281–290 of 296 posts
I was told governments can't get involved in crypto, that's what makes it great? Totally anonymous? Untraceable?
That's not entirely true. Bitcoin is neither anonymous nor untraceable. governments however can't control it. They can only observe what's happening on the chain. Hope that helps.
Earlier quoted context omitted.
I don't see how that's relevant to the incentives of foreign enemies attacking us. As I said, there are many. It basically stops being criminal activity. Do you really think that's not the case, or that that isn't going to considerably skew where these attacks come from?
I think he's making the point that the attributions of "This came from " are without any evidence. How exactly do you determine that a hack originated in Russia when Russian ips will not hand over their traffic to US authorities? Just because a lot of illicit web traffic originates from Israeli servers, for example, does not mean that it originated in Israel. In reality, our cyber security agencies have no idea where…
Badly, I guess, because no one has mentioned evidence or a lack of evidence anywhere in the thread.
> How exactly do you determine that a hack originated in Russia when Russian ips will not hand over their traffic to US authorities?
There are a lot of different ways. GEOIP is just one method. Examining the artifacts for code-reuse from other malware is another big one. Looking at the types of attacks is another ie: "this malware uses these techniques, and these are favored by groups 1,2,3".
There's a lot more to it than that, and not all of it is public. I've seen attribution done through backdoor channels that were not strictly legal.
> In reality, our cyber security agencies have no idea where these guys are coming from
No, more often than not we definitely do.
Earlier quoted context omitted.
If the private key was hashed, and they only had the hash, then they could not crack it. Hashing is not the same as encryption.
Second reply: I saw that you work in applied cryptography and blockchain technology @ Cryptography Services (NCC Group) so you might be familiar with somewhat Grey Hat russian forum InsidePro; back in the day I saw people there requesting Bitcoin private key recovery for their lost private keys or if they encrypted and/or hashed wallet private keys and couldn't recover plaintext anymore and I can say that amateur cra…
That's only if the key was derived from a weak password, which allows it to be brute-forced with standard password scanning techniques. If you're even slightly concerned with security you let a computer generate a fully random key using the proper amount of entropy—preferable on an air-gapped system or an HSM (hardware wallet). No one is going to be "recovering" private keys which were generated and handled securely without a very large budget and physical access to the storage medium.
Earlier quoted context omitted.
I don't understand why so many people are jumping to the conclusion that the FBI broke sha-256. Theres so many other lower hanging fruit posibilities... 1: they served the server provider with a warrant they provided physical access. 2: their server infra was running vulnerable code for another service. 3. weak passwords / weak security in general 4. they cut a deal with the upstream ransomware providers and were pro…
> FBI broke sha-256 A very odd conclusion because that's not the crypto you need to break to steal some coins.
Earlier quoted context omitted.
Hacker gangs also apparently lose 2.4 million dollars at the drop of a hat, which is something that no security consultant ever has to worry about.
> which is something that no security consultant ever has to worry about There's enough self-styled cypherpunk infosec experts that might insist on being paid only in BTC and then lose their decrypted wallet...
Earlier quoted context omitted.
> I think you are assigning too much “us vs them” to the ransomware marketplace. Attacking things in a foreign jurisdiction is massively appealing from a "what will get me thrown in jail by my own government if things go wrong" perspective. You don't need any political loyalty for that calculation.
The problem is that state-level actors are considerably more sophisticated in their activities than what was seen here. There was a story on HN a while back that can best be summed up as "Defending against this is impossible: Mossad is gonna Mossad and there is nothing you can do about it: https://news.ycombinator.com/item?id=26591669
Earlier quoted context omitted.
what do you mean? if they broke sha256 in any meaningful way then people can skip (or significantly game) the whole mining thing...
The mining algorithm can just be changed with a hard fork. The only think that would irrevocably kill Bitcoin is breaking private keys (ie discovering others private keys, or signing transactions without private keys). A fork could not solve it as there'd be no way to prove which coins you actually owned before the fork.
theres no speculation that this exists, but bitcoin wouldnt last in a commercial world of quantum algos
This story makes absolutely no sense at all. The errors present by these hackers are so comical it's simply unbelievable. I'm supposed to believe some elite Russian hacking group keeps their crypto wallets running on a US host where the FBI just logs right in and snatches the private key? I'm starting to entertain the conspiracies that the future of commodities price manipulation is fake ransomware attacks. There nee…
People overestimate criminals. The ones that get caught, especially. What would you do if you were a foreign intelligence service? Participate in attacks yourself? No! You would drop hints and supply tools sideways to sloppy groups of idiots enabling them to be destructive, maybe acquiring some funds, and keeping your hands as clean as possible. Then when it comes out that "elite russian hackers" were incompetent idi…
this is a true criminal SaaS, partly because its low risk, high reward for the developers and partly because its a russian funded op that needs to cover its ass in the nature of its attacks on democracy and corporatism.
Earlier quoted context omitted.
The mining algorithm can just be changed with a hard fork. The only think that would irrevocably kill Bitcoin is breaking private keys (ie discovering others private keys, or signing transactions without private keys). A fork could not solve it as there'd be no way to prove which coins you actually owned before the fork.
many people speculate that quantum computing would crack private keys in no time. theres no speculation that this exists, but bitcoin wouldnt last in a commercial world of quantum algos
AND even if the elliptic curve cryptography of bitcoin is broken, say you can solve it in a year/month/week/day, the fact is most BTC unspent transaction outputs (UTXO's) are scripted "pay to public key hash".
The entity proving ownership of the UTXO needs to show a public key (that is so far unknown ... if they haven't reused this address before), AND this public key needs to hash into the address, AND the signature signed by the private key verified.
So if somebody announced they had solved secp256k1 and could break it in 1 week, your funds are safe. (1) They probably don't know your public key. Relax. And (2) You just wait for the BTC soft fork to support new crypto, then do a transfer to yourself. You transmit your transaction to the mempool (exposing your public key for the first time), and it will be mined in 10-30 minutes. Not enough time for the hackers to monitor the mempool and come up with a valid signature. Then your new UTXO is a different spend script for how to spend it next time using some new unbreakable crypto.