Bitcoin/Scam - Historique des versions

Admin le 31 mars 2018 à 06:21

2018-03-31T06:21:07Z

← Version précédente		Version du 31 mars 2018 à 08:21
Ligne 40 :		Ligne 40 :
	------------		------------

	My first experiment was to see if anyone used a block hash as a private key. That would actually be a nifty way to 'compress' 32 bytes in your head. You would only have to remember the block height (which is only maybe 6 digits) and the corresponding larger 32 byte number would be saved for all time in the chain itself!		My first experiment was to see if anyone used a block [[hash]] as a private key. That would actually be a nifty way to 'compress' 32 bytes in your head. You would only have to remember the block height (which is only maybe 6 digits) and the corresponding larger 32 byte number would be saved for all time in the chain itself!

	Results: Success! I found 46 addresses that had some amount of bitcoin sent to them between 2009 and 2016. As expected, these all had 0 balances either because the owner had taken them back or they were discovered by someone else.		Results: Success! I found 46 addresses that had some amount of bitcoin sent to them between 2009 and 2016. As expected, these all had 0 balances either because the owner had taken them back or they were discovered by someone else.
Ligne 196 :		Ligne 196 :
	And remember my merkle root experiment? I believe those were also part of this. However, I have not linked those to this one particular collection address yet. In the end, I found a total of four different 'discoverable' private key methods being used.		And remember my merkle root experiment? I believe those were also part of this. However, I have not linked those to this one particular collection address yet. In the end, I found a total of four different 'discoverable' private key methods being used.

	I made sure my database was filled with every block hash, merkle root, transaction id and Sha256(public address) for private keys and let my bot run. Transactions for all four types were showing up, again for tiny amounts which I ignored. By this time, I was watching BTC getting taken in small amounts regularly. Sometimes, I saw as many as 6 transactions fly by in one day.		I made sure my database was filled with every block [[hash]], merkle root, transaction id and Sha256(public address) for private keys and let my bot run. Transactions for all four types were showing up, again for tiny amounts which I ignored. By this time, I was watching BTC getting taken in small amounts regularly. Sometimes, I saw as many as 6 transactions fly by in one day.

	How fitwear lost (and got back) 9 BTC		How fitwear lost (and got back) 9 BTC
Ligne 207 :		Ligne 207 :
	In his case, in Aug 2017, he imported the private key for his 1Ca15MELG5DzYpUgeXkkJ2Lt7iMa17SwAo paper wallet address into blockchain.info and submitted a test transaction. At some point between then and Nov 12, the compromised 15ZwrzrRj9x4XpnocEGbLuPakzsY2S4Mit got into his online wallet as an 'imported' address.		In his case, in Aug 2017, he imported the private key for his 1Ca15MELG5DzYpUgeXkkJ2Lt7iMa17SwAo paper wallet address into blockchain.info and submitted a test transaction. At some point between then and Nov 12, the compromised 15ZwrzrRj9x4XpnocEGbLuPakzsY2S4Mit got into his online wallet as an 'imported' address.

	Together, we contacted blockchain.info and I relayed the information I just outlined above to them. Their security team investigated but found no evidence it was their system that was at fault. I suppose it's possible his system was somehow compromised back in August and managed to import a key into blockchain.info without him knowing it. Or someone else logged into his account, imported the key, then waited. I feel the malware/login explanations are much less likely because it looks like code attempting to 'hide in plain sight' to me. You wouldn't need to use Sha256(address) or block hash or txid or merkleroot if you were malware or an unauthorized login. You would at least salt or obscure the key with some bit of knowledge only you know so that only you could derive the private key (as mentioned earlier). The fact that information from the blockchain itself is being used indicates it may be some transaction processing logic. Also, fitwear took extreme precautions (you can read his reddit post for details). The origin of these poison destination addresses remains a mystery.		Together, we contacted blockchain.info and I relayed the information I just outlined above to them. Their security team investigated but found no evidence it was their system that was at fault. I suppose it's possible his system was somehow compromised back in August and managed to import a key into blockchain.info without him knowing it. Or someone else logged into his account, imported the key, then waited. I feel the malware/login explanations are much less likely because it looks like code attempting to 'hide in plain sight' to me. You wouldn't need to use Sha256(address) or block [[hash]] or txid or merkleroot if you were malware or an unauthorized login. You would at least salt or obscure the key with some bit of knowledge only you know so that only you could derive the private key (as mentioned earlier). The fact that information from the blockchain itself is being used indicates it may be some transaction processing logic. Also, fitwear took extreme precautions (you can read his reddit post for details). The origin of these poison destination addresses remains a mystery.

	If it's the case that some wallet generation code is doing this, then it may be the case that we're seeing 'change' transactions. When you create a wallet, there maybe 20 addresses generated. They are all supposed to be random keys. If this rogue code creates one of them in this manner (based on the public address string of an earlier one), then at some point, your 'change' will get put back into it as the wallet 'round-robins' through the list.		If it's the case that some wallet generation code is doing this, then it may be the case that we're seeing 'change' transactions. When you create a wallet, there maybe 20 addresses generated. They are all supposed to be random keys. If this rogue code creates one of them in this manner (based on the public address string of an earlier one), then at some point, your 'change' will get put back into it as the wallet 'round-robins' through the list.
Ligne 405 :		Ligne 405 :
	<br>		<br>

			==Pages connexes==

			* [[Hash]]

			<br>

	==Liens ==		==Liens ==

Admin : /* Liens */

2017-12-12T17:15:59Z

Liens

← Version précédente		Version du 12 décembre 2017 à 19:15
Ligne 408 :		Ligne 408 :
	==Liens ==		==Liens ==
	* https://cran.r-project.org/package=digest		* https://cran.r-project.org/package=digest

			* https://www.palkeo.com/code/vol-bitcoin.html petite erreur en début d'article, mais sinon l'article est bien

	<br>		<br>

Admin le 5 décembre 2017 à 12:11

2017-12-05T12:11:03Z

← Version précédente		Version du 5 décembre 2017 à 14:11
Ligne 2 :		Ligne 2 :
	* source : https://pastebin.com/jCDFcESz (via https://twitter.com/zooko/status/936153159617179649?s=09)		* source : https://pastebin.com/jCDFcESz (via https://twitter.com/zooko/status/936153159617179649?s=09)

			==Introduction==
	<pre>		<pre>

Ligne 29 :		Ligne 30 :

	</pre>		</pre>

			* sha256(tout le dico) pour voir si, par hasard, des sha256(mots du dico) ne sont pas dans la BC. Bingo ! Non seulement qqs uns, mais tous ! pourquoi ? quel intérêt ? attirer l'attention sur l'imprudence à procéder ainsi ? Et puis, pour créditer 50.000 adresses, faut forcément un robot


	==Experiment 1==		==Experiment 1==

Admin : /* Experiment 3 */

2017-12-05T12:10:31Z

Experiment 3

← Version précédente		Version du 5 décembre 2017 à 14:10
Ligne 98 :		Ligne 98 :

	</pre>		</pre>

	* sha256(tout le dico) pour voir si, par hasard, des sha256(mots du dico) ne sont pas dans la BC. Bingo ! Non seulement qqs uns, mais tous ! pourquoi ? quel intérêt ? attirer l'attention sur l'imprudence à procéder ainsi ? Et puis, pour créditer 50.000 adresses, faut forcément un robot


	==Experiment 4==		==Experiment 4==

Admin : /* Experiment 3 */

2017-12-05T12:08:01Z

Experiment 3

← Version précédente		Version du 5 décembre 2017 à 14:08
Ligne 99 :		Ligne 99 :
	</pre>		</pre>

	Experiment 4		* sha256(tout le dico) pour voir si, par hasard, des sha256(mots du dico) ne sont pas dans la BC. Bingo ! Non seulement qqs uns, mais tous ! pourquoi ? quel intérêt ? attirer l'attention sur l'imprudence à procéder ainsi ? Et puis, pour créditer 50.000 adresses, faut forcément un robot


			==Experiment 4==
	<pre>		<pre>
	Experiment 4		Experiment 4

Admin : /* Experiment 2 */

2017-12-05T12:07:32Z

Experiment 2

← Version précédente		Version du 5 décembre 2017 à 14:07
Ligne 68 :		Ligne 68 :
	</pre>		</pre>

	* ~~sha256(tout le dico) pour voir si, par hasard, des sha256(mots du dico) ne sont pas dans la BC. Bingo ! Non seulement qqs uns, mais tous ! pourquoi ? quel intérêt ? attirer l'attention sur l'~~imprudence ~~à procéder ainsi ? Et puis,~~ pour ~~créditer 50.000 adresses, faut forcément un robot~~		* même imprudence que pour exp1



	==Experiment 3==		==Experiment 3==
	<pre>		<pre>

Admin : /* Experiment 2 */

2017-12-05T12:06:22Z

Experiment 2

← Version précédente		Version du 5 décembre 2017 à 14:06
Ligne 52 :		Ligne 52 :
	==Experiment 2==		==Experiment 2==

			<pre>
	Experiment 2		Experiment 2
	~~<pre>~~
	------------		------------

Ligne 65 :		Ligne 65 :

	Similar to merkle root and block hashes, transaction ids (hashes) also seem to have been used as private keys. Still nothing alarming to me thus far.		Similar to merkle root and block hashes, transaction ids (hashes) also seem to have been used as private keys. Still nothing alarming to me thus far.

			</pre>

			* sha256(tout le dico) pour voir si, par hasard, des sha256(mots du dico) ne sont pas dans la BC. Bingo ! Non seulement qqs uns, mais tous ! pourquoi ? quel intérêt ? attirer l'attention sur l'imprudence à procéder ainsi ? Et puis, pour créditer 50.000 adresses, faut forcément un robot



			==Experiment 3==
			<pre>
	Experiment 3		Experiment 3
	------------		------------
Ligne 90 :		Ligne 98 :

	People were obviously burying bitcoin in the chain. Whether they expected the coins to be taken or not, we'll never know. But these methods were still highly 'discoverable' in my opinion.		People were obviously burying bitcoin in the chain. Whether they expected the coins to be taken or not, we'll never know. But these methods were still highly 'discoverable' in my opinion.

			</pre>

			Experiment 4
			<pre>
	Experiment 4		Experiment 4
	------------		------------

Admin : /* Experiment 1 */

2017-12-05T12:04:53Z

Experiment 1

← Version précédente		Version du 5 décembre 2017 à 14:04
Ligne 46 :		Ligne 46 :

	Nothing really alarming so far.		Nothing really alarming so far.

	</pre>		</pre>

	* ~~Experiment 1 : sha256(tout le dico) pour voir si, par hasard,~~ des ~~sha256(mots du dico) ne sont pas dans la BC. Bingo~~ ! ~~Non seulement qqs uns, mais tous ! pourquoi ? quel intérêt ? attirer l'attention sur l'imprudence à procéder ainsi ? Et puis, pour créditer 50.000 adresses, faut forcément un robot~~		* y a quand même des imprudents !


	==Experiment 2==		==Experiment 2==

Admin le 5 décembre 2017 à 11:35

2017-12-05T11:35:21Z

← Version précédente		Version du 5 décembre 2017 à 13:35
Ligne 27 :		Ligne 27 :

	What follows is a description of my experiments and what led me to discover what I believe is either a scam or really bad coding error.		What follows is a description of my experiments and what led me to discover what I believe is either a scam or really bad coding error.

			</pre>

			==Experiment 1==

			<pre>
	Experiment 1		Experiment 1
	------------		------------
Ligne 41 :		Ligne 46 :

	Nothing really alarming so far.		Nothing really alarming so far.

			</pre>

			* Experiment 1 : sha256(tout le dico) pour voir si, par hasard, des sha256(mots du dico) ne sont pas dans la BC. Bingo ! Non seulement qqs uns, mais tous ! pourquoi ? quel intérêt ? attirer l'attention sur l'imprudence à procéder ainsi ? Et puis, pour créditer 50.000 adresses, faut forcément un robot


			==Experiment 2==

	Experiment 2		Experiment 2
			<pre>
	------------		------------

Ligne 371 :		Ligne 384 :

	==Remarques==		==Remarques==

	* Experiment 1 : sha256(tout le dico) pour voir si, par hasard, des sha256(mots du dico) ne sont pas dans la BC. Bingo ! Non seulement qqs uns, mais tous ! pourquoi ? quel intérêt ? attirer l'attention sur l'imprudence à procéder ainsi ? Et puis, pour créditer 50.000 adresses, faut forcément un robot

	* Experiments 1-3 : de l'imprudence assez banale		* Experiments 1-3 : de l'imprudence assez banale

Admin : /* Remarques */

2017-12-03T10:30:54Z

Remarques

← Version précédente		Version du 3 décembre 2017 à 12:30
Ligne 379 :		Ligne 379 :

	* experiment 4 : des gars ont pris leur adresse publique comme clé privée !		* experiment 4 : des gars ont pris leur adresse publique comme clé privée !

			<br>


			==Liens ==
			* https://cran.r-project.org/package=digest

	<br>		<br>

Bitcoin/Scam - Historique des versions

Admin le 31 mars 2018 à 06:21

Admin : /* Liens */

Admin le 5 décembre 2017 à 12:11

Admin : /* Experiment 3 */

Admin : /* Experiment 3 */

Admin : /* Experiment 2 */

Admin : /* Experiment 2 */

Admin : /* Experiment 1 */

Admin le 5 décembre 2017 à 11:35

Admin : /* Remarques */

Admin : /* Liens */

Admin : /* Experiment 3 */

Admin : /* Experiment 3 */

Admin : /* Experiment 2 */

Admin : /* Experiment 2 */

Admin : /* Experiment 1 */

Admin : /* Remarques */