Bitcoin Forum
December 08, 2016, 08:17:18 PM *
News: Latest stable version of Bitcoin Core: 0.13.1  [Torrent].
 
   Home   Help Search Donate Login Register  
Pages: « 1 ... 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 [406] 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 »
  Print  
Author Topic: [CLOSED] BTC Guild - Pays TxFees+NMC, Stratum, VarDiff, Private Servers  (Read 829237 times)
This is a self-moderated topic. If you do not want to be moderated by the person who started this topic, create a new topic.
eleuthria
Legendary
*
Offline Offline

Activity: 1750


BTC Guild Owner


View Profile WWW
December 16, 2014, 07:08:39 PM
 #8101

@Eluethria, idk how this is possible since wallet is locked, but I've received a seemingly "valid" link and email from support@btcguild to modify it

Webpage settings confirm address is unchanged but can you confirm?

Assuming the email is valid, the only way for that to happen is if somebody has your login credentials.  The code to generate a wallet change code and send off an email only works if there is a valid login.  I'm looking into that address, and it looks like there was a number of accounts hit by that address, but the percentage is so low (and the majority were accounts that had a 0 balance), that it's likely the end result of the login brute force attacks (using username+password leaks from other sites) that have been happening over the last year.  The current IP blacklist in fighting those repeated attacks exceeds 1 million unique IPs [and likely a <0.01% false positive].

R.I.P. BTC Guild, 2011 - 2015.
BTC Guild Forum Thread
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
Taugeran
Hero Member
*****
Offline Offline

Activity: 658


CCNA: There i fixed the internet.


View Profile
December 16, 2014, 08:20:58 PM
 #8102

@Eluethria, idk how this is possible since wallet is locked, but I've received a seemingly "valid" link and email from support@btcguild to modify it

Webpage settings confirm address is unchanged but can you confirm?

Assuming the email is valid, the only way for that to happen is if somebody has your login credentials.  The code to generate a wallet change code and send off an email only works if there is a valid login.  I'm looking into that address, and it looks like there was a number of accounts hit by that address, but the percentage is so low (and the majority were accounts that had a 0 balance), that it's likely the end result of the login brute force attacks (using username+password leaks from other sites) that have been happening over the last year.  The current IP blacklist in fighting those repeated attacks exceeds 1 million unique IPs [and likely a <0.01% false positive].

Ok that calms me on all but one question: if indeed the change cod is valid, how would it have been generated if I've previously clicked on the lock address button?

Bitfury HW & Habañero : 1.625Th/s
tips/Donations: 1NoS89H3Mr6U5CmP4VwWzU2318JEMxHL1
Come join Coinbase
eleuthria
Legendary
*
Offline Offline

Activity: 1750


BTC Guild Owner


View Profile WWW
December 16, 2014, 09:47:08 PM
 #8103

@Eluethria, idk how this is possible since wallet is locked, but I've received a seemingly "valid" link and email from support@btcguild to modify it

Webpage settings confirm address is unchanged but can you confirm?

Assuming the email is valid, the only way for that to happen is if somebody has your login credentials.  The code to generate a wallet change code and send off an email only works if there is a valid login.  I'm looking into that address, and it looks like there was a number of accounts hit by that address, but the percentage is so low (and the majority were accounts that had a 0 balance), that it's likely the end result of the login brute force attacks (using username+password leaks from other sites) that have been happening over the last year.  The current IP blacklist in fighting those repeated attacks exceeds 1 million unique IPs [and likely a <0.01% false positive].

Ok that calms me on all but one question: if indeed the change cod is valid, how would it have been generated if I've previously clicked on the lock address button?

There's no way to legitimately get to that page in the UI, but if you force POST data into the page as if you clicked the button, it will still trigger the email, which is what happened in this case.  However, even clicking the confirmation link would not change your locked address (the code was validly generated, the email validly sent, but the actual change can't happen due to the lock).

R.I.P. BTC Guild, 2011 - 2015.
BTC Guild Forum Thread
Taugeran
Hero Member
*****
Offline Offline

Activity: 658


CCNA: There i fixed the internet.


View Profile
December 16, 2014, 10:31:51 PM
 #8104

Gotcha

Bitfury HW & Habañero : 1.625Th/s
tips/Donations: 1NoS89H3Mr6U5CmP4VwWzU2318JEMxHL1
Come join Coinbase
eleuthria
Legendary
*
Offline Offline

Activity: 1750


BTC Guild Owner


View Profile WWW
December 18, 2014, 01:56:16 AM
 #8105

There was a bug introduced in the wallet confirmation email function last night that was just recently corrected.  If you've had problems changing your wallet in the last 24 hours, you will have to try changing it again on your Settings page to trigger a new email confirmation.

R.I.P. BTC Guild, 2011 - 2015.
BTC Guild Forum Thread
PatMan
Hero Member
*****
Offline Offline

Activity: 924


Watch out for the "Neg-Rep-Dogie-Police".....


View Profile WWW
December 21, 2014, 11:05:27 AM
 #8106

Eleuthria, you got a urgent PM  Wink

"When one person is deluded it is called insanity - when many people are deluded it is called religion" - Robert M. Pirsig.  I don't want your coins, I want change.
Amazon UK BTC payment service - https://bitcointalk.org/index.php?topic=301229.0 - with FREE delivery!
http://www.ae911truth.org/ - http://rethink911.org/ - http://rememberbuilding7.org/
PatMan
Hero Member
*****
Offline Offline

Activity: 924


Watch out for the "Neg-Rep-Dogie-Police".....


View Profile WWW
December 21, 2014, 03:06:05 PM
 #8107

Eleuthria, you got a urgent PM  Wink

OK, following up to this, I have already PM'd Eleuthria & am awaiting a response - but feel that I should inform miners here about my problem in an effort to ensure that nobody else's accounts have been compromised & are losing their payouts without their knowledge, so here goes.

I have been using the Guild as one of my failover pool for some time now, but upon going through my various payments from different accounts at various pools I noticed that my payments from Guild had stopped. Upon logging in I saw that both my BTC & NMC accounts payout addresses had been changed & locked to payout at 0.01 each. Both these changes were made between 2014-08-2 & 2014-10-24, which was the date the first payment went out - yes, I know, two months ago - my fault for not keeping an eye out. However, it's happened. I have changed my password & email address on my account, but as both my payout addresses have been locked, I can only remove the Guild from my pool miners & raise the auto payout payout to avoid any more payments going to the "mystery" payout addresses, which are:

BTC  16tuzEarAgnASdwvUAxAhbd6df2nUo42UD
NMC   MxeA8Bq7LcKP9zWnGYUBbWu6ZvMD4hHjXY

Looking through the payments sent to the above addresses, I can see that there have been many payments of 0.01 to both of them over a period of months, far more than just my missing payments - so it looks like I'm not the only victim - but I do hope I'm wrong.

Until I hear from the good eleuthria, I would advise everyone to check to make sure their payout addresses have not been changed & locked immediately as a matter of precaution, as well as a change of password. I sincerely hope that this is purely an isolated incident, but can't know for sure until eleuthria has investigated the issue & contacts me.

Peace  Smiley

Edit: Updated dates.

"When one person is deluded it is called insanity - when many people are deluded it is called religion" - Robert M. Pirsig.  I don't want your coins, I want change.
Amazon UK BTC payment service - https://bitcointalk.org/index.php?topic=301229.0 - with FREE delivery!
http://www.ae911truth.org/ - http://rethink911.org/ - http://rememberbuilding7.org/
SgtMoth
Hero Member
*****
Offline Offline

Activity: 890


buy silver!


View Profile
December 21, 2014, 03:59:18 PM
 #8108

I locked both long ago, its there for a reason!  Open a new account and clean your computer out.  Your account logging in and wallets should be stored on a computer that you dont browse with or look at emails.  Your running your own bank, start acting like it!

btw...my lesson cost me $2200
PatMan
Hero Member
*****
Offline Offline

Activity: 924


Watch out for the "Neg-Rep-Dogie-Police".....


View Profile WWW
December 21, 2014, 04:03:39 PM
 #8109

I locked both long ago, its there for a reason!

Yes, I'm aware of that, thanks. I deliberately didn't lock them for a reason. lesson learned I suppose  Wink

Edit: The issue here is not the lost BTC/NMC - I've not lost a large amount. The issue is that someone is able to access accounts in the first place.

Your running your own bank, start acting like it!

 Roll Eyes

"When one person is deluded it is called insanity - when many people are deluded it is called religion" - Robert M. Pirsig.  I don't want your coins, I want change.
Amazon UK BTC payment service - https://bitcointalk.org/index.php?topic=301229.0 - with FREE delivery!
http://www.ae911truth.org/ - http://rethink911.org/ - http://rememberbuilding7.org/
Taugeran
Hero Member
*****
Offline Offline

Activity: 658


CCNA: There i fixed the internet.


View Profile
December 21, 2014, 04:24:33 PM
 #8110

I locked both long ago, its there for a reason!

Yes, I'm aware of that, thanks. I deliberately didn't lock them for a reason. lesson learned I suppose  Wink

Edit: The issue here is not the lost BTC/NMC - I've not lost a large amount. The issue is that someone is able to access accounts in the first place.

Your running your own bank, start acting like it!

 Roll Eyes


It all stems most likely from the Bitcointalk hack that happened. Emails were gathered and now presumably malicious 3rd parties are attempting to brute force

Bitfury HW & Habañero : 1.625Th/s
tips/Donations: 1NoS89H3Mr6U5CmP4VwWzU2318JEMxHL1
Come join Coinbase
PatMan
Hero Member
*****
Offline Offline

Activity: 924


Watch out for the "Neg-Rep-Dogie-Police".....


View Profile WWW
December 21, 2014, 04:31:16 PM
 #8111

It all stems most likely from the Bitcointalk hack that happened. Emails were gathered and now presumably malicious 3rd parties are attempting to brute force

This is my thought also, and have changed my registration details here, again. My PC is very secure with an excellent security setup, plus I format & reinstall every few months, the last time being a few weeks ago. I know that a unit can never be 100% secure, but consider my setup to be much more so than the average PC.

"When one person is deluded it is called insanity - when many people are deluded it is called religion" - Robert M. Pirsig.  I don't want your coins, I want change.
Amazon UK BTC payment service - https://bitcointalk.org/index.php?topic=301229.0 - with FREE delivery!
http://www.ae911truth.org/ - http://rethink911.org/ - http://rememberbuilding7.org/
eleuthria
Legendary
*
Offline Offline

Activity: 1750


BTC Guild Owner


View Profile WWW
December 21, 2014, 06:28:46 PM
 #8112

It's not just the Bitcointalk hacks.  Especially when it comes to long time Bitcoin users, repeating the use of passwords anywhere probably means your password is known.  There was bitcoinpool.com which had a plaintext leak of all usernames and passwords.  There was the earlier MtGox hack that had a leak where many early accounts had easily reversible hashes due to lack of a proper salt, and no doubt there were *many* other Bitcoin site leaks that went unreported.  There have also bee in the last 3 years leaks from Adobe and LinkedIn (and more, those are just the two that come to mind).

I know that the brute force attacks that are always taking place against BTC Guild are not "brute force".  They're not guessing passwords, they're using username+password combinations from a database that has been compiled over many years, with millions of username+password combinations, and tunnel it through infected computers from all over the world to prevent any kind of pattern analysis from hitting them without false positives.

R.I.P. BTC Guild, 2011 - 2015.
BTC Guild Forum Thread
PatMan
Hero Member
*****
Offline Offline

Activity: 924


Watch out for the "Neg-Rep-Dogie-Police".....


View Profile WWW
December 21, 2014, 06:57:50 PM
 #8113

Thank you eleuthria for the fast & first class support as always. This is why BTCGuild is the best centralised pool out there bar none. I was fortunate enough to not have lost too much, I hope the other users who have been affected didn't lose too much also.

There you have it people - change passwords often & be careful out there!

Peace  Smiley

"When one person is deluded it is called insanity - when many people are deluded it is called religion" - Robert M. Pirsig.  I don't want your coins, I want change.
Amazon UK BTC payment service - https://bitcointalk.org/index.php?topic=301229.0 - with FREE delivery!
http://www.ae911truth.org/ - http://rethink911.org/ - http://rememberbuilding7.org/
eleuthria
Legendary
*
Offline Offline

Activity: 1750


BTC Guild Owner


View Profile WWW
December 21, 2014, 09:04:28 PM
 #8114

Thank you eleuthria for the fast & first class support as always. This is why BTCGuild is the best centralised pool out there bar none. I was fortunate enough to not have lost too much, I hope the other users who have been affected didn't lose too much also.

There you have it people - change passwords often & be careful out there!

Peace  Smiley

And never, ever, ever, re-use a same or similar password unless it's a specific one used for sites where somebody else getting your account means absolutely nothing.

R.I.P. BTC Guild, 2011 - 2015.
BTC Guild Forum Thread
spineshank624
Newbie
*
Offline Offline

Activity: 5


View Profile
December 27, 2014, 08:06:49 PM
 #8115

lol I think this is the worst 24 hour payout in a long time .... I have made .00019312 in the last 24 hours  Tongue ehh its life hope the luck goes up!
(its only a 110g/h miner so not expecting much lol)
medUSA
Legendary
*
Offline Offline

Activity: 952


--Signature Designs-- http://bit.ly/1Pjbx77


View Profile WWW
January 09, 2015, 10:35:35 AM
 #8116

I have a small amount of namecoin stuck on BTCGuild. I could not find a way to manually withdraw all the namecoin like I could with bitcoin. I could change the automatic withdraw limit and get most of those out, but I prefer to clear the balance. Thanks.
rnaodm
Member
**
Offline Offline

Activity: 61


View Profile
January 09, 2015, 05:11:05 PM
 #8117

Where is the NMC mined info? The dashboard only has btc account balance info
hurricandave
Legendary
*
Offline Offline

Activity: 868



View Profile
January 09, 2015, 05:13:14 PM
 #8118

Where is the NMC mined info? The dashboard only has btc account balance info
Open the settings Tab. Upper right select "show" next to Namecoin then "apply". Return to Dashboard. Only Namecoin earnings are displayed.
rnaodm
Member
**
Offline Offline

Activity: 61


View Profile
January 09, 2015, 05:14:14 PM
 #8119

thank you!
navigator
Sr. Member
****
Offline Offline

Activity: 360


View Profile
January 13, 2015, 06:36:45 PM
 #8120

Wow, I haven't been paying attention and noticed we hit over 230% luck. That's the highest in a long while, right?

I've been wondering if I should temporarily leave the pool after any over 200% luck days. It seems we always have a short bad luck run afterwards.
Pages: « 1 ... 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 [406] 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 »
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!