We have a super interesting talk for you up next by Amro Abdel-Gawad. He's a security researcher with Immunai, sorry. My speech is getting a little slurred today. I'm not even drunk. So without further ado, I'm going to let him take off his talk. Let's get a big round of applause for him. So when I started working on the remote metamorphic engine research, the last thing I was thinking about back then was metamorphism. All right, is it OK now? So the last thing I was thinking about when I started working on the remote metamorphic engine research was metamorphism. I wasn't thinking about metamorphic at all. I was mainly trying to create unbreakable code, a piece of code that cannot be reverse engineered, cannot be tampered, cannot be analyzed. So anyone who has limited experience with reverse engineering will know that it's actually not possible to create unbreakable code. It's possible to resist reverse engineering, but it's really impossible to create a piece of code that would have high resistance to the degree that it cannot be analyzed. So I researched the subject. I read about a lot of papers. I learned about a lot of obfuscation techniques, amazing obfuscation techniques. And I applied a lot of techniques. But unfortunately, I failed. Sequence of failure attempts kept going up until the moment that I decided to simplify the problem and treat the problem as a security problem. Well, at first, that actually turned to complicate the problem rather than simplifying it. Because unfortunately, we don't know what security is. We know what security is not. And we learned about weaknesses based on knowledge of vulnerabilities. And we learned about strengths and security based on weaknesses and defined weaknesses. But we really don't know what security really is. If you ask me 15 years ago when I started my career, what is security, you would have lost your whole day receiving my response to your question. Today, if you ask me the same question, you will really make me thinkin' something amazing about security that the more we learn about it, the less likely we are capable to define it. But there's no wonder. As at a certain point in my research, I came into very satisfying view for security. That security actually meant to be undefined. That security is all about undefined expressions. Undefined expressions that aim to take probabilities out of the equation that you're trying to secure. So the remote metamorphic engine, research of resisting reverse engineering started by defining security as an undefined expression, taking the lessons learned from there and applied to the binary protection problem. And that resulted in flux binary mutation. And only then with flux binary mutation I started to have satisfying results for resisting reverse engineering. But resisting reverse engineering or resisting a reverse engineer turned to be not enough. Once you have high rates of satisfying results of resisting reverse engineering, you will then realize that the problem is much bigger than that. You need to also count automated tools. You need to count AI tools or machine learning. And then the problem is not only about the code. The problem is also about data. How are we gonna secure the data? Input, output, even the data all is being processed inside the code. So that resulted in the end by adding techniques to secure the data and the code that resulted in sort of artificial immunity. So that's the outline of the presentation today. And the remote metamorphic engine is actually the name that I've given to the approach which is a new approach for resisting reverse engineering. But it's more like a new approach rather than an actual engine. And I decided to name the approach like that because it's not possible without metamorphism or mutation and it's not possible without having the engine or the morphic engine isolated remotely or away from the reverse engineering environment. And I'm applying all these techniques using very simple, very simple techniques that I'm gonna go through with all with you today within the coming few minutes. So I define security as an undefined expression following very simple analysis flow. If we don't know what security is but we know about a lot of successful security solutions, so if we analyze these successful security solutions enough, we can then find patterns that keep repeating itself everywhere and then we can, by defining these patterns probably that will help us to better understand security and will help us to better approach security. So that's exactly what I've done. If you ever do that, you will find something pretty interesting that randomization and isolation are two major patterns that we rely on in everything. To the degree that if you take these two patterns out of the equation or out of any security solution, security is not gonna be possible. Randomization like, let me give you an example like stack buffer of fruit protection where we insert random number and then we check on the random number when the function returns. Added a space layout randomization to disable jumping into hard coded locations. Encryption, asymmetric and symmetric encryption almost everywhere you will find random numbers without random numbers we cannot apply a lot of security solutions. And on the other hand, a much stronger security pattern is isolation. And if you just treat these patterns based on their meaning, randomization and isolation you wouldn't really gain much from their meaning but analyzing them in abstract mathematics you can then be able to isolate the patterns away from their meaning and then you would be able to extend their strength and to find their ultimate strength and then you will be able to move freely with these patterns to apply it on other problems. So I've done just that and then I arrived into defining randomization in its ultimate security pattern as division by infinity in an inverse relation to probabilities where like you increase the random number as much as possible to reduce probabilities as much as possible to zero. And on the other hand, I defined isolation as a division by zero which is an undefined mathematical expression by then you can actually take probabilities totally out of the equation. So only then when I return back to solve the binary protection problem only then I started to see another dimension to the problem. From that perspective, all the researches that I read about and learned about and all the failure attempt that I went through, they were all going toward infinity in an attempt to increase the time and effort needed to disable reverse engineering or to resist reverse engineering. So how about going toward zero? In this case, and instead of increasing the time and effort needed for reverse engineering, we will just reduce the time as much as possible to zero. So allow just few milliseconds for the code to be executed. And by that, there will be no way for the code to be reverse engineered. Imagine that you are just generating a code that will be valid only for six milliseconds. There will be no way that it will be reverse engineered unless it will be saved and then analyzed and then reverse engineer will return back to try to attack the system based on knowledge of previous execution. But then if you do that, it means that the code is expired. The code is not gonna be used anymore. So you need to generate new code. And hence we need to have metamorphic engine. But not a metamorphic engine from the perspective of viruses or malware where they use metamorphism just to change the way the code looks like or to change the pattern or to change the signature of the code. We need to have actually more like mutation engines, more than just morphic engines. So I went by and I defined the unbreakable code as an unpredictable code, but the code that cannot be determined and cannot be and to keep on changing. And it cannot be expected before it gets executed. And while trying to apply the randomization on isolation techniques that we talked about, I found that the major weakness is actually the static code dynamic data, which is the model that we use to everywhere that this is the way we learn how to program. This is the way we learn how to develop our software. The code is static and the data is dynamic and that enables all sorts of reverse engineering and also enables all sorts of replicable software exploits. So I tried to change that model into the dynamic code dynamic data that the code will keep on changing and the code will keep on evolving while it's being executed and that the code will not remain the same, will not remain static. So if you look at the code now and try to analyze it, it should look totally different than the way it looked just a minute ago or a few seconds ago. So any reverse engineering attempt goes through three main stages. Locating the code, analyzing the code and then breaking the code. In order to have very high rates of RE resistance, we need to resist all these stages. We need to make the code unlocatable. So we're gonna make that by storing the code remotely and perform remote execution. And we're gonna disable analyzing the code by using flux binary mutation and by setting the lifetime of the code into a few milliseconds. And then we'll make the code unbreakable by allowing the code to know more about itself that it would detect any tampering attempt if any happened while it's being executed. So the remote metamorphic engine architecture looks as you see here, will divide the engine into two separate areas. Trusted area and untrusted area. The trusted zone here is the area where the reverse engineer has no access to. And the untrusted zone is where the reverse engineer would have access to. We'll have mutation engine stored in the trusted zone that will keep generating code and keep mutating the code and then push the code to be executed in the untrusted zone by using challenge response metamorphic protocol. So why remote? Why we have to store the engine, the morphic engine remotely, away from the reverse engineering environment? Well, if you keep the engine next to the, in the reverse engineering environment, a reverse engineer will just simply go and reverse the engine itself and will break the engine. So in order to secure the engine itself, the engine has to be stored in a secure area and an area where the reverse engineer doesn't have any access to. But you don't really have to do that. It all comes to what you're trying to defend against. If you are trying to make the code keep morphing itself and keep changing because you're trying to defend against intrusion or malware or external intrusion. So you can then have the engine in the same trusted area. But today I'm mainly focused on, or the presentation is mainly focused on resisting reverse engineering rather than using metamorphism to secure the trusted environment. So the remote metamorphic engine is based on challenge response protocol, challenge response communication protocol that is made of morphed machine code rather than data. And the protocol is pretty simple is that the trusted, the trusted area will push four bytes of code size and then will push the morphed code and then the untrusted area will just receive, will receive the code and execute the code and then respond back, respond to the engine. And trusted area and untrusted area here can be client and server. It can be kernel and user mode. It can be guest and host machine. It can be even like an oil reader in an oil field and then you need to check its integrity to make sure that it's secure. It's not tampered. And on the other hand, we also should count the offensive approach which is in this case, a malware can use the trusted area as a command and control server and untrusted area as the infected machine where it's untrusted because reverse engineers will have access to. So by doing that, we would actually split the execution flow into two different areas. An area that the reverse engineer has access to and another area where the reverse engineer doesn't have access to. And that on its own will create a lot of challenges to any reverse engineer because the reverse engineer will never see the whole picture. We'll see just parts of the code being executed and we then even determine what decision is gonna be made on the responses or return values. So here is a list of samples of the challenges that can be pushed into that protocol which is mainly, here I'm mainly focused on challenges that we'll check on the integrity of the environment such as in memory code integrity check, execution environment integrity check, detecting hooks or trying to determine if the execution environment is real or it's emulated or it's instrumented. Clock synchronization. Clock synchronized challenges is actually empty challenges. It has no functionality at all where you can just create a challenge that has to be executed to be solved and then you would push it to the untrusted area to make sure that it's not analyzed. And then detect virtual machines or detect or collect hardware IDs to check on the integrity of the hardware. So once you start to work on these challenges you will find that not all the challenges will have the same strength. Some challenges will be so easy to be broken and some challenges will be much harder to be broken from a reverse engineering perspective. The challenges, the more you're gonna rely on the CPU and the execution and the process itself that you will create challenges that will only execute inside the process this will be the most solid challenges. But if you're gonna create challenges that will communicate with the operating system or resolve or communicate with APIs in the system these are weak challenges that can be fooled easily. So that makes the approach if it's gonna be used by any malware will be weak enough to be analyzed. The only trick will be just to know that a malware is analyzing the execution environment while you're analyzing the malware and to make sure that you wouldn't slow down the malware while it's being executed so it will reveal all its functionality and you can go on and reveal its functionality. So in order to ensure, in order to ensure to secure the challenges we will use morphing techniques where we will have the function that we need to execute and then we have to mutate the function in a manner that the challenge cannot be solved unless the code is executed. And the way we will do that we will have to rely on other morphing techniques not just like the malware morphing techniques. We need to use mutation techniques that will change the functionality of the code not just changing the code structure or not just changing the code semantics. So here's how we can, here's how I'm creating these challenges in the remote metamorphic engine is getting the function and then applying morphing techniques on the function changing the function structure totally and then add a head and a tail to the function and the head is just unused in instructions and the tail is where we will perform response mutation. So every time the function is gonna get executed it will return different response. Here is the sample of the code being executed. Challenges are being generated and being sent to be executed in the untrusted area. And as you can see the encrypted response every time the challenge is being executed it will return back different return value and then the morphing engine will receive the response and then decrypted back to its original value. And the main reason why you need to do that is to make sure that no one can fool the responses or can hook into the response and then just send fake responses. So in order to perform mutation for every single challenge I'm mainly using reversible instructions and the reversible instruction what they do is that when the function returns before the function returns a set of instructions will take the return value and then mutate the return value. So the remote metamorphic engine would generate mutation key and then use that key to create dynamic encryption routine and then insert the encryption routine in the end of the function to encrypt the response. And then once the response is returned to the remote metamorphic engine it will use the same mutation key to use to generate a decryptor that will decrypt the response and return it back to its original value. So here as you can see these are samples of the mutation that we will use to mutate the response. And this mutation is actually as you can see here we're using a set of reversible instructions like addition, subtraction, XOR, bit rotation to the left or to the right and then once the response returns back you will apply the opposite instruction to reverse the response back to its original value. So once you start to use these instructions and as you can see here if you use these instructions in detail any AI or reverse engineer trying to analyze the code will be able to detect that this set of instructions is actually in the tail of the function. So in order to disable that we have to use the same exact instructions in the body of the function. We'll use that in the morphing techniques that we're gonna do to the function and also we'll use the same instructions in the head where we will insert useless instructions. So this how like anyone analyzing the function will not be able to determine the beginning of or the end or the body of the function. So here after performing the morphing techniques that I'm gonna show you now what you need to do is to disable any reverse engineer or AI trying to automated tools trying to analyze the code. You need to disable them from determining the beginning or the end or the middle of the function by mixing the same instruction sets everywhere in the function. So the mutation techniques that we will need to use to resist reverse engineering it's totally different than the mutation techniques or the morphing techniques that malware would use. Malware they use morphing or polymorphic techniques to evade antiviruses. They use polymorphic techniques simply by encrypting the code and then when the code executes it will fold memory and then decrypt and then will be in its original form. And on the other hand they use metamorphic techniques to make the code operate in the same exact way but would look totally different. I use totally different instruction sets. So no encryption is used in metamorphism. Here are some samples of what here are some techniques that are used by malware metamorphic techniques which is like all aiming to change the structure of the code or evading signatures. But what we're trying to do here is not really to evade signature. We need actually to resist reverse engineering. If you make some few changes to the code to make it look different still a reverse engineer can easily determine what's going on. But more importantly because we need to evade artificial intelligence or any automated tools we need to use morphing techniques that will make it expensive for automated tools in terms of time rather than just changing the signature. So the flux mutation goals that we're gonna have is to extend the trust. So the notion is that if you have few milliseconds of trusted execution we need to be able to extend that trust from few milliseconds to cover the whole untrusted area by checking on the integrity of the execution area. Ensure trusted execution. We need to make sure that the challenges that we're creating will not be solved unless the code get executed. And while doing that we also need to disable the code being emulated or instrumented. And we need to also detect reverse engineering or an evade reverse engineering while the code is being executed. So in order to make it expensive for any automated tool or reverse engineer trying to reverse engineer the code we need to have, we need to use morphing techniques that will require time for any automated tool to analyze the code. So I'm using here mainly structure obfuscation. So every time the code is being morphed the structure of the code will be totally different. And I'm actually changing the structure of the code not by making the structure look different but actually by making the structure look the same. So all the functions while they are being morphed though they are different functions at the end they will look all the same. And that's how you can make it harder for any automated tools to determine the difference between the functions. So we'll make it harder for any automated tool to attack the code while it's being executed. So these are actually basic blocks. So we take a function, simple function and then we would morph it into thousands of basic blocks that they all look the same. And these basic blocks will be totally disconnected. There's no edges connecting these basic blocks with one another.  So here as you can see reverse engineer will just receive the code as totally disconnected basic blocks. And then only when these blocks start to get executed they will start to connect to one another. And that's how we can make it more expensive for any reverse engineer or automated tool to analyze the code. In order for any automated tool to analyze that code it has to emulate the execution of these basic blocks or analyze it. So it will be expensive at the end of the day in terms of time. And then at the end you wanna make sure that in order for the challenges to be solved it will only be solved if the code gets executed only natively or even on an emulator but not on an instrumentation tool or any tool that tries to understand try to understand the code or break the code while it's being executed. So here sample of these basic blocks. Every basic block here is actually just one instruction. And the morphic techniques that I'm using is actually taking every single instruction as you can see up here this is the original instruction. And then taking the instruction and then transform every single instruction into a basic block. And that basic block will encrypt the instruction and then the only way that the real instruction will appear is by executing the basic block. So the morphic techniques that we can use to resist reverse engineering in the context of clock synchronization that you're allowing the code only to execute for few milliseconds is totally different than the morphic techniques that is used by malware to change the structure of the code or to evade signatures. So here is the list of the techniques that I found to be very helpful. We need to use metamorphic techniques plus polymorphic techniques. You cannot really rely on metamorphism only. You need to use polymorphic techniques. And why you need to use polymorphic techniques because you have to do self-modifying code. You have to generate self-modifying code to make it more expensive in terms of time for any automated tool to reverse engineer the code. And you need to make code structure obfuscation so any AI wouldn't determine which function is which because not all the challenges will have the same strength. Some challenges will be weak and some challenges will be strong. So you need to disable any reverse engineer to determine which function is which. And the way we'll do that is to make all the function look the same and all the function will have the same structure as I showed you. And then challenge response mutation which we talked about in the beginning is that you're generating code that will expire in few milliseconds so you need to actually make the code function differently because if it wouldn't function differently it can easily be faked. So every time we execute the function it should function in a different way and return different return value. So it will transform into a real challenge. And slices permutation is where if you have 100 functions if you send these functions to be executed in the same sequence that will be a weakness as well. You have to morph the sequence of the functions. So every time you send functions to be executed you will have to rearrange the sequence of these functions while being executed. And code size magnification is also very important here because if you're expiring the code in few milliseconds and you're trying to determine if the code is being executed natively or if the code is being analyzed if you're sending just few instructions it will be so hard for you to determine the difference. So you have to magnify the code. You have to magnify it enough that will enable you to determine or you will have a larger difference between if the code is being executed natively or the code is being emulated. And by saying emulated here I don't really mean like emulated CPU but rather instrumentation that the code is being instrumented while it's being executed and then a reverse engineer or an AI would patch or like would tamper the code while it's being executed. So here's a sample. This is just a very simple function that you can define in the remote metamorphic engine. This function is just checking if the debugger is connected to the process. And I've chosen this function because it's just very short and small and enough to fit into the screen. So we'll start morphic techniques by inserting useless instructions, unused instructions. And then after inserting these unused instructions and randomizing every time you would insert different set of instructions this is how you can change a little bit the structure of the code on the first stage. And then here we're also can use expansion so you can replace one instruction that does memory operation. You can change it with a different set of instructions that perform the same exact operation but in a different way and using different instructions. So the first morphing stage you will reach that code. And then in the second morphing stage because we need to make it harder for any reverse engineer to analyze the code we need actually to change the structure of the code and make it much harder for any automated tool to hook into any part of the code. So every single instruction should look totally different and should be moved into totally different position inside the function or inside the binary code. So what I'm doing here is actually I'm taking that code and then inserting a label into every single instruction and then inserting a jump after every single instruction. And by that I'm totally free to move any instruction anywhere because the sequence of execution will always be the same. So this code here that you see is exactly the same as that one. By inserting labels and inserting jumps after every instruction to the next one you are free to move any instruction anywhere. You are free to move any of these basic blocks anywhere. These two are exactly the same. Just doing trun position here. So after doing that and changing the structure of the code and doing transposition and moving every single instruction in a different location we will take every single basic block and then use polymorphic techniques to transform this basic block into self-modifying code. So that basic block, we're gonna take it and transform it into that morphed basic block which is a self-modifying basic block. As you can see here, this is a mutation, a randomly generated mutation key that I'm using to create randomly encryption and decryption routines. And here as you can see this is a randomly generated self-modifying code. So every single basic block which is actually every single instruction will be transformed into a self-modifying basic block on its own. And here's a helper function that just helps to allocate the location of the code and memory. And as you can see, these parts actually will transform into self-modifying and it will modify itself while it's being executed to unfold into the original instruction or the original basic block. And also the jump that you see here, the jump that is after the instruction is also gonna be morphed. So any AI or reverse engineer trying to understand which instruction will be next, he wouldn't be able to know or any automated tool trying to analyze the code, they wouldn't be able to know which next instruction, which instruction will be next until the code is executed and the code self-modify and decrypt itself and then we'll jump to the next basic block and then the next basic block will self-modify and decrypt itself and memory and then we'll reveal the next instruction and so on. And we need to do that because we only have few milliseconds for the code to be executed and we wanna make it very expensive for any automated tool to try to solve the code within that allowed timeframe. Like these techniques might not be that interesting if you just give the reverse engineer as much time as he want to reverse engineer the code but in the context of the code has to be executed in few milliseconds, these techniques are very helpful. And for sure it's gonna be helpful if you would add multiple layers of self-modifying. So at the end, the code will be morphed into these structures. Here as you can see, these are like three basic blocks. So every single instruction will be transformed into these randomly generated basic blocks. Here's a sample of the code being executed and self-modifying just to give you a feel. All the basic blocks will end up looking exactly the same and while being executed, they will change and they will connect and they will unfold the memory. As you can see here, this code will change now and reveal that instruction. Sorry. So these morphic techniques, if it's used normally to just to morph a piece of code it wouldn't be helpful at all. But the point is that the code will have only few milliseconds to be executed and to respond back to the remote metamorphic engine with the right response. So here as you can see, these are four different generation, four different samples of the same function being morphed. And every time the function is morphed, it will respond back with a totally different return value and then the engine will receive the return value and then decrypt it and return it back to its original value. And as you can see here, the response time is six milliseconds. I was here connecting the trusted and untrusted area, the remote metamorphic engine and the client on a same machine and a local host. If you're gonna connect it remotely it might be much longer than that. And here as you can see, every time the code is being morphed it will result in a totally different code size. So the code size will be different, the structure will be different and the instruction sets that are used will be totally different. As you can see the first time the original code actually if you just assemble it it will be around maybe 30 or 40 bytes. And here these 30, 40 bytes of the original code are being transformed into 15,000 bytes or around like 2,000 or 5,000, five or 6,000 instructions. Now, in order to determine if the code is being really executed or if the challenge really been solved without being tampered or without being reverse engineered or without being emulated or instrumented. If someone just hooked into the challenge response protocol and then tried to just set the return value into any value and trying to fool the protocol the remote metamorphic engine can easily detect that. So any immunity system in nature actually is based on knowing the self. So the remote metamorphic engine actually tries to learn and know about the self by comparing the responses or the challenges that are returned comparing it to the previous execution. So we have the same function, we would execute it maybe five times and every time the code will look different the structure will look different and the function will actually include totally different functionalities because it's mutated. And every time the function get morphed and being sent to be executed it will return a different return value but then the engine will use the randomly generated decryption or mutation key to solve the challenge and return it back to the original value. So as you can see here if anyone tries to tamper the code while it's being executed or try to tamper the response while the response is being returned by just simply hooking into a response and then sending, faking the response the engine can easily determine that by comparing the responses with the previously returned responses. So as you can see here these are seven different mutated functions of the same exact functions every time the function is being sent to be executed it will return back totally different value and then all these values should decrypt back to the same exact value. So the remote metamorphic engine can determine if there's any tampering attempts if the decrypted value will look totally different will result in a different value than all the previously generated code. On the other hand the engine can be able to determine if the code been executed natively or in a healthy way compared to being instrumented or being analyzed based on time. So we, in this challenges for example we're allowing 500 milliseconds for the code to be executed and to return back and then the engine can determine if the code is being analyzed or the code is being emulated or being instrumented if the response returns back in a higher time frame than the allowed time frame. So the way I actually said the allowed time frame I'm actually doing it manually by executing the code natively and then measuring the code the execution time of the code and then would allow because every time you send the code to be executed will return back in a different time frame so you have to enable a time frame because the code will keep on fluctuating. So I'm mainly allowing the average of the execution time multiplied by three to five factors. And this way it's like it's based on the assumption that if the code is being analyzed there must be at least two or three instructions being inserted to analyze the code or there must be at least comparison instructions. So as you can see here on these are all the same functions these are all same generation seven different generations of the same function every time it's being executed it will return back in a slightly different time frame. The first time return back in 45 milliseconds second one 65 milliseconds and then in this sample I'm allowing only 500 milliseconds for the code to be executed and then once the return value returns back in a higher time frame the engine can determine that the code is being analyzed and then it can act in a different way. In case of a malware using these techniques perhaps that would be the most tricky part of it. A malware wouldn't really be able to change the behavior because the malware will still have to communicate with API who still will have to communicate with the operating system. So still you can determine or you can signature the malware based on behavior analysis but the tricky part is that the malware can be analyzing the code or analyzing the reverse engineer while the reverse engineer is analyzing the code or the malware can analyze the execution or the instrumentation environment while the instrumentation environment is analyzing the malware. So that might eliminate or just the tricky part once you know about it it's gonna be so easy to bypass it but if you don't know about it a malware can evade the analysis and maybe act in a totally different way and in this case the functionality is even not stored in the executable file that you're analyzing all the functionalities are stored remotely and then you wouldn't be able to go to the next step in analyzing the code. So it's just this trick that the malware can use to evade reverse engineering so it's the technique is not really that wouldn't really add much to malware evading malware as much as it can be used for defensive approaches trying to eliminate the code from being reverse engineered or pushing integrity checking functions to check on the integrity of the code or the integrity of the environment you're executing the code in and this is actually the most this is the most challenging part is that how can you really trust in any nodes that you are connecting to how can you trust on the integrity of things in your network? How can you trust the integrity of the processes that are running in your network where you are relying on static code? If you're relying on static code and that static code can be hooked can be patched, can be tampered in memory and then you wouldn't really be able to determine or trust its input or output. So the remote metamorphic engine can be used to check on the integrity of connected things and to ensure that things cannot be reverse engineered or it will be much harder to be reverse engineered or get tampered. On the other hand, execution time also you can determine that the code is being analyzed or the code is being faked if the response returned back in a lower timeframe than the allowed timeframe. In this case, maybe someone is trying to fake the responses and executing it in a much faster CPU or performing any tampering attempts that would result in the code being returned very fast. So these two variants would help a lot to determine if the code is being executed natively or it's being tampered or it's being reverse engineered. So I'm running out of time. So if you have any question you can feel free to email me. I'm gonna be using this email address for the coming couple of weeks and with that, it's been an honor to be part of your day today. Thank you for joining me. Have a good day. Thank you.


Yeah, yes, you can hear me. Hi, can you hear both of us? So and welcome to the Bitcoin show, what are we at? Six oh my gosh, we're at episode six already and I'm Bruce Wagner, and I'm Ed Gal and Welcome there's all kinds of breaking news in the Bitcoin world and we want to bring it to you and Get as much information as we can to you as quickly as we can so As I say there's a lot going on I'm gonna bring up the first of all let me just say this today's episode of the Bitcoin show is Brought to you by our awesome sponsors first ambivert creative. Ambivert creative is a Mbivrt Creative comm they create your corporate identity and Bitcoin bonus comm Bitcoin bonus comm they're amazing you'll get paid back in bitcoins for everything you do everything you shop online Everything you buy and sign up for that you're doing any way you get paid back and blue canary night light Blue canary night light comm They sell the most amazing blue canary light night light check it out Just take a look at it and read the story behind it and you'll be hooked You got to buy one all right and trade hill comm which is the new exchange site on the scene new kids on the block and Awesome new features and so on you can actually get a 10% discount for all your trades for life with views the Referral code on your screen, which is th as in trade hill dash R as in referral code 141 that's th dash R 1 4 1 so thank you guys for sponsoring the Bitcoin show We're always looking for new sponsors, and we really appreciate you. Yeah, so Today we have live via Skype Kevin day you don't know Kevin probably Say hello Kevin. They have to be married to him. Thanks for having me on today, but Kevin has a story to tell So why don't I just let's just go into it Kevin, and why don't you tell us tell us the story from the beginning? well, I've been playing on the Bitcoin market for quite a while now, and I've been using Mt. Crocs trade funds for You know last couple months like a lot of people here I think have been I was a witness to the event that happened yesterday where somebody with a large quantity of Bitcoins decided to sell all of them at a penny which instantly crashed the market and You know because every cell has to be matched up with a buy Somebody was the one who bought all those coins for a penny, and that somebody just happened to be me Yesterday just through pretty much good timing. I bought roughly $5 million worth of bitcoins for $3,000 Wow $5,000 $5,000 worth $5,000 worth of bitcoins for about $3,000 five million dollars worth now when you say five million dollars worth of Bitcoin How are you determining like how many bitcoins is that? I ended up with 259,000 bitcoins and at yesterday's prices before Everything crashed that would have been roughly, you know around $5 million dollars And what what price I mean what price is that would that be five million dollars? What it should have been Wow, okay, so How do you think this happened and what's going on now Well, it looks like I mean There's a lot of guests going on right now and there hasn't been a lot of really official statements as to what really did happen But it looks like somebody was able to Penetrate one or more accounts on Mt. Gox that had significant funds of Bitcoin store and one of the interesting security features that Mt. Gox has is that you're not allowed to withdraw more than a $1,000 of Bitcoin at whatever the current market value is per day sort of a safety feature So, you know if you have millions of dollars in bitcoins in there It's supposed to be safe, you know No one can take more than a thousand dollars at a time and let you've gone and emailed them prove to you are and said, you know You basically are taking responsibility for what happens And I think some smart guy realized that if he crashes the market so bitcoins are work less than a penny apiece He could withdraw whatever he wanted I'm guessing this is pure speculation But that's the only reason why I think somebody did this was they were planning on crashing the market and Then cash me out quickly as they could Hopefully buying them all back at a penny, which I think I beat them to What let's seem to happen was we were all watching this this trade as it happened where somebody put a gigantic sell order in and The way of market like this works There will be some people who are buying some people who are selling, you know, and it keeps trying to match up the best Prices for buyers as it went through the system. So it started out buying bitcoins at $17 and then $15 and then $10 and This order just one single order for so many bitcoins consumed every Order on the system until it was just some people's hoping for a miracle Orders for a penny apiece at all the way at the very bottom That I just got a tiny bit on top of and be everybody else's punch, right? So you think that Okay, so the big question that a lot of people are asking is was it just one account that was Hacked and the bitcoins were sold from or what did it were a lot of people's bitcoins sold? What do you what do you think about that? Which is plausible, but I think one of the questionable things is why would anyone store this amount of money on a public website? Especially one that over the last few days has been getting a lot of flack for having security problems you know for for several days you know people have been saying here's a list of everyone's encrypted passwords and The people from Mount Docs have been assuring everybody know everything safe. Don't worry about it But I would think if I had you know It looks like the total amount that this account had in it before the attack right into it was somewhere in the order $8 million worth that yesterday's prices And you know, it's it's a little odd to try to think why somebody would have that much money in one account at a time But if what the mouth guys people are saying is true It was one person who had all this a hacker broke into it and was trying to find any way of eating that money out and Basically crash the market for everyone to be able to do so and you're in Chicago, Illinois, right? Yes, and how long have you been a customer of Mount Docs? I've been really you know playing with it Probably a month or two now. There's a month or two Okay, and you I mean, obviously, this is the best deal you found a penny What was the price going when you first got into it? Now a lot of people are saying that it was multiple accounts all triggered to sell at the same time. Are you I mean Do we have any way of knowing really? You know It would be difficult I think for that to happen because for one when we were watching the trades go through, you know The way Mount Docs handles trades is that they one large trade will slowly eat up more and more Buyers as it finds them. It's not an instant trade like what would be a sale like on a big stock market it seems to be sort of paced and All of these trades were coming in with the exact same time with them which got further and further in the past So either someone times them to the very second to all go off at once or they all were in one account Okay Wow, so Well, they could have been couldn't they have been all triggered at the same time to go off at the same time Couldn't they all Have been triggered to go off at the same time But one of the things that we actually noticed yesterday is that while one trade is executing it's almost impossible to put in a new one The system keeps saying, you know, there's a trade already in progress and it can't create a new one So I don't know if that's an intentional limit of only allowing one trade to go through while one processing Or if that was just a side effect of so many people Hacking and hitting a refresh button on the browser that it killed the site But it was nearly impossible for anyone to execute trades until this finished, right? Okay, and you say that it took about 20 minutes for this whole this whole event to I mean for the whole trade That one transaction to complete My head but it felt around 20 minutes. Yeah, I mean we were watching, you know In real time and still seeing the same what appeared to be the same order still executing for far after You know, everyone had already started panicking and wondering what was going on. Wow All right, so how How do you feel about the Suggestion of a rollback of all these transactions? Well, I think all of you think I'm really biased here in this But I think a rollback is really pretty dangerous for a few reasons The biggest is that up until now the whole idea of a rollback was almost unheard of, you know Mt. Gotts had never said hey we reserve the right to rollback feel like it They've never published the policies where they do, you know traditional stock markets have written published policies where if there's some kind of Obvious error or security incident or whatever. Here's what level it takes for these rules to kick in and here's how we will handle it There was none of that and some of the language on the Mt. Gotts website To some of us really made it seem like they were saying we aren't interfering in any trade whatsoever We're just matching up buyers and sellers so there's There's a feeling that I guess a few of us here that are saying We don't know that they really should be allowed to do this because they made it sound like not only that they never mentioned this but they hadn't They had used language to make it sound like they thought they couldn't Yeah Okay, so that's a lot of things that are not very specific until after it's kind of too late Wow so all right if Do you think that you're the only one who benefited from this Definitely not I think that was probably the one who benefited the most at least I got the biggest order in But there were a lot of people who had standing orders for a very long time They basically told the system, you know if the price ever drops below 10 by me a thousand dollars worth The price ever dropped below five by me $10,000 worth whatever And all of those orders from everyone who was pretty much willing to put the criminal line before this happened got their orders filled So there were quite a number of people and again, it's not hard to rewind this now to figure out what happened while the site's still down But there have been quite a few people and I see you've been saying you know, they got trades in to they got this happened that this happened So it's it's hard to tell the scale of the scope in less They're going to be really transparent about which trades are gonna to revoke and why Yeah, and were you what were you trying to withdraw that those Or I Happened was when I placed this trade order I was basically clicking over and over again and getting you know trades not be executed right now When I didn't think any of them went through And then the whole site died for a few seconds. I refreshed. I looked at my history I showed you know that I had just bought more than 250,000 coins and Everybody in IRC was sort of talking about, you know, what happened why you know, what's going on Combined with the fact that the there was a lot of security concerns recently I was at the very least had doubts whether the whole site had just been hacked and someone was trying to empty everything Not just one account of the whole thing so Initially, I tried to withdraw a substantial portion of that just it that were safe keeping it's nothing else and That $1,000 limit kicked in and stopped me. I didn't get very much out at all and Decided that point that even though there may have been some ways I could have Evaded that and still went through the whole thing. I thought that would look very suspicious, you know And that's I didn't want anyone to think I was responsible for the whole crash anyway So I should be you know, not do anything even slightly shady. So I just left it all in there untouched so that when Homer heads were around we figured what happened, right? When calmer heads prevail, okay I know there's a huge Debate going on about rollback or don't rollback and all that and it's it's a very Disconcerting because I mean obviously everyone's biased to one degree or another I guess unless they didn't have anything at all in But everyone either benefited or or well, I shouldn't say that not everybody benefited or lost but a lot of people have strong opinions about it because they don't want their transactions to be reversed You know, I think I kind of expected people to come down Kind of hard on on you because that's what people do especially in forums on the interwebs, but the You know, obviously, you know, you got a five million dollars worth of Bitcoin and for a penny a piece I mean who wouldn't like that that would be a happy day I guess you're probably jumping up and down around the house for at least for a few minutes Oh, he was near for a tap for a moment near heart attack. Yeah, like we won the lottery. It was an interesting moment And you know one point I can make too is that Very few people I think have been negatively impacted by this in any way Definitely whoever's account that these came out of it if what they're saying is true It all came out of one account that guy got a really rough deal, right? I think Mount Docs is going to get a really rough deal because a lot of trust in them has been shattered and You know, this is going to really affect their business, I think as for Day-to-day people that customers using the exchange. I don't think there are very many people who can say they actually Were because this happened people who had orders to buy Chicken at place most of these orders well before this had happened and had already basically committed to buy at that price And because the system was so overloaded there were very few people even able to panic sell if they wanted to so I think only the people who really been Substantially harmed in this, you know where you actually point to a number and say this is how many dollars this people this person lost was whoever's account had eight million dollars in it sitting there to start with and What effect this is going to have on the Mount Docs economy going forward. Mm-hmm. Wow. I think also, I mean Specifically, I guess like you're saying maybe no one monetarily But the whole community as a whole is being affected obviously because no one's 90 percent of the trades are going through Mount Docs and No one's able to do that right now. So It's at a standstill What I think one of the other issues that I think is being overlooked right now Regardless of how this affects me if they're going to start setting a precedent where if they feel something Improper happened without really having fixed policies that everyone can point to and go yeah, I agreed to It's going to make it very difficult for people to trust Putting money leading money in their account there. We're just going to really harm liquidity, you know if I have to be panicked about Could a trade I just made that doubled my money get reversed an hour later I'm going to pull my money out after every trade right and if everybody is doing that and it takes so long to put money back in Liquidity is really going to dry up in any exchange that doesn't have a policy of We won't do a do a rollback in less x y and z happen and everyone agrees to begin with because If this is the norm and this is going to be the status quo going forward where they're going to arbitrarily reverse things with behind the scenes decisions happening and no one really knowing what's going on Personally, even if I was not involved in this, I don't know that I feel comfortable keeping my money in there anymore, right? Yeah, I mean I think that I don't I don't think that would be the norm, but I as anything in its infancy.  So I guess it's just playing it by ear Definitely, you know and Other questions that come up too, like, you know, where do they draw the line? If I have an account tomorrow that five bitcoins get hacked from are they going to refer for me because I lost five You know, if not, where do they draw the line? You know, are they doing this because they're claiming some responsibility for what happened not because it was my mistake And if they were claiming responsibility for it, should they be forced to honor these trades then All right How would you feel if it had been the other way around? Say you had five or ten million dollars in In mount gox because you were doing a big trade Or you were doing a trade over time and you had to have that those dollars there or there's bitcoin there Or you had made so much money Which is probably likely you'd made so much money by the increase in the value And you're only able to get a thousand dollars a day out because you don't want to You know facture id To mount gox if you have all this wealth stored in there and you're whittling away trying to get it out And all of a sudden your account was hacked because you put your wife's name and birthday as your password How would you feel today? What would you be saying today if that hadn't been the other way around? I mean, I guess hindsight is a lot clearer than knowing what I do. It does not happen But to me if I was dealing in highly convertible very difficult to reverse currency I would not store on a public website if I was dealing with eight million dollars worth I don't care Who was running it? You know one of the the tenants of bitcoin is that it's cryptographically secure If I have bitcoins in my wallet Unless someone gets possession of my wallet file, they can't touch it But if I'm storing bitcoins on a site like mount gox That's on a computer connected to the internet that's letting random people tell it to do things I don't think I would ever put myself in that situation to begin with. I'm not saying if this guy's fault But even then if I had to I would have the most epic password you have ever seen If it was what's standing between me and someone taking my eight million dollars Right. Well, I mean, but on the other hand, you know We have to remember that at mount gox you can only withdraw a thousand dollars a day And up to ten thousand dollars a month anonymously. So a lot of people are kind of stuck in this trap Of not being able to get it out You can get you know bitcoins you can transfer out any amount you want and you ask them to The bitcoin transfer limit just by asking. Well, maybe but that's not published and people don't know that Well, no, I have That was part of I went through the the procedure to have the cash withdrawal limit for myself Great because I was bumping into it. Mm-hmm And one of the things he asked was do you want to up your bitcoin withdrawal limit as well? You can just tell me whatever you want to set that to and I'll do it Right And I know other big traders are doing the same thing as well where you know A thousand dollars worth of bitcoins a day for people that are trading in massive amounts. That's nothing right Yeah, you know, I Again, I can't speculate on what the intentions were of the person who had this account But I'm definitely curious as to Why you know, I think I think I want to know that more than anything Why did somebody have 500,000 plus bitcoins stored on a public website? Yeah, well, I can say I know a lot of people who don't know that it's possible to You know send any a personal email to Um, you know to mark and ask him to raise that limit I mean, it's a lot of these things are not on the website. They're not public So they're just all they do is try and it says no you can't You try it tells you to email them to have a grade It's what happens when you try to receive that limit that it says just hit limit x Please email this special address to ask to have it removed when I did that to have my my limit changed I am emailed back a couple hours later asking for photo ID and right for bank. Yes. Do you got it? And did you get an email like that? That asked me where I wanted to change my limits to So the way I found out from it was by hitting you right Hmm by hitting it Oh because okay, are you sure that because we've hit that limit before are you sure you're getting you get an Email saying that you can raise the line. No, no when you try to withdraw it It tells you send an email to this address and then when you send an email you get a response back like what you said Okay, I got you when you try to withdraw more in a certain amount an email address appears It tells you to email that address to have your limit changed Okay, so anyway, but I mean if we assume that this is the case that the guy just didn't know people are very busy And they you know they barely know what's happening day to day If he just if he had it in there, he's busy and he he ran into this thing and he got oh It's an email I got to do something and he never got around to it and he you know He trusts mount gox mount after all it's the number one trade site 90% of all the trades happen through mount gox If he's trusting the site, he's got his money there You know, maybe he you know a lot of people have their money in mount gox and trade hill and Mybitcoin.com and all these web based Cloud based services and they're just trusting That it's going to be there because everybody else has their money there But if if they you know if this is by the way, what I tell you the audience If you have a password that's not secure and unique you need to change it Of course, you can't do it right now the site's down But on anything whether it's my bitcoin or mount or trade hill or mount gox or anything You have to use a unique password. So Make sure that it's long and then it's unique it should be like scrambled letters and numbers I use this thing called key pass x was that what it's called the key pass x. It's free It's free open source software, but uh google key pass x k is k e e p a s s x all one word And it's an awesome little uh, they're not a sponsor or anything But it's an awesome little free tool that will organize all your passwords But you must have a unique password for mount gox. You have to have a unique password for trade hill You have to have a unique password for your email everything needs to be unique and it needs to be long At least 12 to 16 random letters and numbers I have uh, you can have it set to always include numbers letters. You can make a lower case You can make them uh, if you add one symbol it makes it nearly unhackable But I would say like 16 characters long and this little tool will help you because you just click a button copy It paste it right in and keep your passwords secure, but anybody you had A uh password that they used on mount gox that they also used on my bitcoin Or their email or anything else you're probably already hacked You've got to go in and change your password immediately and verify that google apparently knows Was made aware that this uh email list with login ids and passwords got uh hacked and Disclosed on the internet so they've already uh forced a reset on everybody's gmail account I know I got that when I went to log on it said you you suspicious activity Give us a new password. So that's a good thing that that's happening All right. Now. This is probably a good time to uh take just a moment Again and thank our sponsors because without our sponsors We wouldn't be here to tell you the story and I got to tell you this at 10 p.m. Eastern time tonight, which I think is 2 a.m What is it you see you you tc you tc gm gm t whatever it's called 2 a.m. Tomorrow GMT which is 10 p.m. Eastern time tonight. We're going to have mark Mark how do you say this name car palace mark car palace who is the owner of mount gox? On live with us here. So join us live tonight at 10 p.m. Eastern and For an hour and we're going to chat with mark directly and you'll be able to ask your questions in the chat room And we will ask him on the air and hopefully get to the bottom of all these questions and conspiracy theories and so on But first let me take a moment and thank ambivert creative Ambivert creative is uh, it's a m b i v e r t ambivert creative dot com they create your your corporate identity You're a geek you create this amazing website product service whatever it is that you're selling And you need a really cool looking logo and with colors and you know theme and style and all that They will create your corporate identity including your your website your logo your business cards your stationery your whole corporate identity Ambivert creative. They're awesome. Of course they accept bitcoin who doesn't right And bitcoin bonus bitcoin bonus is amazing before they became a sponsor I was getting people calling me telling me how you heard of this thing. Of course i've heard of it And my friend daryl started it in dc. It's an amazing little thing It's called bitcoin bonus dot com all the shopping you do online Even if it's you know best buy dot com all the big big name dot coms all the stuff you're buying anyway Web hosting i guarantee you the stuff that you're buying right now is already there You go there click the link for it on bitcoin bonus dot com And you will get paid back in bitcoin for just making the purchases you're going to make anyway So check out bitcoin bonus dot com Next blue canary night light Blue canary night light dot com. It's an amazing little thing. They sell one thing It's a nightlight, but it's so cool. It's this beautiful little blue nightlight Glows kind of a blue purplish blue color and It's a really cool couple who created this thing for their daughter And there's a song about it and so on but anyway Check it out. You you'll take one look at it, and you'll fall in love with it And you can buy it with a bitcoin so oh maybe more than one bitcoin maybe less than one now Anyway, uh, check it out blue canary night light dot com and finally trade hill dot com Of course trade hill is the new kid on the block as far as online automated exchange sites And trade hill is awesome. They've got the full featured Many many currencies many many ways to get your money in get your money out They don't have any limits on withdrawals. They have What else all kinds of new services that are coming soon like options and so on There's also many ways to get it out and are coming where you can actually shop online As I was saying you can put in the product and buy from all these major.coms with your bitcoins directly All in one transaction So check it out and you get 10 off of all trades for life on trade hill dot com If you use the referral code for the bitcoin show, which is th-r 141 That's th like trade hill dash r as in referral code 141 th dash r 141 So thanks to our sponsors if it weren't for them we wouldn't be here and um so Back to our questions What do you got ed well a lot of people on the on the chat room i'm reading are Saying that by them by mount gox rolling back it's like the same as saying a bailout or fiat currency And um, you know, I understand where they're coming from because of the bad taste in everyone's mouth with our current uh financial system, but um I I don't know what's fair and I don't know the whole story. So I'm deferring my My true opinion until I know the whole story because I always think there's like three or four sides to each story and um and so uh Do you think the same way that it's rolling back is is really not the president? I think you might have mentioned that before right um, I guess One of the concerns I have with this now too is is basically that it's If if we're allowing this third party to exhibit more control over the whole bitcoin economy than we originally thought they had That really changes the dynamics of everything here, you know How how much that affects things? I have no idea. I don't think anyone's going to be able to tell us that until the market's reopened but you know giving a significant control of Who is allowed to have what trades occur To a third party does change the dynamics. I'm I I you know, I can't tell you what effect that will have Yeah, well, I know that in like the new york stock exchange. This is I don't know how common it is, but it's not uncommon for them to roll back You know trades because by the time they figure out that there is a mistake Then they have to do that. There's no real other way to do it So it's not perfect, but it's maybe the best way one of the analogies I've read is you know If somebody, uh, you know breaks into someone's house and they steal a bunch of uh jewelry or something and then they go and You know sell it and they set up a whatever they sell it on craigslist And you happen to be the lucky buyer who buys this jewelry at a bargain It's not really a defense that well, this was a fair transaction because it's considered stolen goods Obviously, it's really easy to identify that that happened. And so if you're possessing stolen goods, even if you did buy it It's uh, you don't get to keep it.  Do you would you consider? I mean, do you think that's a valid argument to say you bought these fair and square on the exchange site? But you actually bought it from the Criminal who hacked into somebody's account.  That's a really complicated question. Um And I have had so many armchair lawyers and real lawyers been trying to give me advice over the last few days As to exactly the answer to that question and the answer is I don't know Um, there are some who definitely believe that this is would be considered stolen goods And there are some who believe that this isn't a case of anything being stolen It is just that mount goch sold me Bitcoins that they didn't have a buyer or a seller that was wanting to sell those So they made a sale to me that they didn't have a you know, it wasn't backed by legitimate order from somebody else and I accept, you know, I accepted the trade and They are responsible for that whether that's true or not, too.  There are rollbacks and broken trades and things that happen constantly You know, some some traders say that a significant portion of every trade they make gets rolled back because of some error here or there And in principle, I'm completely okay with the idea of things being rolled back What I'm I'm not okay with is for things to be rolled back with no clear policy as to why and not even the understanding that everyone went into with it that rollbacks were going to even be a possibility So, you know, there's kind of kind of a two-part answer there, but I think a lot of things are we didn't know our possibility are happening because this used to be just a penny little game It was almost it was an experimental almost like a video game multiplayer game For pennies and it was just we were just playing With play money, you know, literally pocket change now suddenly it's a multimillion dollar market and it's real Serious money and all of us and I mean we're getting what we asked for it's unregulated. It's decentralized. There's no authority So it's kind of like the wild wild west. It's really by our beware I get questions constantly We're kind of torn in between Wanting some of the same real world protection that we have for tangible goods in real life or traditional stock exchanges or markets But at the same time we're still wanting the other side of the coin where we have unregulated mess that we also want And where we decided to make that line come down is going to I think dictate the future bitcoins The um for those people who are just arriving late um, we're speaking to Kevin Day, who's live with us via Skype from Chicago, Illinois Kevin is the the gentleman who just happened to click buy at the right time Won the lottery the bitcoin lottery on mount gox. He actually bought Basically at the going rate at the time 17 something 1750 something He bought the equivalent of five million dollars worth of bitcoin for a penny a piece And um, he is not in favor of a rollback Who would be but um, I think you understand that um you know Did it I think you kind of see both sides like you you feel like um Tell me if i'm wrong, but tell me if i'm expressing your sentiment correctly that you feel that um You understand that you don't expect to keep five million dollars worth of bitcoin Maybe but you feel like this really wasn't fair to you either even though I mean to be to be able to make this purchase and then have it like oh never mind You're losing the whole bitcoin community is going to lose a lot of trust in exchanges If this can just happen on a whim you purchase and you get a good deal I mean you it goes bitcoin drops to ten dollars and you buy a whole bunch and then a day later They say oh oops me made a mistake. We're going to restore from the backups and oh and you don't have any bitcoin That you know, right? I mean if there was a clear line That someone had given out before this point that said, you know, here's where we will do rollbacks I would have no problem with it. You know, I either agree with that and use mouth gosh where I would disagree with that and go somewhere else um The the issue that I think a lot of people are having right now is just the the uncertainty that this is added everyone Just I think before this one assumed us to the trade the trade is done. There is no going back. There's no, you know and It's a little weird in that the The scenario they're trying to play out now with the rollback The buyer is basically going to get most if not all of everything they had back mount gox is going to have pretty much Very little in the way of responsibility for this The only people who are going to come away from this negatively were the people who had buyers executed that got canceled and there are probably a lot of you out there saying well, that's how it should be and If that's all we had agreed to to begin with then I would be completely okay with that what I'm you know What I don't like I guess is the the uncertainty factor This is thrown into everything now, you know Am I going to have to wait 10 days before I spend any bitcoins before I spend the microwave a day an hour? You know, where did that line just get moved? Right. Let me ask a lot of people are asking this. I know that you already told me this but for the audience After this trade happened, how many bitcoins or dollars did you withdraw? I got 643 bitcoins That's true that I am holding on to and not touching until we decide what's going to happen with this But I ended up with 643 which I think is One other point I was hoping to make publicly here too was that Some of the statements that mount gox has been making about exactly what has happened is this Well, I'm not at all implying they are not being truthful I don't know that they're explaining it the way that people are understanding what happened You know the statement that's been on the mount gox website since this happened has said You know the the hacker is the one who compromised an account sold all the bitcoins Bought them all again and then tried to withdraw them And while I don't know that this is what they intended to say I think anybody who reads that sentence is going to think that this hacker is the one who made this gigantic buy not me Right, and that's how they are justifying doing the rollback is that that's the only way they can prevent This hacker from benefiting from this unless you are the hacker then that's very misleading To say the least I'm here showing my face showing my name Well, maybe it's true what they say this really is the world's stupidest hacker You're getting on television and telling telling the world you did this, but you didn't do this. We'll make it clear You didn't do this I just got lucky in pressing, you know, that's it. That's all I did. I was lucky timing I had nothing to do with crash and you know one of the points I'd like to make too was I could have caused another crash If I really wanted to withdraw this whole thing After the crash happened, there was only like maybe a hundred bitcoins that I needed to to sell as humundous loss To crash the market again And then I would have been well under the $1,000 width a day limit and I could have taken the whole thing out And I didn't do that. Why didn't you do that? I just to be honest I thought that if I did that for one nobody would believe me. I wasn't responsible for it And second, I was really worried about what effect that would have on the whole community I have a stake in all this too And I was you know, honestly could not predict what that would happen and Was pretty much going to defer to the mount bounce people for how to proceed Never assuming that this was going to be one of their possibilities they were going to go forward with Wow, your brain must have been like smoking all these thoughts spinning around in your mind And you and you talk it over with your family and did you ask them what they think or did you do this all on your own? It was all pretty much happening too quickly to really do anything You know It was one of those we didn't know what was going to stop or how long it was going to take and we all were just sort of Watching what was happening going If we're going to do something, let's do it quick So I sort of did this on my own just watching what everybody else was saying in the chat room and went with it You know, I haven't heard I maybe had a touch maybe the chat room can fill us in I haven't really been reading any comments from anybody saying that they That they lost bitcoin, of course, we don't they probably don't know yet because they can't log into mount gox and see that's what's the problem of course, but They would have received a trade confirmation email if they had you know, I don't get this do we get the email So I think if someone was getting a bunch of email reports, they didn't expect I'm assuming would have heard about that by now How do you I don't even know about that because I we're in mount gox And I don't do we get a trade confirmation email when we do a trade? I don't think so. Is that an option you can turn on or something? We have an email address on our account and I don't think we've ever received a trade Confirmation from them though. Maybe it's just something that they implemented with newer Users or maybe it's an option that you selected somewhere. I don't remember ever getting a trade confirmation I heard somebody say that too, but I don't think we I mean we we've used it quite a bit We never received an email confirmation. So I know on my gmail account They were going straight to my spam box until I started unflagging them. So maybe Honestly, I don't know. I don't remember turning something on for that But I remember going into my spam box one day and seeing all those emails and had to manually tell it Not to and then that went on I've seen yeah, there's a lot of speculation reading in the in the forums You know the million million and one conspiracy theories coming out of the woodwork and you know people talk about how If the hacker had full access to the entire The entire machine obviously they wouldn't have had to do any of this They would just withdraw all the bitcoins directly if they had access to the machine and they could control it So obviously he must have whoever he she had the hacker was Um had full had access to the accounts and maybe was able to brute force apparently probably brute force the password and get into At least one account. Probably the one what seems to have happened and again, but this is this is a lot of speculation here, but um according to some of the statements that mount ox has made as an auditor was auditing some of their books Had access to their their database in a read only fashion And apparently was only supposed to be looking at certain things only verifying some numbers just You know, they've been going through some efforts to try to become more legal in certain areas and be registered in that sort of thing They were trying to have their books in a word before they did that and This auditor got their personal computer broken into in some way So somebody broke into the auditor's computer who then used that information to connect to the mount cop server And was able to get a copy of every username email address and encrypted password and While the passwords were encrypted It's becoming trivial now to be able to basically just try every possible password and see Which one produces the same encrypted mess that was stored in the file? And I think almost probably as a worst possible case here Using computer video cards is one of the best ways of doing that and this group here Everyone who's doing bitcoin mining has continued with massive numbers of video cards in them So anybody here could have launched this gigantic attack against these encrypted passwords Very very quickly. Wow Now there were people the moment it got leaked on IRC Running them through a scanner and coming up with some of the very simple passwords within seconds Wow, it's amazing. So this again, I'm going to repeat this to the audience Change your passwords. Do not ever use the same password for two things Make sure your passwords are 16 characters at long and your passwords should look like a bitcoin address You understand it should be letters numbers Symbols those little tilde things you can't remember it. It's okay Use free software like key pass x to manage all your passwords under one locked encrypted file And you can use it on your key pass x has a there's a key pass droid Um app that's free for your phone And you can have that file on your drop box use drop box and you've got that It's very convenient. You can also do it on you know mac windows and ubuntu linux So there's no excuse people. You've got to have a unique password for everything I don't care how inconvenient you might think it is We're not talking about email anymore and spreadsheets. We're talking about money So you've got to keep it locked up with a secure password and don't use the same password for two different things This is something yet and I have gone around around about I want a convenient password I don't have to look it up. Well, don't be lazy. Don't be lazy. This is money here And look what happened, you know, you can an investment of Five or ten thousand dollars or who knows how much can turn into a million dollars Or ten million dollars, whatever the case may be and you still have that lame little You know password that's your dog's name and your wife's anniversary. That is not cool You're going to lose it all So um and don't ever use the same password for two things. Yeah, there's a question here for kevin from the chat room If there is a rollback, uh, if it goes through the do you plan on taking legal action? And if and if so, are you afraid how legal action could affect bitcoin's value and government involvement? That's actually a really good question. I've had so many lawyers offering to represent me of this That I have just basically told them all back off. Um, the advice I'm getting right now Is to immediately filing junction preventing mount auction doing anything because One of the things that is kind of considered a Uh a principle of how exchanges work is once a rollback is executed and trading his resume You cannot do a double undo, you know, there's no going back a second time Right So even if I were able to I'm not at all saying I'm going to do this But even if I were to sue these guys win and say, you know, I won this judgment They can't go back however long that's going to take and redo it so I don't think there are there are really many legal options I have that wouldn't completely trash the economy because I think even just You know me going oh, I'm going to get an injunction place against mount gox would trash the economy instantly everyone pull all their money out And liquidity would fall to nothing and that would be the end of it, you know um So I don't if you want those cases where even if I won I would have lost because the bitcoins would be worth nothing at that point All right, so yeah, I mean you can you can it's kind of like uh crossing Crossing the crosswalk on green with us with a a speeding taxi and coming the other way you can be dead right and dead You know so you can end up with all the bitcoins in the world, but then they're worthless if the whole market is trash So obviously everyone's interest is in protecting the bitcoin The bitcoin, you know economy the whole entire bit bitcoin itself So at this point Okay, so we we we get the picture sort of Unfolding and evolving in front of our eyes as to what pieces are coming together about what happened here um There's obviously a lot of lessons for everyone involved both customers of the exchange sites, um ordinary people Um buyer sellers and all that and the exchange sites themselves mount gox I'm sure has about 300 things that they've learned from this And uh trade hill and all the others have too So, um, I guess the question is Now that you have explained what has happened and and your your point of view and your situation and what and all that What would you ask mount gox to do? What would you have them do? To be honest, first I would like some more transparency in what's going on You know one of the things that really bugged me is that within minutes of Of mark logging on to irc and seeing what happened one of his first reactions was to say we're rolling it all back Which seemed to me like a very abrupt decision that happened before there was really enough evidence disabled going on So I'd like to kind of know how they for this decision And really what happened because he's he's telling a lot of people basically, you know If we look at the total amount of money that was sold that's roughly 10 million dollars that was spread across You know 100 people He's asking all those people to give that up without really Telling them why they're doing that, you know, he's saying it's still a count. He hasn't really Come forward with any of it that I completely understand. He's got he's got things to do right now You know, I've been trying really hard to let him have some space to do that Before I'm all over him going. Hey, what about me? What about me? You know, I I think the longer that the exchange is down the worse Things are going to be for everybody So until things, you know, until he's here to the point where okay, we're going to get things back up now That's what I want to talk to him about what's going on Right. Yeah, this brings up a you know, we've talked about this before but it brings up a good question as far as Like a free open source exchange software software as opposed to a proprietary and will that I might show my ignorance here, but would that help any at all? Do you think if if we had more of a free open transparency type of software? I think that would that would be a first step I think still no matter what as long as there's somebody who's running it Who feels that they can go in and manually change the database to undo something they didn't agree with That's still a problem, you know, and I think that's really counter towards how bitcoin works You know, if I give you bitcoins, there is nothing I can do To undo that later, you know, so I think that's we need to come up with some kind of exchange system Where the exchange works under similar principles, you know, it's all cryptographically signed. It's all You know mathematically proven that once something's done, it's not undone To at least make me feel more secure about this because It's kind of shaking my face a lot of things, you know Yeah So I mean in general Do you okay if you were running an exchange site, would you I know that you're saying that if if you are going to do rollbacks Then you should announce that that is a possibility if you were running an exchange site, would you post that rollbacks are a possibility and under what conditions would you Say that rollbacks should should happen I'm I'm not supposed to get you rollbacks at all actually, you know, if I were running a site like this I would I would probably very clearly have something but at the same time I don't know if I would have my rollback policy to include something where if the exchange was Partially or fully at fault That I wouldn't cover those it's just trades And I think it's gonna be really hard for mount docks to later say that they had no responsibility in this happening whatsoever Mm-hmm So that's kind of where where I would be in that situation I would probably allow rollbacks, but with some very very clear policies up front and how like Like what what would the policies be though? Like I mean well two things two parts to this question I guess what would under what conditions or there's would there's be a certain type of condition that you would want that You would say rollbacks would be necessary and also do you really think that it's mount docks's Responsibility if they if there's a any kind of a flaw in the system or the system is hacked or whatever I mean They're a victim obviously mount docks is also a victim of the hacker as much as any more than anybody probably and Do you think that mount docks should be liable financially to make up for those losses out of their own pockets? Again, I'm really tournament because I really think mark is a good guy. I don't think he's being malicious here I don't want to say anything bad happened to him, but on the other side of that coin They're the only ones who are really able to pursue anything against this auditor to try to recover damages for you know This is someone who apparently was claiming to be some kind of professional like this Who was responsible for all this? They're the only person who could go after their liability insurance to get things reimbursed We can't do that So for some reasons they are I think they're responsible for that alone and others, you know People had been telling them for days there was a password problem and they kept reassuring everybody that everything was okay I still changed my password anyway, but You know To prevent it continually reassure the public that their exchange is secure and then later to be proved that it's not and they Probably should have known that it wasn't It's really hard for me to feel like they shouldn't have some liability in this Yeah, it's uh Some liability in this uh, which is covering it all it's the question obviously There's there's so many issues because it is unregulated. There's not uh, there's not a government Uh, you know fdic that's backing this which is a good thing. That's a feature not a bug. We all agree however You know, it is the wild wild west in a way I mean anybody can set up a bank basically anybody can set up a bitcoin bank You can set up your own my bitcoin.com or your own exchange site And for all of you who are thinking about starting your own exchange site live listen to this Pay attention and learn because it's more than just a computer and a code You got to have the uh, you got to have the the wherewithal to secure it And also to withstand a lot of stress because I always I always tell that that one thing I do not want to be involved with is Uh opm other people's money because when you're when you're managing other people's money Man, you are on the hook.  They will come after you and I really feel for mark in this situation obviously, I mean because Um, he's you know jed who founded mount gox and mark who now has taken it over our phenomenal guys and they are You know, they're they're doing a great great thing. Everybody has to agree what mount gox has done for bitcoin is Uh, really beyond compare they what they've made it strong mount gox is the price when you want to know What's a bit what a bitcoins worth? It's mount gox. So what they've contributed to the bitcoin community We have to keep that in perspective that um, it They're they're volunteers just like all of us. We're they're doing more than than probably any of us watching So the fact that we put all of our It is centralized to a certain extent And we're putting all of this burden and stress on them. They're coders. They're programmers, you know They're doing the best they can with what they've got or at least at least we hope they are But uh, basically they're holding on to other people's money And uh, it's a very risky dangerous game. So you really got to think it through It's got to be careful careful, uh, thought out process. So we're going to be doing a video in the next 10 well, yeah 10 p.m. Eastern time We're going to have mark himself from mount gox live who's going to answer all of your questions from the chat room And yeah in the next couple days, we're going to be doing a how-to video So watch for that too on only one tv.com a how-to video how to Back up and secure your bitcoins yourself on your own machine. Absolutely securely. So We're out of time we're we are out of time. So Come back and watch again at 10 p.m. Eastern time or 2 a.m. Tomorrow gmt And we'll have mark from mount gox here live to join us and thank you very much Kevin for joining us and telling your story And thanks to our sponsors who are providing this great show for you guys Absolutely, so till 10 o'clock. We'll see you then All right. Thanks for joining us