Ethercombing: Finding Secrets in Popular Places
> In this paper we examine how, even when faced with this statistical improbability, ISE discovered 732 private keys as well as their corresponding public keys that committed 49,060 transactions to the Ethereum blockchain. Additionally, we identified 13,319 Ethereum that was transferred to either invalid destination addresses, or wallets derived from weak keys that at the height of the Ethereum market had a combined total value of $18,899,969. In the process, we discovered that funds from these weak-key addresses are being pilfered and sent to a destination address belonging to an individual or group that is running active campaigns to compromise/gather private keys and obtain these funds. On January 13, 2018, this “blockchainbandit” held a balance of 37,926 ETH valued at $54,343,407.
> In an experiment, we picked a private key of 1, for no reason other than that it is the lower bound of a possible private key for secp256k1 and it also lies within the 1 to 232-1 range of a 32-bit truncated key. We use the private key 0x0000000000000000000000000000000000000000000000000000000000000001 to derive the public Ethereum address 0x7e5f4552091a69125d5dfcb7b8c2659029395bdf.
> Proof of work algorithm based on random code execution
Opera introduces Reborn 3, the first desktop browser with Web 3, faster VPN and ad blocker
> Opera now also includes Web 3-support and a Crypto Wallet, an important new feature. It allows you to browse and make transactions the blockchain-based Internet of the future, also known as Web 3. This makes Opera the first ever Web 3-ready computer browser.
Here we go....
A Deep Dive on RSA Accumulators
> Accumulators are a topic of interest in academia since 1994. Similarly to a Merkle Tree, they are used to cryptographically commit to the knowledge of a set of data. At a later point in time, proving membership of a subset of the dataset in the dataset can be proven by publishing a proof. In Merkle Trees the proof is called a Merkle Branch (or Merkle Proof), and grows logarithmically to the size of the committed data (commit 16 elements, prove inclusion by revealing log_2(16)=4).
> Accumulators on the other hand, allow proving membership in constant size, as well as batching of proofs for multiple elements (which is not a feature of Merkle trees).
> The focus of this post will be on describing the building blocks of RSA Accumulators, how we can construct proofs of (non-)membership as well as batch them across multiple blocks. This particular technique also has applications in UTXO-Based Plasma, and has given birth to the Plasma Prime variant. A lot of effort is being put into designing an accumulator that allows compaction of the UTXO-set in Plasma.
Vitalik Buterin on Cryptoeconomics and Markets in Everything
> At the intersection of programming, economics, cryptography, distributed systems, information theory, and math, you will find Vitalik Buterin, who has managed to synthesize insights across those fields into successful, real-world applications like Ethereum, which aims to decentralize the Internet.
> Tyler sat down with Vitalik to discuss the many things he’s thinking about and working on, including the nascent field of cryptoeconomics, the best analogy for understanding the blockchain, his desire for more social science fiction, why belief in progress is our most useful delusion, best places to visit in time and space, how he picks up languages, why centralization’s not all bad, the best ways to value crypto assets, whether P = NP, and much more.
The Verge Hack, Explained
> In both cases, this hack presents a strong argument for tending towards sticking to things proven to work and to be wary of overcomplicating things and thereby introducing unnecessary risks when people’s financial assets are involved.
When more is less.
Do You Take Sweatcoin?
> Hoping to convert his daily constitutional into cash, a correspondent recently amassed more than a hundred sweatcoins by walking around New York, and then investigated what he could reap from his labors. At the Gap, when a clerk ringing up the correspondent’s purchase asked, “Do you have a Gap card?,” the correspondent said, “No, but I have sweatcoin.” The clerk furrowed his brow and demanded legitimate currency. A cashier at Astor Place Hairstylists was impressed by the concept, when it was explained to him (“Sounds like a million-dollar idea”), but was unwilling to accept sweatcoins as payment for a haircut.
Is VIX Manipulated or Hedged?
> Also Uber drivers, financial technology, Fannie and Freddie and a crypto tween.
> I feel like “financial literacy” as it is usually conceived is terrible, just a lot of “if your bank pays 10 percent compound interest and you start with $100 then in three years will you have more or less than $130?” and other arithmetic trivia that is of limited interest in our world of low interest rates and flourishing Ponzi schemes. “Financial literacy” will tell you that the answer is “more than $130,” because compound interest Einstein blah blah blah, but the correct answer is “less than $130,” and likely zero, because if your bank pays you 10 percent interest in the United States in 2018 it is a Ponzi and will steal your money.
> Like here is a financial-literacy quiz: Are these companies? If you get at least five of those right then I will allow you to drive for Uber.
A fantastic money stuff.
Bitcoin has a huge scaling problem — Lightning could be the solution
> So, what’s on the horizon as bitcoin prepares for Lightning to strike? To truly understand, it’s important to first understand how Lightning uses the cryptographic primitives of the bitcoin network to make secure payments outside the blockchain (you’re in luck—we’ll explain). From there, we’ll take a step back and consider the key strengths and weaknesses that the new network is likely to have once it’s deployed at scale.
Okay, so Bitcoin.
> It was invented by Satoshi Nakamoto, a developer at Nintendo who mysteriously disappeared in the 1990s. The multiplayer mode in Goldeneye N64, on which he was lead developer, uses a primitive form of Bitcoin to keep track of high scores.
Predicting Random Numbers in Ethereum Smart Contracts
> Secure PRNG implementation in the Ethereum blockchain remains a challenge.
Blockchains: How to Steal Millions in 2^64 Operations
> TL;DR: you can hijack certain Lisk accounts and steal all their balance after only 2^64 evaluations of the address generation function (a combination of SHA-256, SHA-512, and a scalar multiplication over Ed25519’s curve).
Decentralization in Bitcoin and Ethereum
> We have been conducting a longitudinal study of the state of cryptocurrency networks, including Bitcoin and Ethereum. We have just made public our results from our study spanning 2015 to 2017, in a peer-reviewed paper about to be presented at the upcoming Financial Cryptography and Data Security conference in February.
> Here are some highlights from our findings.
Scalable, transparent, and post-quantum secure computational integrity
> Here we report the first realization of a transparent ZK system (ZK-STARK) in which verification scales exponentially faster than database size, and moreover, this exponential speedup in verification is observed concretely for meaningful and sequential computations, described next. Our system uses several recent advances on interactive oracle proofs (IOP), such as a “fast” (linear time) IOP system for error correcting codes.
The blockchain paradox: Why distributed ledger technologies may do little to transform the economy
> And this leads me to my final point, a provocation: once you address the problem of governance, you no longer need blockchain; you can just as well use conventional technology that assumes a trusted central party to enforce the rules, because you’re already trusting somebody (or some organization/process) to make the rules.
Ten years in, nobody has come up with a use for blockchain
> What if, ten years after it was invented, the reason nobody has adopted a distributed ledger at scale is because nobody wants it?
That’s just, like, your opinion, man.
Zealot: New Apache Struts Campaign Uses EternalBlue and EternalSynergy to Mine Monero on Internal Networks
Combining all the exploits for fun and profit.
Notes on Blockchain Governance
> In which I argue that “tightly coupled” on-chain voting is overrated, the status quo of “informal governance” as practiced by Bitcoin, Bitcoin Cash, Ethereum, Zcash and similar systems is much less bad than commonly thought, that people who think that the purpose of blockchains is to completely expunge soft mushy human intuitions and feelings in favor of completely algorithmic governance (emphasis on “completely”) are absolutely crazy, and loosely coupled voting as done by Carbonvotes and similar systems is underrated, as well as describe what framework should be used when thinking about blockchain governance in the first place.
DAO for pentesters
> 1) Solidity hacks/vulnerabilities/attacks/features. 2) Client side attacks at DApp and ICO landing page. 3) Writeup of Parity bugs.
SEC Halts a Real Initial Coin Offering
> Well never mind then. “Munchee was seeking $15 million in capital to improve an existing iPhone app centered on restaurant meal reviews and create an ‘ecosystem’ in which Munchee and others would buy and sell goods and services using the tokens,” says the SEC, though in fact it only raised about 200 ether (about $60,000) from 40 buyers before shutting down.