Slashdot Mirror
ISPs Could Take Down Large Parts of Bitcoin Ecosystem If They Wanted To (bleepingcomputer.com)
An anonymous reader writes: A rogue ISP could take down large parts of the Bitcoin ecosystem, according to new research that will be presented in two weeks at the 38th IEEE Symposium on Security and Privacy in San Jose, USA. According to the researchers, there are two types of attack scenarios that could be leveraged via BGP hijacks to cripple the Bitcoin ecosystem: hijacking mining proceeds, causing double-spending errors, and delaying transactions. These two (partition and delay) attacks are possible because most of the entire Bitcoin ecosystem isn't as decentralized as most people think, and it still runs on a small number of ISPs. For example, 13 ISPs host 30% of the entire Bitcoin network, 39 ISPs host 50% of the whole Bitcoin mining power, and 3 ISPs handle 60% of all Bitcoin traffic. Currently, researchers found that around 100 Bitcoin nodes are the victims of BGP hijacks each month.
Isn't the point of (successful) attack/hijacking, whatever, NOT to be detected and identified ?
Just the other day, some Russian ISP routed what, most of Visa & Mastercard traffic through their servers or something... happens often.. sometimes mistake, sometimes maybe not, but still they cannot keep doing it indefinitely.
Yeah ?
hide everything?
Oh you mean using steganography in Cat Videos?
I'd rather be riding my '63 Triumph T120.
Bitcoin has plenty of problems that need, but these issues aren't them.
This article describes fairly generic things and jumps to insane conclusions, eg:
"These attacks can be used to sneakily siphon off some of the mining proceeds into an attacker’s account."
This sort of statement is totally wrong and not backed up by how that can work (It can't)
ISPs Could Take Down Large Parts of ANY Ecosystem If They Wanted To.
They can divert or block any traffic it's flowing through.
And there's little the users can do against it.
So that article isn't bringing anything new!
Sent as ripples into the electromagnetic field. No single photon has been harmed in the process.
Title could easily have been "ISPs Could Take Down Large Parts of Online Banking Ecosystem If They Wanted To".
Oh it's going to be so much fun once net neutrality is gone, isn it?
For crying out loud. They still haven't fixed BGP? I remember reading about stuff like this in the 90s.
If the Wiki article is anything to go by this is through complacency.:
Although security extensions are available for BGP, and third-party route DB resources exist for validating routes, by default the BGP protocol is designed to trust all route announcements sent by peers, and few ISPs rigorously enforce checks on BGP sessions.
This sort of thing is really frustrating, a fix available but nobody bothers!
So is a fix for other horribly insecure critical internet infrastructure like DNS and DHCP. But using them costs money. And in this particular case of BGP, the ones that could secure it even have a good reason to leave it insecure.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
It is fixed in practice, but BGP being an open standard does not demand this in it self. Most (all?) major ISP use filters to make this impossible. And even if an attack is successful they would be going through the complete transit traffic of that ISP in realtime. So, that is not something a desktop PC can do.
You need a working transit network that is connected to ISPs that do not filter with whom you have active BGP sessions. Not just a PC on the internet. Then you need the equipment to filter this information to scam people in realtime. This assumes the Bitcoin attack is effective with traffic one way as the BGP attack will only affect the traffic going A to B and not B to A.
Basically this is hyperbole.
If you need to collude with 39 ISP to block 50% of the traffic, if a SINGLE packet reaches another node it will propagate. This is complete theoretical attack and both not achievable and non-realistic. Even if 90% of the nodes are corrupted, at some point the block will be propagated.
Well when is it on topic?
My ism, it's full of beliefs.
Almost anything could be substituted and it would still work... A rogue BILLIONAIRE could take down large parts of the FIAT ecosystem, according to new research that will be presented in two weeks at the 38th IEEE Symposium on Security and Privacy in San Jose, USA. According to the researchers, there are two types of attack scenarios that could be leveraged via BILLIONAIRE hijacks to cripple the FIAT ecosystem: hijacking earnings, causing double-spending errors, and delaying transactions. These two (partition and delay) attacks are possible because most of the entire FIAT ecosystem isn't as decentralized as most people think, and it still runs on a small number of BILLIONAIRES. For example, 13 BILLIONAIRES host 30% of the entire FIAT network, 39 BILLIONAIRES host 50% of the whole FIAT earning power, and 3 BILLIONAIRES handle 60% of all FIAT traffic. Currently, researchers found that around 100 FIAT nodes are the victims of thefts each month.
Just add {In Space!} to anything.
They could also disrupt Paypal, Visa and other systems.
That's why we need net neutrality. DO comment to the FCC.
gofccyourself.com
a thing is the absolute control over it.
These attacks can be used to sneakily siphon off some of the mining proceeds into an attacker’s account.
Wrong. Mining proceeds are protected by a private key. Nothing an ISP can do will reveal that private key, thus they cannot siphon proceeds.
Note: The US government took down currency and it caused the great depression.
Most (all?) major ISP use filters to make this impossible.
All major ISPs are believed to use filters, but it still does not make it impossible.
Sometimes someone will always screw up with the filters.
Sometimes (frequently) big enough peers or customers will get exceptions.
Filters don't protect against an intentional actor who manages to compromise a router or manipulate the filters whether through technical measures, deception, or fraud.
True, but that is not what BGP does.
If the routers are hacked, no protocol can protect you.
That would require both routers to be hacked though.
Is it possible to short Bitcoin?