Who are the Ethereum/DAO white hat hackers?
How can the community be assured that they can be trusted? Are they using the same exploit as the black hat hacker used? What prevents the white hat hackers from turning black hat and keeping the ETH they were able to recover?
Q: Who are the Ethereum/DAO white hat hackers?
A: The spokesperson for The Goodies (or Robin Hood as referred to in Update on the White Hat attack) is Alex Van de Sande. The other members have not been revealed to the public.
While he is not working on behalf of his employer as part of The Goodies, the spokesperson is lead designer at the Ethereum Foundation. He is spearheading the Wallet and Mist project with the Go Ethereum team.
Q: How can the community be assured that they can be trusted?
While
Everyone in this group acted as an individual and did not represent or received the endorsements of their employers.
I, and most Ethereum users, have already given the spokesperson the trust as we are already running the binary programs on our computers to interact with the Ethereum network. He, and the colleagues he works with in his normal employment, is already in a position where he could engineer the software running on your computer to steal all the private keys from your computer, along with any other juicy information you hold on your computer.
Q: Are they using the same exploit as the black hat hacker used?
Yes. You can see the similar signatures in the transactions used to perform this exploit in How many The DAO recursive call vulnerability attacks have occurred to date?.
Q: What prevents the white hat hackers from turning black hat and keeping the ETH they were able to recover?
The value of the Ethereum network would fall dramatically, and their ETHs would be devalued at the same time.
If the other members of The Goodies were to turn, the community would pursue the public face of The Goodies.
And it would be very hard to hide when you have a public profile. Remember this face:
For those who didn't follow the link:
I wouldn't call myself part of the Robin Hood Group, not because I’m afraid of legal consequences or ashamed of it, but because I don’t think I’m worthy of that title. The guys who made the DAO counter attack were able to create attack vectors much more sophisticated than the original attacker developed, and created new ways to twist it so that the original attacker couldn’t counterattack. They set up active running scripts that at some point were constantly draining the dao to 1 wei, to capture any ether the attacker sent to the DAO to set up a new attack. I would never be able to do any of this. While I did a small part in helping the original counterattack, I’ve also been told that since the first attack most of the original group splintered and only a few kept pushing forward. I haven’t participated since that day, I don’t control any of the private keys to any relevant addresses, I had recent contact with them, but since the main goal was accomplish I don’t intend to keep contact and I certainly don’t want to be seen as their spokeperson for the next step..
Also, even the small part I did, I acted as an individual, not as part of the Ethereum Foundation. I never told Vitalik about my plans and when Ming, the Executive Director, asked me about it I refused to tell her, so that the Foundation wouldn’t be in any way implicated or active in this.
Last time I spoke to the White Hat Group about the status they had told me the attacker was able to run off with a big part of the funds and while they had recently won some battles, the funds were far from secure as they were still aware of possible attacks – which is why I didn’t want to make any public comment on that matter, otherwise the attention could jeopardize this whole thing. AFAIK part of the reason they were more successful now was because the DAO had less value and was under a lot less scrutiny since the fork.
Before you guys talk about what they are going to do with the funds, notice that this group had absolutely no obligation to keep doing what they were doing, yet kept doing it anyway. They worked hard for the fork to happen because they wanted all the DAO investors to be made whole – and they accomplished that – but then the Ethereum Classic community made its central tenet that such a solution was morally wrong and we were all corrupt for doing it. The blackhat hacker tried their best to ruin any chance of counterattack, negotiation or ceasefire) yet I’ve seen posts in this community comparing them to Satoshi Nakamoto. These guys have done what no one else was willing or capable to do, yet they are constantly harassed and whenever I read a question about the White Hat Group’s ETC funds, the first answers usually mention lawsuits or assume malice on their part. I wonder how many DAO token holders today are even the same people who believed the original vision and participated on the launch and how many tokens are currently held simply by people who wanted to buy them for a chance of an arbitrage opportunity. I don’t blame those guys for asking themselves why bother do so much for people who seem to hate them so much. Now, of course, this doesn’t represent the full community, I’ve been in contact with people from the Classic mod team that are trying to change the tone, but my recent experience having to defend small API choices on the wallet as mr Gravity automatically assumes the worst about it, made me realize this isn’t the charitable and understanding Ethereum community I met at Devcon0 and 1.
To make it completely clear, while I appreciate the irony that the same people who claimed the Dark attacker was the rightful owner because “code is law” are asking the opposite of the white hat attackers, I don’t endorse this idea: my understanding has always been that they would do their best to give the money back to the community, otherwise they would be no better than the black hat.
I do not know what they intend to do now and I learned that the recovery was successful via the multiple reddit mentions. While I believe they have the best intentions they are also at risk for a lot of legal troubles and costs. On a personal note I’ve lended them DAO tokens for the attack, which I haven’t seen since. I’ll be asking them for the eth-dao to be returned, but I’m donating the etc-dao to them.
My main point is this, they could have washed their hands of all this the day of the fork and let it all be taken by the thieves you applauded. If anything is ever recovered it’s all due to the tireless work of these people. So instead of constantly debating how much the white hats owe you, ask yourself how much you owe the white hats.
