VIP Member hacked?

[hilariousetc]

Just saw this user posting in the Cloudbet's Super 6 Soccer Predictor Competition:

https://bitcointalk.org/index.php?action=profile;u=18021     JusticeForYou June 04, 2011

He stood out because he's a VIP and I've never seen him before, and then noticed his details had been reset recently:

This user's password was reset recently.

This user recently woke up from a long period of inactivity.

This isn't the first time he's woken from a long period of inactivity either. He disappeared on May 26, 2015 to reappear on August 13, 2017.

On the 15th he then asked for a silly loan:

Well lets get straight to business.

I want to borrow Bitcoin.

Full Disclosure: I have no intention of paying them back, so I'll skip the sad story and great business plan.

I just figured every other method was used to get people to loan coins, why not just an honest one.

If you're interested deposit coins here vvv


Thank You for your time.


Best Regards,

Then nothing until November 07, 2018 where he posted in the Cloudbet giveaway thread.

[1714912622]

1714912622

[1714912622]

1714912622

[1714912622]

1714912622

[1714912622]

1714912622

[1714912622]

1714912622

[coinlocket$]

We have not so much to work with.
Looking at post history he is/was rich (?) and used some addresses

2011 address

Code:

1tabCzGVPEK6kCJpQhFKwpXcsdnhTXyY4

https://bitcointalk.org/index.php?topic=53888.msg655867#msg655867
https://web.archive.org/web/20181118133953/https://bitcointalk.org/index.php?topic=53888.msg655867
Last transaction: 2015
https://www.walletexplorer.com/wallet/1ce41055bde615a6?from_address=1tabCzGVPEK6kCJpQhFKwpXcsdnhTXyY4
2012 address

Code:

1G12XfoPSLYiCdCH49qtN6NHMmHPQwPUta

https://bitcointalk.org/index.php?topic=76661.msg851287#msg851287
https://web.archive.org/web/20181118133957/https://bitcointalk.org/index.php?topic=76661.msg851287
Last transaction: 2014
https://www.walletexplorer.com/wallet/2e072bdb2773aaf3?from_address=1G12XfoPSLYiCdCH49qtN6NHMmHPQwPUta

2012 address
https://bitcointalk.org/index.php?topic=79099.msg881225#msg881225

Code:

14TmNWeLZNurQtmxAi62DH8RHn2pQPH2yc

https://web.archive.org/web/20181118175755/https://bitcointalk.org/index.php?topic=79099.msg881225
Last transaction: 2011
https://www.walletexplorer.com/wallet/ec65b769cf53b894?from_address=14TmNWeLZNurQtmxAi62DH8RHn2pQPH2yc



He owns these wallets
https://www.walletexplorer.com/wallet/1ce41055bde615a6/addresses
https://www.walletexplorer.com/wallet/2e072bdb2773aaf3/addresses

Code:

1tabCzGVPEK6kCJpQhFKwpXcsdnhTXyY4
13AV2U35JxfNBiw7tTjBUsbAtZZt32bBYH
1ABSKEnh51VSafuwEuNue9asc7X4TnU9iB
1PLGrwniHFUyXrhyQAswGJDQuKKx7D2VYF
1G12XfoPSLYiCdCH49qtN6NHMmHPQwPUta
1idL6feqziEfNvz5nZuotNeQqz39w4LN9
144c5cAfagPEURS5UT8d8oZvZuwdoKSQMw

A signed message from one of those address will prove the ownership.

[SFR10]

This isn't the first time he's woken from a long period of inactivity either. He disappeared on May 26, 2015 to reappear on August 13, 2017.

But recent password resets, points to a different case (I checked the relevant archived pages of "security log" but didn't find any password resets on previous period):

• November 06, 2018, 07:23:19 PM - JusticeForYou - password reset via email
• November 06, 2018, 07:05:09 PM - JusticeForYou - password changed
• November 06, 2018, 03:55:44 PM - JusticeForYou - woke up
• November 06, 2018, 03:55:34 PM - JusticeForYou - password reset via email

Code:

13AV2U35JxfNBiw7tTjBUsbAtZZt32bBYH

https://bitcointalk.org/index.php?topic=76661.msg851287#msg851287

This is the correct address:

Code:

1G12XfoPSLYiCdCH49qtN6NHMmHPQwPUta

2012 address 100+btc transaction
https://bitcointalk.org/index.php?topic=76661.msg851312#msg851312

Code:

14TmNWeLZNurQtmxAi62DH8RHn2pQPH2yc

You've linked another address. Correct one is:

https://bitcointalk.org/index.php?topic=79099.msg881225#msg881225

Looking at post history he is/was rich (?)

~Snipped~

2012 address 100+btc transaction
https://bitcointalk.org/index.php?topic=76661.msg851312#msg851312

Back then, it was just 504.98 USD.

[Theb]

This account is possibly hacked, a big chunk of his activity was from 2011 to 2015 and just by seeing his post history it is the first time he posted something related to Football, and most of his post before then are more sensible compared to him "borrowing" BTC without paying back. I'm pretty sure that he can already be tagged by a DT member for asking a loan back in 2017 and admitting that he won't pay it back.

[coinlocket$]

~

Fixed, the spreadsheet used was messed up.
I agree with @theb looking the activity the account seems hacked now. The user's recent activity is very different back then in 2011, we can only ask for a signed message.

[Veleor]

https://bitcointalk.org/index.php?action=profile;u=18021     JusticeForYou June 04, 2011

He stood out because he's a VIP and I've never seen him before, and then noticed his details had been reset recently

Perhaps you don't remember him because he has changed his nickname. His previous name was BTC_Bear.



Archive: http://web.archive.org/web/20171126120414/https://bitcointalk.org/index.php?action=profile;u=18021

[LoyceV]

Perhaps you don't remember him because he has changed his nickname. His previous name was BTC_Bear.

The name change was very recent. Around 2 weeks ago, Piggy scraped this data:

Code:

18021        BTC_Bear        0: -0 / +0      250     828     392     VIP     2011-06-04T06:07:49     2017-08-15T20:32:13                                     hidden  The ∑ Number Game 1ApJdWUdSWYw8n8HEATYhHXA9EYoRTy7c4              N/A             2018-11-03T15:18:28.056747

[Findingnemo]

A VIP member is now trying to participate in a free games to make some bucks which not enough to identify that the account was hacked?

Hope he will be negged by DT member soon or he may scam the other forum people using the reputation of that account.

[marlboroza]

A VIP member is now trying to participate in a free games to make some bucks which not enough to identify that the account was hacked?

Or they woke up after long time and changed password and email as they are not using forum on daily/monthly/yearly base. Or maybe cloudbet sent them PM to join contest, they've received notification in email and went to games and rounds. Or they sold account. Or account was hacked. Or they have alt account(s) and they know about contest. Or...or...or..
Anyway, they started this thread Server Compromised? after almost 1 year of inactivity:

Just received this:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

You are receiving this message because your email address is associated
with an account on bitcointalk.org. I regret to have to inform you that
some information about your account was obtained by an attacker who
successfully compromised the bitcointalk.org server. The following
information about your account was likely leaked [...]

Is there any way to check if password was changed between forum hack (May, 22. 2015.) and that email (May, 25. 2015.)? That could be good indicator.

[S_Therapist]

Is there any way to check if password was changed between forum hack (May, 22. 2015.) and that email (May, 25. 2015.)? That could be good indicator.

I have tried to find out but seems there is no way to find users total password change/reset history. You may contact with @yogg since he was also searching for such kind of data last year.

Is there any way to check the seclog archives for between 2015 and 2017 ? Yeah, I know it's 24 months and it keeps only the last 30 days...  

Edit- I also checked same as SFR10, got some archived page but didn't find any log for this user.

[actmyname]

1LG9NweYZkmfaKW6XyLcB3uLhqR73WMCmv via The ∑ Number Game (archive)
and
1MsXYJikZmCaPgzTHGAMmjLbP9D7QRJ8E5
1Eh3JfsScTThANXZByTjno8PSJrHEtmB6j from the winner's transaction: tx (being from MtGox)

1Gdc8pDDemYFr5zTRs4bwNsVurF8dSxZHw from Christmas Auction IRC and address historyGonna need a signed message.


WalletExplorer yields these results:

Code:

1LG9NweYZkmfaKW6XyLcB3uLhqR73WMCmv
1L6C4K8b7uvZbGXkSCPBuy12RBecpzuSZL
1DNoXfrzYKiyY6p6xDByRBKLmg1UnCu4jz
1JBMWNtWkyo1MFHMf7BFPyF5GuAaC5td3h
18BDV9v7hpqaeDLVKNDVvo8VSkmcqnFuvh
1Gdc8pDDemYFr5zTRs4bwNsVurF8dSxZHw
1HiMEgHQkppmW3gUfr1pudBUzp8pAmYXY8
1PLmuBCFiiWX2DjvcTvxssFs6Yyv5N1hDZ
1D8dqFQgT2zZdjEmLwRY3giCMK63DuQp2G

Or perhaps a signed message from the key used here: https://bitcointalk.org/index.php?topic=83059.msg5288700#msg5288700 (archive)
Or this one, if it's different. https://bitcointalk.org/index.php?topic=61080.msg717433#msg717433 (archive)

[TMAN]

https://bitcointalk.org/index.php?topic=5099391.msg49396732#msg49396732

the user dodged the question when it was bought up before...

anyone want a bet its a compromised account?

[JusticeForYou]

~snip

I don't have access to this address now they are pretty old. I just have access to the email which I used from when I created this account.

[actmyname]

~snip

I don't have access to this address now they are pretty old. I just have access to the email which I used from when I created this account.

How about the GPG key? This is 2014, before the leak.

[qwk]

anyone want a bet its a compromised account?

I suspect that it's not hacked, but that's just a gut feeling.
No bet.

edit: theymos could possibly send an email to his last known email address.

The email I received returned:

Bad signature by Michael Marquardt <michael_m+pgp@mm.st>

[JusticeForYou]

How about the GPG key? This is 2014, before the leak.

As, I said I don't have access to the old keys because my old hard drive was crashed and I was not able to recover it.

Still, I have access to the original email and also many people here already know me.

edit: theymos could possibly send an email to his last known email address.

The email I received returned:

Bad signature by Michael Marquardt <michael_m+pgp@mm.st>

I would not be good with publishing my PMs publicly, but I can trust @qwk and send him a PM with a screen shot of my PMs from 2012 ( oldest once) which include my original email mentioned. And later he could confirm, what is my original email from much years.

[Hhampuz]

An email will hardly prove anything. Looking at your post history (Sure, it's been years), you look like a completely different person.

Now I won't judge too much, numerous things can happen which would change someones style of writing but in your case it is quite extreme.

Until address can be signed or other form of signing method I'll be in doubt. Could be wrong but that's just what it looks like (Especially since you instantly started voicing strong opinions after being inactive for years).

[actmyname]

As, I said I don't have access to the old keys because my old hard drive was crashed and I was not able to recover it.

Still, I have access to the original email and also many people here already know me.

Why did you change your name, exactly? And when did your hard drive crash?

[JusticeForYou]

An email will hardly prove anything.

Yes, it proves much things about my identity, atleast to the people I know.

(Especially since you instantly started voicing strong opinions after being inactive for years).

Yes, I see this accusation because I am talking about some anti DT stuff, but that is what I read and felt right to support. Nothing personal just a way I could make the community more decentralized.

Why did you change your name, exactly?

Good question  

I did this as I thought it would be worth to become someone with better justice. It has pretty big meaning which I would explain, sometime in the future.

And when did your hard drive crash?

It was around Jan 2016 due to a electricity overload in my house.

[The Sceptical Chymist]

The post quality has changed since 2011, at least to my eyes.  Not that his English was perfect back then, but it seems to have been much better than what he's been writing lately. 

It's also a bit weird that an old-timer would suddenly inject himself into the middle of all of this forum drama after all this time, especially given those periods of inactivity.  Being inactive sort of makes me think he wouldn't care so much about the DT issues and whatnot...and then suddenly he appears.

I never noticed this thread, apparently--or I didn't pay attention to it when it was created.  Now I'm really curious as to whether it's the original owner posting.  Not sure how he can prove it if he can't sign a message.  PMs and e-mail are kind of iffy forms of proof, but I'll keep my eye on this thread.