5 ms·

From the post mortem (1) -=> - A hacker managed to exploit a ICO multisig wallet vulnerability and drain 44,055 ETH - $9,119,385 at present. - A white hat sho

From the post mortem (1) -=> - A hacker managed to exploit a ICO multisig wallet vulnerability and drain 44,055 ETH - $9,119,385 at present. - A white hat showed up and "saved" 377,000 ETH - $78,039,000 !!! - by draining other accounts. I get the "see cryptos are too insecure / it's a pyramid / it's a bubble / ICOs are scams / etc" arguments. But holy shit turning a world currency into the wild west - for better or worse - is going to be disruptive, period. That $10m out the window is like a Series A for a nefarious hacker with deep crypto skills, what does this success embolden or create? I can only imagine the debacles that we have to look forward to, and I say that in full support of and as a long term believer in both blockchain and cryptocurrencies. (1) https://press.swarm.city/parity-multisig-wallet-exploit-hits-swarm-city-funds-statement-by-the-swarm-city-core-team-d1f3929b4e4e https://press.swarm.city/parity-multisig-wallet-exploit-hits...

sillysaurus3 9y ago
The real lesson is: don't store your coins on a third party anything. This was a third-party wallet. Everyone used it because everyone else used it. Exactly like Mt Gox. There was no reason to store coins on Mt Gox, just like there was no reason to use this wallet. A moment's reflection would have prevented this foolish decision.
- ChrisClark 9y ago
  This wasn't a third party wallet actually. It is the local Parity wallet and node. What this was, was a bug in the multisig contract that Parity would give you to deploy. So it is a contract you personally deploy onto the ethereum network and then interact with. You do own it, you own the private keys for the address, etc. But the bug allowed any other address to add themselves as owners and withdraw from it. Luckily not many people used it and the white hat was able to claim all the rest before anyone else.
  - sillysaurus3 9y ago
    https://github.com/paritytech/parity https://github.com/paritytech/parity About Parity Parity's goal is to be the fastest, lightest, and most secure Ethereum client. We are developing Parity using the sophisticated and cutting-edge Rust programming language. Parity is licensed under the GPLv3, and can be used for all your Ethereum needs. Parity comes with a built-in wallet. How is this not a third-party wallet? They say right on the page that they're trying to be the best implementation of Ethereum. That means they're not the core implementation, right?
    - nebulous1 9y ago
      You compared it to Mt Gox, which is where the confusion is coming from. With an online service like Mt Gox you don't have control of the coins at all. I have no issue using an open source implementation of something. You haven't explained why that's an issue.
      - sillysaurus3 9y ago
        Whether it's an online service or a local wallet with an embedded buggy smart contract, your coins are just as gone. If you're perfectly happy to use it, you're perfectly happy to lose everything. How many millions need to be lost before this lesson is learned?
        nebulous1 9y ago
        Again, you haven't made any case for not using open source third party software. The other other example you've come up with was a close source proprietary internet service. Very few people, for instance, use the official Bitcoin Core wallet.
        sillysaurus3 9y ago
        I believe there have been scam wallet implementations for BTC in the past, though I don't have any info. They're your coins. Throw them off a bridge if you want. Meanwhile, people who stick with core tech have been burned zero times. Why does the obsession with shiny new convenient thing outweigh people's good sense not to risk thousands or hundreds of thousands of dollars? If that amount of money were printed out in front of you, you'd take extreme measures to protect it. "Don't use an un-audited third party piece of software that controls the fate of your life savings" is the most basic step. It occurs to me that you might be arguing against this because you have a large sum stored in some third-party tech. If that's the case, I urge you to snap out of it and transfer your coins somewhere safe immediately. I say "snap out of it" because that's the phrasing I would've used with myself, right before I lost money in Mt Gox. The only reason that happened is because I never stopped to ask myself "Is this a good idea?"
  - mpeg 9y ago
    Exactly, you are deploying code to the cloud that you didn't write and trusting it with your money. So many things wrong about that, it's the cryptocurrency equivalent of installing random software packages on your critical servers.
    - zfran 9y ago
      actually the best practice is not writing your own code and using thoroughly audited industry standards. Writing your own smart contracts for things that other people have already done and secured is akin to rolling out your own cryptography. Obviously, just like it's happened with openssl in the cryptography equivalency, this can also go wrong, but it's less likely. If you write your own you should get your code audited by a specialist, or many, before deploying.
- nebulous1 9y ago
  Parity does not appear to be an online service. It's local.
  - mpeg 9y ago
    It runs on a distributed cloud VM actually (Ethereum). So the rule applies: don't trust online services with your money, especially if you didn't write the code.
    - 5chdn 9y ago
      Parity does not run on the EVM, it's a local node processing a local copy of the blockchain. You can create normal accounts which are just private/public keypairs you have full control of without anything "being in the cloud" or "distributed". What you are referring to might be the vulnerable multi-signature wallet itself, which - once deployed - runs on the EVM. And that only affects a fraction of Parity users. Note, I work for Parity.
runeks 9y ago
> That $10m out the window is like a Series A for a nefarious hacker with deep crypto skills [..] Where "deep crypto skills" refers to someone who bothered to read the documentation on Solidity (the Ethereum contract language), specifically the section on function visibility[1], and the Parity wallet contract itself[2]. In other words, an obscure security hole was not found by a genius hacker. An obvious, trivial, simple mistake was exploited for $9m because the people investing money in it provably didn't know what they're were doing. [1] http://solidity.readthedocs.io/en/develop/contracts.html#visibility-and-getters http://solidity.readthedocs.io/en/develop/contracts.html#vis... [2] https://github.com/paritytech/parity/blob/4c32177ef3f4521c663113749400f5a8b6f0e0d4/js/src/contracts/snippets/enhanced-wallet.sol https://github.com/paritytech/parity/blob/4c32177ef3f4521c66...
- kough 9y ago
  because the people investing money in it provably didn't know what they're were doing. Very true – the price hasn't really moved in response to this news, which makes very little sense to me. I'd be shorting if I could figure out how.
  - keypusher 9y ago
    Would you short the US dollar because one small bank got robbed due to bad security? The flaw here was not with Ethereum, it was with the wallet developer.
    - mcbits 9y ago
      Based on the relative sizes of the currencies, this is closer in scale to the Bernie Madoff scam, but happening overnight instead of gradually over 20 years.
  - tboyd47 9y ago
    Why should the price move in response to this? They'll just change the rules and print more.

sillysaurus3 9y ago

The real lesson is: don't store your coins on a third party anything. This was a third-party wallet. Everyone used it because everyone else used it. Exactly like Mt Gox. There was no reason to store coins on Mt Gox, just like there was no reason to use this wallet. A moment's reflection would have prevented this foolish decision.

ChrisClark 9y ago
This wasn't a third party wallet actually. It is the local Parity wallet and node. What this was, was a bug in the multisig contract that Parity would give you to deploy. So it is a contract you personally deploy onto the ethereum network and then interact with. You do own it, you own the private keys for the address, etc. But the bug allowed any other address to add themselves as owners and withdraw from it. Luckily not many people used it and the white hat was able to claim all the rest before anyone else.
- sillysaurus3 9y ago
  https://github.com/paritytech/parity https://github.com/paritytech/parity About Parity Parity's goal is to be the fastest, lightest, and most secure Ethereum client. We are developing Parity using the sophisticated and cutting-edge Rust programming language. Parity is licensed under the GPLv3, and can be used for all your Ethereum needs. Parity comes with a built-in wallet. How is this not a third-party wallet? They say right on the page that they're trying to be the best implementation of Ethereum. That means they're not the core implementation, right?
  - nebulous1 9y ago
    You compared it to Mt Gox, which is where the confusion is coming from. With an online service like Mt Gox you don't have control of the coins at all. I have no issue using an open source implementation of something. You haven't explained why that's an issue.
    - sillysaurus3 9y ago
      Whether it's an online service or a local wallet with an embedded buggy smart contract, your coins are just as gone. If you're perfectly happy to use it, you're perfectly happy to lose everything. How many millions need to be lost before this lesson is learned?
      - nebulous1 9y ago
        Again, you haven't made any case for not using open source third party software. The other other example you've come up with was a close source proprietary internet service. Very few people, for instance, use the official Bitcoin Core wallet.
        sillysaurus3 9y ago
        I believe there have been scam wallet implementations for BTC in the past, though I don't have any info. They're your coins. Throw them off a bridge if you want. Meanwhile, people who stick with core tech have been burned zero times. Why does the obsession with shiny new convenient thing outweigh people's good sense not to risk thousands or hundreds of thousands of dollars? If that amount of money were printed out in front of you, you'd take extreme measures to protect it. "Don't use an un-audited third party piece of software that controls the fate of your life savings" is the most basic step. It occurs to me that you might be arguing against this because you have a large sum stored in some third-party tech. If that's the case, I urge you to snap out of it and transfer your coins somewhere safe immediately. I say "snap out of it" because that's the phrasing I would've used with myself, right before I lost money in Mt Gox. The only reason that happened is because I never stopped to ask myself "Is this a good idea?"
- mpeg 9y ago
  Exactly, you are deploying code to the cloud that you didn't write and trusting it with your money. So many things wrong about that, it's the cryptocurrency equivalent of installing random software packages on your critical servers.
  - zfran 9y ago
    actually the best practice is not writing your own code and using thoroughly audited industry standards. Writing your own smart contracts for things that other people have already done and secured is akin to rolling out your own cryptography. Obviously, just like it's happened with openssl in the cryptography equivalency, this can also go wrong, but it's less likely. If you write your own you should get your code audited by a specialist, or many, before deploying.
nebulous1 9y ago
Parity does not appear to be an online service. It's local.
- mpeg 9y ago
  It runs on a distributed cloud VM actually (Ethereum). So the rule applies: don't trust online services with your money, especially if you didn't write the code.
  - 5chdn 9y ago
    Parity does not run on the EVM, it's a local node processing a local copy of the blockchain. You can create normal accounts which are just private/public keypairs you have full control of without anything "being in the cloud" or "distributed". What you are referring to might be the vulnerable multi-signature wallet itself, which - once deployed - runs on the EVM. And that only affects a fraction of Parity users. Note, I work for Parity.

runeks 9y ago

> That $10m out the window is like a Series A for a nefarious hacker with deep crypto skills [..] Where "deep crypto skills" refers to someone who bothered to read the documentation on Solidity (the Ethereum contract language), specifically the section on function visibility[1], and the Parity wallet contract itself[2]. In other words, an obscure security hole was not found by a genius hacker. An obvious, trivial, simple mistake was exploited for $9m because the people investing money in it provably didn't know what they're were doing. [1] http://solidity.readthedocs.io/en/develop/contracts.html#visibility-and-getters http://solidity.readthedocs.io/en/develop/contracts.html#vis... [2] https://github.com/paritytech/parity/blob/4c32177ef3f4521c663113749400f5a8b6f0e0d4/js/src/contracts/snippets/enhanced-wallet.sol https://github.com/paritytech/parity/blob/4c32177ef3f4521c66...

kough 9y ago
because the people investing money in it provably didn't know what they're were doing. Very true – the price hasn't really moved in response to this news, which makes very little sense to me. I'd be shorting if I could figure out how.
- keypusher 9y ago
  Would you short the US dollar because one small bank got robbed due to bad security? The flaw here was not with Ethereum, it was with the wallet developer.
  - mcbits 9y ago
    Based on the relative sizes of the currencies, this is closer in scale to the Bernie Madoff scam, but happening overnight instead of gradually over 20 years.
- tboyd47 9y ago
  Why should the price move in response to this? They'll just change the rules and print more.