Hacker Redirects Traffic From 19 Internet Providers to Steal Bitcoins

http://www.wired.com/2014/08/isp-bitcoin-theft/

by muneeb • 12 years ago

171 64 12 years ago

wired.com

0x0• 12 years ago

Could this be prevented by adding some TLS to the mining control channels?

Filligree• 12 years ago

Yes.

It's both hilarious and ironic that they didn't.

smutticus• 12 years ago

Here is the link to the original research.

http://www.secureworks.com/cyber-threat-intelligence/threats...

cgjaro2• 12 years ago

Upvote the parent!

mrb• 12 years ago

I work in InfoSec and it is mind-boggling to see the sophistication levels of some of the Bitcoin heists, like this BGP incident. When was the last time you saw a BGP attack? 99.9% of real-world attacks don't even bother targetting such a core routing service. Another example: in March 2012, internal Linode management infrastructure was compromised to steal 47k BTC: http://blog.zorinaq.com/?e=67 http://www.theregister.co.uk/2012/03/02/linode_bitcoin_heist... This means attackers had effectively root access to any Linode's customers' VM! When was the last time you saw an entire cloud provider environment being compromised?

I like to see it as ISPs and cloud providers increasing their security and patching vulnerabilities thanks to Bitcoin's growing adoption :)

0xeeeeeeee• 12 years ago

It is incredible, the equivalent of the "Oceans" movies but electronic instead. For everyone one of these sophisticated attacks there is a huge number of smash and grabs.

Really interesting stuff. It is only getting better as well (imho). I am honestly not noticing any increase in security aptitude in the average engineer. People are still making the same mistakes.

blazespin• 12 years ago

It's a fundamental problem with bitcoin in that it hugely incentivizes computer hacking. The more widespread bitcoin and blockchain becomes, the greater the incentive. There will be a lot of collateral damage from all this.

onewaystreet• 12 years ago

The same thing can be said about credit cards. If there is a problem with Bitcoin (and I'm not sure that there is) it is that unlike with credit cards there is no possible recovery of stolen coins.

arjunnarayan• 12 years ago

The great thing about this is it that it puts a floor on the bounty on all network bugs. Since we know that lots of national security folks are regularly exploiting various bugs for their own purposes, this means that the internet will be significantly improved. I see it as a bonus.

oafitupa3• 12 years ago

Sounds like a problem with computers, not Bitcoin.

andreasvc• 12 years ago

Nothing fundamental with bitcoin, same thing happens with online banking. In general, people will try to steal anything of value.

tomp• 12 years ago

At the same time, it hugely incentivizes improvements in computer security. After all, it's "our" fault for still using crappy and buggy Linux, Windows and Mac OSes, written in crappy and error-prone languages such as C and C++. Mind you, this crappy software is responsible for a lot more thefts than just bitcoin (e.g. China hacking and stealing trade secrets), but with bitcoin, you can put a definitive (if volatile) dollar price on the hacking.

mpyne• 12 years ago

I like to see it as ISPs and butt providers increasing their security and patching vulnerabilities thanks to Bitcoin's growing adoption :)

They'd have every reason already to increase their security. So I'll take the other approach, and continue to enjoy popcorn when I read about yet another one of these heists.

seanp2k2• 12 years ago

What are you using to replace "cloud" with "butt" :)

ChuckMcM2• 12 years ago

That there is this level of investment is not particularly surprising when the item is fungible for cash (even at a fractional rate to market). There is the added kicker that often the failure/loss will go unreported if the victim has more to lose than the attacker (see early Mt Gox moves at 'covering' the fact that bitcoins were stolen).

It is difficult for me to imagine a better way to incentivize the creation and deployment of malware than Bitcoin today.

jusben1369• 12 years ago

Well given how long Target and others sit on massive CC data breaches you'd have to say the same incentives exist for CC attacks and bitcoin.

thaumasiotes• 12 years ago

Actually, based on the numbers in the article I do find the level of investment surprising.

Though each redirection lasted just 30 second or so, the thief was able to perform the attack 22 times, each time hijacking and gaining control of the processing power of a group of bitcoin miners
At its peak, according to the researchers’ measurements, the hacker’s scam was pocketing a flow of bitcoins and other digital currencies including dogecoin and worldcoin worth close to $9,000 a day.

An estimated 22 half-minute episodes of hijacking a flow worth $9000 / day. There are 1440 minutes in a day, so $9000*11/1440 = $68.75 . The means here are much more impressive than the ends.

edit: forget what I said, the article later says that $83,000 of currency was taken.

marcosdumay2• 12 years ago

Maybe I should buy some Bitcoin... Keeping a online wallet may be a great way to test a computer's security.

(Ok, half kidding, it's not secure, whatever computer I could talk about.)

nchelluri• 12 years ago

Link is a 404 for me.

kmod• 12 years ago

The finger-pointing at BGP is red herring: the problem is that the stratum protocol has zero authentication. If you can intercept those streams, you can trivially ask anyone to start mining for you instead. This could also have been done using DNS poisoning, ISP-side intercepts, or anything else in the standard bag of tricks. http://blog.kevmod.com/category/bitcoin/

bdamm• 12 years ago

Indeed, for bitcoin it's a solvable problem, however let's not let that distract us from the monumental revelation that BGP hacking is so easy to do that someone motivated by a relatively paltry reward can pull it off.

This is one aspect of bitcoin that I really like, it shows us where the weaknesses are.

marcosdumay2• 12 years ago

You're certainly not looking, because BGP insecurity is very old news.

scott_karana• 12 years ago

Wow. Not sure why they don't name-and-shame the ISP, but that's really ridiculous.

sergers• 12 years ago

As a Canadian, using a Canadian ISP, I would like to know as well.

Not entirely surprised regarding rogue employee possibility.

dfox• 12 years ago

There are two things at play here: attacker has to have access to one ISP to inject the route (eg. rogue employee) and there has to be another ISP that accepts such route from BGP (I would say that filtering weirdly specific routes is good and common practice). When you have access to ISP network you don't have to inject things into BGP to attack your own customers.

tacoman• 12 years ago

"the CTU research team provided the BGP evidence to the upstream ISP closest to the origin of the malicious activity."

I think this likely means it's a smaller ISP.

tbarbugli• 12 years ago

Jack Bauer will take good care of this issue

devicenull2• 12 years ago

NANOG post from this morning has the AS path:

http://mailman.nanog.org/pipermail/nanog/2014-August/069131....

I'm unsure exactly which was originating the route.

mickayz• 12 years ago

The lack of auth and encryption is only part of the problem with Stratum's implementation. At Toorcamp 2014 I presented about the vulnerabilities discovered when looking into common miners and their impact on the network. More details available in the associated white paper:

http://www.dejavusecurity.com/blog/2014/7/15/bitcoin-researc...

rdl• 12 years ago

It's mind boggling to me that this wasn't done a year or two ago.

If bitcoin were genuinely anonymous (it isn't, because it's highly linkable, even if essentially pseudonymous), it would probably be vastly more dangerous in this way -- there would be billions of dollars spent on exploiting security outside bitcoin++ to steal bitcoin++.

runeks• 12 years ago

It's mind boggling to me that this wasn't done a year or two ago.

Two years ago, obtaining the same amount of bitcoins as this attack did would net you 1/100th the profit in dollars (bitcoins were around $6 a piece two years ago).

I think it's likely that attackers started considering this scheme around a year ago, when the bitcoin price shot up to $100, and the potential rewards became sizable.

driverdan• 12 years ago

I know a number of people who got hit by this type of reconnect attack. I suspect I may have been hit by it for short periods of time. Most of the big altcoin pools were targeted. Soon after most miner software was modified to disable this Stratum feature but there are still plenty of other issues with the Stratum protocol as highlighted by other comments.

gluczywo• 12 years ago

Nobody has pointed it out so far. Since it is an attack on IP routing, it could be prevented by using SSL for the Stratum protocol used by mining pools.

fsniper3• 12 years ago

Would it? With this sophistication and latest exposures of CAs security I'm not fully sure that TLS MITM is a remote probability.

Hacker Redirects Traffic From 19 Internet Providers to Steal Bitcoins

Related Stories