NXT :: descendant of Bitcoin - Updated Information

[Anon136]

so what is the hash of the whole nxt-client-0.4.8.zip archive supposed to be?

*edit* This is the output from online-convert.com

hex: ec7c30a100717e60d8abe50eedb23641952847d91ff90b9b05a74ff98d8a4cf2

HEX: EC7C30A100717E60D8ABE50EEDB23641952847D91FF90B9B05A74FF98D8A4CF2

h:e:x: ec:7c:30:a1:00:71:7e:60:d8:ab:e5:0e:ed:b2:36:41:95:28:47:d9:1f:f9:0b:9b:05:a7:4f:f9:8d:8a:4c:f2

base64: 7HwwoQBxfmDYq+UO7bI2QZUoR9kf+QubBadP+Y2KTPI=

[1714980631]

1714980631

[1714980631]

1714980631

[1714980631]

1714980631

[Zahlen]

intel, when PaulyC reported the theft, lots of people besides EvilDave were suggesting possibilities. The most commonly suggested was keylogger. I remember someone posted something like

1) SHA256 and Elliptic Curve algo broken: 0.0001%
2) Keylogger: 80%
3) Bogus client: 10%
4) Rogue node: 10%

Personally I suggested some nonsense about possible address collision from different passwords. So I guess that makes me a troll too

[xyzzyx]

so what is the hash of the whole nxt-client-0.4.8.zip archive supposed to be?

ec7c30a100717e60d8abe50eedb23641952847d91ff90b9b05a74ff98d8a4cf2

anything else is bogus.

[Anon136]

so what is the hash of the whole nxt-client-0.4.8.zip archive supposed to be?

ec7c30a100717e60d8abe50eedb23641952847d91ff90b9b05a74ff98d8a4cf2

anything else is bogus.

thankyou sir. it looks like I'm in the clear.

[Damelon]

Also clear.

Very big PHEW

Edit: blockchain explorer is back up, btw

[Passion_ltc]

I created a new account under 0.4.7e and transfered ALL NXT to the new ID. This should work out. Let's just wait for the Aliases Transfer. :p


Also: Is it just a NXT Keylogger or does it log the whole system? :s


Edit: Well, didn't worked THAT well. Lost my NXT also..

[opticalcarrier]

I created a new account under 0.4.7e and transfered ALL NXT to the new ID. This should work out. Let's just wait for the Aliases Transfer. :p


Also: Is it just a NXT Keylogger or does it log the whole system? :s

from the code just a NXT logger

[newcn]

In summary,what I found from Chrome history:
from download history, the malware link was:
http://162.243.246.223/nxt-client-0.4.8.zip
sha256: 948ce760c379f13f4ea9def6babaa36b0d706bf91098f1d64945fdde3eac5f06

the creation time and modification time of the zip file on my local disk was:

Code:

creation time:2013‎.‎12‎.‎31‎，‏‎20:31:14
‎modified time:2013‎.‎12‎.‎31，‏‎20:35:16

in that time period, I only accessed two pages:

Code:

20:29 https://bitcointalk.org/index.php?topic=345619.11740
20:30 https://bitcointalk.org/index.php?topic=345619.0

from the download history, I probably downloaded the malware from the first page,that is:
http://info.nxtcrypto.org/nxt-client-0.4.8.zip
(I found the new version and checked it on the first page, and it's true, there's an update there, but I don't like the mega site, its slow from my home, so I downloaded the link from the first page)
the thief might changed the link directly,
 or he might changed IP address of info.nxtcrypto.org
current IP of info.nxtcrypto.org is 46.28.204.121,
which is different from 162.243.246.223

[utopianfuture]

Also clear.

Very big PHEW

Edit: blockchain explorer is back up, btw

Great Love the blockchain explorer and nexern's work.

[opticalcarrier]

In summary,what I found from Chrome history:
from download history, the malware link was:
http://162.243.246.223/nxt-client-0.4.8.zip
...

Please edit your post, it looks like you are saying there is bogus software at info.nxtcrypto.org
It looks like you got the bogus software directly from the thief.  My guess is that is where paulyC got his as well.

Some folks are claiming that dextern is involved and changed the link on nextcoin - i dont believe that is the case, Graviton removed his moderator access when that mess went down

But as far as I know, dex has still not returned the donation NXT.

[rickyjames]

By the way, I just checked and Drexme was last online here two hours ago.
There is a good chance he will try to cash in tonight if he read this thread now that we are on, to him...

And just how many accounts is he gonna plunder, I wonder?

This is gonna get really, really bad...

I will be the first to ask the question "Do we wanna stop the blockchain and roll it back?"

[NWO]

Open source incoming! Rally has begun! Anything below .0001 is CHEAP 

[intel]

intel, when PaulyC reported the theft, lots of people besides EvilDave were suggesting possibilities. The most commonly suggested was keylogger. I remember someone posted something like

1) SHA256 and Elliptic Curve algo broken: 0.0001%
2) Keylogger: 80%
3) Bogus client: 10%
4) Rogue node: 10%

Personally I suggested some nonsense about possible address collision from different passwords. So I guess that makes me a troll too

If you still didnt understand, there was a patched NXT Client which logged all password to server of EvilDave!

[utopianfuture]

By the way, I just checked and Drexme was last online here two hours ago.
There is a good chance he will try to cash in tonight if he read this thread now that we are on, to him...

And just how many accounts is he gonna plunder, I wonder?

This is gonna get really, really bad...

I will be the first to ask the question "Do we wanna stop the blockchain and roll it back?"

At this point, I don't think there are more than a few cases. The thief will certainly take the fund right when he gets the pass. We have two reported cases so far.

It is important to locate the source of the bogus link.

[newcn]

In summary,what I found from Chrome history:
from download history, the malware link was:
http://162.243.246.223/nxt-client-0.4.8.zip
...

Please edit your post, it looks like you are saying there is bogus software at info.nxtcrypto.org
It looks like you got the bogus software directly from the thief.  My guess is that is where paulyC got his as well.

Some folks are claiming that dextern is involved and changed the link on nextcoin - i dont believe that is the case, Graviton removed his moderator access when that mess went down

But as far as I know, dex has still not returned the donation NXT.

well, I didn't mean that, I didn't accussed anyone or any site.
in fact, the current IP of info.nxtcrypto.org is 46.28.204.121,
and it's different from 162.243.246.223, that's where I downloaded the malware

[utopianfuture]

intel, when PaulyC reported the theft, lots of people besides EvilDave were suggesting possibilities. The most commonly suggested was keylogger. I remember someone posted something like

1) SHA256 and Elliptic Curve algo broken: 0.0001%
2) Keylogger: 80%
3) Bogus client: 10%
4) Rogue node: 10%

Personally I suggested some nonsense about possible address collision from different passwords. So I guess that makes me a troll too

If you still didnt understand, there was a patched NXT Client which logged all password to server of EvilDave!

Is it the same or separate issue from PaulyC's hacked account ?

[Zahlen]

I will be the first to ask the question "Do we wanna stop the blockchain and roll it back?"

Maybe see how much damage was done first? The account that PaulyC's 7808 NXT was sent to contains only ~1150 more NXT. newcn lost ~17k. Probably easier to reimburse lost NXT if it isn't too large.

Is it possible to find out how long the fake link was up, and how many people downloaded from it?

[intel]

By the way, I just checked and Drexme was last online here two hours ago.
There is a good chance he will try to cash in tonight if he read this thread now that we are on, to him...

And just how many accounts is he gonna plunder, I wonder?

This is gonna get really, really bad...

I will be the first to ask the question "Do we wanna stop the blockchain and roll it back?"

At this point, I don't think there are more than a few cases. The thief will certainly take the fund right when he gets the pass. We have two reported cases so far.

It is important to locate the source of the bogus link.

1. What about that guy who lost 250k of coins? Total is about 300K, there are many reports on nextcoin.org forum.
2. Already located.

[intel]

intel, when PaulyC reported the theft, lots of people besides EvilDave were suggesting possibilities. The most commonly suggested was keylogger. I remember someone posted something like

1) SHA256 and Elliptic Curve algo broken: 0.0001%
2) Keylogger: 80%
3) Bogus client: 10%
4) Rogue node: 10%

Personally I suggested some nonsense about possible address collision from different passwords. So I guess that makes me a troll too

If you still didnt understand, there was a patched NXT Client which logged all password to server of EpicThomas!

Is it the same or separate issue from PaulyC's hacked account ?

The same. All hacked accounts is only work of one patched (infected) client designed by one pair of hands.

EpicDave is OK, EpicThomas is not OK , as he is owner of IP to which password logs leaked. Just confused these two names.

[utopianfuture]

By the way, I just checked and Drexme was last online here two hours ago.
There is a good chance he will try to cash in tonight if he read this thread now that we are on, to him...

And just how many accounts is he gonna plunder, I wonder?

This is gonna get really, really bad...

I will be the first to ask the question "Do we wanna stop the blockchain and roll it back?"

At this point, I don't think there are more than a few cases. The thief will certainly take the fund right when he gets the pass. We have two reported cases so far.

It is important to locate the source of the bogus link.

1. What about that guy who lost 250k of coins? Total is about 300K, there are many reports on nextcoin.org forum.
2. Already located.

1. Can you give me the link to 250k loss case.
2. We still don't know where it was posted. Nextcoin or nxtcrypto or where ?

I would support a roll-back if that much money involved.