CRYPTO-CURRENCIES HACK CHANGES WALLET ADDRESSESJanuary 24, 2018
Earlier this week I blogged about some of the dangers that I believe to reside in the new crypto-currency fad. To recapitulate, in my opinion those dangers are twofold, as they relate to (1) the closed nature of the system itself which is a deep sort of philosophical issue that I have addressed in various books and interviews about the relationship of one's "physics" to one's "financial views", and (2) to the inherent vulnerability of all cyber-systems to hacking, external manipulations and so on. It is the latter possibility with which I have been concerned of late, for when these crypto-currencies first emerged, my first thought was that they were - because of cyber-vulnerability - almost a perfect way to augment and enhance a hidden system of finance. Even if that high octane speculative possibility was wide of the mark or "off the end of the twig," they were a romper-room of possibilities for fraud.
Sure enough, we've seen stories emerging of neo-Fascist groups using them to finance their "projects", and it wouldn't surprise me the least to discover that some of these groups widely in the news lately will eventually be discovered to have financed their activities in part through playing the crypto-currency market.
To the growing list of possibilities for fraud and "diversion" you can now add this one, shared by Mr. T.M.:
Consider the implications of these four paragraphs:
Satori—the malware family that wrangles routers, security cameras, and other Internet-connected devices into potent botnets—is crashing the cryptocurrency party with a new variant that surreptitiously infects computers dedicated to the mining of digital coins.
A version of Satori that appeared on January 8 exploits one or more weaknesses in the Claymore Miner, researchers from China-based Netlab 360 said in a report published Wednesday. After gaining control of the coin-mining software, the malware replaces the wallet address the computer owner uses to collect newly minted currency with an address controlled by the attacker. From then on, the attacker receives all coins generated, and owners are none the wiser unless they take time to manually inspect their software configuration.
Records show that the attacker-controlled wallet has already cashed out slightly more than 1 Etherium coin. The coin was valued at as much as $1,300 when the transaction was made. At the time this post was being prepared, the records also showed that the attacker had a current balance of slightly more than 1 Etherium coin and was actively mining more, with a calculation power of about 2,100 million hashes per second. That's roughly equivalent to the output of 85 computers each running a Radeon Rx 480 graphics card or 1,135 computers running a GeForce GTX 560M, based on figures provided here.
Assuming the wallet address continues to generate coins at the same rate, the proceeds after a few months could be well worth the effort, assuming the massive cryptocoin sell-off—which has caused Etherium's value to drop by 42 percent in the past four days—doesn't continue. (Emphasis added)
It's that third paragraph, and the emphasized portion that grabbed my eye, for in my admittedly non-tech-savvy mind, it opened up two possibilities of high octane speculation, each of which - if true - is very disturbing. I say "if true" here because I am not only not tech-savvy, but I'm also standing on the very end of the twig, but I share these thoughts because I rather suspect that there are those out there who have been watching the crypto-currency story with the same mixture of speculation and cynicism as I.
To put my "high octane speculations" into context, let's recall that when crypto-currencies first became an internet "meme," some of the "accompanying memes" were their security, and more importantly, their alleged freedom from tampering by "the big players," namely the central banks. Then there were stories of how the Bank of England was thinking about crypto-currencies, and that meme, for a moment, was forgotten, until everyone forgot about the Bank of England story, moved on, and the meme of "free from tampering by big players" remerged into the narrative.
Now, in that context, consider those sentences from the third paragraph once again:
At the time this post was being prepared, the records also showed that the attacker had a current balance of slightly more than 1 Etherium coin and was actively mining more, with a calculation power of about 2,100 million hashes per second. That's roughly equivalent to the output of 85 computers each running a Radeon Rx 480 graphics card or 1,135 computers running a GeForce GTX 560M, based on figures provided here.
Reading that, two possibilities struck me: the hacker or hackers have more than ordinary computing power at their disposal, and this may mean either (1) that they have created a virtual network by "taking over" other computers for the purpose of mining as the article suggests, or (2) they have such computing power already available themselves. If the latter, then it implies a network, an individual or people with enough money to purchase that kind of computing power either through leasing or outright hardware purchase. If so, then one is looking at a major actor in a certain sense, either a group like "Anonymous" or some other type of extra-territorial entity like a corporation, or perhaps even a "state actor." If any of these possibilities are the case, then effectively someone is mining Etherium for money. But consider the "payoff:": a mere $1300 for all that computing power? So I have to wonder, what's the electric bill for all those "85 computers"? It would hardly seem to be profitable unless one were able to do this on a much grander scale, and the article hints that this may be going on in the statement "the records also showed that the attacker had a current balance of slightly more than 1 Etherium coin and was actively mining more." Of course, if one is "taking over" other computers and using them for this purpose, one won't have to worry very much about the electric bill. Indeed, the article itself points this out:
The message is demonstrably untrue, since malware that uses other people's computers and electricity to mine cryptocurrency is by definition malicious.
Any way one slices this, this is a serious problem to consider. And while considering it, note that the article also hints that considerations like these might be responsible at least in part for the recent dramatic sell-offs:
Assuming the wallet address continues to generate coins at the same rate, the proceeds after a few months could be well worth the effort, assuming the massive cryptocoin sell-off—which has caused Etherium's value to drop by 42 percent in the past four days—doesn't continue.
So with apologies for all those crypto-currency advocates out there, stories like this make me very uneasy, and very glad I didn't jump on the bandwagon.
See you on the flip side...