Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

medium.freecodecamp.org

Post reply on HN
Print view View original

211–220 of 440 posts

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#211

Post by Jabanga »

o- wrote: post #196
Jabanga wrote: post #179

Earlier quoted context omitted.

Your Whig history of an ever progressing political system is not accurate in my opinion. I've written this comment before, and I'll repeat it as it's relevant to your comment: Societies have gradually grown more unfair as the political system has strained under their growing complexity. According to political scientists, the average voter has an extremely limited understanding of what their government is doing. The t…

I fully agree with your analysis. But cryptocurrencies are just the latest tool that will serve well the interests of the demagogues. Technocracy will not improve affairs that we don't resolve as a society in the first place. More powerful tools means just more power to those who can afford the longest lever. Any other interpretation is just a blatant neglect on the history of technology.

Cryptocurrencies, growing pains aside, will arrest the trend toward economic centralization. They are not just more powerful tools. They are tools that shift the control over money from large trusted third parties to individuals. They literally allow an individual to be their own bank.

They are a counter-force against the trend toward eliminating cash, and with it, financial privacy [1]:

>Any future cashless bank-payments society will be the outcome of a deliberate war on cash waged by an alliance of three elite groups with deep interests in seeing it emerge.

These statements from an executive at MasterCard are a great window into the company's designs on cash and its electronic corollaries:

>There's huge interest in cryptocurrencies and what perhaps they can create in the market place. Now we at MasterCard are not completely comfortable with the idea of cryptocurrencies largely because they go against the whole principle that we've established our business on which is really moving to a world beyond cash and ensuring greater transparency.. If you think about it, cash is a problem for a number of countries. Cash really facilitates anonymity, it facilitates illegal activity, it facilitates tax avoidance and a range of other things that aren't going to drive efficiency in an economy

-https://youtu.be/bO4jHXjCXw8?t=2m57s

>If it's an anonymous transaction, that sounds like a suspicious transaction. Why does somebody need to be anonymous?

-http://youtu.be/bO4jHXjCXw8#t=4m12s

[1] https://aeon.co/essays/if-plastic-replaces-cash-much-that-is...

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#212

Post by GlennS »

owenversteeg wrote: post #52

I think the fundamental problem here is an economic one. Make three assumptions: 1) most contracts worth implementing in Ethereum are fairly complex 2) even given great developers, bugs are inevitable in complex code 3) the budget of the contract-makers' security team MUST be smaller than that of the hackers You quickly see that if the chance of a bug is nonzero, "smart contracts" don't make economic sense. If you ha…

You might expect the risk to go down over time, as people develop standard contracts with proven reliability.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#213

Post by sillysaurus3 »

mannykannot wrote: post #210
shadowmint wrote: post #42

This is a very pro-Ether take on what happened, but ultimately it comes to the right conclusion: > The problem is that his programming toolchain allowed him to make these mistakes. Damn straight. The problem is that the model of 'public by default, opt in for security' is fundamentally daft in this context. There's quite a good read on that particular topic here too http://hackingdistributed.com/2017/07/20/parity-wal…

>This is a very pro-Ether take on what happened, but ultimately it comes to the right conclusion: >> The problem is that his programming toolchain allowed him to make these mistakes. This is not the right conclusion; it is too shallow. It suggests that the risks of smart contracts can be fixed with some changes to the programming toolchain, but no-one has ever made one that only produces secure code, and I think I ca…

Yes, but this reductive view isn't useful. It's happening, whether we know how to do it or not. The important question is how to proceed.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#214

Post by discreteevent »

neuralzen wrote: post #186
ckastner wrote: post #130

> Having sounded the alarm bells, a group of benevolent white-hat hackers from the Ethereum community rapidly organized. They analyzed the attack and realized that there was no way to reverse the thefts, yet many more wallets were vulnerable. Time was of the essence, so they saw only one available option: hack the remaining wallets before the attacker did. > By exploiting the same vulnerability, the white-hats hacked…

You could say the same thing about home routers with that argument then, which are often under patched, and apparently require grey hats to act. http://www.computerworld.com/article/2988656/network-securit...

You could but if my home router gets hacked it doesn't directly give the attacker access to all of my money.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#215

Post by josefx »

antouank wrote: post #154
dawidloubser wrote: post #148

As long as Ethereum apps are powered by a deeply-flawed programming language (Solidity) and VM (EVM), this will happen over and over again. Writing provable, secure software is difficult, and highly unlikely if your environment doesn't force the correct mindset. Solidity (poorly named) was made with the primary goal of being easy for JavaScript / Node hackers to use. The cost of this is now illustrated through the re…

Exactly. I'm amazed that so much of the web today is still based on "easy" scripting languages like JS or Python, which are fragile and error prone. Once I transitioned to Elm and Haskell, I saw bugs almost disappear. I didn't improve as a dev, I just used a safer language. Especially when money is involved, correctness and safety should be the number 1 priority.

> Exactly. I'm amazed that so much of the web today is still based on "easy" scripting languages like JS or Python

You can put any script kiddy in front of them and get a "working" program.

> Once I transitioned to Elm and Haskell,

My first question when I heard of Haskells main features: "What does a planet from Star Wars have to do with programming?". Haskell is not a source of cheap programmers.

> Especially when money is involved, correctness and safety should be the number 1 priority.

When money is involved the first priority is a cost/risk evaluation. Generally the people involved in that evaluation don't have much of a personal risk so the number 1 priority is to reduce the cost.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#216

Post by brazzy »

return0 wrote: post #165
ckastner wrote: post #130

> Having sounded the alarm bells, a group of benevolent white-hat hackers from the Ethereum community rapidly organized. They analyzed the attack and realized that there was no way to reverse the thefts, yet many more wallets were vulnerable. Time was of the essence, so they saw only one available option: hack the remaining wallets before the attacker did. > By exploiting the same vulnerability, the white-hats hacked…

> something is very wrong with your system To be clear, neither of the two situations is "more moral" than the other. In the end however, the question remains: who you trust. Governments have resolved the question long ago (by enforcing trust), cryptocurrencies are just now starting to face the same question. You are correct however that who you Trust remains the greatest issue behind creating a currency.

I think that is a bit too simplistic a view, and the better question is: when things go wrong, what is your fallback?

Modern governments provide an elaborate system of fallbacks: checks and balances, a justice system with multiple levels of appeals. Those may be complex and fallible, but they are at least reasonably good at dealing with unexpected problems.

When a smart contract goes wrong, there are no fallbacks.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#217

Post by bhaak »

PeterisP wrote: post #188
bhaak wrote: post #159

Earlier quoted context omitted.

Are these the same one time pads that have already been cracked by the NSA after the Soviets reused them?

If you reuse them, then it's not a one time pad any more, is it? Yes, it's well known that two-time pads are very vulnerable in ways that one time pads are not.

They are still one time pads, just incorrectly used.

Even if the cryptography is sound, you also need to ensure that no user error can happen.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#218

Post by mpeg »

shadowmint wrote: post #42

This is a very pro-Ether take on what happened, but ultimately it comes to the right conclusion: > The problem is that his programming toolchain allowed him to make these mistakes. Damn straight. The problem is that the model of 'public by default, opt in for security' is fundamentally daft in this context. There's quite a good read on that particular topic here too http://hackingdistributed.com/2017/07/20/parity-wal…

But the function people were exploiting needed to be public, I don't see how internal by default would have made any difference.

The real issue here is that the class constructor called a function instead of containing all code within itself. It's a fundamental misunderstanding of how the EVM works and how Solidity compiles to it.

I've read the code and it's hard to convey the level of incompetence that went into having a dynamic call from the Wallet constructor to the initWallet function; but it's very, very high.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#219

Post by mannykannot »

sillysaurus3 wrote: post #213
mannykannot wrote: post #210

Earlier quoted context omitted.

>This is a very pro-Ether take on what happened, but ultimately it comes to the right conclusion: >> The problem is that his programming toolchain allowed him to make these mistakes. This is not the right conclusion; it is too shallow. It suggests that the risks of smart contracts can be fixed with some changes to the programming toolchain, but no-one has ever made one that only produces secure code, and I think I ca…

Yes, but this reductive view isn't useful. It's happening, whether we know how to do it or not. The important question is how to proceed.

Proceeding by ignoring the inherent difficulties is certainly an option... In fact, that is how we got to the current situation.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#220

Post by mpeg »

andretti1977 wrote: post #72

How did the white hats understood the vulnerability? I don't know anything about ethereum so i'm honestly asking. Is there a public log of the method invocations so they could see the hacker was exploiting that exact vulnerability and decided to replicate it?

Yep, if you saw the attack done it was really easy to replicate it as all transactions are public.

In fact, it's a testament to the poor technical capability of most people involved in Ethereum that the whitehat was even able to do this, in any other environment you'd have had other blackhats clean out the remaining $90m within minutes, all it took was to fire up a web3 console (ethereum's javascript interface) and call the initWallet method with your own address on it.

Then you could drain the contract at will.

Post reply on HN