Topic: Is it possible to fake the BTC blockchain? (Read 528 times)

In the world of internet hackers can easily fake everything they can easily create blogs of different sites although different organizations try to create blogs like their official sites there are many differences between these blogs. If you follow the sites in the right way you can consider them if you see the logo of the fake site BTC blockchain can be forged but not completely.

We regularly update our blog publication with resources that can be used as inspiration for content.

Blog articles can be published anywhere on the internet and publicly accessible. Articles can be written in any language, but please check with us to make sure your language will qualify for a bounty.

Examples of recommended publications on reputable outlets, such as Bitcoinist, or in any other media relevant to Cryptocurrency. Your blog or Medium site works, too, however you must also follow that post up by distributing it on Reddit.

Writers should familiarize themselves with the official white papers to ensure an accurate depiction of MyIdentityCoin.

False

True, this topic has been already answered.
The answer is that it would be technically possible, but it would not worth it as the cost would be too high.


Please before posting read the first 2 pages of discussion, there are all answers there.

Based on the scenario given it might not possible, its either it will not be sent or retain in that account or simply be late in transaction since there is no way to have a fake blockchain unless the host will give his address to be sent to him. Beside crypto users are aware of scammers now that's why they do face to face transactions maybe as well they know they will have transaction why not load his self a data Internet on their place.

Agreed. He is trying to point out if the scammer try to show the blockchain of a fork BTC. There is no way faking blockchain since it's transparent ledger and it's design to solve this kind of situation.
There is no way that this example will happened because there's no person in the world that will transact BTC without internet connection and will rely on the seller internet connection.
This is an absurd example and this topic must be closed since it's already received too many replies.

That is quite technical but for general point of view, I think we cannot fake blockchain only if transaction are done according to its usual process.
What you site in your example is some kind of negligence on the person transacting and we know that if we are transacting a big amount of BTC , we will have to make sure that we will not fall for any kind of trick to steal our money.

No it is nt possible to fake any btc  or blockchain transaction all the transactions are listed in blockchain website we can access all transactions

I'm not sure how this would work. Is he going to connect the guest to an internet network that he is able to manipulate data from it? I mean, this could be possible, similar to how countries block certain sites, I am sure smart hackers are going to be able to also manipulate things on someone's phone when they try and access the internet (eg, making things show up, after they use the internet).

You could be able to another address show up in place of an actual address possibly, but this hacker would need to be incredibly skilled.

TBH from this discussion it seems like it can't be done or at least the cost of doing it would be much higher than just buying the BTCs 

This is an interesting one.
It looks like it can be done but I don't know exactly how.
 I guess traders should be careful of "fake internet" then or even avoid exchanging Bitcoin via public Wi-Fi or other people's internet.

 Imagine if this is done on a large scale by a powerful entity.

Seems like you haven't read what we were speaking about here.

This is an eye opener mate, must persons are just looking for your idea, they have all it takes to make things work.
Just tell them what you think, and they will make it a reality!

I hope something like this will not happen in years to come.
It will really have a negative effects on cryptocurrencies In general.

Not all innovations are welcome development

Even if the bitcoin address is pre-copied the host can generate fake transaction on "fake blockchain" on which visitor is connected.


Yes, if he is using a reputable app he can't be fooled by a fake transaction as it will not appear on his app.

Technically everything is quite possible , one thing that you learn in cyber security is that you are not supposed to actually let anyone connect you with a wifi or Bluetooth and send something in your mobile , you should understand that everything that we see right now can fall anytime ... Everything does have one or more negative sides therefore we don't know how one can do it but we do know it's possible.

I don't think they can fool people like that because the bitcoin blockchain has so many blocks that each transaction requires block verification, it's impossible to manipulate or send fake bitcoin, unless they use third party applications or sites that cannot be reached by the blockchain technology created by the recipient to be sent via a fake application.

From what @pooya87 above has said about Electrum, for instance, seems it's not that easy to fake a blockchain with the lite wallet either:

anyway. much cheaper attack to achieve if user is just using a lite wallet cellphone app. which would usually be the case for most meet up stuff

if victims node was downloaded to be a vrsion that the attacker hintd at, thus victims nod had ruls accepting attackers funky non btc rules.. then yes
but if victims node was recent proper btc node it would just regect the blocks from attacker

alt of people think a mining pool can just create a block that magics new coins or is 100mb and if 99% of people receive the block then it becomes accepts.. no
first the ndoes have to have a rule to not check balances to allow magic coins to be accepted. and then a rule to allow a 100mb block
and then majority of nodes if they pass the funky rules then need to follow a chain of blockhashes that the pool has produced by out pacing other pools..(tripl hard as it involves not only hash power but users havng the re-codd clinets to accept )


in most cases in just a current form '51% attack' a pool cant make mega blocks or make new coins appear from nothing.. al they can do is choose which valid rule following transactions to include or exclude

EG a transaction that follows ral btc rules. but where the attacker has only broadcast the tx to his attacker pool on the privat network thus only shows as confirmed in the forked private chain. but not even registered on the real btc chain.
thus when user gets home and syncs to the true btc chain. he ends up seeing his transaction is not confirmed as it was not broadcast and included on the real public btc chain

in short. people worry too much that pools can change the rules without needing consensus of chaning the code client run.. but all a pool can do is change th transaction lists in blocks

Is it possible for a 99% consensus 'SCAM' to possibly be the real "BTC" blockchain?

I'm thinking about the real world use scenario. That's why when someone has said here that the naive user could be scammed and there is nothing to do I don't feel quite satisfied with it.
But still I'm considering that if someone takes his laptop to go to someone to get paid he'd sync his blockchain before especially if he lives in a place where the internet is not that quick. So he'd sync before just to avoid waiting both him and the payer during the transaction (which by itself may take up to one hour).
So my receiver is not a complete noob as he accepts BTC as payment, but he lives in a very remote, poor place somewhere in the world, where the scammers are very active and technology doesn't work always as it should be.
In any case he has his a recent blockchain downloaded, so as per your explanation the attack can't be performed.

running scenarios through my head.
if your running a full node that has not been synced you are more at risk than one that synced.
but take that with a grain of salt

lets simplify it without the techni detail
imagine your node was synced recent enough to knows it needs blocks of ~50exa hashes performed to get a block
the attacker only has 50petahash(1000 asics($200k equipment))
what would take the public ntwork 2 weks to make 2016 blocks
and would take attacker 38 years to produce 2016 blocks to even gt to a point to start reducing the difficulty

imagine your node was last synced in 2014 enough to knows it needs blocks of ~a few petahashs  performed to get a block
the attacker only has 50petahash(1000 asics($200k equipment))
the attacker could easily convince your node his privat fork has good reliable chainwork to make your node build upon blocks after the blockheight your node requests that you dont have.

so in short if an attacker wants to do something your full node needs to be very outdated in sync to b a cheap attack.
or the attacker needs to invest more to be able to do a for attack the more rcent the re-sync is required

so again not possible. but just low chance for more experienced users that sync regular
noobs that are fresh and totally unsynced(never used a full node before thus have no sync to fork/orphan) an attack can be cheap, very cheap as the only data the noob would b getting is the private forks version

I think I've got my answers and I'm satisfied.
Thank you guys! 

I think it’s possible to deceive a person using online crypto wallets. However, what you are asking about is excluded, it is checked very easily and "fake Internet" will not be able to help scammers to fake the BTC blockchain

what you are asking will always come down to HOW the received is checking the status of the transaction he receives.
people already explained the case where receive runs a full node i want to address two other things that were mentioned here.

SPV wallets
in this case it still is impossible to fool the receiver. although it depends on the wallet but a decent one (like Electrum) would download the block headers, verify their proof of work and could also use merkle root to make sure the "server" it is connected to is not lying about transactions and their state. and since everything is protected by an still strong hash algorithm and the proof of work, the design is fraud proof.
in this scenario the only thing that a malicious server can do is to show a confirmed transaction as unconfirmed. the opposite is impossible. for example if the malicious server shows an unconfirmed transaction as confirmed then it also has to provide a merkle root from the block that it claims contains this and since it can't, this attack becomes impossible. (the same arguments about having hash power and mining the block is true here too).

web wallets and block explorers
in this case it is also impossible to fool the receiver. in order to fool the receiver (eg. show an unconfirmed tx or a tx that  doesn't even exist) as confirmed the attacker has to perform a Man In the Middle attack. even if you are using his WIFI you are still communicating over an encrypted channel. the only way this is possible is if either the web wallet/block explorer was NOT using SSL encryption or if the attacker can inject a malicious certificate authority into receiver's device and then pull the MITM attack easily.

If you are trying to find out if there are ways that gullible people can be scammed, history tells us that the answer is always YES.

If you are trying to determine if a savvy user taking the proper precautions can be scammed, the answer is: Maybe.  It depends on motivations, risk tolerance and awareness, and many other factors.

If you are trying to determine if Bitcoin-Qt itself has a fatal flaw that someone could take advantage of, the answer is: Yes.  Bitcoin-Qt assumes a "rational actor".  If someone (or a group of people) is willing to spend huge amounts of money to turn another person (or group of people) into victims, without gaining any monetary benefit for themselves, then a it would technically be possible to acquire more hashpower than the rest of the world combined and create havoc with anyone they want to.


Performing an attack that takes advantage of the victim's trust is always possible. It doesn't matter what form that trust takes.  Using a Bitcoin-Qt that is provided to you by the attacker is a form of trust. Accepting an unconfirmed transaction is a form of trust. Accepting a single confirmation on a BTC transaction valued at $200,000.00 is a form of trust. Using a light wallet is a form of trust.  Using a hosted wallet is a form of trust.  Using a block explorer is a form of trust. Using paypal is a form of trust. Using paper checks from a bank is a form of trust.

Choose your favorite form of trust, assign it to the potential victim, and yes, it will be possible to take advantage of that trust.

Agreed.  

This post is a kind of work in progress, as much info I get that make me change my mind as much the "rules" are changed. I'm not after imposing my opinion, just to see whether there is an issue or not. So I "changed my rules" because of the previous post. But thank you for many valid points explained.

That's right. It's nothing to do with the place, what I described in OP is only a specific case of a more general kind of attack. But putting the attack into contest of receiving a visitor gives the attacker the possibility to receive something "after he paid" and then disappear or just wash his hands as the victim has actually seen his BTC on his wallet, while in Internet it's more difficult.

Seems like performing this kind of attack against a lite wallet is much easier, right?

In terms of Bitcoin-Qt wallet, this attack would be VERY expensive.  The attacker would need to have control of nearly as much bitcoin block hashing power as the rest of the world combined if they wanted to provide blocks at a reasonable rate of about one every 10 minutes.  They *might* be able to get away with about one-sixth of the world's hash power if they knew for sure that their vicitim was only going to wait for 1 confirmation but...

1) The average time for the attacker to create a valid forked block will be an hour (some blocks will take even longer).
2) One sixth of the world's hashpower is still very expensive.
3) The more value you are exchanging, the more confirmations you should wait for, and the more suspicious you should be of unusual circumstances
4) It is going to take nearly an hour to get that 1 confirmation which is a lot of time for the victim to become suspicious and decide to check on things.
5) All that hashpower could have earned real bitcoins by mining on the real blockchain (approximately 12.5 bitcoins per hour).  So, unless the attack is for more than 12.5 bitcoins or is driven by pure vengeance (And not a profit motive), the attacker probably could have earned a lot more money by simply mining instead of attacking.
6) If the attack IS for more than 12.5 BTC... See #3



You are changing the rules here.  You said that you were thinking about Bitcoin-Qt BECAUSE it is usually perceived as a better solution than any light wallet.  Now you are saying that the victim is going to use a worse solution?

If the user is willing to use any system the requires some amount of trust (Lite wallet, hosted wallet, blockchain explorer, paypal, credit card, paper check from a bank account, etc), then it will always be possible to take advantage of that trust with enough effort. The more trust that is needed the easier it will be to take advantage of that trust.


No.  Bitcoin-Qt doesn't care how much hash power you have.  It just cares if you were able to provide a valid hash. On average it requires a LOT of attempts before you stumble across a valid hash.  If you don't actually have enough hash power, then it is going to take you a very long time to try enough attempts to stumble across a valid hash.  At the current difficulty, it requires generating (on average) approximately 46,800,000,000,000,000,000,000 hashes before stumbling on a valid hash. Without a lot of hashpower, it is going to take a long time to generate that many hashes.

It isn't going to be enough to "modify the bitcoind".  The attacker doesn't get to choose the valid difficulty.  The victim's Bitcoin-Qt calculates the difficulty itself (it does not trust the difficulty that it hears from other nodes).  It does this by looking at the amount of time it took to calculate the previous 2,016 blocks (approximately 2 weeks of blocks), and the difficulty that those blocks were calculated at. The attacker would need to modify the victim's Bitcoin-Qt if he wanted to change the difficulty value that the victim's software would accept.

There is no hashpower "communicated to the blockchain".  There is only a hash that is either valid (below the current difficulty threshold) or isn't valid (is above the current difficulty threshold).  Since the victim's Bitcoin-Qt gets to set that difficulty threshold itself, either the attacker generated enough hashes to stumble across blocks with a low enough hash, or they didn't generate enough and haven't yet found blocks with a low enough hash.


Place has nothing to do with the attack you are trying to describe.  The point of your described attack is simply that the victim is isolated from other Bitcoin nodes and is forced to communicate with nodes that the attack controls.  There may be MANY different ways to accomplish this, but in the end it isn't likely to be a profitable attack unless you have a VERY VERY gullible victim.

Possible if the buyer is not really that into bitcoin just yet since the seller could give him a link to a pre-fabricated app displaying wrong information and feed/supply the wrong information. The only real way to avoid this is to not use the seller’s hotspot connection. Go to a public place wherein wifi is available and could not easily tampered, let seller scan your address’ QR code and pay him/her. Personally I don’t really connect to a public network I don’t trust but when it comes to such need, I go to Starbucks or anywhere else where wifi is free and use their connection.

??should an attacker be certain his victim only uses a lit wallet??

well..
most people dont carry around a desktop computer when wanting to use remote/someone elses internet. so usually people are checking via a smart phone by default when they go visit someones house. so chances that the victim is using a lite wallet being very very high without attacker even having to try

..
secondly. if someone is a noob and doing their first step into bitcoin as an introduction, an attacker can sway the noob whwich lite wallet to download.
"EG to save you learning all the technobabble just download wallet XXX which is user friendly" most nobs would do it without thinking

thirdly and a good defense for victim. if iin your scenario of meeting up with an attacker. the victim has a face, location and other details which authorities can use to catch the attacker. this isnt as much the case in remote private exchanges

this topic doesnt mean that its super easy for an attacker to do it.. like advertising to scammers a get rich quick and easy.. but its just stating its not impossible to achieve and people should atleast be wary

its like debit card cloning. in quiet village/small towns that dont have much police patrols and where ATM's are scarce. the population usually end up using the limited atm's more. and its stuff like that which card cloner love. secluded location to give them time to insert the card skimmer without being spotted and knowing the footflow(usage) of atm will be high due to lack of competing atm's
hense people should be wary when using an ATM

its like getting a random phone call from an accented voice saying they are technical support and that you have a virus and need to download their software.. just be wary..

even of chances of being scammed seem low. doesnt man saying something is impossible to happen should be said, nor should it be said to not be aware of the potential risk even if chances are low

In the first place, people don't even need to go to the other party's place just to make a payment. Bitcoin blockchain works in a way that everywhere you are, as long as you have an internet connection, you can transfer funds to another account.

Though, faking the BTC blockchain will not be possible. There are articles that state that blockchain can be hacked: https://www.technologyreview.com/s/612974/once-hailed-as-unhackable-blockchains-are-now-getting-hacked/. But in this case, it is not BTC blockchain. What they did to compromise the blockchain is to to have a huge hash power authority.

In terms of bitcoin, these hashing power is distributed that makes it strong enough to be invulnerable to hacking.

And would it be possible for the attacker to fake the hashpower? As he has all the nodes he can modify the bitcoind in order to drop the difficulty and to mine with a CPU, but to communicate to "blockchain" the hashpower multiplied by let say 10^whatever?

And another thought. What if the attacker performs the same attack without inviting his victim to a physical place, just by knowing the victims IP and isolating from him the right net and offering only connections to the fake nodes?  

So should the attacker be certain his victim only uses a lite wallet he can invite his victim to his home to receive the payment?

And again I'd like to make it clear what is the purpose of this question. People are often ask and speak about wide BTC adoption here. But should this issue exist it can be the cause of many scams in the places like Africa, for instance, where many people have a mobile phone and also a free internet connection, but only... enabled to use Facebook and Whatsapp. So with a high degree of probability the sender's home wi-fi would be used in the above described transaction.