NXT :: descendant of Bitcoin - Updated Information

[salsacz]

Actually I am still not 100% sure how it happend. We came to the conclusion that it must be a Keylogger/trojan BUT then they would have had access to many online wallets and exchanges, and ONLY my NXT accounts were compromised. So overall strange, but it could have been avoided with using Linux or upping my Windows security.

You followed a link from this user, who deleted his posts:
https://bitcointalk.org/index.php?action=profile;u=120275

And you downloaded hacked program from this newbie:
https://bitcointalk.org/index.php?action=profile;u=170751;sa=showPosts

[1714209730]

1714209730

[1714209730]

1714209730

[1714209730]

1714209730

[salsacz]

I didn't know you were so instrumental in identifying EpicThomas. And so I didn't thank you, but I am doing it now. I really appreciate the way that you have contributed such a crucial piece to this investigation.

these people actually helped with investigation that lead to the identification:

First identified Nxt hacker

Robbed announcements:
PaulyC
01-01-2014, 14:03:40
https://bitcointalk.org/index.php?topic=345619.msg4253372#msg4253372

sparta_cuss
01-01-2014, 17:05:58
https://bitcointalk.org/index.php?topic=345619.msg4255475#msg4255475

newcn
01:40:33 AM (CET)
https://bitcointalk.org/index.php?topic=345619.msg4262475#msg4262475

plasticAiredale on Today at 13:31:39
https://bitcointalk.org/index.php?topic=345619.msg4269412#msg4269412

Hacker was still posting to the Nxt topic:

EpicThomas
01-01-2014, 19:18:39
Both bitcoin and nxt generate your address from a 256bit key. The only problem is that bitcoin generates your private key while nxt uses sha256(pass) to get your private key.
https://bitcointalk.org/index.php?topic=345619.msg4257117#msg4257117

Good points:
Come-from-Beyond on 01-01-2014, 20:43:09

- Someone cracked SHA256 and Curve25519 (why then multi-million accounts not hacked?)
- Someone distributes modified NRS (someone should decompile PaulyC's software)
- Keylogger
- He used online node that records entered passphrases

Patel: 01-01-2014, 20:48:22

Another possibility is that the global mod that went rogue from the nxtforum, he could have changed the download link to a infected copy of NRS and people who used that link from the forum were using a compromised version

BloodyRookie: 01-01-2014, 21:04:11

He should calculate the SHA256 Hash of the class files, no need to decompile.

opticalcarrier: 01-01-2014, 21:15:36

its unforunate that one of the links there is a mega.co server. paulyc please tell us if you downloaded from the mega.co link or not.
in fact, can you please look on your HD and get the zipfile and post it somewhere for us to look at.

Finale:
PaulyC
Today at 01:43:01

Has anyone else noticed the 4.8 download zip from nextcoin.org vs. the one from this exact link Nxt 0.4.8 - https://mega.co.nz/#!yV5A1BTR!oi33K7WovgccuEHvP05nzggTnxrkZHJbwFmv5tGeXNI
Are 5 Kb in difference? is that anything to be concerned about?

S3MKi
Today at 01:55:38

Where did you download your client 0.4.8?

utopianfuture
Today at 02:04:18

Looks like you downloaded a bogus client.

newcn found the hack:
newcn
Today at 02:21:33

the 0.4.8 client I used, I forgot where I downloaded it, but from chrome history,  the link was http://162.243.246.223/n...

Salsacz found the hacker's Bitcointalk account:
Salsacz, 02:38:10 AM (CET)
https://bitcointalk.org/index.php?topic=345619.msg4263111#msg4263111

LiQio found a proof in googlecache:
LiQio
Today at 14:16:48

Thanks for the additional info, seems to point again to EpicThomas
He quoted the original message, but modified the link! And later modified it back!
Check:
https://bitcointalk.org/index.php?topic=345619.msg4237883#msg4237883
BUT in Google cache (Do not use the link found in cache!):
http://webcache.googleusercontent.com/search?q=

+ then I pointed out other posts where could be modified links

---

I am glad so we could find the wrong client and now we exactly know how it happened and how many people got robbed:
https://bitcointalk.org/index.php?topic=345619.msg4271189#msg4271189
- We can still check some other blocks during the time of the hacks, but it looks like we can relax now

[jl777]

Oke Im trying to open the client of wesley, I installed the extention in Chrome, I type NXT in the browser with a space, but nothing happens... does anybody now what do from here?

Don't worry about alias extensions for now, just download the client from: http://nxtra.org/mac/NxtMac.zip
unpack the ZIP file and copy it to your applications folder
Then launch the program, wait for it to download the blockchain
click on lock, put in a STRONG password (30+ random characters)

James

I did everything you said, But for some reason the program doesnt open, its there in the application File, but it doenst open....

You are probably running an old version of Mac OS. I think you might need to install the JRE first,but only if your mac OS is recent enough.

James

What is a JRE? I have the newest Mac OS

I also see the same problem on a Mac with 10.7.5
I click on the NxtMac app, it starts but immediately exits.

I guess need to wait for universal client coming out next week

James

[twistelaar]

Oke Im trying to open the client of wesley, I installed the extention in Chrome, I type NXT in the browser with a space, but nothing happens... does anybody now what do from here?

Don't worry about alias extensions for now, just download the client from: http://nxtra.org/mac/NxtMac.zip
unpack the ZIP file and copy it to your applications folder
Then launch the program, wait for it to download the blockchain
click on lock, put in a STRONG password (30+ random characters)

James

I did everything you said, But for some reason the program doesnt open, its there in the application File, but it doenst open....

You are probably running an old version of Mac OS. I think you might need to install the JRE first,but only if your mac OS is recent enough.

James

What is a JRE? I have the newest Mac OS

I also see the same problem on a Mac with 10.7.5
I click on the NxtMac app, it starts but immediately exits.

I guess need to wait for universal client coming out next week

James

So How can I acces my wallet at the moment?

[delulo]

The mechanism I am thinking of is bots or the same person or a group of people trading most of the volume between each other with different accounts to high prices. The ones that loose are the "normal" traders that also happen to trade at these price...  

I doubt this is going on. Last night, bter was at large premiums to dgex. Also, bter has more volume than dgex now. There is a LOT of demand to trade NXT. Even at these levels less than 3% of NXT is being traded everyday. If what you say is going on, it would have been the reverse. In any case, there is no rule against trading among your own accts. This is all standard fare in the world of high frequency trading.

Just stick to a price you are comfortable with trading at and stick to it, until some fundamental change happens that affects your analysis.

For example, I was on the fence about DOGE, until I heard that they funded the jamaican bobsled team for olympics. That is the team that the movie "cool runnings" was based on. Combine this with the usual TV ratings of hundreds of millions of viewers and knowing that the story cannot help but get airtime with the dogs pulling sleds, bobsled, etc. I then saw DOGE was creeping up to its alltime high, so I decided to buy it counting on an overshoot and getting some nice room above my entry price to protect from volatility.

I got lucky as it immediately tripled in price, but I followed a process. I usually steer very clear of anything without technical merit, but the network effect with DOGE is so strong, it can bootstrap all the infrastructure it needs to survive and thrive.

So, why the long story? Well, what does it matter what bots are doing what if I am intending to hold until at least the Olympics are around the corner? It is like waves on the beach. Sometimes a big one comes crashing in unexpectedly, but if you are waiting for the tide to come in and go out, you can safely ignore all the waves.

Tides are much more predictable that waves.

James

I agree, always stick to fundamentals...

Any insights on this: Is it known yet when a client with noticeable improved features will come out? Anything else (marketing wise or something) upcoming these days?

[twistelaar]

Oke I guess I have to offer money to get some help, who wants to help me to set up my wallet, I give 5 next coins for anybody that wants to help me, I want to acces my wallet, but for somehow, after installing the newest client this midday I cant get acces true terminal and the new mac client also doesnt work...

[delulo]

I doubt this is going on. Last night, bter was at large premiums to dgex. Also, bter has more volume than dgex now.

James

I noticed you guys getting technical and just had to jump in... we already had a failed test of 0.00013... if you guys see it breaking 0.0001 on the downside... be prepared to see rates as low as when NXT was first listed in Bter... if not lower. On the flipside... it breaks 0.00013... and we are all happy campers!   

If it is not artificially pushed over this barrier...

[jl777]

I doubt this is going on. Last night, bter was at large premiums to dgex. Also, bter has more volume than dgex now.

James

I noticed you guys getting technical and just had to jump in... we already had a failed test of 0.00013... if you guys see it breaking 0.0001 on the downside... be prepared to see rates as low as when NXT was first listed in Bter... if not lower. On the flipside... it breaks 0.00013... and we are all happy campers!   

I don't see how .00013 is any special price other than lucky 13. No significant time was spent at that price,the key prices are alltime high .00015 to .00016 and .0001

We both agree that if it goes below .0001, then we could easily see it back to .0006, but it is hovering around .000125 now due to strong CNY support. A lot of buy orders at .5 CNY/NXT and above, so <.0001 would require large scale selling of NXT/CNY, but there is nobody with a lot of NXT at prices above .000125

A lot of the near term price will depend on successful launch of new client next week. If that is late, then NXT will become available at bargain prices again. Even if it comes out on time, we will still see a selloff when it is released. buy the rumor, sell the news.

James

[sparta_cuss]

I didn't know you were so instrumental in identifying EpicThomas. And so I didn't thank you, but I am doing it now. I really appreciate the way that you have contributed such a crucial piece to this investigation.

these people actually helped with investigation that lead to the identification:

First identified Nxt hacker

Robbed announcements:
PaulyC
01-01-2014, 14:03:40
https://bitcointalk.org/index.php?topic=345619.msg4253372#msg4253372

sparta_cuss
01-01-2014, 17:05:58
https://bitcointalk.org/index.php?topic=345619.msg4255475#msg4255475

newcn
01:40:33 AM (CET)
https://bitcointalk.org/index.php?topic=345619.msg4262475#msg4262475

plasticAiredale on Today at 13:31:39
https://bitcointalk.org/index.php?topic=345619.msg4269412#msg4269412

Hacker was still posting to the Nxt topic:

EpicThomas
01-01-2014, 19:18:39
Both bitcoin and nxt generate your address from a 256bit key. The only problem is that bitcoin generates your private key while nxt uses sha256(pass) to get your private key.
https://bitcointalk.org/index.php?topic=345619.msg4257117#msg4257117

Good points:
Come-from-Beyond on 01-01-2014, 20:43:09

- Someone cracked SHA256 and Curve25519 (why then multi-million accounts not hacked?)
- Someone distributes modified NRS (someone should decompile PaulyC's software)
- Keylogger
- He used online node that records entered passphrases

Patel: 01-01-2014, 20:48:22

Another possibility is that the global mod that went rogue from the nxtforum, he could have changed the download link to a infected copy of NRS and people who used that link from the forum were using a compromised version

BloodyRookie: 01-01-2014, 21:04:11

He should calculate the SHA256 Hash of the class files, no need to decompile.

opticalcarrier: 01-01-2014, 21:15:36

its unforunate that one of the links there is a mega.co server. paulyc please tell us if you downloaded from the mega.co link or not.
in fact, can you please look on your HD and get the zipfile and post it somewhere for us to look at.

Finale:
PaulyC
Today at 01:43:01

Has anyone else noticed the 4.8 download zip from nextcoin.org vs. the one from this exact link Nxt 0.4.8 - https://mega.co.nz/#!yV5A1BTR!oi33K7WovgccuEHvP05nzggTnxrkZHJbwFmv5tGeXNI
Are 5 Kb in difference? is that anything to be concerned about?

S3MKi
Today at 01:55:38

Where did you download your client 0.4.8?

utopianfuture
Today at 02:04:18

Looks like you downloaded a bogus client.

newcn found the hack:
newcn
Today at 02:21:33

the 0.4.8 client I used, I forgot where I downloaded it, but from chrome history,  the link was http://162.243.246.223/n...

Salsacz found the hacker's Bitcointalk account:
Salsacz, 02:38:10 AM (CET)
https://bitcointalk.org/index.php?topic=345619.msg4263111#msg4263111

LiQio found a proof in googlecache:
LiQio
Today at 14:16:48

Thanks for the additional info, seems to point again to EpicThomas
He quoted the original message, but modified the link! And later modified it back!
Check:
https://bitcointalk.org/index.php?topic=345619.msg4237883#msg4237883
BUT in Google cache (Do not use the link found in cache!):
http://webcache.googleusercontent.com/search?q=

+ then I pointed out other posts where could be modified links

---

I am glad so we could find the wrong client and now we exactly know how it happened and how many people got robbed:
https://bitcointalk.org/index.php?topic=345619.msg4271189#msg4271189
- We can still check some other blocks during the time of the hacks, but it looks like we can relax now

Holy Jeebus, that's a lot of help! What a community!
Now if we can just get Graviton and Bter to get an id... Probably illegal without a warrant, but I won't tell.

[TwinWinNerD]

Actually I am still not 100% sure how it happend. We came to the conclusion that it must be a Keylogger/trojan BUT then they would have had access to many online wallets and exchanges, and ONLY my NXT accounts were compromised. So overall strange, but it could have been avoided with using Linux or upping my Windows security.

You followed a link from this user, who deleted his posts:
https://bitcointalk.org/index.php?action=profile;u=120275

And you downloaded hacked program from this newbie:
https://bitcointalk.org/index.php?action=profile;u=170751;sa=showPosts

So basically it was my carelessness afterall. I hope not many others were hacked. But I know many people that don't check their balance often, so more people could be affected but haven't noticed yes.

Do you know why the other guy was hacked? The one with 500k stolen

[mr_random]

I doubt this is going on. Last night, bter was at large premiums to dgex. Also, bter has more volume than dgex now.

James

I noticed you guys getting technical and just had to jump in... we already had a failed test of 0.00013... if you guys see it breaking 0.0001 on the downside... be prepared to see rates as low as when NXT was first listed in Bter... if not lower. On the flipside... it breaks 0.00013... and we are all happy campers!   

I don't see how .00013 is any special price other than lucky 13. No significant time was spent at that price,the key prices are alltime high .00015 to .00016 and .0001

We both agree that if it goes below .0001, then we could easily see it back to .0006, but it is hovering around .000125 now due to strong CNY support. A lot of buy orders at .5 CNY/NXT and above, so <.0001 would require large scale selling of NXT/CNY, but there is nobody with a lot of NXT at prices above .000125

A lot of the near term price will depend on successful launch of new client next week. If that is late, then NXT will become available at bargain prices again. Even if it comes out on time, we will still see a selloff when it is released. buy the rumor, sell the news.

James

Interesting perspectives. I stand by my original opinion weeks back that NXT will prove to be one of the most volatile cryptos ever in price. I wouldn't even like to try and guess where we will be in 2 weeks time. But that is so exciting. Long term I see only moons and rockets.

What's scary is that the trading volume is so high on exchanges like dgex and bter. Once NXT goes on Cryptsy I see the price going stratospheric.

The pace of development on this project is a spectacle in itself. We've put projects like Mastercoin to shame with our agile development and clever use of bounties. I go away from this thread for two days and come back and I can't believe the progress and what I am reading.

[salsacz]

price? China! - to the mooon! We want Nxt! Where are Nxt? Stucked in the DGEX. We want Nxt. Why people don't send Nxt to bter? Europeans are sleeping. Price - up up up. - 16! Morning in the Europe - wow, Nxt much profit, need to send there my Nxt = Price - down down down. - 12.

last hours - China sleeping. - price 12


China wakes up in 2 hours, wow, Nxt small price - up up up - 18 in 5-6 hours.

[mnightwaffle]

just realized marlboro has a NXT flavor...

[starik69]

Oke I guess I have to offer money to get some help, who wants to help me to set up my wallet, I give 5 next coins for anybody that wants to help me, I want to acces my wallet, but for somehow, after installing the newest client this midday I cant get acces true terminal and the new mac client also doesnt work...

What exactly is your OSX? Type in terminal

Code:

java -version

whats the answer?

[delulo]

Is it known yet when a client with noticeable improved features will come out? Anything else (marketing wise or something) upcoming these days? 

Any info on this?

[S3MKi]

price? China! - to the mooon! We want Nxt! Where are Nxt? Stucked in the DGEX. We want Nxt. Why people don't send Nxt to bter? Europeans are sleeping. Price - up up up. - 16! Morning in the Europe - wow, Nxt much profit, need to send there my Nxt = Price - down down down. - 12.

last hours - China sleeping. - price 12


China wakes up in 2 hours, wow, Nxt small price - up up up - 18 in 5-6 hours.

This is true salsacz. I think price is rising so fast. And when I saw wall at 0.00015 about 500kNxt I
thought somebody wanted to stop price. But now I don't see that wall

[TwinWinNerD]

POS = Proof of sex
and it guarantees that only adults use this epic currency!!!!!

[wastedbit]

Actually I am still not 100% sure how it happend. We came to the conclusion that it must be a Keylogger/trojan BUT then they would have had access to many online wallets and exchanges, and ONLY my NXT accounts were compromised. So overall strange, but it could have been avoided with using Linux or upping my Windows security.

You followed a link from this user, who deleted his posts:
https://bitcointalk.org/index.php?action=profile;u=120275

And you downloaded hacked program from this newbie:
https://bitcointalk.org/index.php?action=profile;u=170751;sa=showPosts

What is this about?  It is not clear from the links.

BTW.  I take it as policy to delete old postings that are no longer relevant.  Why not?

[msin]

Is it known yet when a client with noticeable improved features will come out? Anything else (marketing wise or something) upcoming these days? 

Any info on this?

Yes, there will be a big client release (nexern) in about two weeks.  It will be a cross platform one click desktop client (open-source).  There will be several new features implemented and ongoing development of some really interesting new features.  That's my understanding.

[opticalcarrier]

so in a few days, we'll also be on vircurex.  next week nexern release.  interesting times.