raritycheck
Copper Member
Full Member
Offline
Activity: 697
Merit: 179
|
|
August 09, 2024, 05:03:55 AM |
|
I may have responded a bit harshly originally, but it infuriates me when this level of incompetence is allowed to flourish in this space.
It's good to see rarity making people whole, but there is zero room for incompetence in this space. You should never make and sell another key ever again rarity, have someone trusted do it or stick to DIY.
Furthermore, I have no skin in the game here, however, in case I have to point it out to everyone, he's been saying the whole time that he was using a new vanitygen software then the big reveal is that he used a compromised walletexplorer.net
Last I checked, walletexplorer.net has never been a vanity address generator, so I'm calling BS on that.. And don't even get me started on those ghetto ass printed keys shown.
I ain't buyin' any of it guys. And like I said, I have no skin in this game, I'm just speaking truth and offering advice.
I have played around with compromised wallet software before, when you fund a compromised address, 99% of the time the funds are swept within minutes.
I would advise everyone to secure their BTC. Don't say I didn't warn you if this turns out to be a test run and the next one sweeps everything
Apologies. Just to clarify we were saying that we were trying different software and we only remember why we changed the software was because we were trying vanity address generation and toward the end abandon the vanity generation and in the whole process (for god knows what reason) we needed up using walletgenerator. We really regret making the switch. But that was the whole reason why we went away from bitaddress in the first place.
|
|
|
|
MoparMiningLLC
aka Stryfe
Legendary
Online
Activity: 2240
Merit: 2383
EIN: 82-3893490
|
|
August 09, 2024, 05:04:35 AM |
|
based on the quality of the paper and ink used - I recommend peeling all of RC coins - many of them have ink that is bleeding which will only get worse over time.
This is not true. During the printing itself it looks some hole coins might have not properly printed paper but we have used waterdrop water proof paper and the ink does NOT bleed. Please don’t spread lies. not spreading lies - I have shown the keys to multiple people - Polymerbit and Minerjones - both agreed they ink was bleeding. and if they were crystal clear multiple people would not have had issues and needed help. one pk had 2 "Q" and they were not even the same size - one appeared to be either a different font or a different size if the same font.
|
|
|
|
raritycheck
Copper Member
Full Member
Offline
Activity: 697
Merit: 179
|
|
August 09, 2024, 05:05:32 AM Last edit: August 22, 2024, 06:32:12 PM by hilariousandco |
|
based on the quality of the paper and ink used - I recommend peeling all of RC coins - many of them have ink that is bleeding which will only get worse over time.
I believe Krogoth mentioned the Vigilante coin keys were crystal clear. VIBGYOR coins are also crystal clear. For hole coins sometimes there can be slight doubt between 3 and J. But we are here to help and we will try our best to help others. I have seen several VIBGYOR pk's that were NOT clear. Not clear and not bleeding are different things. All VIBGYOR coins are readable . And if someone peels their coin and cannot make the key please message us we will help. based on the quality of the paper and ink used - I recommend peeling all of RC coins - many of them have ink that is bleeding which will only get worse over time.
This is not true. During the printing itself it looks some hole coins might have not properly printed paper but we have used waterdrop water proof paper and the ink does NOT bleed. Please don’t spread lies. not spreading lies - I have shown the keys to multiple people - Polymerbit and Minerjones - both agreed they ink was bleeding. We used waterdrop waterproof paper. How can the ink be leaking ? We are asking so we make sure this doesn’t happen again.
|
|
|
|
raghavsood
Copper Member
Sr. Member
Offline
Activity: 378
Merit: 477
Track Burns @ burned.money
|
|
August 09, 2024, 05:08:30 AM |
|
We made a mistake. We have been doing lots of digging since morning on how this could have happened. We knew this isn't a hardware issue as we never connect any of our hardware to internet. Plus, we have no backups so this isn't a personnel issue. Issue is with the keygen software we used. In full transparency, for the first version of vigilante series, and for the hole coins we have used https://github.com/bitaddress/bitaddress.org to create keys on an airgap computer. For VIBGYOR orange we used https://github.com/walletgeneratornet/WalletGenerator.net again on an airgap computer. Unfortunately, since morning we started digging into looks like walletgeneratornet is actually compromised. We have learned from our mistake and we can only look forward from here. We have been refunding the clients (still few to go). For next generation of our coins, we will use better keygens + also, print and post sample private keys before using those for the coins. We appreciate all support from the forum members. Thank you for sharing the software. However, this does raise more questions, and it would be very helpful to have as many answers as possible. 1. Were the keys generated using the code from this specific GitHub repository on an offline computer (i.e. are you certain it was this repo and not a fork/similar looking clone?) 2. If the repo wasn't directly used and you used the website instead, are you certain it was "walletgenerator. net"? .org has been known to be a phishing site for a long time, and .net presently redirects to .com 3. Are you able to provide the exact date (or narrowest date range) when the generation was done? In the event that there is a malicious site or repo, knowing the exact time frame will assist in scouring sources such as archive.org to find more details 4. You mentioned previously that you still had the original hardware used - I would suggest quarantining it and not using it any further. On that hardware, do you still have a copy of the source code used/website listed in the browser history? For anyone to look into this in more detail, it is imperative that we have as much information as possilbe.
|
|
|
|
MoparMiningLLC
aka Stryfe
Legendary
Online
Activity: 2240
Merit: 2383
EIN: 82-3893490
|
|
August 09, 2024, 05:08:54 AM |
|
based on the quality of the paper and ink used - I recommend peeling all of RC coins - many of them have ink that is bleeding which will only get worse over time.
This is not true. During the printing itself it looks some hole coins might have not properly printed paper but we have used waterdrop water proof paper and the ink does NOT bleed. Please don’t spread lies. not spreading lies - I have shown the keys to multiple people - Polymerbit and Minerjones - both agreed they ink was bleeding. We used waterdrop waterproof paper. How can the ink be leaking ? We are asking so we make sure this doesn’t happen again. I will share the pics tomorrow, I am in bed just on my phone so not on PC with the pictures.
|
|
|
|
raritycheck
Copper Member
Full Member
Offline
Activity: 697
Merit: 179
|
|
August 09, 2024, 05:09:33 AM |
|
This is for the website- not for the code on github which RC said he used. One of the main reasons this vulnerability was found was by comparing the two code bases, which revealed the addition of the malicious code. From that medium article you posted in (2019): 'At this time, the code on GitHub is not malicious nor vulnerable, nor has it been malicious or vulnerable previously.' Last checkin for that code on github appears to be 7 years ago. Even if that code was compromised, if it was on an air gapped system theres no way it could have communicated the keys back to the malicious actors. Something doesnt smell right here. Okay I was about to remove my negative trust for this incident considering the refunds and finally revealing the software, but it still doesn't add up. If the github repo that raritycheck cited is not vulnerable, then there is more to the story. Surely after 7 years someone would have reported an issue on github. It was pure luck. We wanted to try creating vanity addresses (1O) for VIBGYOR coins so we looked at multiple options. In the end we didn’t end up creating vanity addresses But still went with the software we trying to generate vanity addresses
We are currently trying to help every impacted customer. Please note that we aim to reach out to every single one by Sunday evening.
Additionally, you stated that you used this software to generate vanity addresses, but it does not support generating vanity addresses. From what I can tell it offers no functionality above what bitaddress.org does except for supporting dead shitcoins. I don't want to seem like we are being overly critical, and I want to commend you for refunding people, but the fact you waited this long to even give us the name of the software tells me you are still not sharing the full story. Perhaps because it said vanitygen, they assumed it would do such but maybe they changed their mind or figured after the fact it didn't, but decided to stick with it for whatvever reason(s). Not sure, but maybe that's possible. The addresses that were sweeping seemed to be collecting coins from a few, if not many sources. Seems things will come to light sooner than later. Yes this is correct. Unfortunately, we decided to sill change and hence this mishap.
|
|
|
|
buckrogers
Legendary
Offline
Activity: 2745
Merit: 1181
|
|
August 09, 2024, 05:27:05 AM |
|
but we will sell DIY coins if needed This would be nice, and I look forward to seeing some nice designs Thanks!
|
Well I'm dr. spock I'm here to rock y'all
|
|
|
raritycheck
Copper Member
Full Member
Offline
Activity: 697
Merit: 179
|
|
August 09, 2024, 05:27:52 AM |
|
We made a mistake. We have been doing lots of digging since morning on how this could have happened. We knew this isn't a hardware issue as we never connect any of our hardware to internet. Plus, we have no backups so this isn't a personnel issue. Issue is with the keygen software we used. In full transparency, for the first version of vigilante series, and for the hole coins we have used https://github.com/bitaddress/bitaddress.org to create keys on an airgap computer. For VIBGYOR orange we used https://github.com/walletgeneratornet/WalletGenerator.net again on an airgap computer. Unfortunately, since morning we started digging into looks like walletgeneratornet is actually compromised. We have learned from our mistake and we can only look forward from here. We have been refunding the clients (still few to go). For next generation of our coins, we will use better keygens + also, print and post sample private keys before using those for the coins. We appreciate all support from the forum members. Thank you for sharing the software. However, this does raise more questions, and it would be very helpful to have as many answers as possible. 1. Were the keys generated using the code from this specific GitHub repository on an offline computer (i.e. are you certain it was this repo and not a fork/similar looking clone?) 2. If the repo wasn't directly used and you used the website instead, are you certain it was "walletgenerator. net"? .org has been known to be a phishing site for a long time, and .net presently redirects to .com 3. Are you able to provide the exact date (or narrowest date range) when the generation was done? In the event that there is a malicious site or repo, knowing the exact time frame will assist in scouring sources such as archive.org to find more details 4. You mentioned previously that you still had the original hardware used - I would suggest quarantining it and not using it any further. On that hardware, do you still have a copy of the source code used/website listed in the browser history? For anyone to look into this in more detail, it is imperative that we have as much information as possilbe. Hi Raghav We know you are trying to help and we will answer your questions. But please note that most of the team are software engineers in their day job and the only mistake in this whole process is that we truly blindly trusted a compromised software. We think the wallet generator either has a back door or someone has done an RNG attack How we created the keys were we connected the computer via lab cable to the internet to download the client side side site from walletgenerator and the disconnected the cable No hardware (printer) was connected to wifi. All hardware is wiped (windows uninstalled and hard disk wiped) after usage. About dates that is the main reason why we took sometime. After i reached home after my day job I started looking at my personal device to check historically when was the first time i was researching on key gen software and looking at all sales thread and when exactly it could be that we created the keys. But unfortunately as we have no back up of any kind it is impossible to tel exactly. But we feel it might be between July and November 2022.
|
|
|
|
LoyceV
Legendary
Offline
Activity: 3472
Merit: 17516
Thick-Skinned Gang Leader and Golden Feather 2021
|
This website is known to steal Bitcoins for almost as long as I can remember! That's not just a rookie mistake, it's plain negligence. A simple forum search would have brought you to Disclosure: Key generation vulnerability found on WalletGenerator.net (in 2019). Using compromised software offline doesn't make it safe. We didn’t realize walletgenerator has an issue. That can only mean you didn't even search for it, otherwise you'd have found many warnings signs. From that medium article you posted in (2019): 'At this time, the code on GitHub is not malicious nor vulnerable, nor has it been malicious or vulnerable previously.' Last checkin for that code on github appears to be 7 years ago.
Even if that code was compromised, if it was on an air gapped system theres no way it could have communicated the keys back to the malicious actors. Something doesnt smell right here. There's another paper wallet website that turned into stealing Bitcoins after the site was sold, and even offline it produces compromised keys. See this post. There's no need to use potentially compromised software, there's more than enough legit software out there.
Coin refunds should absolutely unequivocally be above just load value, anything less is a slap in the face and bullshit, period. I'm not into collectibles (for privacy, and for "verify, don't trust"), but as far as I know the value of collectibles comes from scarcity, and age. Buyers pay more than just the Bitcoin value when they buy them, which means refunding just the Bitcoin amount is less than the damage done when it got compromised. Even replacing it with a new one removes the "age" of the coin, so doesn't fully fix the value. And that's even ignoring the fact that being compromised even once makes all future coins lose their credibility.
So yes we were incompetent. Yes we have made a mistake. ~ Please stay a little supportive and positive. In my country, we have these sayings: - Trust comes on foot and goes on horseback
- A donkey doesn't hit the same stone twice
This post is my Reference link for neutral feedback.
|
|
|
|
Mitchell
Staff
Legendary
Offline
Activity: 4074
Merit: 2262
Verified awesomeness ✔
|
|
August 09, 2024, 08:54:02 AM |
|
Removed my negative for now, but I cannot wrap my head around why you would use some online wallet generator? Even if the source code wasn't compromised (which it must have been, otherwise, how are we here), why would you ever choose that over actual (airgappable) wallets.
|
| | | . Duelbits | | | ▄████▄▄ ▄█████████▄ ▄█████████████▄ ▄██████████████████▄ ▄████▄▄▄█████████▄▄▄███▄ ▄████▐▀▄▄▀▌██▄█▄██▐▀▄▄▀▌███ ██████▀▀▀▀████▀███▀▀▀▀█████ ▐████████████■▄▄▄■██████████▀ ▐██████████████████████████▀ ██████████████████████████▀ ▀███████████████████████▀ ▀███████████████████▀ ▀███████████████▀ | | | | | . ▄ ▄▄▀▀▀▀▄▄ ▄▀▀▄ █ █ ▀▄ █ ▄█▄ ▀▄ █ ▄▀ ▀▄ ▀█▀ ▄▀ ▀█▄▄▄▀▀ ▀ ▄▀ ▄▀ ▄▀
Live Games | | ▄▄▀▀▀▀▀▀▀▄▄ ▄▀ ▄▄▀▀▀▀▀▄▄ ▀▄ ▄▀ █ ▄ █ ▄ █ ▀▄ █ █ ▀ ▀ █ █ ▄▄▄ █ ▀▀▀▀▀▀▀▀▀▀▀▀▀ █ █ █ █▀▀▀▀▀▀▀▀▀▀▀▀▀▀▀█ █▄█ █ ▀▀█ ▀▀█ ▀▀█ █ █▄█
Slots | | . ▄▀▀▀▀▀▀▀▀▀▀▀▀▀▄ █ ▄▄ █ ▄▀▀▀▀▀▀▀▀▀▀▀▀▀▄ █ █ ▄▄ █ █ █ █ █ █ ▄▀▀▄▀▀▄ █ █ █ ▀▄ ▄▀ █ █
Blackjack | | | | █▀▀▀▀▀█▄▄▄ ▀████▄▄ ██████▄ ▄▄▄▄▄▄▄▄█▀ ▀▀█ ████████▄ █ █████████▄ █ ██████████▄ ▄██ █████████▀▀▀█▄▄████ ▀▀███▀▀ ████ █ ███ █ █▀ ▄█████▄▄▄ ▄▄▀▀ ███████▀▀▀ | | | | | | | | | | [ Đ ][ Ł ] AVAILABLE NOW | |
Advertisements are not endorsed by me.
|
|
|
tweetious
Sr. Member
Offline
Activity: 2052
Merit: 399
Cryptoshi Blockomoto
|
|
August 09, 2024, 11:02:56 AM |
|
We made a mistake. We have been doing lots of digging since morning on how this could have happened. We knew this isn't a hardware issue as we never connect any of our hardware to internet. Plus, we have no backups so this isn't a personnel issue.
How we created the keys were we connected the computer via lab cable to the internet to download the client side side site from walletgenerator and the disconnected the cable No hardware (printer) was connected to wifi.
First of all, we are not judging you here. We are not asking questions to understand if you made a small or a big mistake, to convict/"crucify" you later on. We are all making mistakes. Being here answering questions & trying to find solutions is really appreciated. What is important here, is that we need to understand exactly how this leak happened. Was it a mistake by your side (ie you used a compromised key gen and mistakenly the airgap computer was connected to the internet and the generated key pairs were leaked) OR you actually use the key gen in a proper way -airgap computer, compiled the key gen from github source code in you airgap computer etc. etc.- and still the priv keys were leaked? If it was the first case, then fair enough. However, if it is the second case, we REALLY need to know all the details to protect others from creating compromised key pairs. I am not technical enough (there are many highly technical individuals here, hence please correct me if I am wrong), however the only way I can think of -in the second case- that the priv keys could be leaked from an airgap computer, is if the entropy used for generating the key pair was not random. Hence, if someone knows the exact entropy used, they could probably generate the same key pairs. My question here is: Did you compile the key gen (on the air gaped computer) from the github source code OR you used a pre-compiled file (from the github or eleswere). If the second, could you please indicate what exactly you used? Again, we are not asking questions to turn the answers against you. Since (as you are saying too) this has probably affected many others - even outside of the collectibles community- we just want to protect others from falling into the same mistake. And in order to protect them, we need to work out exactly how the priv keys were leaked. (and your collaboration on that would be of crucial importance) Lastly (and here my above quotes apply) if I understand this correctly the term "airgap" refers to hardware never connected to the internet. Hence if you connected the hardware to the internet (even for 1 second) then the term "airgap" might not still apply. I am just trying to help here, no negativity whatsoever
|
|
|
|
raghavsood
Copper Member
Sr. Member
Offline
Activity: 378
Merit: 477
Track Burns @ burned.money
|
|
August 09, 2024, 11:19:06 AM |
|
We made a mistake. We have been doing lots of digging since morning on how this could have happened. We knew this isn't a hardware issue as we never connect any of our hardware to internet. Plus, we have no backups so this isn't a personnel issue.
How we created the keys were we connected the computer via lab cable to the internet to download the client side side site from walletgenerator and the disconnected the cable No hardware (printer) was connected to wifi.
First of all, we are not judging you here. We are not asking questions to understand if you made a small or a big mistake, to convict/"crucify" you later on. We are all making mistakes. Being here answering questions & trying to find solutions is really appreciated. What is important here, is that we need to understand exactly how this leak happened. Was it a mistake by your side (ie you used a compromised key gen and mistakenly the airgap computer was connected to the internet and the generated key pairs were leaked) OR you actually use the key gen in a proper way -airgap computer, compiled the key gen from github source code in you airgap computer etc. etc.- and still the priv keys were leaked? If it was the first case, then fair enough. However, if it is the second case, we REALLY need to know all the details to protect others from creating compromised key pairs. I am not technical enough (there are many highly technical individuals here, hence please correct me if I am wrong), however the only way I can think of -in the second case- that the priv keys could be leaked from an airgap computer, is if the entropy used for generating the key pair was not random. Hence, if someone knows the exact entropy used, they could probably generate the same key pairs. My question here is: Did you compile the key gen (on the air gaped computer) from the github source code OR you used a pre-compiled file (from the github or eleswere). If the second, could you please indicate what exactly you used? Again, we are not asking questions to turn the answers against you. Since (as you are saying too) this has probably affected many others - even outside of the collectibles community- we just want to protect others from falling into the same mistake. And in order to protect them, we need to work out exactly how the priv keys were leaked. (and your collaboration on that would be of crucial importance) Lastly (and here my above quotes apply) if I understand this correctly the term "airgap" refers to hardware never connected to the internet. Hence if you connected the hardware to the internet (even for 1 second) then the term "airgap" might not still apply. I am just trying to help here, no negativity whatsoever Based on a discussion I had with the team separately earlier today, they opened the website on the computer, before removing the internet connection and generating the keys. It does not appear that the tool was built from source. Unfortunately, that does make it extremely hard to validate anything more - even with a date range to work with, past investigations into walletgenerator knock-offs and scams have shown some degree of sophistication in serving "Good" generators to some IPs, and bad seeds to others. Without the original page used by the team to generate the keys being saved and available, it isn't really possible to look futher. Presumably, the backdoor took the same form as the one described in the previously linked reports in this thread - the page was seeded with bad random data which was saved by the attackers, and they've simply been biding their time for a few years before sweeping to let the pot grow. This matches the on-chain evidence as well.
|
|
|
|
MoparMiningLLC
aka Stryfe
Legendary
Online
Activity: 2240
Merit: 2383
EIN: 82-3893490
|
|
August 09, 2024, 12:47:05 PM Last edit: August 09, 2024, 02:24:49 PM by MoparMiningLLC |
|
based on the quality of the paper and ink used - I recommend peeling all of RC coins - many of them have ink that is bleeding which will only get worse over time.
This is not true. During the printing itself it looks some hole coins might have not properly printed paper but we have used waterdrop water proof paper and the ink does NOT bleed. Please don’t spread lies. not spreading lies - I have shown the keys to multiple people - Polymerbit and Minerjones - both agreed they ink was bleeding. We used waterdrop waterproof paper. How can the ink be leaking ? We are asking so we make sure this doesn’t happen again. I will share the pics tomorrow, I am in bed just on my phone so not on PC with the pictures. The first and last images are of rarity check coins, the first from one of the lost series. The last from VIBGYOR. The second and third images are of a key I generated. Here is the one that best represents what I am referencing as appearing to have the ink bleeding. and before you can say it is because it is being zoomed in so much. here is a key I made almost 2 years ago with 2 pt sized font - first image is showing how small it is and the second image is me zooming in on the same. It has no ink bleeding. and here is a key from VIBGYOR that I would not say is "crystal clear" update images replaced.
|
|
|
|
SwissCrab
Copper Member
Member
Offline
Activity: 236
Merit: 18
|
|
August 09, 2024, 03:16:49 PM |
|
My guess the hardware was not actually airgrapped.
But out of curiosity :
Which browser have you used ?
I had a quick look at securerandom.js (I did not inspect it throughly) :
It relies on the Web Crypto API (which is supported in all modern versions of browser), but if it is not supported it will fallback to Math.random() and/or ArcFour. Both are not cryptographically secure - it is non-cryptographic pseudo-random number generator (PRNG). I believe there is even a comment in the code about PRNG.
|
1 sat/vB 4ever
|
|
|
raritycheck
Copper Member
Full Member
Offline
Activity: 697
Merit: 179
|
|
August 09, 2024, 03:34:15 PM |
|
My guess the hardware was not actually airgrapped.
But out of curiosity :
Which browser have you used ?
I had a quick look at securerandom.js (I did not inspect it throughly) :
It relies on the Web Crypto API (which is supported in all modern versions of browser), but if it is not supported it will fallback to Math.random() and/or ArcFour. Both are not cryptographically secure - it is non-cryptographic pseudo-random number generator (PRNG). I believe there is even a comment in the code about PRNG.
Google Chrome.
|
|
|
|
hybridsole
|
Based on a discussion I had with the team separately earlier today, they opened the website on the computer, before removing the internet connection and generating the keys.
I went ahead and removed my negative trust, because I feel bad for you, and you have had to pay dearly for this mistake. But this sentence right here proves you should never, ever make any private keys for anyone ever again. Full stop. You don't need a "team" to generate keys, that's the first fuck up. If it wasn't the well known malware you used, it would have been someone in this "team" to save the keys for later. There was so much wrong with how you went about this, that to think you can salvage your brand and make more products is astounding. Let this thread be an example for anyone who wants to make their own coins. Don't. There is zero margin for error in this business. And without calling out this level of incompetency, we are only encouraging others to follow in your footsteps.
|
|
|
|
raritycheck
Copper Member
Full Member
Offline
Activity: 697
Merit: 179
|
|
August 09, 2024, 08:24:43 PM |
|
Based on a discussion I had with the team separately earlier today, they opened the website on the computer, before removing the internet connection and generating the keys.
I went ahead and removed my negative trust, because I feel bad for you, and you have had to pay dearly for this mistake. But this sentence right here proves you should never, ever make any private keys for anyone ever again. Full stop. You don't need a "team" to generate keys, that's the first fuck up. If it wasn't the well known malware you used, it would have been someone in this "team" to save the keys for later. There was so much wrong with how you went about this, that to think you can salvage your brand and make more products is astounding. Let this thread be an example for anyone who wants to make their own coins. Don't. There is zero margin for error in this business. And without calling out this level of incompetency, we are only encouraging others to follow in your footsteps. Thank you
|
|
|
|
raritycheck
Copper Member
Full Member
Offline
Activity: 697
Merit: 179
|
|
August 09, 2024, 08:35:31 PM |
|
Guys!
We also want to remind all that last year when the Yogg debacle happened, we volunteered to help everyone impacted by giving RC coins to each impacted forum member. Every single one impacted. We didn't say not to anyone and helped everyone.
And when something went wrong, most of the forum members rushed to immediately provide negative feedback and when we asked 12 hours of time, people were already concluding bad stuff about us on this forum. It hurts so much. That's all.
|
|
|
|
LoyceV
Legendary
Offline
Activity: 3472
Merit: 17516
Thick-Skinned Gang Leader and Golden Feather 2021
|
|
August 09, 2024, 08:41:03 PM |
|
And when something went wrong, most of the forum members rushed to immediately provide negative feedback and when we asked 12 hours of time, people were already concluding bad stuff about us on this forum. It hurts so much. That's all. You're wrong here: from what I've seen, people are very conservative with negative feedback. I've seen only 2 negative tags on your account, and the warning was justified. It's also easy to remove later. We also want to remind all that last year when the Yogg debacle happened, we volunteered to help everyone impacted by giving RC coins to each impacted forum member. Every single one impacted. We didn't say not to anyone and helped everyone. I think most people here agree that your heart is at the right place. But that's just not enough to create secure funded coins.
|
|
|
|
seavodin
Member
Offline
Activity: 149
Merit: 16
|
|
August 09, 2024, 09:43:19 PM |
|
We are not hiding anything. We are sorry if something doesn’t make sense. When we were creating keys for VIBGYOR we were (don’t remember what other soft gen) but we were looking to generate 1O (1Orange) for the first coins in the series. That’s all we remember the real reason For change of key gen solution. And moved from bitaddess to walletgenerator. That’s what we meant that we unluckily changed software. We took. Sometime because it was 1 am last night until we were responding to messages. Then we woke and went to work(day job) Then we came back and checked as much history as possible and we researched as much as possible and researched only to realized that walletgenerator is compromised.
But we are not hiding anything.
We didn’t answer because weren’t sure how this happened but as soon as possible we had time we responded.
Seavodin you have bough few coins from Is, what does your heart say? Did we really do something intentionally ? What does your interactions with us say? Will we hide somehting or makeup somehting ? Do you not think we are always helpful and caring as much as possible We are humans and yes a mistake is made for VIBGYOR series.
I dont think anyone here truly thinks you did this maliciously- you would be financially hurting yourself and your brand. It wouldnt make any sense and you would have just ghosted out of the community. But when any sort of a security leak happens, the person or entity involved typically tries to spin things in a way to take as little accountability as possible, and preserve as much trust from society as possible (it could happen to anyone right? just bad luck). This is why the sharing of information immediately is so vital, so your customers within this community can do an independent sort of 'audit' as opposed to you just investigating yourself. As mentioned by other members, there are quite a few engineers/programmers/technically savvy people on the board who can not only assist but verify claims. This is good for you and good for the community. When information isn't provided immediately, my first reaction is that the person/entity is playing for time and trying to spin the facts. I'm not saying that that was what you were necessarily doing here, but your actions up to that point seemed to indicate it. I appreciate your longer form responses later on, as it lets people understand a bit more about what was going on as opposed to having to speculate, like I did. Perhaps part of this is a language barrier thing, or a PR response kind of issue. I think Raghavsood provided the missing information here, which clears up how this occurred: Based on a discussion I had with the team separately earlier today, they opened the website on the computer, before removing the internet connection and generating the keys.
It does not appear that the tool was built from source.
Unfortunately, that does make it extremely hard to validate anything more - even with a date range to work with, past investigations into walletgenerator knock-offs and scams have shown some degree of sophistication in serving "Good" generators to some IPs, and bad seeds to others. Without the original page used by the team to generate the keys being saved and available, it isn't really possible to look futher.
Presumably, the backdoor took the same form as the one described in the previously linked reports in this thread - the page was seeded with bad random data which was saved by the attackers, and they've simply been biding their time for a few years before sweeping to let the pot grow. This matches the on-chain evidence as well.
If this is accurate, then the breach occurred because: - Using a computer that was not air gapped (was connected to the internet which allowed loading of the malicious website) - Getting the software supplied by this .net website, and not downloading it from github - Removing the internet connection did not secure key generation, as the website had already served up code that had an entropy seed value known to the attackers This contradicts some of the information supplied earlier, but makes sense how this attack occurred. The original explanations did not make sense in how the attack was perpetrated, and that was what I was trying to clear up. Without a clear root cause on the issue, not only could you fall into this trap again (or more likely a variation of it)- but others could as well. I would like to say that I am a fan of RC's designs and own several coins. I do not benefit from attacking his team, as it lowers the value of my collectibles and potentially stops a newer maker from creating new coins: something i support. I've supported this in the past by pre-ordering RC's LC V2 coins prior to this event occurring.
|
|
|
|
|