Reused R values again

[gully]

http://www.reddit.com/r/Bitcoin/comments/2oonu2/well_i_was_part_of_the_00002/
This is my thread, I can confirm that and I can confirm that the BTC address is mine also.
Please PM me. I lost $650 that I was saving up for a car. I am only 17 man, I really need this money.
https://blockchain.info/address/1NDmX336zK4ntTLDqbpK9dWk8qNB81z2Q6

[1714858243]

1714858243

[1714858243]

1714858243

[1714858243]

1714858243

[1714858243]

1714858243

[itod]

I don't think that he is a good samaritan unless he eventually gives me the coins he stole back. I also sent an email to blockchain so hopefully I can get refunded or something...this is retarded.

Here's the explanation how to sign the message, it's for two wallets but the procedure is pretty much the same for all other wallets:

http://support.bitcoin.cz/Knowledgebase/Article/View/36/0/how-to-sign-a-message-using-a-bitcoin-client

Just sign the message to prove you are not trying to steal somebody else's coins, and PM that signature to johoe, he promised to return the coins to their rightful owners. IMHO it is very honorable thing if he fulfills the promise, if he haven't collected the coins a real thief could have done it and you would never see your coins back.

[TheRealSteve]

Here's the explanation how to sign the message

Just to note:

If you can convince me that they belong to you (signing a message with the address is obviously not enough; the private key is already known),  I will send the funds back.

[Remember remember the 5th of November]

Here's the explanation how to sign the message

Just to note:

If you can convince me that they belong to you (signing a message with the address is obviously not enough; the private key is already known),  I will send the funds back.

Just sign the previous address from which the funds were transferred from(their outputs)

[itod]

Here's the explanation how to sign the message

Just to note:

If you can convince me that they belong to you (signing a message with the address is obviously not enough; the private key is already known),  I will send the funds back.

Just sign the previous address from which the funds were transferred from(their outputs)

Good idea. This is definitely proof the coins are yours, no question about it.

[TheRealSteve]

The only problem is people who might have sent the original owner these coins might attempt to scam by pretending to be him.

Well, that's not the only problem.  Signing a message with the key associated with the address the funds were sent from - and this would of course have to be an unaffected address as well - does work well... if you can do so.  If you are not the owner of that address - e.g. you purchased Bitcoin from a service, you're mining at a pool, any case where the coins were sent to you by a third party - you would be SOL, at least as far as this approach goes.

In the mean time, it looks like blockchain.info is intending to make affected people whole again.  Perhaps some people will effectively double their returns as a result

[migovision]

Here is one BCI user who claims to have lost 99 BTC which were not moved to the Good Samaritan's address:

http://www.reddit.com/r/Bitcoin/comments/2oo72b/victim_100_bitcoins_stolen_from_blockchaininfo/

The destination address got two other inputs; perhaps other ursers?
https://blockchain.info/address/1M77fUCzQrmY8jHRRgpzDVPAK5eQ31bwxZ

I am the other user with the adress 1LDpUmrwVKSFyXy2czE423dH8yd4K9R9WW. If the user with the 99BTC will read this. pls write me a messeage.

 

[molecular]

Can someone point me to the actual commit that introduced this bug?

[sunkawakan]

Can someone point me to the actual commit that introduced this bug?

"Improvments to RNG":
https://github.com/blockchain/My-Wallet/commit/98d5a7ca59ef04d06ac6aee468634b12975a0f5c

[JorgeStolfi]

Can someone point me to the actual commit that introduced this bug?

"Improvments to RNG":
https://github.com/blockchain/My-Wallet/commit/98d5a7ca59ef04d06ac6aee468634b12975a0f5c

I suppose that they generated one number with the new code, and it looked random allright. 

[johoe]

I just want to say that I contacted the blockchain.info support, but I haven't heard back from them, yet.

To avoid double reimbursement, I want coordinate this with the blockchain.info people.  They should, hopefully, be able to check whether claims are valid or not.  If you lost funds due to this bug, contact the blockchain support, not me.  I cannot answer all PMs regarding this problem.

[cr1776]

I just want to say that I contacted the blockchain.info support, but I haven't heard back from them, yet.

To avoid double reimbursement, I want coordinate this with the blockchain.info people.  They should, hopefully, be able to check whether claims are valid or not.  If you lost funds due to this bug, contact the blockchain support, not me.  I cannot answer all PMs regarding this problem.

Just remember, no good deed goes unpunished. Perhaps this should be in a new thread too.

[yakuza699]

Most of the coins were saved (216BTC) the remeaning ones went to this address https://blockchain.info/address/1xyWYGDStMKVmNH4hivbfhJZa5xWFVWfd

[JorgeStolfi]

Most of the coins were saved (216BTC) the remeaning ones went to this address https://blockchain.info/address/1xyWYGDStMKVmNH4hivbfhJZa5xWFVWfd

Someone claimed to have lost 99 BTC
http://www.reddit.com/r/Bitcoin/comments/2oo72b/victim_100_bitcoins_stolen_from_blockchaininfo/

They ended up here:
https://blockchain.info/address/18MFgZkAqcBLJcQof81xLFzAQ4r4XLS6sn

Only a tiny amount from them ended up at https://blockchain.info/address/1xyWYGDStMKVmNH4hivbfhJZa5xWFVWfd

[flipperfish]

Can someone point me to the actual commit that introduced this bug?

"Improvments to RNG":
https://github.com/blockchain/My-Wallet/commit/98d5a7ca59ef04d06ac6aee468634b12975a0f5c

Is it the unconditional use of Math.random() after the use of the Crypto API (if available), that lead to the bug? Or is there some other problem, I don't see?
Why isn't there a fixing commit, yet?

[Initscri]

I just want to say that I contacted the blockchain.info support, but I haven't heard back from them, yet.

To avoid double reimbursement, I want coordinate this with the blockchain.info people.  They should, hopefully, be able to check whether claims are valid or not.  If you lost funds due to this bug, contact the blockchain support, not me.  I cannot answer all PMs regarding this problem.

In my support ticket with them, I mentioned you. Hopefully this may elevate /escalate the priority.

[itod]

Can someone point me to the actual commit that introduced this bug?

"Improvments to RNG":
https://github.com/blockchain/My-Wallet/commit/98d5a7ca59ef04d06ac6aee468634b12975a0f5c

Is it the unconditional use of Math.random() after the use of the Crypto API (if available), that lead to the bug? Or is there some other problem, I don't see?
Why isn't there a fixing commit, yet?

zootreeves added a note an hour ago:

For those interested. The bug was caused by missing line 29 and not initialising rng_pptr to 0. This commit was force pushed over.

[johoe]

The money has been returned to blockchain.info.  Please write to blockchain support to claim refund.

From: Ben Reeves <...@blockchain.info>
If you could return the funds to address 15tXHJCjehqCEL6zRCkGwvuDY6YzZV5sKP that would be fantastic.

I should also add if that using our admin tools, if users supply us with the correct wallet information, we are able to accurately determine which refund claims are valid and which are not. So far we have processed over 30 refund requests and will be processing more over the rest of this week.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

15tXHJCjehqCEL6zRCkGwvuDY6YzZV5sKP
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - http://gpgtools.org

iQEcBAEBAgAGBQJUh5AdAAoJEP3NqDUC96SQqH0H/3pTTawCXZWfWAwIoVQPkSYa
DgpioEvHLDHXegfAfXyo8X9vc50kEseQVeZ5FAvoeC3Hy76gNIgEDllP5o6FUXL2
HsEj7qcafY5AxlxMgRRG9p1OcbeJS6mlbZrjB78BD+zrtzZaLFoSAf4+lw3YZHg5
xvA0WyNoHE1Hzg8+pdPbg1PPN6dHT38+PCyqFgYIjkjq07UbxxtyyWs8KIQqSuTe
4XIh0gjd73Wqtxm4CAHtnwy0PA5Pi/lE7v0d6qqF2l86SlxDkT6067asMw9Te0JJ
WgnFM8fePrM8HU980n0xvamae7J71zlFMN2/RYfj2t/pTIEWz25ZI2iVS0MGg14=
=9MGK
-----END PGP SIGNATURE——

PGP key is available from https://blockchain.info/security.txt



https://blockchain.info/tx/ea8fa447d59000843910932a42bf7a28915772d97a006e97714d026b78885754

[theymos]

The money has been returned to blockchain.info.  Please write to blockchain support to claim refund.

That's very ethical of you. I hope they gave you a substantial reward.

[BruceFenton]

The money has been returned to blockchain.info.  Please write to blockchain support to claim refund.

From: Ben Reeves <...@blockchain.info>
If you could return the funds to address 15tXHJCjehqCEL6zRCkGwvuDY6YzZV5sKP that would be fantastic.

The return address is SINGLE SIG??!?   C'mon guys.

I absolutely love Blockchain -- but there is not a great excuse to not use multi signin this of all transactions.