Bitcoin Forum
August 13, 2022, 03:34:37 AM *
News: Latest Bitcoin Core release: 23.0 [Torrent]
 
  Home Help Search Login Register More  
  Show Posts
Pages: [1] 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 »
1  Other / Beginners & Help / Re: New crypto users, a few tips to avoid losing your hard earned coins on: November 26, 2020, 01:46:05 PM
Has there been any case where a redirection malware has actually changed the destination address?

There are countless cases where user A has sent something to user B, and for some reason the coins ended up with user C (who in this case is a hacker with clipboard malware). If something like this happens we can be pretty sure it's clipboard malware, but most victims don't want to check what actually happened but follow the advice to format the disk and start with clean OS.

It should be noted that clipboard malware can hit the user of any crypto wallet, so it is an advantage to use a hardware wallet that will always ask us to confirm if the address matches. Of course, it is a good and desirable practice to always check several times if necessary, especially if we send large amounts.

When I purchased my Ledger I heard about the Trezor vulnerability. I assume they would have changed the chip since then - perhaps they have not updated it. My Ledger requires a pin to be entered to access the device and clears the seed if it fails 3 times. Are the Trezor's still hackable with a pin/password if physical access is available?

Trezor vulnerabilities cannot be literally fixed with new firmware, because the problem is in the hardware itself - which means that all existing devices that use current hardware will always be vulnerable. When and if the Trezor makes a completely new model, we can expect that it will not be exposed to that vulnerability.

As for PIN protection, Kraken has demonstrated that it is possible to create a script that will brute force a PIN consisting of 4 numbers in about 2 minutes.Therefore, one should not rely on PIN as protection because if someone has physical access to a hardware wallet and enough technical knowledge, it is only a matter of time before they will be able to extract the seed.

Additionally, because the Trezor firmware utilizes an encrypted storage, we developed a script to crack the PIN of the dumped device, leading to a full compromise of the security of the Trezor wallets. The script was able to brute force any 4-digit pin in under 2 minutes. This attack demonstrates that the STM32-family of Cortex-M3/Cortex-M4 microcontrollers should not be used for storage of sensitive data such as cryptographic seeds even if these are stored in encrypted form.


Thanks for the info. So I guess redirect malware must be prevalent enough that there have been enough documented cases. I figured a lot of them would be failures to copy/paste properly like having a previously copied address in the clipboard instead of the one you want to send to but after searching the forums it seems somewhat common.

I understood the Trezor failure was hardware related. I assumed they would have released a newer chip by now that fixes the problem but I guess that isn't the case. Yeah if's a hardware level failure firmware usually can't shore up the problem like Specter and Meltdown issues with CPUs (relying on the OS to intercept those vulnerabilities).

I'll stick with my Ledger. Obviously a 4 digit pin can be bruteforced quite quickly. My Ledger says the device will wipe itself on 3 failed attempts of pin entry - so hopefully nobody has found a workaround for the Ledger Blue. I am assuming Trezor doesn't behave in this manner.
2  Other / Beginners & Help / Re: New crypto users, a few tips to avoid losing your hard earned coins on: November 23, 2020, 08:17:06 AM
Alternatively, you can use a hardware wallet which essentially uses encryption hardware to shield your private keys from the PC allowing you to use your wallet on a system without worry about compromise. Notable hardware wallet companies are Trezor and Ledger and prices are generally reasonable considering the protection they provide.

It is not as simple as it may seem at first, because by buying a device like this and sending a coin to it, we cannot say that we are 100% protected. While it is true that a hardware wallet protects us even on a computer infected with malicious software, the way it protects us is by forcing us to check each of our actions in the user interface and on the hardware wallet screen. Therefore, if we know that the seed should not be shared with anyone and should not be entered anywhere, the greatest attention should be paid to the clipboard malware that changes the destination address - so before click send check for address match (on UI and on HW screen).

Hardware wallets are also a good option if you like to access your wallets somewhat frequently but worried about residential theft (like if you keep your hardware wallet in a drawer right next to your PC). A hardware wallet, if fallen into the wrong hands, prevents thieves from accessing your coins as would a safe.

Partly true, because there is a known vulnerability in the Trezor wallet that allows anyone who comes into physical possession of the device to very easily extract the seed if it is not additionally protected with a passphrase (extra 25 word). Everyone should practice additional protection of the device itself by protecting their main wallet with passphrase, which will not only protect the seed (if anyone finds it), but is the only thing that can protect our coins in case of a physical attack where thieves can only access to that wallet which contains a small part of the coins.

Valid points. Has there been any case where a redirection malware has actually changed the destination address? This is why I do routinely check the first 6 and last 6 of each sending address. I know some of those redirection scripts are cleared out by Malwarebytes Premium but obviously if the malware is new or is relatively low availability in the wild then it probably won't get picked up on by the scanner's heuristics.

When I purchased my Ledger I heard about the Trezor vulnerability. I assume they would have changed the chip since then - perhaps they have not updated it. My Ledger requires a pin to be entered to access the device and clears the seed if it fails 3 times. Are the Trezor's still hackable with a pin/password if physical access is available?
3  Other / Beginners & Help / Re: New crypto users, a few tips to avoid losing your hard earned coins on: November 20, 2020, 11:16:18 AM
If you can afford it, it’s wise to dedicate a separate machine for handling your wallet synchronizations that doesn’t do anything unsafe like downloading questionable torrents and surfing new websites.
It's pretty unnecessary. Hardware wallets can actually be used with infected computers and hence why they're a preferred method of storage. Its unrealistic for someone to get another computer just for Bitcoin.

A good anti virus and some prudent measures are generally enough.
•   Hardware wallets are a good option if you’re willing to spend some money and like to access your wallets somewhat frequently but worry about residential theft. A hardware wallet, if fallen into the wrong hands, prevents thieves from accessing your coins as would a safe. It does not keep a backup of your private keys, however, so again make sure you can access those even if your hardware wallet is stolen.
It isn't what it's designed for. While hardware wallets are reasonably hardened against physical attacks, they're primarily used to guard against malware and use on compromised computer. They can defend against physical attacks but it'll be way better to keep them in a safe instead.
•   If you do choose to buy a hardware wallet only buy from reputable sources – preferably the vendor itself. Amazon used to be a safe place to buy from but they have been mixing their inventory recently and many people are receiving Nano and Trezor wallets that have been used or at least the box was open. Understand how seeds and wallets work before dumping all your coins into one.
It's okay to buy from the third party if you've the technical knowhows to wipe the device completely. Border agents tends to open the package and inspect the device and it's safe as long as the seal is not broken and that your device is not opened physically.
•   If you have any intention of sharing your coins with others in the event of injury or demise, make sure those involved know how to access the public and private keys. Making a convoluted 97 letter password is not a good idea if you’re the only one who will ever know the password.
Multisig could be a possible way to store Bitcoins. Try exploring that.

Other than that it's comprehensive. Great work.

Ahh true on that about hardware wallets being used with an infected PC. I was just coming from my own personal experience where I was helping somebody who had malware and I didn't know about it until he hooked up a Ledger Nano and the Chrome extension was installed but it was asking for a private key. I thought to myself "What the hell is this". It's highly improbably for them to acquire access but I still moved on to a safer computer.

In some parts of the world PCs are quite expensive. In the US you can get a cheap laptop on black Friday which costs as much as a Ledger Blue so I figured it's not that much of a burden financially. I guess it's more a matter of how meticulous people are with their online safety.

Multisig is good. There are a lot of nice options for storing coins now - some even handle seeds for multiple coins. Much easier than sitting on the Bitcoin core and waiting for it to sync back in 2011. I'll amend my post a bit.
4  Other / Beginners & Help / New crypto users, a few tips to avoid losing your hard earned coins on: November 20, 2020, 10:45:52 AM
Hey ladies and gents. I’ve been off the boards for a long time but I’ve still been mining. My friend just made a couple of errors with some crypto she had despite me verbally explaining things to her before, so I thought I would write some general guidelines for all those new to using cryptocurrency. This is general advice and applies more or less to every single cryptocurrency out there including Bitcoin, Ethereum, Litecoin and so forth.

•   Whenever possible, try to be the only person who has access to your private keys (ie own your private keys). Having a public address is like knowing the shipping address for Amazon, you know there’s a lot of money there but you don’t have the keys to enter the building. The private keys are the access to your coins, if you give out that information anywhere on the internet your coins are as good as gone.
•   As private keys are the things that control access to your money, only you should control your coins. Don’t leave them on an exchange unless actively trading. It’s very unlikely that even a lawsuit will be able to recoup the value of lost/stolen coins.
•   Going back to the idea that your private keys are the keys to unlocking your coins, make sure they are backup up somewhere. Many people think their coins are actually located inside the wallet.dat file that many conventional wallets use – but the wallet.dat file just keeps the private keys. Sometimes you can encrypt the file with a password, but it is still better to keep a backup copy as you would with childhood pictures or any other important document. There are numerous threads on the forums showing a variety of ways to keep backups – everything from printing out a single copy which you keep in a safe to super paranoid distribution of encrypted files spread around the world.
•   Since most hackers know that private keys are the key (pardon the pun) to getting access to your coins, they will often employ keyloggers and other malware to learn what passwords you enter. Some malware even log clipboard content and take screenshots intermittently so even using onscreen keyboards and password managers might not be safe. The most prudent course of action is just avoid clicking any link you’re not sure is 100% safe. If you can afford it, it’s wise to dedicate a separate machine for handling your wallet synchronizations that doesn’t do anything unsafe like downloading questionable torrents and surfing new websites. Alternatively, you can use a hardware wallet which essentially uses encryption hardware to shield your private keys from the PC allowing you to use your wallet on a system without worry about compromise. Notable hardware wallet companies are Trezor and Ledger and prices are generally reasonable considering the protection they provide.
•   Hardware wallets are also a good option if you like to access your wallets somewhat frequently but worried about residential theft (like if you keep your hardware wallet in a drawer right next to your PC). A hardware wallet, if fallen into the wrong hands, prevents thieves from accessing your coins as would a safe. It does not keep a backup of your private keys, however, so again make sure you can access those even if your hardware wallet is stolen (a user in the forums posted about his wallet being hidden under his bed without a backup - not a good idea when most thieves will take anything small and electronic)
•   If you do choose to buy a hardware wallet only buy from reputable sources – preferably the vendor itself. Amazon used to be a safe place to buy from but they have been mixing their inventory recently and many people are receiving Nano and Trezor wallets that have been used or at least the box was open. Understand how seeds and wallets work before dumping all your coins into one.
•   If you have any intention of sharing your coins with others in the event of injury or demise, make sure those involved know how to access the public and private keys. Making a convoluted 97 letter password is not a good idea if you’re the only one who will ever know the password.
•   Blockchain transactions are for all intents and purposes irreversible. If you send money to the wrong address or put the wrong amount you’re at the mercy of the receiver to send the balance back to you. If you send to an unknown address you might as well kiss the coins goodbye.
•   If you are making a purchase of an item or traded good on the forums, please check out the user’s Trust rating. If the value of the item is significant you should consider using an established escrow service. Spending just 0.5% of the cost of the transaction can save you from a world of headache. Remember that blockchain transactions are not reversible so sending to any party you are not familiar with before receiving an item is blindly trusting that person.
•   As Lucius notes, below, always check the destination address when you are sending coins. Some malware attacks actually alter the address when they read a crypto address has entered the clipboard, so instead of copying the address you want to send to, the malware replaces the destination address and you paste the wrong address into the sending field. Usually checking the first and last 3 or 4 digits is sufficient, but checking 12 or more digits makes it nearly impossible for somebody to have made a near clone address (simple entropic math).


If you have any further suggestions or tips please recommend them and I’ll append them to my list. Hopefully this helps a few people avoid a few mistakes.
5  Economy / Gambling discussion / Re: Lottery is a poor man's tax on: October 28, 2020, 02:50:08 AM
It comes down to a inability to judge optimism and reality properly. Poor people are either too despondent about their situation so they're in a depressed state or they feel overly optimistic about their chances to win despite know that the ticket may state the odds of winning are 1 in 43 million or something to that effect. Instead of focusing on themselves to improve their condition the long arduous way they're looking for a shortcut. for middle class and rich people it's probably more of an excitement issue than a need to achieve some goal.
6  Other / Beginners & Help / Re: Even if you buy a hardware device from an authorised reseller, you need to check on: October 28, 2020, 02:39:24 AM
Amazon's inventory is not pristine. They routiney mix 3rd party sellers with their own manufacturer sourced stuff. Some reviewers are idiots because they think just because they bought the product from Amazon that it went through the proper channels and didn't pay attention the Buy Box when clicking add to cart. I have received counterfeit items from flash memory to batteries that was sold directly by Amazon. I can only assume the inventory was mixed by accident, but at this point I doubt Amazon cares as it's just riding on it's bulk.

While it's not guaranteed every 3rd party hardware wallet will contain malicious code, you can be certain there's definitely a motive to have somebody want to steal your passphrase. If there's a way, there's a will.
7  Alternate cryptocurrencies / Mining (Altcoins) / Re: Is it worth purchasing Antminer E3? on: October 28, 2020, 02:23:12 AM
Do you have ideas for mining equipment in the $600 area for ETH mining beside building a mining rig?


You can still hobby mine with a mid level CPU based gaming rig with a decent AMD card IF you have very cheap electricity. It may not earn much, but should be able to pay for the the next upgrade of your current card. You can't really do this with lend end cards as they don't have the memory speed/bandwidth to support ETH which now needs 4GB+. Something like a 5700 XT with $200 for the rest of the rig should work. You can get in some gaming in down time.
8  Alternate cryptocurrencies / Mining (Altcoins) / Re: Ethereum Mining NoDevFee 0% v15.0 🔥 on: October 27, 2020, 08:57:30 PM
The simple fact that the thread is almost entirely composed of newbies should be a clue as to the veracity of the claims. Plain and simple - don't go chasing pennies on the street and get hit by a truck resulting in medical bills in the thousands. At best this program simply diverts a smaller fee to the hacker and at worst it introduces a backdoor to your system. It's not worth the risk.
9  Alternate cryptocurrencies / Mining (Altcoins) / Re: which coin mining is most profitable ? on: January 22, 2018, 07:06:43 AM
Ya know, going back to the beginning of this thread, it never ceases to amaze me how many folks are compelled to beat around the bush..... The user asked which coin would be most profitable for mining.... Just answer the god damn question for f**k sake! There was no mention of buying anything, the question was about "mining".

None. The answer is none.

Think about this, if you bought a certain amount of tokens (with the money that could have been allocated to mining) and the coin the coin goes up 100x in a year, you would only be able to mine a fraction of what you would have been able to buy.

Mining only works well if the coin fails to launch and does mediocre increases.

There are so many CPUs, GPUs, and ASICs mining now that any coin/token difficulty goes up the second it comes up on a radar or gets placed on an exchange. The exception being maybe the first 96 hours of mining a new coin.
10  Alternate cryptocurrencies / Mining (Altcoins) / Re: Im realy frustrated and i need your help on: January 22, 2018, 06:57:51 AM
I'm assuming that the "-50" that you put in settings is -50mv voltage to the core? Try getting rid of that. Most cards can handle that but occasionally one card can't and it will cause the whole rig to go down.

Also, you can leave Hardwareinfo64 running and look to see if you're getting memory errors - if you are back off on the memory overclocks.
11  Alternate cryptocurrencies / Mining (Altcoins) / Re: 36 Hour Rubbleshoot - ASUS z270-a only mounting 5 of 6 rx570 on: January 22, 2018, 04:48:41 AM
Try disabling 4g encoding, see if it detect all the cards and error 20s on a few cards, then you can go back and re-enable 4g.

As mentioned above sometimes recabling might solve the issue if the power supply isn't providing enough power or sometimes just a loose connection somewhere.
12  Alternate cryptocurrencies / Speculation (Altcoins) / Re: Is Ripple Going To Reach 10,000$ By 2020? on: January 22, 2018, 04:34:58 AM
So you're going to give your fiat to buy a token used by banks who printed your faithless fiat in the first place? Well thankfully it's not like xrp can be generated out of thin air or governed by a central agency who can devalue the coin.... oh wait  Shocked Roll Eyes

Profits to me made - yes. Sell you soul to the devil - I would rather sell people into slavery.
13  Alternate cryptocurrencies / Mining (Altcoins) / Re: Single GPU mining in 2018 with free electricity - worth it? on: January 22, 2018, 04:25:48 AM
Depending on the reason why you are on a base, you may want to check on the use policy for both electricity and internet (if you're not using a private provider). Military conduct code is not something to mess around with. If you are not enlisted and won't be violating code then just buy a wifi switch that can reboot the PC remotely.
14  Alternate cryptocurrencies / Mining (Altcoins) / Re: GPU mining will die in 2018! on: January 22, 2018, 04:22:38 AM
If I was in the southern hemisphere and dealing with heat issues I would definitely consider dumping my cards for insane inflated prices and just buy back at lower prices. The savings could be used to buy coins directly since everything is on sale compared to December prices.

In northern hemisphere many are enjoying the "free" heat so miners are not as annoying. I wish this shortage had hit 6 months ago, I would have dumped all my older cards back then.
15  Alternate cryptocurrencies / Mining (Altcoins) / Re: Best mining OS/Multiboot on: January 22, 2018, 04:18:19 AM
For maximum rig density nothing can beat Linux distros because they can handle those new boards with 19 available slots. ethos and smos are very popular but may have monthly fees per rig. Windows 10 has resource issues with some boards and can't do the insane density linux can.

If you're going to be using AMD cards then Windows is easier to flash BIOS and control voltages. Windows has the pain that is forced Windows updates - not a problem for those who know how to shut it down. Windows is more stable with mixed AMD/nVidia rigs. Windows tends to mine a tad bit faster than linux distros.

As far as uptime, they're the same. I've had rigs some stay up for over 6 months straight and only come down because of a power outage or cleaning.

Most would say pick the OS you're most comfortable with.
16  Alternate cryptocurrencies / Mining (Altcoins) / Re: Best 2/3 Graphic Cards to Buy? on: January 22, 2018, 04:09:05 AM
nVidia cards are very easy to set up for near optimal performance and require only about 1 hour to fine tune a rig of 6 cards. A 6 card AMD rig will require over 6 hours of time to fine tune and get stable after flashing BIOS.

Having said that, my AMD cards are currently earning 5x the rate of their nVidia counterparts on a $ basis - they just excel when tweaked.

This last December run has seen nVidia outsell AMD for mining.
17  Alternate cryptocurrencies / Mining (Altcoins) / Re: GPU fans after a year of running on: January 22, 2018, 12:27:34 AM
That's why I love the Sapphire dual ball bearing X-Fans. One screw to take off the fan for maintenance and cleaning and no wires to run or deal with. Replacements are $12.50 each including shipping from Sapphire and they are super easy to replace.






Yeah I stayed away from Sapphire ever since the 6950/7950 days. I changed every single fan on over 30 6950 because every one failed in 2 years and some of the ones on my 7950s I changed more than 3 times. I guess Sapphire got sick of RMAs for fans and improved their fan quality and modular design.

I have yet to have a single Twin Frozr fan fail - they must protect from dust intrusion really well.

6 out of the 10 sapphires I’ve had have failed me. I will never buy a sapphire again. This is not even fan related. I RMA’d one but it came back to me unable to mine.

The VRMs on those 280X Dual-X were also crap. There are at least 10 posts here of people who had their card burn or entire rigs catch on fire because of bad VRMs.  You combine bad fans plus cheap VRM cooling and you have high failure rate. That cards did mine well when they weren't busy dying.
18  Alternate cryptocurrencies / Mining (Altcoins) / Re: GTX 1060 Ethereum rig on: January 22, 2018, 12:08:11 AM
Thank all you guys, at this point I'll wait for the RX 570/580...

570/580 are great for ETH, but they admittedly a major pain in the ass to set up. AMD has been getting progressively harder and harder to mine with. I have 6870s and 7970s that were so easy to mine BTC and scrypt with, and then monero. I was able to mine ETH but only with some fuss on R9 380s and 390s. RX 470s needed bios mod and lots of tweaking on each card, and the 570/580 are even pickier.

If you're willing to put in the time tweaking then go AMD. If you want to set it and forget it buy the 1060s and buy ETH with the equihash coin you mine.
19  Alternate cryptocurrencies / Mining (Altcoins) / Re: AsRock H81 PRO BTC R2.0 Does not start BIOS, no POST on: January 21, 2018, 05:08:09 PM
It sounds silly, but make sure the CPU 12V is plugged in all the way. When the fan spins but I get no video from Igfx or PCIe then that is usually the cause. if that doesn't work try clearing the CMOS or trying a different RAM stick/slot.
20  Alternate cryptocurrencies / Mining (Altcoins) / Re: Which are the best mining pool there today to invest with 100 percent trust? on: January 21, 2018, 04:58:17 PM
More than 95% of cloud mining has proven to be a scam or incompetent failure over the past 5 years. There's several threads detailing the failings of cloud mining.

You're asking for the best company out of the "built for failure" setup.... sounds like asking for which cancer has the best mortality rate.

The best option is to avoid them all together, "none of the above" is unfortunately the best option.

If you don't want to mine then consider buying the coins directly from an exchange.
Pages: [1] 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 »
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!