Is Bitcointalk forum compromised?

[Alex Zee]

I will repost from the Ripple forum:

Amazing the number of dormant accounts that never ever posted in BITCOINTALK.ORG that have come alive so that they can get Ripples. Look for any user with "JR.Member" and see how many post they have done. These accounts were created years ago and never had a single post until after the giveaway.

Almost half of the giveaway addresses on page 58 are from 2011 and never had a posting until today.

This approach to a giveaway is falling apart due to this abuse. Also results in a ton of spam postings.

An example: (easy to find)

RaducuIulianu
Registered Date: June 16, 2011, 09:23:04 AM
#Post: 6 (All on March 1st)
Ripple Account: rEiUFmQbeEJKmHdSTuCTfBwUAck6A8jfT5
Immediately moved to another account: rEiUFmQbeEJKmHdSTuCTfBwUAck6A8jfT5 which has a ton of 40K transfers to it.

What the...? This means Bitcointalk is either compromised or one of its admins got really low.

Maybe this has to do with the old hack that leaked some passwords and attacker has access to old accounts now?

This guy just gathers money from all acounts into this one:

raRuz7se7tqNQJECUWjJdqSnEAR3F2PgcK

and then caches them out to BTC via Bitstamp.

Anyway, I think this fraud has to stop. Both OpenCoin and Bitcointalk guys should do something about it!

Ripple has enough negative attitude towards it without such fraudulent, shady affairs.

EDIT:
Sorry, the original post is 1.5 months old, didn't notice the date so I guess it's not that urgent.

But still - was anything done about that? Did you try to figure out who the bad guy is?

[1715083278]

1715083278

[1715083278]

1715083278

[1715083278]

1715083278

[1715083278]

1715083278

[1715083278]

1715083278

[John (John K.)]

I will repost from the Ripple forum:

Amazing the number of dormant accounts that never ever posted in BITCOINTALK.ORG that have come alive so that they can get Ripples. Look for any user with "JR.Member" and see how many post they have done. These accounts were created years ago and never had a single post until after the giveaway.

Almost half of the giveaway addresses on page 58 are from 2011 and never had a posting until today.

This approach to a giveaway is falling apart due to this abuse. Also results in a ton of spam postings.

An example: (easy to find)

RaducuIulianu
Registered Date: June 16, 2011, 09:23:04 AM
#Post: 6 (All on March 1st)
Ripple Account: rEiUFmQbeEJKmHdSTuCTfBwUAck6A8jfT5
Immediately moved to another account: rEiUFmQbeEJKmHdSTuCTfBwUAck6A8jfT5 which has a ton of 40K transfers to it.

What the...? This means Bitcointalk is either compromised or one of its admins got really low.

Maybe this has to do with the old hack that leaked some passwords and attacker has access to old accounts now?

This guy just gathers money from all acounts into this one:

raRuz7se7tqNQJECUWjJdqSnEAR3F2PgcK

and then caches them out to BTC via Bitstamp.

Anyway, I think this fraud has to stop. Both OpenCoin and Bitcointalk guys should do something about it!

Ripple has enough negative attitude towards it without such fraudulent, shady affairs.

EDIT:
Sorry, the original post is 1.5 months old, didn't notice the date so I guess it's not that urgent.

But still - was anything done about that? Did you try to figure out who the bad guy is?

No, the forum itself was not compromised. Many old accounts were under the control of a few users who probably planned to use them to scam in the near future,(old accounts seem more credible to newbies) as there's no registering restrictions on the board.

[🏰 TradeFortress 🏰]

I highly doubt the forum is compromised, someone just made a lot of accounts in 2011.

This is a OpenCoin Inc's giveaway rules problem, not the forum's.

[Alex Zee]

I see. Then I guess it is indeed OpenCoin's problem of not filtering accounts properly.

Thanks for clarifying this.

[Maged]

I have seen an unusual amount of 2011 accounts in the whitelist thread in the past day, so something is up. I'll put in an IP lookup request.

[Maged]

Great work, everyone!

The following accounts have all been compromised and will be marked as a scammer until the real owner reclaims them:
anonameous, matthewdowns1128A1F5, williamsnider72, sarajasie0C2C, kellyhuta64, CrowdCrackingGroup, bryankfurw05, btclaw, Sandragutierre24Y, Bitcoinmaker, jeraldftizt65, SusanaMenor23, carsonchassy5, milardistone41, fiveletterword, min0r, iamstimpy, bitcento, pandapeluche, DigiZ, trusturtechnolust, AshShep, terrence, SwimsuitPaul, Miss_Magenta, ymfeeling, cspalmer2, Robert William Bonzi, uAbbieBartonq, pooraich, Powercoiner, leahsandes, AaronBreillat, susanakaul, cocopuffs1003, TheRonPaulKid, rockstarshorty21, chevo, errtest, jimmi12, miguelvuc

[Alex Zee]

Great work, everyone!

The following accounts have all been compromised and will be marked as a scammer until the real owner reclaims them:
anonameous, matthewdowns1128A1F5, williamsnider72, sarajasie0C2C, kellyhuta64, CrowdCrackingGroup, bryankfurw05, btclaw, Sandragutierre24Y, Bitcoinmaker, jeraldftizt65, SusanaMenor23, carsonchassy5, milardistone41, fiveletterword, min0r, iamstimpy, bitcento, pandapeluche, DigiZ, trusturtechnolust, AshShep, terrence, SwimsuitPaul, Miss_Magenta, ymfeeling, cspalmer2, Robert William Bonzi, uAbbieBartonq, pooraich, Powercoiner, leahsandes, AaronBreillat, susanakaul, cocopuffs1003, TheRonPaulKid, rockstarshorty21, chevo, errtest, jimmi12, miguelvuc

Wow, thanks!

[Maged]

More:
brigitte2378sack, balmut051, joan48ellis, lfelicols12t, emoryyrer96, conradinoz76, stevguthie7, diegospensi7, headhunter, edwinaphan7, hilarioprnce7, bitboy999, Lavada, Lang, azerty6757, MSTRKRFT, KatiHahnA, AreYouCereal, ndawg4554, DrZaius

Let us know if you find more accounts that might be compromised and we'll look into it.

[pekv2]

Great work, everyone!

The following accounts have all been compromised and will be marked as a scammer until the real owner reclaims them:
anonameous, matthewdowns1128A1F5, williamsnider72, sarajasie0C2C, kellyhuta64, CrowdCrackingGroup, bryankfurw05, btclaw, Sandragutierre24Y, Bitcoinmaker, jeraldftizt65, SusanaMenor23, carsonchassy5, milardistone41, fiveletterword, min0r, iamstimpy, bitcento, pandapeluche, DigiZ, trusturtechnolust, AshShep, terrence, SwimsuitPaul, Miss_Magenta, ymfeeling, cspalmer2, Robert William Bonzi, uAbbieBartonq, pooraich, Powercoiner, leahsandes, AaronBreillat, susanakaul, cocopuffs1003, TheRonPaulKid, rockstarshorty21, chevo, errtest, jimmi12, miguelvuc

More:
brigitte2378sack, balmut051, joan48ellis, lfelicols12t, emoryyrer96, conradinoz76, stevguthie7, diegospensi7, headhunter, edwinaphan7, hilarioprnce7, bitboy999, Lavada, Lang, azerty6757, MSTRKRFT, KatiHahnA, AreYouCereal, ndawg4554, DrZaius

Let us know if you find more accounts that might be compromised and we'll look into it.

Holy shit, O.O. That is a ton of cleaning you did there. Great job. That's nuts.

[Raize]

Has anyone run all of our MtGox-hack reverse engineered passwords on user accounts created pre-August 2011? My guess is some of those may be sleeper-scammers...

I know the hash list was posted, but no doubt many crackers have a list of the passwords that were simple 10-character alpha-numeric or less, or is selling it. If such a list was obtained, theymos or another admin could run an offline-pass on them to make sure none of these old accounts are using an easily-compromised password?

[LanYu]

Reposting this here. I had the following exchange tony with a man named Tony coming from the e-mail tonycicc@gmail.com

I received the following email today, to an email that is not even the one listed on my forum account.

Hi I saw you are on bitcointalk.org forum and wondered if you would be willing to sell me your account for $15?   I see you haven’t been on there in quite a while, so perhaps you don’t need the account.

 

I could make a new acct, but I don’t want to go through the newbie waiting period before I can post in the main forums, so I would like an active account.   Let me know and I could Paypal you the money or send you the equivalent in BTC.  Just let me know.  Thanks.

I sent the following follow up email

I am a bit curious, what leads you to conclude that I am on the
bitcointalk.org forum?

And he replied back with the following

Hi, I believe your email address was listed on the site as being someone who
registered but hadn't used their account much, at least recently.  So I just
looked through the member list and emailed a few people from there.   But
can send the funds if you no longer need that acct or just want to make a
new one.  Thanks.

Very curious...

[FreddyFender]

This was the troll-pile from June 11-19, 2011 or the Cosby Caper compromise? Did we not narrow the culprits down to SA or other known affiliates?

[Alex Zee]

Not sure if this would help in any way, but these are Ripple addresses of those accounts:

rDhVzGdgqFXSrfrN8KKZQB2pX4xKh3iVyC (bitboy999)
r9svLtQiemyWcFg6vPn24qhs2Sht33s5cR (conradinoz76)
rB8RWdnR55NfgZtShdjhXCK3xGUYj3vexf (brigitte2378sack)
rKt4ekuGetbXA7q6JrZm7QEQHtbFhGktz1 (MSTRKRFT)
rJKAcretphkuRbKDB3DTpGnL6nMuyLHMb (hilarioprnce7)
rMXDo4eStcmfUxsXRX2f5ZoNNothQsjhx4 (joan48ellis)
r9mtCWNFv1MxgFRSet1D61pLfygCCPrtWj (balmut051)
r45T1nnNs3NDt4YHFXBzF51dbruB8p5Jhb (lfelicols12t)
rsC1p9rw141YhhPCDfrZZARcHp2ndXdebD (Lang)
rQE4DkEvt5Qq3dsAPMLwKf56zqHFfdNHGH (emoryyrer96)
r325Q2BxE6t9cvGXA92uFDyz8C3M9xfaZg (williamsnider72)
rBPj5VfS2waceRPJPLDFkN9mfQ9bo9zQXC (stevguthie7)
r372dvURUzhPSvbn5K3q8inJJVVb2z95JE (diegospensi7)
r3Mdx8bT9uALRLSK71xdKNZpd7v25rEDrg (headhunter)
rEb4nthyGnAPk78sJx4idMVhwxNMDWLVXp (edwinaphan7)
rMBGtDiR1F1uH9nwqE7N8KaRkpXsfXf7cL (KatiHahnA)
rMvf6AgUxN3bhFD46t7bmR289Jy63xaHFM (azerty6757)
raFiQmqTqs2XNcjwcerN7be2WfjttBsBnC (Lavada)
rfXEx4zne69Z2x7ReEtWAeztJLZKix4zQS (Miss_Magenta)
r3fjAaRqdfFyHQx4UxVzBWRe1WFHcbjN1P (uAbbieBartonq)
razBoFtQUpKbHxrxWMDqYF5ZtS8UJU1sRW (milardistone41)
rKSzNoRgQJqZUPmEkuJpk4f3mgyJLb3GYL (terrence)
rNxU8S7bXN4UhZbXZ5xg4Aj3n7DbsvarUt (TheRonPaulKid)
rfiyDF4eLVEeuvUeN41vNwLhuk2JsFP6Je (carsonchassy5)
ra7mx76b7EZW1tYf3U9rZy9mhMs834Wbep (fiveletterword)
rwK6AfyK3xeK9z7zGw5Gg32i36ZhtYemvu (btclaw)
rMafHLLeAGP3kfF3pC1mLAmFe5yLjV6hce (AshShep)
rwd3oJyjDrPDJBsErgGUewXct2Zau2FT98 (trusturtechnolust)
rDVKnGmdAEhhc8Z7HEGgXZKvZeJQ5VfmGU (Powercoiner)
rD7cNJuRaJ4FETfGLzD59DsxVHarVQF7Yd (iamstimpy)
rMgHwn8wsbpwNHE7kpmracsj4tKeY2BScZ (Bitcoinmaker)
rUmeNtAhArrXcjHgCqRAREndj17dwpDuzX (matthewdowns1128A1F5)
rB9tVCg26Cg5uWdcUqJwgESQ77daU1FKrT (sarajasie0C2C)
rwg9WdYkEjB53FV3mvmhf3zJ6JaNxxQv6M (kellyhuta64)
rJeu3rujHHpjw6Naip38dbE7eCMQX9sgq3 (bryankfurw05)
rwynwQCh7NrcZrtxF3t5BhWGEUkCQ18NSX (Sandragutierre24Y)
rfGdFc1oAHGAHTWkuwsgUk8h7mThQ4j97Y (jeraldftizt65)
rDQ41x6AGCYrKDW3urdk2hhdvTh4umcJ1S (jimmi12)
rpMw3EhdL22dYdgD5PrpFGpzPQjsMG9hqH (Robert William Bonzi)
rN9TidskfqEFoo24KWEjLDMnaqNUK5Qns4 (anonameous)
ra4vvH2QN9WBFwLbVsNwxoeSo6UxgRsypW (errtest)
r3E7BAh2y6hn78qr9sfVjbwomcJ5rkf1sH (CrowdCrackingGroup)
r499UL6MtkiaM2Ed2KkVyWoWDj3G3a9MT1 (min0r)
rB3M9ok35xFTpvvmXdCPsJedXJ3EwDwKCv (DigiZ)
rNrwLxNysdcVDZkN4z5XY9fSQ3T5X4Vsxr (SwimsuitPaul)
rKUYBZuPSqtAHW1NUNSTQkoht4qww6uyME (pandapeluche)
rHQQCaoGLYPHRiJqCiijqKqCACFRMZEGDw (chevo)
rfVVEVuL7jsmmrPVFEPXbeU6TpDnArN3Q5 (leahsandes)
rMeWMDEQC14J7VAPFaGSD2RGJPPkSM94Dq (AaronBreillat)
rLA9W5T5D6SHQ6ytwiwPNcaPsQnrtJFeJJ (SusanaMenor23)
rE1hqUzyZ8jHX3SrUvuPHaNpAky65H9zEU (cspalmer2)
rUSYXJ9KtBVBeM9HBh6xTxT5EQYmUF5gMQ (pooraich)
rLzyiamW4zuxugtxQv3zLz6EG73XEJdKje (rockstarshorty21)
rf6fwW4NJuFBFJtzXNRr9ea5LH2zkdLicn (ymfeeling)
rDATKR6K3ab774sjxiSTb3aV1qVLnuhLq8 (cocopuffs1003)
rnwGcAVEBPeihFBSS2PcHYH8GBatpRJ3oc (bitcento)

[deedee_1987@hotmail.com]

Hi,
please some administator contact me.
Susana tryed to talk with theymos a few days but he hasn't answer. She sent PM.

I also requested the ripple giveaway, and I'm sure in the same IP that some of these guys (already received)

If you run a simple TRACE on the IP you understand why we have the same IP....it is from our UNIVERSITY CAMPUS, and I think I don't need to explain why the out IP is the same.

One of the guys told us to reactivate the accounts to ask the ripple giveaway, so we did it... we are all in the same campus, and created during the time of BTC, but were never active. Now that we had the chance to get some free ripples to exchange (what some have already made with BTC), we activated again... nothing illegal I think :\

Please some moderator give me a contact, you can contact each and any of the persons that they will answer you.
we can send ID on all of us to a admin, just tell what you need.

Sorry for the long text.

regards

[Maged]

Hi,
please some administator contact me.
Susana tryed to talk with theymos a few days but he hasn't answer. She sent PM.

I also requested the ripple giveaway, and I'm sure in the same IP that some of these guys (already received)

If you run a simple TRACE on the IP you understand why we have the same IP....it is from our UNIVERSITY CAMPUS, and I think I don't need to explain why the out IP is the same.

One of the guys told us to reactivate the accounts to ask the ripple giveaway, so we did it... we are all in the same campus, and created during the time of BTC, but were never active. Now that we had the chance to get some free ripples to exchange (what some have already made with BTC), we activated again... nothing illegal I think :\

Please some moderator give me a contact, you can contact each and any of the persons that they will answer you.
we can send ID on all of us to a admin, just tell what you need.

Sorry for the long text.

regards

No, all of those accounts were used by the same person. I personally checked each account to prevent this exact problem from happening. For example, please tell me how this account wasn't compromised:
https://bitcointalk.org/index.php?action=profile;u=31850;sa=showPosts

And yes, I'm sure you have plenty of fake IDs. You probably got them from the same place you got these accounts. Now, you could argue that you bought these accounts legitimately (since we allow that here), but since they all posted in the Ripple thread and were owned by a single person, that still qualifies for a scammer tag.

[deepceleron]

deedee_1987@ : another account registered in 2010 with NO posts until now - the same slimeball attempting to social engineer.

One does wonder the vector here - are these accounts hacked, or did one entity just make many forum users? The creating IP address should let someone determine their sockiness.

[scintill]

No, all of those accounts were used by the same person. I personally checked each account to prevent this exact problem from happening. For example, please tell me how this account wasn't compromised:
https://bitcointalk.org/index.php?action=profile;u=31850;sa=showPosts

I agree it's suspicious, but anyone care to point out what's particularly damning about the post history?  I noticed the second-to-last "ok thanks" post was surrounded by other short, useless replies with scammer tags in that thread.

Also curious, if it's appropriate to reveal, was the IP really owned by a university?

[deedee_1987@hotmail.com]

I'm sorry to say, but what is the problem of having that spam posts saying hello?

all of the guys sayed something with no sence since there were restrictions on the forum and we could not post in the ripple giveaway.

I don't know what is the forum problem in us having a free ripple offer. It doesn't qualify as a scam, does it?
And we sure don't spam the rest of the forum.

this was supposed to be a FREE forum, open, and not like a government. (my opinion)

thanks

[myrkul]

this was supposed to be a FREE forum, open, and not like a government. (my opinion)

Yup, it's not like a government. Which means you don't get a vote.

This is private property. And not yours.

[deedee_1987@hotmail.com]

i know it's not mine, it's of the community

at least it was why the founder made it, dont you agree?

Where can we send our ID's ? real members, not spam or scam

[myrkul]

Maged says you're a scammer, and all the accounts are the same person.

I tend to believe him.

I hope you didn't spend too much on those accounts.

[deedee_1987@hotmail.com]

yes, I asked maged to confirm that information by PM message.
I also offered to help confirm the identity of the persons.

I can assure you all the accounts were registered in our campus, not by the same person.
It was incentivated by one of our colleagues that wanted to trade with us, but are all legitimate accounts. Therefore I don't understand why they have to be marked Scam...

I just think is a bit unfaire, but....

[John (John K.)]

Spammers and scammers should rot the in coldest spot in hell. *looks in spambox*
Anyway, I'm quite sure that Maged is correct here. In case you didn't read, the forum policy specifically points out that spam is a bannable offense here anyway, and pointless posts are counted as spam.

[deedee_1987@hotmail.com]

by the forum rules is mandatory everyone makes 5 posts of "spam" to be allowed to post where we want.

Even so, we all tryed to say something "usefull". And all in the newbies section, of course.

So, we are not spammers nor scammers.

We are of the IT course, all with legitimate accounts, legitimate e-mails, everything correct.

[organofcorti]

I'm a developer, registered a long time ago, and now back to the game...

What exactly did you develop?

[theymos]

You're not from a university IP.

[John (John K.)]

by the forum rules is mandatory everyone makes 5 posts of "spam" to be allowed to post where we want.

Even so, we all tryed to say something "usefull". And all in the newbies section, of course.

So, we are not spammers nor scammers.

We are of the IT course, all with legitimate accounts, legitimate e-mails, everything correct.

No, spam is not allowed. I tend to delete such posts when I see them in the newbie subsection.

[myrkul]

You're not from a university IP.

Probably not named DeeDee, or born in 1987, either.

[deedee_1987@hotmail.com]

check the ip's of the usernames you marked spam, and see if it's from the university IP

please check facts, not posts... 

[theymos]

check the ip's of the usernames you marked spam, and see if it's from the university IP

please check facts, not posts... 

The one I checked was from telepac.pt, same as you.

No, spam is not allowed. I tend to delete such posts when I see them in the newbie subsection.

Me too. I also ban people who post nothing but insubstantial garbage.

[deedee_1987@hotmail.com]

let me give a sugestion, if you don't want spam posts from newbies, remove the limitation on the 5 posts.
and put a 2 way registration check (mobile for example)
avoyds this kind of confusion, limits the amount of accounts each person can create, etc etc

about the spam in newbie area, if I want to comment on a different topic outside the newbie section, what is the alternative before the 5 posts?
check on particular post and just say my opinion? It's always spam if I'm just talking...


thanks anyway
dee

[Alex Zee]

deedee_1987, the other side of the issue is that many of these accounts transfered XRPs to one 'master' account and then just cashed it out. I don't have time to trace all of them, maybe Ripple folks would help with some scripts, but a few that I checked manually seem to follow this pattern. And this does make it look like a scam.

For example, here is joan48elis:

https://ripple.com/graph/#rMXDo4eStcmfUxsXRX2f5ZoNNothQsjhx4



How nice.

I also wonder, why did you mention Susana? Is it because she didn't get anything, right? So her address won't look suspicious? Clever boy!

P.S. That, by the way, is about 1,500 dollars at the current price. Not bad for one account. Way to go, Joan 48!

[deedee_1987@hotmail.com]

hi alex,

As I wrote before, we all registered the accounts because one of the guys told us to do it (he wanted to buy our accounts, but we ended up selling him the XRP directly.)

And as I also wrote, we exchange our XRP with BTC, but not with that exchange rate 

about the suspicious activity you say about susana, if that would be correct I wouldn't post here with my accout, since I also received the ripples and sold to him... right?

as it look suspicious I will not insist in this idea, but I still think is very unfaire

besides this question, I have no moral authority to say anything, since I haven't been a colaborator in the forum, and many of the guys posted in this topic have spent weeks of their lives in BTC forum teaching others.

regards to all

[Alex Zee]

...we all registered the accounts because one of the guys told us to do it...

What are you all slaves or something?

And as I understand, you have a time machine too? So this guy told you to register because he wanted XRPs and your group of students quickly jumped back to 2011 and registered all these accounts?

[RodeoX]

i know it's not mine, it's of the community

at least it was why the founder made it, dont you agree?

Where can we send our ID's ? real members, not spam or scam

What University? Perhaps someone could visit and meet ALL of you for lunch?

[Alex Zee]

And what an interesting choice of nicknames for a group of Portugal students...

joan48elis - I assume she's your teacher, right? 48 is probably her age.

williamsnider72 and emoryyrer96 - what a diverse group of students! Community college?

bryankfurw05 - are there lots of Bryans in Portugal?

TheRonPaulKid - of course, Ron Paul is big in Portugal.

This looks more and more believable...

[Raize]

Worth noting, Ripple's entire system is designed to be "gamed" in this fashion. One guy accumulates~500k of XRP and trades it to one of these poor other guys that is exchanging for BTC without realizing this is probably one of the dumbest ideas ever contrived. The scarcity of Bitcoin is built-in to the algorithm. The developers cannot simply change it, the miners have to also accept it. With Ripple, the scarcity of XRP is done by decree, which we all know provides a single point of failure: the developers. Worse still, this acts just like any other pre-mined alt-coin.

TL;DR: Those of you buying and participating in Ripple are getting scammed. Maybe not today or tomorrow, but you're certainly going to get scammed.

[Matthew N. Wright]

TL;DR: Those of you buying and participating in Ripple are getting scammed. Maybe not today or tomorrow, but you're certainly going to get scammed.

Statistically this applies to Bitcoiners too.  

[Alex Zee]

With Ripple, the scarcity of XRP is done by decree, which we all know provides a single point of failure: the developers.

I don't think that's accurate - when the system is properly distributed it will be as hard to change as bitcoin limit. But let's not hijack the topic There are plenty of Ripple pro/con topics here already.

[Raize]

My apologies. I didn't mean to steer the thread in a different direction. I just see this as the end-game of Ripple, creating multiple identities helps you benefit from the system, so it encourages more and false participation, much like dead people voting in elections. I would venture to guess this is just a sysadmin for a small college, or someone using listserve creation permissions to create multiple accounts.

[myrkul]

I would venture to guess this is just a sysadmin for a small college, or someone using listserve creation permissions to create multiple accounts.

At best.

Much more likely it's someone who bought a bunch of IDs from someone, and did a shitty job of hiding his IP.