Michael Perklin: All about security

buy bitcoin toronto

In 2010, Michael Perklin was a digital forensic investigator who focused his efforts on computer security and security theory. He first came across the term “Bitcoin” on a security mailing list. It was being touted as a “totally secure digital money system.”

 

“I scoffed at it,” says Perklin. As a graduate of Sheridan College with a Bachelor’s Degree in Information Sciences (BaISc) and a Masters degree in Information Assurance (MSIA), he and his classmates had toyed around with notions of digital currencies and decide that they weren’t feasible because a central ledger was always required.

 

“So I set out to prove how stupid it [the Bitcoin protocol] was.” At that point, bitcoins were selling for around $1.00. He spent the next few months reading everything he could about Bitcoin, and trying to find ways of discrediting it, drawing on his background in classical security. Over the course of that one long winter, he exhausted as many strategies – covering all seven classes of attacks – as he could.

 

Perklin’s conclusion: “I went from thinking it was the stupidest thing I’d ever heard to thinking it was the most brilliant thing I’d ever heard.” In the meantime, the price of one bitcoin had gone up to $4.00.

 

As Bitcoin research started to consume all his off-hours after work, he began reaching out to the local bitcoin community and attended an early Toronto Bitcoin meet-up with his friend and colleague, Josh McDougall. Their first meet-up featured Peter Todd as a guest speaker who spoke about off-chain transactions: Perklin and McDougall peppered him with questions, challenging his points throughout the presentation. At the end of the session, meet-up organizer Anthony Di Iorio approached Perklin with a proposition.

 

“Anthony thought I made some good points and got the impression I knew what I was talking about. He told me about the new Bitcoin Alliance of Canada that was in the works — maybe I should run for a board member position.” Eventually, in June of 2013, Perklin was indeed elected as one of seven inaugural Alliance board members.

 

By that point, Perklin had begun to combine his two specialized areas of interest — Bitcoin and cybersecurity — and started up Bitcoinsultants in 2012. The company draws on the talents of a pool of professionals, including developers, cryptographers, source-code auditors, and penetration testers who are well-acquainted with the nuances of cryptocurrencies and their cybersecurity needs.

 

The company offers tech advice and consultation for companies who want their developers to integrate Bitcoin into their current ways of doing business. “People who know Bitcoin don’t always know classical security,” says Perklin. They may know that they want to integrate Bitcoin into their general payment processes, but they might not have considered storage options once they’ve collected the payments, for example. Bitcoinsultants can help companies create all the necessary related policies and procedures surrounding these integration issues.

 

They also offer investigative services, law enforcement support, and government/regulatory advice. Perklin himself is a popular and well-respected speaker on all things Bitcoin. He has spoken at conferences and information seminars, educating “anybody who needs to understand what [Bitcoin] is and how it works.” In October of 2014, he was one of three representatives who spoke before the Canadian Senate on behalf of the cryptocurrency community in Canada.

 

What began with Perklin approaching various exchanges and offering his services, has now grown to a business with a sterling reputation. It works with a number of gambling websites, but also counts CaVirtex and Ethereum among its most prestigious clients. Bitcoinsultants has operated out of the Decentral co-work space in Toronto since it opened in January 2014.

How Dell, Expedia and Others Accept Bitcoin Payments

Dell recently announced that they are accepting Bitcoin as a means of payment. Expedia announced last month they’ll start rolling out Bitcoin payments for their services. How are these companies implementing Bitcoin payments online?

 

Dell and Expedia use Coinbase.com. Coinbase is a popular US service for buying, selling and storing Bitcoins (they’re an exchange and offer a wallet). Unfortunately Coinbase is not available for Canadian customers.

 

NewEgg and TigerDirect (online electronics stores) use BitPay.com. BitPay is targetted at developers rather than business people. BitPay is like Stripe for Bitcoin. BitPay can be used by Canadian businesses.

 

The three main Canadian exchanges have their own merchant integration services (with varying ease of use):

 

CaVirtEx (the largest exchange in Canada)

QuadrigaCX (here’s a video aimed at merchants that they published today:

https://www.youtube.com/watch?v=rjkltZ_C6rU)

Vault of Satoshi (the most complicated API)

Stripe, a popular credit card payment integration service, has announced that they will soon offer a Bitcoin payment method but it’s currently in beta.

 

Screenshot of Coinbase merchant landing page.

Buying Bitcoin at Decentral

At Decentral we have a convenient bitcoin teller machine that makes purchasing bitcoin easy. To use the machine at our location, simply follow these steps:

 

  1. Click ”Start” on the main screen when you are ready to begin. The price per bitcoin displayed at this point will be your purchase price. Note, of course, that you can always buy fractions of a bitcoin, but the minimum amount per transaction is $5 Canadian.
    Enter your phone number and then the verification code that you receive by SMS message.
  2. Choose “Buy Bitcoin”
  3. Next, choose “Yes” if you already have a bitcoin wallet. Choose “No” if you would like the machine to print a paper wallet.
  4. Place the QR code for your wallet’s public receive address in the scanner; it’s the top-right horizontal slot.
  5. Start inserting your Canadian cash into the bill acceptor, which will have a green light activated to indicate that it is ready.
  6. After you’ve inserted your individual bills, click “I’m Done” to complete the transaction.
  7. Congratulations, you now have bitcoin! A confirmation of the transaction will be sent via SMS to your phone. You can also print a paper receipt for your records.
    Note that the machine will read only the QR code for your public bitcoin address; you cannot type the address in manually. Fortunately, all bitcoin wallet systems on your phone or computer are able to display a QR code for the wallet’s public receive address.

 

If you have any questions about the process, please come by Decentral and we’ll help you get started. 64 Spadina Ave. Toronto, ON. Canada.

How Dell, Expedia and Others Accept Bitcoin Payments

image

Screenshot of Coinbase merchant landing page.

—-

Dell recently announced that they are accepting Bitcoin as a means of payment. Expedia announced last month they’ll start rolling out Bitcoin payment for their services. How are these companies implementing Bitcoin payments online?

Dell and Expedia use Coinbase.com. Coinbase is a popular US service for buying, selling and storing Bitcoins (they’re an exchange and offer a wallet). Unfortunately Coinbase is not available for Canadian customers.

NewEgg and TigerDirect (online electronics stores) use BitPay.com. BitPay is targetted at developers rather than business people. BitPay is like Stripe for Bitcoin. BitPay can be used by Canadian businesses.

The three main Canadian exchanges have their own merchant integration services (with varying ease of use):

  1. CaVirtEx (the largest exchange in Canada)
  2. QuadrigaCX (here’s a video aimed at merchants that they published today: https://www.youtube.com/watch?v=rjkltZ_C6rU)
  3. Vault of Satoshi (the most complicated API)

Stripe, a popular credit card payment integration service, has announced that they will soon offer a Bitcoin payment method but it’s currently in beta.

How to buy Bitcoins at Decentral

At Decentral we have a convenient bitcoin teller machine that makes purchasing bitcoin easy. To use the machine at our location, simply follow these steps: 

  1. Click  "Start" on the main screen when you are ready to begin. The price per bitcoin displayed at this point will be your purchase price. Note, of course, that you can always buy fractions of a bitcoin, but the minimum amount per transaction is $5 Canadian. 
  2. Enter your phone number and then the verification code that you receive by SMS message. 
  3. Choose “Buy Bitcoin”
  4. Next, choose “Yes” if you already have a bitcoin wallet. Choose “No” if you would like the machine to print a paper wallet
  5. Place the QR code for your wallet’s public receive address in the scanner; it’s the top-right horizontal slot. 
  6. Start inserting your Canadian cash into the bill acceptor, which will have a green light activated to indicate that it is ready.
  7. After you’ve inserted your individual bills, click “I’m Done” to complete the transaction. 
  8. Congratulations, you now have bitcoin! A confirmation of the transaction will be sent via SMS to your phone. You can also print a paper receipt for your records.

Note that the machine will read only the QR code for your public bitcoin address; you cannot type the address in manually. Fortunately, all bitcoin wallet systems on your phone or computer are able to display a QR code for the wallet’s public receive address. 

If you have any questions about the process, please come by Decentral and we’ll help you get started. 64 Spadina Ave. Toronto, ON. Canada. 

image

What You Need to Know About the New Canadian “Bitcoin Law”

This post was written by Addison Cameron-Huff, a tech lawyer who works for Decentral. Addison is a lawyer but he is not your lawyer. You should seek legal advice before acting on any of the legal information presented in this article.

 

What’s Happened?

A Canadian federal law affecting Bitcoin passed last Thursday. Bill C-31, an omnibus budget act, contains provisions that will eventually bring certain Bitcoin businesses into Canada’s anti-money laundering regime. The new rules are not in effect yet.

 

Who Will Be Affected?

In short: anyone engaged in the business of buying or selling of virtual currencies and who has Canadian customers.

 

Any person or business who “ha[s] a place of business in Canada and that [is] engaged in the business of providing … the following [service]: … dealing in virtual currencies”.

 

Also affected: any person or business who “do[es] not have a place of business in Canada, that [is] engaged in the business of providing at least one of the following services that is directed at persons or entities in Canada, and that provide those services to their customers in Canada: … dealing in virtual currencies.”

 

Citations for above: Bill C-31, s. 256(2): http://www.parl.gc.ca/content/hoc/Bills/412/Government/C-31/C-313/C-313.PDF (pgs. 164-165).

 

What is “Dealing”?

Dealing isn’t defined in the act but generally means buying or selling. Coupled with the requirement that someone be “in the business of”, it’s likely that this law won’t affect people buying or selling for personal use or merchants using Bitcoin.

 

The law can be expected to be similar to how car dealing works: selling your own car doesn’t require a license but running a car dealership does.

What is “Virtual Currency”?

The new law doesn’t define “virtual currency”. The definition will be in the regulations that will eventually be passed (see below).

 

What Will the Rules Be?

Anyone covered by the new rules will have to register as a “Money Services Business” (MSB) and comply with the anti-money laundering regime (please see previous Decentral blog posts).

 

Probably the most significant MSB rule is that companies may only do business in amounts up to a certain threshold before requiring that customers provide identification. The threshold will likely be either $1000 (current MSB rules for the money transmission/remittance category) or $3000 (foreign exchange category).

 

The exact rules won’t be known until the corresponding regulations are published (here). The final rules will probably be preceded by a notice of proposed regulation posted in Part I of the Canada Gazette.

 

When Will the New Rules Take Effect?

The new rules won’t take effect until the government declares them in effect.

 

Section 298(3) of the law states that s. 256(2) (the key Bitcoin-regulating part of the law) will “come into force” (become a law people are required to follow) “on a date to be fixed by Order of the Governor in Council”.

 

What is an Order in Council? An Order in Council is one of the pathways by which laws can come into force. They are published on the Orders in Council site (hard to navigate/monitor) and in the Canada Gazette Part II (easier to monitor, it’ll be published as a “Statutory Instrument” [e.g. “SI/2014-XXX”]). The only way to know that an order has been published is to check every day and see if something’s been published.

 

What Should Bitcoin Businesses Do?

Find a lawyer and attempt to understand how money laundering rules apply to your business and what the registration/compliance steps are.

 

FINTRAC (the regulatory agency for anti-money laundering) offers some guidance for money services businesses on its website: http://www.fintrac-canafe.gc.ca/msb-esm/intro-eng.asp.

 

Registering as an MSB is free and quite straightforward. Compliance is complicated and will likely affect involve hiring a lawyer.

 

What’s Going to Happen?

  1. Canadians may be banned from some online virtual currency services. Although Canada is a base for many Bitcoin businesses, Canadians are a small market. The money laundering rules have such severe penalties that probably services will just not allow registration by Canadians rather than attempt to comply.
  2. Some Bitcoin businesses may have business models that aren’t compatible with the new regulatory regime. They’ll have to adapt their model to the new environment.
  3. Small businesses may not be able to afford the compliance costs. This may lead to consolidation in the industry.
  4. The new regulatory regime may provide a big boost to the Canadian Bitcoin industry. Canada will soon have the world’s first nationally regulated virtual currency industry.

 

Photo by @spettacolopuro.

Dealing with Cryptowall and Ransomware

by Michael Perklin

As a digital investigator who spent years tracking cyber criminals online, and as someone who has launched a Bitcoin security consulting company, I’ve been contacted a number of times by victims of digital ransom, looking for ways out. The story is always the same: they see a warning on their computer screen telling them that their files are encrypted, and unless they pay a hefty ransom (with Bitcoin) before the clock runs out, they will never gain access to their files again.

I’ve decided to write this blog post to answer some questions about this type of ransomware and help the thousands of Canadians who must be affected by it.

Jump to the bottom to read the four suggestions on how to deal with this ransomware, or continue reading for more details about it.

In late 2013, a new form of ransomware titled CryptoLocker hit the Internet, indiscriminately encrypting portions of every file it could get its hands on. Files stored in “My Documents” folders, external drives and even shared folders hosted on other computers in the local network had portions of the contents encrypted using an RSA encryption key. The decryption key was made available to victims of this attack for the price of $300, paid in Bitcoin.
Although the CryptoLocker’s command and control servers were taken down in May 2014 thanks to a joint US Department of Justice raid on servers hosted in Kiev and Donetsk, this hasn’t stopped ransomware from spreading.

A new piece of ransomware has made its rounds lately: CryptoWall. My research into CryptoWall shows it is essentially the same code as CryptoLocker, but is designed to use a different command-and-control methodology to hopefully outlive its CryptoLocker predecessor. It also asks for $500 in ransom instead of CryptoLocker’s $300. Thankfully, this newest variant seems to use much of the same code as the old one, including all of its flaws.

The older CryptoLocker software had a few flaws in how it a) chose encryption keys to encrypt the victim’s files, and b) how it used these keys to encrypt the files in the first place.
Performing cryptographic operations with software in a secure manner is not easy. Care must be taken when using the encryption key in software to ensure it is only used to encrypt, and is removed from the system immediately afterwards. If this care isn’t taken, the encryption key can linger in a few places including RAM, pagefiles on the hard drive, and even cached locations on disk. These can be written inadvertently by the application, the application’s framework (.NET, JavaVM, Rails and other frameworks) or by the Operating System itself (in this case, Windows).
This is one of the services that my company, Bitcoinsultants, provides our clients: advice on using cryptography properly to ensure their applications don’t succumb to any of the 7 classes of attacks on information systems (Information Leakage being one).

In a true case of irony, this difficulty of securely using encryption keys has left CryptoLocker insecure, leaving copies of the key on victims’ computers. Where this would normally be an example of an Information Leakage vulnerability, in this case it is a bastion of hope for all of CryptoLocker’s (and CryptoWall’s) victims.

Dealing with Ransomware

There are a few suggestions that I regularly give to people looking for help. I’ve listed them here:

  1. Keep a backup of your data before you get hit. This may seem like a cop-out suggestion, but the fact is if you have a safe copy of your encrypted data you don’t need to pay a ransom to recover the files; you already have them. External hard drives and large USB keys make this easy; simply drag and drop your files to your external drive, and unplug it when the copy is finished. This hard drive can be used to recover your files in the event your system becomes infected;
  2. Try to decrypt the files on your own. If you have experience with programming and are an advanced technical user of computers, you may want to visit these technical resources which can help you understand and decrypt the files on your machine. Keep in mind this will take a significant amount of time and experience with the more technical aspects of computers in order to execute.
  3. As much as I hate to suggest this, consider paying the ransom. Every case I’ve helped with has had their files decrypted after paying the ransom. As dishonourable as the attackers may be in writing this ransomware, they at least keep their word when it comes to decryption. I’ve had people offer to pay for my services to decrypt their files for them out of principle – they’d rather pay a whitehat hacker than a ransom – but the fact is the amount of time and effort required costs more than the ransom. I believe the authors of this ransomware priced the ransom purposely to ensure that it will always be cheaper to pay than to hire professionals to decrypt it on their own.
  4. Canadians can report the incident to the Canadian Anti-Fraud Centre. They keep tabs on scams affecting Canadians and coordinate resources where necessary to combat them. Residents of other countries can find the counterparts to the CAFC in their country, such as the Fraud.org website in the United States;

One of the victims that I’ve helped made a comment regarding this virus and its use of Bitcoin:

“This just proves that Bitcoin is illegal, and it’s only a matter of time until governments ban it for taking advantage of people like me.”

I sympathize with all of the victims of this ransom, but personally I feel that blame should be placed squarely on the attacker and not on the medium of payment demanded. After all, people have held others hostage in demand of $1000s of dollars in unmarked bills; should the Canadian or US dollars be banned for taking advantage of people? Making these counter-arguments helped this victim see that the payment processor was not at fault, however I imagine many others who are less familiar with Bitcoin have jumped to the same erroneous conclusions, making the job of the Bitcoin Alliance of Canada that much more difficult.

The fact is, the easiest way to deal with these types of attacks is to be prepared in advance. If you don’t have a backup of your data, now is the best time to make one.

Until next time,

Michael Perklin