Hot answers tagged

85

There is a chance that once the bitcoins have been converted into ‘real money’ or ‘real assets’ the ledger could leak information on the owners of those bit coins. But even then tracking and attribution can be very complex, but in answer to your question the reason in this case is probably that the attacker(s) haven’t ‘cashed’ them in yet. Depending on who ...


69

Yes, Target did have their account hacked. In fact, quite a lot of verified account holders have been hacked to further this scam. The scammers do this to impersonate other accounts, including Elon Musk's, by changing their name while retaining their verified status. In this case, it just looks like the scammer is using Target's account directly. This scam ...


52

I heard this example during one of the guest lectures back in my grad school. I think it is simple enough since I've myself used it many times, to explain ZKP to people with almost Zero Knowledge of crypto/math. Let's say that I want to convince you that I have a superpower to count the exact number of leaves on a tree, within a few seconds. I want to ...


51

Wright did not obtain Nakamoto's private key. What he did provide as evidence was a signature from one of the early bitcoin transactions. However, that signature is from the blockchain and can be looked up by anyone. Wright was able to fool some people from the mainstream media who don't really understand the technical details, but the security community ...


50

I dug into this, cause I also got the Discord message. Felt too good to be true, right? Well, yes, it is too good to be true. I set up a new Browser, with no history in it, made a temporary email and signed up. I entered their "You have won" code, and sure thing, they did deposit 0.48 BTC on the account I just made on their site. Cool. (They probably just ...


31

Target has since confirmed my suspicion: Hard Fork article “Early this morning, Target’s Twitter account was inappropriately accessed” a company spokesperson told Hard Fork in an email. “The access lasted for approximately half an hour and one fake tweet was posted during that time about a Bitcoin scam.” “We’re in close contact with Twitter, have deleted ...


24

The receiver won't learn your IP, but a somewhat determined adversary could. (Of course, if the seller is an adversary, then they could.) This isn't a part of the protocol (there's no sender_IP field in the transaction), it is accomplished via listening in many places on the mesh network and doing statistics to determine the originating node of a transaction....


22

Contrary to popular believe, Bitcoin is the exact opposite of being untraceable. Any transactions between wallets are stored safely, unchangeable and completely public in the blockchain and can be traced at a later date. By anyone - not just law enforcement. What's left for law enforcement to do is to find out which wallet belongs to which person. The ...


20

The only reliable evidence of an internal person attacking your systems is if you catch them with their fingers on the keyboard. People often suspect insiders because they have spent an extraordinary amount of money building extremely sophisticated defenses, and they simply cannot imagine a hacker being able to navigate them. They have grandiose releasing ...


17

Bitcoins carry with them a complete log of their entire transaction history. So the bitcoins used to pay that ransom can forever be found. Whomever has them in their possession can be tracked down, at least elecronically. Transfering those bitcoins into other currency or goods could be used to track down the person who benefited from the bitcoin. To ...


16

This is neither a virus nor a trojan, and it does not make the site unsafe to visit in any way whatsoever. Your antivirus package is crying wolf. Coinhive is a Javascript plugin which implements a cryptocurrency miner. While you view a web site which uses this script, your browser will perform calculations to mine cryptocurrency for the owner of the web ...


15

He didn't. What people are saying is that he "used a signature from early in the block chain as evidence" which still sounds like he could prove he made an early block signature, even if it wasn't the genesis block, but that's not the case. What he did, as far as I get it, was like taking an old book and taking a picture of the author's signature and go "...


14

Ability to compute a lot of hashes very fast with dedicated hardware is a problem for password hashes, but not a new problem. Before the advent of ASIC specialized in SHA-256, we were already taking FPGA into account (see for instance this research machine, from already five years ago). An ASIC can roughly be clocked at two to three times the frequency of ...


10

There are schemes (1 and 2) that use environmental sensors like accelerators to generate a shared secret. Two devices are shaken while held together. The specific time, pattern and magnitude of shaking should be unique to these two devices. This data can be used to calculate a secret value only these two devices should know.


10

Most people simply don't know how to buy bitcoin, and would probably require being walked through the process (expensive). Those few who do know how to buy bitcoin tend to be more tech-savvy, and perhaps less-easily fooled by call center scammers. A lot of people also associate bitcoin with criminal activity, which could also make it more-difficult to trick ...


9

You do not encrypt with ECDSA; ECDSA is a signature algorithm. It so happens that an ECDSA public key really is an "EC public key" and could conceptually be used with an asymmetric encryption algorithm that uses that kind of key; e.g. ECIES; or it could also be used as one half of a key exchange algorithm like ECDH, resulting in a "shared secret" than can ...


8

OK, first a correction: If one can only give away their bitcoins by providing their private key, No. You send bitcoins to another party by signing a transaction that transfers the bitcoins from your address (controlled by your private key) to another address (controlled by the other party's private key). Actual private keys should never be exchanged, ...


8

Based on the provided information it is hard to tell exactly, what's behind the scam. The site is really new (domain was registered 4 days ago), which makes it even less credible. I visited the site and it is actually really well made design wise. It presents itself as a normal crypto trading platform. From my perspective there are two most likely vectors ...


6

The best demonstration of zero-knowledge proofs I have come across is "Applied Kid Cryptography, or How to Convince Your Children You Are Not Cheating" by Moni Naor, Yael Naor, and Omer Reingold. They examine a simple but real-life cryptographic problem: how to convince people that you know the solution to a Where's Waldo puzzle without releaving any ...


6

Higher electricity consumption. CPUs and graphic cards clock down when they don't have much to do, which causes them to consume much less power. But a cryptocurreny miner will keep them busy at all times. This will increase your power bill. This is in fact a common problem for many cryptocurrencies: The value of the currency is less than the price for the ...


6

Bitcoin can combine several transactions' outputs as a new transaction's input, and it can also split a single transaction's output among many recipients. This is because only balances are transferred in transactions, not individual units of bitcoin. "Mixing" services do this to obscure where bitcoin is going. After inspecting one of these transactions, ...


5

From my basic understanding, since bitcoin network is peer to peer, you do not directly connect to your destination, but broadcast the message to your peers. Because of this, those peers are the ones that see your true IP address (and most likely they are the only ones). Because of this, it might be possible to trace back the transaction to you, but no ...


5

Removing the SIM alone wouldn't prevent a remote hack if the phone was powered up as WiFi would still be available and therefore an attack vector. However, a phone that is off with no source of power is not remotely hackable. At least there's no demonstrated techniques or even published research that I know of which would make it possible. Without a power ...


5

When you install the Linux OS, you have to assume that the software is the genuine one, free of backdoors. Linux distributions tend to use digital signature on packages; a digital signature does not guarantee absence of backdoor, but it prevents undetected alterations in transit: you know that the package you get is the one produced by the packager. Since ...


5

Generally locking accounts as proposed by raz is a very bad thing - it leads to helpdesk load, annoyed customers, and is not needed to actually prevent brute force attacks. Temporary suspensions are used by more and more systems, often some delay that foils brute force, like 5 or 30 minutes, or by using an escalating scale, eg doubling the timeout each ...


5

Your setup is called air gap. 512 MB (even 2) is still a lot for a virus payload that only needs to steal a private key. I think what you want is to use QR codes for both parties. If you print the QR codes, be sure to use separate printers, just like with all peripheral devices (even a mouse chip could contain an exploit that got there through your online ...


5

I see your question as having two parts: Why blockchain? According to ZDNet's summary of the request, the preference for a decentralised blockchain solution is rooted in an interest in moving away from legacy centralised architectures, which DARPA describes as "expensive, inefficient, brittle and subject to cyber attack" at the given link. Why not an ...


5

We already have such a system: DNSSEC, that allows precisely the control required. The problem with using Blockchain with domains, is that theres no inherent link between the domain and the keypair using for signing. So this information must be tied to each other somewhere. And somewhere would then be at the registrar, making the whole blockchain then ...


Only top voted, non community-wiki answers of a minimum length are eligible