Mt. Gox under DDoS attack as bitcoin price surges

http://www.computerworld.com/s/article/9238118/Mt._Gox_under_largest_DDoS_attack_as_bitcoin_price_surges

by morphics • 13 years ago

94 75 13 years ago

wladimir5• 13 years ago

One thing with Bitcoin that still needs to be decentralized is the exchanges. This shows again that mtgox is the achilles heel. Sure, there are many other exchanges and ways to sell/buy, but it's telling (and sad) that DDoSing mtgox is an effective price manipulation method.

As the stakes grow higher Bitcoin is turning into an interesting endeavor in building resilent systems and preventing Single Points of Failure.

TazeTSchnitzel2• 13 years ago

It is already decentralised in the sense that there are plenty of alternatives, and there are "over-the-counter" places like Bitcoin's #bitcoin-otc.

wladimir5• 13 years ago

I know that. But for some reason there is an extreme reliance on mtgox for price information. Even trades in -otc are usually based on the mtgox price. So maybe I worded it wrong, it's not so much trade that is centralized but the trade/price broadcasting.

mtgx• 13 years ago

If the banks ever start adopting it, then trading Bitcoins should become pretty decentralized.

wladimir5• 13 years ago

In what sense are banks decentralized? Aren't those too-big-to-fail giants what we're trying to get away from in the first place? :-)

oleganza• 13 years ago

The reason for a lack of easy to use exchanges is the artificial cost of entry. You cannot simply set up a website to trade coins for money with some friends because of licensing, regulations, capital requirements etc. If you were free to move your money how you want on the internet without questions asked, we would have many exchanges (and probably wouldn't need Bitcoin in the first place).

tlrobinson3• 13 years ago

This is one of promises of Ripple. It will be interesting to see how it plays out.

skore• 13 years ago

> What can you do?

> Like our favorite author here at Tibanne says… Don’t Panic!

> “Panic-selling is a wide-scale selling of an investment which causes a sharp decline in prices.[...]” (Source: Wikipedia)

But... But I want it to crash! Just a little! So I can finally buy lots of bitcoins myself!

lucb1e2• 13 years ago

I want it to crash too! Like, drop to half the price and then http://3.bp.blogspot.com/_JZ0rN-zdg2M/TU_NRnvhGfI/AAAAAAAAAF...

viraptor2• 13 years ago

I don't think it can crash anymore. Not like the last time anyway. Too many people know that the price will go back again and want this to happen. (me included)

What that means in practice is that some people will buy after 5% drop, more after 10%, even more after 15%, etc... I don't believe anymore that we can have a proper crash in this situation. If we do, the price will bounce back in a matter of seconds. I'm probably not the only one keeping an open order to buy as many bitcoins as possible at below £5. Lack of sell-stop orders on mtgox also means there's nothing to balance them out (apart from automatic trading).

saraid2162• 13 years ago

You should really photoshop those dollar signs into bitcoin symbols.

lucb1e2• 13 years ago

It's a bird....It's a plane...It's Cloudflare!

Edit: Oh they're already using it? Guess they can't save the day then... MtGox seem to be up now though.

nwh• 13 years ago

Most Bitcoin websites, Mt. Gox included, are already behind CloudFlare. Worryingly, this means they have surrendered their SSL private keys to a secondary company.

wladimir5• 13 years ago

Worryingly, indeed. To me it appears that the "cloud" is the next bastion of centralization and "too big to fail"s. In this case, instead of providing services in a decentralized fashion that makes it hard to attack, they hide behind ever larger and stronger behemoths.

In the case of cloudflare there is no great data loss if they disappear, though they could intercept passwords and private data (can you trust them? who has access? what if they are hacked?). But when a service such as gmail (suddenly) disappears... it would be devastating to many people. Much like the failure of a bank.

gphil• 13 years ago

Yeah, but you also already have to trust the certificate authority, your ISP, your employees who have access to the server...the list goes on.

Furthermore, I believe the way it works is that clients make an SSL connection to CloudFlare, who makes another SSL connection to your service (using different key pairs.) Granted, they still get to see all your traffic unencrypted, but it all just comes back to trust.

api2• 13 years ago

Anyone remember EFNet IRC in the mid-1990s? Bitcoin is going to be like that, except real money is at stake.

skrebbel• 13 years ago

I remember EFNet allright, but I've still no clue what you're talking about.

At least to my understanding, EFNet was (is?) an IRC network. With channels. Where people chat. Maybe I missed some relevant history?

yebyen2• 13 years ago

I think he's remembering #e or something like that, where I spent a great part of my childhood (before it moved to Freenode and forked to #gah) where things happened before the public knew, such as VA Linux, E17, offended.co.uk (author of feh), and MythTV.

And ferite. (a c-like scripting language that I love, with regex's)

api2• 13 years ago

Basically, the old IRC protocol was pretty brittle. You could break the network with DDOS attacks, exploits, etc. in order to get "ops" on IRC channels. This resulted in a sort of emergent hacker game called channel wars. Massive attacks were constantly being launched, to the point that running an IRC server became a way to have a serious target painted on your connection.

andyzweb• 13 years ago

I'm still banned for life from EFNet for some mid 90's transgressions.

trotsky2• 13 years ago

Mt. Gox is in the midst of a major technical overhaul of its exchange. Gay-Bouchery said Mt. Gox is rebuilding its trading platform from the ground up.

We're throwing out our entire OLTP system, but trust us - the lag and error pages that have been popping up on our heaviest trading day of the year are caused by hackers.

CapitalistCartr• 13 years ago

Attackers. They're not hackers, they're vandals throwing eggs at your house.

Karunamon• 13 years ago

Yes it's entirely more likely that they're breaking their own service (which with transaction fees is their primary income source) rather than some person or group screwing with the exchange in order to influence the price.

trotsky2• 13 years ago

Heh. I'm suggesting their trading platform is having trouble scaling, not that they're doing it on purpose.

brokentone• 13 years ago

Largest DDoS attack? A mighty claim without any numbers. I thought we just had the largest attack on Spamhaus the other week anyway? Oh well, I quit tech news stories.

swinglock• 13 years ago

I assume against Mt. Gox.

SethMurphy3• 13 years ago

With all the vague claims about attacks and building a "bullet proof" system I have a hard time trusting them any more than a trader at a big bank selling their own complicated financial instrument. He seems to be trying to manipulate the prices with these statements too. Good thing it is unregulated. Oh yeah, and "He warned bitcoin traders not to panic or invest more money than they're willing to lose." IMHO this is a straight up admission it is a speculative investment and not a real currency at the moment.

jimktrains22• 13 years ago

I'm pretty sure that Grade A bonds, CDs, and IRAs, among few others, accounts are the only types of investments that one should consider putting more money then they're willing to loose into.

Bitcoins is a ForEx market, and like any ForEx market, you can lose money, quickly.

gibybo• 13 years ago

Technically speaking, an IRA is just a (brokerage|bank) account with a special tax designation. It won't stop you from putting all your money in a penny stock or out of the money options, for example.

jbooth• 13 years ago

Unless you do most of your financial transactions in bitcoin, you're treating it as a speculative investment.

If you're buying bitcoins in order to make an online purchase, you're using it as a currency.

If you're buying bitcoins, then selling them back to dollars/whatever when you need money, you're treating it as speculation.

rmrfrmrf2• 13 years ago

> IMHO this is a straight up admission it is a speculative investment and not a real currency at the moment.

Did anyone ever claim that it was? I mean...it's a real currency in the sense that people are using it to exchange goods and services, but IMO anyone who has the expectation that Bitcoin should have had all of its issues figured out right out of the gate has their standards set a wee bit high.

SethMurphy3• 13 years ago

I am not a banker or an economist, but when I hear the word currency I have certain expectations, savings and spending come to mind first. Speculation is not something I immediately think of. In reality the use of it as a currency seems to be limited, at the moment, to high margin items (food, virtual goods). While I have personally seen virtual services accepting Bitcoins I have yet to see a local small business accept them myself. I would not feel comfortably saving or spending them at the moment, so I don't look at them as a true currency. I do highly stress "at the moment" though, anything is possible and this is fascinating to watch from the sidelines.

NelsonMinar2• 13 years ago

In this article Mt Gox says that the attacks are to manipulate the currency. My first guess was this was a shakedown; it's not uncommon for organized criminal gangs to DDOS a site until they pay a ransom. Grey market sites are particularly vulnerable to extortion; online gambling, for instance.

baby2• 13 years ago

What kind of sources do you have to back up this theory? Never heard of that before.

NelsonMinar2• 13 years ago

The main source I've read on DDOS extortion is "Fatal System Error". It's largely about Barrett Lyon's company Prolexic, a company specifically providing DDOS protection for online casinos. But that's just one example, I think there are many more. I have zero specific evidence that there's been DDOS extortion against BitCoin providers, but it sure seems plausible.

eli• 13 years ago

And the concept is hardly new: http://news.bbc.co.uk/2/hi/technology/4579623.stm

kgo• 13 years ago

Some Russians tried this in May 2011 during the last bubble. MtGox was transparent about it.

https://bitcointalk.org/index.php?topic=7494.0

tlrobinson3• 13 years ago

The lag of six or seven seconds before a trade is executed "is not acceptable,"

I don't understand what a DDoS has to do with trade lag. They're DDoSing the website, not the trading engine, right?

6 or 7 seconds is bad enough, but it's a huge understatement. MtGox's trading engine "lag" can grow to absurd numbers, it was like 10 minutes a couple days ago. I honestly can't comprehend how it gets this bad. It should be on the order of micro or milli seconds. It's not like matching up trades is computationally expensive.

Anyone have an explanation?

M4v3R2• 13 years ago

6, 7 seconds? Few days ago there was a 1 HOUR lag. I am not kidding. All MtGox APIs have lagged a whole frickin' hour behind their trading engine. Now THAT was bad. And I see more than 60 seconds lag nearly every day.

Edit: Seems you updated the post, so now my is obsolete :).

Anyway, their official explanation is that the engine is so slow because when iterating over the whole orderbook, which is huge, they have to check if every offer has enough funds for it to be executed. This is a design flaw and they want to fix it by not letting you to place a order without sufficient funds in the first place.

tlrobinson3• 13 years ago

That sounds like terrible software engineering and doesn't inspire confidence.

saosebastiao2• 13 years ago

I would hope not, but this makes me skeptical. Does this mean that the trading engine and the website are the same entity?

waterlesscloud2• 13 years ago

Yes, they are.

They currently have a project underway to separate the two.

The site owner, MagcialTux, said yesterday in irc that for the last couple of years (since the first bubble) they've basically made barely enough revenue to keep the site running (and sometimes at a loss), much less improving it. They looked at loans, but the most they could arrange was a couple hundred thousand, which wouldn't have been enough apparently. They also privately contacted big bitcoin fortune holders for loans, to the same result.

The kind of people that you'd hire to make it work right are expensive, to no one's surprise. The last few months have given Gox a huge increase in revenue, and they're using it to finally upgrade their tech.

I'm not a Gox fan, and I wish people would use the other exchanges and get some diversity into the system, but I can understand how they got where they are.

baby2• 13 years ago

What is bad is that sometimes you can't cancel a bid or an offer and you end up selling or buying something you didn't want.

Well that's actually bad if you day trade... which is kinda bad for the currency anyway.

jpdus• 13 years ago

Does anyone had a withdrawal request processed by Mt.Gox during the last days?

I requested 2 withdrawals more than a week ago and didnt receive any funds nor do the requests show up in my account history...

saosebastiao2• 13 years ago

Bitcoin makes for some great speculation, but I absolutely cannot treat it as a currency until the prices stabilize independent of the exchange used.

kurtko• 13 years ago

The prices can't stabilize if it is to reach broad adoption. That is the essence of the Catch22 going on here.

drcode• 13 years ago

What are you talking about? It's been 24h since we've had a fluctuation greater than 5%!

(kidding)

ChuckMcM2• 13 years ago

Fascinating stuff. Since there is no legal authority behind Bitcoin (meaning people with jails and a willingness to use them) there are incentives to find ways to manipulate it in these sorts of ways, and little risk.

I don't doubt for a minute that the authorities find this amusing since they would no doubt rather a currency outside anyone's jurisdiction got established and so people who destabilize it are "friends" of a sort. That makes them less likely to intervene.

That combination makes BitCoin sort of like [1] Eve Online, but with drugs instead of spaceships. I wonder if this will lead to the creation of 'recovery agents' like the art world has, usually former thieves or investigators who work for insurance companies for a percentage of the recovered value.

[1] in the sense that you can scheme and plan large takeovers and heists and the "outside" world doesn't care.

saraid2162• 13 years ago

EVE Online has drugs, too. #justsaying

kiba• 13 years ago

Buying drugs for bitcoin just happens to be the most famous use, because the media love to pay attention to Silk Road. So when everyone think about bitcoin, silk road comes to mind. Everything else associated with bitcoin just get left behind because it is boring.

tolmasky2• 13 years ago

I know this is a commonly held belief, and quite possibly also the correct legal interpretation of the situation, but I find it so strange. A currency is just what we call a currency. If tomorrow my friends and I decide to start trading goods for bicycles, then our bicycles become currency. I don't see how that would all of a sudden make it OK to steal each other's bicycles, or somehow put bicycles outside the scope of existing laws. If I went to the police and said "Someone stole my bicycle", it would seem crazy for them to respond with "haha should have kept that value in USD instead sucker!"

Every physical good we have has only the value we instill in it in our minds. The absolute best analogue to this is chips at a casino. Chips really are a parallel currency. They can buy you anything within the mini economy of the host casino (and additionally are accepted by other fringe elements in said city). They can be exchanged back for USD as well. Despite this, the authorities in Las Vegas take casino chip theft very seriously. Now people can go out of their way to explain how chips aren't really currency for whatever reason they want. To that I could then respond "fine, but in that case I also don't believe bitcoin to be currency either, just my own digital property, like an iTunes song. So I still expect to have these digital assets protected by the law".

regis• 13 years ago

How is your iTunes library protected by law?

baddox• 13 years ago

It should be noted that when there is a legal authority behind a currency, there is immense incentive to find ways to manipulate and infiltrate that authority. I would even argue that this incentive is stronger than the incentive to manipulate a decentralized currency.

someOtherName• 13 years ago

Because what is "Mt. Gox"???

https://encrypted.google.com/search?q=Mt.+Gox

https://mtgox.com/ "Mt.Gox is the world's most established Bitcoin exchange."

jmgao• 13 years ago

It's a Magic the Gathering Online card exchange.

nsoun• 13 years ago

Are there patterns in flow traffic that monitoring tools could help detect/mitigating a DDoS like this?

Mt. Gox under DDoS attack as bitcoin price surges

Related Stories