Coin News

Monero has officially released its Malware Response Workgroup website yesterday. In an effort to help protect Monero’s community, the website aims to provide resources to educate about the types of malware that may take advantage of users. It provides support for problems including unwanted in-browser and system mining (cryptojacking) and ransomware, all which have been a growing problem as of late.

In a blog post by Justin Ehrenhofer on the Monero website, the Malware Response Workgroup is “a self-organized set of volunteers that maintains these resources and provides live support.”

The post goes on to describe future efforts to provide support directly through the website; however, volunteers are currently available for live support at #monero-mrw.

The Burn Bug

The announcement of the working group is a second bit of positive news from the Monero community, coming shortly after it successfully patched a bug in its wallet code.

The “burn bug” never affected the actual protocol or the coin supply, but, if exploited, it would have allowed a malicious actor to profit significantly from inflicting damages on organizations within the Monero ecosystem, such as exchanges and any entity using a Monero wallet.

The bug could have been exploited as follows: An attacker first generates a random private transaction key. Then, they modify the code to merely use this particular private transaction key, which ensures multiple transactions to the same public address (e.g. an exchange's hot wallet) are sent to the same stealth address. Subsequently, they send, say, a thousand transactions of 1 XMR to an exchange. Because the exchange's wallet does not warn for this particular abnormality (i.e. funds being received on the same stealth address), the exchange will, as usual, credit the attacker with 1000 XMR. The attacker then sells his XMR for BTC and lastly withdraws this BTC. The result of the hacker's action(s) is that the exchange is left with 999 unspendable / burnt outputs of 1 XMR.

In the simplest sense, the bug allowed for funds to be sent in such a way that the recipient could not spend them, and the wallet would still report these as properly received funds.

It would have been possible to send multiple transactions to the same one time address, each transaction with a different key image. Since the one-time address can only be used once, it could only claim one of those outputs sent to it — but the wallet software was accumulating the amounts of all of those transactions.

While the concept of burning funds by sending multiple transactions to the same stealth address is nothing new in the Monero community, the consequences were never properly thought through if a third party, like an exchange, is involved. In May 2017, the topic was lightly discussed in a Monero SE Q&A. Users tossed around the idea, concluding they are “not sure of the implications or whether the protocol guards against this.” It was not until the hypothetical scenario included an exchange where the community realized the true implications of such an exploit.

The Discovery and Fix

The exploit was discovered on September 16, 2018, after Reddit user s_c_m_l described a hypothetical attack on exchanges that support the Monero’s XMR token. The scenario presented User A sending XMR to Exchange B via many transactions with the same stealth address, allowing User A to then exchange the currency he sent and proceed to cash out. This was the first time anyone had imagined such a situation.

Less than 24 hours after s_c_m_l proposed the attack in a Monero subreddit, another Reddit user, Vespco, posted the idea in the official Monero subreddit. Shortly after, a patch was created by the Monero dev team and applied on top of the v0.12.3.0 release branch. The patch was implemented via a pull request.

After pull request #4438 was implemented, the developer community privately notified as many exchanges, services and merchants in order to minimize the number of organizations that would be exposed when the official announcement was made.

Monero Community Responses

As dEBRUYNE mentions in his blog post, this practice was not ideal because there were inevitably organizations that they weren’t able to notify. The behind-the-scenes notifications could also have been viewed as preferential treatment, which is never ideal for a community fostering decentralization and fairness.

Following the patch release, community members on Reddit were unsure how to perceive the outcome of the situation and were debating if the Monero dev team should have disclosed that there was a bug while they were working on a patch instead of after. Reddit user fort3hlulz suggested:

“I *do* think that a simple disclosure would be helpful in the future … [for example] a bug is reported and found to be real. Monero devs make a post that there *is* a bug, that it is being worked on, but without details on what/exploit details.”

What’s unusual in this circumstance, however, was that the bug was originally mentioned in Reddit as opposed to the official Monero Dev group, which left the community, devs included, unsure how to announce that there was indeed a bug. Nonetheless, the quick response by the entire community, developers included, seems to have reinforced confidence in Monero.

In the future, Monero and its community hope that further community efforts like the Malware Response Workgroup will provide better resources for users to report bugs of all types. Referring to the main focus of the group, Ehrenhofer writes “We will not be able to eliminate malicious mining, but we hope to provide necessary education for people to better understand Monero, what mining is, and how to remove malware.”

In what seems like the first coordinated strike from government agencies, the U.S. Securities and Exchange Commission (SEC), the Commodity Futures Trading Commission (CFTC) and the Federal Bureau of Investigation (FBI) have taken action against a securities broker for violating federal laws in connection with security-based swaps funded by bitcoin.

On September 27, 2018, the SEC announced that it had filed charges at a U.S. District Court for the District of Columbia against Marshall Islands-based securities company 1pool Ltd., also known as 1Broker, and its Austria-based CEO Patrick Brunner for trading security swaps to American investors and others across the world without meeting the "discretionary investment thresholds required" by federal securities law.

The SEC further claims that 1Broker was fraudulently issuing swaps as it was not a registered "securities-based swaps dealer," and it also failed to transact on a registered national exchange.

Commenting on the claims, Shamoil Shipchandler, director of the SEC's Fort Worth regional office, said the SEC would protect U.S. investors on any platform regardless of the currency used in the transaction.

"International companies that transact with U.S. investors cannot circumvent compliance with the federal securities laws by using cryptocurrency."

The SEC is seeking permanent injunctions, penalties and "disgorgement plus interest" against 1Broker and its CEO.

Responding to the SEC's allegation, 1Broker assured customers of the safety of their funds and said they were ready to cooperate with the SEC.

The CFTC filed a similar complaint against 1Broker for illegally offering off-exchange, transactions, not registering as a Futures Commission Merchants (FCM), and failure to implement anti-money laundering and supervisory features.

The statement from the CFTC reads in part:

"Entities required to be registered as FCMs such as 1pool, are required by Commission Regulations to diligently supervise all activities of their officers, employees, and agents relating to their business as an FCM, including the handling of customer accounts, and to implement and maintain adequate supervisory systems and procedures."

The Federal Bureau of Investigation followed this up with a seizure of the 1Broker.com domain name. The Bureau claims the domain was taken down after a U.S. District Court for the District of Columbia found probable cause that it's in violation of federal laws.

The Blockchain Trust Accelerator (BTA) has received a six-figure grant from the Social Alpha Foundation (SAF) to build its latest project known as The Impact Ledger, an online registry of blockchain projects designed to assist in the public, nonprofit and for-profit sectors.

BTA was founded in 2016 and seeks to connect philanthropists with civil society organizations, governments and technologists to establish blockchain pilots for social good. The organization operates as a not-for-profit enterprise between the Bitfury Group, New America, the National Democratic Institute and the Rockefeller Foundation.

SAF works to educate communities, both local and abroad, on the benefits of blockchain technology and inspire them to utilize its capabilities for social ventures. Founded in Hong Kong in 2017, the company offers funding to businesses and other organizations that try to improve the environment, public health and formal education systems through blockchain technology.

Applicants that qualify for SAF grants receive anywhere between $10,000 and $100,000 for their projects. Most of the SAF’s funds are garnered through cryptocurrency token sales and ICOs. Among the association’s past grantees are Aparna Krishnan, who co-founded Mechanism Labs in June 2018 and was awarded the prestigious Thiel Fellowship.

Tomicah Tillemann is the co-founder of BTA. Speaking with Bitcoin Magazine, Tillemann states that blockchain technology is emerging when trust in organized leadership is at an all-time low.

“According to the Edelman Trust Barometer, trust in nonprofits dropped nine points amongst the general population and a staggering 22 points among the informed public from 2017 to 2018,” he claims.

“We agreed to define parameters for, establish and manage a comprehensive registry of blockchain projects in the governance and social impact space. The goal is to help organizations and governments learn what has been attempted, what has been successful, and assess whether these solutions can scale. Also, it is difficult to persuade organizations to share information. We would like to work on encouraging the blockchain community to engage in more collective learning around both successes and failures.”

Similar projects such as ConsenSys Social Impact, which seeks to empower students by helping them develop blockchain projects for social good, have also appeared on the horizon in recent weeks. Tillemann says that ConsenSys has been a key partner in the development of the Impact Ledger, and that executives are contributing information from within their ecosystem to assist in the development of the registry.

Furthermore, he says that three specific audiences stand to benefit from the Impact Ledger the most, the first being individuals and organizations undertaking social impact blockchain projects. A listing on the Impact Ledger would bring newfound attention and resources to their projects.

The second group is the people that these projects are built to assist, while the third includes organizations that could benefit from the blockchain for social impact but have yet to undertake any projects. This would include NGOs and funders, corporations and even startups.

“The Impact Ledger will increase the flow of resources toward maturing the technology and, ultimately, the impact of social and civil projects,” Tillemann said.

The newest episode of What Bitcoin Did features a debate between two crypto advocates with a strong economic background, Caitlin Long and Dr. Saifedean “Saife” Ammous. It was loosely moderated by regular host Peter McCormack and the discussion was lively.

Caitlin Long, a recurring guest with the podcast network, has been involved with Wall Street financial banking for more than 20 years and has been a firm advocate for cryptocurrency since 2012. Dr. Saifedean “Saife” Ammous, on the other hand, comes from a more academic background and has been a professor of economics for several years. Having embedded himself in the space for several years, Ammous is also the author of a book on cryptocurrency and economics, “The Bitcoin Standard.”

These two experts share many views about the direction of cryptocurrency and the greater financial industry, approaching the issue from wholly different spheres that still go on to influence popular thought in economic theory. Although the two come from different backgrounds, Long claimed that “I suspect we don’t disagree on a whole lot,” beginning the conversation by discussing the times she’d recommended Ammous’ book to other professionals.

Nevertheless, McCormack moderates the two through a stimulating discussion on many topics of common interest, including the relevance of Austrian Economics to our modern times, several specific areas which prominent Austrians such as Murray Rothbard failed to predict, and cryptocurrency’s fate in the context of an impending worldwide economic catastrophe.

This episode is from just one of several cryptocurrency podcasts that are held to similar standards of information and quality, all of which are available on the Let’s Talk Bitcoin Network.

The U.S. Congress has nixed a bill that looked to create a task force to combat the use of cryptocurrency in financing terrorism. House Resolution 5036 (H.R.5036), which purported to establish the "Independent Financial Technology Task Force," was sent to the House of Representatives on Wednesday, September 26, 2018, for consideration.

At the time it was introduced by Representative Ted Budd, the proposed bill was seen as a positive move from U.S. lawmakers, which aims to mitigate the use of cryptocurrencies in terrorist financing. The task force would focus on researching the ways in which terrorism could be financed through cryptos and propose actions to curb such activity.

In addition to the creation of the task force, the bill would also support the development of tools and programs to detect any illicit use of cryptocurrency.

Public records from Congress indicate that the bill was passed by the House before the "motion to reconsider" was "agreed to without objection." Seeing as the bill was accepted before being reconsidered, this misstep means that the bill can not proceed to be ratified, per congressional rules.

In addition to federal law enforcement studying cryptocurrencies and how terrorists are exploiting them, the bill also made room for rewards for those who provide information that leads to the conviction of those involved in crypto terrorism financing. These rewards would have been paid out from the funds seized from convicts, as well as from related fines and forfeitures.

H.R.5036 was seen as a more robust version of another cryptocurrency-related bill. Released earlier last year, the House of Representatives introduced the "Homeland Security Assessment of Terrorists Use of Virtual Currencies Act" which seeks to make a proper threat assessment on the use of cryptocurrencies by terrorists.

One of the talking points of the Act is the way it defines virtual currencies. It defines virtual currencies as any digital representation of value functioning as a medium of exchange, store of value or a unit of account. This broad definition includes bitcoin, ether, a virtual debit card and even a Paypal balance.

A bill that seeks to create a task force to combat the use of cryptocurrency in financing terrorism has just passed the House of Representatives. House Resolution 5036 (H.R.5036), which purports to establish the "Independent Financial Technology Task Force," was sent to the House of Representatives on Wednesday, September 26, 2018, before it passed an unanimous voice vote and has now moved to the Senate for consideration.

The proposed bill, which was introduced by Representative Ted Budd, is seen as a positive move from U.S. lawmakers, which aims to mitigate the use of cryptocurrencies in terrorist financing. The task force would focus on researching the ways in which terrorism could be financed through cryptos and propose actions to curb such activity.

In addition to the creation of the task force, the bill would also support the development of tools and programs to detect any illicit use of cryptocurrency.

Public records from Congress indicate that the bill was passed by the House without contention. Seeing as the vote was unanimous and the bill wasn't a controversial one, the motion to reconsider was laid upon the table and gavelled out, so it will now procede to a vote in the Senate.

In addition to having federal law enforcement studying cryptocurrencies and how terrorists are exploiting them, the bill also proposes rewards for those who provide information that leads to the conviction of those involved in crypto terrorism financing. These rewards will be paid out from the funds seized from convicts, as well as from related fines and forfeitures.

H.R.5036 is seen by many as a more robust version of another cryptocurrency-related bill. Released earlier last year, the House of Representatives introduced the "Homeland Security Assessment of Terrorists Use of Virtual Currencies Act" which seeks to make a proper threat assessment on the use of cryptocurrencies by terrorists.

One of the talking points of the Act is the way it defines virtual currencies. It defines virtual currencies as any digital representation of value functioning as a medium of exchange, store of value or a unit of account. This broad definition includes bitcoin, ether, a virtual debit card and even a Paypal balance.

Clarification: An earlier version of this article mistakenly claimed that the bill would not procede to the Senate due to a point of procedure. The error has been corrected.

Leading companies in the gaming and blockchain space have come together to form the Blockchain Game Alliance, a coalition that will advocate for blockchain development within the gaming industry. The Blockchain Game Alliance will create an open forum for stakeholders to “share knowledge and collaborate on research which fosters new ways to create and play games.”

The Alliance was announced at the inaugural Blockchain Game Summit which was held from September 25-26, 2018, in Lyon, France. The Blockchain Game Alliance is made up of influential companies such as Alto, Gimli, Fig, Ubisoft, Ultra, B2Expand, ConsenSys, EverdreamSoft and Enjin.

Nicolas Gilot, co-CEO of Ultra, a PC game publishing platform built on the blockchain, told Bitcoin Magazine the alliance will “democratize blockchain within the gaming industry.”

“We believe that by supporting each other and by having some of the brightest minds in the industry facilitate research and development, together we can drive disruptive change and deliver a fully fledged and improved user experience,” Gilot added.

The Alliance will also be used to develop best practices and common standards that promote the alignment and uniformity of blockchain integration within the community.

“The Blockchain Game Alliance aims to leverage our combined skills and expertise to provide a bridge between blockchain and gaming to accelerate industry adoption,” Dan Biton, co-founder of Gimli, noted in a statement put out by the new alliance.

Some exciting use cases for blockchain technology in the gaming community includes using characters in multiple games with interlinked environments. Using blockchains to track in-game items can also help increase the value of those items by providing new ways to use them in and out of the games.

Developers can also create rare items and prove their scarcity — one of the reasons why trading card games like Spell of Genesis became so successful within the community. Special wallets can then be used to store these assets for proof of ownership and facilitate item/asset trades between games.

Distributed ledgers can also mitigate the fees users and merchants must pay for in-game payment gateways and subscription fees, as decentralized payment gateways and cryptocurrencies feature cheaper fees than their credit card company counterparts.