Apparently today we had the second attack against twister.
But this time we are seeing the long anticipated “reversal attack”, which is when a new branch is quickly produced in order to overtake the original block chain sequence. Since this branch may start in a certain time in in the past, all registrations past the forking point are reverted and discarded. It seems the attacker has used our last checkpoint as a fork point (01/16/14 @ 8:41:39am) as he couldn’t have gone farther in the past (otherwise twister nodes would have rejected his blocks).
While this is a very unfortunately thing (except for him, who might find it very funny), I don’t think it is reason for much concern. I’m sure that we will be able to secure against this kind of attack using some ideas that are currently being discussed in twister-dev:
https://groups.google.com/forum/#!topic/twister-dev/tH3HlVQ_wmo
If you want to join the discussion, this is a good time.
For people who registered past 01/16/14, my apologies. Please try to resend your the registration to the network with the following command:
./twisterd sendnewusertransaction “username”
Then let us know if it works or not. I’m listening @twister or @mfreitas.
PS: One reason it is currently easy for digital coin miners to attack twister is the currently small hashrate of our network. So if you want to help making this attack harder for them, start generating blocks yourself!
Update (2014-01-21)
Comment by buhtig314 in github issue #111: “Then why the author susggested us to register previous usernames again? After all ,he knows the system best.I supposed,he can roallback the whole database to previous state by some way.(now i know ,maybe i misunderstand the author’s suggestion, he suggested us resend registration but not use previous usernames). If you’r conjecture is true,after twice’s attack ,attackers may posses almost all usernames registered by all of us by simply replacing the public keys with his own public keys. If so, it is ridiculous. By the way, if it’s due to twister’s weak computing power,why not make the “generating blocks” as a default option in twister client?”
mfreitas commented:
At the time I posted about the reversal attack i didn’t knew the attacker had re-registered the same usernames to himself. I just saw the blocks being reversed and replaced by new ones, not what the new blocks contained within. If the attacker had just discarded the old blocks, then resending the registrations would work.
We can’t just rollback the database because this would invalidate all users that registered AFTER the attack.
Yes, this is due to our low computing power. And no, i’m not fond of the idea of using the user’s CPU without their consent. If someone builds a list of the blocks generated by the attacker we might think of an alternative to recover those usernames. This would not be simple or risk-free though.
Hmmm…
> ./twisterd sendnewusertransaction “stookie”
error: {“code”:-11,”message”:”Error: this username exists in tx database”}
Can see my posts on the postboard, without avatar. Profile popup coming up empty. Profile page has correct secret key, but no other details (except user name). Setting these to what they were before has no effect.
Pretty sure I registered after the 16th, but not 100% sure.
Your username was accepted into blockchain really. You may check with this command:
./twisterd getrawtransaction stookie 1
I can’t be sure if the public key there corresponds to your private key though. However you can check it yourself: (1) take note of your secret key, (2) stop twisterd, (3) remove your twisterwallet.dat, (4) start twisterd, (3) try importing the secret key again as:
./twisterd importprivkey secretkey stookie
If they don’t match you will get “Private key mismatch to existing public key (wrong username?)”.
Let us know, thanks!
This is exactly what I tried to do yesterday just after the report of the attack, only to see that it wasn’t possible to reimport my private key in the current blockchain… Very frustrating…
I just checked, the timestamp of the transaction corresponding to my username is exactly during the period of time when I was recompiling twisterd last night. So I can’t be the one who did it and it confirms that some funny person wanted not only to fork the chain as a PoC, but also to do harm to any username that was reverted in the process… :/
Just to follow up, I get the same error, so it looks like my username has been thiefed too.
Thanks for your help anyway, Miguel.
Out of curiosity, is this the “definite” version, or are there any plans to call this an experiment, sort out the bugs, and start again? ie Should I create a new username?
Hi there,
I registered yesterday and did this today because twisterd didn’t seem to start correctly :
- removed dir “blocks” and “chainstate”
- started twisterd (network tab indicating that block chain was not up-to-date, then it started downloading new block chain : ok)
The test
./twisterd sendnewusertransaction “sphinx”
gave the same result as stookie (error: {“code”:-11,”message”:”Error: this username exists in tx database”})
Then
./twisterd getrawtransaction sphinx 1
gave a transaction (which I think means my user exists for others)
I stopped twisterd with this line
twisterd stop
Removed my twisterwallet.dat
Started back twisterd with this line
./twisterd -daemon -rpcuser=user -rpcpassword=pwd -rpcallowip=127.0.0.1
Then
./twisterd importprivkey XXXXX sphinx
error: {“code”:-5,”message”:”Private key mismatch to existing public key (wrong username?)”}
So what’s next ?
)
I tried the same with the web client (import privkey for user, it gave the same message
Good luck
./twisterd importprivkey secretkey boneidol
gives
Private key mismatch to existing public key (wrong username?)
I registered on 16-Jan-2014
does this mean my twister username is taken now ?
I thought I recovered my username but now when I try to post I get: “Ajax error: bad post signature” (or from the CLI: “error: {“code”:-32602,”message”:”bad post signature”}”)
It looks like my private key has not changed. Any idea how I can fix this?
Looks like that issue went away, it works now.
Just lost my twister’s account.
“Private key mismatch to existing public key (wrong username?)”
The timestamp in the blockchain does not match my registration time (I registered on friday).
Good work, evil attacker !
Same for me, my two account were create yesterday around ~14 UTC.
Can’t reimport neither, and first transaction in the new blockchain for the two are at 22:14 UTC yesterday and 13:06 UTC this da
I tried to import my privkey
error: {“code”:-5,”message”:”Private key mismatch to existing public key (wrong username?)”}
Registered friday 17, if it matters
Hi,
Got the same problem.
Now I can’t import my Private key.
1. Twister is runing
2. I run ./twisterd importprivkey XXXXX name
and geting
error: {“code”:-5,”message”:”Private key mismatch to existing public key (wrong username?)”}
Same here,
Can’t reimport my privkey.
The attacker apparently stole our usernames in the process…