Slashdot Mirror
Network Hijacker Steals $83,000 In Bitcoin
An anonymous reader writes with news that bogus BGP announcements can be used to hijack work done by cryptocurrency mining pools. Quoting El Reg: Researchers at Dell's SecureWorks Counter Threat Unit (CTU) have identified an exploit that can be used to steal cryptocurrency from mining pools — and they claim that at least one unknown miscreant has already used the technique to pilfer tens of thousands of dollars in digital cash. The heist was achieved by using bogus Border Gateway Protocol (BGP) broadcasts to hijack networks belonging to multiple large hosting companies, including Amazon, Digital Ocean, and OVH, among others.
After sending the fake BGP updates miners unknowingly contributed work to the attackers' pools.
Apparently he was able to spoof some control messages to the miners since their only validation was IP address. It is an interesting question: since they should have known about this BGP vulnerability which has been used before, why didn't their minerserver communication have stronger validation? The answer would be, I think, that they didn't bother since it happens so rarely. Probably from now on they will start using another layer of validation. Yet another example of how security happens in the real world: it doesn't get used until the pain gets bad enough.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
...Bitcoins are like money in real banks and are insured. No harm to the victim.
Oh wait....
It's a blockchain. It's know what portions were stolen. Send a message out to all people involved in this scheme to not accept them.
Oh right - that would undermine the illusion of "freedom".
At least this weeks compulsory Bitcoin story is sort of amusing.
This trick is as old as it gets. BGP will accept a more specific route as superior to a more general route, and there is no authentication in the exchange. The flaw here is the upstream providers involved did not properly filter the routing announcements allowed from this attacker, and instead let them announce net blocks that were not their own, then intercept the traffic to those net blocks.
In other words, nothing to see here, move along.
From what the article says, this hijack went on for months without anyone noticing, and only came to attention because one guy happened to notice that his mining client was connecting to the hijacker's pool server. The first person to notice it did so on March 22nd, when the hack had been running since at least early February. My question is, why didn't people notice their profits vanishing in the month before the first person reported it?
Piker. Should have applied himself.
In C++, your friends can see your privates.
I've been pointing out the risks of router poisoning for, what, 17 years now.
Ever since the NSA started demonstrating router poisoning, it was only a matter of time before even the script kiddies figured it out.
I've been pointing out that the current rash of cryptocurrencies have excessive reliance on trust for the past year.
This sort of attack was inevitable. Bitcoin can plead semi-innocence because strong authentication is counter to strong anonymity. However, no router on the Internet should accept rogue announcements - even from three letter agencies - or accept unauthorized changes to the running configuration or active router tables.
MITM attacks are exceptionally dangerous and the hazards can only get worse.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
So what we have here are two problems.
One lack of authentication for the miners with the pools. Something a few SSL on the servers and wrapping those sockets calls with openSSL would make the route hijacking ineffective for stealing mining resources.
So there is a lesson in this whatever it is you are doing on the internet if you care AT ALL about it you should be using SSL and checking certs, (Looking at your slashdot) sure there are tons of problems as weaknesses in SSL but until something better comes along its beats the hell out of clear text with no authentication what so ever.
Two BGP needs to be replaced or updated to support much stronger authentication and the network operators need to just push getting it done, even if it means telling customers we can't / won't peer with you and neither will anyone else unless you get you routers and or software update to do this. If they stick together in it there should be no trouble getting that done.
Stealing some computer cycles used to generate bit coins is probably among the least real harm someone with access to advertise bogus routes in BGP could do; and lots of people are in a position to do that. We should be thankful its only a little money these guys were making off with. The Internet has gotten to big for the network operators to just relay on everyone playing nice and being good citizens, We need some stronger technical controls put in place and regular auditing beyound well nobody has complained on NANOG.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
You say unknown miscreant.
On Wall Street they're simply called "staff".
Frankly, I see little difference between stealing BitCoins from a mining pool and High Frequency Trading. And that's perfectly legal.
Lost at C:>. Found at C.
The use of bogus BGP to treat networks into believing that it is connecting to a legitimate network instead of having its own network stream being hijacked can be used for much more than mere Bitcoin snatching
It can also be used to "branch out" legitimate net traffic to some listening posts (something NSA and all other spy agencies like to do) and thus, further compromise the legitimacy of the network itself - and the loss of privacy / data / whatever that the data stream happen to contain
This is a serious threat !
Muchas Gracias, Señor Edward Snowden !