basically generate a new key via the bitaddress.org HTML file and import it into Armory. By doing so you eliminate my ability to mess around with the Armory key generation function and my ability affect the randomness of the process. Since the device is not intended and should never be connected to the internet, other than to mess around with the randomness of the genkey function I cannot do much more to gain profit. Just to state the obvious, I have not infected the Raspberry Pi with any malicious software and have not made any code changes to either the Armory client, Raspbian OS or bitaddress.org HTML file. |
|
|
|
IT would be cool to bundle this all together on a small mini-itx computer with hard drive that could both run as a full node (support Bitcoin!) and run armory for your cold storage needs. It could be set up to only have the port open to the outside world to connect to the bitcoin network, nothing else.
In my opinion, if the network cable is plugged to the board, it cannot be considered as 'cold' storage. |
|
|
|
By the way, if anyone is interested in adding something to the bundle, he can do it via USB instead of connecting the device to the internet which is quite convenient even compared to directly plugging the Pi to the internet.
How about adding a script with coldpi that removes the ethernet interface and the temptation to easily connect the coldpi to the internet? Well I don't want to cripple the device by removing the interface. I will however disable it by default, so even if you connect the cable by mistake nothing will happen until you start the networking service manually. I'll be uploading the complete Raspberry Pi SD image soon (not just the Armory source as currently available). |
|
|
|
I know you are probably doing this with good intentions, but it seems a lot of people are putting a lot of trust in these kind of products without thinking about the security possibilities.
If I wanted to steal some bitcoin this would be a fantastic way to do it. I could modify the armory source to stash any PKs loaded to an obscure location on the SD card. I could then modify one of the standard linux daemons to wait for an internet connection and then send the contents of this obscure PK file to myself. I know that this is theoretically an offline wallet but I can see many people in a moment of weakness establishing an internet connection just long enough to download and install one of their favorite apps that doesn't come in your bundle.
Again, I doubt this is the case, but people really shouldn't be running software on anything that they haven't personally verified the source/binaries. When setting up an environment verify the OS, the bitcoin client and any other tools that you will need. There isn't any way to do that with this, a whole lot of blind faith in an anonymous entity is required.
Indeed it is possible for me to steal coins from users who choose to use my compiled Armory version, however it is extremely difficult for me to do that, and impossible if you actually follow my own instructions (which is to NEVER connect the Pi to the internet). By the way, if anyone is interested in adding something to the bundle, he can do it via USB instead of connecting the device to the internet which is quite convenient even compared to directly plugging the Pi to the internet. |
|
|
|
I wrote http://github.com/orweinberger/bitquote.gitIt takes the data from Bitcoin Average however you can also choose whatever currency you want and control the design via CSS. It currently works ONLY with Bitcoin Average but maybe you'll find it useful. |
|
|
|
Hi!
Great initiative, I tried to follow the instructions, I fail on one python message:
coldstore@pi:~/BitcoinArmory-0.88-beta$ python ArmoryQt.py
Traceback (most recent call last):
File "ArmoryQt.py", line 33, in <module>
from PyQt4.QtCore import *
ImportError: No module named PyQt4.QtCore
any ideas?
I wouldn't mind at all to pay for a ready-made image to download, but I am to impatient to wait for a piece of plastic in the snail-mail. Think people with serious bitcoin assets would be quite weary of using warez copied to an obscure site btw :-)
My installation manual was not complete, I've updated now to include all necessary packages required to install Armory. Please try now http://coldpi.com/manuals/install.html |
|
|
|
|
Checking out this error now, will update
|
|
|
|
I think the key point being made is: You have no recourse if a user of your coldpi creates an image of the sd card posts a link to the image as the software is open-source and you don't "own" the software. I like the idea about pre-loading it with BTC but then you may need a register as a MSB with MT license to sell within the USA.
There's no reason for anyone to create an image since I'm sharing compiled Armory source available for free download. The Cold PI kit will be sold to people that does not have the time/knowledge to deal with purchasing a new Raspberry Pi and installing everything on it. Regarding preloading it with Bitcoin. It's a cool idea but not practical. I do not want to launch the Armory client after I install it on a client's Cold Pi since they cannot tell if I also took their private key and saved it somewhere. |
|
|
|
Very cool idea, although rather expensive. The Piper wallet does the same thing (off line bitcoin wallet) and it includes a built in printer, nice decked out software, for about the same price. https://piperwallet.comI love piper but it costs more than Cold Pi and also provides less features. Cold Pi has Armory that allows you to manage multiple wallets/addresses, print paper wallets and many more features. Actually, all you need to do is add Armory to the Piper and you have that too. Remember Piper is also a Raspberry PI but with an included printer. So technically it's Cold Pi plus printer. In reality though with both projects you're just paying for the box. The software is all open source. :-) Yes you're right, problem is that compiling the Armory for the RPi is a nightmare.. |
|
|
|
This is pretty cool. Now I'll have something to do with my raspberry pi I got for Christmas.
Glad you liked it, if anyone has any suggestions on other relevant software that I can add to the Cold Pi please let me know. As previously mentioned, all compiled code is available freely for download. You can also choose to pay for the kit or the SD card alone if you don't have the knowledge or time to deal with it. Could you also fit a browser and the offline version of https://bitcoinpaperwallet.com/ in? That would be awesome. I could replace a whole PC with this setup. Browser is already there, ships with the Raspbian OS. I didn't mention it but I'm also adding an offline version of the bitaddress.org code. I'll add the bitcoinpaperwallet.com one as well. Thanks! |
|
|
|
This is pretty cool. Now I'll have something to do with my raspberry pi I got for Christmas.
Glad you liked it, if anyone has any suggestions on other relevant software that I can add to the Cold Pi please let me know. As previously mentioned, all compiled code is available freely for download. You can also choose to pay for the kit or the SD card alone if you don't have the knowledge or time to deal with it. |
|
|
|
In case anyone is still interested in compiling the Bitcoin Armory on the RPi, you can download the compiled source code from http://coldpi.com. That is Bitcoin Armory 0.88, compiled for Raspbian. |
|
|
|
|
