Network Hijacker Steals $83,000 In Bitcoin 101
An anonymous reader writes with news that bogus BGP announcements can be used to hijack work done by cryptocurrency mining pools. Quoting El Reg: Researchers at Dell's SecureWorks Counter Threat Unit (CTU) have identified an exploit that can be used to steal cryptocurrency from mining pools — and they claim that at least one unknown miscreant has already used the technique to pilfer tens of thousands of dollars in digital cash. The heist was achieved by using bogus Border Gateway Protocol (BGP) broadcasts to hijack networks belonging to multiple large hosting companies, including Amazon, Digital Ocean, and OVH, among others.
After sending the fake BGP updates miners unknowingly contributed work to the attackers' pools.
This is *NOT* hilarious ! (Score:5, Insightful)
The use of bogus BGP to treat networks into believing that it is connecting to a legitimate network instead of having its own network stream being hijacked can be used for much more than mere Bitcoin snatching
It can also be used to "branch out" legitimate net traffic to some listening posts (something NSA and all other spy agencies like to do) and thus, further compromise the legitimacy of the network itself - and the loss of privacy / data / whatever that the data stream happen to contain
This is a serious threat !
Re: (Score:2)
There is insurance for computer breach/financial loss due to hacking... wonder if miners should invest in such and also if such insurance is actually available for miners.
Re: (Score:2)
They could also just make the mining pool protocol use TLS.
This is hilarious (Score:1)
I don't know, is stealing property illegal? .. so I am guessing the legal system has to back that up.
IRS deemed it "property" and wishes to tax us on it
Re: (Score:2)
Computer fraud and abuse act makes anything a federal judge doesn't like a crime in retrospect. Because it was passed years ago, the fuckwits have declared it not to be an after the fact law (whatever the fucking latin for that is).
My lifes dream is to invent a new crime, and these fuckwits basically ruined it.
Re: (Score:2)
What you are looking for is ex post facto but that isn't the case against the Computer fraud and abuse act. What that means is you can't do something which is perfectly legal, congress decide they don't like it, quickly pass a law against it and than prosecute you for what you did before the law was written.
The problems with the CFNA are that it is,
1. Vague - a law that is so broad a prosecutor can apply it to basically anything is unconstitutional, or void for vagueness.
2. Its cruel and unusual in that th
Re: (Score:2)
Fucking latin. No fond memories of that wasted time. Damn jebbies.
Where is the validation? (Score:5, Informative)
Re: (Score:3, Insightful)
Really, this sounds like the miner's fault for not realizing it earlier. My pools have an app that updates me in realtime what they see as my balance and my hash rate. If you've been re-directed to an invalid pool, you'd think your hash rate and earnings would drop to 0 over time and you'd pick up on that and try to correct the issue. I would probably notice within 15 minutes if this happened.
Re: (Score:2)
Re: (Score:2, Interesting)
Really, this sounds like the miner's fault for not realizing it earlier. .
Erm, no.
When somebody impersonates an authority figure so they can steal things, it's the fault of the robber, for stealing shit, not the fault of the person for not checking their ID.
Re: (Score:2)
I had been given the impression that each hashing operation was either of identical computational cost or close enough that a reasonably representative GH/s rate could be established quickly. Is there mining hardware/software with meaningful variation between 'working' and 'offline'?
Re: (Score:2)
Re: (Score:2)
However, the process of mining is a stochastic random process. Essentially, the job of a miner is to find a partial "hash collision" - essentially, the miner hashes the transaction data and a random nonce, and aims to find a hash as close to 000000000....00 as possible. The bitcoin/alternative network agrees a priori, what threshold counts as a "hit". The miner essentially tries random nonces,
Re: (Score:2)
exactly, just like you should notice someone hijacked your email server and is intercepting every second email you receive ...
Re: (Score:2)
It could also act as a man-in-the-middle where everything looks fine.
I think all it needs is a copy of the data to be able to 'steal' it.
That's okay.... (Score:3, Insightful)
...Bitcoins are like money in real banks and are insured. No harm to the victim.
Oh wait....
Re:That's okay.... (Score:5, Funny)
Re: (Score:2)
Theorem: all currencies are non-fiat currencies backed by the value of the effort required to steal.
Re: (Score:2)
Re: (Score:2)
Anyone want to play "spot the libertarian"?
Re: (Score:2)
Not too far off. Back by the power of the military that is controlled by the supporters of the currency.
Except that there are countries with no military [wikipedia.org] that have their own currency.
Re: (Score:3, Informative)
If you stored Bitcoin in a bank, it would be insured, and there wouldn't be an issue. This isn't even about wallets or banks or credit. This time, it's about a bug in the protocol. Every bug discovered makes the system stronger. Sucks that miners are losing money, but the discovery is good news in the long run. Compare this with the banking system. When a bug is discovered, it takes years to get fixed, millions, sometimes billions of dollars are lost. The process is onerous and intrusive, often resulting in
Re: (Score:1)
A problem surfaces in Bitcoin world, at worst you're going to have to wait a week before the wallets or miners are patched. What was that you were saying about harm again?
The attacker has been doing this for 4 months. And we'll see how long it takes for Bitcoin and other currencies to fix their protocols and for the new protocols to be deployed.
Re: (Score:2)
And it's just now that they've caught it?
Re: (Score:2)
FDIC should be banned.
Re: (Score:1)
And just how do you check the security of a bank?
Walk in the door and demand a code audit before depositing your money?
Grow up, the real world doesn't work the way Ayn Rand's John Galt fantasy world does.
Re: (Score:1)
The can not be fired. They will not be prosecuted. They wil
Re: (Score:3)
If there was no FDIC some smart person would start a private insurance agency and sell stickers to the banks that tell customers they are protected.
Except that, until 1933, there was no FDIC, and your scenario didn't happen. Instead, we had bank runs.
Re: (Score:2)
My tax money should not be spent allowing you to go through life oblivious and insured from the risks you take.
Although I am sure that you will attempt to continue to believe that is exactly what I should be forced to spend my money on.
Re:That's okay.... (Score:5, Insightful)
Tax money is not yours, it's a payment for partaking in civilization which, after all, requires a lot of human effort to upkeep.
I think this is the problem with most libertarians: you've been surrounded by the invisible support systems of society all your life, so you mistake them for something that occurs naturally, like sunlight. Thus when you're required to pull your weight and help maintain these systems, you see this as an egregious violation of your property rights, completely oblivious to the fact that property is an artificial construct built and maintained by them in the first place. And everyone else, of course, sees a freeloader who's arrogant enough to be insulted by the very idea of having to chip in.
The world does not owe you unpaid servitude. You will never get things like property rights or a monetary system without having to pay for them. Nor can you pay only for things that directly benefit you, because that leads to a tragedy of the commons where everyone argues why someone else should pay for every single system and the end result is that no one pays for anything, and society collapses.
I doubt that you'll stop playing a victim because you've been told polish some of the tiles on the streets of gold you walk on every now and then, but this is why you aren't being taken seriously outside the lunatic fringe.
Re: (Score:2)
The bond rating agencies could do it...wait.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
So? (Score:4, Interesting)
Oh right - that would undermine the illusion of "freedom".
At least this weeks compulsory Bitcoin story is sort of amusing.
Re: (Score:1)
The bitcoins weren't really "stolen". It was more like building an exact replica of a diamond mine, and having the bus driver bring miners to your replica mine instead of the real mine. The replica is so good that the miners work for you without knowing it. Only when they see a paycheck of $0.00 from their employer do they understand that someone's been tricking them.
Re: (Score:2)
Even then, they just assume the mine is owned by McDonalds.
Re: (Score:2)
It's a blockchain. It's know what portions were stolen. Send a message out to all people involved in this scheme to not accept them.
Oh right - that would undermine the illusion of "freedom".
Please try to send the message and let us know how it worked. I think that you'll discover that your "illusion of freedom" is very far from actual reality.
That's the thing with illusions (Score:2)
Re: (Score:2)
In case you haven't noticed yet that is what Bitcoin is FOR.
ISP Failure, not Application Failure (Score:5, Insightful)
This trick is as old as it gets. BGP will accept a more specific route as superior to a more general route, and there is no authentication in the exchange. The flaw here is the upstream providers involved did not properly filter the routing announcements allowed from this attacker, and instead let them announce net blocks that were not their own, then intercept the traffic to those net blocks.
In other words, nothing to see here, move along.
Re: (Score:2)
Still a problem. You can't control all ISPs. I don't know enough about the protocol but I figure extra simple measures will be put in place to avoid further loses.
Re: (Score:2)
Not at all. The flaw is in the lack of validation. I should not blindly trust that when I send something it will get to the right person.
How did people not notice this early? (Score:3)
From what the article says, this hijack went on for months without anyone noticing, and only came to attention because one guy happened to notice that his mining client was connecting to the hijacker's pool server. The first person to notice it did so on March 22nd, when the hack had been running since at least early February. My question is, why didn't people notice their profits vanishing in the month before the first person reported it?
Re:How did people not notice this early? (Score:4, Informative)
I got hit April 25th with this. I noticed within an hour, and it took me about an hour to determine that my connection to the pool had been spoofed, and my miners redirected to the attackers pool. I had no idea at the time *how* it was done.
My mining software was a couple of months old at the time, and the latest version would ignore such redirect requests. I updated and continued on, having lost maybe 2 hours of mining.
The redirect comes from that fact that the "Stratum" protocol used by many minors to request work from the pools was originally designed as a wallet to blockchain server protocol. Under that use case, it makes sense that the server might suggest to a (wallet) client that they use another server.
Re: (Score:2)
Yeah, I saw that 30 seconds *after* hitting the submit button. :facepalm:
Only $83,000? (Score:2)
Re: (Score:1)
Re: (Score:1)
A) They're almost certainly not in the US, and may be in a country that doesn't even classify this as a crime
B) Even in the US, this would definitely not result in life in prison, or even close to it, unless it was committed by an elderly person
C) People risk life in jail for a hell of a lot less than $83K (which is incidentally about double the median household income in the US, definitely not "average") on a daily basis. See convenience store armed robberies for a few hundred dollars. As a general rule,
Re: (Score:2)
It's average for engineers with the skillset/patience and detail oriented mindset to pull something like this off.
Sigh (Score:4, Insightful)
I've been pointing out the risks of router poisoning for, what, 17 years now.
Ever since the NSA started demonstrating router poisoning, it was only a matter of time before even the script kiddies figured it out.
I've been pointing out that the current rash of cryptocurrencies have excessive reliance on trust for the past year.
This sort of attack was inevitable. Bitcoin can plead semi-innocence because strong authentication is counter to strong anonymity. However, no router on the Internet should accept rogue announcements - even from three letter agencies - or accept unauthorized changes to the running configuration or active router tables.
MITM attacks are exceptionally dangerous and the hazards can only get worse.
Re: (Score:2)
Something which is rather ironic given that trust is an important issue with cryptography.
Re: (Score:2)
You might want to check out NIST's page on authenticating+encrypting modes.
You might want to look at Diffe-Hellman key exchange, where nothing is provided that cannot be entrusted to a wiretapper.
You might want to look at the Byzantine class of problems and their use in encryption.
You might want to look at the reasons for and against random oracles.
I see very, very little in cryptography that has to do with trust. Almost everything is dedicated to assuming that nothing can be trusted. People are encouraged
Re: (Score:2)
A lot of the strength in cryptography is lost in areas that depend on trust. Like trusting that the vendor doesn't put a backdoor in your system, or trusting your OS doesn't break your firewall, or that any third-party CA's are actually trustworthy, or there isn't a weird compiler bug that kills your entire encryption system. These things may be tested against and prevented one-by-one, but they are overhead, which makes the notion of security a matter of risk management. Cryptography tries hard to reduce th
And nothing of value was lost (Score:1)
Somebody stole me kibbles and bits!
-- A Lying Imp
So really bitcoin is incidental (Score:5, Informative)
So what we have here are two problems.
One lack of authentication for the miners with the pools. Something a few SSL on the servers and wrapping those sockets calls with openSSL would make the route hijacking ineffective for stealing mining resources.
So there is a lesson in this whatever it is you are doing on the internet if you care AT ALL about it you should be using SSL and checking certs, (Looking at your slashdot) sure there are tons of problems as weaknesses in SSL but until something better comes along its beats the hell out of clear text with no authentication what so ever.
Two BGP needs to be replaced or updated to support much stronger authentication and the network operators need to just push getting it done, even if it means telling customers we can't / won't peer with you and neither will anyone else unless you get you routers and or software update to do this. If they stick together in it there should be no trouble getting that done.
Stealing some computer cycles used to generate bit coins is probably among the least real harm someone with access to advertise bogus routes in BGP could do; and lots of people are in a position to do that. We should be thankful its only a little money these guys were making off with. The Internet has gotten to big for the network operators to just relay on everyone playing nice and being good citizens, We need some stronger technical controls put in place and regular auditing beyound well nobody has complained on NANOG.
Re: (Score:2)
Pre-Snowden there was a huge BGP attack that re-routed lots of traffic, so much so that it was hard to tell who was targeted (instead of small things like this, think more like "all western Chinese traffic routed through US"). At the time there was lots of useless conjecture as to what it was about and whether or not it was really an attack or just a seriously stupid misconfiguration. Of course, nowadays we know that TLAs use this as one of their tools to grab target traffic that would otherwise be out of r
Bah ... (Score:3, Insightful)
You say unknown miscreant.
On Wall Street they're simply called "staff".
Frankly, I see little difference between stealing BitCoins from a mining pool and High Frequency Trading. And that's perfectly legal.
Re: (Score:2, Interesting)
Frankly, I see little difference between stealing BitCoins from a mining pool and High Frequency Trading. And that's perfectly legal.
The official stock market justification for HFT is that it provides "liquidity" (that's the actual word they use) to the market. Translated into human-speak, that means that the trading companies get transaction fees for every transaction under HFT and that money is very important to them. Of course the traders don't pay the kind of fees that us normal people pay. They get volume discounts. But the justification is that somehow the HFT fees that get paid benefit all of us by allowing them to lower the f
Re: (Score:2, Insightful)
Welcome to capitalism, where gaming the system for profit is a moral imperative.
Re: (Score:3)
Tomayto, tomahto.
The Capitalist applies capital to the highly profitable enterprise of getting legislation bent to his favor and prosecution bent to disfavor his competitors. How SCOTUS doesn't think that's corruption boggles what's left of my mind.
Re: (Score:3)
No, it's pretty much inherent.
The people who make the assumption that people aren't inherently corrupt and won't game the system are either stupid, or lying to you.
In its modern form, the corruption is built right in.
Re: (Score:2)
well, maybe not *this* anonymous coward, but just look at this thread and you'll read plenty of comments saying "well, anyone who lost money was an idiot because ." So, either you aren't reading slashdot or...
dang, I just replied to an AC
Does BitCoin need a way to void coins? (Score:1)
Bitcoin transactions are already traceable in the blockchain. The information is already there to declare that a given transaction is "null and void" and identify all bitcoins that were affected by that transaction and void them or if they have been co-mingled with valid coins and re-issued, declare all of the progeny of that mixing as having a total value equal to the non-tainted transactions, i.e. these coins would have a "lesser value" than a regular coin.
The problems are not purely technical - they are
Re: (Score:1)
If you want safe money, stick to the currencies that are backed by state force.
What's the point of having money if it's not safe, at least from the time you take possession of it until the time you spend it?
Re: (Score:2)
No, you couldn't, because a transaction can and often does have multiple inputs from different past transactions and multiple outputs into future ones. Your "evil" transaction will eventually be in the history of most if not all of the unspent outputs.
Bitcoins don't have identity. A B
Re: (Score:1)
No, you couldn't, because a transaction can and often does have multiple inputs from different past transactions and multiple outputs into future ones. Your "evil" transaction will eventually be in the history of most if not all of the unspent outputs.
Bitcoins don't have identity. A Bitcoin is a unit of magnitude for use in accounting, not a dollar bill with a serial number.
I've already addressed this issue above, see "or if they have been co-mingled with valid coins and re-issued, declare all of the progeny of that mixing as having a total value equal to the non-tainted transactions, i.e. these coins would have a "lesser value" than a regular coin."
Let's use a simple example:
If a transaction has an input of 1BC from A and 2BC from B, and an output of 1BC to C and 2BC to D, then coin "C" would be considered to have the weighted value of "A+B+B"/3 and coin D would have the weig
Re: (Score:1)
So what. (Score:1)