Bitcoin Forum
April 26, 2024, 12:50:49 AM *
News: Latest Bitcoin Core release: 27.0 [Torrent]
 
  Home Help Search Login Register More  
  Show Posts
Pages: « 1 ... 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 [89] 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 »
1761  Bitcoin / Bitcoin Discussion / Re: Mt Gox Break In Part 2 on: September 13, 2011, 04:35:56 AM
I can recommend everyone with a larger amount of BTC/fiat on Mt.Gox to start using a Yubikey, I really think it will make a different security-wise. If anyone can give facts that tells me it is the contrary of my thinking, please tell me.

It does appear it would stop a lot of the most common attacks that take place around here when it comes to mtgox.
Now if an attacker has control of the mysql db as well as possible write permits to the file system.. I do not think a yubikey
will matter much.

I will expand on this. If someone gains control of mtgox, the attacker can just alter logs and dbs to make it appear that users are doing it themselves with little to no evidence that the machine was broken into.

Magic hardware oracles only make it harder for attackers to attack from the perspective of the user. They are also not perfect due to lack of public third party auditing. The one RSA produces and is used by secure government and corporate facilities and was recently defeated.

tl;dr: It prevents attacks like keylogging, it doesn't prevent attacking mtgox itself.
1762  Bitcoin / Bitcoin Discussion / Re: Mt Gox Break In Part 2 on: September 13, 2011, 04:31:52 AM
Tux has replaced the missing BTC.

oh wow.  How many BTC are we talking about here?  So can I now log in to my own account from some foreign VPN or Tor, withdraw my own bitcoins and claim I was hacked and get free BTC?  Or do I have to have one of those "staff" labels to qualify?  

he spent 17000 BTC bailing out Bitomat.  he could've just let them and their btc holders die on the vine and he would've been better off than buying a worthless exchange.

$60 USD worth. It was a trivial amount, I was more worried about a large scale attack, which doesn't seem to be underway. Its better to warn everyone instead of sit on the information. I'm glad I was the only one hit so far.
1763  Bitcoin / Bitcoin Discussion / Re: Mt Gox Break In Part 2 on: September 13, 2011, 04:30:02 AM
I have to say one more thing. It is not right to bail out some (because they are a staff member on Bitcoin forum etc.) ans let others that get hacked for different reasons get nothing. This sounds to me like what the Federal Reserve did and are doing today, they bailed out friends/banks with trillions of dollars of interest free/low interest money and let "Main street" take the hit.

As a supporter of Ron Paul, that is the most slanderous and insulting thing I've seen said on this message board in awhile.

As it stands, there are no other people reporting account problems. I still believe I was targeted because I'm a well known face for the Bitcoin community and a developer of software that is used in conjunction with Bitcoin frequently.
1764  Bitcoin / Bitcoin Discussion / Re: Mt Gox Break In Part 2 on: September 13, 2011, 04:28:01 AM
-a third party is engaging in a cyberwar against bitcoin using man in the middle attacks.

After a lengthy conversation with MagicTux, unless it does turn up that mtgox has been hacked, neither of us can figure out what happened. Its obviously not me and I didn't fall for a phishing expedition, and Im pretty sure its not on his end. His description of security on the new post-hack mtgox is pretty decent. Its not perfect, but he has gone to great lengths to prevent a repeat.

Even if they dumped the password database, the passwords are sufficiently salted and hashed that it is extremely unlikely they grabbed my password first.

I also do not think it is likely the recent DigiNotar or Globalsign break ins have produced SSL certs to attack mtgox with (which WOULD explain this) because mtgox uses EV certs and as far as I know none of the fake certs were for EV, but DigiNotar and Globalsign both DO issue EV certs. Although I am not ruling this out.

DigiNotar knew about the break in for months, and I obviously have logged in since then.

Tux has replaced the missing BTC.

I believe that fraudulent EV certificates were issued.

For reasons unrelated to this, I would like to have this citation notated.
1765  Bitcoin / Bitcoin Discussion / Re: Mt Gox Break In Part 2 on: September 13, 2011, 03:38:25 AM
-a third party is engaging in a cyberwar against bitcoin using man in the middle attacks.

After a lengthy conversation with MagicTux, unless it does turn up that mtgox has been hacked, neither of us can figure out what happened. Its obviously not me and I didn't fall for a phishing expedition, and Im pretty sure its not on his end. His description of security on the new post-hack mtgox is pretty decent. Its not perfect, but he has gone to great lengths to prevent a repeat.

Even if they dumped the password database, the passwords are sufficiently salted and hashed that it is extremely unlikely they grabbed my password first.

I also do not think it is likely the recent DigiNotar or Globalsign break ins have produced SSL certs to attack mtgox with (which WOULD explain this) because mtgox uses EV certs and as far as I know none of the fake certs were for EV, but DigiNotar and Globalsign both DO issue EV certs. Although I am not ruling this out.

DigiNotar knew about the break in for months, and I obviously have logged in since then.

Tux has replaced the missing BTC.

Asking once again. Do you use a Yubikey on Mt.Gox?

As Ive said in the past, I do not believe that they improve security.
1766  Bitcoin / Bitcoin Discussion / Re: Mt Gox Break In Part 2 on: September 13, 2011, 03:24:38 AM
-a third party is engaging in a cyberwar against bitcoin using man in the middle attacks.

After a lengthy conversation with MagicTux, unless it does turn up that mtgox has been hacked, neither of us can figure out what happened. Its obviously not me and I didn't fall for a phishing expedition, and Im pretty sure its not on his end. His description of security on the new post-hack mtgox is pretty decent. Its not perfect, but he has gone to great lengths to prevent a repeat.

Even if they dumped the password database, the passwords are sufficiently salted and hashed that it is extremely unlikely they grabbed my password first.

I also do not think it is likely the recent DigiNotar or Globalsign break ins have produced SSL certs to attack mtgox with (which WOULD explain this) because mtgox uses EV certs and as far as I know none of the fake certs were for EV, but DigiNotar and Globalsign both DO issue EV certs. Although I am not ruling this out.

DigiNotar knew about the break in for months, and I obviously have logged in since then.

Tux has replaced the missing BTC.
1767  Bitcoin / Bitcoin Discussion / Re: Mt Gox Break In Part 2 on: September 13, 2011, 02:34:51 AM
I notified MagicTux through his support email, and he sent back a useless form letter as a reply.

Quote
Hello,


Recently there has been a large increase in the number of “phishing” attacks that have been made against the users of Mt.Gox.

Phishing involves deceiving users through fake emails or websites into providing their user name and password to the phisher, who then uses this information to log into the account and withdraw as many funds as they are able into their own bank account.

Phishing is another form of Internet crime similar to hacking which has steadily become more prevalent with the increase of Internet banking, shopping and exchange services. We urge our users to be cautious of phishing attacks, not only when accessing Mt.Gox but when providing any personal information over the Internet.

While the following steps cannot protect users completely from phishing, they will ensure that any attempt to steal personal information is far less successful:

-Always check the URL in the address bar of your browser when logging into Mt.Gox. It should read “https://mtgox.com”.
-Never click on hyperlinks in emails to access Mt.Gox.
-If you are ever unsure of the veracity of an email’s contents, contact Mt.Gox Support. We will be more than happy to confirm whether or not the email you have received is authentic.
-Be aware that Mt.Gox will never contact you by email asking for your user name or password.
-Check the security certificate of the website you are logging into. In modern browsers, this can be done by looking at the address bar and checking whether or not a blue certificate appears to the left of the address.
-Mt.Gox will soon implement the VeriSign EV Authentication certificate, which will make the address bar turn green when you are accessing the real Mt.Gox website.
-Use anti-virus software at all times. A number of anti-virus programmes include anti-phishing features which will notify you when you are accessing a suspect website.

We sincerely apologize for the inconvenience our users have suffered at the hands of phishers, and are doing all that we can to prevent further attacks in the future.

Thanks,

MtGox.com Team

I consider this a smoking gun.
1768  Bitcoin / Bitcoin Discussion / Re: Mt Gox Break In Part 2 on: September 13, 2011, 02:22:37 AM
At this moment, I'm questioning if DiabloD3 really posted this thread, I smelll something fishy here.
Maybe the forum (or DiabloD3 account) is compromised again.

Nope, its really me. Hi.
1769  Bitcoin / Bitcoin Discussion / Re: Mt Gox Break In Part 2 on: September 13, 2011, 02:19:26 AM
my bet is Diablo has had his forum acct hacked.  look, he puts up an OP then refuses to elaborate?

this could be a new tactic from the banker/gov't trolls lurking here to combat Bitcoin.  an "allten" guy here is advocating clearing out your mtgox accts as well to force an audit which makes no sense if he really was concerned about bitcoin or mtgox as it would cause a bank run like event killing mtgox.

Having my forum account "hacked" (which theymos does not believe has happened to anyone because everyone changed their passwords too fast) cannot be related to mtgox getting hacked. I use two different passwords if the op post wasn't clear by the use of the word unique.
1770  Bitcoin / Bitcoin Discussion / Possible false alarm: MtGox break in on: September 12, 2011, 06:05:03 PM
It seems Mt Gox has been broken into again. My account was just liquidated and send to a foreign address, the IP of which seems to be in the Ukraine. I assume I was targeted because I'm a Bitcoin developer.

Since I use Linux and use unique high entropy passwords, I am ruling out any nonsense like local trojans.

Everyone: Clear out your accounts if you have anything in them.
1771  Other / CPU/GPU Bitcoin mining hardware / Re: DiabloMiner GPU Miner (Long Poll, BFI_INT, async networking, multipool) on: September 12, 2011, 12:13:52 PM
Please note: Eligius is intentionally disabling rollntime for DiabloMiner users and tripling reject rates in the process. Use a different pool, such as btcguild which maintains a reject rate below 0.5%.
1772  Bitcoin / Mining software (miners) / Re: CGMINER CPU/GPU miner, GPU overclock+monitor+fanspeed in C for linux/windows/osx on: September 12, 2011, 04:52:41 AM
You do realize its easy to get banned, right? Take my advice, shut the fuck up.

You do realize its easy to not act like a responsible moderator on these forums, right?  Take my advice, resign as moderator.

1773  Bitcoin / Mining software (miners) / Re: bug or miracle? on: September 11, 2011, 10:39:14 PM
My 5850 has been steadily cranking out almost exactly 390MHash/sec at 940 Core/330 RAM running Phoenix with phatk 2.2.. I just discovered that by opening, not even running, CrystalDiskMark that my MHash rises to 395MHash/sec!! Is it just somehow interacting with the timing code that calculates the speed or am I actually getting 5 more MHash!? I do have a Dell PERC/4e PCIe RAID controller in the computer though, maybe a PCI-Express bandwidth/timing thing?

This is probably the strangest thing I've had happen with this computer, no other software causes this.

Textbook timing bug. Phoenix has a broken mhash meter that is known to read either too high or too low. Use DiabloMiner or cgminer instead.
1774  Bitcoin / Mining software (miners) / Re: CGMINER CPU/GPU miner, GPU overclock+monitor+fanspeed in C for linux/windows/osx on: September 11, 2011, 11:02:24 AM
Did you create cgminer or not? I believe you should treat everyone same and help to improve your software.

You do realize its easy to get banned, right? Take my advice, shut the fuck up.
1775  Other / CPU/GPU Bitcoin mining hardware / Re: DiabloMiner GPU Miner (Long Poll, BFI_INT, async networking, multipool) on: September 11, 2011, 07:39:10 AM
Update: Cut network failure sleep in half, move execution threads from 2 to 3 to increase performance until AMD fixes CPU usage bug
1776  Bitcoin / Pools / Re: [600 GH/s] Eligius pool: ~0Fee SMPPS, no reg, RollNtime, SQL, hop OK, 8decimals on: September 09, 2011, 08:12:51 PM
Latest DiabloMiner sends X-Mining-Extensions header as "longpoll rollntime switchto". This is not recognized by eligius and rollntime is disabled for this miner.
Last I checked, DiabloMiner had bugs in its rollntime implementation, and Diablo-D3 stubbornly denied they existed (thus refusing to fix them), so I blacklisted it from using it. Specifically, with rollntime enabled, DiabloMiner is somehow confusing its work and when it expires, and sending shares against work older than 2 minutes, even after it has received new work. If Diablo-D3 has fixed this, and someone is willing to do some real-time testing to confirm it (on IRC), I'd be glad to remove it from the blacklist...

That bug never existed and I repeatedly confirmed that the bug is in your pool.
The only thing you confirmed was that your logs were reporting things sanely. The actual on-the-wire packets confirmed you were sending me dead shares.

If this is your stance, I might have to end up adding code to detect eligius and force reenable it.
If Eligius doesn't tell you it's allowed, it isn't: forcefully rolled shares will be rejected outright.

You depend on UA snooping. Just sayin.

And no, the only thing you confirmed is that miners still have a very low rate of stale shares. Are you going to start blacklisting other miners because they produce stale shares too?
1777  Bitcoin / Pools / Re: [600 GH/s] Eligius pool: ~0Fee SMPPS, no reg, RollNtime, SQL, hop OK, 8decimals on: September 09, 2011, 04:04:45 PM
Latest DiabloMiner sends X-Mining-Extensions header as "longpoll rollntime switchto". This is not recognized by eligius and rollntime is disabled for this miner.
Last I checked, DiabloMiner had bugs in its rollntime implementation, and Diablo-D3 stubbornly denied they existed (thus refusing to fix them), so I blacklisted it from using it. Specifically, with rollntime enabled, DiabloMiner is somehow confusing its work and when it expires, and sending shares against work older than 2 minutes, even after it has received new work. If Diablo-D3 has fixed this, and someone is willing to do some real-time testing to confirm it (on IRC), I'd be glad to remove it from the blacklist...

That bug never existed and I repeatedly confirmed that the bug is in your pool.

If this is your stance, I might have to end up adding code to detect eligius and force reenable it.
1778  Bitcoin / Pools / Re: [600 GH/s] Eligius pool: ~0Fee SMPPS, no reg, RollNtime, SQL, hop OK, 8decimals on: September 09, 2011, 11:13:25 AM
Latest DiabloMiner sends X-Mining-Extensions header as "longpoll rollntime switchto". This is not recognized by eligius and rollntime is disabled for this miner.

I use eligius almost exclusively, rollntime works fine.

Edit: Goddamnit luke, you broke it!
1779  Other / CPU/GPU Bitcoin mining hardware / Re: DiabloMiner GPU Miner (Long Poll, BFI_INT, async networking, multipool) on: September 08, 2011, 04:44:05 PM
Hi Diablo,
I have a Radeon 6670 running on Win7-64bit and after i upgraded the Catalyst to the last version (11.8 from 11.6) my hardware errors reported are between 20% and 25% and the CPU usage is 40% to 50% (before was under 10%).

Any idea what should i do or where i should look for some info?

Thanks.
edit: forgot to mention that i use the default configuration (launched the .exe using only with the -o, -r, -u and -p options).

Try adding -v 2 to see if it decreases HW errors.

Also, newer versions of Catalyst have a CPU use bug that effects all OpenCL apps. It cannot be fixed from within the app.
1780  Bitcoin / Mining software (miners) / Re: GUI miner INVISIBLE! on: September 06, 2011, 01:51:45 AM
Sounds like a driver bug.
Pages: « 1 ... 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 [89] 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 »
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!