There is spam happening involving usage of this project/script

[Flyingmana]

I got this Mail.

Vincent highground.ou@gmail.com über sendgrid.net | Vincent highground.ou@gmail.com über sendgrid.net | 19:11 (vor 2 Stunden) |   |  

Vincent highground.ou@gmail.com [über](https://support.google.com/mail/answer/1311182?hl=de) sendgrid.net 19:11 (vor 2 Stunden) an mich

Hello,

I hope this message finds you well. I am reaching out to inquire about the possibility of purchasing a proof from you using your GitHub account: https://github.com/Flyingmana

I am willing to offer $500 in exchange for your assistance in generating the requested proof. It involves downloading a repo and running a simple python script that proves the ownership of your github account.The script is fully open sourced and the link is https://github.com/fluencelabs/dev-rewards

If you are not sure about receiving the money, I can pay you first for the half amount, which is $250. After you've sent me the proof I can send you the remaining half. The price is negotiable. I can do paypal, venmo, crypto or any other payment method you would like.

If you are interested in this proposal, please let me know, and we can discuss the details further. I believe this collaboration could be mutually beneficial.

Thank you for considering my offer. I look forward to your response.

Best regards,
Vincent
Vincent
1301 Terminal Pl, San Mateo, CA 94401

[Elara6331]

I also received an email like this and I've reported it to SendGrid, so they'll hopefully suspend the account that was used to send this, but the spammers will likely figure out a different way to send their emails in the future, so this project should definitely mention the spam somewhere in its README so that people don't fall for it.

[Guri-X]

I have also received this same spam email.

[ElvisKrop]

I also received an email like this and I've reported it to SendGrid, so they'll hopefully suspend the account that was used to send this, but the spammers will likely figure out a different way to send their emails in the future, so this project should definitely mention the spam somewhere in its README so that people don't fall for it.

Definitely a good idea!

[Fil]

I've been getting several of these emails, which are obviously scammers. However for "transparency" they redirect to this repo, which leaves me confused. If this project is legit, what does it do, and what is the scammers' plan.

[FDiskas]

No free energy and no free money 🤑
Report to github thous repositories

[FWDekker]

@Fil From my limited understanding, Fluence is launching a cryptocurrency token, so Fluence (randomly?) selected a bunch of GitHub accounts to give 5000 of those tokens to. Of course, using OAuth would be too easy and secure, so instead they created their own system, but they didn't add mutual authentication, so if a scammer intercepts the communication (or deceives you into communicating with them) they can pretend to be you and get your tokens.

Warning

Even if you don't care about these tokens and would be happy to sell them, don't give your bank account number or other payment details to random people on the Internet.

I think Fluence's authentication method works as follows. Fluence took the public SSH keys of the selected users and used those to encrypt some secret data, and uploaded those encrypted pieces of data to a public location. If (and only if) you have the corresponding SSH private key, you can decrypt the data, and with that you can create a proof validating your ownership. This repository is a tool that automates the user-side part of it and spits out a proof if you give it your SSH private key. You can then upload this proof at https://claim.fluence.network/ (don't sue me if that's the wrong link, verify it yourself) to claim the tokens into an Ethereum wallet of your choice. Of course, if you give your proof to a scammer, they'll take your tokens instead.

Apart from lacking mutual authentication, there's a few other security flaws in their design as well. Most notably, it requires access to your private SSH key. Of course, they promise they won't abuse that privilege (you do thoroughly read all scripts before running them, right?), but they do not consider supply chain attacks (e.g. by pinning package versions with hashes). They don't even have a security policy.

[Fil]

Thanks for the explanation. I have no plans to sue you nor to run any of these scripts :)

[Guri-X]

I replied back on this email saying that i need to know more about what this code does and here is the reply I received. Make sure you look out for this phone number:

Sure, so basically I need your GitHub account to generate the proof so that I can claim for the fluence dev rewards. The code is not written by me, but the fluence labs. I selected your account based on their list of GitHub users. 

Can we chat on telegram or WhatsApp or WeChat or any other chat media? That way we can communicate better and I will send you the first half once I start chatting with you. Zoom or Google Meet also works. 

My telegram handle is xiaomaogy and my WhatsApp username is +12026643450, my WeChat is xiaomaogy88. 

[FWDekker]

I replied back on this email saying that i need to know more about what this code does and here is the reply I received. Make sure you look out for this phone number:

Sure, so basically I need your GitHub account to generate the proof so that I can claim for the fluence dev rewards. The code is not written by me, but the fluence labs. I selected your account based on their list of GitHub users. 

Can we chat on telegram or WhatsApp or WeChat or any other chat media? That way we can communicate better and I will send you the first half once I start chatting with you. Zoom or Google Meet also works. 

My telegram handle is --- and my WhatsApp username is ---, my WeChat is ---. 

Their explanation is sound, but that's usually how they get ya. But $500 for just a bunch of tokens? Well, if it sounds too good to be true, it probably is.

[xiaomaogy]

So I was the one who batch sent this email. And I'm not a scam. I did purchase proof from some people. And I will deliver the money if they send me the proof. There is a lot of speculation around the FLT so some people are willing to sell the proof for a certain amount of money, also 500 dollars is negotiable and it is a fair market.

I don't intend to run away with other people's proof without paying, so I don't think it is a scam.

[FWDekker]

So I was the one who batch sent this email. And I'm not a scam. I did purchase proof from some people. And I will deliver the money if they send me the proof. There is a lot of speculation around the FLT so some people are willing to sell the proof for a certain amount of money, also 500 dollars is negotiable and it is a fair market.

I don't intend to run away with other people's proof without paying, so I don't think it is a scam.

Yes, in hindsight, I realised it might not be a scam, since it appears that the tokens are currently valued at $1 each (and eligible people receive 5000 tokens), which explains your interest much more. (Though I still disapprove of your email not sufficiently informing people of the impact of sharing such a proof.)

That said, though, unless I misunderstand something, how is the proof useful to you if you don't also have a corresponding signature containing the address of your own Ethereum wallet?

[xiaomaogy]

By the way, if anyone here is willing to sell their proof, you can reach out to me at highground.ou@gmail.com, also you can add my telegram：xiaomaogy. I'm willing to buy the github proof if you are qualified, and the price is negotiable.

[xiaomaogy]

So I was the one who batch sent this email. And I'm not a scam. I did purchase proof from some people. And I will deliver the money if they send me the proof. There is a lot of speculation around the FLT so some people are willing to sell the proof for a certain amount of money, also 500 dollars is negotiable and it is a fair market.
I don't intend to run away with other people's proof without paying, so I don't think it is a scam.

Yes, in hindsight, I realised it might not be a scam, since it appears that the tokens are currently valued at $1 each (and eligible people receive 5000 tokens), which explains your interest much more. (Though I still disapprove of your email not sufficiently informing people of the impact of sharing such a proof.)

That said, though, unless I misunderstand something, how is the proof useful to you if you don't also have a corresponding signature containing the address of your own Ethereum wallet?

So basically I can give them an address when they generate their proof.

So the token price fluctuates, and it's hard to tell how much it would worth when it gets unlocked. There is a two month unlocking period. Also a lot of people don't have the channel to sell the token. I'm just providing another channel for them to benefit from it.

Also I think I'm doing a good thing, because of my email more developers are aware of the dev reward, and if they don't want to sell at least they can claim it by themselves, and avoid the halfing later on.

If you are bothered by my email, I'm really sorry. I don't want to scam you, but this is the only way I can reach out to people, and see if they are interested.

Again add me on telegram if you are interested in selling, my telegram handle is: xiaomaogy

[cromatikap]

So I was the one who batch sent this email. And I'm not a scam. I did purchase proof from some people. And I will deliver the money if they send me the proof. There is a lot of speculation around the FLT so some people are willing to sell the proof for a certain amount of money, also 500 dollars is negotiable and it is a fair market.

I don't intend to run away with other people's proof without paying, so I don't think it is a scam.

You got some competition, I received an email offering $700 😄

[Justman100]

@Flyingmana

Ah, so I'm not the first 😝

[Justman100]

I've seen a lot of bad scams, but this one really shoots the bird

[xiaomaogy]

So I was the one who batch sent this email. And I'm not a scam. I did purchase proof from some people. And I will deliver the money if they send me the proof. There is a lot of speculation around the FLT so some people are willing to sell the proof for a certain amount of money, also 500 dollars is negotiable and it is a fair market.
I don't intend to run away with other people's proof without paying, so I don't think it is a scam.

You got some competition, I received an email offering $700 😄

Yes, I can compete with that price. I will offer the best price on the market. Just contact me on telegram if you are interest in selling. My telegram is: xiaomaogy

[GianlucaCesari]

@Fil From my limited understanding, Fluence is launching a cryptocurrency token, so Fluence (randomly?) selected a bunch of GitHub accounts to give 5000 of those tokens to. Of course, using OAuth would be too easy and secure, so instead they created their own system, but they didn't add mutual authentication, so if a scammer intercepts the communication (or deceives you into communicating with them) they can pretend to be you and get your tokens.

Warning

Even if you don't care about these tokens and would be happy to sell them, don't give your bank account number or other payment details to random people on the Internet.

I think Fluence's authentication method works as follows. Fluence took the public SSH keys of the selected users and used those to encrypt some secret data, and uploaded those encrypted pieces of data to a public location. If (and only if) you have the corresponding SSH private key, you can decrypt the data, and with that you can create a proof validating your ownership. This repository is a tool that automates the user-side part of it and spits out a proof if you give it your SSH private key. You can then upload this proof at https://claim.fluence.network/ (don't sue me if that's the wrong link, verify it yourself) to claim the tokens into an Ethereum wallet of your choice. Of course, if you give your proof to a scammer, they'll take your tokens instead.

Apart from lacking mutual authentication, there's a few other security flaws in their design as well. Most notably, it requires access to your private SSH key. Of course, they promise they won't abuse that privilege (you do thoroughly read all scripts before running them, right?), but they do not consider supply chain attacks (e.g. by pinning package versions with hashes). They don't even have a security policy.

I mean, I think it's fairly safe to generate the proof and sell it to someone if it's done properly (payment to ETH wallet, never sending private key etc.) they will not have access to any critical information? but maybe i'm missing something?

[Flyingmana]

@Fil From my limited understanding, Fluence is launching a cryptocurrency token, so Fluence (randomly?) selected a bunch of GitHub accounts to give 5000 of those tokens to. Of course, using OAuth would be too easy and secure, so instead they created their own system, but they didn't add mutual authentication, so if a scammer intercepts the communication (or deceives you into communicating with them) they can pretend to be you and get your tokens.

Warning

Even if you don't care about these tokens and would be happy to sell them, don't give your bank account number or other payment details to random people on the Internet.

I think Fluence's authentication method works as follows. Fluence took the public SSH keys of the selected users and used those to encrypt some secret data, and uploaded those encrypted pieces of data to a public location. If (and only if) you have the corresponding SSH private key, you can decrypt the data, and with that you can create a proof validating your ownership. This repository is a tool that automates the user-side part of it and spits out a proof if you give it your SSH private key. You can then upload this proof at https://claim.fluence.network/ (don't sue me if that's the wrong link, verify it yourself) to claim the tokens into an Ethereum wallet of your choice. Of course, if you give your proof to a scammer, they'll take your tokens instead.

Apart from lacking mutual authentication, there's a few other security flaws in their design as well. Most notably, it requires access to your private SSH key. Of course, they promise they won't abuse that privilege (you do thoroughly read all scripts before running them, right?), but they do not consider supply chain attacks (e.g. by pinning package versions with hashes). They don't even have a security policy.

I mean, I think it's fairly safe to generate the proof and sell it to someone if it's done properly (payment to ETH wallet, never sending private key etc.) they will not have access to any critical information? but maybe i'm missing something?

👀 there is also a substantial risk to lose your private ssh key this way, which if you use this one for paid work, can also cause quite some very expensive liability issues.
Natural paranoia in combination with people offering hundreds of Money for it makes me wonder if the proof could already contain a masked version of the private ssh key.(because naturally there is a low chance these coins reach such a high market value, especially if only a few shady people buy the majority of it, so there needs to be something else behind it)
But cryptography is hard, and I would definitely neither be able to confirm or deny my assumption even if I put a lot of hours into reading the source.

[cromatikap]

@FWDekker No way that I run those scripts, but did you have a look at the paranoid instruction?

What do you think?

I found an old vulnerability from grep but the ubuntu 22.04 they tell to spin is supposed to have the patched version 🤔

Looks legit to me, but I'd be up to have second opinions before trying it, don't want my sk to get hacked

[GianlucaCesari]

@Fil From my limited understanding, Fluence is launching a cryptocurrency token, so Fluence (randomly?) selected a bunch of GitHub accounts to give 5000 of those tokens to. Of course, using OAuth would be too easy and secure, so instead they created their own system, but they didn't add mutual authentication, so if a scammer intercepts the communication (or deceives you into communicating with them) they can pretend to be you and get your tokens.

Warning

Even if you don't care about these tokens and would be happy to sell them, don't give your bank account number or other payment details to random people on the Internet.

I think Fluence's authentication method works as follows. Fluence took the public SSH keys of the selected users and used those to encrypt some secret data, and uploaded those encrypted pieces of data to a public location. If (and only if) you have the corresponding SSH private key, you can decrypt the data, and with that you can create a proof validating your ownership. This repository is a tool that automates the user-side part of it and spits out a proof if you give it your SSH private key. You can then upload this proof at https://claim.fluence.network/ (don't sue me if that's the wrong link, verify it yourself) to claim the tokens into an Ethereum wallet of your choice. Of course, if you give your proof to a scammer, they'll take your tokens instead.

Apart from lacking mutual authentication, there's a few other security flaws in their design as well. Most notably, it requires access to your private SSH key. Of course, they promise they won't abuse that privilege (you do thoroughly read all scripts before running them, right?), but they do not consider supply chain attacks (e.g. by pinning package versions with hashes). They don't even have a security policy.

I mean, I think it's fairly safe to generate the proof and sell it to someone if it's done properly (payment to ETH wallet, never sending private key etc.) they will not have access to any critical information? but maybe i'm missing something?

👀 there is also a substantial risk to lose your private ssh key this way, which if you use this one for paid work, can also cause quite some very expensive liability issues.
Natural paranoia in combination with people offering hundreds of Money for it makes me wonder if the proof could already contain a masked version of the private ssh key.(because naturally there is a low chance these coins reach such a high market value, especially if only a few shady people buy the majority of it, so there needs to be something else behind it)
But cryptography is hard, and I would definitely neither be able to confirm or deny my assumption even if I put a lot of hours into reading the source.

I understand, thankfully I can dispose of my ssh key and already have generated a new one, so I don't know if there are more "shady" parts about that, the only thing I can say about @xiaomaogy is that he paid what we settled for the proof, half before half after so that part I can vouch for

[FWDekker]

@FWDekker No way that I run those scripts, but did you have a look at the paranoid instruction?

What do you think?

I found an old vulnerability from grep but the ubuntu 22.04 they tell to spin is supposed to have the patched version 🤔

Looks legit to me, but I'd be up to have second opinions before trying it, don't want my sk to get hacked

The paranoid instructions involve disabling the network of the Docker container before importing your SSH key, so it can't covertly exfiltrate your key. (Instead of Docker, you can also use Podman, which is rootless, but then you can only disable the network by running pkill slirp4netns on the host (not in the container).)

The proof itself also doesn't contain anything that is related to your private SSH key. The private SSH key is only used to decrypt the ciphertext from metadata.bin, and then the proof is based on that output (and the Ethereum address to which the tokens should be transferred).

I haven't checked the other scripts in this repo, but if you follow the paranoid instructions I don't see the private key leaking (assuming they have not been maliciously edited as of me writing this). No, I think the main risk here is you giving away tokens without the other paying you.

If you are still paranoid about losing your SSH key, then generate the proof, remove your public SSH key from all accounts where you use it, and then give the proof to someone else. (If you follow the best practice of using a unique SSH key per machine per service, this is easy. Otherwise, this might be a good time to start doing that.)

[VannTen]

I also received one of those mails.

Well, fluence is not up to date on ssh obviously. FIDO2 ssh keys private part never leaves the security token (and so you can't use them with age), so good luck generating your proof in that case ! 😆

[manaus0xff]

Even if you don't care about these tokens and would be happy to sell them, don't give your bank account number or other payment details to random people on the Internet.

Yeah. Otherwise a scammer will send money to your bank account and you'll be left with the money like an idiot.

[FWDekker]

Even if you don't care about these tokens and would be happy to sell them, don't give your bank account number or other payment details to random people on the Internet.

Yeah. Otherwise a scammer will send money to your bank account and you'll be left with the money like an idiot.

Go ahead, share whatever details you want with strangers on the Internet. Surely, they won't use it to build a profile by connecting various data leaks to perform a (spear)fishing attack against you, your family, or your colleagues, right? ;-)

[xiaomaogy]

Yes scamming is really a thing these days. After purchasing around 5 proofs I got someone contacting me, acting as if they are certain github account users. I didn't verify that(which is my fault), and sent them the first half of the money via different crypto payment method (like ZEC or Dash). And after they received the crypto they deleted the telegram chat and disappeared. I'm really disappointed and now I really need to verify the ownership of the account before I actually pay people.

I'm still purchasing git proof for the fluence rewards if anyone is interested. My telegram is: xiaomaogy. But I will be more careful.

[danicuki]

Why don't use OAuth for this proof???

[o-kotb]

I don't know why I was listed in it either. And I really don't care about any of that crypto stuff. However, I can vouch for @xiaomaogy as well. I sold my tokens to them because I have no use for it. The process was pretty straightforward there. So that at least isn't a scam.

[LeslieOA]

@Fil From my limited understanding, Fluence is launching a cryptocurrency token, so Fluence (randomly?) selected a bunch of GitHub accounts to give 5000 of those tokens to. Of course, using OAuth would be too easy and secure, so instead they created their own system, but they didn't add mutual authentication, so if a scammer intercepts the communication (or deceives you into communicating with them) they can pretend to be you and get your tokens.
Warning
Even if you don't care about these tokens and would be happy to sell them, don't give your bank account number or other payment details to random people on the Internet.
I think Fluence's authentication method works as follows. Fluence took the public SSH keys of the selected users and used those to encrypt some secret data, and uploaded those encrypted pieces of data to a public location. If (and only if) you have the corresponding SSH private key, you can decrypt the data, and with that you can create a proof validating your ownership. This repository is a tool that automates the user-side part of it and spits out a proof if you give it your SSH private key. You can then upload this proof at https://claim.fluence.network/ (don't sue me if that's the wrong link, verify it yourself) to claim the tokens into an Ethereum wallet of your choice. Of course, if you give your proof to a scammer, they'll take your tokens instead.
Apart from lacking mutual authentication, there's a few other security flaws in their design as well. Most notably, it requires access to your private SSH key. Of course, they promise they won't abuse that privilege (you do thoroughly read all scripts before running them, right?), but they do not consider supply chain attacks (e.g. by pinning package versions with hashes). They don't even have a security policy.

I mean, I think it's fairly safe to generate the proof and sell it to someone if it's done properly (payment to ETH wallet, never sending private key etc.) they will not have access to any critical information? but maybe i'm missing something?

👀 there is also a substantial risk to lose your private ssh key this way, which if you use this one for paid work, can also cause quite some very expensive liability issues. Natural paranoia in combination with people offering hundreds of Money for it makes me wonder if the proof could already contain a masked version of the private ssh key.(because naturally there is a low chance these coins reach such a high market value, especially if only a few shady people buy the majority of it, so there needs to be something else behind it) But cryptography is hard, and I would definitely neither be able to confirm or deny my assumption even if I put a lot of hours into reading the source.

I was paranoid but highly curious.
Learnt about the airdrop from not one, but two emails (a friendly one from a Daniel and another one from airdropsss that seems designed to dissuade the email recipient from claiming).

I went with a hybrid of the paranoid method but used the web interface to generate proofs:

1. Create a Linux VM (I use UTM on macOS, but you can use QEMU, etc)
2. Clone this repo to said VM
3. wget the metadata.json file
4. Disable networking in your VM (before disabling/disconnecting, make certain you have age, etc installed)
5. Run a simple HTTP server within the web/ folder (e.g. python -m http.server)
6. Start process
7. Purge VM

Complete overkill, but worked.

NOTE: I generated proofs for my own GitHub account and claimed the tokens to my own Ethereum wallet.
Not saying this has happened, but if anyone asks for your private keys, SSH or otherwise: you're being scammed.

[xiaomaogy]

I don't know why I was listed in it either. And I really don't care about any of that crypto stuff. However, I can vouch for @xiaomaogy as well. I sold my tokens to them because I have no use for it. The process was pretty straightforward there. So that at least isn't a scam.

Thanks for the vouch, really appreciate it. So far I've traded with more than 25 people. Some of them are scams and never return after I sent them the initial batch of the money, but many of them are honest and we made the trade work.

You can still reach out to me on telegram: xiaomaogy. I'm still purchasing the git proof. I can also use the approach mentioned by @LeslieOA if you are worried. That way I don't have access to anything from you, just the proof. You can be sure that I'm honest and all I want to do is get the proof so that I can claim the FLT reward.

[Fi1osof]

@xiaomaogy not scammer. Hi send me $250 in eth. But then i read this project more carefull and claim tokens for myself. Send eth to @xiaomaogy back. No scam, no hate.

[AhmedBaset]

The TLDR, Is running that script and giving the requested proof safe? Can anyone confirm?