Slashdot Mirror
Network Hijacker Steals $83,000 In Bitcoin
An anonymous reader writes with news that bogus BGP announcements can be used to hijack work done by cryptocurrency mining pools. Quoting El Reg: Researchers at Dell's SecureWorks Counter Threat Unit (CTU) have identified an exploit that can be used to steal cryptocurrency from mining pools — and they claim that at least one unknown miscreant has already used the technique to pilfer tens of thousands of dollars in digital cash. The heist was achieved by using bogus Border Gateway Protocol (BGP) broadcasts to hijack networks belonging to multiple large hosting companies, including Amazon, Digital Ocean, and OVH, among others.
After sending the fake BGP updates miners unknowingly contributed work to the attackers' pools.
Apparently he was able to spoof some control messages to the miners since their only validation was IP address. It is an interesting question: since they should have known about this BGP vulnerability which has been used before, why didn't their minerserver communication have stronger validation? The answer would be, I think, that they didn't bother since it happens so rarely. Probably from now on they will start using another layer of validation. Yet another example of how security happens in the real world: it doesn't get used until the pain gets bad enough.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
It's a blockchain. It's know what portions were stolen. Send a message out to all people involved in this scheme to not accept them.
Oh right - that would undermine the illusion of "freedom".
At least this weeks compulsory Bitcoin story is sort of amusing.
This trick is as old as it gets. BGP will accept a more specific route as superior to a more general route, and there is no authentication in the exchange. The flaw here is the upstream providers involved did not properly filter the routing announcements allowed from this attacker, and instead let them announce net blocks that were not their own, then intercept the traffic to those net blocks.
In other words, nothing to see here, move along.
I've been pointing out the risks of router poisoning for, what, 17 years now.
Ever since the NSA started demonstrating router poisoning, it was only a matter of time before even the script kiddies figured it out.
I've been pointing out that the current rash of cryptocurrencies have excessive reliance on trust for the past year.
This sort of attack was inevitable. Bitcoin can plead semi-innocence because strong authentication is counter to strong anonymity. However, no router on the Internet should accept rogue announcements - even from three letter agencies - or accept unauthorized changes to the running configuration or active router tables.
MITM attacks are exceptionally dangerous and the hazards can only get worse.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
So what we have here are two problems.
One lack of authentication for the miners with the pools. Something a few SSL on the servers and wrapping those sockets calls with openSSL would make the route hijacking ineffective for stealing mining resources.
So there is a lesson in this whatever it is you are doing on the internet if you care AT ALL about it you should be using SSL and checking certs, (Looking at your slashdot) sure there are tons of problems as weaknesses in SSL but until something better comes along its beats the hell out of clear text with no authentication what so ever.
Two BGP needs to be replaced or updated to support much stronger authentication and the network operators need to just push getting it done, even if it means telling customers we can't / won't peer with you and neither will anyone else unless you get you routers and or software update to do this. If they stick together in it there should be no trouble getting that done.
Stealing some computer cycles used to generate bit coins is probably among the least real harm someone with access to advertise bogus routes in BGP could do; and lots of people are in a position to do that. We should be thankful its only a little money these guys were making off with. The Internet has gotten to big for the network operators to just relay on everyone playing nice and being good citizens, We need some stronger technical controls put in place and regular auditing beyound well nobody has complained on NANOG.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
Still not a problem. We have been told repeatedly that they have no intrinsic value. So the joke is on the hilacker
The use of bogus BGP to treat networks into believing that it is connecting to a legitimate network instead of having its own network stream being hijacked can be used for much more than mere Bitcoin snatching
It can also be used to "branch out" legitimate net traffic to some listening posts (something NSA and all other spy agencies like to do) and thus, further compromise the legitimacy of the network itself - and the loss of privacy / data / whatever that the data stream happen to contain
This is a serious threat !
Muchas Gracias, Señor Edward Snowden !
I got hit April 25th with this. I noticed within an hour, and it took me about an hour to determine that my connection to the pool had been spoofed, and my miners redirected to the attackers pool. I had no idea at the time *how* it was done.
My mining software was a couple of months old at the time, and the latest version would ignore such redirect requests. I updated and continued on, having lost maybe 2 hours of mining.
The redirect comes from that fact that the "Stratum" protocol used by many minors to request work from the pools was originally designed as a wallet to blockchain server protocol. Under that use case, it makes sense that the server might suggest to a (wallet) client that they use another server.
Tax money is not yours, it's a payment for partaking in civilization which, after all, requires a lot of human effort to upkeep.
I think this is the problem with most libertarians: you've been surrounded by the invisible support systems of society all your life, so you mistake them for something that occurs naturally, like sunlight. Thus when you're required to pull your weight and help maintain these systems, you see this as an egregious violation of your property rights, completely oblivious to the fact that property is an artificial construct built and maintained by them in the first place. And everyone else, of course, sees a freeloader who's arrogant enough to be insulted by the very idea of having to chip in.
The world does not owe you unpaid servitude. You will never get things like property rights or a monetary system without having to pay for them. Nor can you pay only for things that directly benefit you, because that leads to a tragedy of the commons where everyone argues why someone else should pay for every single system and the end result is that no one pays for anything, and society collapses.
I doubt that you'll stop playing a victim because you've been told polish some of the tiles on the streets of gold you walk on every now and then, but this is why you aren't being taken seriously outside the lunatic fringe.
Forget magic. Any technology distinguishable from divine power is insufficiently advanced.