Pages:
Author

Topic: How to dismantled the awesome security of Bitcoin network in 4 simple steps. (Read 2951 times)

legendary
Activity: 3878
Merit: 1193
I would rather trust solidcoin over bitcoin.  Once the mining value drops, who are you going to trust to maintain the network, a  node like deepbit?   They can double spend too.  At least with a 1,000,000 coin owner, they have a vested interest to keep the system going. 
There are no 1,000,000 coin holders. And with the change to 5 coins/block, there aren't going to be any for many many years. So with solidcoin you are putting 100% of your trust in a single person. Why would you put any trust in a single person who can't keep promises?

Why pay "protection" to a bunch of mafia ridden miners.
Oh, you mean the built-in solidcoin "protection" fund? Yeah, why would you do that?
hero member
Activity: 717
Merit: 501
I would rather trust solidcoin over bitcoin.  Once the mining value drops, who are you going to trust to maintain the network, a  node like deepbit?   They can double spend too.  At least with a 1,000,000 coin owner, they have a vested interest to keep the system going.  Why pay "protection" to a bunch of miners that are losing money. I guess deepbit, will not lose money since he is a pool.
full member
Activity: 210
Merit: 100
You forgot what was pointed out during the ddos attack on the major pools.

1) knock out the 3 most major pools
2) run the 51% attack against a greatly reduced network before anyone has chance to react.

Must say tho if bitcoin watch figures can be trusted its nice to see such a large "others" wedge in the hashing pie chart.


Like today for instance....the pools are down but hashrate has increased...interesting.

Most miners give you and option to setup fallover pool.  Prior to last DDOS attack most miners were complacent and didn't use it.  They lost a lot of missed hashes.  Others stupidly clung on thinking the big 3 would be up in matter of minutes and lost hours more.  Today miners are more likely to either use auto-failover or manually point their rigs to a smaller pool.

I had my miners setup with a backup pool the problem was that during the DDOS my miners just kept running without generating anything from the pool.  To the miner it did not know the difference...as soon as I stopped the process and tried to restart it would not log in but until I did that there is no way it would have ever switched to the backup.
full member
Activity: 154
Merit: 100
If you pay $15,000 for 1000000 coins and you attack it and it collapses.  Then, fine they start another chain with $15,000 of your cash in their pockets.  If it can be identified which node caused the problem, they could use the old block chain, and delete the attackers coins.

1) Nodes don't have identification numbers.  If they did then it wouldn't be very useful as an anonymous currency.

2) The point wouldn't be to just take the network down.  One could use a tiny amount of money to double spend 10x, 20x, 100x that.  So spend $15K to steal $150K+ from victims of the flawed block chain.  Think those victims are going to jump on board for round 2?

They're already on round 2.  You mean round 3.   Grin
newbie
Activity: 29
Merit: 0
We already do.  A 51% attack against Bitcoin is prohibitively expensive. 
You just need to attack one or two pools. I don't think it is that expansive...
hero member
Activity: 717
Merit: 501
If you pay $15,000 for 1000000 coins and you attack it and it collapses.  Then, fine they start another chain with $15,000 of your cash in their pockets.  If it can be identified which node caused the problem, they could use the old block chain, and delete the attackers coins.
donator
Activity: 1218
Merit: 1079
Gerald Davis
Exactly, therefore we need a solid 51% protection  Smiley

We already do.  A 51% attack against Bitcoin is prohibitively expensive. 

The ScamCoin schemes didn't increase the cost to engage in a 51% attack they decreased it.
full member
Activity: 168
Merit: 100
Um the point of a double spend is that by the time the network realizes and prices dropped you have already spent your funds twice and don't give a crap.  Granted SolidCoin is worthless but if it ever was you could for example take $100K worth of SC and buy $100K worth of BTC, perform attack and then buy $100K worth of BTC again.  $100K worth of SC -> $200K worth of BTC.  That is the entire reason for a double spend.  To in effect double your money (at the expense of victims).  An unlawful transfer of wealth from attacker to victim.

Exactly, therefore we need a solid 51% protection  Smiley
donator
Activity: 1218
Merit: 1079
Gerald Davis
Lololol, maybe not then... Ok, so you don't appear to get how Trusted Nodes work. Wait for the Source to come out and you will see why this won't work.

Is that you CoinHunter?  Using the wrong sockpuppet again.  If source code hasn't been released then how do you know what the source code will reveal.

Quote
$160 an Hour? Even at this price (which is pure fantasy), that means if you need a couple of days to set up and pull off your attack you're spending 7 grand on cloud computing power.. If you need a week, you'll spend over 25 grand. Do you expect to make this money back somehow with this attack, or are you just doing this for lulz? You'll somehow need to raise this money just to attempt to destroy something for no reason and with no guarantees it will even work...

Why would you need a week.  You do understand how a double spend works right?  You just need to create an alternate chain long enough to generate sufficient confirmations for victims to accept the double spends as valid.  That is a few hours not weeks.

Quote
Uhuh... lets say your crazy scheme does work and you just spent $50k to buy up a million Solidcoins, "overpower" the trusted nodes and perform a 51% attack on this "imaginary" network, now what? Destroy it? You sure as fuck won't be able to sell the coins you steal, everyone will know what has just happened so the price would drop to zero. So what's the point of all this? You could have spent that $50k on drugs, or a car...

Um the point of a double spend is that by the time the network realizes and prices dropped you have already spent your funds twice and don't give a crap.  Granted SolidCoin is worthless but if it ever was you could for example take $100K worth of SC and buy $100K worth of BTC, perform attack and then buy $100K worth of BTC again.  $100K worth of SC -> $200K worth of BTC.  That is the entire reason for a double spend.  To in effect double your money (at the expense of victims).  An unlawful transfer of wealth from attacker to victim.
sr. member
Activity: 1008
Merit: 250
Wow, sounds like a real genius plan you got there, hotshot.

Ignoring the fallacy of the "security" of the massive hash power of the Bitcoin network (which has been dropping about 15% every 2 weeks), there are just one or two problems with your fabulous "plan"....

Step 1:
If the attacker is smart and uses a balanced approach they could amass 1 mil coins cheaply.

He'd have to be smart with a lot of money to burn, and a loooooong time to wait for those lowball sell orders to come in. Probably better off just putting the money in a bank account an earning interest tbqh. Right now it would be impossible to buy a million coins outright with any amount of money, there aren't that many for sale.

Quote
Step 1a:
An alternative approach would be for attacker to scam/defraud/steal coins.  For example if the mybitcoin.com operators had existed on this alt-chain through their outright theft they would now be considered "trusted".  Don't you see the logic?


Wait what, mybitcoin.com stoled a million bitcoins?? I thought the number was closer to 150k?

Do you not think if someone stole a million coins, the thousands of people complaining that they had their coins stolen would alert people to what was going on? The value of the coins would crash and your whole "plan" becomes a total waste of time.

Also, if you did manage to steal a million coins without the entire world knowing what is going on, why would you then use that wealth to destroy the network which makes them valuable? Surely human greed takes over at that point and you would just sell them?

Never mind, the rest of your plan is sure to be foolproof...

Quote
Step 2:
Attacker now checks the average block signing time for the even blocks to estimate hashing power of even trusted nodes.   Using EC2 cloud or botnet attacker ramps up his trusted node's hashing power to 100x the trusted nodes hashing power.  While this may seem like a lot in reality it isn't.  See we have made this very easy for the attacker.  In essence we have ensured the much larger hashing power of the "untrusted network" can't help us to protect the vulnerable trusted nodes.  If there are only a few (or say one) trusted node you could produce a super powerful trusted attack node with only ~100 CPU.  Now building 100 CPU may be a challenge but you can always rent them from Amazon for ... $40 per hour.  If we massively overpower the other trusted nodes then we are defacto the only effective trusted node as we have a reasonable chance of always signing a node faster than any other trusted node. If there is only one well that makes it even easier.

Lololol, maybe not then... Ok, so you don't appear to get how Trusted Nodes work. Wait for the Source to come out and you will see why this won't work.

Quote
Step 3:
Launch a normal 51% attack against the network.  Normally this would be prohibitively expensive however the use of low cost cloud CPU resources , botnets, and rogue system admins mean that low cost commodity CPU can be used to win via numerical superiority.  Say your alt chain has 0.05234GH/s of hashing power and average CPU gets 10KH/s.  That is only ~5000 CPUs necessary to achieve 51% control over the network.  A well timed DDOS attack against major pools could degrade that network hashing power significantly.  When 5000 CPU are available via Amazon for $160 per hour or less with unlawful computing power you start to realize how a trivial sum can be used to attack the network.

Cute, but I think you overestimate how "cheap" Cloud CPU power is. To rent 5000 CPUs for any significant amount of time you would need quite a lot of money, much more than you could ever hope to earn out of this crazy scheme.

Plus how will you configure all of these clients? You would need a team of people working round the clock, will they all work for free?

$160 an Hour? Even at this price (which is pure fantasy), that means if you need a couple of days to set up and pull off your attack you're spending 7 grand on cloud computing power.. If you need a week, you'll spend over 25 grand. Do you expect to make this money back somehow with this attack, or are you just doing this for lulz? You'll somehow need to raise this money just to attempt to destroy something for no reason and with no guarantees it will even work...

Quote
Step 4:
Attacker now has control over the block chain. The combination of trusted nodes and CPU-friendly algorithm allowed this to happen for a trivially small amount of resources.

Uhuh... lets say your crazy scheme does work and you just spent $50k to buy up a million Solidcoins, "overpower" the trusted nodes and perform a 51% attack on this "imaginary" network, now what? Destroy it? You sure as fuck won't be able to sell the coins you steal, everyone will know what has just happened so the price would drop to zero. So what's the point of all this? You could have spent that $50k on drugs, or a car...
donator
Activity: 1218
Merit: 1079
Gerald Davis

From the OP:
Quote
"Say you didn't want that kind of security (the security provided by Bitcoin's massive distributed network).  Here is how to introduce flaws that significantly reduce the cost of attacking your alt chain:"

That alt-chain is SolidCoin.
hero member
Activity: 793
Merit: 1026
Yes, if you steal a double digit percentage of the total bitcoins in existence, and then create a massive botnet capable of performing a 51% attack, you could effectively control Bitcoin...  my first two thoughts are "duh" and "wat" followed by "duh" and "duuuhhhh" and "who cares".

This wasn't about Bitcoin.

Maybe I'm just having a brain fart or maybe I'm just stupid, but could you explain it to me like I'm a child then, so I can understand what (or who) your point was?
sr. member
Activity: 518
Merit: 250
Ah... missed the flipping obvious, think mr taxes is correct
sd
hero member
Activity: 730
Merit: 500
Most miners give you and option to setup fallover pool.  Prior to last DDOS attack most miners were complacent and didn't use it.  They lost a lot of missed hashes.  Others stupidly clung on thinking the big 3 would be up in matter of minutes and lost hours more.  Today miners are more likely to either use auto-failover or manually point their rigs to a smaller pool.

Or solo mine as a backup. Solo mining is undosable and it prevents any one of the big three dosing the other two and performing a 51% attack.
donator
Activity: 1218
Merit: 1079
Gerald Davis
You forgot what was pointed out during the ddos attack on the major pools.

1) knock out the 3 most major pools
2) run the 51% attack against a greatly reduced network before anyone has chance to react.

Must say tho if bitcoin watch figures can be trusted its nice to see such a large "others" wedge in the hashing pie chart.


Like today for instance....the pools are down but hashrate has increased...interesting.

Most miners give you and option to setup fallover pool.  Prior to last DDOS attack most miners were complacent and didn't use it.  They lost a lot of missed hashes.  Others stupidly clung on thinking the big 3 would be up in matter of minutes and lost hours more.  Today miners are more likely to either use auto-failover or manually point their rigs to a smaller pool.
full member
Activity: 210
Merit: 100
You forgot what was pointed out during the ddos attack on the major pools.

1) knock out the 3 most major pools
2) run the 51% attack against a greatly reduced network before anyone has chance to react.

Must say tho if bitcoin watch figures can be trusted its nice to see such a large "others" wedge in the hashing pie chart.


Like today for instance....the pools are down but hashrate has increased...interesting.
donator
Activity: 1218
Merit: 1079
Gerald Davis
Yes, if you steal a double digit percentage of the total bitcoins in existence, and then create a massive botnet capable of performing a 51% attack, you could effectively control Bitcoin...  my first two thoughts are "duh" and "wat" followed by "duh" and "duuuhhhh" and "who cares".

This wasn't about Bitcoin.
hero member
Activity: 793
Merit: 1026
Yes, if you steal a double digit percentage of the total bitcoins in existence, and then create a massive botnet capable of performing a 51% attack, you could effectively control Bitcoin...  my first two thoughts are "duh" and "wat" followed by "duh" and "duuuhhhh" and "who cares".
sr. member
Activity: 518
Merit: 250
You forgot what was pointed out during the ddos attack on the major pools.

1) knock out the 3 most major pools
2) run the 51% attack against a greatly reduced network before anyone has chance to react.

Must say tho if bitcoin watch figures can be trusted its nice to see such a large "others" wedge in the hashing pie chart.
sr. member
Activity: 418
Merit: 253
FlipPro, I think someones building a case on you...lol
Pages:
Jump to: