News for hackers. Stuff that matters.
Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by TheAmazingRace on Sunday May 25, 2025 @09:35AM (#44087728)
This write up is very interesting to me for one main reason. It underscores how incredibly important it is for anyone dealing in this stuff to do the following…

Keep. Your. Mouth. Shut.

Pseudo-anonymity, with the emphasis on the pseudo part, is only as good as you. If you truly believe in Bitcoin and all that implies, it really is in your best interest to be quiet and keep it to yourself, and this knife cuts in more ways than you might expect. You don’t have layers of security like at a traditional bank. You are the weakest link wrt private keys and storage.

Also, even talking about it amongst folks you think are your friends, like fellow Bitcoin users, isn’t wise either. Hypothetically, if you became exceedingly wealthy on paper, it would be in the interest of others to take you out of the equation so you can’t cash out. If that means a five dollar (or whatever they cost these days) wrench to the head so you stop moving… now that value is locked up in the blockchain! Could this happen to any given bitcoin users with just a few satoshi or whatnot? Very unlikely, but don’t forget that a decade and a half ago, a handful of bitcoins could cost you very little money. Now it has gone up exponentially in value and would make you a big fat target.

There are those on /r/bitcoin that think a wrench won’t ever break their wills and spirits. That math is invincible. Don’t think they’ve ever been on the wrong side of one before. Math might be bulletproof, but wetware is very fragile.

Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by jsheard on Sunday May 25, 2025 @09:47AM (#44087815)
The tension is between needing to keep your mouth shut (for your own safety) and needing to loudly evangelize crypto at every opportunity (because its value is still mostly predicated on hype and FOMO, which must be maintained). For people to believe the narrative that buying crypto will make them rich, there has to be crypto-rich people shouting about how crypto-rich they are.
Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by TheAmazingRace on Sunday May 25, 2025 @09:51AM (#44087845)
That is quite a balancing act, isn’t it?
Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by throwanem on Sunday May 25, 2025 @10:53AM (#44088282)
Not before Miami slides into the Atlantic...
Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by TheAmazingRace on Sunday May 25, 2025 @10:59AM (#44088329)
Lol
Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by hoseja on Monday May 26, 2025 @09:44AM (#44097374)
"hype and FOMO", also known as "democratic mandate"
Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by dylan604 on Sunday May 25, 2025 @09:51AM (#44087840)
> Keep. Your. Mouth. Shut.

The interesting thing to me about this is watching how we've changed over the past 40 years. As a kid, it was impressed up on kids to not talk to strangers. You don't tell people where you live. You don't tell people anything more than necessary. Now, people share the most intimate details of their daily lives. People share/invite random strangers to their accounts without any concerns about who they are or what they might do. People just do not think about how the most benign of posts can be used for nefarious purposes by someone else. So we've gone from share nothing to over sharing everything.

Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by mattgreenrocks on Sunday May 25, 2025 @11:25AM (#44088487)
It’s definitely changed from generation to generation.

During covid some SWEs had pretty sweet gigs due to lowered expectations and a rush on talent. And what do a small fraction of SWEs do? Make “life in the day of” videos that glamorize how cushy and easy-going it is, painting the whole group of SWEs as spoiled and entitled who make too much money. Point is they could’ve just realized they had it good and kept quiet.

But, no, they had to hustle for internet points, even risking their job inadvertently. It’s unbelievable to me how fast we flipped from the internet being an accessory to life to it being a surrogate for actual social interaction.

Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by lazide on Monday May 26, 2025 @05:12AM (#44095494)
What will really boil your brain is how for many of those, the situation was not even real and they just made it up for clout.
Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by concernedParty on Monday May 26, 2025 @07:22AM (#44096282)
> (Proverbs 13:7) There is one who pretends to be rich, yet has nothing; There is another who pretends to be poor, yet has great wealth.

Pretending you're rich has been happening for a long time. Conversely, pretending you're poor though might make you a bit of a miser as you wouldn't use what you have to help anyone else. It seems wise to be discrete about your wealth if you have it, or you're just inviting trouble for little real gain.

Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by ummonk on Sunday May 25, 2025 @11:23AM (#44088477)
Ehh, changes in privacy expectations have gone both ways. 40 years ago people also voluntarily listed their home address and telephone number in phone books that would be mailed to the whole community.
Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by dylan604 on Sunday May 25, 2025 @03:07PM (#44090136)
If you think the telephone book is any where close to the same thing as the amount of information available via a web search, then you're just not even trying to have a serious conversation. At the time of printed phone books, it's not like you could pull out the super computer in your pocket and get turn by turn directions to that address. If you were fancy, you could maybe pull out your Mapsco and figure out how to get there, but only if that address was in the same area as the set of Mapsco books you had on hand.
Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by egypturnash on Sunday May 25, 2025 @05:02PM (#44091096)
You could go to the bookstore and get an appropriate map or two pretty easily. Or a gas station. Or join the AAA and get them to put together a TripTik. Or some combination.

Sure it'd take longer than pulling up directions on your phone does now but if you're planning a cross-country trip to kidnap someone and beat their passphrases out of them or demand a ransom from their family or whatever then you've probably got some other plans to make. If it's a total impulse then you just grab your duct tape, chainsaw, masks, and continental-scale road atlas and hit the road; when you get to your target's state you can pick up maps that'll get you to their place at the first gas station you hit. Don't make jokes about why you're on a road trip when you stop at the whimsical roadside attraction shaped like a dinosaur, someone will come forwards when your case makes the news.

Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by ummonk on Sunday May 25, 2025 @08:50PM (#44092808)
I had a road map of the county, with an index mapping each name to squares on the map, and address intervals listed on each long road. It would take me a few minutes tops to prepare turn by turn directions to a new address.

If I needed a direction addresses for another city I'd just go there (had a full highway map of the country) and buy the local map - they were typically for sale near the front of basically every store (gas station, pharmacy, etc.).

Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by TheAmazingRace on Sunday May 25, 2025 @09:56AM (#44087881)
So just another point on this… you are probably not as anonymous on the internet as you might think. You can brag about wealth in cryptocurrency. But use a handle long enough, or even across several accounts that can somehow be linked, and a fingerprint of you could be constructed. It really can be done with some forensic analysis.

And I think it all boils down to the fact that some humans need to make noise about their successes so they feel validated. Much like the cryptocurrency evangelists, they probably can’t help themselves because they want to ensure they defend “the mission” even if it comes at great personal cost in the long run.

Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by throwanem on Sunday May 25, 2025 @10:56AM (#44088299)
I've recently quoted on here something about learning to spend what's in your pocket. That is a special case of the same general principle evinced here, which is that if you don't put work into maintaining a broad perspective, you lose the ability to distinguish what you're used to and what's ordinary.

It's worth worrying about in the general case, too. There are subtler and much more noxious failure modes here than merely getting beaned with a Swedish nut rounder.

Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by scotty79 on Monday May 26, 2025 @06:18AM (#44095885)
That provides additional safety to all the people who haven't lost their mind and keep their mouths shut.
Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by hibikir on Sunday May 25, 2025 @12:03PM (#44088749)
This kind of works, until you have a medical issue that impairs your brain enough,an event that loses hardware keys or backups, or you care about possible inheritors when you die.

Everything you do to keep keys safe from some risks weakens your posture against other risks. Making sure most people don't know about your holdings is nice and all, but ultimately key management is a really hard problem. It's hard enough for companies, but I'd argue it's even worse for individuals.

Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by TheAmazingRace on Sunday May 25, 2025 @12:09PM (#44088805)
You are correct about key management being hard. I’ve been telling folks that absolutely insist on getting into Bitcoin that it’s best to leave out any notions of convenience at all, as convenience is the enemy of security. If you absolutely must have the stuff, stick to a cold wallet using pen and paper. It still has its own downsides, but it’s arguably one of the most simple ways to handle the keys problem.
Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by XorNot on Sunday May 25, 2025 @05:47PM (#44091487)
Except that's irrelevant. Key management doesn't mitigate the threat against you.

If the person who kidnaps you believes you have the necessary keys on you, or remember them or whatever, they aren't going to let you go because you genuinely do not have the ability to provide them.

Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by TheAmazingRace on Sunday May 25, 2025 @07:51PM (#44092433)
I fully agree with this sentiment. The burden of proof rests upon the kidnapped person to present the cryptocurrency or say it was “lost in a boating accident” but good luck proving a negative, in which case, you’re probably dead.
Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by quesera on Sunday May 25, 2025 @08:20PM (#44092621)
... and you don't even have the option of coughing up the keys to save your life.
Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by beeflet on Sunday May 25, 2025 @09:41PM (#44093123)
you can just keep a small amount (~$100) on a hot wallet for daily spending, and keep the rest under a multisig scheme or something.
Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by throwanem on Sunday May 25, 2025 @10:52AM (#44088270)
> Keep. Your. Mouth. Shut.

With events like the recent Coinbase breach, is this even enough?

Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by TheAmazingRace on Sunday May 25, 2025 @11:10AM (#44088395)
Nobody has to use Coinbase. That said, yes you aren’t wrong. The more intermediaries you deal with, the higher your exposure risk.
Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by throwanem on Sunday May 25, 2025 @11:32AM (#44088542)
That, and there's zero backward or forward secrecy by design. Avoiding intermediaries can't ameliorate the hazards of the protocol.
Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by TheAmazingRace on Sunday May 25, 2025 @11:53AM (#44088688)
Exactly. Hence why I don’t advocate for any cryptocurrency at all, personally. It’s fraught with peril and the juice really isn’t worth the squeeze to me. Others may have a different calculus, but I’d rather not be looking over my shoulder constantly.
Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by throwanem on Sunday May 25, 2025 @11:59AM (#44088726)
Oh, same, I've never touched the stuff. That was pure intuition 15 years ago; these days I think of it as a longterm investment paying major dividends in peace of mind.

Of course it would be easy to say one's never touched crypto, and not so easy to prove, as with any negative. I don't care. If I ever get bounced with a King Dick, it'll far more likely be because I said something someone didn't like - which seems to happen about as often as I open my mouth, these days.

In any case they better not let me hear them coming. Wiser to spin the block in a car, really. I've never been hit with a wrench before, but it did once take more than a hammer to get me off my feet.

Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by lazide on Monday May 26, 2025 @05:15AM (#44095510)
Coinbase is also the least messed up exchange on this front, at least with even a whiff of legality.
Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by throwanem on Monday May 26, 2025 @11:32AM (#44098407)
Yeah, they've been pushing hard since 2020 to get picked as the winner of a government-guaranteed monopoly on legal ramps between USD and crypto. It looks like they might pull it off, too. I haven't stopped being glad I didn't decide to work for Armstrong in '21 but I have to give him he's got the nous to recognize what a good thing Visa's always had going. I wonder how many skeletons they buried in the 60s...
Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by busyant on Sunday May 25, 2025 @04:18PM (#44090713)
> Keep. Your. Mouth. Shut.

Matt Levine had a recent article about this. Another part of the problem is that some BTC repositories* got hacked and the hackers got people's names and addresses and maybe quantity of BTC

So, even if you keep your mouth shut, if people can get your address, you're a potential target.

*(I can't recall the details and I don't know enough about crypto to know if I'm using the proper terminology)

* edit: here's the article. skip down to "$5 wrench attack"

https://archive.is/lUNox

Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by PicassoCTs on Sunday May 25, 2025 @05:28PM (#44091316)
You know, there are people here who have a living memory growing up in a high trust society. https://en.wikipedia.org/wiki/High-trust_and_low-trust_socie... And i refuse to accept all this advice, all this barbed wire as normal and all these grifters and gangsters as socially acceptable. And i refuse the victim reversal, of the "stupid" victim calling for it.

No, all those trying to normalize the wild-west and those who try to prosper from the wild west- they have to go. Now. Wherever they came from. Take your low-thrust, non-working societies with you. The enablers too, if you want to co-exist with this, you are wrong here. You need to go. Now.

Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by tmnvix on Sunday May 25, 2025 @05:35PM (#44091389)
You seem to be implying that immigrants are responsible.

While I agree that we are seeing a shift towards lower trust societies in the west, I can think of plenty of potential domestic causes.

Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by dotancohen on Sunday May 25, 2025 @08:58PM (#44092857)
Nobody mentioned immigrants. Society exists online as well as in cities.
Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by PicassoCTs on Monday May 26, 2025 @02:43AM (#44094646)
No, there are immigrants who want to dwell in high trust societies and contribute to that. Who are welcome! If you want this and want to participate in it - you are a enrichment to the world and the society you want to partake.

But if you push for a lowtrust society, because these "upvalue" security providers in daily life and you think you must re-educate your fellow man away from "stupidity" towards being eternally paranoid on the lookout, you are a detriment.

If you plan to actively prosper from pushing the scam parasitism and decay on "suckers" or just poisoning a high-trust society with low-trust fabrications - you are the economic equivalent to a lethal parasite or contagion.

Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by lazide on Monday May 26, 2025 @05:16AM (#44095517)
You’re just imagining a false past. Shit like this has always been going on - it’s just more visible now.

The Jordan Belforts and P.T. Barnums (and many more) have been a part of US society since the beginning.

Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by PicassoCTs on Monday May 26, 2025 @05:55AM (#44095750)
What if you imagine it wrong, and the past has been actually filled with high-trust useful idiots in the silent majority, thinking god watches them and they can leave the door and car unlocked, cause god also watches the village? What if you are just one of the infected?
Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by lazide on Monday May 26, 2025 @06:33AM (#44095982)
Uh, I’m saying that there has always been a sucker born every minute. I don’t think we’re disagreeing.

You’re just able to see the snake oil salesman parting the rubes from their coin remotely, instead of only being able to see it if you’re standing right next to the rube.

Even with that happening, there are still plenty of rubes - and just like before, people who are trying to run the snake oil salesman out of town (but generally being ineffective at it).

Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by robocat on Sunday May 25, 2025 @07:40PM (#44092365)
> Keep. Your. Mouth. Shut.

This leads to the outcome that it is hard to find good security advice. I'm from New Zealand and too many in the crypto community here are far too trusting (unsafely so - so why would I wish to learn from them).

I was (past tense) interested in investing in crypto however I wanted to learn how to manage security before I invested more than I could afford to lose (say more than a month's salary). I have never felt I could trust my own security so I have never invested much in crypto (one exception has been a little money in crypto correlated stocks).

I was in South America and I thought that might be a good place to learn crypto security since the people there need to be a lot more careful about their security. I couldn't find anybody I trusted to teach me, even if offering a good professional hourly rate. Easy to find people with opinions on security: however they were somewhat ignorant because they lacked real risk (because their amounts at risk were small enough that they would never be spear targeted).

When basic security is silence, then it is difficult to find anyone clueful who would teach.

Edit: an interesting adventure in trying to understand trust. Smart people won't share the details of their own security because it puts their security at risk (how can they trust me?) And why would I trust anybody who isn't at risk?

Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by TheAmazingRace on Sunday May 25, 2025 @07:46PM (#44092397)
It really is a rough row to hoe. This sort of Wild West commerce with cryptocurrency is what the community at large wanted, and now with that lack of trust… that extends to everything here.

It’s truly exhausting in the long run, which is why I prefer the old fashioned, tried and true financial vehicles instead.

Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by aleph_minus_one on Monday May 26, 2025 @04:51AM (#44095389)
> And why would I trust anybody who isn't at risk?

Because they are very knowledgeable.

Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by lazide on Monday May 26, 2025 @05:11AM (#44095491)
Knowledge which has never been (credibly) tested, or for which there is little at stake for the person expounding it if they are wrong is unwise to trust.
Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by lottin on Sunday May 25, 2025 @08:01PM (#44092492)
> Keep. Your. Mouth. Shut.

A critical aspect of crypto-currencies is sales. They have to sell a story so that investors keep pouring money into the system. Otherwise the whole thing would collapse very quickly.

Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by daveguy on Sunday May 25, 2025 @11:05PM (#44093581)
Or just don't mess with bitcoin and other crypto. It's pretty easy to avoid.
Re:Investigating Wrench Attacks: Physical Attacks Targeting ... by MrScruff on Monday May 26, 2025 @04:44AM (#44095345)
I have a few friends who've done well out of crypto, and they seem to struggle to follow your advice. I think the success they have with it also gives them a false sense of confidence, like they know what they're doing, rather than bzzzzzt number goes up.

One of them was defrauded of their entire savings, and only discovered at the point where they needed it as a deposit on a house. The person had spent over a year worming their way into their confidence (not just online), and was regarded as a good friend. They managed to convince them over a long period of time that it was safer for them (as a financial advisor) to manage their funds for them. Once the wallet was out of her control, the 'friend' disappeared entirely.