Coinomi BUG or ...?

[pizza50]

i just updated yesterday my coinomi desktop wallet ... and like for 3-4 minute the whole coinomi screen with accounts and balance was frozen and in screen appear more than 2,6 million hash and password (i saved all data with the ctrl+c and v function) like

MD5(SALTPLAIN) 9e1e01ec93c98152f1a41b2ad779dac7:t67SaDq4NhFL7Q8UiVKuapR0U526axqG:Martinez5*
MD5(SALTPLAIN) 9e1e0855d3757abec81d941dcfe7511f:teKoHEjEJmf69G1NCBcQj68mPA9YODyT:Harry2008!
MD5(SALTPLAIN) 9e1eea1ac88d674d9d7437f3bd811580:jAoXfrfrZEwSFCwXdJXnPp3cPvYV8mbx:Spout500!
MD5(SALTPLAIN) 9e1f1771d6faeff0bb9b88888676dc5c:tsNpCU8CmqhwFlkAmVZ1fgkWgvsvBCf3:Joshua#1
MD5(SALTPLAIN) 9e1f8213a755e1f11e5f56d750378998:XKZxF1Jmq41W9dUgVdxF5UYSExpNbcko:May292009
MD5(SALTPLAIN) 9e1fd4f70b4fd5d73df2c6bc426f4eeb:jDkRzqo7BdA0hFShNDPdrgXeFDOQ8Q8o:Darlene5
MD5(SALTPLAIN) 9e200b9b6d49c30952be3dd3f220227e:5RVuru1Ec3936BBRYSKbisCQ4uXmOH5B:Africa97
MD5(SALTPLAIN) 9e20eb0133849e18f9845b09507e1d75:z2IyHlcgZkgBFg1vkRds1rPlR6eU7PDH:abc12345%
MD5(SALTPLAIN) 9e213146a374925c4251c3f99d1571c4:v1z6NhPTe25H4vQy5cM6AeA591Do6teh:chris0505
MD5(SALTPLAIN) 9e216fa6c6aa422cb519b72d09a250af:VsHui1XXKJoQcWKmkGHpqQjUTLyOjzl8:Windows.1
MD5(SALTPLAIN) 9e21df9d6a45b36008415b02bd5c49f9:cNCelGKO6qbhMDGr6mytBnXVQeSfOfHw:coolmom7
MD5(SALTPLAIN) 9e224247733b78db474d81817c39bb6b:V1DTxzmV6lvr5PjV2TlYue5pW7DdTU8T:B2thelake
MD5(SALTPLAIN) 9e23a82cec57d50f60b3534a19611636:ProithAAcq8UehoLoGpEym1o9dsgLMjD:comfort2
MD5(SALTPLAIN) 9e2423338f6ffbc92db1464607fa55d2:bXQxgAaa0Y5JLcKOizwS63boFNT7vQGp:newyork1$
MD5(SALTPLAIN) 9e24a96fa3d19b53c57eee8400c1146d:OoSK7glEyoJVXsrWRgO85RG14bvn6suR:almando1
MD5(SALTPLAIN) 9e24e9ec093695ac2a287ae9ca48fd76:6vuGgbyay4gGgPcY29hDo1cFkBdEry74:Lolalola1!
MD5(SALTPLAIN) 9e258894ca9cf477a0189f9eb47948fe:Tmp6oHzlf1MA6vJl9XsgBHFdMzgREb9Z:1Michelle
MD5(SALTPLAIN) 9e2725e19387519f8b7f2e7dacab44b5:NBa08pxqumWozsgQsJncBcPucigbruo7:Flyboy00
MD5(SALTPLAIN) 9e286d2faa4e0a898699ea971874072a:qzTBgo9ZtIDqFJdZMBIohk0WBKpaYYOw:Soccer13$
MD5(SALTPLAIN) 9e287b9ecf18751f3d57a39084858669:94bXx0eE0vfm4GbtoSlr14ISKn8k7jL8:Daddysgirl1!
MD5(SALTPLAIN) 9e28a112907c074734e4b39728a4f2a3:opUZalvALekFUOv2CSvRjXuatwlBH605:987654321ali

what you think what was happens? its a bug, what kind of data are this?

[1714981994]

1714981994

[1714981994]

1714981994

[1714981994]

1714981994

[mocacinno]

I'm defenately not a fan of coinomi... But it would seem strange if they actually used your pc for bruteforcing salted md5 hashes...

I have no idear who you are, what your technical knowledge is, and how clean you keep your computer... But my first tought would be that you downloaded some malware, even a fake version of coinomi, and the malware is using your computer's resources to crack passwords...

Only my first tought tough... No idear if coinomi messed up, but the odds are bigger that you downloaded some malware next to coinomi.

Did your system load increase dramatically while this event was happening?

[pizza50]

i run kaspersky + malwarebytes licensed version
my crypto money is safe, nobody accessed my pc
coinomiwas downloaded from official website ....

[bob123]

i run kaspersky + malwarebytes licensed version

This doesn't mean anything.

coinomiwas downloaded from official website ....

We hear that extremely often. And in the end the user made a mistake and it was a phishing site.
Did you at least verify the checksum?

Code:

.exe checksum (SHA256):65b3d96a0ff403fee6166be5149df9f270466b3ed24ba77bcf3c58cb7a815607 

Not that hosting the executable and the checksum on the same page would be secure.. but at least that's something.

Could you answer mocacinno's question?

Did your system load increase dramatically while this event was happening?

Generally, i would recommend you to not use coinomi.
There are better and more secure wallets available.

[jackg]

i run kaspersky + malwarebytes licensed version
my crypto money is safe, nobody accessed my pc
coinomiwas downloaded from official website ....

Different AVs can interfere with each other so I'm not sure keeping both is a great idea and if you have they're probably configured to not look at the same section of disk at once which could cause a problem...

Have you tried running a kaspersky scan? Did you get a community warning when you installed coinomi to say fewer than 50 people installed it (I used to get it and ignore it in electrum). You could try scanning the exe file in both to see if someone's been stupid enough to make a trojan and not a virus but I'd stop running coinomi immediately just in case it's a virus and check there's nothing weird running in the task manager if you can (you can Google the handle of tasks you don't recognise to see if they're created by your os but this might be futile if the malware is able to intercept this information and change it)...

I don't know what official coinomi comes with but it does look like you're being used as a botnet like the others said...

[pizza50]

checksum verified
no extra process work no extra resources is consuming in my pc ..so for sure nobody using my calculator for hash cracking, etc
and this strange things appeared only 1 time ... i use coinomi from mre than 1 year
only 1 time exactly when i updated the software

[TryNinja]

You didn't take a screenshot of it?

I have PM'ed Brenny_Coinomi about this thread. Maybe - if that really happened - it's something which can be explained by him?

[pizza50]

and the strange things is that i fund my password in that list - and i use a really long and complex password for coinomi ...

[Lucius]

i just updated yesterday my coinomi desktop wallet ... and like for 3-4 minute the whole coinomi screen with accounts and balance was frozen and in screen appear more than 2,6 million hash and password (i saved all data with the ctrl+c and v function)

How did you get to the number of 2.6 million passwords? I suppose they're not counted manually, is that number show somewhere in Coinomi UI?

and the strange things is that i fund my password in that list - and i use a really long and complex password for coinomi ...

To me, this is really weird, because according to what Coinomi says, all user data is only on the user's device, and there is an encrypted application data folder where seed/keys are stored. What interests me is where the user's password is stored? According to this, it turns out that it is located on a Coinomi server that sent everything to one user during an update in some crazy bug

Assuming everything is stored locally, then it is impossible for one program to connect to millions of computers and pull all this data - or is it still possible?

[BrewMaster]

To me, this is really weird, because according to what Coinomi says, all user data is only on the user's device, and there is an encrypted application data folder where seed/keys are stored. What interests me is where the user's password is stored? According to this, it turns out that it is located on a Coinomi server that sent everything to one user during an update in some crazy bug

words of a centralized and closed source wallet mean absolutely nothing. it would be like Coinbase saying they aren't sending all your activities to the authorities every second.
they also have a bad history of doing strange things that make no sense like sending the seed to their server to be checked! so i wouldn't be surprised if their servers also stored the wallet passwords.

[mocacinno]

and the strange things is that i fund my password in that list - and i use a really long and complex password for coinomi ...

This changes everything... If there is even a shred of evidence this would mean that they were caught sending sensitive data "home" for the second time...

Do be careful, the first time (when they allegedly sent seeds to Google) they spent loads of time, effort and money to "bury" the guy that uncovered the alleged infractions.

[pizza50]

because i thought is something really strange i saved all them with ctrl+c and v in a text file (i use editpad pro) and its easy to count ... i mark the last line and editpad show the line number
maybe if the coinomi application did not freze so hard,  would have been more lines ... who know
i think this are not seeds or anything related to keys, they are coinomi passwords - when a coinomi wallet owner will send out money need put this password to approve the transfer
anyway is very very strange how can this appear in the application ..

i just updated yesterday my coinomi desktop wallet ... and like for 3-4 minute the whole coinomi screen with accounts and balance was frozen and in screen appear more than 2,6 million hash and password (i saved all data with the ctrl+c and v function)

How did you get to the number of 2.6 million passwords? I suppose they're not counted manually, is that number show somewhere in Coinomi UI?

and the strange things is that i fund my password in that list - and i use a really long and complex password for coinomi ...

To me, this is really weird, because according to what Coinomi says, all user data is only on the user's device, and there is an encrypted application data folder where seed/keys are stored. What interests me is where the user's password is stored? According to this, it turns out that it is located on a Coinomi server that sent everything to one user during an update in some crazy bug

Assuming everything is stored locally, then it is impossible for one program to connect to millions of computers and pull all this data - or is it still possible?

[LoyceV]

and the strange things is that i fund my password in that list - and i use a really long and complex password for coinomi ...

Any chance I can have your file (the one with 2.6 million lines)? Feel free to remove your own password first. If you encrypt it and upload it somewhere secure, I'd like to see if by any chance my own password is in your list. I only use Coinomi on mobile though.
I don't expect my password to be in your list, but if it is, it proves something is terribly wrong.

[cr4zyd3v]

Does someone knows if "SALTPLAIN" means it is salted or not? Have you tried to hash your current password in an md5 hasher and compare the result against the hash associated with your username in the list?

If they are equals, that should be very relevant

[DaveF]

I smell BS
1) Running 32 cores hard I can't hash and write 2,600,000 lines to an SSD with the machine doing nothing else for 5 minutes
2) New user we never heard from before having an issue like this.
3) Copy / pasting that much data in Windows will slow it to a crawl unless you have gigs and gigs of free RAM.

-Dave

[ABCbits]

Whether it's Coinomi bug or malware that pretends as Coinomi, i think what you should do are :
1. Immediately move your cryptocurrency from Coinomi to another wallet using clean/secure computer
2. Format your storage & reinstall your OS

[DaveF]

Whether it's Coinomi bug or malware that pretends as Coinomi, i think what you should do are :
1. Immediately move your cryptocurrency from Coinomi to another wallet using clean/secure computer
2. Format your storage & reinstall your OS

And just don't move the coins. Use a new wallet. Just don't move the seed.

Although I still claim BS. I asked a programmer I know this morning about it.

More or less it came back as: 2.6 million hash. Let's do math.
2.5 million / 5 minutes. Both a longer time then the OP said and a smaller number of hashes.
that is 500,000 a minute. Or 8300 a second. Could be done with a very optimized PC app if they were using the GPU also.
But there is still no way in hell you could display to the screen and write to a file at the same time.

-Dave

[khaled0111]

I don't know what official coinomi comes with but it does look like you're being used as a botnet like the others said...

I don't think so as I also disagree with other members believing that OP downloaded a malware which uses his computer to crack md5 hashes simply because those are salted md5 hashes (password + salt).

However, I agree with DaveF. I find it hard to believe that a random user was able to generate or download 2.6 million hashes in 4-5 minutes and copy pasted all the data to a text file without causing the computer to freeze unless it's really a very powerful one.
Besides, if it was really caused by a bug on Coinomi servers then the question is why are they saving hashes, salts and passwords (plain text) on the same table!! it's not safe and I doubt they would make such mistake.

[bob123]

I smell BS
1) Running 32 cores hard I can't hash and write 2,600,000 lines to an SSD with the machine doing nothing else for 5 minutes
2) New user we never heard from before having an issue like this.
3) Copy / pasting that much data in Windows will slow it to a crawl unless you have gigs and gigs of free RAM.

Let's do some math.

OP posted 21 lines which need 1912 Byte of storage.
That's roughly 91 Byte per line.

91 Byte * 2.600.000 Lines = 236600000 Byte = 225 MB

That's definitely not too much to copy/paste and doesn't need gigs of free RAM.

Copy/pasting that definitely will take some time (maybe ~5 minutes?). So technically.. OP could tell the truth.
However i agree with you, that this seems to be quite unlikely. Especially since OP only registered here to create this thread.

[pizza50]

https://bitcointalk.org/index.php?action=profile;u=459836
LoyceV
Legendary
Activity: 1904
Merit: 6555

he was the first who requested the list ...i will send him
you have right i am new user and probable not enough trustworthy, but he is trusted enough, i will send him the list
he will the community more about ...

its a 214 MB file ... as i see some lines are duplicated, i think i have at least 500 k lines
and yes, i have a dell latitude 7480 with very good i7 processor and some gb ram...

and the strange things is that i fund my password in that list - and i use a really long and complex password for coinomi ...

Any chance I can have your file (the one with 2.6 million lines)? Feel free to remove your own password first. If you encrypt it and upload it somewhere secure, I'd like to see if by any chance my own password is in your list. I only use Coinomi on mobile though.
I don't expect my password to be in your list, but if it is, it proves something is terribly wrong.