Network Attack on XVG / VERGE

[variable42]

Perhaps to be most helpful you could make these comments on github where the developer can actively respond.

He did.

https://github.com/vergecurrency/VERGE/issues/685

[boxalex]

Following the whole thread and having read really every message and post on it i would like to share my personal opinion:

- great thx to ocminer. I personally see that every technical post he made makes absolutly sense and has its obvious logic. Too bad that there are too many arrogant people here. The Verge devs should have listened to him from beginning and i'am pretty sure the issue would have not gone that way.

- again great thx to ocminer for posting it and making XVG miners aware what happens. I think miners and other pool owners should have the right to know whats going on with a coin they are mining. At least, we XVG miners are part of XVG as well, maybe something that Verge has forgotten allready.

- even one more thx to ocminer for his stance in this case and taking the side of the miners. At least for me, suprnova is now a 1st class pool i thrust and whenever possible i will use it. 1% donation to show and honor such open discussion and defending the miners point of view and interest.

About Verge/XVG:

- Until today i was a Verge fan, Verge miner, Verge holder (with about 200k XVG, not a whale but still), Verge hoper because it was an underdog in my opinion and i like underdogs that make it up.

- This whole issue (and some others) has shown to me that the Verge team is not really interested in its miners, followers, holders, investors, you call it .... They write off some 20m+ XVG as it was nothing. About the legit miners that mined over hours only orphaned blocks, nothing. I guess the pool owners as well are in the negative with these "hacked" blocks.

- Than the noobish fix, backroll, you have read about it all the pages bevor, no need to comment it again. Seriously, this is not the approach i want by a coin i like and have hope in. Absolutly not. Its the approach of a Noob team that just has made a coin, not more and not less. Not even anymore sure if its really such privacy coin as it pretends to be.

- Than again thinking about it. What to await from a team that even does not manage to have a working email on its homepage? Whats left for some skilled programming?

- Here again a point that just makes it clear how you actually threat your followers: Huge amount of followers get scammed on your twitter threads. Scammed users cry for some ad/banner/warning to have others warned. Only thing you comment is " we get alot of messages about it, but seeing as there is absolutely nothing we can do about it right now, those messages are not a priority." Seriously? You can  not add a simple warning message on your twitter messages? Spare me the "other coins have the same problem", as we talk here about XVG. So having daily your followers nonstop scammed is not one of your priorities?? Adding a simple warning message which takes about 2s is not possible? It isn't even more about the scam, its about you are unwilling to do the very least someone of you team could do to prevent YOUR followers to get scammed, but 0 interest in it.

- Than the chat with ocminer. The only thing you worried about was that he made it public, again 0 interest in fixing actually the problem and hack. You Verge guys really make me believe that you are not interested in fixing whatever. Only in this thread i have seen at least 4 - 5 high level technical experts you could have taken good advice from. You even give shit about some of the best pools around, again evidience that you do not care about your base and people involved in XVG as pools and miners are the backbone of your currency, at least imo.

- Verges only luck seems to be a lot of desperate XVG holders that hope some day to make a fortune holding that 0.03 - 0.05$ coin raising to US$ 1 (this would be at least by market cap #4). The question is if it is possible that a coin really can make it up based on luck and day dreamers?! Time will show. I personally will follow ocminer and get my hands of XVG, selling my little XVG holding and not mining it anymore. Sometimes in life principles should be stronger than just profit thinking. I just do not feel good supporting anymore a project that gives shit about its followers, miners, pools, investors, believers, ......

Just my 2 cents and satoshis

[CA_TD_investor]

One is for reading blocks from disk e.g. resyncing and the other is for accepting blocks via peers...

http://cdn.someecards.com/someecards/usercards/1341502017158_5104234.png 
Just FYI, this is probably what you're dealing with.

[buzzkillb]

I've no leg in this I'm just here for the popcorn.

But as a rule of thumb: when someone as ancient as ocminer pats you on the shoulder and tells you something: you sit down and listen.

Sunerok clearly needs lessons in humbleness.

Couldn't agree more. I've been following this thread all day for the back and forth entertainment.

If I was part of the Verge team I'd have worked together with ocminer and even paid him for help if I couldn't handle it myself. I've been mining on his pools for years now. Always does an excellent job supporting his own infrastructure and is known as a stand up member in the crypto community. More pool operators should follow oc's lead.

As for the vulnerability being disclosed privately vs. publicly it really doesn't matter in this instance.

1) ocminer was not the attacker
2) the attack was already taking place without significant public contact/updates by the Verge team as to what was happening
3) ocminer did not disclose technical details to the public in any form where someone could take the information and replicate the attack themselves

I don't feel it's necessary to add my personal opinions on the Verge blockchain however it's very clear that if the developers need help, ASK FOR IT. There is no shame in seeking help when you're overwhelmed. Remember that blockchains are supposed to be decentralized, open source, and contributed to by anyone with the means to do so, not a self contained dictatorship.

I am not surprised an older member is putting some proper logic and reason into this thread. You guys contacting the SEC and then others are wondering why regulations are being brought down heavy onto crypto. Wanting to see this stuff fail is completely insane.

I know XSH has a temp fix already out and are working on a proper fix now.

[badfad]

I'm suprised that so many people (miners and hodlers) are shocked at suneroks dude behaviour, I mean you took him seriously  

[CA_TD_investor]

Hey, guys! Tell me, is it possible the same attack on other coins, which also alternate algorithms? For example, is it Ravencoin or Pigeoncoin? And in general, all algorithms in the family of X (X11 and so on)?

from what i saw, it is definitely in several other coins. i did a quick search on github and found many others. to save them the headache of what we just went through, i am not going to name them here though.

 

You could you know... help them like OCMINER tried to help you.   I mean it certainly would save face. 

[CA_TD_investor]

hmmm...

https://github.com/deroproject/dero/blob/ac08e492592168b24a0c60da80adef2ce1a4d151/src/cryptonote_basic/difficulty.cpp#L3

How do you have time for THIS when the coin is still vulnerable?

[Motngay2002]

Okay guys, as the shit keep hitting the fan harder and harder here I need to take a few steps to actually end that drama for me:

Suprnova will not reopen any of it's XVG/Verge pools for mining whatsoever. You can mine it freely on any different pool if you like. Withdrawals are possible of course.

The background is that the "fix" promoted by the devs simply won't fix the problem. It will just make the timeframe smaller in which the blocks can be mined / spoofed and the attack
will still work, just be a bit slower.

Also the over 20 Million XVG which were instamined by the attacker won't be blacklisted, reverted, filtered or rolled-back in anyway according to the verge-dev, so in my opinion you all (the miners and investors) got betrayed about that 20 M coins .. For some it might be only a few coins, for some it might be a lot.. For some this might all be drama for them, I see you there of course..

Just to clarify a few last things:

1. The fix won't fix it. The problem is not alone the drifttime, but also the algo variance. You have to make sure that not X blocks get mined on one algo.
    Myriad and digibyte had the same issues - they fixed it.

    Here's a possible fix for the issues: https://github.com/digibyte/digibyte/pull/15

    Please DON'T just merge the code like you see it in that commit, you need to actually find the right places in your code and merge it. It's a slightly different codebase, so it won't work
    with just copy & paste, you actually have to understand and rewrite it to fit to your needs.


2. It's possible to blacklist certain addresses within the blockchain. So if you know on which addresses hacked funds reside, you can simply "blacklist" them directly in the codebase of the coin.
    For example you know that the attacker has used address "123abc123acb123abc" as the root for his hacked funds. You can now - at anytime - update your wallet code and just say
    "orphan all transactions with the root address "123abc123acb123abc". So even if the hacker moves the funds NOW or in one year, it won't happen as you've blacklisted the originating address.
    This was done previously also, not on myriad but on another coin - I can also find that commit for you.


3. I was getting blamed for "judging" too early and posting this info publicly on bitcointalk. I've mixed feelings about this.. Yes, I could have spoken silently to the devs at first and tell them "hey,
    something weird is going on on your blockchain" - however in the same time my miners were asking why the pool wasn't finding blocks and I already saw the first tweets about "skimming" and    
    stuff.. So.. What to do ? Keep the info about the hacker silent with the devs and wait 3-4 days for a (non-working) fix and get my reputation killed totally or just go for a public post about it
    and shutdown the pools ? I know, it's a difficult decision and my decision might have been wrong, but hey, I'm neither the attacker nor am I the guy responsible for the coin..  Also I was a bit
    astonished that I was actually the first to report the problem.. I was expecting devs watch their coin closely and come up with fixes upfront.. or at least know about what happend.

    In my opinion the optimal handling for this problem probably would have been something like this:

   1. Contact pools and exchanges to shutdown mining and trading
   1a. Tweet/Inform miners about the problem and tell them it's been worked on but takes it's time.
   2. Talk about possible problems and mitigation practices with devs/exchanges and pools.. Create a "conference room" for this for example and invite all necessary people there.
   3. Find a resolution, roll back the chain or at least filter the malicious coins (as someone as a (big) advantage here which he shouldn't, or?? So some others have a big disadvantage, or not ?)
   4. Go back online with the resolution and back to mining.



Least but not last here's a chatlog from a few moments ago, sorry for posting the drama but I just can't let it stand like it is at the moment.. If you don't want to read drama, just skip the part:
And yes, I might be a bit upset there as well, sorry, next time I'll be more precise and "nice"


...
[16:08:43]  <vergeDEV>   yes i put it in both branches
[16:10:11]    ed__ (319465d0@gateway/web/freenode/ip) joined the channel
[16:12:43]  <ocminer>   hmm no filtering/rollback of the attackers coins ?
[16:12:55]  <ocminer>   thats over 20 mills for him...
[16:13:08]  <vergeDEV>   we dont do rollbacks.
[16:13:16]  <vergeDEV>   we roll forward
[16:13:17]  <@Epsylon3>   i imagine the mess :p
[16:13:31]  <@Epsylon3>   the only this you can do is tracking the coins
[16:13:38]  <vergeDEV>   ocminer, would have been great if you contacted someone from our team. by you putting this on bitcointalk, you invited a ton of other people to attack as well.
[16:13:39]  <@Epsylon3>   talking with exchanges
[16:14:01]  <vergeDEV>   also your quote The vergeDEV @ Discord says "everything is okay - there's nothing to fix"..
[16:14:03]  <vergeDEV>   thats bullshit.
[16:14:05]  <vergeDEV>   i never said that
[16:14:15]  <vergeDEV>   why are you quoting me saying something i never said?
[16:14:18]  <ocminer>   -.-
[16:14:25]  <vergeDEV>   i already talked to bittrex and binance, theyre updated
[16:14:55]  <ocminer>   you just don't understand what this is all about
[16:16:02]  <vergeDEV>   how so?
[16:16:14]  <vergeDEV>   i do understand. we are having blocks injected with spoofed timestamps.
[16:16:20]  <@Epsylon3>   what the amount mined per day ?
[16:16:22]  <@Epsylon3>   is*
[16:16:24]  <vergeDEV>   and i never said "everything is okay - there's nothing to fix"
[16:16:46]  <@Epsylon3>   i need to add a script command for that :p
[16:16:54]  <ocminer>   also your commit won't fix it
[16:16:57]  <ocminer>   but ..
[16:17:12]  <ocminer>   go ahead and "move forward"
[16:17:14]  <vergeDEV>   ~4mill/day
[16:17:17]  <@Epsylon3>   XVG: current block_time set in the db 0mn35 (35 sec)
[16:17:18]  <@Epsylon3>   XVG: avg time for the last 2048 blocks = 0mn13 (13 sec)
[16:17:18]  <@Epsylon3>   XVG: avg time for the last 1024 blocks = 0mn31 (31 sec)
[16:17:35]  <@Epsylon3>   my script dont go so far :p
[16:17:51]  <ocminer>   12000 * 1560 = 18.7 mills already
[16:17:53]  <@Epsylon3>   XVG need 20x that :p
[16:18:30]  <vergeDEV>   yeah it wasnt that bad until ocminer posted it on bitcointalk, and then everyone and their mother joined in.
[16:18:51]  <vergeDEV>   and also misquoted me completely
[16:19:00]  <ocminer>   lol, now you're blaming me for an attack on your blockchain ? srsly ?
[16:19:07]  <vergeDEV>   did i blame you?
[16:19:09]  <@Epsylon3>   2026860 now... 2000000 was 2018-04-01 17:39:37
[16:19:11]  <vergeDEV>   i said the attack wasnt as bad
[16:19:14]  <ocminer>   [16:18:30]  <vergeDEV>    yeah it wasnt that bad until ocminer posted it on bitcointalk, and then everyone and their mother joined in.
[16:19:15]  <vergeDEV>   it was worse after
[16:19:20]  <@Epsylon3>   3 days..
[16:19:25]  <@Epsylon3>   4
[16:19:27]  <vergeDEV>   yes that is correct. congrats, you got a quote correct
[16:20:03]  <@Epsylon3>   so yep, maybe not 12000 blocks
[16:20:14]  <@Epsylon3>   i may create a script to check :p
[16:20:49]  <@Epsylon3>   Height:    2010000
[16:20:49]  <@Epsylon3>   Time:    2018-04-04 14:22:01
[16:21:03]  <@Epsylon3>   after first hack so
[16:21:31]  <@Epsylon3>   will do the script, i like right numbers
[16:26:22]  <ocminer>   listen.. kid... you have a absolutely trashy shitcoin pumped in heaven through that tweet from john mcafee back in that day.. you probably made a lof of money by that idiot tweeting xvg to the moon.. you should have used the chance and invested some of that money and invest it into a decent dev team, as seriously, and everyone knows that, you have not the slightest idea of coding whatsoever... If you've had done that, you could have patched your
[16:26:22]  <ocminer>    super-old codebase already to a super-recent codebase like myriad or digibyte and wallets would't have memory leaks all over, wouldn't take >30 mins until they startup and also those two drama's with the earlier tor hardforks wouldn't have happen. I'm not the guy who "keeps bullshit silent" - when I see something is happening, I report it - immediately and from my POV your users/miners have been betrayed by over 20 M coins which were injected
[16:26:22]  <ocminer>    maliciously into the blockchain... This is not a kiddo script hack and my post didn't change anyhting but just revealing what is happening at the moment (as you didn't notice yourself until I came into your hostile discord) and it's not a bad thing to post that publicly. You know see me as your enemy or whatever - I don't care, if you want to continue with your coin, go ahead, surely without me, but this should be your utmost last warning - think
[16:26:22]  <ocminer>    about yourself, think about how you make decisions and maybe come down a bit from your emperor throne and get help from professionals if you can't handle it alone... You'll see what happens after your HF - nothing, guaranteed, because you don't fix the root cause of this.
[16:26:27]    vergeDEV (~sunerok@unaffiliated/sunerok) left IRC (Ping timeout: 240 seconds)
[16:26:50]  <ocminer>   And Epsylon3 ... you
[16:27:04]  <@Epsylon3>   i slept
[16:27:09]  <@Epsylon3>   :p
[16:27:22]  <phm87>   Hi, sorry I come back late
[16:27:23]  <ocminer>   're not much better than him.. only looking for the profits here.. .your miners also lost a lof of coins during the network was stalled and the 15k blocks mined...
[16:27:34]  <phm87>   I am running unimining where there is XVG
[16:27:36]  <@Epsylon3>   you are wrong
[16:27:38]  <phm87>   (on blake2s)
[16:27:39]  <ocminer>   if you'd be honest, you'd shutdown the pool and let him fix his shit up
[16:27:41]  <@Epsylon3>   i stopped the pool the whole day
[16:28:02]  <@Epsylon3>   and answered everyone why
[16:28:08]  <ocminer>   it's up and running already, without any fix for the malicious coins
[16:28:10]  <@Epsylon3>   lot of spam
[16:28:16]  <@Epsylon3>   took the whole day
[16:28:37]  <@Epsylon3>   i pasted the fix i made this morning
[16:28:38]  <phm87>   sorry I will read what you said few minutes ago, I am late but I'll shut the pool if coin dev say so then I can explain to my miners that I follow coin dev orders
[16:28:52]  <phm87>   when a coin explodes randomly and coin dev don't care then I delist it
[16:28:58]  <@Epsylon3>   which is the commit, with proper knowledge and amount of seconds
[16:29:04]  <phm87>   but XVG risk is high for Uni so I may delist it
[16:29:07]  <ocminer>   that fix from him is just bullshit, it changes nothing, just the timespan of which they do the attacks.. .they will be slowed down a bit, but that's all

....



This will be my last dealing with XVG. I don't like to get cheated and blamed. As a miner myself I care for what I mine and I care for others as well - you can take it or leave it.

Rest assured there will be lots of pools you can still mine on, no problem at all will occur.


Also Congratulations to the Hacker - you've chosen the right coin for your hack (which was invented in 2014 btw:)) - don't buy too many Lambos with your > 20M Verge... so what.. About 1 Million $ now ?

Thanks supernova . i sell all XVG now

[Mojo_LB]

hmmm...

https://github.com/deroproject/dero/blob/ac08e492592168b24a0c60da80adef2ce1a4d151/src/cryptonote_basic/difficulty.cpp#L3

How do you have time for THIS when the coin is still vulnerable?

Your comment sir is funny and sad at the same time....

[orestrus]

Sold it all today and bought cardano Zero confidence in this coin

[h0wd]

Perhaps to be most helpful you could make these comments on github where the developer can actively respond.

He did.

https://github.com/vergecurrency/VERGE/issues/685

I think this is really handled with a lot of incompetence.
How is this coin still 'worth' what it is now?
I don't understand.

[orestrus]

I mean how can we have faith in a project that get's hacked every other day? Twitter, etc etc. BTW, Binance suspended Verge deposits. Glad I sold with a slight profit and switched to cardano.

[mvd]

Wow, reading through that chat transcript between ocminer and the arrogant devs that are apparently teenagers based on the responses.  Just unbelievable.  

Binance just cut it off, so I just sold all my XVG on Bittrex before they de-list this POS (Proof of Shitcoin).

[orestrus]

Wow, reading through that chat transcript between ocminer and the arrogant teenagers supposedly in charge of this shitcoin, just unbelievable.  

Binance just cut it off, so I just sold all my XVG on Bittrex before they de-list this POS (Proof of Shit[Suspicious link removed]d riddance.

Yeah, this coins smells like shit now..and binance is a MAJOR red flag. Did you get ADA as well?

[Micmac14]

While not a good situation for verge and those invested, you people realize that all companies living on the net have had to deal with hacks at some point or another right??? Verge team will learn from this I'm sure and they will fix it in short order.

[orestrus]

While not a good situation for verge and those invested, you people realize that all companies living on the net have had to deal with hacks at some point or another right??? Verge team will learn from this I'm sure and they will fix it in short order.

Yes, but who would invest in a project that has tons of problems like this?  As an investor I would be seriously concerned if miner tells dev team how to fix simple problem. RED FLAG

[juni4000]

That's what happens when an independent code audit is not performed. I sold my Verge.

[Micmac14]

While not a good situation for verge and those invested, you people realize that all companies living on the net have had to deal with hacks at some point or another right??? Verge team will learn from this I'm sure and they will fix it in short order.

Yes, but who would invest in a project that has tons of problems like this?  As an investor I would be seriously concerned if miner tells dev team how to fix simple problem. RED FLAG

Just to name a few in recent memory Sony, JP Morgan, Home Depot, can go on and on. Coding ain't easy.

Who is still invested in those companies I just named. They must all be gone now right???

[thierryouellet]

While not a good situation for verge and those invested, you people realize that all companies living on the net have had to deal with hacks at some point or another right??? Verge team will learn from this I'm sure and they will fix it in short order.

The problem is not the hack, it's how the dev team reacts to it. They act like idiot basement kids that just got lucky with their shit coin.

[nrg_wolf]

That's what happens when an independent code audit is not performed. I sold my Verge.

cheers for selling into my buy orders ^_^.....

once this blows over verge will climb and fall again a few more times over.... profits to be made lol. @OCminer i think its time to close this thread down or atleast lock it.... pretty sure there is more then enough shite flowing now the cleanup is going to take awhile.