Comment by nayuki

14 hours ago

The server is getting overloaded, so here's the text for reference:

    Steal my Bitcoin
    0.65 hours without a successful hack
    
    There is a bitcoin key hidden on this server worth about $502.
    
    It is accessible to the PHP user account through the print-flag binary.
    
    This PHP version was selected from before the PHP2SHELL CVEs were released.
    
    First person to get the wallet wins. If you don’t need the money, consider donating it to those who do: givewell.org.
    
    All traffic is logged. This is a known vulnerable machine, so we cannot guarantee privacy. Other attackers may access or monitor activity and data beyond our control. Do not submit anything you want to keep private.
    Challenge wallet
    Explorer ↗
    
    bc1qlnu5…t3cxqy
    
    0.00625104 BTC
    
    ≈ $502.35 USD
    stealmybitcoin.com · Terms of participation

19 comments

nayuki

Reply
xmcp123  13 hours ago

Bahaha someone added to the fund. It’s now $1004

  • bluefirebrand  13 hours ago

    That's way funnier than taking it honestly

    • Fnoord  5 hours ago

      How so? Anyone can do this, if it fits their agenda. Especially useful way to use your stolen/extorted BTC. If I had an exploit for this right before or right after embargo was lifted, and I could do that again, then it is in my interest to have cybersecurity people get more lax. For example, any secret agency in the world could be behind such a psyop. But also any criminal group or company invested in this field. You seen recently (Shinyhunters) how people can wear double hats.

      Another trick could be to increase hype. Original author could've done that, for example because they always planned to burn 1k USD in BTC on this for whatever reason.

      And then there's the trick to hope others follow, after which he, ehh, magically takes the money. That's a bit akin to ICO scams.

      Can I prove any of the above theories? No. But the author cannot prove their motives are sincere either.

  • paulpauper  12 hours ago

    imagine having so much $ lying around that you do that

    i picked the wrong profession

    • londons_explore  2 hours ago

      I sometimes posted a donation link or joke site and got surprisingly large donations.

      Made my tax audit rather painful.... "I posted a joke on the internet about binary numbers not being worth anything and someone gave me $10k of bitcoin that I'm now declaring - is it income for the work of writing the joke, or a gift? The sender likely didn't know who I was, and was likely overseas but I cannot prove who they were or which country they were in".

    • argee  9 hours ago

      Maybe your username could have been paulrichguy and things would've been different.

fwlr  13 hours ago

Great way to inject some price information into the “AI automates exploits at scale” narrative. “AI can now chain complex exploits, it’s point-and-click pwnage, you say? Over or under $500 a pop?”

  • snailmailman  13 hours ago

    I'm seeing a few comments that say $500 isn't enough, and its not worth it for them to try to hack it. But if it costs fewer than $500 of tokens in an AI, then it seems like it is? I thought a lot of the claim people are making is that you dont actually need to hack anything you just ask an AI and it does it. The exploitable bug is public and documented. All the pieces are theoretically there, and there are repeated claims that AI is trivializing exploits and its super easy to hack things now.

    If that were true, and someone can hack the server for less than $500 of tokens, its an easy profit.

  • flir  13 hours ago

    $500 is the value of the prize. We don't know what the price someone will pay for a lottery ticket is.

    • fwlr  13 hours ago

      It’s not very much information, I agree. Even such scant information, however, is a significant and refreshing improvement on the current state of the narrative. Kudos to the servermaster, I say.

sscaryterry  12 hours ago

This could be an interesting bug-bounty type of initiative. Setup a system, lets other dudes at their expense battle for scraps?

zoeysmithe  14 hours ago

" All traffic is logged."

For $500 he can look in the logs and find all manner of new exploits, or new deviations of the existing ones, he can then sell for thousands. Clever business model lol

These projects would be more interesting and ethical if the current and historical logs were instantly put up somewhere public in real-time for anyone to observe.

Regardless, I'm guessing the smart hackers aren't going to bother.