I have nothing to say about the account ownership claim of this user. I also did not had initially any intention to step in, but as this user claims he did something he did not achieved (and brags about it), and he is using the same extortion practices he has used in the Sia community, now I have to step in to provide clarity and context to the situation.
I am a Sia third-party developer (not core) and moderator of the Sia Discord community. I am also the owner of the resources websites
https://siastats.info and
https://keops.ccHow can David Vorick claim Siacoin has data redundancy and host failures will not effect data when I just demonstrated to him with only 5000$ worth of hardware i could damage users files.
Importantly,
the Sia software has been patched for almost 2 months against the Sybil attack this user intended to perform, and he did not provoked any damage to the user's filesMr. Honarchian used to be the owner of Siaberry Inc., a business selling Raspberry Pi kits preconfigured to be Sia "hosts". Sia is a decentralized storage network where users offer the free space in their disks (hosts) to users that want to store files in the network. All data is encrypted and each file distributed among 30 hosts with a 3x redundancy scheme that ensures any 20 of them can go offline but yet the files will be available to download. A community member (not even a core developer) revealed in two blog posts the security vulnerabilities of the hardware (
https://blog.spaceduck.io/siaberry-1/) and the dubious business practices of the company (
https://blog.spaceduck.io/siaberry-2/).
Moved by vindication, he decided to perform a Sybil attack against the whole network, by deploying a large number of hosts that could collect enough redundant copies of the files. Afterwards he would disconnect the machines and provoke a data loss on users on November 5th. He started to extort the Sia community and core developers requesting a ransom of $5000. For those interested, this is a folder full of screenshots of his multiple threats and extortion attempts:
https://mega.nz/#!90pW0KDY!CCfW-3YutYjtHMETow62FG82g8XQ6pO6T3tc4UVPJOo
However, as soon as the community detected his intentions, it reacted (in less than 10 days): on September 6th Sia version 1.3.4 is released (
https://www.reddit.com/r/siacoin/comments/9dlrik/sia_v134_has_been_released/), including a feature that avoided users to keep adding more of Honarchian's machines to their list of hosts. On October 16th, version 1.3.6 is released (
https://www.reddit.com/r/siacoin/comments/9orvzw/sia_v136_is_ready_download_now/) including a feature that cancels contracts with hosts using the same subnetwork (and so, making users to stop using his hosts). On September 6th I release Decentralizer (
https://keops.cc/decentralizer) a simple tool that geolocates hosts and cancels contracts with those sharing location. The tool can keep detecting and associating these hosts even if the attacker uses VPNs or changes their geolocation, thanks to the use of an online database on SiaStats, which is constantly monitoring the network of hosts.
The Sia network has been inmune for almost two months to his attack, but yet he kept his extortion and his plan of provoking data loss on those not updating their clients. He even started to threat to dox people, including myself because I developed this tool to neutralize the attack. Take a look also at his Medium article he linked in his first post, where after paragraphs of no-sense he ends up claiming he will stop if he is paid $5000 before November 5th. Finally, 3 days ago, on October 24th, his machines get turned off.The proof that his attack did not had any effect and the redundancy scheme worked is that even 3 days after the unplugging event, no Sia user has reported so far on any of the Sia communities a data loss event.
As Mr. Honarchian is now using the same extortion and doxing techniques in the BTC community, I think it is important everybody knows the recent past of this user.
