WARNING: If you voted on steemengineteam post change your keys immediately

themarkymark (78)in #security • 5 years ago (edited)

View this post on Hive: WARNING: If you voted on steemengineteam post change your keys immediately

5 years ago in #security by themarkymark (78)

Sort:

inertia (73) 5 years ago

Note: changing your keys might not be enough if you have authorized apps to use your account. You must revoke the app in order to keep them from using your vote.

https://beta.steemconnect.com/auths

$0.88

16 votes

[-]

themarkymark (78) 5 years ago

Thanks for bringing that up. Right now it is unsure if they have keys or using a posting authority.

It doesn’t appear they have their own authority and are either using someone else’s they has access to or more likely using actual posting keys farmed via an app or accidentally leaked.

$0.27

6 votes

[-]

smooms (61) 5 years ago

They don't use steemconnect. I signed up to check and you have to enter your posting key onto the side. It's probably saved into their own DB. So everyone who is affected by these fuckers should change his/her keys asap.

$0.00

1 vote

[-]

mahdiyari (67) 5 years ago

Maybe not related to this case but it's always good to review what apps are authorized to your account.

$0.00

2 votes

[-]

condeas (62) 5 years ago (edited)

This app is not listed there.

Please excuse the editing.
In this app, the private key was saved directly on the website :-(

$0.00

[-]

torico (63) 5 years ago

good idea just to review this in general. i have granted access to a ton of apps that arent even valid anymore. thats ending. tx

$0.00

[-]

isaria (74) 5 years ago

Good point....just revoked a bunch

$0.00

[-]

abh12345 (76) 5 years ago

A list of accounts that have voted for @steemengineteam

https://hackmd.io/BHJJ32OVQQyxf9K8MTzcbQ

Might be quicker to check than logging on to alt accounts. (Ctrl+F to search)

Thanks for the heads-up.

$0.68

13 votes

[-]

isaria (74) 5 years ago

Thanks for putting that list together

$0.02

2 votes

[-]

abh12345 (76) 5 years ago

Glad it is of use :) I didn't fancy logging into 10 alts to see if they'd voted somewhere!

$0.00

[-]

kaerpediem (70) 5 years ago

Phew!! Not on the list...
Thank you :)

$0.00

[-]

abh12345 (76) 5 years ago

Bravo :D

$0.00

[-]

mytechtrail (59) 5 years ago

I am on your list and have changed my password, but cannot find a vote for that post thru steemworld.org or https://steemd.com/ireland/@steemengineteam/ireland-its-time-to-hop-aboard-the-steemengine-2019-10-19

How did you get the names on your list?

$0.00

[-]

abh12345 (76) 5 years ago

I used @steemsql and checked every vote to the account, not just the post above.

$0.00

[-]

mytechtrail (59) 5 years ago

Thanks for the reply and for using your access to SteemSQL to run the query. Do you know of another way I could look for the posts my account voted for?

$0.00

[-]

abh12345 (76) 5 years ago

There used to be a couple of places but they seem not to be running now.

$0.00

[-]

thekitchenfairy (71) 5 years ago

same here @mytechtrail. Via Asher's link I am on the list of voters, but on steemworld and steemd, my name didnt show up

$0.00

[-]

abh12345 (76) 5 years ago

mytechtrail https://steemit.com/@steemengineteam\philippines-its-time-to-hop-aboard-the-steemengine

mytechtrail https://steemit.com/@steemengineteam\croatia-its-time-to-hop-aboard-the-steemengine

thekitchenfairy https://steemit.com/@steemengineteam\steemengine-stats---2019-06-14

thekitchenfairy https://steemit.com/@steemengineteam\vienna-its-time-to-hop-aboard-the-steemengine-2019-10-20

Two each :)

$0.00

[-]

thekitchenfairy (71) 5 years ago (edited)

For Vienna, i downvoted it manually earlier

And for the 3rd link you gave, it was manually too

What am talking about is the Ireland post where my name is listed as voter on your list, yet am not on steemworld and steemd for that Ireland post. So thats the odd one.

$0.00

[-]

abh12345 (76) 5 years ago

Then you must be in the clear :)

The list was all votes on the account, with number of votes next to each account.

Apologies for the confusion.

$0.00

[-]

macchiata (70) 5 years ago

Does this mean that those who are included have been infected?

$0.00

[-]

abh12345 (76) 5 years ago

I would change your keys to be safe.

Don't forget to back them up.

$0.00

[-]

viking-ventures (69) 5 years ago

Thanks. Unfortunately, I'm on the list.

$0.00

[-]

abh12345 (76) 5 years ago

If you choose to change your keys, which i think is being advised, don't forget to make an offline copy.

$0.00

[-]

viking-ventures (69) 5 years ago

Already done. It's on files on USB and printed out. :-)
Thanks so much for your help on this.

$0.00

[-]

always1success (76) 5 years ago

Thanks!

$0.00

[-]

abh12345 (76) 5 years ago

$0.00

[-]

joanstewart (65) 5 years ago

Thanks for list @abh123454, helped to do quick check.

Big thanks to @themarkymark for head up on this.

$0.00

[-]

dedicatedguy (74) 5 years ago (edited)

My name is on that list but I don't see any vote going out from my account to that post in, I just checked the last 3 days using steemworld. The only votes are the ones I just did manually (4% and then back to 0%). Why is my username on that list if no vote came out from my account? @abh12345?

Edit: I think I know why my account is on that list, because I voted them in the past. But I haven't vote in their posts in months perhaps even more than a year.

$0.00

[-]

abh12345 (76) 5 years ago

Yes that is the reason and you have likely changed your keys and/or removed authority so should be good.

$0.00

[-]

gaich (59) 5 years ago

Thank you! !BEER

$0.00

[-]

beerlover (62) 5 years ago

^{View or trade BEER.}

Hey @abh12345, here is a little bit of BEER for you. Enjoy it!

$0.00

[-]

luvlylady (56) 5 years ago

Freaky stuff I tell ya. That list is long.

Posted using Partiko Android

$0.00

[-]

rishi556 (62) 5 years ago

Realized how little I use steemconnect now due to steemkeychain. Time to revoke most of the apps.

$0.27

1 vote

[-]

crokkon (68) 5 years ago (edited)

$0.16

5 votes

[-]

themarkymark (78) 5 years ago

I saw that but it is obviously storing keys as it used votes from people who have not logged in a long time.

$0.00

[-]

viking-ventures (69) 5 years ago

I didn't sign up to autovote for them...

$0.00

[-]

crokkon (68) 5 years ago (edited)

$0.00

1 vote

[-]

viking-ventures (69) 5 years ago

I'm not linked to their Steem account - just their official steem-engine.com site. I'm not autovoting them (I double checked.) It would also appear - looking at the Steem account mentioned above - that these people are trying to do a serious phishing scam.

Not trying to be argumentative, just trying to help those who are trying to figure out the leak.

$0.00

[-]

crokkon (68) 5 years ago (edited)

$0.00

1 vote

[-]

viking-ventures (69) 5 years ago

I didn't think so.
But your previous comment was very confusing to me then. I haven't linked an account with them...

$0.00

[-]

shauner (57) 5 years ago

I agree. It isn't a leak... it's their business model of defaulted autocuration vote trading.

Posted using Partiko Android

$0.00

[-]

raymondspeaks (69) 5 years ago

I'm going to share this post in the neoxian discord. Thanks for the heads up. Luckily my vote wasn't used.

$0.02

2 votes

[-]

torico (63) 5 years ago

who was that guy who screwed over CC? gotta wonder if he had a few alts...

$0.00

1 vote

[-]

isaria (74) 5 years ago

ali-h

$0.00

[-]

torico (63) 5 years ago

yah that shtcnt as cope would say...

$0.00

[-]

emrebeyler (74) 5 years ago (edited)

Seems like upvotes are mostly done with the users of this application, directly with the users' keys. Regarding the app accounts, here are the most common apps authorized amongst upvoters (2810)

[('busy.app', 1199), 
('steemauto', 727),
 ('dtube.app', 688), 
('steem.app', 615),
 ('dmania.app', 552), 
('dlive.app', 530), 
('bottracker.app', 441), 
('steemhunt.com', 358), 
('partiko-steemcon', 350), 
('utopian.app', 289)]

This information itself doesn't point anything exactly, though. I was curious, here is the data for others also.

$0.00

1 vote

[-]

viking-ventures (69) 5 years ago

okay - the only one of those I use is SteemAuto. I just checked that one too (changing keys, etc, with SteemConnect as well...) I didn't have any unauthorized autovotes.

$0.00

[-]