Netpurgatory

With the current down market for Bitcoin and Cryptocurrencies there has been a lot of talk on Twitter and other places and since there is so much that I disagree with, I figured I should add my 2 cents (or maybe 2 satoshis is more appropriate in this case). Unfortunately, what I have to say is too long for a tweet or two so I’ve got to go back to the mostly forgotten blog for this. I will for once give this the disclaimer that all opinions are my own and in no way represent my employer or any coins I’m involved in or hold.

As I’m writing this, Bitcoin is $6,133.47 according to CoinMarketCap (after a high of about $20,000 6 months ago). Most of the altcoins have been more or less following that. A few (decred for example) are still strong, but even they are down from a week or so ago.

Not too surprisingly this worries some people. There are more than a few posts and news stories about Bitcoin dying or something like that. I don’t have any response to that since it is nothing we haven’t seen before. I’m actually much more interested in the responses I’ve seen from some of the pro-Bitcoin or pro-cryptocurrency folks.

More than a few people have been saying that a downturn in Bitcoin is a good thing because it will scare away or otherwise push out the people who don’t belong here (noobs, no-coiners, or whatever other term they feel like using).

I have two big issues with this thinking.

First, this price drop is not a good thing and to claim it is makes no sense to me. I don’t think it is a terrible thing or in any way fatal to cryptocurrencies, but that doesn’t make it good. While there may be certain trading strategies that do well with volatility, so most people and most uses, it is not great (and even worse, it is scary if you haven’t been around the block a few times). I don’t like seeing people losing money (either real or on paper) and I don’t like losing money myself. Of course you should never gamble or invest money that you can’t afford to lose, but when you combine the crazy high prices from a few months ago with the currently low prices, that dramatically impacts who can afford to play in the cryptocurrency sandbox. This bring up the second (and more important to me) issue I have.

I absolutely do NOT want people being driven out of cryptocurrency for economic reasons (or really for most reasons). I’ve been doing Bitcoin and cryptocurrency for a relatively long time now. The earliest public code I could find from me was:

jcv@triforce btcjson $ git show d0d58c54db28d1a84bcc9b8effd985f59135972c | head
commit d0d58c54db28d1a84bcc9b8effd985f59135972c
Author: John C. Vernaleo <jcv@conformal.com>
AuthorDate: Fri May 10 16:16:18 2013 -0400
Commit: John C. Vernaleo <jcv@conformal.com>
CommitDate: Mon May 13 12:25:41 2013 -0400

Initial implementation

so I’ve seen a whole lot of people come and go in this space.

There have been the folks who think that this will let them somehow get away from governments in either some libertarian or cyberpunk utopia (let me know how that one goes, but I won’t be holding my breath). There are the people who hate banks (and I have some news for them, banks have noticed cryptocurrency and blockchain and are putting a lot into this space now). There are the pro privacy people (hope they are sticking with Monero and Zcash rather than Bitcoin). There are the straight up anarchist punks who don’t seem to be in the space too much, but as an old punk, I totally want to see more of you. There are degenerate traders who apparently decided normal stock, bond, and forex trading just wasn’t volatile enough to get the rush they needed. There are the technologists who just think there is good tech here that we should be using and let’s see what we can do with it (not surprisingly I’m probably closer to that camp than anything else). And there are the ‘regular folk’ that we haven’t done a great job of getting them involved in the first place. You may or may not see yourself in one of these groups and there are lots of others that I missed. But my point is, much like the early web, we should want everyone here. The one overriding goal of most of this is decentralization and that should include everyone that we can. If your goal is decentralization but you want to exclude x, y, or z (with the obvious exception of wanting to exclude those who are trying to prevent decentralization of course), then you might just not be doing it right.

None of this means that we just accept anything that gets thrown out there and called cryptocurrencies. There will of course be coins that the market and the community will reject (hopefully for technical reasons). And there are probably people who will fit into a similar category. But even those cases aren’t things to celebrate. They are unfortunate facts of life, but that’s all.

So, in summary, don’t panic at a downturn, but don’t celebrate it as a way to push people out either.

On a Sunday evening this past summer, an attacker (not going to get into the whole misuse of the word ‘hacker’ here) took over some of my accounts and attempted to take over others. I suspect this was related to my involvement in Bitcoin and cryptocurrencies (these are nice target to steal) but I can’t be totally sure. I’ve heard a number of similar stories and read a few articles about similar incidences so I decided I should write my experience up.

A few examples of similar attacks are here, here, and here.

I got off pretty lucky. I had a few hours of inconvenience but I didn’t actually lose anything. Some of that was due to luck and some was due to the way I have things setup (but more on that later). In light of that I decided it was worth it to write up what I did right, what I did wrong, and how I could improve my security.

Timeline

Let’s start with a timeline of the incident since there are some interesting points about it. Some of this is not in the order I saw it, but it seems clearest this way.

11:00PM I finish giving my daughter a bottle and go to put it in the spreadsheet I have on my phone (you are supposed to keep track of how much infants eat and I like data, so don’t judge me). The phone says I’m logged out of my Google account. Seems odd but I’m not concerned yet. I put the baby to bed and go to my computer to see what is going on.

11:20PM I see password reset emails from bitstamp, dropbox, groupon, and gmail. Only the gmail one was successful. Since my gmail forwards to my normal mail, I have the email about the password reset.

11:27PM SMS sent from Google voice account to a 702 area code number.

11:28PM Call using Google voice to network solutions (changing my DNS).

11:33PM zoho.com email setup for my personal domain.

11:39PM I changed my gmail password back to something I control.

11:45PM I set my DNS back to my server.

12:00AM I notice my phone has no service. Log on to Verizon account and I see my phone number is set to an Apple iPhone 5s (I use an android phone and have for many years) but no recent logins on my account.

12:30AM Finally find a Verizon number to call (their security hotline). The very nice person one the line tells me that that number is for police or government callers. I have to use the Fraud Hotline which is only open from 7AM to 11PM.

2:00AM I manage to get my phone number back by sending an SMS to another phone on my account (family plan).

7:30AM Called Verizon’s fraud number. They blacklisted the MEID and SIM card for me but otherwise couldn’t explain what happened.

8:00AM Called Network Solutions. They said it was impossible for someone to change DNS over the phone (despite that I know it happened and have personally done it in the past without the account password).

8:30AM Called zoho. The confirmed that an account was made for my domain but no email got to it (since I stopped it very quickly). I assumed they wanted control of my email and would just recreate my address there but instead they made a single email address with a very bad word that I won’t post here as the address (and anyone who knows me knows that there are very few bad words that I don’t use so the choices are pretty limited here). Zoho closed the account for me.

9:00AM Discovered that the same attack was done to a coworker of mine at more or less the same time frame (and a different mobile carrier). This makes it very suspicious that we were particularly targeted for our bitcoin work.

Failure Points

Verizon Wireless

Verizon should never have switched my number to a different phone. The attacker never signed in to my account and almost certainly only had partial information about me and yet Verizon basically gave away my cell phone number which is one of the most important keys to all sort of parts of a person’s digital (and financial) lives.

Gmail

My gmail password was changed which was probably the initial goal until they discovered that I just forwarded that to my real email. This was due to my settings rather than a flaw in their systems or processes.

Network Solutions

Network solutions should not have changed my DNS over the phone. The attacked did use a number that may have been associated with me at one point (a Google Voice number) but still, changing that without my password wasn’t good.

What I Did Right

Probably the best thing I did was catch this quickly and started changing things back before any harm was done. Unfortunately, that isn’t really a strategy one can rely on.

While I didn’t have it turned on for all of my accounts, I did have two factor auth turned on for a number of accounts. That meant that the attackers couldn’t get in to everything.

The fact that I don’t use gmail as my primary email account (and don’t host my email with gmail) saved me a lot of trouble. It meant that when the attackers got my gmail account and started trying to reset passwords, they didn’t get the reset emails since they didn’t have access to that email address yet.

I don’t keep any Bitcoins or other cryptocurrencies on any exchanges which meant that there was nothing to steal without accessing computers of mine (which would be a much tougher thing to do).

Also very helpful was that I have an email client that keeps a local copy of the emails. This meant that I had access to the gmail password change email even though my email accounts were not accessible (making it much faster to recover). Webmail is the attackers friend in these cases.

What I Did Wrong

I got off very well in this, but there were still things I could have done better. Most importantly, I should have had Two Factor Authorization (2FA) turned on for my gmail account. I also should not have had a recovery phone number set for my account.

The second thing is I should not have had a domain (and an important one) registered with Network Solutions. They do not support 2FA (not even the terrible SMS version of it), and they can clearly be talked in to changing things over the phone (something I’ve seen in person even before this).

Things to Improve

There are some steps I took to prevent this from happening again. First I turned on 2FA using Google Authenticator, not SMS, for all of my google accounts and removed the recovery phone number. That part is very important since you phone number can be stolen.

Then I moved the last of my domains off of Network Solutions and on to a better Registrar that supports 2FA.

While I already used 2FA on many accounts, there were still some that I did not so I have now turned it on whereever possible.

Interesting Points

The most interesting thing about this to me was that the attack changed my Verizon number right before their fraud department closed. That made it much harder to recover. It is also worth noting that there was nothing technical about this. The first (Verizon) point and third (network solutions) in this attack was done entirely through social engineering. All of the other bits relied on using the password changes more or less as intended.

The seemingly target nature of this is also interesting. The only part that I find confusing was why they just made a bad email address on zoho rather trying to match my real address. That makes the whole thing seem much less careful than the rest of it. The only thing I can guess is that the attacker was annoyed that I was already getting things back at that point.

I’ve also considered that it might make sense to have a separate Google account just for use with Android (so just for the Android App backups, contacts, etc) and to not use that for anything else. I haven’t fully thought through if that helps enough to be worth it.

Another important point is that 2FA using SMS (when a website sends you a text message with a login code) is NOT secure.

Why Post This

I want to make a small note as to why I’m posting this. One could question posting details of an attack in case the bad guys can learn from it. While that is true, I think it is more important that everyone else can learn from it and protect themselves a bit more. I’ve already dealt with most of the ways in on my end so I’m not tremendously worried myself. The possibility of compromising a cell phone remains and until the carriers fix that, there isn’t much we can do there so it is vital to address all the issues that we can. Also, I’d posting this to shame the companies that let this happen (Verizon Wireless and Network Solutions).

Not much to say here, just a test posting after moving this site to a new webserver. I may try to write up some of the details needed to get WordPress and OpenBSD to play nicely together if I have time later.

I want to talk about compilers a bit.  I haven’t really worried about compilers in a few years, but since it sounds like there may be some interesting things going on in that area, it seemed like there might be something to look into again.

There’s a lot of talk these days about clang and llvm as a replacement for gcc. This has gained some momentum since Apple’s switching over to llvm (which ended up causing trouble for people who use MacPorts and lots of UNIX tools on the Mac, but that’s another story).  The various BSDs seem to have shown some interest in this too.

Ignoring the non-technical issues that seem to drive some people in this direction (I don’t really understand the anti-GNU sentiment that seems to come up relatively frequently these days either), llvm is supposed to be better at optimizing output than gcc.  This is where I actually get interested.

Most of my work on optimizing code comes from doing simulations in FORTRAN 77 when I was in grad school.  So the first thing I looked for to test this was a FORTRAN frontend for llvm.  This may seem like an odd thing to want, but lots of technical and scientific work is still done in FORTRAN.  It is actually a great language for a certain set of problems.  Turns out clang is pretty much for C-like things (I guess the name should have been a hint there).

To support languages like FORTRAN, there is a project from llvm called Dragon Egg.  It isn’t really a compiler, it is just a plugin to allow you to use llvm to do optimization for gcc (and since they claim FORTRAN support, presumable gfortran).

So, I installed it, checked out a copy of ZEUS-MP from my svn repo, modified the makefile, and tried to compile it.  And nothing.  I got strange build errors right away.  Now Zeus is extremely portable at this point.  In the past it was known to run on UNICOS, Irix, and lots of other long gone systems.  I’ve personally made sure that it could compile with the Intel Compilers, Portland Group Compilers, G77, GFortran, and Sun Studio Fortran Compiler.  I actually found the best performance with the gcc based compilers (g77 and gfortran).  Seemed surprising considering that in toy examples, the Intel Compilers generally perform best.  I have a figure or two related to this in my dissertation.

I could probably fight and try to get zeus to compile this way, but I don’t do hydrodynamics or FORTRAN for a living any more, and this was just supposed to be a quick experiment, so I don’t think I’ll put the time into it.  Maybe they will eventually get FORTRAN support to work better and I’ll try this again.  But for now, I’ll stick with the GNU Compilers.