Slashdot Mirror
Hacker Uses Exploit To Generate Verge Cryptocurrency Out of Thin Air (bleepingcomputer.com)
An anonymous reader quotes a report from Bleeping Computer: An unknown attacker has exploited a bug in the Verge cryptocurrency network code to mine Verge coins at a very rapid pace and generate funds almost out of thin air. The Verge development team is preparing a hard-fork of the entire cryptocurrency code to fix the issue and revert the blockchain to a previous state before the attack to neutralize the hacker's gains. The attack took place yesterday, and initially users thought it was a over "51% attack," an attack where a malicious actor takes control over the more than half of the network nodes, giving himself the power to forge transactions. Nonetheless, users who later looked into the suspicious network activity eventually tracked down what happened, revealing that a mysterious attacker had mined Verge coins at a near impossible speed of 1,560 Verge coins (XVG) per second, the equivalent of $78/s. The malicious mining lasted only three hours, according to the Verge team. According to users who tracked the illegally mined funds on the Verge blockchain said the hacker appears to have made around 15.6 million Verge coins, which is around $780,000.
Hard-fork to rollback? Of it goes the can never forget a transaction, apparently it looks like it useful to forget, can't see why they make it a feature.
... That is the general idea.
How is this an attack? Sounds like somebody smart figured out how to mine very quickly.
If he tries to use the funds he will bring the value down to a fraction of that. It is sad that other people will suffer as well.
air thick with pollution from wasted energy.
Well the really old currencies typically had to be mined out of thick hard rock.
Thin air seems rather convenient by comparison. Perhaps too convenient.
If the attacker would have created coins at a reasonable rate the attack may have never been detected.
If he'd kept the mining down to a high-but-not-suspicious level he could've mined for weeks and sold his Verge for USD nd walked away with tens or hundreds of thousands of dollars by summer and maybe millions by Christmas.
Hmm, maybe he or one of is buddies did and this is his way of "shutting the whole exploit down."
We will probably never know.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
So transactions in a blockchain are NOT secure and are NOT permanent. If a blockchain can be AND IS forked from a previous point in time, then doesn't that defeat all security and reliability in the blockchain currency?
The Verge development team is preparing a hard-fork of the entire cryptocurrency code to fix the issue and revert the blockchain to a previous state before the attack to neutralize the hacker's gains.
And to neutralize all the legit (if any) transactions, by the way, creating money out of thin air for those that spent it, and destroying it for those that received it.
Remember this if you are investing real money in Bitcoin, or any other well-known cryptocurrency: Some few people have the power to revert all operations back and make your money vanish, as proven here.
That basically is the way these things are generated. Sure, usually it takes more time, but that is the only thing that went wrong here. Also describes well what these "coins" are worth: Absolutely nothing. That is, unless you find a sucker that is willing to pay for them.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
According to users who tracked the illegally mined funds on the Verge blockchain...
Is not what is "legal" for a blockchain what the majority of nodes maintaining the chain say is legal? If someone broadcast a "weird" transaction on the network but all of the other nodes accepted it and agreed to include it in the blockchain, isn't by definition the transaction done and considered "legal" by the network? After all the rules of the network are what the network says they are; without this concept it wouldn't really be a non centralized, distributed system.
because if so, what difference does it make how they're mined? And if not, shouldn't you be able to stop the invalid coins?
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
screwing with it for it's own sake. Hell, he might have already made all his money, decided anything more would be pointless, and did this again, for the hell of it.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
Which cryptocurrency isn't generated out of "Thin Air"?
Ken
I read through TFA and the submitted patch, but it's not actual clear what the flaw was. I figured /. would like to some full description rather than vague handwaving.
Not at all. One old currency was cowry shells.
Anything works as a currency so long as it's not widely available for nothing in the culture it is used within.
The nominal value of crypto-currency is a consensual agreement among it's users. The technology is the hand waving part that gives a pseudo-rationality to the shared delusion. At the point that enough people doubt the value it ceases to exist.
Nations that maintain currencies have resources to manage currency: courts, law enforcement, armies, laws, taxes, international agreements, the world wide banking system. And even with all that it's not always possible to keep things from going haywire.
Crypto-currency is dependent on a rule of law maintained by the same entities that are responsible for regular currency. It is intrinsically less secure then regular traditional money.
And you can take that to the bank.
Why is Snark Required?
More amusingly, this was the original attempt to fix it before deciding to fork
-static const int64 nMaxClockDrift = 2 * 60 * 60; // two hours // fifteen minutes
+static const int64 nMaxClockDrift = 2 * 15;
Because, yeah, 2 * 15 seconds is fifteen minutes.
They then had another go and just added "* 15" to increase the value, creating a weirdly obscure way to specify 7.5 minutes
+static const int64 nMaxClockDrift = 2 * 15 * 15;
The mere fact that a hack could "create" cryptocurrency out of thin air is proof enough that all cryptocurrencies are thin air,
You might want to reread the chapter on inference in the presence of quantifiers.
Every end has half a stick.
That guy must've been wearing a "joker hat" - he wound up with nothing except the "joy" of seeing a bunch of people having to deal with cleaning up his mess, just like Gotham City's Joker.
A white hat would've reported the bug quietly. A black hat would've capitalized on it with a lot more "smarts" so he wouldn't walk away with nothing.
A grey hat would've done something in between, but he wouldn't have done it just for the lulz.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.