May 14, 2013 05:55 AM
(This post was last modified: May 14, 2013 08:26 AM by Chris Ηansen.)
So... I was mining on the night of 5/13/2013, and left the miner on all night so I could earn more. I woke up to 66 hashes that I had solved, but only 38 coins connected to my account. I thought to myself, "Okay, just let the network refresh for a second, and you will have the BLC." I refreshed the network, and I got no more BLC. WTF RIGHT?! I was starting to think that I got fucked over by not reading somewhere that someone takes a cut of what you mine... not the case. I refreshed the transaction history, and found that the notorious Who? has been stealing BLC from people, and I was just his latest victim. It looks really weird because it says that the BLC was sent directly from me, to his many addresses that I assume he just made with a script, but that is not the case at all. My best guess is that he has access somehow to the network that BLC runs off of. How else would he had be able to do this.
I have already checked my PC for malware, scanned the IP addresses coming from my PC, and to my PC, and nothing is out of the ordinary... just that I lost a lot of BLC. I also understand that this is a giant wall of text to read, but I just woke up to this, and I am in a rush to send messages all around to people who are close to BLC to make sure they understand that their stuff might just be taken away if it even so much looks like you can earn a profit. THIS IS NOT AT THE FAULT OF BLOOCOINS CREATORS... ITS AT THE FAULT OF Who? AND OTHER HACKERS.
tl;dr BLC has been hacked probably, and Who? is stealing BLC from miners of it like myself.
PROOF:
https://imgur.com/h6NA834,ZhkWLCj,Spcde6j
https://puu.sh/2TgTH.png
https://i.imgur.com/GFwwzA5.png
Any additional proof that anyone submits will show up here.
UPDATES:
UPDATE 1: Don't know if its because of a related issue, or something else, but the network keeps going down for me...
UPDATE 2: Who? admitted to stealing the BLC from me, and most likely other people too. Now we wait for the hole to be closed by Max... :\
UPDATE 3: Narrowing down the possibility's of this attack...
UPDATE 4: IF YOU HAVE A CUSTOM BLC ADDRESS FROM ZSNAG, THEN YOU NEED TO MAKE YOUR OWN ADDRESS THAT YOU GET FROM RUNNING THE BLOOCOIN.PY FILE FOR THE FIRST TIME, AND SEND THE BLC FROM YOUR CUSTOM ADDRESS TO THE NEW RANDOM ADDRESS!
Any updates will be shown here as I get it so that people know the newest story...
Interesting.
Keep in mind the difficulty also switched to 8 last night, so that may be why some of the coins weren't added to your account (eg. you were still solving for difficulty 7, which were rejected by the lvl 8 server).
Who? does have the most BLC at the moment, stating that he has a GPU miner he "whipped up" in an evening.
(May 14, 2013 06:06 AM)Mohatu Wrote: Interesting.
Keep in mind the difficulty also switched to 8 last night, so that may be why some of the coins weren't added to your account (eg. you were still solving for difficulty 7, which were rejected by the lvl 8 server).
Who? does have the most BLC at the moment, stating that he has a GPU miner he "whipped up" in an evening.
I thought about the difficulty being ramped up, but when the history says that I sent a bunch of BLC to addresses like "RyanC_stealing_your_bloocoins_here93njsz" in 1 BLC per transaction increments... I have my doubts that it was because of the difficulty. But thanks for the input.
It's not implausible that you could write a GPU miner in an evening. He's claiming that he use the JtR Kernels, which would make it quite achievable in an evening.
You guys are all just totally off the grid out of control
![[Image: 2TgTH.png]](https://puu.sh/2TgTH.png)
Unfortunate.
That's just sad. Won't be mining any more BLC from now on :/
(May 14, 2013 06:27 AM)Mohatu Wrote:
Unfortunate. Well fuck... this god damn sucks. :\
Ah wow, although this sucks for a lot of users it was an impressive attack by Who?.
Can't guarantee it's an actual attack. If Who? (or whoever this is) simply had access to the bloostamp file at one point in time, the account would be permanently unsecure. This is why you shouldn't generate bloostamp files on websites (so you can have "custom" names).
He has a custom name, meaning he most likely used that one website to get it. If that website stores the keys, and it is compromised, then it isn't our faults the account gets stolen from.
I recommend just having an anonymous SHA1 username generated by either mine or the official client.
(May 14, 2013 06:42 AM)Mohatu Wrote: Can't guarantee it's an actual attack. If Who? (or whoever this is) simply had access to the bloostamp file at one point in time, the account would be permanently unsecure. This is why you shouldn't generate bloostamp files on websites (so you can have "custom" names).
He has a custom name, meaning he most likely used that one website to get it. If that website stores the keys, and it is compromised, then it isn't our faults the account gets stolen from.
I recommend just having an anonymous SHA1 username generated by either mine or the official client. Already a head of you... working on it right now.
Uhm, I don't believe one bit of this thread, I've been talking to him on the IRC I doubt he could.
You can edit the transactions by double clicking on them (Probably local only) but it's still easily fake-able.
Awwww man just getting the feeling of BLC now it's hacked :(
(May 14, 2013 07:33 AM)Danoontje Power Wrote: Awwww man just getting the feeling of BLC now it's hacked :(
It's not hacked, learn to read before taking sides.
His account is compromised because he decided to go for a custom address.
(May 14, 2013 07:34 AM)Mohatu Wrote: It's not hacked, learn to read before taking sides.
His account is compromised because he decided to go for a custom address.
Ooow Okay thanks for the heads up, im gonna mine now xD
|
![[Image: kBbBHOF.png]](https://i.imgur.com/kBbBHOF.png)
