Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

153k Ether Stolen in Parity Multi-Sig Attack

etherscan.io

Post reply on HN
Print view View original

381–390 of 754 posts

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#381

Post by 52-6F-62 »

chillydawg wrote: post #267
52-6F-62 wrote: post #6

Earlier quoted context omitted.

A hard fork couldn't undo the damage if everybody wanted to. The exploiter/hacker/scammer, whatever you want to label them, can move ETH into other coins on exchanges immediately. This will cause an innocent party to buy them, removing any chance of reversal affecting the person[s] responsible. During the DAO hack, the funds were prevented from moving anywhere so a hard fork caused a direct reversal. That's my unders…

Eth is worth less right now, as there is an implicit chance that all transactions will be rolled back to a few hours ago. Hence any buyer of ETH will be getting a fair price for the risk. Wild west all round.

None of that is true at all. Rolling it back would do nothing for anybody affected, so there's no way a consensus would form. That and a majority of the hacked accounts were prevented loss by whitehats as things look now.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#382

Post by jeeceebees »

dvcc wrote: post #77

Can someone explain how immutable contracts get updated? From what I understand you can have one contract forward requests to another, and you can use some storage in the forwarding contract to determine the real target contract. But why would someone participate in a contract that is mutable? I guess I am just wondering how this contract can be updated, given its on the blockchain and considered immutable.

The contract code is immutable. The code that you agree to can be pretty complicated though and might not do exactly what you think it does.

In this case, by some stupid mistake the contract allowed anyone at all to change who was considered an owner of a wallet.

The code wasn't changed; one of the functions it specified was used to change a variable.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#383

Post by youdontknowtho »

empath75 wrote: post #223
eek05 wrote: post #175

Earlier quoted context omitted.

Not necessarily. Without judging the suitability of Ethereum for this, if you have something that does automated contracts at e.g. 9 nines reliability (fails one time in a billion), it may be very much worthwhile even if you have to fall back to the court system for the one in a billion occurrence. Now, I'm skeptical of Ethereum's suitability in this space - the design doesn't seem to be geared enough towards correct…

Rolling back the dao set a terrible precedent, and people that were ripped off in the latest hack should rightfully be asking for another fork. If there isn't one, then it'll be apparent that the developers will only protect their own interests.

That's a great point. It will be interesting to see what they do here. My bet is that they cover their interests, with an outside chance that they make up some kind of BS about percentage of ethereum in circulation vs the size of the fraud.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#384

Post by hinkley »

rubidium wrote: post #371
patejam wrote: post #355

Earlier quoted context omitted.

I feel like we shouldn't be expressed in dollars, but in percentage of total funds. In this case 16 million is about 1% of the total. This would be a $16 billion case if the US banking system was the target and used this technology.

That... doesn't make a difference in my mind. Losing 1% of people's money is _very_ unacceptable and worth being laughed at for. Financial institutions are accurate to tiny tiny fractions of percentage points. Not "eh we got 99% of it right".

Especially when the odds are that it will happen again soon.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#385

Post by rainboiboi »

flashmob wrote: post #351
davidgerard wrote: post #261

Earlier quoted context omitted.

Actually, I think Solidity being designed to turn bad node.js coders into bad smart contract coders was key to Ethereum's success. I've written a book on this (hit upload five minutes ago! release Monday!) which hammers on this point (and all the stuff surrounding this issue). I think Solidity is actually designed with worse is better in mind, because Ethereum is the first smart contract platform that anyone actually…

You've wet my appetite. Got a link to your book?

Check out his profile.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#386

Post by hinkley »

Cthulhu_ wrote: post #250
mechnesium wrote: post #214

Earlier quoted context omitted.

Precisely. Code reviews and software quality assurance aren't just corporate redtape, they can save your rear.

Especially for this; it should be enterprise, bank-tier code, covered by as much red tape as possible. The problem with cryptocurrency is that they try to be better than the system, but have to relearn all the lessons the hard way. It probably won't take too long before all of it becomes exactly like what banks are now - heavily regulated, etc.

Meanwhile, the people who fleeced the old system know all the tricks and they get a chance at doing it again before the regulations kick in.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#387

Post by kbenson »

dahdum wrote: post #374
kbenson wrote: post #284

Earlier quoted context omitted.

That may be, but if so, it might be worse . What's worse, not getting a lot of uptake for this idea that's been hard going for others, or getting the uptake because of trade-offs you made that make it a ticking time-bomb that may damage the reputation of the idea for years to come and set it back?

Solidity is like PHP in the 90's, easy to learn and easy to screw up. Though Solidity just compiles to the EVM, and there is no reason new, safer languages can't be built on top. As far as I can remember, the EVM has never failed, just programmers.

That comparison may be apt. PHP at that time was a mix of some good ideas (ease of deployment) with some horrible ones (register globals on by default is unexcusable), and some poor planning. We all lived with the fallout of that for a very long time.

The register globals issue could have been avoided at very little cost, if any cost at all, to the popularity and spread of the language and many millions of dollars and much personal information would have been saved.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#388

Post by Taek »

vasilipupkin wrote: post #330
Taek wrote: post #323

Earlier quoted context omitted.

People write this stuff off so fast. Here we have a parity developer, probably one of the most competent in the Ethereum ecosystem, and he screwed up to the tune of losing $30m of other people's money. If HE can't get it right, what business do you have running around saying that anyone who can make a webpage can make a decentralized application? We are playing with money. Dealing with attackers is not as simple as r…

Dear god, I've been thinking crypto is a bubble since 2010. At some point, we have to admit this is not just a bubble. It's a new unproven evolving technology

Crypto has had at least 3 distinct bubbles. There's the current one, marked by Eth's absurd rise to $300. The previous one was when Bitcoin made an absurd rise to $1200 in 2014. There was a bubble before that where Bitcoin rose to $266 in 2011. And one before that I believe where Bitcoin rose to $32 in 2010.

Though crypto has risen past the high point of each of these bubbles, each price point can be definitively classified as a bubble in it's own time, and was followed by a crash that wiped out >70% of the market cap over the coming months/years.

Though it did recover, that doesn't mean it wasn't a bubble.

I believe cryptocurrency is going to be bigger than e-commerce is today. But it's not there yet, and it shouldn't be valued as though it has changed the world. It hasn't yet, and it's still a few years away at least from doing so.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#389

Post by sillysaurus3 »

shurcooL wrote: post #350
earlz wrote: post #25

Here's the root error I believe: https://github.com/paritytech/parity/blob/master/js/src/cont... The initWallet function should have been marked internal, but was instead not marked. Unmarked functions default to public in Solidity, so anyone can call that function and reinitialize the wallet to be under their control

Please be aware that you can press Y before sharing a link to make it a permalink. The link you shared points to master branch, which will change over time, so the line number you pointed to will have something else. Based on the time of your post, I suspect you meant to link to: https://github.com/paritytech/parity/blob/4c32177ef3f4521c66...

That Y hotkey is immensely useful. Thanks!

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#390

Post by true_religion »

sillysaurus3 wrote: post #311
stale2002 wrote: post #309

Earlier quoted context omitted.

Sure they will ask. And you can say something like "I was an early bitcoin investor". Or "I trade cryotcurrencies". It is perfectly reasonable to be a cryto trade that never withdraws to USD, and just makes money by transferring between crypto currencies and ICOs or something. I am sure there are a whole lot of people out there who spent a thousand dollars or so back in 2009, and now they have 10 mill in the bank. It…

I guess I'm skeptical of the idea that they won't ask for proof of your trades, which would lead to discovering you were a thief. But I suppose that's highly unlikely.

I suppose but this sub thread was a reaction to someone mentioning that it was hard to get USD out of Bitcoin. It's not about laundering money from illicit transactions.
Post reply on HN