Bitcoin Forum
December 07, 2016, 08:30:31 PM *
News: To be able to use the next phase of the beta forum software, please ensure that your email address is correct/functional.
 
   Home   Help Search Donate Login Register  
Pages: [1] 2 »  All
  Print  
Author Topic: Please forgive my ignorance, but WTF ?  (Read 4001 times)
bitlane
Internet detective
Sr. Member
****
Offline Offline

Activity: 462


I heart thebaron


View Profile
June 03, 2012, 05:21:57 PM
 #1

So, in regards to the Bitcoinica ordeal....

The Facts:

Today, we have discovered a suspicious Bitcoin transaction that doesn't seem to be initiated by any one of the company owners. Some of them are not online at the moment so

this is not conclusive.

Suspicious transaction:

  {
        "account" : "",
        "address" : "182tGyiczhXSSCTciVujNRkkMw1zQxUVhp",
        "category" : "send",
        "amount" : -18547.66867623,
        "fee" : 0.00000000,
        "blockhash" : "00000000000003f6bfd3e2fcbf76091853b28be234b5473a67f89b9d5bee019c",
        "blockindex" : 1,
        "txid" : "7a22917744aa9ed740faf3068a2f895424ed816ed1a04012b47df7a493f056e8",
        "time" : 1336738723
    },

The IP address associated with the above address is 91.121.174.223 (according to blockchain.info)

So, just surfing around, I came across a few things that puzzle me:




So...The 'Receiver' of the 'SENT' bitcoins from Bitcoinica runs a pool on port80 ?

....and is generating blocks ? (as recently as June 1, 2012)






As I said, please forgive my ignorance, as I really do have no idea if any of this is even relevant, but I had to ask....

More links for your browsing pleasure maybe ?....

http://blockchain.info/tree/5416502

http://blockchain.info/ip-address/91.121.174.223

http://blockchain.info/tx-index/7504034/438fbc2bd1435a460743290ab8265a2e9a84589d55a40cb3e0c8f0d29f17a1b1

http://blockchain.info/tree/7504034

http://blockchain.info/address/1HBrT9Yjb4THfw7sFvAHtcU5q3vJrJMabq

http://blockchain.info/tx-index/7428041/4def4f169ce16d730558b48ced612f478dc6c849a9c2b398b281170c5fbccf55



I have no idea, as I said, if this is relevant, makes any sense....or is old news already.
I just figured a post couldn't hurt.
bitlane.

1481142631
Hero Member
*
Offline Offline

Posts: 1481142631

View Profile Personal Message (Offline)

Ignore
1481142631
Reply with quote  #2

1481142631
Report to moderator
1481142631
Hero Member
*
Offline Offline

Posts: 1481142631

View Profile Personal Message (Offline)

Ignore
1481142631
Reply with quote  #2

1481142631
Report to moderator
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1481142631
Hero Member
*
Offline Offline

Posts: 1481142631

View Profile Personal Message (Offline)

Ignore
1481142631
Reply with quote  #2

1481142631
Report to moderator
1481142631
Hero Member
*
Offline Offline

Posts: 1481142631

View Profile Personal Message (Offline)

Ignore
1481142631
Reply with quote  #2

1481142631
Report to moderator
1481142631
Hero Member
*
Offline Offline

Posts: 1481142631

View Profile Personal Message (Offline)

Ignore
1481142631
Reply with quote  #2

1481142631
Report to moderator
casascius
Mike Caldwell
VIP
Legendary
*
Offline Offline

Activity: 1344


The Casascius 1oz 10BTC Silver Round (w/ Gold B)


View Profile WWW
June 03, 2012, 05:24:17 PM
 #2

The main problem is that is not necessarily the IP that originated the transaction, just the first known to have relayed it.  Any node will relay a valid transaction. What blockchain.info records is the first node it heard a transaction from, and if the originator does not have his own connection to blockchain.info's servers (a very probable thing) blockchain.info simply can't know the offenders IP.

Companies claiming they got hacked and lost your coins sounds like fraud so perfect it could be called fashionable.  I never believe them.  If I ever experience the misfortune of a real intrusion, I declare I have been honest about the way I have managed the keys in Casascius Coins.  I maintain no ability to recover or reproduce the keys, not even under limitless duress or total intrusion.  Remember that trusting strangers with your coins without any recourse is, as a matter of principle, not a best practice.  Don't keep coins online. Use paper wallets instead.
vuce
Sr. Member
****
Offline Offline

Activity: 476


View Profile
June 03, 2012, 05:24:31 PM
 #3

The IP address associated with the above address is 91.121.174.223 (according to blockchain.info)

This is just the IP of the one who relayed the transaction, as far as I know.
Gabi
Legendary
*
Offline Offline

Activity: 1050


View Profile
June 03, 2012, 05:25:40 PM
 #4

The IP means nothing.
It's just the IP that relayed that transaction to blockchain.info. Not who created it (maybe yes maybe no, no way to know)
bitlane
Internet detective
Sr. Member
****
Offline Offline

Activity: 462


I heart thebaron


View Profile
June 03, 2012, 05:26:14 PM
 #5

AAhh..OK.

Sorry guys.

As I said, I have no idea how to even use blockchain.info to 'follow' TXs...LOL

kokjo
Legendary
*
Offline Offline

Activity: 1050

You are WRONG!


View Profile
June 03, 2012, 05:26:57 PM
 #6

LOL, bitcoins can't be traced to a IP.

the ip in blockchain.info, is the ip that forwarded the transaction to blockchain.info, it is therefor not from the original sender of the bitcoins.

"The whole problem with the world is that fools and fanatics are always so certain of themselves and wiser people so full of doubts." -Bertrand Russell
Liberty Payout
Sr. Member
****
Offline Offline

Activity: 266



View Profile
June 03, 2012, 05:28:39 PM
 #7

Felt like Sherlock for a sec, didn't you?  Cool
kokjo
Legendary
*
Offline Offline

Activity: 1050

You are WRONG!


View Profile
June 03, 2012, 05:31:42 PM
 #8

Felt like Sherlock for a sec, didn't you?  Cool
he is a Internet detective, LOL.

"The whole problem with the world is that fools and fanatics are always so certain of themselves and wiser people so full of doubts." -Bertrand Russell
bitlane
Internet detective
Sr. Member
****
Offline Offline

Activity: 462


I heart thebaron


View Profile
June 03, 2012, 05:37:53 PM
 #9

Felt like Sherlock for a sec, didn't you?  Cool

No....lol

I just got lucky and started finding my own IP attached to a bunch of transactions that I have been involved in and didn't properly understand what it meant.....hehe

I suck at being a detective.

Maged
Legendary
*
Offline Offline

Activity: 1260


View Profile
June 03, 2012, 05:45:59 PM
 #10

The reason why they post the IP is because it is extremely valuable when combined with statistical analysis to find out who sent a transaction. For a single transaction, it's worthless. For 40 transactions, not so much. The problem is finding enough transactions to make the IP useful. While we might never know the exact IP of a transaction, analyzing the IP of who relayed a transaction could tip off what country a transaction came from.

dscotese
Sr. Member
****
Offline Offline

Activity: 446


I prefer evolution to revolution.


View Profile WWW
June 03, 2012, 06:56:25 PM
 #11

There is probably a way - an expensive and time-consuming way - to track through the block-chain over the weeks/months/years after a theft has been recognized, and eventually identify the thief.  I doubt that 18,000 BC (about $90k, I guess) would cover it, but if the people we make fun of for sleuthing ignore our dispersions and keep at it, cooperate with each other, and get encouragement and help from us, that cost may go down.

So if and when we know who did it, what do we do then?  I kind of doubt that there's any state that would be willing to defend BitCoin (and I don't think I'd want them involved anyway).  That leaves vigilantes (which, for legal reasons, we can't condone) and tracking the criminal to pressure him/her until the thief pays back the stolen bitcoin.

I suppose this is already going on, but that the efforts are kept hidden from everyone in order to avoid alarming the thief who might then put extra effort into burying the trail.  I disagree with that reason.  I think any such efforts should be open, specifically because BitCoin users tend to be smart enough to "play chess" the way I like to play it - that is, honestly explaining my rationale to my opponent (if they want to hear it), under the assumption that, in the chess game this optimizes learning and engenders respect and friendship and, with the bitcoin thief sleuthing, the thief's efforts to thwart the pursuers' progress will backfire.  Especially since the openness of the process may not be complete (yes I know that's a bit duplicitous, but it seems justified).

So anyway, bitlane, I'm glad you looked into it and shared what you found. 

The thief is probably reading this and laughing at me.  That's why I've deployed my "Laugh-detector-inator" (apologies to Dr. Dufenschmirtz).  I recommend you give up now, whoever you are!

I like to provide some work at no charge to prove my valueAvoid supporting terrorism!
Satoshi Nakamoto: "He ought to find it more profitable to play by the rules."
bitlane
Internet detective
Sr. Member
****
Offline Offline

Activity: 462


I heart thebaron


View Profile
June 03, 2012, 07:03:32 PM
 #12

So anyway, bitlane, I'm glad you looked into it and shared what you found. 

Sometimes it takes a 'simpler' mind to look at the situation, unattached - CALL ME RAINMAN Wink

Raoul Duke
aka psy
Legendary
*
Offline Offline

Activity: 1442



View Profile
June 03, 2012, 07:27:39 PM
 #13

Well bitlane, I like you so I'll leave you some leads for you to follow...

You can see in this IRC log that BitcoinicaHacker used the usernames B1tcoinz and ageis on IRC http://ibot.rikers.org/20120521.html.gz

Looking for ageis on IRC logs I found some on #postfix IRC channel, which isn't much surprising, given that the dude used an exploited mailserver to pawn Bitcoinica and he's asking questions about, get ready, SASL and authentication stuff.
http://echelog.com/logs/browse/postfix/1321657200
http://echelog.com/logs/browse/postfix/1321743600

Also found an ageis on the IRC Bitcoin dev channel:
http://bitcoinstats.com/irc/bitcoin-dev/logs/2012/04/09/1
http://bitcoinstats.com/irc/bitcoin-dev/logs/2012/04/14/1
And the following that I found on #bitcoin-dev tells me that he's the same ageis on the #postfix
Quote
03:08    ageis kevin@ageispolis.net

Keep digging...
Every human makes mistakes and this dude is nothing else but human.

Now, if this helps to catch the guy, I want 10k BTC of reward lol

ineededausername
Hero Member
*****
Offline Offline

Activity: 784


bitcoin hundred-aire


View Profile
June 04, 2012, 01:49:14 AM
 #14

Well bitlane, I like you so I'll leave you some leads for you to follow...

You can see in this IRC log that BitcoinicaHacker used the usernames B1tcoinz and ageis on IRC http://ibot.rikers.org/20120521.html.gz

Looking for ageis on IRC logs I found some on #postfix IRC channel, which isn't much surprising, given that the dude used an exploited mailserver to pawn Bitcoinica and he's asking questions about, get ready, SASL and authentication stuff.
http://echelog.com/logs/browse/postfix/1321657200
http://echelog.com/logs/browse/postfix/1321743600

Also found an ageis on the IRC Bitcoin dev channel:
http://bitcoinstats.com/irc/bitcoin-dev/logs/2012/04/09/1
http://bitcoinstats.com/irc/bitcoin-dev/logs/2012/04/14/1
And the following that I found on #bitcoin-dev tells me that he's the same ageis on the #postfix
Quote
03:08    ageis kevin@ageispolis.net

Keep digging...
Every human makes mistakes and this dude is nothing else but human.

Now, if this helps to catch the guy, I want 10k BTC of reward lol

Most likely impersonated a reputable member to throw you off Sad

(BFL)^2 < 0
rjk
Sr. Member
****
Offline Offline

Activity: 420


1ngldh


View Profile
June 04, 2012, 01:54:10 AM
 #15

Well bitlane, I like you so I'll leave you some leads for you to follow...

You can see in this IRC log that BitcoinicaHacker used the usernames B1tcoinz and ageis on IRC http://ibot.rikers.org/20120521.html.gz

Looking for ageis on IRC logs I found some on #postfix IRC channel, which isn't much surprising, given that the dude used an exploited mailserver to pawn Bitcoinica and he's asking questions about, get ready, SASL and authentication stuff.
http://echelog.com/logs/browse/postfix/1321657200
http://echelog.com/logs/browse/postfix/1321743600

Also found an ageis on the IRC Bitcoin dev channel:
http://bitcoinstats.com/irc/bitcoin-dev/logs/2012/04/09/1
http://bitcoinstats.com/irc/bitcoin-dev/logs/2012/04/14/1
And the following that I found on #bitcoin-dev tells me that he's the same ageis on the #postfix
Quote
03:08    ageis kevin@ageispolis.net

Keep digging...
Every human makes mistakes and this dude is nothing else but human.

Now, if this helps to catch the guy, I want 10k BTC of reward lol

Most likely impersonated a reputable member to throw you off Sad
Yeah there needs to be some actual evidence. psy's stuff isn't evidence. And I'm sure rg can confirm that, since he's met him in person. I also have IRC logs that are pretty convincing.

Mining Rig Extraordinaire - the Trenton BPX6806 18-slot PCIe backplane [PICS] Dead project is dead, all hail the coming of the mighty ASIC!
Raoul Duke
aka psy
Legendary
*
Offline Offline

Activity: 1442



View Profile
June 04, 2012, 01:59:40 AM
 #16

Well bitlane, I like you so I'll leave you some leads for you to follow...

You can see in this IRC log that BitcoinicaHacker used the usernames B1tcoinz and ageis on IRC http://ibot.rikers.org/20120521.html.gz

Looking for ageis on IRC logs I found some on #postfix IRC channel, which isn't much surprising, given that the dude used an exploited mailserver to pawn Bitcoinica and he's asking questions about, get ready, SASL and authentication stuff.
http://echelog.com/logs/browse/postfix/1321657200
http://echelog.com/logs/browse/postfix/1321743600

Also found an ageis on the IRC Bitcoin dev channel:
http://bitcoinstats.com/irc/bitcoin-dev/logs/2012/04/09/1
http://bitcoinstats.com/irc/bitcoin-dev/logs/2012/04/14/1
And the following that I found on #bitcoin-dev tells me that he's the same ageis on the #postfix
Quote
03:08    ageis kevin@ageispolis.net

Keep digging...
Every human makes mistakes and this dude is nothing else but human.

Now, if this helps to catch the guy, I want 10k BTC of reward lol

Most likely impersonated a reputable member to throw you off Sad

Did he? And he happened to impersonate it on some channel that isn't Bitcoin related, right?
And only him? Why not impersonate lot's of them, then?
Also, care to explain this
Name:    ageisp0lis
Posts:    11
Position:    Jr. Member
Date Registered:    October 22, 2011, 02:03:34 AM
Last Active:    May 21, 2012, 08:47:58 AM

Half hour after the usernames fuck up. Checking if somehow someone noticed it, maybe?

You guys can ignore it but the fact is: it's the only lead there is so far.

FlashFire
Newbie
*
Offline Offline

Activity: 11


View Profile
June 04, 2012, 02:18:29 AM
 #17

Wow, this is some shady stuff. I hope this gets solved. I love Bitcoinica.

[Signature too tall.]
dscotese
Sr. Member
****
Offline Offline

Activity: 446


I prefer evolution to revolution.


View Profile WWW
June 04, 2012, 02:44:17 AM
 #18

Everyone has the blockchain, and it seems like it would be pretty simple to write a program that would identify all the addresses to which the 18k BC have gone.  Of course, there are a crapload of these addresses, but that just increases the number of people who might get somewhere doing the following:

"Hey, my address is in that list because of a payment sent to me from XXXXX.  I can't find that person anywhere now, but the blockchain shows that the address they used to pay me had like 200BC in it.  Maybe that person, wherever he is, can help us find the thief."

Then maybe I'm that person, and I hear about this effort, so I check it out and say, basically, the same thing.

At some point the actual thief will feel that people are on his trail.

Is Bitcoinica offering any kind of compensation for the identification of the thief?  If they do, I think they ought to let him keep the reward if he turns himself in and returns whatever is leftover after the reward.

This thing about looking back through the blockchain really intrigues me.

I suppose that if I got a nice payment for something that wasn't so dear to me, I might not be willing to say "oh, yeah, I sold that to Mr.X" - but then I'd have no evidence that I'm not the thief.

Thieves have to spend slowly in order to avoid attracting the attention of the authorities, but in this case, the authority is a piece of code with 100% attention.  So should I start building code that will be able to identify all the addresses that currently hold BC that came from 182tGyiczhXSSCTciVujNRkkMw1zQxUVhp?  Or is there already that software?

I like to provide some work at no charge to prove my valueAvoid supporting terrorism!
Satoshi Nakamoto: "He ought to find it more profitable to play by the rules."
Stephen Gornick
Legendary
*
Offline Offline

Activity: 2002



View Profile
June 04, 2012, 02:47:14 PM
 #19

So should I start building code that will be able to identify all the addresses that currently hold BC that came from 182tGyiczhXSSCTciVujNRkkMw1zQxUVhp?  Or is there already that software?

Like this?
 - http://toolongdidntread.com
 - http://anonymity-in-bitcoin.blogspot.com/2011/07/bitcoin-is-not-anonymous.html

And here's a method that provides a visual traversal method if you want to do it manually:
 - http://blockchain.info/tree/5484758

Manual investigations or a flow analysis method will help reveal some identity where the use of bitcoin is typical.   But if basic precautions are employed, bitcoins can be used anonymously.  The thief knows to only spend anonymously, or ... like has been done already, to spend in ways where it doesn't matter like spending by donating to the bitcoin faucet, or giving away coins, "Robin Hood" style on IRC:
 - http://pastebin.com/3ukW7NpN
 - http://bitcointalk.org/index.php?topic=82581.0;all

 

EhVedadoOAnonimato
Hero Member
*****
Offline Offline

Activity: 616



View Profile
June 04, 2012, 02:55:21 PM
 #20

LOL, bitcoins can't be traced to a IP.

Don't be that sure. It's not that difficult to directly connect to all listening nodes.
That's the main reason I always put my bitcoin behind Tor.
Pages: [1] 2 »  All
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!