NXT :: descendant of Bitcoin - Updated Information

[Come-from-Beyond]

I've got PaulyC's password. It's uncrackable and matches the account. If he is not trolling then we have 4 explanations:

- Someone cracked SHA256 and Curve25519 (why then multi-million accounts not hacked?)
- Someone distributes modified NRS (someone should decompile PaulyC's software)
- Keylogger
- He used online node that records entered passphrases

[landomata]

I've got PaulyC's password. It's uncrackable and matches the account. If he is not trolling then we have 4 explanations:

- Someone cracked SHA256 and Curve25519 (why then multi-million accounts not hacked?)
- Someone distributes modified NRS (someone should decompile PaulyC's software)
- Keylogger
- He used online node that records entered passphrases

We haven't looked at this possibility...updating client from the blockchain would solve this.

[utopianfuture]

I've got PaulyC's password. It's uncrackable and matches the account. If he is not trolling then we have 4 explanations:

- Someone cracked SHA256 and Curve25519 (why then multi-million accounts not hacked?)
- Someone distributes modified NRS (someone should decompile PaulyC's software)
- Keylogger
- He used online node that records entered passphrases

While I may give PaulyC the benefit of doubt, it can't be ruled out that it is a legit transaction authorized by PaulyC himself.

[Patel]

Another possibility is that the global mod that went rogue from the nxtforum, he could have changed the download link to a infected copy of NRS and people who used that link from the forum were using a compromised version

[Come-from-Beyond]

doesn't each new passphase entered unlock a new account?

U don't need to unlock an account. This is how I would brute force accounts:

1. Got all non-empty account ids
2. Launched my GPUs (they r unprofitable to mine BTC but still useful)
3. Each GPU generated an account id and checked it matches one of the 7000 already existing ones (repeat zillion times)

[Come-from-Beyond]

We haven't looked at this possibility...updating client from the blockchain would solve this.

It's enough to modify only JavaScript part to send entered passphrases to adversary's server.

Edit: It's only 10 lines of JS code.

[EvilDave]

@PaulyC :

Have u scanned yr PC for malware? Trojan/key logger looks like a very good possiblility at this moment.

And how is yr off-line security ? Anyone else have acess to yr PC?

[BloodyRookie]

Wouldn't it be pretty easy to restrict transactions to a specific MAC address? You register a MAC address for your account via a transaction. Only if the MAC address of you computer is the specified one, the transaction is executed. Just an idea.

[Come-from-Beyond]

Wouldn't it be pretty easy to restrict transactions to a specific MAC address? You register a MAC address for your account via a transaction. Only if the MAC address is the specified one, the transaction is executed. Just an idea.

It's impossible.

[landomata]

We haven't looked at this possibility...updating client from the blockchain would solve this.

It's enough to modify only JavaScript part to send entered passphrases to adversary's server.

Edit: It's only 10 lines of JS code.

so how do we protect again this.

[laowai80]

- Someone cracked SHA256 and Curve25519 (why then multi-million accounts not hacked?)
- Someone distributes modified NRS (someone should decompile PaulyC's software)
- Keylogger
- He used online node that records entered passphrases

0.0000000000000000001%
1-10%
80-90%
1-10%

about that kind of probability for each explanation.
Keylogger is the main suspect of course.

[PaulyC]

I agree it could be any of those 4 reasons CfB gave, but curiously why hasn't the hacker or whoever done anything with those stolen NXT? Isn't that a weird behavior or?

just so we don't go on a tangent here,
this is the client I used.
4.8
https://nextcoin.org/index.php/topic,4.0.html

nxt-client-0.4.8.zip

[ferment]

price on dgex to da moon!

if litecoin is a chikun. what's nxt?

[laowai80]

price on dgex to da moon!

if litecoin is a chikun. what's nxt?

chikun killer, by summer for sure )

[BloodyRookie]

Wouldn't it be pretty easy to restrict transactions to a specific MAC address? You register a MAC address for your account via a transaction. Only if the MAC address is the specified one, the transaction is executed. Just an idea.

It's impossible.

why?

[landomata]

Keylogger is the main suspect of course.

There is really no way to protect against keyloggers except proper vigilance....yet malware is still everywhere and not going away anytime soon.


This is where Rickyjames/Opti-carriers idea comes in handy

[intel]

offline mining of all NXT accounts in parallel
problem gets worse the more NXT accounts there are
this attracts more hackers the more NXT is worth
This will create an equilibrium effect like a boat anchor to a hot air balloon. The more NXT succeeds, the more it will be hacked.

CfB, tell me there is a solution that is more effective than the user needs to not be unlucky

James

I can tell you some ideas.

Currently there is only a password. Lets also add login field when registering for account access.

This 'll require NO changes in protocol:

FINALPASSWORD = [LOGIN][PASSWORD]

So, even password "Alisa" 'll be quite secure when using with login "mrbober777", so the final password is   "mrbober777Alisa"     which is much more protected thay plain "Alisa". Attacker should spend MUCH more resources for brute-forcing passwords with a login added to the password field.

CfB ?

[BloodyRookie]

I've got PaulyC's password. It's uncrackable and matches the account. If he is not trolling then we have 4 explanations:

- Someone cracked SHA256 and Curve25519 (why then multi-million accounts not hacked?)
- Someone distributes modified NRS (someone should decompile PaulyC's software)
- Keylogger
- He used online node that records entered passphrases

He should calculate the SHA256 Hash of the class files, no need to decompile.

[2X84]

Wouldn't it be pretty easy to restrict transactions to a specific MAC address? You register a MAC address for your account via a transaction. Only if the MAC address of you computer is the specified one, the transaction is executed. Just an idea.

Even if it were possible I'm afraid that would cause more problems than it would solve  ...

[rickyjames]

- Someone cracked SHA256 and Curve25519 (why then multi-million accounts not hacked?)
- Someone distributes modified NRS (someone should decompile PaulyC's software)
- Keylogger
- He used online node that records entered passphrases

0.0000000000000000001%
1-10%
80-90%
1-10%

about that kind of probability for each explanation.
Keylogger is the main suspect of course.

I totally agree with these ballpark estimates.

I would note that if my proposed public / private key account freeze page were implemented in the client, it would be virtually immune to a keylogger since the private part of the unfreeze key would be written down manually, and the one time it's typed in is to unlock the account anyway.  Presumably the user would send NXT out of a high value account and immediately refreeze it once the transaction was gone.

Tho just to stay paranoid, there's also screengrab loggers that could get a visual unfreeze private key in my scheme...