Slashdot Mirror
Network Hijacker Steals $83,000 In Bitcoin
An anonymous reader writes with news that bogus BGP announcements can be used to hijack work done by cryptocurrency mining pools. Quoting El Reg: Researchers at Dell's SecureWorks Counter Threat Unit (CTU) have identified an exploit that can be used to steal cryptocurrency from mining pools — and they claim that at least one unknown miscreant has already used the technique to pilfer tens of thousands of dollars in digital cash. The heist was achieved by using bogus Border Gateway Protocol (BGP) broadcasts to hijack networks belonging to multiple large hosting companies, including Amazon, Digital Ocean, and OVH, among others.
After sending the fake BGP updates miners unknowingly contributed work to the attackers' pools.
It has to be said.
And is this even illegal?
I doubt it.
Good thing I keep my miner offline. Anyone who connects their mining rig to the Internet deserves everything they get.
Apparently he was able to spoof some control messages to the miners since their only validation was IP address. It is an interesting question: since they should have known about this BGP vulnerability which has been used before, why didn't their minerserver communication have stronger validation? The answer would be, I think, that they didn't bother since it happens so rarely. Probably from now on they will start using another layer of validation. Yet another example of how security happens in the real world: it doesn't get used until the pain gets bad enough.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
...Bitcoins are like money in real banks and are insured. No harm to the victim.
Oh wait....
It's a blockchain. It's know what portions were stolen. Send a message out to all people involved in this scheme to not accept them.
Oh right - that would undermine the illusion of "freedom".
At least this weeks compulsory Bitcoin story is sort of amusing.
This trick is as old as it gets. BGP will accept a more specific route as superior to a more general route, and there is no authentication in the exchange. The flaw here is the upstream providers involved did not properly filter the routing announcements allowed from this attacker, and instead let them announce net blocks that were not their own, then intercept the traffic to those net blocks.
In other words, nothing to see here, move along.
From what the article says, this hijack went on for months without anyone noticing, and only came to attention because one guy happened to notice that his mining client was connecting to the hijacker's pool server. The first person to notice it did so on March 22nd, when the hack had been running since at least early February. My question is, why didn't people notice their profits vanishing in the month before the first person reported it?
Piker. Should have applied himself.
In C++, your friends can see your privates.
I've been pointing out the risks of router poisoning for, what, 17 years now.
Ever since the NSA started demonstrating router poisoning, it was only a matter of time before even the script kiddies figured it out.
I've been pointing out that the current rash of cryptocurrencies have excessive reliance on trust for the past year.
This sort of attack was inevitable. Bitcoin can plead semi-innocence because strong authentication is counter to strong anonymity. However, no router on the Internet should accept rogue announcements - even from three letter agencies - or accept unauthorized changes to the running configuration or active router tables.
MITM attacks are exceptionally dangerous and the hazards can only get worse.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Somebody stole me kibbles and bits!
-- A Lying Imp
So what we have here are two problems.
One lack of authentication for the miners with the pools. Something a few SSL on the servers and wrapping those sockets calls with openSSL would make the route hijacking ineffective for stealing mining resources.
So there is a lesson in this whatever it is you are doing on the internet if you care AT ALL about it you should be using SSL and checking certs, (Looking at your slashdot) sure there are tons of problems as weaknesses in SSL but until something better comes along its beats the hell out of clear text with no authentication what so ever.
Two BGP needs to be replaced or updated to support much stronger authentication and the network operators need to just push getting it done, even if it means telling customers we can't / won't peer with you and neither will anyone else unless you get you routers and or software update to do this. If they stick together in it there should be no trouble getting that done.
Stealing some computer cycles used to generate bit coins is probably among the least real harm someone with access to advertise bogus routes in BGP could do; and lots of people are in a position to do that. We should be thankful its only a little money these guys were making off with. The Internet has gotten to big for the network operators to just relay on everyone playing nice and being good citizens, We need some stronger technical controls put in place and regular auditing beyound well nobody has complained on NANOG.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
You say unknown miscreant.
On Wall Street they're simply called "staff".
Frankly, I see little difference between stealing BitCoins from a mining pool and High Frequency Trading. And that's perfectly legal.
Lost at C:>. Found at C.
The use of bogus BGP to treat networks into believing that it is connecting to a legitimate network instead of having its own network stream being hijacked can be used for much more than mere Bitcoin snatching
It can also be used to "branch out" legitimate net traffic to some listening posts (something NSA and all other spy agencies like to do) and thus, further compromise the legitimacy of the network itself - and the loss of privacy / data / whatever that the data stream happen to contain
This is a serious threat !
Muchas Gracias, Señor Edward Snowden !
I don't know, is stealing property illegal? .. so I am guessing the legal system has to back that up.
IRS deemed it "property" and wishes to tax us on it
Bitcoin transactions are already traceable in the blockchain. The information is already there to declare that a given transaction is "null and void" and identify all bitcoins that were affected by that transaction and void them or if they have been co-mingled with valid coins and re-issued, declare all of the progeny of that mixing as having a total value equal to the non-tainted transactions, i.e. these coins would have a "lesser value" than a regular coin.
The problems are not purely technical - they are social and managerial:
The social problem is this:
* Would we rather have a system where crooks can get away with stealing and washing funds and take the risk that OUR funds may be stolen (the current system),
or,
* Would we rather have a system where crooks and those who deal with "shady characters" know they might wind up with worthless coin, thereby disincentivizing this kind of activity, at the cost that anybody at any time may wind up having their coinage de-valued or voided because it was found to be stolen in a transaction days, months, or years ago?
The managerial problem is this:
* Do we want to have a system in which "the community" endorses a coin's devaluation or voiding, and if so, how would that decision be made?
* Do we want a system in which individuals decide for themselves if they want to accept "dirty money" and merely provide them with a means to determine if a given BC is tainted or not?
The latter option is something that anyone can do for themselves today at least in principle:
I can decide that I refuse to accept any BC if it has a certain known-evil transaction in its blockchain history. Yes, this will require me to do a lot of work before accepting any transaction, but in principle, I could do it. If a lot of heavy hitters started doing this - or if major countries started requiring businesses in their country to check coins against a government-run blacklist before accepting them - then this will become a reality even if the majority of the BC community doesn't support the idea.
I guess the questions are:
* Does the community want to "head off" the "individual choice"/"nationally mandated choice" option by doing the work needed to have a community-managed coin-invalidation system?
* Does the community want to maintain the status quo, knowing that the "individual choice"/"nationally mandated choice" option is likely in the future?
* Does the community want to take technical and other measures to make any kind of coin-invalidation system so impractical that it won't be done in the foreseeable future or at least take measure to make it infeasible to invalidate coins that have been through more than a few transactions and/or who have been reported as stolen more than a few hours ago?
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Stolen coins are sold or mixed immediately, so the criminals would keep their money while innocent people holding coins at the time of revocation would get burned. All you'd accomplish is screwing over normal people to bail out some big mining pool. It's one-line feel-good measures like this that are destroying the mainstream economy, so I'm glad the burden is on you to convince all users - not just the ones on top - to adopt this change.
How many years has bitcoin been amusing you?
Miscreant. Had to look up pronunciation. Learned a new work! Thanks, Slashdot!
That's nothing. I have $10,000,000 in Monopoly money.
That's the thing with illusions isn't it? They are not real.