I Tried Hacking Bitcoin and I Failed

http://www.businessinsider.com/dan-kaminsky-highlights-flaws-bitcoin-2013-4

by mdelias • 13 years ago

155 96 13 years ago

>Modern languages like JavaScript and Ruby are great, in that they do a huge amount for you under the surface, but then you don’t actually know what they’re going to do. Ruby got burned pretty badly recently when some systems listening on the network were a little too … friendly. Engineering is a game of tradeoffs. So, of course, is business.

That sounds... a bit... confused. Was there really such an issue with Ruby or is he getting his wires crossed with the Rails problems of recent?

lmm• 13 years ago

He's equated Ruby with Rails, which isn't so unreasonable given how they're used in practice.

drivebyacct22• 13 years ago

I guess, but Bitcoin's security comes from the protocol and network design, not something inherent to C++.

ck22• 13 years ago

Try harder:

https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposu...

jacquesm2• 13 years ago

> Announced: 2013-05-15

How does that work? Is this a planned announcement of a known vulnerability or a typo?

ck22• 13 years ago

I've seen security issues given a reserved ticket number and then not disclosed until the vendor is given a certain amount of headstart?

So they are maybe saying it will be disclosed in 30 days.

thefrow• 13 years ago

I don't know all the specifics, but they've pushed a patch in March for this accidental hard-fork of the blockchain with a couple months of grace period before the fix allows larger block sizes which will not be able to be processed by older clients with the bug present.

See: http://mineforeman.com/2013/03/17/post-fork-plan-upgrade-you...

tlrobinson3• 13 years ago

Of course no software is bug free, but this is a pretty good track record.

As far as I know, none of these vulnerabilities have actually resulted in money being lost (perhaps with the exception of some mining rewards in the forks). Most of these are denial of service.

afreak• 13 years ago

>When $50K of BitCoins is stolen today, and is $500K of BitCoin five years from now, every last cent of that filthy lucre can be monitored with acute cryptographic precision until the end of time.

Unless I am mistaken we can also see Bitcoins get stopped dead in its tracks after the user loses their wallet file due to data loss, no?

reaclmbs3• 13 years ago

>When $50K of BitCoins is stolen today, and is $500K of BitCoin five years from now, every last cent of that filthy lucre can be monitored with acute cryptographic precision until the end of time.

Thats just false. Its easy to convert Bitcoin into other altcoins. And then convert those alt coins into other altcoins. And then convert those alt coins into Euros/Rubles/USD. And in the future some of these alt coin chains will vanish totally and it will take a miracle to recover the block chain history.

sophacles3• 13 years ago

Explain how.

ambiate2• 13 years ago

Yes. This is true.

Also, on your quoted statement: I do not believe the author consider money laundering with bitcoins. Say I steal $500k worth of bitcoins. I contact launder XYZ and he places my $500k worth of coins with $5.5mil worth of coins, then, funnels using smaller amounts to a multitude of addresses back to the thief. Since there are so many transactions to/from in the Launder's wallet, it would be hard to trace past that point where the $500k actually went.

marshray4• 13 years ago

So what does the launderer gain for the risk of taking the loss/blame for the theft? Surely he must impose a healthy fee? Surely this fee would be negotiable based on the good provenance of the coins.

This currency is a money-tracker's dream.

mrb5• 13 years ago

At the very end, Kaminsky says that large financial actors and nation states have the ability to deploy massive mining farms, and that somehow this is a bad thing.

I do not think so.

These actors would merely compete between each other, thereby enhancing the security of the Bitcoin network, making it harder for an individual actor to perform majority attacks ("51% attack") and rewrite the block chain. A successful attack, with large actors already participating in the mining industry, would require collusion, which I think is unlikely.

Perhaps Kaminsky simply meant that deploying massive mining farms would help them profit from Bitcoin more efficiently than the average user. This would be false. Contrary to other industries, there is no economy of scale in Bitcoin mining. I witnessed this first hand when expanding my GPU ops from 2 Ghash/s to ~60 Ghash/s in 2011. Indeed, the smaller you are, the more overhead costs become negligible and eventually effectively "free". The student mining in his university dorm, or the individual mining on his mini desktop ASIC or computer at work, have zero mining costs when operating: free electricity, free hosting, free A/C, free network connectivity. However, the ones managing huge farms have to pay for data centers, maintenance technicians, electricity, etc. This is why Bitcoin mining is a long-tail system: most of the mining power comes from a large number of small-time miners.

(I should add that at this moment, in 2013, there is a small window of opportunity for a large actor to dominate mining. ASICs are barely starting to hit the network, so in theory a large actor could deploy many of them and represent more than half of the mining capacity. However this window is rapidly closing. Most people estimate the network hash rate is going to grow by 10-50x in the next 12 months.)

peterjancelis2• 13 years ago

The risk is not in governments profiting from adding hashing power to the network, the risk is in them obtaining a majority of the hashing power and doing a 51% attack.

feral• 13 years ago

As an additional point to this, something I often don't see acknowledged is that ASICs have to be produced by chip fabs, which due to their nature are capital intensive and centralized, and hence relatively easy to bring under government control.

I guess that as a result, it'll always be possible for governments to get majority hashing power, by taking control of where the ASICs are produced.

tlrobinson3• 13 years ago

I recently calculated the cost of 50% hashing power in ASICs, and it was something like $1M.

Even if the hash rate grew 10-50x it would cost less than $50M. Well within reach of governments or large corporations.

That said, as adoption and thus the value of Bitcoin increases, the incentive to mine and thus secure the network rises, so there's a nice feedback loop.

NewAccnt• 13 years ago

Rumor has it that Butterfly has been sitting on their preorders and using it to build a massive ASIC fleet. Whether or not these are true, as you suggest, building a 51% fleet is not out of reason if you take the right path and keep your mouth shut. There has already been forks of the blockchain due to powerful miners.

http://mineforeman.com/2013/03/14/what-the-fork-was-that-a-f...

mrb5• 13 years ago

Firstly, your numbers are off. If the hash rate grew by 50x, we would be at 3.5 Phash/s, so the attacker would need to deploy another 3.5 Phash/s to attack the network. And Butterfly Labs's ASIC price is $50 per Ghash/s. So it would cost $175M.

Secondly, you cannot buy $175M of ASICs from BFL; they are too small of a company.

Thirdly, by the time you design, build, and deploy ASICs yourself (12 months+[1]), the network would have grown again, maybe by another 2x/5x/10x, who knows... you would have needed to account for this by spending respectively $350M/$875M/$1.75B !

So effectively by the time the network reach 3.5 Phash/s, it will be too late.

[1] For comparison it took more than a year for the DOE to deploy the #1 supercomputer, Titan, out of commodity hardware.

marshray4• 13 years ago

> These actors would merely compete between each other

https://en.wikipedia.org/wiki/Bretton_Woods_system

bcoates• 13 years ago

They are not obligated to play by the rules and fairly compete with each other; if their goal is not to acquire bitcoins by mining but to disrupt the system by publishing problematic blocks, they don't raise the difficulty factor.

There are absolutely economies of scale for mining (it's just making and running custom hardware, a classic economy of scale business), it's just the combination of low profitability and a small market [1] means it's not worth doing unless you're getting paid to attack the network.

[1] at the very peak pre-crash price, $341 million/year of revenue for mining every single block.

mrb5• 13 years ago

Imagine a graph where the x-axis represents the size of your mining farm (from small to big), and the y-axis the percentage of the mining income spent on operating costs.

For small values of X the curve is close to zero. As we move to the left the curve suddenly jumps, and then decreases and decreases but without ever coming back close to zero.

This illustrates my point: small miners have operating costs close to zero, above a certain size you suddenly start needing to spend quite a bit on operating costs (first rack, first A/C unit, etc), and as you scale up and up yes there is some amount of economy of scale, but never enough to reduce your operating costs close to zero.

I say "economies of scale do not exist" but what I mean more precisely is that they are not sufficient to cause big miners to push small miners out of the market.

fivre• 13 years ago

I tried hacking MtGox, but it was down.

inovator• 13 years ago

Maybe it was down because they knew you tried to hack ;)

ChuckMcM• 13 years ago

I wonder if we'll see the blog post "I hacked Mt.Gox and now have 264,832 btc, how do I sell that and turn it into dollars/rubles/yen/yuan/whatever?"

zeteo2• 13 years ago

>The cost of regulating any network actually goes up exponentially with the number of nodes that must be monitored (you need a hierarchy of systems to perform ‘guard labor’ to make sure systems are behaving within declared parameters).

This is at the core of the argument and doesn't make any sense. Worst comes to worst, the cost of monitoring all interactions between n nodes is O(n^2) even when adding monitors on top of monitors etc. The way banking is organized, it's even less. Alice doesn't transfer money directly to Bob: she talks to her bank, who talks to Bob's bank, who then talks to Bob. The banks have to monitor one-on-one interactions with their customers and the government monitors interactions between banks. This all is well within O(n), where n is the total number of customers.

I'm not saying Bitcoin doesn't have any advantages, but easier monitoring of fraud is not one of them. How do you even know the coins were indeed stolen?

hollerith• 13 years ago

>I'm not saying Bitcoin doesn't have any advantages, but easier monitoring of fraud is not one of them.

I took that to be about whether the government will be successful in shutting Bitcoin down, not about fraud.

(Even then, I do not know what he means by "exponentially" -- I decided to assume it is an inexact, not-mathematically-valid use of the word.)

kbenson2• 13 years ago

I believe he was stating that it's exponential as designed when used P2P. Large exchanges acting as banks reduces this, but by reducing some of the benefits of the design/protocol.

zeteo2• 13 years ago

>exponential as designed when used P2P

That's not any clearer than the original. Please, do explain.

polarix• 13 years ago

Moreover, we should expect the zerocoin strategy to "solve" the traceability of stolen funds.

A1kmm• 13 years ago

Even limitations legislation will allow stolen Bitcoins to eventually re-enter legal circulation.

For example, under New Zealand law, if someone (party A) stole BitCoins from someone else (party B), kept them for 6 years, and then used them to buy something from someone else (party C), party C would have be the sole legal owner of the Bitcoins, because Party B lost their legal right to the property (i.e. right to use the Bitcoins) by losing possession for more than 6 years. Party A could be charged with theft even after the 6 years, but Party C could not be charged with possession because they did not have possession at any point in the first 6 years. Party C could be compelled to identify Party A if they had evidence about Party A's identity.

With Bitcoin, Party C and Party A might be the same people, but using different Bitcoin addresses, and it might be hard to definitively prove that they are not the same, especially if Party C puts forward a credible and difficult to disprove transaction in which they obtained the Bitcoins.

Disclaimer: IANAL.

clarkm• 13 years ago

Here are the slides from a talk that Dan Kaminsky gave about Bitcoin at Toorcon Seattle a couple years ago: http://www.slideshare.net/dakami/bitcoin-8776098

I like his "Security Inversion" slide:

> Normal Code:

> * Looks like it might be OK up front

> * Scratch the surface, it's actually really bad

> Bitcoin:

> * Looks really bad up front

> * Scratch the surface, it's actually surprisingly good

> * We aren't used to systems with these characteristics

> * This code has the mark of having been audited by People Like Us

gonehome• 13 years ago

These weird coincidences along with bitcoin's very strange start (the pseudonym, the fact that it seems like a group worked on it) are really interesting. I'm surprised there's not more discussion about who really created it.

asperous• 13 years ago

The person that wrote the paper probably wanted it to go along with the idea of decentralization that bitcoin is all about. More then likely it's someone on the bitcoin.org board or perhaps even a group of people on that board.

pdog• 13 years ago

New Yorker article from October 2011 about Bitcoin and its mysterious creator. Found two possible candidate for Satoshi Nakamoto's true identity from clues in his posts and his code.

http://www.newyorker.com/reporting/2011/10/10/111010fa_fact_...

ef4• 13 years ago

His point on trace-ability is true, and one that lots of Bitcoin supporters don't fully appreciate. The system is not anonymous. It is pseudonymous, which is not nearly the same thing.

Here's some interesting work on getting to real anonymity:

http://blog.cryptographyengineering.com/2013/04/zerocoin-mak...

logicalmind• 13 years ago

I'm no bitcoin expert, and you seem to be more knowledgeable than me, so I have a question regarding this trace-ability. As far as I understand it, every transaction is essentially a digitally-signed source/dest/amount tuple. Where source and dest are bitcoin wallet addresses. These wallets/addresses can be created and destroyed at any time. So if I transfer bitcoins to a wallet/address I generated that we'll call wallet1. And then later transfer those bitcoins to another wallet I generated we'll call wallet2. If I now delete wallet1, how is the flow of bitcoins traceable?

It's entirely possible that were discussing two types of traceability here. The traceability of bitcoins from wallet/address to wallet/address will always be possible. But the wallet/address to owner traceability seems impossible. But maybe I'm misunderstanding.

shmageggy2• 13 years ago

Wallet/address to owner is potentially traceable when you sell coins for cash, as that money has to go to a real account somewhere. I think that's the point the author is making when he says none of the stolen coins have been spent yet. I'm wondering though, if there's anyone watching these stolen coins to see when they change hands. It seems like it would be fairly simple to flag certain addresses as "in possession of stolen goods" and ban them from trades on major hubs.

simondlr• 13 years ago

That's correct. That's why it is pseudonymous. You just have to make sure that any addresses you use can't be traced back to you.

irq• 13 years ago

Following your example, the act of transferring bitcoins from wallet1 to wallet2 is made public, as part of the blockchain.

Put simply: when sending bitcoins, you must send from the address that received them. You cannot, for example, receive bitcoins on one address, create a new address, and then send those same coins from that new address. You have to essentially "pay" that new address from the first address, and that action is public and traceable.

CallingIit• 13 years ago

Hooray, another Bitcoin related story! Please post more, maybe one more will convince more marks to join this doomed financial farce.

rkuykendall-com• 13 years ago

A doomed financial farce can still be fascinating, and can still be a huge milestone in mankind's history. In fact, I would say a huge percentage of our history is made up of doomed farces. The more spectacular the failure, the bigger the impact. Bitcoin, doomed or not, is starting to become pretty spectacular.

drivingmenuts• 13 years ago

It's all fun and games until someone's economy gets Really Unalterably trashed and then the guns come out.

The Bitcoiners live in some digital utopia where no one ever pulls a real gun because of politics, but the rest of us are going to have to pick up the pieces for their hubris.

RyanZAG• 13 years ago

Premise here is pure madness - I'm sure I could ask a random security researcher to hack Chrome and he would surely fail. But at the next Hack-a-day or similar, Chrome WILL be cracked wide open when the whole world gets a shot. So no - your inability to hack Bitcoin is not some grand statement of security on Bitcoin, only a statement that you didn't manage to hack it. I'm sure you didn't manage to hack thousands of other things that other did manage to hack, too (unless you've somehow hacked just about everything else including Ruby - not RoR?).

His point about how easy it is to monitor Bitcoin is unfortunately turning out to be true, which is incredibly unfortunate as Bitcoin is currently being used to purchase illegal drugs and similar. Once the FBI/NSA gets in on it, we're probably going to see a bunch of pointless arrests.

marshray4• 13 years ago

Dan may be random, but he's no "random security researcher". And he has, in fact, hacked "just about everything" a time or two by discovering and exploiting common mode vulnerabilities.

His point of view is worth listening to.

deepblueocean• 13 years ago

His point of view is certainly worth listening to, but Dan should know better than anyone that the fact that even he can't break something is still not an argument for (or even a suggestion of) its security.

lawnchair_larry• 13 years ago

Isn't that overstating his accomplishments a bit? Unless by "just about everything", you mean the DNS bug and the media, sure...

None of his published work seems consistent with the skillset that would qualify one to thoroughly audit bitcoin. He tends to stick to higher-level, less technical vulnerabilities.

makomk• 13 years ago

In fact, there was actually a really interesting vulnerability he'd missed which was discovered by the developers shortly afterwards. Due to a flaw in the merkle tree Bitcoin used to calculate block hashes, you could trivially create a new invalid block with the same hash as almost any valid one. If you managed to feed the bad block to a node before it heard the good version, that node wouldn't ever accept the correct version because it "knew" that block was invalid. Do that to an exchange or wallet and maybe a couple of big mining pools and you could fork the exchange onto a different version of the blockchain, convincing them you'd sent them bitcoins when you hadn't. I don't think it would have required much in the way of resources to pull off either.

nfm• 13 years ago

http://en.wikipedia.org/wiki/Dan_Kaminsky

He found serious flaws in DNS and SSL. Of course one code review is not authoritative, but he is pretty credible.

Tycho• 13 years ago

But BitCoin doesnt need a sponsored hackathon for people to start finding flaws in it. As the author pointed out, there is a huge reward already waiting for anyone who can cheat bitcoin. That should guarantee that many have already tried and failed along with the author.

Unless of course they succeeded but kept it to themselves for strategic reasons.

ph0rque• 13 years ago

The bit about stolen money being forever traced is very interesting, and leads me to an idea: can an ethics flag be added to the mining software to make your client refuse to process transactions on stolen bitcoins?

Although now that I think about it, one could allege that your bitcoins, which really belong to someone else, have been stolen, and thus effectively prevent that person from spending those bitcoins. So you would need to have a very high bar for determining those bitcoins were really yours.

shalmanese• 13 years ago

I asked this on Quora a couple of months ago: http://www.quora.com/Bitcoin/Would-it-be-theoretically-possi...

baltcode• 13 years ago

I have a noob question if someone can answer it. It seems to me that mining is a computationally wasteful exercise. Why don't crypto-currencies just reward the computations needed to keep and confirm transactions, which is actually an economically beneficial service?

lcampbell• 13 years ago

> the computations needed to keep and confirm transactions

AFAIK, that's effectively what mining is. From my understanding, transactions exist in a limbo state (where they're relayed around the bitcoin network) until they're included in a mined block and become part of the blockchain. A "mined block" is basically just a list of transactions (including a coinbase transaction, which is the new bitcoins), the merkel root of the previous blocks, and some other data such that the hash of the entire thing is suitable, as determined by the network difficulty. Thus, mining and confirming transactions are effectively one and the same.

Sorry for the poor (and possibly incorrect) explanation, I'm still wrapping my head around it too.

ealloc• 13 years ago

as lcampbell said, the point of mining is actually to keep and confirm legitimate transactions. Mining needs to be a 'difficult' (but otherwise useless) problem like cryptographic hashing in order to make it difficult to fake transactions. Computations which might be useful in some other way are too easy - only cryptographic hashing is 'difficult' enough to stop the fakes.

It's kind of like captchas - a seemingly pointless pain in the ass on purpose to weed out the spam.

gbhn• 13 years ago

I have a question. I read on the bitcoin site that currently the transaction rate is limited (at 7tps). This seems like a good precaution, as otherwise someone could try to flood the network, but what enforces that limit? Is it that by and large miners use software with that limit, so transaction floods are ignored?

matthew-wegner• 13 years ago

Two reasons:

1) The hashing difficulty automatically adjusts to match the network throughput, so that new blocks are found once every 10 minutes. New blocks introduce new Bitcoins, so this controls the total supply.

2) New blocks extend the last agreed-upon block. If an attacker forged a block, they would have to do so faster than the rest of the network combined to control the entire block chain (clients agree the longest block chain is legitimate). While you could do this without the same computational expense, it would rely much more on Internet connectivity.

An older AMD GPU can calculate ~250 million hashes per second. With no difficulty, a transaction could be verified on the network as fast as miners could broadcast their agreement. This would mean attackers could more easily control the block chain with DDoS and other network-related tricks. Even now, the largest mining pools are sometimes targeted to slow down transaction processing.

gusgordon• 13 years ago

This article really isn't that good or that interesting. I understand people who hold bitcoins upvote anything that says something positive about the currency, but come on, not this.

_pmf_• 13 years ago

> Written in C++, which for all of its strengths is not usually the safest thing in the world to be reading random Internet garbage with

What kind of retarded nonsense is this? What the fuck does this guy think his scripting toy languages are written in?

I Tried Hacking Bitcoin and I Failed

Related Stories