A hacker stole $31M of Ether – how it happened, and what it means for Ethereum • Hacker News Board

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#291

Post by kerkeslager » Fri, Jul 21, 2017, 2:48 PM UTC

return0 wrote: post #165

ckastner wrote: post #130

> Having sounded the alarm bells, a group of benevolent white-hat hackers from the Ethereum community rapidly organized. They analyzed the attack and realized that there was no way to reverse the thefts, yet many more wallets were vulnerable. Time was of the essence, so they saw only one available option: hack the remaining wallets before the attacker did. > By exploiting the same vulnerability, the white-hats hacked…

> something is very wrong with your system To be clear, neither of the two situations is "more moral" than the other. In the end however, the question remains: who you trust. Governments have resolved the question long ago (by enforcing trust), cryptocurrencies are just now starting to face the same question. You are correct however that who you Trust remains the greatest issue behind creating a currency.

The hope for cryptocurrencies was that they removed the need for centralized trust entirely. As long as no entity can perform a 51% attack on the block chain, you don't need to trust anyone. This is why the successful 51% attack on the Ethereum block chain which was performed by the DAO should be viewed as a fundamental failure.

The underlying cause is a generally shoddy design of the contract language: when you're writing code where it's imperative that it have no security flaws, writing it in a JavaScript-like language which provides so few protections is absurd.

The Ethereum community is run by profiteering speculators rather than revolutionaries, however, so to them, performing a 51% attack on their own blockchain whenever they don't like how a contract turns out is an okay solution.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#292

Post by loceng » Fri, Jul 21, 2017, 2:49 PM UTC

return0 wrote: post #165

ckastner wrote: post #130

> Having sounded the alarm bells, a group of benevolent white-hat hackers from the Ethereum community rapidly organized. They analyzed the attack and realized that there was no way to reverse the thefts, yet many more wallets were vulnerable. Time was of the essence, so they saw only one available option: hack the remaining wallets before the attacker did. > By exploiting the same vulnerability, the white-hats hacked…

> something is very wrong with your system To be clear, neither of the two situations is "more moral" than the other. In the end however, the question remains: who you trust. Governments have resolved the question long ago (by enforcing trust), cryptocurrencies are just now starting to face the same question. You are correct however that who you Trust remains the greatest issue behind creating a currency.

So why and how do we trust those who have the power to reverse these thefts? Ethereum already did it once, why not again, and again, and again? Are we going to end up with 50 forks, and then how does that even work - do then people accepting these crypto-currencies need to decide which forks they're going to accept from? I may be using the wrong language here, however I hope my point is getting across.

What happens if a crypto-asset becomes a legitimate currency and then an bad actor wants control and takes it using military-level force - or manipulation like blackmail, death threats of you or family members, etc?

The Russian government being strongly against anti-crypto-currencies and then recently Ethereum being endorsed by Putin himself by a physical visit with Vitalik. Does that not ring warning bells to others?

If someone evil - for a lack of better word - pumps $1 billion into the ecosystem early on, how much could they turn that into? What if then they use other $1 billion to lobby and pay off politicians, or get people into power who are "strong believers" in the crypto-assets, to then intertwine societies currencies with crypto-currencies. There is a lot of incentives for them to do this, and I'm not the only one aware of this issue. Even just pumping more $ billions into the ecosystem will create stronger believers - because their "$100 is now worth $70 million."

This current investment-like incentive for creating a new currency is bad for society, the wealth transfer as it currently would happen needs to be worked out of a crypto-asset based currency.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#293

Post by pkilgore » Fri, Jul 21, 2017, 2:49 PM UTC

wildmusings wrote: post #69

eridius wrote: post #58

Earlier quoted context omitted.

> This isn't a normal loss by the way, where you can prosecute someone or sue somebody. No, this is the instant, digital theft of the entire value of the contract, to an anonymous digital address where it will be quickly blended in with hundreds of millions of dollars of similar thefts a month. Also worth pointing out that a non-trivial number of people would say that no theft at all has occurred, as the smart contra…

That's a fascinating point. Can any lawyers comment on how the law might see this?

Lawyer/programmer here (US law). It's an interesting problem.

Let's assume offer, acceptance, capacity, legality for a transaction.

So question to me is, when do we have a contract (do we have a contract?) and what IS the contract. For this usually (not always) look to the so called "meeting of the minds."

If we define the meeting of the minds as the EXACT actual code, it's hard to argue that using a bug in the code is a breach. Simplistic example: I write a lease that says if I sell the house me or the buyer can terminate the lease on 30 days notice. You do not do any diligence on that lease. When I sell the house and the buyer terminates, you're out of luck.

If we define the meeting of minds as "you are promising to do thing X for me, and you propose to do it with a smart contract", then if there is a bug in the contract, that might be a breach on behalf of the person offering to do thing X. Simplistic example: Your website says if I send ETH to address "0xExample" you offer a service that will send it back in 6 months. If 0xExample is hacked and money wasn't returned, well, you could argue that there was a breach of a contract to return your money.

No idea how a Court might come out, and being the law, it depends on shades of grey, other factors, skill of lawyers, etc.

I frankly can't wait until this shit gets litigated.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#294

Post by Oras » Fri, Jul 21, 2017, 2:51 PM UTC

andretti1977 wrote: post #72

How did the white hats understood the vulnerability? I don't know anything about ethereum so i'm honestly asking. Is there a public log of the method invocations so they could see the hacker was exploiting that exact vulnerability and decided to replicate it?

and if there is a group of white-hat hackers supporting and monitoring, how come they didn't find that before and fixed it?

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#295

Post by bo1024 » Fri, Jul 21, 2017, 2:51 PM UTC

mannykannot wrote: post #210

shadowmint wrote: post #42

This is a very pro-Ether take on what happened, but ultimately it comes to the right conclusion: > The problem is that his programming toolchain allowed him to make these mistakes. Damn straight. The problem is that the model of 'public by default, opt in for security' is fundamentally daft in this context. There's quite a good read on that particular topic here too http://hackingdistributed.com/2017/07/20/parity-wal…

>This is a very pro-Ether take on what happened, but ultimately it comes to the right conclusion: >> The problem is that his programming toolchain allowed him to make these mistakes. This is not the right conclusion; it is too shallow. It suggests that the risks of smart contracts can be fixed with some changes to the programming toolchain, but no-one has ever made one that only produces secure code, and I think I ca…

I would argue that it is not a pipe dream, but does require a paradigm shift in how the world views software.

For whatever historical reasons, software has almost always been engineered shoddily as compared to other money-critical or life-critical forms of engineering.

Companies (and governments) aren't willing to make the investments of time, personnel, expertise, and money that are required to create secure, safe code. Insecurity and vulnerability is the norm even among supposedly security-conscious organizations.

We could discuss the root causes all day (companies rarely face full consequences of poor security, etc), but part of the problem is denial. Few are willing to acknowledge how much work it would be to create truly secure code. Instead they settle for being better than most competitors.

However, this does not mean that really, actually secure code is impossible, just that we should (a) admit the scope of the challenge, (b) start taking steps toward that goal (like investing more in research).

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#296

Post by jcranberry » Fri, Jul 21, 2017, 2:51 PM UTC

Cpoll wrote: post #288

ameister14 wrote: post #247

Earlier quoted context omitted.

>Societies have gradually grown more unfair as the political system has strained under their growing complexity. Since when? Since the 60's? Perhaps. Since the rest of history? No. Every argument you make in the rest of your comment other than pure scope of surveillance doesn't apply if you aren't comparing in the short term, i.e. 1-2 generations. In 1903, the average voter didn't know what the government was doing.…

> In 1903, the average voter didn't know what the government was doing. In "Amusing Ourselves to Death," Neil Postman argued the opposite: In the 1800s, people would watch hours-long political debates for amusement and were much more politically literate (the book is more about the negative effects of telecommunication - most people know it as the inspiration for the famous Orwell vs. Huxley infographic).

You may be right in this instance but there are plenty salient examples to illustrate his point. Current governments are much better than the mixed bag of monarchic/feudal societies that were in place for much longer than current systems.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#297

Post by magnetic » Fri, Jul 21, 2017, 2:54 PM UTC

CoryG89 wrote: post #225

brazzy wrote: post #216

Earlier quoted context omitted.

I think that is a bit too simplistic a view, and the better question is: when things go wrong, what is your fallback? Modern governments provide an elaborate system of fallbacks: checks and balances, a justice system with multiple levels of appeals. Those may be complex and fallible, but they are at least reasonably good at dealing with unexpected problems. When a smart contract goes wrong, there are no fallbacks.

> When a smart contract goes wrong, there are no fallbacks. Sure there is. As the DAO hack showed us, if you can get enough of the network to agree to it, you can literally rewrite history and create an alternate universe where the contract never went wrong.

I've heard this argument before and was wondering how it can be considered ok:

1) hacker steals massive amount of money from a crypto wallet

2) hacker cashes out and gets real money

3) network realizes the hack and "rewrites history" as if "the contract never went wrong"

How is this a valid outcome? Somebody in here is out a large amount of real money.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#298

Post by kcanini » Fri, Jul 21, 2017, 2:54 PM UTC

jacquesm wrote: post #190

will_brown wrote: post #180

Earlier quoted context omitted.

Smart contracts are not laws of nature, they are contracts. I totally agree you could come up with a few examples where enforceability would be a practical impossibility, but that's also the case with standard contracts. Just like the Arizona law I cited restricting use of smart contracts for "fire arm tracking", the law could restrict smart contracts in all sorts of ways to protect the public. Examples: -drafters of…

> Smart contracts are not laws of nature, they are contracts. No, they are software. And the participants to such a contract have agreed that the execution of that software is the entirety of their transaction. If one of the parties changes their mind after the fact they will have to convince a judge first that even though they initially agreed that the execution of the contract was the entirety of the agreement that…

You just described how the adjudication of all contracts works. Smart contracts are no more above the law than paper contracts are.

> And the participants to such a contract have agreed that the execution of that software is the entirety of their transaction.

How would such an agreement be communicated or enforced? The same thing happens with paper contracts: when you sign on the dotted line, it's understood that the contract encompasses the entirety of your transaction. However, there always remains the possibility of appealing to the judicial system later to argue that the contract is void/unenforceable.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#299

Post by kovacs_x » Fri, Jul 21, 2017, 2:56 PM UTC

bastawhiz wrote: post #33

hn_throwaway_99 wrote: post #28

Earlier quoted context omitted.

> I know I'm this situation the dev made a simple mistake, but I wonder if Ethereum is safe as a system assuming developers will make many mistakes, and those mistakes will happen more often as more complicated contracts are written. This will probably come off as being assholish, but I honestly don't mean it to be: you should read the rest of the article. It actually covers this topic in depth and has good thoughts…

The rest of the article amounts to a few points: - Humans make mistakes, the tools should have been better - The technology to make Ethereum safe doesn't really exist - We should work to make that technology exist - We should be happy this happened since it raises awareness about the problem > In the end, attacks like this are good for the community. They call you to your senses and force you to keep your eyes open.…

Traditional financial systems have established administrative body and practices, risk monitoring systems, fraud insurance and "slowness" that actually helps in cases as these (eg. You very often can undo transactions, by freezing funds somewhere across the world and then resolve those issues later on).

Imo cases like these will be crucial in adoption of crypto currencies and smart contracts. And if there will be no (administrative) safe guards against cases like these, it might as well be the end for crypto currencies, simply because of lack of general trust in them.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#300

Post by loceng » Fri, Jul 21, 2017, 2:56 PM UTC

Jabanga wrote: post #179

dullgiulio wrote: post #173

Earlier quoted context omitted.

Look, no. One hundred times, no. Governments in the west are quite accountable, voted for and with a system of checks and balances that has evolved over time, through wars and revolutions. Some random benevolents overlords (white-hat hackers) that save you just because they are magnanimous was the only option only in the most primive societies. Thankfully we moved on from those times, don't you agree?

Your Whig history of an ever progressing political system is not accurate in my opinion. I've written this comment before, and I'll repeat it as it's relevant to your comment: Societies have gradually grown more unfair as the political system has strained under their growing complexity. According to political scientists, the average voter has an extremely limited understanding of what their government is doing. The t…

If we create a UBI then people will have the time to be better educated, to be healthier, to raise healthier, happier, and more productive families. We're almost there, automation will strongly facilitate this.

Because a new technology seems exciting - and gains adoption because early adoption means potential for an individual to turn $1000s of into $1,000,000s with very little individual effort of working towards mass adoption; along with the ecosystem of VCs pumping $100s of millions into creating platforms to support this speculation - doesn't mean we give up on the existing system.

If you don't think the same demagogues, special interest groups, or simply evil/bad actors won't attempt to takeover - then you're already proven wrong by this blackhat 'abuse' of sending themselves money. And it can get much worse than that.

The value of the blockchain is the public ledger IMHO, and the way $100 can because $70 million just because demand is higher, that has too strongly incentivized it and has and will attract very bad people - even if there are good people involved in the ecosystem.