Category Archives: Economics

Hackers Stole Over $20 Million From Misconfigured Ethereum Clients

Posted on by

A group of hackers has stolen over $20 million worth of Ethereum from Ethereum-based apps and mining rigs, Chinese cyber-security firm Qihoo 360 Netlab reported today.

The cause of these thefts is Ethereum software applications that have been configured to expose an RPC [Remote Procedure Call] interface on port 8545.

The purpose of this interface is to provide access to a programmatic API that an approved third-party service or app can query and interact or retrieve data from the original Ethereum-based service —such as a mineror wallet application that users or companies have set up for mining or managing funds.

Because of its role, this RPC interface grants access to some pretty sensitive functions, allowing a third-party app the ability to retrieve private keys, move funds, or retrieve the owner’s personal details.

As such, this interface comes disabled by default in most apps, and is usually accompanied by a warning from the original app’s developers not to turn it on unless properly secured by an access control list (ACL), a firewall, or other authentication systems.

Almost all Ethereum-based software comes with an RPC interface nowadays, and in most cases, even when turned on, they are appropriately configured to listen to requests only via the local interface (127.0.0.1), meaning from apps running on the same machine as the original mining/wallet app that exposes the RPC interface.

Some users don’t like to read the documentation

But across the years, developers have been known to tinker with their Ethereum apps, sometimes without knowing what they are doing.

This isn’t a new issue. Months after its launch, the Ethereum Project sent out an official security advisory to warn that some of the users of the geth Ethereum mining software were running mining rigs with this interface open to remote connections, allowing attackers to steal their funds.

But despite the warning from the official Ethereum devs, users have continued to misconfigure their Ethereum clients across the years, and many have reported losing funds out of the blue, but which were later traced back to exposed RPC interfaces.

Source: Hackers Stole Over $20 Million From Misconfigured Ethereum Clients

Blockchain’s Once-Feared 51% Attack Is Now Becoming Regular among smaller coins

Posted on by

Monacoin, bitcoin gold, zencash, verge and now, litecoin cash.

At least five cryptocurrencies have recently been hit with an attack that used to be more theoretical than actual, all in the last month. In each case, attackers have been able to amass enough computing power to compromise these smaller networks, rearrange their transactions and abscond with millions of dollars in an effort that’s perhaps the crypto equivalent of a bank heist.

More surprising, though, may be that so-called 51% attacks are a well-known and dangerous cryptocurrency attack vector.

While there have been some instances of such attacks working successfully in the past, they haven’t exactly been all that common. They’ve been so rare, some technologists have gone as far as to argue miners on certain larger blockchains would never fall victim to one. The age-old (in crypto time) argument? It’s too costly and they wouldn’t get all that much money out of it.

But that doesn’t seem to be the case anymore.

NYU computer science researcher Joseph Bonneau released research last year featuring estimates of how much money it would cost to execute these attacks on top blockchains by simply renting power, rather than buying all the equipment.

One conclusion he drew? These attacks were likely to increase. And, it turns out he was right.

“Generally, the community thought this was a distant threat. I thought it was much less distant and have been trying to warn of the risk,” he told CoinDesk, adding:

“Even I didn’t think it would start happening this soon.”

Inside the attacks

Stepping back, cryptocurrencies aim to solve a long-standing computer science issue called the “double spend problem.”

Essentially, without creating an incentive for computers to monitor and prevent bad behavior, messaging networks were unable to act as money systems. In short, they couldn’t prevent someone from spending the same piece of data five or even 1,000 times at once (without trusting a third party to do all the dirty work).

That’s the entire reason they work as they do, with miners (a term that denotes the machines necessary to run blockchain software) consuming electricity and making sure no one’s money is getting stolen.

To make money using this attack vector, hackers need a few pieces to be in place. For one, an attacker can’t do anything they want when they’ve racked up a majority of the hashing power. But they are able to double spend transactions under certain conditions.

It wouldn’t make sense to amass all this expensive hashing power to double spend a $3 transaction on a cup of coffee. An attacker will only benefit from this investment if they’re able to steal thousands or even millions of dollars.

As such, hackers have found various clever ways of making sure the conditions are just right to make them extra money. That’s why attackers of monacoin, bitcoin gold, zencash and litecoin cash have all targeted exchanges holding millions in cryptocurrency.

By amassing more than half of the network’s hashing power, the bitcoin gold attacker was able to double spend two very expensive transactions sent to an exchange.

Through three successful attacks of zencash (a lesser-known cryptocurrency that’s a fork of a fork of privacy-minded Zcash), the attacker was able to run off with about more than 21,000 zen (the zencash token) worth well over $500,000 at the time of writing.

Though, the attack on verge was a bit different since the attacker exploited insecure rules to confuse the network into giving him or her money. Though, it’s clear the attacks targeted verge’s lower protocol layer, researchers are debating whether they technically constitute 51% attacks.

Small coins at risk

But, if these attacks were uncommon for such a long time, why are we suddenly seeing a burst of them?

In conversation with CoinDesk, researchers argued there isn’t a single, clear reason. Rather, there a number of factors that likely contributed. For example, it’s no coincidence smaller coins are the ones being attacked. Since they have attracted fewer miners, it’s easier to buy (or rent) the computing power necessary needed to build up a majority share of the network.

Further, zencash co-creator Rob Viglione argued the rise of mining marketplaces, where users can effectively rent mining hardware without buying it, setting it up and running it, has made it easier, since attackers can use it to easily buy up a ton of mining power all at once, without having to spend the time or money to set up their own miners.

Meanwhile, it’s grown easier to execute attacks as these marketplaces have amassed more hashing power.

“Hackers are now realizing it can be used to attack networks,” he said.

As a data point for this, someone even erected a website Crypto51 showing how expensive it is to 51% attack various blockchains using a mining marketplace (in this instance, one called NiceHash). Attacking bytecoin, for example, might cost as little as $719 to attack using rented computing power.

“If your savings are in a coin, or anything else, that costs less than $1 million a day to attack, you should reconsider what you are doing,” tweeted Cornell professor Emin Gün Sirer.

On the other hand, larger cryptocurrencies such as bitcoin and ethereum are harder to 51% attack because they’re much larger, requiring more hashing power than NiceHash has available.

“Bitcoin is too big and there isn’t enough spare bitcoin mining capacity sitting around to pull off the attack,” Bonneau told CoinDesk.

Source: Blockchain’s Once-Feared 51% Attack Is Now Becoming Regular – Telegraph

McAfee’s Cryptocurrency Leaks Personal Information for Thousands of Investors

Posted on by

On Mar 30, researchers at Kromtech Security identified a database open to the public containing full names, addresses, email addresses, encrypted passwords, wallet information, along with links to scanned passports, driver’s licenses, and other IDs for over 25,000 investors of the newly created Bezop. The information was found within a MongoDB database without any security.

John Mcafee, an adviser on the board for Bezop, described Bezop as “a distributed version of Amazon.com” in a recent Twitter post.  It is that, but it’s also a cryptocurrency.  Bezop is adding, and has in fact already added, it’s own cryptocurrency, which they call “Bezop tokens”, into the stream of transactions.

[…]

It does not seem to be a very good start for a company such as this to place personal information of anyone on the Internet and open to the public, especially it’s early investors.  In fact, it’s a little difficult to grasp how it could happen, even if by mistake.   Given the changes to MongoDB, it would have to have been deliberately configured to be public, a configuration which should not even be risked internally.

Making your investor’s personal information public is obviously not a good practice and a huge mistake to make.  We hope that they ensure that their new product, which uses MongoDB as part of it’s design, and any future bounty programs using the same, will be configured far more securely than this MongoDB instance turned out to be.  Ease of use should never be placed above security, even during the development cycle.

At the time of this report, Bezop has been notified and have made no comment, but they have secured the database.

In our previous research we have learned that it takes about 3 hours for a misconfigured MongoDB server to be compromised.

Source: Cryptocurrency Leaks Personal Information for Thousands of I

But really – who uses MongoDB anymore?!

Tried checking under the sofa? Indian BTC exchange Coinsecure finds itself $3.5m lighter

Posted on by

Indian Bitcoin exchange Coinsecure has mislaid 438.318 BTC belonging to its customers.

In a statement by parent firm Secure Bitcoin Traders Pvt, posted late on Thursday, the biz said its chief security officer had extracted a bunch of Bitcoin to distribute to punters – and discovered the funds were “lost in the process.”

The vanished Bitcoin stash was worth £2,493,590 ($3,547,745) at the time of publication, and apparently departed Coinsecure’s secure coin servers on April 9.

Earlier this week, folks began to smell a rat as the site went down for an unexpected nap that day:

Things proceeded to become more alarming for worried customers as Coinsecure stopped accepting deposits due to “backend updates.”

We’re told chief security officer Dr Amitabh Saxena and chief exec Mohit Kalra should have been the only ones with access to the wallet’s private keys. Here’s a crime report the biz filled out and submitted to Indian authorities:

Coinsecure FIR

With Bitcoin values tumbling after historic highs, it seems the quickest way to lose your cryptocurrency is to, er, deposit it somewhere.

Source: Tried checking under the sofa? Indian BTC exchange Coinsecure finds itself $3.5m lighter • The Register

Do you have a browser based bitcoin wallet? Check you’re not hacked if it’s JavaScript based

Posted on by 
A significant number of past and current cryptocurrency products
contain a JavaScript class named SecureRandom(), containing both
entropy collection and a PRNG. The entropy collection and the RNG
itself are both deficient to the degree that key material can be
recovered by a third party with medium complexity. There are a
substantial number of variations of this SecureRandom() class in
various pieces of software, some with bugs fixed, some with additional
bugs added. Products that aren't today vulnerable due to moving to
other libraries may be using old keys that have been previously
compromised by usage of SecureRandom().

Source: [bitcoin-dev] KETAMINE: Multiple vulnerabilities in SecureRandom(), numerous cryptocurrency products affected.

‘Being cash-free puts us at risk of attack’: Swedes turn against cashlessness

Posted on by

Most consumers already say they manage without cash altogether, while shops and cafes increasingly refuse to accept notes and coins because of the costs and risk involved. Until recently, however, it has been hard for critics to find a hearing.

“The Swedish government is a rather nice one, we have been lucky enough to have mostly nice ones for the past 100 years,” says Christian Engström, a former MEP for the Pirate Party and an early opponent of the cashless economy.

“In other countries there is much more awareness that you cannot trust the government all the time. In Sweden it is hard to get people mobilised.”

There are signs this might be changing. In February, the head of Sweden’s central bank warned that Sweden could soon face a situation where all payments were controlled by private sector banks.

The Riksbank governor, Stefan Ingves, called for new legislation to secure public control over the payments system, arguing that being able to make and receive payments is a “collective good” like defence, the courts, or public statistics.

“Most citizens would feel uncomfortable to surrender these social functions to private companies,” he said.

“It should be obvious that Sweden’s preparedness would be weakened if, in a serious crisis or war, we had not decided in advance how households and companies would pay for fuel, supplies and other necessities.”

[…]

Until now, Kontantupproret has been dismissed as the voice of the elderly and the technologically backward, Eriksson says.

“When you have a fully digital system you have no weapon to defend yourself if someone turns it off,” he says.

“If Putin invades Gotland [Sweden’s largest island] it will be enough for him to turn off the payments system. No other country would even think about taking these sorts of risks, they would demand some sort of analogue system.”

[…]

Skarec points to problems with card payments experienced by two Swedish banks just during the past year, and by Bank ID, the digital authorisation system that allows people to identify themselves for payment purposes using their phones.

Fraudsters have already learned to exploit the system’s idiosyncrasies to trick people out of large sums of money, even their pensions.

The best case scenario is that we are not as secure as we think, Skarec says – the worst is that IT infrastructure is systemically vulnerable.

“We are lucky that the people who know how to hack into them are on the good side, for now,” he says. “But we don’t know how things will progress. It’s not that easy to attack devices today, but maybe it will become easier to do so in the future.”

The banks recognise that digital payments can be vulnerable, just like cash.

“Of course there are people trying to abuse them, but they are no more vulnerable than any other method of payment,” says Per Ekwall, a spokesperson for Swish, the immensely popular mobile payments system owned by Sweden’s banks.

[…]

But an opinion poll this month revealed unease among Swedes, with almost seven out of 10 saying they wanted to keep the option to use cash, while just 25% wanted a completely cashless society. MPs from left and right expressed concerns at a recent parliamentary hearing. Parliament is conducting a cross-party review of central bank legislation that will also investigate the issues surrounding cash.

[…]

“If you have control of the servers belonging to Visa or MasterCard, you have control of Sweden,” Engström says.

“In the meantime, we will have to keep giving our money to the banks, and hope they don’t go bankrupt – or bananas.”

Source: ‘Being cash-free puts us at risk of attack’: Swedes turn against cashlessness | World news | The Guardian

Hacker Uses Exploit to Generate Verge Cryptocurrency out of Thin Abir

Posted on by

An unknown attacker has exploited a bug in the Verge cryptocurrency network code to mine Verge coins at a very rapid pace and generate funds almost out of thin air.

The Verge development team is preparing a hard-fork of the entire cryptocurrency code to fix the issue and revert the blockchain to a previous state before the attack to neutralize the hacker’s gains.

Verge devs: Not a >51% attack

The incident took place yesterday, and initially, users thought it was a “>51% attack,” an attack where a malicious actor takes control over the more than half of the network nodes, giving himself the power to forge transactions.

Rumors swirled around all day yesterday, as users feared the attacker might use his dominant network position to siphon funds from their accounts.

The Verge team eventually came out and clarified the details surrounding the incident, denouncing rumors of a 51% attack, but not revealing additional info about the real cause of the incident.

[…]

Nonetheless, users who looked into the suspicious network activity eventually tracked down what happened, revealing that a mysterious attacker had mined Verge coins at a near impossible speed of 1,560 Verge coins (XVG) per second, the equivalent of $78/s.

[…]

According to unofficial estimations, some users who tracked the illegally mined funds on the Verge blockchain said the hacker appears to have made around 15.6 million Verge coins, which is around $780,000.

News of the hash attack and the fear of a sudden influx of new Verge coins led to a drop of between 7% and 8% in Verge’s exchange rate. According to CoinMarketCap, Verge is today’s 21st largest cryptocurrency based on market cap. This is the second security incident involving the Verge dev team, with a mysterious hack happening last fall.

Source: Hacker Uses Exploit to Generate Verge Cryptocurrency out of Thin Air

So – how useless is a virtual currency that backrolls a full day of transactions?

The Lottery Hackers

Posted on by

That’s when it hit him. Right there, in the numbers on the page, he noticed a flaw—a strange and surprising pattern, like the cereal-box code, written into the fundamental machinery of the game. A loophole that would eventually make Jerry and Marge millionaires, spark an investigation by a Boston Globe Spotlight reporter, unleash a statewide political scandal and expose more than a few hypocrisies at the heart of America’s favorite form of legalized gambling.
[…]
This particular game was called Winfall. A ticket cost $1. You picked six numbers, 1 through 49, and the Michigan Lottery drew six numbers. Six correct guesses won you the jackpot, guaranteed to be at least $2 million and often higher. If you guessed five, four, three, or two of the six numbers, you won lesser amounts. What intrigued Jerry was the game’s unusual gimmick, known as a roll-down: If nobody won the jackpot for a while, and the jackpot climbed above $5 million, there was a roll-down, which meant that on the next drawing, as long as there was no six-number winner, the jackpot cash flowed to the lesser tiers of winners, like water spilling over from the highest basin in a fountain to lower basins. There were lottery games in other states that offered roll-downs, but none structured quite like Winfall’s. A roll-down happened every six weeks or so, and it was a big deal, announced by the Michigan Lottery ahead of time as a marketing hook, a way to bring bettors into the game, and sure enough, players increased their bets on roll-down weeks, hoping to snag a piece of the jackpot.

The brochure listed the odds of various correct guesses. Jerry saw that you had a 1-in-54 chance to pick three out of the six numbers in a drawing, winning $5, and a 1-in-1,500 chance to pick four numbers, winning $100. What he now realized, doing some mental arithmetic, was that a player who waited until the roll-down stood to win more than he lost, on average, as long as no player that week picked all six numbers. With the jackpot spilling over, each winning three-number combination would put $50 in the player’s pocket instead of $5, and the four-number winners would pay out $1,000 in prize money instead of $100, and all of a sudden, the odds were in your favor. If no one won the jackpot, Jerry realized, a $1 lottery ticket was worth more than $1 on a roll-down week—statistically speaking.

“I just multiplied it out,” Jerry recalled, “and then I said, ‘Hell, you got a positive return here.’”
[…]
This was an uncomfortable leap for a guy with no experience in gambling, but if he stopped now, he would never know if his theory was correct. During the next roll-down week, he returned to Mesick and made a larger bet, purchasing $3,400 in Winfall tickets. Sorting 3,400 tickets by hand took hours and strained his eyes, but Jerry counted them all right there at the convenience store so that Marge would not discover him. This time he won $6,300—an impressive 46 percent profit margin. Emboldened, he bet even more on the next roll-down, $8,000, and won $15,700, a 49 percent margin.
[…]
he lottery is like a bank vault with walls made of math instead of steel; cracking it is a heist for squares. And yet a surprising number of Americans have pulled it off. A 2017 investigation by the Columbia Journalism Review found widespread anomalies in lottery results, difficult to explain by luck alone. According to CJR’s analysis, nearly 1,700 Americans have claimed winning tickets of $600 or more at least 50 times in the last seven years, including the country’s most frequent winner, a 79-year-old man from Massachusetts named Clarance W. Jones, who has redeemed more than 10,000 tickets for prizes exceeding $18 million.
[…]
he and Marge were willing to do the grunt work, which, as it turned out, was no small challenge. Lottery terminals in convenience stores could print only 10 slips of paper at a time, with up to 10 lines of numbers on each slip (at $1 per line), which meant that if you wanted to bet $100,000 on Winfall, you had to stand at a machine for hours upon hours, waiting for the machine to print 10,000 tickets. Code in the purchase. Push the “Print” button. Wait at least a full minute for the 10 slips to emerge. Code in the next purchase. Hit “Print.” Wait again. Jerry and Marge knew all the convenience store owners in town, so no one gave them a hard time when they showed up in the morning to print tickets literally all day. If customers wondered why the unassuming couple had suddenly developed an obsession with gambling, they didn’t ask. Sometimes the tickets jammed, or the cartridges ran out of ink. “You just have to set there,” Jerry said.

The Selbees stacked their tickets in piles of $5,000, rubber-banded them into bundles and then, after a drawing, convened in their living room in front of the TV, sorting through tens or even hundreds of thousands of tickets, separating them into piles according to their value (zero correct numbers, two, three, four, five). Once they counted all the tickets, they counted them again, just to make sure they hadn’t missed anything. If Jerry had the remote, they’d watch golf or the History Channel, and if Marge had it, “House Hunters” on HGTV. “It looked extremely tedious and boring, but they didn’t view it that way,” recalled their daughter Dawn. “They trained their minds. Literally, they’d pick one up, look at it, put it down. Pick one up, put it down.” Dawn tried to help but couldn’t keep pace; for each ticket she completed, Jerry or Marge did 10.
[…]
That June, Jerry created a corporation to manage the group. He gave it an intentionally boring name, GS Investment Strategies LLC, and started selling shares, at $500 apiece, first to the kids and then to friends and colleagues in Evart. Jerry would eventually expand the roster to 25 members, including a state trooper, a parole officer, a bank vice president, three lawyers and even his personal accountant, a longtime local with a smoker’s scratchy voice named Steve Wood. Jerry would visit Wood’s storefront office downtown, twist the “Open” sign to “Closed,” and seek his advice on how to manage the group.
[…]
And business was good. By the spring of 2005, GS Investment Strategies LLC had played Winfall on 12 different roll-down weeks, the size of the bets increasing along with the winnings. First $40,000 in profits. Then $80,000. Then $160,000. Marge squirreled her share away in a savings account. Jerry bought a new truck, a Ford F350, and a camping trailer that hooked onto the back of it. He also started buying coins from the U.S. Mint as a hedge against inflation, hoping to protect his family from any future catastrophe. He eventually filled five safe deposit boxes with coins of silver and gold.
[…]
A mathematics major in his final semester, Harvey had been researching lottery games for an independent study project, comparing the popular multistate games Powerball and MegaMillions to see which offered players a better shot at winning. He’d also analyzed different state games, including Cash WinFall, and it hadn’t taken him long to spot its flaw: On a roll-down week, a $2 lottery ticket was worth more than $2, mathematically.

Within days, Harvey had recruited some 50 people to pony up $20 each, for a total of $1,000, enough to buy 500 Cash WinFall tickets for the February 7 roll-down drawing. The Patriots won the Super Bowl on February 6, and the following day, the MIT group took home $3,000, for a $2,000 profit.

Curiously enough, the MIT students weren’t the only ones playing Cash WinFall for high stakes that day. A biomedical researcher at Boston University, Ying Zhang, had also discovered the flaw, after an argument with friends about the nature of the lottery. Believing it to be exploitative, Zhang had researched the Massachusetts State Lottery to bolster his point. Then he found the glitch in Cash WinFall, and as happens so often in America, a skeptic of capitalism became a capitalist. Zhang encouraged friends to play and formed his own betting club, Doctor Zhang Lottery Club Limited Partnership. His group began wagering between $300,000 and $500,000 on individual roll-down weeks, and eventually Zhang quit his job as a biomedical researcher to focus on the lottery full time. He bought tickets in bulk at a convenience store near his home, in the Boston suburb of Quincy, and stored the losing tickets in boxes in his attic until the weight made his ceiling crack.

As energetically as Zhang played the game, however, he couldn’t match the budding lottery moguls at MIT. After the first roll-down, Harvey assembled 40 to 50 regular players—some of them professors with substantial resources—and recruited his classmate, Yuran Lu, to help manage the group. Lu was an electrical engineering, computer science and math major with a mischievous streak: one time, to make a point about security, he’d stolen 620 passwords from students and professors. Now he helped Harvey form a corporation, named Random Strategies LLC, after their dorm. Their standard wager on a roll-down week was $600,000—300,000 tickets. Unlike the Selbees, who allowed the computer to pick numbers for them (“Quic Pics”), the MIT students preferred to choose their own, which avoided duplicates but also meant that the students had to spend weeks filling in hundreds of thousands of tiny ovals on paper betting slips.

Source: The Lottery Hackers – The Huffington Post

A great article on how three groups of people were hacking this lottery and how it all ended.

Tesla’s Amazon Cloud Account Hacked to Mine Cryptocurrency

Posted on by

An unidentified hacker or hackers broke into a Tesla-owned Amazon cloud account and used it to “mine” cryptocurrency, security researchers said. The breach also exposed proprietary data for the electric carmaker.

The researchers, who worked for RedLock, a 3-year-old cybersecurity startup, said they discovered the intrusion last month while trying to determine which organization left credentials for an Amazon Web Services (AWS) account open to the public Internet. The owner of the account turned out to be Tesla, they said.

“We weren’t the first to get to it,” Varun Badhwar, CEO and cofounder of RedLock, told Fortune on a call. “Clearly, someone else had launched instances that were already mining cryptocurrency in this particular Tesla environment.”

The incident is the latest in a string of so-called cryptojacking attacks, which involve thieves hijacking unsuspecting victims’ computers to generate virtual currencies like Bitcoin. The schemes have seen a resurgence in popularity as cryptocurrency prices have soared over the past year.

Earlier this month, websites for the U.S. federal court system and the U.K.’s National Health Service roped their visitors into similar virtual money-minting operations.

Source: Tesla’s Amazon Cloud Account Hacked to Mine Cryptocurrency | Fortune

Crooks opt for Monero, paypal, ebay and gamesfor laundering

Posted on by

“Platforms like Monero are designed to be truly anonymous, and tumbler services like CoinJoin can [further] obscure transaction origins,” said Dr Mike McGuire, senior lecturer in criminology at Surrey University and author of the study.

Many cybercriminals are using virtual currency to convert the illegal proceeds of crime into hard cash and assets. Digital payment systems are used to help hide the money trail.
[…]
Methods like “micro laundering”, where thousands of small electronic payments are made through platforms like PayPal, are increasingly common and more difficult to detect. Another common technique is to use online transactions – via sites like eBay – to facilitate laundering.

Crooks are circumventing PayPal and eBay’s anti-fraud controls, even though both are “getting better at picking up laundering techniques”, according to Dr McGuire.
[…]
“Keeping transactions low, say $10-12, makes laundering almost impossible to spot, as they look like ordinary transactions. It would be impossible to investigate every transaction of this size. By making repeated small payments, or limited transactions, your profile begins to gain the ‘trust’ of controls systems, which makes it even harder to detect laundering as payments are less likely to be flagged.”

Botnets can be used to make thousands of these transactions and increase your trust rating.

“I have also seen evidence of multi-stage laundering, where criminals will make payments through websites like Airbnb which look completely legitimate. Cybercriminals are also gaining access or control of legitimate PayPal accounts by phishing emails. I also saw it was easy to buy stolen credentials from online forums to gain access to hundreds of PayPal accounts which can then be used to launder payments.”

McGuire said cybercriminals are working with the fraud controls to then manipulate them by applying to go beyond current annual payment limits and then providing false or hacked documentation to support the checks which permit larger payments.
[…]
Cybercriminals elsewhere are active in converting stolen income into video game currency or in-game items like gold, which are then converted into Bitcoin or other electronic formats. Games such as Minecraft, FIFA, World of Warcraft, Final Fantasy and GTA 5 are among the most popular options because they allow covert interactions with other players to facilitate the trade of currency and goods.

“Gaming currencies and items that can be easily converted and moved across borders offer an attractive prospect to cybercriminals,” Dr McGuire told The Register. “This trend appears to be particularly prevalent in countries like South Korea and China – with South Korean police arresting a gang transferring $38m laundered in Korean games back to China.

“The advice on how to do this is readily available online and explains how cybercriminals can launder proceeds through both in-game currencies and goods.”

The findings come from a nine-month study into the macro economics of cybercrime, sponsored by infosec vendor Bromium

Source: Crooks opt for Monero as crypto of choice to launder ill-gotten gains • The Register

Can AMD Vulnerabilities Be Used to Game the Stock Market?

Posted on by

On Tuesday, a little known security company claimed to have found vulnerabilities and backdoors in some AMD processors. Within some parts of the security community, the story behind the researchers’ discovery quickly became more interesting than the discovery itself.

The researchers, who work for CTS Labs, only reported the flaws to AMD shortly before publishing their report online. Typically, researchers give companies a few weeks or even months to fix the issues before going public with their findings. To make things even stranger, a little bit over 30 minutes after CTS Labs published its report, a controversial financial firm called Viceroy Research published what they called an “obituary” for AMD.

“We believe AMD is worth $0.00 and will have no choice but to file for Chapter 11 (Bankruptcy) in order to effectively deal with the repercussions of recent discoveries,” Viceroy wrote in its report.

CTS Labs seemed to hint that it too had a financial interest in the performance of AMD stock.

“We may have, either directly or indirectly, an economic interest in the performance of the securities of the companies whose products are the subject of our reports,” CTS Labs wrote in the legal disclaimer section of its report.

On Twitter, rumors started to swirl. Are the researchers trying to make money by betting that AMD’s share price will go down due to the news of the vulnerabilities? Or, in Wall Street jargon, were CTS Labs and Viceroy trying to short sell AMD stock?

Security researcher Arrigo Triulzi speculated that Viceroy and CTS Lab were profit sharing for shorting, while Facebook’s chief security officer Alex Stamos warned against a future where security research is driven by short selling.

Yaron Luk, co-founder of CTS Labs, told Motherboard that “Viceroy is not a client of CTS, and CTS did not send its research to Viceroy.” When asked about the company’s financial motivations, Luk said that “we are a for-profit company that gets paid for its research by a variety of research clients.”

“We do not discuss our research clients,” he wrote in an email sent after publication of this article. “In addition, we are driven by the desire to make products more secure, and to protect users, as we hold companies responsible for their security practices.”

Viceroy’s founder, Fraser Perring, was adamant about its company’s intentions.

“We haven’t hidden the fact that we short the stock,” Perring said in a phone call with Motherboard. “Where does a company with these serious issues go? For us you can’t invest in it.”

Source: Can AMD Vulnerabilities Be Used to Game the Stock Market? – Motherboard

Phishing and Attempted Stealing Incident on Binance VIA / BTC coins not only stopped, but costs hackers money

Posted on by

On Mar 7, UTC 14:58-14:59, within this 2 minute period, the VIA/BTC market experienced abnormal trading activity. Our automatic risk management system was triggered, and all withdrawals were halted immediately.

This was part of a large scale phishing and stealing attempt.

So far: All funds are safe and no funds have been stolen.

The hackers accumulated user account credentials over a long period of time. The earliest phishing attack seems to have dated back to early Jan. However it was around Feb 22, where a heavy concentration of phishing attacks were seen using unicode domains, looking very much like binance.com, with the only difference being 2 dots at the bottom of 2 characters. Many users fell for these traps and phishing attempts. After acquiring these user accounts, the hacker then simply created a trading API key for each account but took no further actions, until yesterday.

Yesterday, within the aforementioned 2 minute period, the hackers used the API keys, placed a large number of market buys on the VIA/BTC market, pushing the price high, while 31 pre-deposited accounts were there selling VIA at the top. This was an attempt to move the BTC from the phished accounts to the 31 accounts. Withdrawal requests were then attempted from these accounts immediately afterwards.

However, as withdrawals were already automatically disabled by our risk management system, none of the withdrawals successfully went out. Additionally, the VIA coins deposited by the hackers were also frozen. Not only did the hacker not steal any coins out, their own coins have also been withheld.

Source: Summary of the Phishing and Attempted Stealing Incident on Binance – Binance

If you’re so smart, why aren’t you rich? Turns out it’s just chance.

Posted on by

The most successful people are not the most talented, just the luckiest, a new computer model of wealth creation confirms. Taking that into account can maximize return on many kinds of investment.
[…]
The distribution of wealth follows a well-known pattern sometimes called an 80:20 rule: 80 percent of the wealth is owned by 20 percent of the people. Indeed, a report last year concluded that just eight men had a total wealth equivalent to that of the world’s poorest 3.8 billion people.
[…]
while wealth distribution follows a power law, the distribution of human skills generally follows a normal distribution that is symmetric about an average value. For example, intelligence, as measured by IQ tests, follows this pattern. Average IQ is 100, but nobody has an IQ of 1,000 or 10,000.

The same is true of effort, as measured by hours worked. Some people work more hours than average and some work less, but nobody works a billion times more hours than anybody else.

And yet when it comes to the rewards for this work, some people do have billions of times more wealth than other people. What’s more, numerous studies have shown that the wealthiest people are generally not the most talented by other measures.
[…]
Alessandro Pluchino at the University of Catania in Italy and a couple of colleagues. These guys have created a computer model of human talent and the way people use it to exploit opportunities in life. The model allows the team to study the role of chance in this process.

The results are something of an eye-opener. Their simulations accurately reproduce the wealth distribution in the real world. But the wealthiest individuals are not the most talented (although they must have a certain level of talent). They are the luckiest.
[…]
Pluchino and co’s model is straightforward. It consists of N people, each with a certain level of talent (skill, intelligence, ability, and so on). This talent is distributed normally around some average level, with some standard deviation. So some people are more talented than average and some are less so, but nobody is orders of magnitude more talented than anybody else.
[…]
The computer model charts each individual through a working life of 40 years. During this time, the individuals experience lucky events that they can exploit to increase their wealth if they are talented enough.

However, they also experience unlucky events that reduce their wealth. These events occur at random.

At the end of the 40 years, Pluchino and co rank the individuals by wealth and study the characteristics of the most successful. They also calculate the wealth distribution. They then repeat the simulation many times to check the robustness of the outcome.

When the team rank individuals by wealth, the distribution is exactly like that seen in real-world societies. “The ‘80-20’ rule is respected, since 80 percent of the population owns only 20 percent of the total capital, while the remaining 20 percent owns 80 percent of the same capital,” report Pluchino and co.

That may not be surprising or unfair if the wealthiest 20 percent turn out to be the most talented. But that isn’t what happens. The wealthiest individuals are typically not the most talented or anywhere near it. “The maximum success never coincides with the maximum talent, and vice-versa,” say the researchers.

So if not talent, what other factor causes this skewed wealth distribution? “Our simulation clearly shows that such a factor is just pure luck,” say Pluchino and co.

The team shows this by ranking individuals according to the number of lucky and unlucky events they experience throughout their 40-year careers. “It is evident that the most successful individuals are also the luckiest ones,” they say. “And the less successful individuals are also the unluckiest ones.”
[…]
They use their model to explore different kinds of funding models to see which produce the best returns when luck is taken into account.

The team studied three models, in which research funding is distributed equally to all scientists; distributed randomly to a subset of scientists; or given preferentially to those who have been most successful in the past. Which of these is the best strategy?

The strategy that delivers the best returns, it turns out, is to divide the funding equally among all researchers. And the second- and third-best strategies involve distributing it at random to 10 or 20 percent of scientists.

In these cases, the researchers are best able to take advantage of the serendipitous discoveries they make from time to time. In hindsight, it is obvious that the fact a scientist has made an important chance discovery in the past does not mean he or she is more likely to make one in the future.

A similar approach could also be applied to investment in other kinds of enterprises, such as small or large businesses, tech startups, education that increases talent, or even the creation of random lucky events.

Source: If you’re so smart, why aren’t you rich? Turns out it’s just chance.

Glitch on Bitcoin Exchange Drops Prices to Zero Dollars, User Tries to Make Off With Trillions

Posted on by

Zaif, A cryptocurrency exchange in Japan reportedly experienced a temporary glitch last week that suddenly offered investors their pick of coins for the low, low price of zero dollars. Several customers took advantage of the opportunity, but one really ran with it.

According to Reuters, it was possible to buy cryptocurrencies for free on the Zaif exchange for about 20 minutes on February 16th. The exchange reportedly revealed the problem to reporters on Tuesday.
[…]
there’s still one customer that’s putting up a fight over their heavily-discounted purchase. How much did they try to pull out? According to Japanese outlet Asahi Shimbun, one customer apparently “purchased” 2,200 trillion yen worth of bitcoin and proceeded to try to cash it out. That’s about $20 trillion. Considering the fact that Bitcoin has a market cap of just over $183 billion, that sell order really must have confused some traders for a bit.

Reuters points out that the glitch couldn’t have come at a worse time for the Japanese cryptocurrency exchange business. Following the recent $400 million heist at the Japanese exchange Coincheck, two separate industry groups have agreed to form a self-regulating body that would strive to protect investors with stronger safeguards. It would also, presumably, demonstrate to authorities that they don’t need to get involved. The Japanese yen is by far the most exchanged national currency in the Bitcoin world, so attracting regulations would have a global impact.

Source: Glitch on Bitcoin Exchange Drops Prices to Zero Dollars, User Tries to Make Off With Trillions

Tesla accused of knowingly selling defective vehicles in new lawsuit

Posted on by

A former Tesla employee claims the company knowingly sold defective cars, often referred to as “lemons,” and that he was demoted and eventually fired after reporting the practice to his superiors. He made these allegations in a lawsuit filed in late January in New Jersey Superior Court under the Conscientious Employee Protection Act (CEPA).The former employee, Adam Williams, worked for Tesla as a regional manager in New Jersey dating back to late 2011. While there, he says he watched the company fail “to disclose to consumers high-dollar, pre-delivery damage repairs” before delivering its vehicles, according to the complaint. Instead, he says the company sold these cars as “used,” or labeled as “demo/loaner” vehicles.
[…]
This is not the first time Tesla has dealt with a lawsuit that involved accusations of lemon law issues. The company settled a lawsuit with a Model X owner in 2016 who complained about problems with the doors and software of his vehicle.

Source: Tesla accused of knowingly selling defective vehicles in new lawsuit – The Verge

Ouch. Sounds like something Musk would do though.

Coinbase empies bank accounts without consent

Posted on by

Digital currency exchange Coinbase said it inadvertently charged punters for transactions they never made, effectively draining money from their bank accounts. It has promised to refund the money taken.

For the last few days, netizens have been complaining that funds had vanished from bank accounts linked to Coinbase without reason. Some people report multiple charges being made that drained their accounts and left them with heavy overcharge fees and the inability to pay bills and rent.

“We can confirm that the unexpected charges are originating from our payment processing network, and are related to charges from previous purchases,” a company rep called Olga said on Reddit.

“To the best of our knowledge, these unexpected charges are not permanent and are in the process of being refunded. We apologize for the poor experience.”

Rather bizarrely the post also asks those people affected by the errors to post up details of the transactions, including their location, the bank used, the number of bogus charges and the case number from the bank. From a security situation that’s very poor practice indeed.

Source: Oh sh-itcoin! Crypto-dosh swap-shop Coinbase empties punters’ bank accounts • The Register

Koinz Trading Bitcoin mining pyramid game enters receivership

Posted on by

At least 60 people fall for Koinz Trading, that claimed to buy and run a BTC miner for you for the price of EUR 6100 + EUR 23 per month. Payments stopped in September. Rumor has it that the founder Barry van Mourik was selling the computers to pay for his debts.

Zeker zestig gedupeerden van Koinz Trading, het Nederlandse bedrijf dat klanten zogenoemde Miners S9-machines had beloofd, zijn hun geld zo goed als zeker kwijt. Het bedrijf is woensdag door de rechtbank in Amsterdam failliet verklaard. Bij de politie zijn tientallen aangiften binnengekomen.

Source: Bitcoinfabriek Koinz Trading failliet – Emerce

LoopX Startup Pulls ICO Exit Scam and Disappears with $4.5 Million

Posted on by

A cryptocurrency startup named LoopX has pulled an exit scam after collecting around $4.5 million from users during an ICO (Initial Coin Offering) held for the past weeks.

The LoopX team disappeared out of the blue at the start of the week when it took down its website and deleted its Facebook, Telegram, and YouTube channels without any explanation.

The company’s former Twitter profile now lists only one tweet, a link to a TheNextWeb article detailing the exit scam, but it is unclear if the LoopX team posted this link themselves, or if somebody else claimed the account name after it was vacated.
Victims tracking funds as they dissipate

People who invested in the startup are now tracking funds move from account to account in a BitcoinTalk forum thread, and banding together in the hopes of filing a class action lawsuit.

Before the site went down, LoopX claimed to have gathered $4.5 million of the $12 million they wanted to raise for creating a new cryptocurrency trading mobile app based on a proprietary trading algorithm.

In an email sent to customers last week, LoopX owners made an ironic statement of “We will have some more surprises for you throughout the week. Stay tuned!”

This was probably not the surprise many users were expecting, but some users did see red flags with the entire LoopX operation and tried to warn would-be investors last month, via LoopX’s official Reddit channel.

Source: LoopX Startup Pulls ICO Exit Scam and Disappears with $4.5 Million

At least 4200 popular and large websites hijacked by hidden crypto-mining code after popular plugin pwned

Posted on by

Thousands of websites around the world – from the UK’s NHS and ICO to the US government’s court system – were today secretly mining crypto-coins on netizens’ web browsers for miscreants unknown.

The affected sites all use a fairly popular plugin called Browsealoud, made by Brit biz Texthelp, which reads out webpages for blind or partially sighted people.

This technology was compromised in some way – either by hackers or rogue insiders altering Browsealoud’s source code – to silently inject Coinhive’s Monero miner into every webpage offering Browsealoud.

For several hours today, anyone who visited a site that embedded Browsealoud inadvertently ran this hidden mining code on their computer, generating money for the miscreants behind the caper.

Source: UK ICO, USCourts.gov… Thousands of websites hijacked by hidden crypto-mining code after popular plugin pwned • The Register

The gender pay gap at Uber is small and has a reason

Posted on by

Specifically, the study stated, drivers who make runs for Uber more frequently are more likely to know where and when to operate in order to get the highest-paying fares.

Thus, because women, on average, spend less time driving for Uber than their male counterparts, they are less likely to be around to grab the highest-paying fares.

“Men’s willingness to supply more hours per week (enabling them to earn more) and to target the most profitable locations shows that women continue to pay a cost for working reduced hours each week, even with no convexity in the hours-earning schedule,” the research team stated.

The study, which was based on data collected from 1,877,252 drivers operating in America from January 2015 to March 2017, examined factors including average hours worked per week, money earned over the whole week, and money earned per hour.
[…]
Overall, the gang concluded that those who drove an Uber car more often were able to make more per trip, and because on average the men surveyed drove 50 per cent more often, they were able to get on average $21.28 (£15.23) per hour compared to $20.04 (£14.35) logged by their female counterparts.

With more time driving, we’re told, comes a better idea of when and where the best fares are to be expected.
[…]
“A driver with more than 2,500 lifetime trips completed earns 14 per cent more per hour than a driver who has completed fewer than 100 trips in her time on the platform, in part because she learns where to drive, when to drive, and how to strategically cancel and accept trips.”

At least one other factor was cited in the gap: speed.

The study found that while driving for Uber, men tended to drive around 2.2 per cent faster than women. This meant that, over the long haul, they were able to rack up a few extra trips and make a bit more money.

“Increasing speed increases expected driver earnings in almost all Uber settings,” the research team concluded.

Source: Uber: Ah yeah, we pay women drivers less than men. We can explain!

Japanese cryptocurrency exchange loses more than $500 million to hackers

Posted on by

Coincheck said that around 523 million of the exchange’s NEM coins were sent to another account around 3 a.m. local time (1 p.m. ET Thursday), according to a Google translation of a Japanese transcript of the Friday press conference from Logmi. The exchange has about 6 percent of yen-bitcoin trading, ranking fourth by market share on CryptoCompare.

The stolen NEM coins were worth about 58 billion yen at the time of detection, or roughly $534.8 million, according to the exchange. Coincheck subsequently restricted withdrawals of all currencies, including yen, and trading of cryptocurrencies other than bitcoin.

Bloomberg first reported the hack. A CNBC email sent to Coincheck’s listed address bounced back.

Cryptocurrency NEM, which intends to help businesses handle data digitally, briefly fell more than 20 percent Friday before recovering to trade about 10 percent lower near 85 cents, according to CoinMarketCap. Most other major digital currencies, including bitcoin, traded little changed on the day.

Source: Japanese cryptocurrency exchange loses more than $500 million to hackers

Hackers Hijacking CPUs to Mine Cryptocurrency Have Now Invaded YouTube Ads

Posted on by

As Ars Technica first reported on Friday, users on social media started complaining earlier this week that YouTube ads were triggering their anti-virus software. Specifically, the software was recognizing a script from a service called CoinHive. The script was originally released as a sort of altruistic idea that would allow sites to make a little extra income by putting a visitor’s CPU processing power to use by mining a cryptocurrency called Monero. This could be used ethically as long as a site notifies its visitors of what’s happening and doesn’t get so greedy with the CPU usage that it crashes a visitor’s computer. In the case of YouTube’s ads running the script, they were reportedly using up to 80 percent of the CPU and neither YouTube nor the user were told what was happening.

Source: Hackers Hijacking CPUs to Mine Cryptocurrency Have Now Invaded YouTube Ads

Security Breaches Don’t Affect Stock Price. Or don’t they?

Posted on by

Abstract: This report assesses the impact disclosure of data breaches has on the total returns and volatility of the affected companies’ stock, with a focus on the results relative to the performance of the firms’ peer industries, as represented through selected indices rather than the market as a whole. Financial performance is considered over a range of dates from 3 days post-breach through 6 months post-breach, in order to provide a longer-term perspective on the impact of the breach announcement.

Key findings:

While the difference in stock price between the sampled breached companies and their peers was negative (1.13%) in the first 3 days following announcement of a breach, by the 14th day the return difference had rebounded to + 0.05%, and on average remained positive through the period assessed.

For the differences in the breached companies’ betas and the beta of their peer sets, the differences in the means of 8 months pre-breach versus post-breach was not meaningful at 90, 180, and 360 day post-breach periods.

For the differences in the breached companies’ beta correlations against the peer indices pre- and post-breach, the difference in the means of the rolling 60 day correlation 8 months pre- breach versus post-breach was not meaningful at 90, 180, and 360 day post-breach periods.

In regression analysis, use of the number of accessed records, date, data sensitivity, and malicious versus accidental leak as variables failed to yield an R2 greater than 16.15% for response variables of 3, 14, 60, and 90 day return differential, excess beta differential, and rolling beta correlation differential, indicating that the financial impact on breached companies was highly idiosyncratic.

Based on returns, the most impacted industries at the 3 day post-breach date were U.S. Financial Services, Transportation, and Global Telecom. At the 90 day post-breach date, the three most impacted industries were U.S. Financial Services, U.S. Healthcare, and Global Telecom.

The market isn’t going to fix this. If we want better security, we need to regulate the market.

Source: Security Breaches Don’t Affect Stock Price – Schneier on Security

However, the dataset:

The analysis began with a dataset of 235 recorded data breaches dating back to 2005

is very very small and misses some of the huge breaches such as Equifax.
There is a very telling table in the results that does show that if a breach is hugely public, then share prices do indeed plummet:

So it may also have something to do with how the company handles the breach and how much media attention is out there.

Crypto-cash exchange BitConnect pulls plug amid Bitcoin bloodbath

Posted on by

Amid a cryptocurrency price correction that has seen the price of Bitcoin drop by half from its mid-December peak, UK-based cyber-cash lending and exchange biz BitConnect said it is shutting down.

The firm, dogged by accusations that it is a Ponzi scheme, cited bad press, regulatory orders, and cyber attacks for its market exit this week.

BitConnect said it has received two cease-and-desist letters from US financial watchdogs: one from the Texas State Securities Board, and one from the Securities Division of North Carolina’s Secretary of State.

The letter from Texas authorities, an emergency cease-and-desist order sent January 3, 2018, charges the company with fraud and misleading investors.

The letter from North Carolina authorities observes that BitConnect’s purported rate of return amounts to about 3,000 per cent annually.

Noting that such rates “are extremely unusual in financial markets,” the North Carolina letter stated: “Guaranteed annual compounded investment returns of over 3,000 per cent are a known ‘red-flag’ for fraud, specifically for the risk that the investment may be a ‘Ponzi scheme.'”

Source: Crypto-cash exchange BitConnect pulls plug amid Bitcoin bloodbath • The Register

Wall Street Analysts Are Embarrassingly Bad At Predicting The Future, Study Finds

Posted on by

The researchers looked at a database of long-term growth forecasts made for all domestic companies listed on a major stock exchange. The forecasts are made in December each year, and predict how well a company’s stocks will do over the next three to five years. From 1981 to 2016, they found that the top 10 percent of stocks analysts were most hopeful about generally had poorer growth than the 10 percent of stocks they were most pessimistic about.

The paper found that investing in the stocks that analysts were most pessimistic in a given year about would have yielded an average 15 percent in extra returns (in stock terms, a profit) the following year, compared to a 3 percent return that would have been made from investing in the predicted champs.

The study, though it hasn’t yet been published in a peer-reviewed journal, is in fact merely an update of a classic study published in 1996; it too found a similarly stark contrast. Nor is this the only kind of study to find a clear gap between the professed stock expectations of analysts and actual reality. So the results aren’t exactly surprising.

Source: Wall Street Analysts Are Embarrassingly Bad At Predicting The Future, Study Finds