@r0nd0n Saves the Day - Again!
5 years ago in #steem by valued-customer (72)
$2.13
- Past Payouts $2.13
- - Author $1.62
- - Curators & beneficiaries $0.51
- > breezin: $0.05
- > meno: $0.05
- > r0nd0n: $0.05
- > steempeak: $0.05
- > v4vapid: $0.05
103 votes
- delso: $0.82
- fulltimegeek: $0.69
- lyndsaybowes: $0.12
- ausbitbank: $0.09
- deepdives: $0.05
- coininstant: $0.03
- followbtcnews: $0.03
- informationwar: $0.03
- proboards: $0.02
- eturnerx: $0.02
- perfectstorm: $0.02
- themanny: $0.02
- jimbobbill: $0.02
- crimsonclad: $0.01
- flagthedonkey: $0.01
- wakeupnd: $0.01
- openparadigm: $0.01
- saboin: $0.01
- fulltimeangel: $0.01
- practicalthought: $0.01
- and 83 more
I couldn't have done it without @drakos and @ausbitbank. Stay safe out there, them streets are rough.
What happened?
Posted using Partiko Android
Hacked.
:/
Do you know how?
Posted using Partiko Android
Phished, I suspect.
Congratulations @valued-customer! You have completed the following achievement on the Steem blockchain and have been rewarded with new badge(s) :
You can view your badges on your Steem Board and compare to others on the Steem Ranking
If you no longer want to receive notifications, reply to this comment with the word
STOPVote for @Steemitboard as a witness to get one more award and increased upvotes!
Curated for #informationwar (by @wakeupnd)
Ways you can help the @informationwar!
Can you please elaborate on the hack? This account I was given has been upvoting posts that I never upvoted. Was not sure if I was hacked as well. I checked Steem Auto and the slate is clean there. No auto votes, or trails whatsoever.
At any rate if you don't mind explaining I would be interested in learning more about what happened. Thanks.
@guiltyparties has reached out to me regarding the incident, and discovered how I enabled the attacker to change my keys. I attempted to post a link, and for some reason the copy action I tried to undertake did not work, and I didn't notice. I had just logged into Steempeak, and my active key remained in my clipboard then was pasted when I posted the link in the comment.
Since it was a link, it was not visible in the text of the comment and I did not notice it. The hacker runs a script that searches the blockchain for keys, and found mine in seconds.
Steem Keychain would have made that impossible, and I regret now that I was not using it.
Only if Keychain is accepted, not if you have to copy ur key from Keychain to steemconnect, right?
Unfortunately you are correct, and my browser doesn't work with Keychain, so I had to paste my key into steemconnect, which loaded it into the clipboard, from whence it was pasted for the entire world when I posted a link.
:// how unlucky
I don't think of it as luck. I think of it as bad opsec. In Alaska where I was raised, I learned that if it happens to you, it's your fault.
hurtful truth, but as anarchist I can completely agree and have the same opinion.
people are not ready to be accountable; women are a special topic.
Back in April someone accidentally posted their Owner key and their account was taken over. That account has somehow phished me, apparently by making a clone page of Steemconnect, and a page that appeared to be a post that directed me to sign in using my key.
Once they had my key, they got my liquid tokens, and there they sit. Because of @r0nd0n's help, I was able to stop the powerdown of my SP they initiated.
Note: I was not able to post, comment, or vote for a couple days, and thought it was just Steempeak acting up. Instead my keys had been changed, and had I acted quickly, I might have prevented the loss of all my liquid tokens.
Your account casting votes you did not indicates your account may be being accessed by another party.
You should change your keys immediately, so that the account cannot be used by anyone to do bad things. You don't want to be accusable of phishing or anything like that, I am sure.
How can you change ur keys, while they did it already?
If they change keys, your keys are outdated and dont work on a key reset?
Posted using Partiko Android
The owner key is necessary to change owner key. That was why the malicious actor was able to completely take over the account they used to take my tokens, but not mine. They only had my active key, and not my owner key, because Steempeak requires active key to login, and I do not use my owner key to login. I was able to change my keys and lock out the bad actor before the powerdown proceeded.
I should point out that I was not phished, and had accidentally pasted my active key when posting a link. The link occluded the actual paste contents so I did not notice it when posting, and the attacker runs a bot searching for keys posted to the blockchain. Within seconds my account was locked out, and since I didn't act immediately to ascertain why I couldn't post (I thought the Steempeak app was tangled up in the web, as sometimes happens. My second mistake, and probably worse than accidentally posting my active key, since that was pretty sneaky, and failing to ascertain the cause of the app failure was pure negligence. Terrible opsec, caused by acclimation to app failure on internetz), my liquid tokens were soon gone.
This is why I am unhappy Steempeak requires active key to login (so they can enforce a 5% benefactor reward to the app), and why Steemit did well to separate the wallet from the social media app, which allowed them to only require posting key until you needed to interact via the wallet.