153k Ether Stolen in Parity Multi-Sig Attack • Hacker News Board

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#11

Post by finnh » Wed, Jul 19, 2017, 9:03 PM UTC

I've posted this before [0], but it's still apropos regarding the foolishness that is Ethereum.

[Ethereum] only makes sense if all of the following obtain:

(a) the code is 100% bug-free (b/c accidents cannot be rewound)

(b) all code-writers are 100% honest (their code does what they say)

(c) all contract participants are 100% perfect code readers (so as to not enter into fraudulent contracts)

(Strictly speaking, only one of (b) and (c) needs to be true).

None of these conditions will ever obtain.

[0] https://news.ycombinator.com/item?id=14471465

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#12

Post by jerrylives » Wed, Jul 19, 2017, 9:03 PM UTC

codewiz wrote: post #4

Can someone ELI5? I use Parity, I have a wallet contract deployed, it's night and I'm wearing sunglasses.

Apparently it's an issue with the initWallet() function which is used to set the owner of the wallet

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#13

Post by lettergram » Wed, Jul 19, 2017, 9:03 PM UTC

niahmiah wrote: post #2

Let me guess... another hard fork to undo this.

Hard fork can't even undo this, from my understanding.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#14

Post by WhatsName » Wed, Jul 19, 2017, 9:04 PM UTC

https://cryptowat.ch/kraken/ethusd

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#15

Post by sinieovercosie » Wed, Jul 19, 2017, 9:04 PM UTC

abhi3 wrote: post #3

That's like 30 Million USD at current prices? This is close to the DAO hack in USD value, not another fork now surely?

ETH was also worth a lot less at that time. DAO hackers took a lot more than 150k ETC.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#16

Post by dna_polymerase » Wed, Jul 19, 2017, 9:04 PM UTC

LeoPanthera wrote: post #7

niahmiah wrote: post #2

Let me guess... another hard fork to undo this.

The same old tired snark, in every single Ethereum-related story.

But it's true. If "code is law" is your key feature you don't simply undo a "code is law" decision and gain investors trust.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#17

Post by ythn » Wed, Jul 19, 2017, 9:04 PM UTC

LeoPanthera wrote: post #7

niahmiah wrote: post #2

Let me guess... another hard fork to undo this.

The same old tired snark, in every single Ethereum-related story.

You prefer a hard spoon? ...it'll hurt more

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#18

Post by 52-6F-62 » Wed, Jul 19, 2017, 9:04 PM UTC

kevinwang wrote: post #5

Can anyone explain? Don't know what I'm looking at.

There was a faulty contract in Parity's multi-sig wallet, which is more like a vault than a typical wallet.

The page linked to here is the blockchain address of whoever exploited that fault and was able to take control of a large number of wallets and forward all of the ETH to their account.

They've sold ~20 ETH so far (~4100 USD), and have ~150,000 sitting at that address still.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#19

Post by rocky1138 » Wed, Jul 19, 2017, 9:05 PM UTC

How do we know this is stolen? The link doesn't provide much detail.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#20

Post by samstave » Wed, Jul 19, 2017, 9:06 PM UTC

Forgive me for being harsh:

Why is there no "pen-test" phase to any crytocurrency which hits the market.

So, let me understand; you're ostensibly smart enough to (perhaps as a body of contributors, even) develop a cryptocurrency offering - yet youre also fucking stupid enough to not have same/wider network of ppl attempt to hack the fuck out of your plan?

Does this already occur? or some savant comes and owns them?

We have fucking HIPPA FFS and the compliance systems for something as trivial as my stupid name.

so; ELI5: WTF are currencies doing/not-doing which allow for such hacks (1) and allow for exploits to go unseen (2)