Network Attack on XVG / VERGE

[variable42]

we were going to reduce the 2 hour drift to 15 minutes, then i brazenly chose 30 seconds. 2 * 15 is 30 seconds which is our blocktime. we decided not to go with that as blocktimes do vary a bit.

No, you didn't. You copied and pasted code from peercoin without fully understanding it, a la https://github.com/peercoin/peercoin/pull/93/commits/4281cb55b04600189bff4f0c8a92e042b34e75f8.

2 * 60 * 60 makes sense as a way to show **2** hours.

2 * 15 doesn't make any sense, if 30 seconds is your desired value. You'd simply just write 30 if that were the case.
2 * 15 is a mistake made by a programmer trying to depict 15 minutes, as the comment indicates.

In this case, you weren't even the programmer who made the original mistake. You were a copy & paste monkey who didn't catch it. Which is fine, but rather than own up to your mistake, you try to invent a reason to make yourself look better.

This is not trustworthy behavior.

[ktru19]

thanks started mining again hopefully no more issues
[/quote]
Can you tell me on which pool are you mining?
[/quote]

yiimp.eu

[Patuba]

is this safe to mine again? seeing its back up on yiimp pool

I would say no. I have been mining on the yiimp pool for over an hour and have 0 confirmed blocks.

You need to wait until you have 140 confirmations; which you don't have yet-- that's why you haven't been paid.

It has usually been pretty fast in the past. That's why I assumed it wasn't good yet. I've looked at the oldest one and it's up to 119 confirmations so I'll know in a little bit if it's good.

Everything has been going alright on yiimp pool.

thanks started mining again hopefully no more issues

Can you tell me on which pool are you mining?

yiimp.eu - using X17

[blindgatsby]

Some people are mistaking "being attacked" as being transparent. Something actually happening isn't "drama" - it's truth and facts. Just because someone brings something up and to the point that it's happening and a huge problem isn't someone stirring up drama. Quit being a child and fix your coin.

and here it is the first brand new message from a brand new account! This predicable FUD start to annoy please use more intelligent method to spread it!

Chill ghosthunter. I've been lurking a while and nothing has ever made sense to comment on but when I see adults, or so I think, thinking everything is ad hominem or similar I wanted to reply. I've never held verge so maybe I don't have a bet in this but I develop so relax. Did I say anything for FUD-use? No. OCMiner has pointed out a large issue and all you can think is "stop spraying negativity on my coin".

1)I stated fact, your account is brand new and that was your first message

2)I don't own any Verge

3)Ocminer had a very wrong behavior. You first talk to devs let sort them out a quick fix, then explain to the world what is happening. Not the "vice versa".

4)This is a drama because what happened sucks but a fixed went out and by quoting CryptoYeff

at the end of the day what did we lose? 20-30 million coins--- who gives a sh!t-- means nothing compared to max supply---- we lost half a day of mining? not the end of the world.

There is a LARGE difference between "stating fact" and also accompanying it with "This predicable FUD" about my said first message. You were not only coming after my brand new account, but that you believed it has a direct purpose.

And you don't own any verge? Your posts from January seem to say you were at least mining it which would mean you do own. Unless you've sold off thus far. Make me incorrect please.

Unfortunately it would seem in this environment and given the communications provided it was seen as a "non-issue" in particular. It was seen as 'stabilizing'.. what? The first round ended and it had tapered off - so in this portion neither you or I know if the dev's were going to do anything. I'd tend to swing more toward the fence of it not being care about. When something is occurring and it seems to dissipate, and maybe it's just me, I want to know why/what was happening.

The fix. Well,.. I'll let that one speak for itself.

[Hypercube]

Besides a shiny website and a custom Qt client, Verge never had features unique from any other coin. Pumping prices with the supply and funding they have is easy, so there might still be upside possibilities but I would consider it a risky play if they decide to pull the plug at some point.

[emmanmalaman]

I hope they can fix or negative this attack as I'm planning to get back to verge in a few weeks or month's time as soon as I get my dough! 

[Scout Georgenson]

Waow, is this technology going to be provided in all of the blockchains in the nearest future?

[StarLawl]

Everyone forgot how Supernova conducted an attack 51 on Bitcoin Gold?

Explain how this where done? Why did he do that? And is there an underlying reason for starting the FUD fest in public like he did?

[blindgatsby]

Everyone forgot how Supernova conducted an attack 51 on Bitcoin Gold?

Explain how this where done? Why did he do that? And is there an underlying reason for starting the FUD fest in public like he did?

I too would like some more information on this anyway. Why does everyone use FUD for anything from someone saying 'this coin sucks' to actual evidence something is really wrong?

I tried googling the above ^, bitcoin gold and suprnova. I couldn't come up with anything.

[KimJungUn]

What a mess.  There's a reason why verge is a joke among the community.

Verge is a scam and the developers are too incompetent to actually do anything.  Everyone could smell a scam a mile away and it smells like Verge.

[Praetorian.1legion]

Recently made a hacker attack on Verge. Attack on the crypto currency lasted more than 3 hours. At the same time, the network did not accept the blocks that ordinary miners produced. There is an assumption that the attack on Verge was initiated not by an individual hacker, but by a government organization.

[blindgatsby]

we were going to reduce the 2 hour drift to 15 minutes, then i brazenly chose 30 seconds. 2 * 15 is 30 seconds which is our blocktime. we decided not to go with that as blocktimes do vary a bit.

No, you didn't. You copied and pasted code from peercoin without fully understanding it, a la https://github.com/peercoin/peercoin/pull/93/commits/4281cb55b04600189bff4f0c8a92e042b34e75f8.

2 * 60 * 60 makes sense as a way to show **2** hours.

2 * 15 doesn't make any sense, if 30 seconds is your desired value. You'd simply just write 30 if that were the case.
2 * 15 is a mistake made by a programmer trying to depict 15 minutes, as the comment indicates.

In this case, you weren't even the programmer who made the original mistake. You were a copy & paste monkey who didn't catch it. Which is fine, but rather than own up to your mistake, you try to invent a reason to make yourself look better.

This is not trustworthy behavior.

Good lord I had skimmed over that the first round of reading through the posts. He seriously did a copy-job on this. Showing code is one way to portray this, but this isn't that. It's the same mistake. Exactly. Twice. By two people. The second one here ripped it from the first.

He cheated on the test and the guy he cheated off of got it wrong.

[Alenth]

we are not doing a rollback and we are preparing a fork to patch this up.

Sorry to mess up this thread and topic a bit, but after i do not get for hours an answer on twitter, neither does the email function on the Verge homepage work, nor does someone respond on the Verge Bitcoin thread i have to try my luck here.

I visited some hours ago the official Verge Twitter profil to read the news about the hash hack. While reading the tweed i noticed several messages offering a compensation for the attack by Verge. Send x Eth and you get some bonus back. Sounded legit to me as it was affilated to the hash attack and i suffered from it as well having had some hours only orphaned blocks on all my baikals, hence i fall victim to this damn scam on the official twitter page.

Now, while i have myself for sure some vault for this i'am seriously angry about how on the official verge twitter page 100s of scams and fake messages that say they got the ETH back are tolerated and nobody cares about it?!?! How is this possible. After i realized i got scammed i even made a post in this tweet that its a scam and to remove it asap, nothing happened and people still fall after that scam. Only on that scam by now 12+ Eth have been transfered the last hours.

Damn, i'am not a twitter guy and very rarely use it, but from an official Verge twitter profil i personal await its clean and at very least if this for some reason is not possible that there are warning messages about these scams!!!! But no, nothing, the whole official Verge Twitter profil is FULL of scams that are tolerated and people like me, fall victims to it. Fine, i lost some 1.8 ETH, but hourly these scams seems to collect a huge amount of ETH that way and nobody there at Verge cares?

Seriously, so far i wondered about the twitter decision to ban crypto, but i begin to understand the decision. They must get shitload of complains from victims like me.....

And what makes me even more angry ... no response:
- Messaged some hours ago verge on twitter .... nothing, scams are staying and getting more and more
- Put a tweet on the Verge tweet to remove the scams .... nothing, scams are just staying there
- posted in the official bitcointalk Verge thread, nothing ......
- tried to email Verge about the ongoing scams .... email function on the homepage isn't even working, it just loads forever. And after 5 attempts to load it still loads after 2 hours, lol.

I'am writting this as a XVG miner and lover, but this all makes me really sad and angry .....

not sure if you thought we had the ability to delete them, but we dont. we have written to twitter about this. it's happening to all major coins right now. =\

I'am not a twitter guy, no idea about other coins or twitter in general, but yes, i thought you can either block, ban or delete such messages as the profil owner.
And as i wrote allready, if it is NOT possible for some reason, why no big warning on top?? I mean it seems you are aware of these 100's of scams on your official Verge profil, but people like me interested in XVG are not.

nothing can be done, this has happened even with Vitalik, cz and many other important figures. It is up to Twitter to do anything about them (keep in mind there are paid people saying "thank you for X ETH" in order to lure you).

Sorry for you man, These are the comments on etherscan:
https://etherscan.io/address/0x4c6Bad785Ffcf6c0746F53DBcAC9c5e877F75bfa#comments

One of the publishers who pump this is https://betanews.com/2018/04/05/verge-cryptocurrency-hack/
Send all your comments there to make them take responsibility!!

[crankycrypto]

And yes, I might be a bit upset there as well, sorry, next time I'll be more precise and "nice"

Great stuff. I normally pass on drama but wow that was fun to read.
Ocminer, you have the cyrpto spirit and what is right about crypto.

98% of these folks are money first. Money would have a developer to sweep sh t under the rug and keep running while the issue is fixed.
this woudl reduce the greatest fraud and loss to the end users. But true integrity would make an announcement, stop the system, fix and start again.  Yes this would/could give negative press, yes this could lower your coin price, yes you could get delisted. yes it is a bad day. But if  integrity  is greater than profits you will make the right choice.

Corporations and greed for profit has all but destroyed the human race. It's time to grow up.

It seems making a million a year is alot of money, till most make it. Then a million a month, then a week. When does it end?

Wealth is good, feels great but without integrity it is worthless, it becomes a means of distraction rather than wealth.

BTW, yes you got a little childish and very mean in your chat... but I loved it. lol

[lgwood01]

I was in the Verge/Discord room when OCMiner came in yesterday, that's where the initial conversation between him and VergeDEV went down, I saw it all live.  Here's my take on the situation if anyone wants to listen to a BTCTalk newb:

Verge/Discord is better than Verge/TG, but not by a huge degree.  People come in there all the time making wild accusations, trash talking the coin and DEV team, sometimes making threats etc.....it is sort of the wild west at times.

What I witnessed, was an un-established, newb Discord member, who's never been there and never been a member of the community come in and starts making all these accusations.  VergeDEV did just happen to be online so he took a step back to dig in and see what was happening.  In the meantime, OCMiner kept going on and on and on, being rude and somewhat demanding of VergeDEV and everyone else in there.....just like all the usual unknown trash talkers do when they come in the room.  What's even more annoying is he never announced himself as the guy who runs any pools, and that he might have intimate knowledge of what happening, just started trash talking right away.....and VergeDEV even asked him if he ran a pool and wanted to talk in private.....to which he never answered.  Then he continued being quite rude, making demands, until he got himself banned.  

I, myself, didn't even take him seriously for about 15 minutes until I started looking at my own miner and the block explorers because he was being quite unprofessional and rude to VergeDEV and everyone in the group as well.....like all the other trash talkers that stop by.

Do I agree that this has been handled by the Verge team in the best way possible?  No, but hindsight is 20/20.  But the way OCMiner conducted himself in a public chat room yesterday morning could have been compared to me walking into the middle of the US Capitol building with a mask over my face so no one could see me, and not identifying myself, screaming "someone is printing extra money at the federal reserve and taking it home with them" then demanding that they fix it right away over and over again while proclaiming this was the end of everything for Verge, among many other insulting things.  You can imagine how well that was received and how seriously he was taken at first.  

There is a reason when exploits are found in software, no matter if they are actively being exploited or not, if you want to minimize damage to all parties involved, you keep things quiet at first and take things through officials channels to allow a fix to be implemented so that others don't take advantage of the exploit right away, not blast it all over the interwebs.  

I work in internet/cyber security, and couldn't imagine the world if every time a security researcher who found an exploit in software or hardware immediately ran out and posted every detail about how it works before giving the software vendor/dev team a chance to patch the code?  Well, I can, and I would rather dig ditches for a living than try to do my current job if that's the way everyone operated when it came to bugs or security flaws.

That's my 2cents

[dillsp88]

Everyone forgot how Supernova conducted an attack 51 on Bitcoin Gold?

Explain how this where done? Why did he do that? And is there an underlying reason for starting the FUD fest in public like he did?

http://cryptoconsulting.info/2017/news/pool-suprnova-six-days-sabotaged-the-work-of-the-bitcoin-network-gold/

[jl777B]

I was in the Verge/Discord room when OCMiner came in yesterday, that's where the initial conversation between him and VergeDEV went down, I saw it all live.  Here's my take on the situation if anyone wants to listen to a BTCTalk newb:

Verge/Discord is better than Verge/TG, but not by a huge degree.  People come in there all the time making wild accusations, trash talking the coin and DEV team, sometimes making threats etc.....it is sort of the wild west at times.

What I witnessed, was an un-established, newb Discord member, who's never been there and never been a member of the community come in and starts making all these accusations.  VergeDEV did just happen to be online so he took a step back to dig in and see what was happening.  In the meantime, OCMiner kept going on and on and on, being rude and somewhat demanding of VergeDEV and everyone else in there.....just like all the usual unknown trash talkers do when they come in the room.  What's even more annoying is he never announced himself as the guy who runs any pools, and that he might have intimate knowledge of what happening, just started trash talking right away.....and VergeDEV even asked him if he ran a pool and wanted to talk in private.....to which he never answered.  Then he continued being quite rude, making demands, until he got himself banned.  

I, myself, didn't even take him seriously for about 15 minutes until I started looking at my own miner and the block explorers because he was being quite unprofessional and rude to VergeDEV and everyone in the group as well.....like all the other trash talkers that stop by.

Do I agree that this has been handled by the Verge team in the best way possible?  No, but hindsight is 20/20.  But the way OCMiner conducted himself in a public chat room yesterday morning could have been compared to me walking into the middle of the US Capitol building with a mask over my face so no one could see me, and not identifying myself, screaming "someone is printing extra money at the federal reserve and taking it home with them" then demanding that they fix it right away over and over again while proclaiming this was the end of everything for Verge, among many other insulting things.  You can imagine how well that was received and how seriously he was taken at first.  

There is a reason when exploits are found in software, no matter if they are actively being exploited or not, if you want to minimize damage to all parties involved, you keep things quiet at first and take things through officials channels to allow a fix to be implemented so that others don't take advantage of the exploit right away, not blast it all over the interwebs.  

I work in internet/cyber security, and couldn't imagine the world if every time a security researcher who found an exploit in software or hardware immediately ran out and posted every detail about how it works before giving the software vendor/dev team a chance to patch the code?  Well, I can, and I would rather dig ditches for a living than try to do my current job if that's the way everyone operated when it came to bugs or security flaws.

That's my 2cents

I thought ocminer used "ocminer" in the discord. He is a very well known person.

Also, this isnt any zeroday exploit that needs super secrecy anyway. It is a known exploit already done to other coins that cloned from the same upstream. It seems all attacks on those coins are attacks that could happen to XVG.

Does that need to be kept a secret? Did I just let random hackers on the internet know something they didnt already know?

[noicyminer]

I was in the Verge/Discord room when OCMiner came in yesterday, that's where the initial conversation between him and VergeDEV went down, I saw it all live.  Here's my take on the situation if anyone wants to listen to a BTCTalk newb:
That's my 2cents

Nice try to put some shit on ocminer....

Anyone can say opposite- any evidence ?

[usmanperwaiz]

Lendroid Support Token (LST) holders were airdropped Verge. I guess maybe they hacked Verge and mined 20M XVG and pleased their token holders. Check if they are behind this.

[ocminer]

So many newbies posting stuff here.. It's really funny

Just FYI..

Your second "fix".. Is still not working at all, the edit you have here:

https://github.com/vergecurrency/VERGE/blob/master/src/main.cpp#L2306-L2321

You also need here:

https://github.com/vergecurrency/VERGE/blob/master/src/main.cpp#L2219


One is for reading blocks from disk e.g. resyncing and the other is for accepting blocks via peers...