Bitcoin Forum
April 25, 2024, 10:16:36 AM *
News: Latest Bitcoin Core release: 27.0 [Torrent]
 
   Home   Help Search Login Register More  
Warning: One or more bitcointalk.org users have reported that they strongly believe that the creator of this topic is a scammer. (Login to see the detailed trust ratings.) While the bitcointalk.org administration does not verify such claims, you should proceed with extreme caution.
Pages: « 1 [2] 3 4 »  All
  Print  
Author Topic: Monero dice seed hacked?  (Read 4060 times)
BetKing.io
Legendary
*
Offline Offline

Activity: 1400
Merit: 1021



View Profile WWW
October 18, 2016, 05:11:44 PM
 #21

The way this guy was betting, was clearly to show that he could cheat. IMO this could have 2 reasons:

If the attack was super simple (e.g. the server was blindly giving the user the server seed) it's also possible it was a non-sophisticated attacker that got hold it of it, and was just dumb enough to not even try to cover his tracks better.  I actually believe this recently happened to PrimeDice in their latest upgrade, with something along the lines of the beta server was a fork of the production server and someone realized this and revealed their server seed and abused the crap out of it to the point it was super obvious. I also heard about another bitcoin site where someone social engineered their way into getting root credentials to the server, but was sufficiently unsophisticated he couldn't figure out how to withdraw the bitcoins.


That said, this is basically a nightmare situation for an investment site. Let's say they suspect or find out that the attacker actually had been abusing this before, who should be on the hook? The investors or the site? Kind of strange how no site ever clarifies that

I've said it to the investors before (noticed FAQ used to say it but not now after re-enabling investments a long time ago) that if this happens (or any big mess up) the investors lose/pay for it. That's the risk they take investing in the site/me.

Fortunately this hasn't ever happened at BetKing anyway.
1714040196
Hero Member
*
Offline Offline

Posts: 1714040196

View Profile Personal Message (Offline)

Ignore
1714040196
Reply with quote  #2

1714040196
Report to moderator
1714040196
Hero Member
*
Offline Offline

Posts: 1714040196

View Profile Personal Message (Offline)

Ignore
1714040196
Reply with quote  #2

1714040196
Report to moderator
Unlike traditional banking where clients have only a few account numbers, with Bitcoin people can create an unlimited number of accounts (addresses). This can be used to easily track payments, and it improves anonymity.
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction.
1714040196
Hero Member
*
Offline Offline

Posts: 1714040196

View Profile Personal Message (Offline)

Ignore
1714040196
Reply with quote  #2

1714040196
Report to moderator
BillyBurns (OP)
Sr. Member
****
Offline Offline

Activity: 429
Merit: 263


View Profile WWW
October 18, 2016, 05:17:03 PM
 #22

Fluffy I see the site bankroll went back up from 60k to 140k now... but I see people betting currently but my account still has taken the massive losses from that player.

 *Image Removed*
fluffypony
Donator
Legendary
*
Offline Offline

Activity: 1274
Merit: 1060


GetMonero.org / MyMonero.com


View Profile WWW
October 18, 2016, 05:39:30 PM
 #23

Fluffy I see the site bankroll went back up from 60k to 140k now... but I see people betting currently but my account still has taken the massive losses from that player.

You don't have any invested in the bankroll? Is your investment on another account?

BillyBurns (OP)
Sr. Member
****
Offline Offline

Activity: 429
Merit: 263


View Profile WWW
October 18, 2016, 05:47:36 PM
Last edit: October 18, 2016, 05:59:23 PM by BillyBurns
 #24

Fluffy I see the site bankroll went back up from 60k to 140k now... but I see people betting currently but my account still has taken the massive losses from that player.

You don't have any invested in the bankroll? Is your investment on another account?

I divested and withdrawal what was left right after I saw his rolls.

-16.660736590630 Xmr, ( Don't know if all loses were from him but I assume a large portion of it was) I was only invested on site for around 20 hours before I divested.

Deposit Hash
c7a2edb767827fb3d32d58150a7cfa3c1d855c83bf7a3e3a134b23abbcd1778a

Withdrawl Hash
c9cf4173c48e773ce85f84b0fb6a3a6e80e7a51a0665cbf00d1783ea20e1ddba

 *Image Removed*
fluffypony
Donator
Legendary
*
Offline Offline

Activity: 1274
Merit: 1060


GetMonero.org / MyMonero.com


View Profile WWW
October 18, 2016, 06:55:52 PM
 #25

Fluffy I see the site bankroll went back up from 60k to 140k now... but I see people betting currently but my account still has taken the massive losses from that player.

You don't have any invested in the bankroll? Is your investment on another account?

I divested and withdrawal what was left right after I saw his rolls.

-16.660736590630 Xmr, ( Don't know if all loses were from him but I assume a large portion of it was) I was only invested on site for around 20 hours before I divested.

Deposit Hash
c7a2edb767827fb3d32d58150a7cfa3c1d855c83bf7a3e3a134b23abbcd1778a

Withdrawl Hash
c9cf4173c48e773ce85f84b0fb6a3a6e80e7a51a0665cbf00d1783ea20e1ddba

Ah - yeah, then you wouldn't have benefited from things being put right since you weren't part of the bankroll any longer, and didn't even have funds still on the site. In a situation like this we can't really compensate for people who have taken their funds out the site.

Pif
Member
**
Offline Offline

Activity: 153
Merit: 18


View Profile
October 18, 2016, 09:20:54 PM
 #26

Your seed was someway hacked, some investor was losing a lot because of this ( and it is your fault just to state clearly how I see it) and tried to limit their losses.

Basically now they are the only one who suffered a loss because you have that great security measure for which you manually process every withdrawal.

From an external point of view it's kind of ridicolous... but if I was an investor I would be very disappointed.

It could be seen also as an inside job to keep some of investors money... but Am just putting it here as a provocation and not something I really think.
fluffypony
Donator
Legendary
*
Offline Offline

Activity: 1274
Merit: 1060


GetMonero.org / MyMonero.com


View Profile WWW
October 18, 2016, 10:19:13 PM
 #27

Your seed was someway hacked, some investor was losing a lot because of this ( and it is your fault just to state clearly how I see it) and tried to limit their losses.

Basically now they are the only one who suffered a loss because you have that great security measure for which you manually process every withdrawal.

From an external point of view it's kind of ridicolous... but if I was an investor I would be very disappointed.

It could be seen also as an inside job to keep some of investors money... but Am just putting it here as a provocation and not something I really think.

Nobody lost any money, you're confused.

Herbet Fry
Sr. Member
****
Offline Offline

Activity: 812
Merit: 253


●Social Crypto Trading●


View Profile WWW
October 18, 2016, 11:06:41 PM
 #28

Why do you even care ? If he is clever and can hack then shame for you. He found a way into the system so good for him. Ga!nbling sites mostly bitch so its good to see someone got them back.

BillyBurns (OP)
Sr. Member
****
Offline Offline

Activity: 429
Merit: 263


View Profile WWW
October 18, 2016, 11:10:26 PM
Last edit: October 19, 2016, 01:34:32 AM by BillyBurns
 #29

Your seed was someway hacked, some investor was losing a lot because of this ( and it is your fault just to state clearly how I see it) and tried to limit their losses.

Basically now they are the only one who suffered a loss because you have that great security measure for which you manually process every withdrawal.

From an external point of view it's kind of ridicolous... but if I was an investor I would be very disappointed.

It could be seen also as an inside job to keep some of investors money... but Am just putting it here as a provocation and not something I really think.

Nobody lost any money, you're confused.

I lost? I was invested in the roll for the entirety of that guys bets he did not make 1 bet that I wasn't apart of( From all the ones I pasted) the other 30k he won that I didn't see I may or not have been but we should be able to know since I know nearly what % of the roll i had invested before I deposited 20 hours ago. I'm not some dude trying to scam you if you look in the crypto-games thread, the support sent me a extra 81 ether 2 days ago  in 1 of my withdrawals and I sent it back.

How can you claim no investors lost when, I deposited 32 Xmr and 20 hours later my Xmr is worth 15 Xmr...... I only divested and cashed out because it was evident to me he was cheating after I looked at those rolls and I somehow get punished for alerting you guys and acting in a intelligent way. I'm assuming I alerted you since I posted in chat my suspicion, then emailed support with a title Seed been hacked. Then pmed Nico with my suspicion, then I requested a withdrawal that was sent while there were no indicators of anyone aware of the hacker other than the hacker and I, also I didn't see his rolls happening, I just opened a tab saw all those bets, no bets were made after I had noticed the seed was compromised.

If all his wins were re-added to the bankroll then my funds would have been re-added to the bankroll because he did in fact win my Xmr...  So since I can verify he did in fact win my Xmr and I can verify you guys did in fact add his wins back to the bankroll where does the extra Xmr he wins that were originally my investment end up?

 *Image Removed*
moooonu
Hero Member
*****
Offline Offline

Activity: 560
Merit: 500



View Profile
October 19, 2016, 01:06:11 AM
 #30

Player is up 66k XMR in 2 days these are the rolls that just happened.. I didn't see the others but this just doesn't seem right to me.


7908821   3000.000000000000   +3000.000000000000   <49.50   46.38   07:23   PolakPotrafi
7908820   3000.000000000000   +3000.000000000000   >50.50   57.52   07:22   PolakPotrafi
7908819   1400.000000000000   +5600.000000000000   >80.20   81.28   07:22   PolakPotrafi
7908818   789.600000000000   +7106.400000000000   <9.90   2.06   07:21   PolakPotrafi
7908817   1535.200000000000   +6140.800000000000   <19.80   13.15   07:21   PolakPotrafi
7908816   935.200000000000   +8416.800000000000   >90.10   94.58   07:20   PolakPotrafi
7908815   1.000000000000   -1.000000000000   >80.20   45.19   07:20   PolakPotrafi
7908814   1.000000000000   -1.000000000000   >80.20   51.31   07:20   PolakPotrafi
7908813   1.000000000000   -1.000000000000   >80.20   24.50   07:19   PolakPotrafi
7908812   1.000000000000   -1.000000000000   >80.20   42.30   07:19   PolakPotrafi
7908811   1.000000000000   -1.000000000000   >80.20   60.60   07:19   PolakPotrafi
7908810   1.000000000000   +4.000000000000   >80.20   84.71   07:19   PolakPotrafi
7908809   1.000000000000   +4.000000000000   >80.20   87.64   07:19   PolakPotrafi
7908808   1.000000000000   -1.000000000000   >80.20   28.28   07:19   PolakPotrafi
7908807   1.000000000000   -1.000000000000   >80.20   32.78   07:19   PolakPotrafi
7908806   1.000000000000   +4.000000000000   >80.20   87.45   07:19   PolakPotrafi
7908805   100.000000000000   +400.000000000000   <19.80   17.08   07:19   PolakPotrafi
7908804   100.000000000000   +200.000000000000   <33.00   28.76   07:19   PolakPotrafi
7908803   100.000000000000   +100.000000000000   <49.50   44.78   07:18   PolakPotrafi
7908802   100.000000000000   +100.000000000000   >50.50   51.85   07:18   PolakPotrafi
7908801   100.000000000000   +100.000000000000   <49.50   18.59   07:18   PolakPotrafi
7908800   100.000000000000   +100.000000000000   <49.50   37.56   07:18   PolakPotrafi
7908799   100.000000000000   +100.000000000000   >50.50   72.20   07:18   PolakPotrafi
7908798   100.000000000000   +100.000000000000   >50.50   57.99   07:18   PolakPotrafi
7908797   100.000000000000   +100.000000000000   >50.50   62.63   07:18   PolakPotrafi
7908796   938.800000000000   -938.800000000000   <9.90   90.87   07:17   PolakPotrafi
7908795   1.000000000000   +1.000000000000   >50.50   88.01   07:15   PolakPotrafi
7908794   1.000000000000   +1.000000000000   >50.50   99.63   07:13   PolakPotrafi

That's a hell of will. Well it can be due to seed compromise. But I know a few players who can roll more greens than him in a row. So may be its 10% skills and 90% luck. Well if he knows exactly what's gonna come next he should not have those reds. I hope that he don't cheat. If he cheated bum his ass Smiley
Lutpin
Copper Member
Legendary
*
Offline Offline

Activity: 1876
Merit: 1874


Goodbye, Z.


View Profile WWW
October 19, 2016, 01:08:43 AM
 #31

That's a hell of will. Well it can be due to seed compromise. But I know a few players who can roll more greens than him in a row. So may be its 10% skills and 90% luck. Well if he knows exactly what's gonna come next he should not have those reds. I hope that he don't cheat. If he cheated bum his ass
Do you always comment without reading the threads first?
This is a 1.5 page thread, it doesn't take much of your time to read through it and get an idea of the situation, but it seems you stopped doing so right after OP.

Go read the thread, then read your comment and think for 3 seconds, please.

So since I can verify he did in fact win my Xmr and I can verify you guys did in fact add his wins back to the bankroll where does the extra Xmr he wins that were originally my investment end up?
I'd be interested in this aswell, how did you determine which investor got which part of the secured funds back once you rolledback the clearly compromised bets?

▄▄█████████▄▄
▄█████████████████▄
▄████▀▀▀▀█████▀▀▀▀████▄
████▀██████▀█▀██████▀████
██████████████████████████
▐█████▄███████████████▄█████▌
▐███████▄▄█████████▄▄███████▌
▐██████▀█████████████▀██████▌
▐███████████████████████████▌
▀██████████████████████▀
▀████▄████▄▀▀▄████▄████▀
▀███████▀███▀███████▀
▀▀█████████████▀▀
  ▀▀▀▀▀▀▀▀▀
   ███████
██████████
██████████
██████████
██████████
██████████
██████████
██████████
██████████
██████████
██████████
██████████
███████



             ▄████████████████████████████████████████████████████████████▄
            ██                          ▄▄▄▄▄▄                           ██
           ██  ██████                ▄██████████▄     ████████████████████▀
          ██  ████████             ▄████▀   ▀████▄    ████▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀
         ██  ████  ████           ████▀       ▀██▀    ████
        ██  ████    ████        ▄███▀                 ████

       ██  ████      ████       ███▀                  ████▄▄▄▄▄▄▄▄▄▄
      ██  ████        ████      ███                   ██████████████
     ██  ████          ████     ███▄                  ████▀▀▀▀▀▀▀▀▀▀

    ██  ████████████████████    ▀████                 ████
   ██  ██████████████████████    ▀████▄        ▄██▄   ████

  ██  ████                ████     ▀████▄   ▄████▀    ████▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄
 ██  ████                  ████      ▀██████████▀     ████████████████████▄
  ██                                    ▀▀▀▀▀▀                           ██
   ▀█████████████████████████████████████████████████████████████████████▀
ndnh
Legendary
*
Offline Offline

Activity: 1302
Merit: 1005


New Decentralized Nuclear Hobbit


View Profile
October 19, 2016, 02:19:29 AM
 #32

So since I can verify he did in fact win my Xmr and I can verify you guys did in fact add his wins back to the bankroll where does the extra Xmr he wins that were originally my investment end up?
I'd be interested in this aswell, how did you determine which investor got which part of the secured funds back once you rolledback the clearly compromised bets?

I think probably it is added back to the investors at the time of adding back. So if someone divested, he won't get anything, but if someone invested, he would get a share of the added back amount Huh
RHavar
Legendary
*
Offline Offline

Activity: 2557
Merit: 1886



View Profile
October 19, 2016, 02:22:15 AM
 #33

I think probably it is added back to the investors at the time of adding back. So if someone divested, he won't get anything, but if someone invested, he would get a share of the added back amount Huh

Yeah, that's how it sounds like. Actually when I designed the moneypot investment system, what I did was create a repayable log of all the investment/divestment/bet events for in a nightmare situation like this (or software bug) it could be replayed so investors wouldn't have made/lost money from the changes in the bankroll when a fake better (or software bug) was playing.

The situation is probably a big mess now, as some investors have lost more than they should've and others made more than they should've. And it's probably pretty likely the ones who unfairly made money have already withdrawn (?) or at the very least, will be unhappy if their balance gets put to the correct amount

Check out gamblingsitefinder.com for a decent list/rankings of crypto casinos. Note: I have no affiliation or interest in it, and don't even agree with all the rankings ... but it's the only uncorrupted review site I'm aware of.
fluffypony
Donator
Legendary
*
Offline Offline

Activity: 1274
Merit: 1060


GetMonero.org / MyMonero.com


View Profile WWW
October 19, 2016, 06:01:02 AM
 #34

I lost? I was invested in the roll for the entirety of that guys bets he did not make 1 bet that I wasn't apart of( From all the ones I pasted) the other 30k he won that I didn't see I may or not have been but we should be able to know since I know nearly what % of the roll i had invested before I deposited 20 hours ago. I'm not some dude trying to scam you if you look in the crypto-games thread, the support sent me a extra 81 ether 2 days ago  in 1 of my withdrawals and I sent it back.

How can you claim no investors lost when, I deposited 32 Xmr and 20 hours later my Xmr is worth 15 Xmr...... I only divested and cashed out because it was evident to me he was cheating after I looked at those rolls and I somehow get punished for alerting you guys and acting in a intelligent way. I'm assuming I alerted you since I posted in chat my suspicion, then emailed support with a title Seed been hacked. Then pmed Nico with my suspicion, then I requested a withdrawal that was sent while there were no indicators of anyone aware of the hacker other than the hacker and I, also I didn't see his rolls happening, I just opened a tab saw all those bets, no bets were made after I had noticed the seed was compromised.

If all his wins were re-added to the bankroll then my funds would have been re-added to the bankroll because he did in fact win my Xmr...  So since I can verify he did in fact win my Xmr and I can verify you guys did in fact add his wins back to the bankroll where does the extra Xmr he wins that were originally my investment end up?

His wins weren't re-added to the bankroll based on the prior state, they were re-added based on the state of the system at the time we were re-adding it. The state of your part of the bankroll at that time was 0, so you don't benefit from that.

Let me put it differently: you saw the errant bets and you divested and withdrew your money, in a panic and at a loss. What if the attacker had gotten away with his withdrawals, and we had to socialise the loss? Would you deposit your money back in to participate in that?

In a situation like this you, as a participant in the bankroll, have your funds invested at risk. Everyone takes the same risk, and gets the same reward. If you try and circumvent a scenario you are effectively cutting your losses, come what may, and it isn't reasonable to turn around afterwards and expect an outcome that is any different.

Look, if the $100 you lost in this scenario is completely untenable then we'll personally send you 15 XMR from the site profits.

I'd be interested in this aswell, how did you determine which investor got which part of the secured funds back once you rolledback the clearly compromised bets?

Based on the investor roll at the time of the distribution out. Because there had been users created and withdrawals / deposits processed in the meantime, we couldn't simply roll the database back.

I think probably it is added back to the investors at the time of adding back. So if someone divested, he won't get anything, but if someone invested, he would get a share of the added back amount Huh

Yep exactly; there wasn't any other way to do that that wouldn't have added insane amounts of complexity to the process, and potentially left the data in an extremely broken state.

Yeah, that's how it sounds like. Actually when I designed the moneypot investment system, what I did was create a repayable log of all the investment/divestment/bet events for in a nightmare situation like this (or software bug) it could be replayed so investors wouldn't have made/lost money from the changes in the bankroll when a fake better (or software bug) was playing.

The situation is probably a big mess now, as some investors have lost more than they should've and others made more than they should've. And it's probably pretty likely the ones who unfairly made money have already withdrawn (?) or at the very least, will be unhappy if their balance gets put to the correct amount

We already have a replayable log (that's the point of the MySQL log after all), but we couldn't rewind the entire system. Consider, for instance, a new user that created an account and deposited funds. If we roll the system state back we would have to manually allocate all of those and manually recreate the users. And, too, consider the exact issue we've got above, where a user divested and withdrew - how do you roll that back? You can't, so you have to move forward with the system in the current state.

NLNico
Legendary
*
hacker
Offline Offline

Activity: 1876
Merit: 1289


DiceSites.com owner


View Profile WWW
October 19, 2016, 06:42:20 AM
Last edit: October 19, 2016, 07:01:41 AM by NLNico
 #35

I understand the risk is on the investors too and the situation would have been different if the cheater managed to withdraw all the money.

But the cheater didn't get any of it, so if you do rewind the cheater's bets, it seems very obvious that you should refund to the affected investors. To suggest otherwise seems ridiculous to me. And to give free money to people who invested after the whole situation seems even more crazy.

Let me put it differently: you saw the errant bets and you divested and withdrew your money, in a panic and at a loss.
That seems like a normal thing to do. If I see a site is hacked, obviously my first reaction is to withdraw my own money. You must be pretty stupid to not immediately make sure your left-over money is safe.

Because there had been users created and withdrawals / deposits processed in the meantime, we couldn't simply roll the database back.
You shouldn't roll the whole database back, you should look which investors got affected by the cheater and how much they lost. In theory just the rolls and invest/divest information, should be sufficient. I understand it's technically tricky and needs some custom script to calculate, but that seems like the only fair way.

EG: you have the invested amounts of the current investors. Loop all events (= all bets + divests/invests) from latest to start of cheater. First event is probably some real bet after the cheater, recalculate what the invested amounts where before that bet. Second event same. If event is a invest/divest, adjust invested amounts too. Then when you reach the last bet of cheater, you should have all the info of which investors were invested at that time including the amount. Separately save how much they lost (or gained) in that cheater's bet. Continue loop and if the event is a cheater's bet, do the same. All till you are back to the first cheater's bet. IMO after this, you should have a list of investors with specific amounts of how much they lost? Reimburse those amounts to the investors.

What if the attacker had gotten away with his withdrawals, and we had to socialise the loss? Would you deposit your money back in to participate in that?
BillyBurns already made a loss from the cheater? So if you decided the losses were on the investors, nothing would have changed? He wouldn't need to deposit - he is already in loss.




edit: TBH I am not sure how many investors actually divested like BillyBurns. If he is the only one, things are probably more easy :x But just the mindset of refunding the investors who actually lost money seems important to me.

Pif
Member
**
Offline Offline

Activity: 153
Merit: 18


View Profile
October 19, 2016, 07:21:04 AM
 #36

Your seed was someway hacked, some investor was losing a lot because of this ( and it is your fault just to state clearly how I see it) and tried to limit their losses.

Basically now they are the only one who suffered a loss because you have that great security measure for which you manually process every withdrawal.

From an external point of view it's kind of ridicolous... but if I was an investor I would be very disappointed.

It could be seen also as an inside job to keep some of investors money... but Am just putting it here as a provocation and not something I really think.

Nobody lost any money, you're confused.

I lost? I was invested in the roll for the entirety of that guys bets he did not make 1 bet that I wasn't apart of( From all the ones I pasted) the other 30k he won that I didn't see I may or not have been but we should be able to know since I know nearly what % of the roll i had invested before I deposited 20 hours ago. I'm not some dude trying to scam you if you look in the crypto-games thread, the support sent me a extra 81 ether 2 days ago  in 1 of my withdrawals and I sent it back.

How can you claim no investors lost when, I deposited 32 Xmr and 20 hours later my Xmr is worth 15 Xmr...... I only divested and cashed out because it was evident to me he was cheating after I looked at those rolls and I somehow get punished for alerting you guys and acting in a intelligent way. I'm assuming I alerted you since I posted in chat my suspicion, then emailed support with a title Seed been hacked. Then pmed Nico with my suspicion, then I requested a withdrawal that was sent while there were no indicators of anyone aware of the hacker other than the hacker and I, also I didn't see his rolls happening, I just opened a tab saw all those bets, no bets were made after I had noticed the seed was compromised.

If all his wins were re-added to the bankroll then my funds would have been re-added to the bankroll because he did in fact win my Xmr...  So since I can verify he did in fact win my Xmr and I can verify you guys did in fact add his wins back to the bankroll where does the extra Xmr he wins that were originally my investment end up?

That was the exact point of my previous post but seems like fluffpony missed it answering

Nobody lost any money, you're confused.

Your site didn't lose a single monero, seedhacker didn't get any monero from your site (not this time at least but you should investigate the past if you already didn't) yet at least one of your investor had their investiment cut in half.

@fluffpony maybe you are the confused  one.

Pif
Member
**
Offline Offline

Activity: 153
Merit: 18


View Profile
October 19, 2016, 07:28:30 AM
 #37

I understand the risk is on the investors too and the situation would have been different if the cheater managed to withdraw all the money.

But the cheater didn't get any of it, so if you do rewind the cheater's bets, it seems very obvious that you should refund to the affected investors. To suggest otherwise seems ridiculous to me. And to give free money to people who invested after the whole situation seems even more crazy.

Let me put it differently: you saw the errant bets and you divested and withdrew your money, in a panic and at a loss.
That seems like a normal thing to do. If I see a site is hacked, obviously my first reaction is to withdraw my own money. You must be pretty stupid to not immediately make sure your left-over money is safe.

Because there had been users created and withdrawals / deposits processed in the meantime, we couldn't simply roll the database back.
You shouldn't roll the whole database back, you should look which investors got affected by the cheater and how much they lost. In theory just the rolls and invest/divest information, should be sufficient. I understand it's technically tricky and needs some custom script to calculate, but that seems like the only fair way.

EG: you have the invested amounts of the current investors. Loop all events (= all bets + divests/invests) from latest to start of cheater. First event is probably some real bet after the cheater, recalculate what the invested amounts where before that bet. Second event same. If event is a invest/divest, adjust invested amounts too. Then when you reach the last bet of cheater, you should have all the info of which investors were invested at that time including the amount. Separately save how much they lost (or gained) in that cheater's bet. Continue loop and if the event is a cheater's bet, do the same. All till you are back to the first cheater's bet. IMO after this, you should have a list of investors with specific amounts of how much they lost? Reimburse those amounts to the investors.

What if the attacker had gotten away with his withdrawals, and we had to socialise the loss? Would you deposit your money back in to participate in that?
BillyBurns already made a loss from the cheater? So if you decided the losses were on the investors, nothing would have changed? He wouldn't need to deposit - he is already in loss.




edit: TBH I am not sure how many investors actually divested like BillyBurns. If he is the only one, things are probably more easy :x But just the mindset of refunding the investors who actually lost money seems important to me.


agree on all the line
fluffypony
Donator
Legendary
*
Offline Offline

Activity: 1274
Merit: 1060


GetMonero.org / MyMonero.com


View Profile WWW
October 19, 2016, 07:52:39 AM
 #38

I understand the risk is on the investors too and the situation would have been different if the cheater managed to withdraw all the money.

But the cheater didn't get any of it, so if you do rewind the cheater's bets, it seems very obvious that you should refund to the affected investors. To suggest otherwise seems ridiculous to me. And to give free money to people who invested after the whole situation seems even more crazy.

We made a decision on how to handle it at the time, under pressure, to the best of our ability. You are welcome to disagree with that decision, but unless you're in that scenario running your own site your opinion is largely meaningless. It's easy to look at it after the fact and go "well I would have done X" - I can think of any one of 30 different ways we could have handled things.

That seems like a normal thing to do. If I see a site is hacked, obviously my first reaction is to withdraw my own money. You must be pretty stupid to not immediately make sure your left-over money is safe.

So then you cut your losses and you get out, the end. There is no coming back later on to try reclaim imagined profit.

Perhaps a comparison will help: let's say that you have 10 BTC in Poloniex. You hear that Poloniex isn't processing BTC withdrawals, along with panic that they're hacked, and use your BTC to buy a bunch of WaffleCoin and withdraw it. You sell your WaffleCoin on ShapeShift, but now the market's tanked and you end up with 9 BTC. Later that day Poloniex put out a statement apologising for the issues and stating that they're now fixed. Would you insist that they roll the trades back? What about the shorters that took profit from you?

Or what if you invested in a startup, and then when it looked like things were going south you sold your investment at a loss. Two years later the startup is a huge, successful company. Do you insist on taking profit from the growth because you *used to be* an investor?

You shouldn't roll the whole database back, you should look which investors got affected by the cheater and how much they lost. In theory just the rolls and invest/divest information, should be sufficient. I understand it's technically tricky and needs some custom script to calculate, but that seems like the only fair way.

EG: you have the invested amounts of the current investors. Loop all events (= all bets + divests/invests) from latest to start of cheater. First event is probably some real bet after the cheater, recalculate what the invested amounts where before that bet. Second event same. If event is a invest/divest, adjust invested amounts too. Then when you reach the last bet of cheater, you should have all the info of which investors were invested at that time including the amount. Separately save how much they lost (or gained) in that cheater's bet. Continue loop and if the event is a cheater's bet, do the same. All till you are back to the first cheater's bet. IMO after this, you should have a list of investors with specific amounts of how much they lost? Reimburse those amounts to the investors.

We thought about this, but we decided that it would be too dangerous for us to spend days and weeks trying to build a magical "undo" script, completely wrecking any auditability, and potentially ending up with a screwed up data set at the end.

BillyBurns already made a loss from the cheater? So if you decided the losses were on the investors, nothing would have changed? He wouldn't need to deposit - he is already in loss.

edit: TBH I am not sure how many investors actually divested like BillyBurns. If he is the only one, things are probably more easy :x But just the mindset of refunding the investors who actually lost money seems important to me.

With all respect to the affected investor, he took his $100 loss and walked away. He didn't contact us, he didn't ask for input on how we were going to handle things. He just assumed that it was the end, and he would have been the *only* investor to get out with his money had we not had safeguards and had the attacker been able to actually drain the wallet. What would have happened then?

You stated at the outset that you understand that the situation would have been different had the attacker managed to withdraw, but you're not actually following that thought through. Had that played out we'd have a total loss on the part of all the investors, and one investor who only incurred a $100 loss, and you can bet that investor wouldn't volunteer to divvy up his remaining funds among the affected investors.

Ultimately you're asking us to take up a morally hazardous position. What happens when someone "accidentally" places a large bet and loses? Should we undo their bet, and take the profits from the investors? An investor that divests and withdraws is no longer part of the bankroll. They bailed out with a profit or with a loss, and that's the end of that.

Nevertheless, I've already offered to send $100 to the affected investor, so I'm not sure what more you expect?

MafiaCoin
Full Member
***
Offline Offline

Activity: 182
Merit: 100


View Profile
October 19, 2016, 07:53:58 AM
 #39

Player is up 66k XMR in 2 days these are the rolls that just happened.. I didn't see the others but this just doesn't seem right to me.


7908821   3000.000000000000   +3000.000000000000   <49.50   46.38   07:23   PolakPotrafi
7908820   3000.000000000000   +3000.000000000000   >50.50   57.52   07:22   PolakPotrafi
7908819   1400.000000000000   +5600.000000000000   >80.20   81.28   07:22   PolakPotrafi
7908818   789.600000000000   +7106.400000000000   <9.90   2.06   07:21   PolakPotrafi
7908817   1535.200000000000   +6140.800000000000   <19.80   13.15   07:21   PolakPotrafi
7908816   935.200000000000   +8416.800000000000   >90.10   94.58   07:20   PolakPotrafi
7908815   1.000000000000   -1.000000000000   >80.20   45.19   07:20   PolakPotrafi
7908814   1.000000000000   -1.000000000000   >80.20   51.31   07:20   PolakPotrafi
7908813   1.000000000000   -1.000000000000   >80.20   24.50   07:19   PolakPotrafi
7908812   1.000000000000   -1.000000000000   >80.20   42.30   07:19   PolakPotrafi
7908811   1.000000000000   -1.000000000000   >80.20   60.60   07:19   PolakPotrafi
7908810   1.000000000000   +4.000000000000   >80.20   84.71   07:19   PolakPotrafi
7908809   1.000000000000   +4.000000000000   >80.20   87.64   07:19   PolakPotrafi
7908808   1.000000000000   -1.000000000000   >80.20   28.28   07:19   PolakPotrafi
7908807   1.000000000000   -1.000000000000   >80.20   32.78   07:19   PolakPotrafi
7908806   1.000000000000   +4.000000000000   >80.20   87.45   07:19   PolakPotrafi
7908805   100.000000000000   +400.000000000000   <19.80   17.08   07:19   PolakPotrafi
7908804   100.000000000000   +200.000000000000   <33.00   28.76   07:19   PolakPotrafi
7908803   100.000000000000   +100.000000000000   <49.50   44.78   07:18   PolakPotrafi
7908802   100.000000000000   +100.000000000000   >50.50   51.85   07:18   PolakPotrafi
7908801   100.000000000000   +100.000000000000   <49.50   18.59   07:18   PolakPotrafi
7908800   100.000000000000   +100.000000000000   <49.50   37.56   07:18   PolakPotrafi
7908799   100.000000000000   +100.000000000000   >50.50   72.20   07:18   PolakPotrafi
7908798   100.000000000000   +100.000000000000   >50.50   57.99   07:18   PolakPotrafi
7908797   100.000000000000   +100.000000000000   >50.50   62.63   07:18   PolakPotrafi
7908796   938.800000000000   -938.800000000000   <9.90   90.87   07:17   PolakPotrafi
7908795   1.000000000000   +1.000000000000   >50.50   88.01   07:15   PolakPotrafi
7908794   1.000000000000   +1.000000000000   >50.50   99.63   07:13   PolakPotrafi

That's a hell of will. Well it can be due to seed compromise. But I know a few players who can roll more greens than him in a row. So may be its 10% skills and 90% luck. Well if he knows exactly what's gonna come next he should not have those reds. I hope that he don't cheat. If he cheated bum his ass Smiley

I think he is lucky only. how hack seed? it's impossible.
fluffypony
Donator
Legendary
*
Offline Offline

Activity: 1274
Merit: 1060


GetMonero.org / MyMonero.com


View Profile WWW
October 19, 2016, 08:11:58 AM
 #40

I think he is lucky only. how hack seed? it's impossible.

We found the bug he exploited that leaked the seed, and we've subsequently patched it.

Pages: « 1 [2] 3 4 »  All
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!