How could the transaction be changed without needing to be re-signed? I lack the technical knowledge to understand how what you describe is possible.
https://en.bitcoin.it/wiki/Transaction_Malleability
Topic: The MtGox Debacle Explained - page 2. (Read 15794 times)
https://en.bitcoin.it/wiki/Transaction_Malleability
2) Bitcoin Foundation could setup some public servers that always run the latest official version of the bitcoin client. Exchanges should then be able to verify that the transaction is legitimate
I guess any self-respecting exchange is already running their own instance of the latest bitcoind for that purpose.
But MtGox is not a self-respecting exchange, that is the problem.
The funny bit is.. they keep sending transactions with spend inputs! Right now! With withdrawals blocked and problem, as you claim, being identified.
Thanks for the write-up, nice job. This feels to me like the most plausible story to go with the facts observed ... and you've done a far better job of explaining things than Mt.Gox.
How could the transaction be changed without needing to be re-signed? I lack the technical knowledge to understand how what you describe is possible.
You don't touch the actual signature, but there are meta-data around it. In a recent version of the official bitcoin client the format of that meta-data has been tightened so the transaction data provided by MtGox is now being rejected by the latest official version. A hacker can then take the rejected raw txdata provided from MtGox, patch it and rebroadcast it. It will get through, but MtGox still thinks it is invalid and returns balance.
I don't think I buy your explanation without providing more details.
Can you provided more details?
What is the new version of the bitcoin client that caused the problem?
When the version was released and when the problems started at MtGox?
What are the changes on the format that were problematic?
I understand that if your theory is correct, there should be initially stuck transactions that finally went through in the blockchain (the modified hacker's version). Can you provide examples of these transactions? (that appeared first in the list of stuck transactions and then went through).
sadly its true.
just read the reddit: gmaxwell explains it well
So I guess buying "goxbtc" just got a lot more risky, even if they sort this out you might end up with nothing.
How could the transaction be changed without needing to be re-signed? I lack the technical knowledge to understand how what you describe is possible.
You don't touch the actual signature, but there are meta-data around it. In a recent version of the official bitcoin client the format of that meta-data has been tightened so the transaction data provided by MtGox is now being rejected by the latest official version. A hacker can then take the rejected raw txdata provided from MtGox, patch it and rebroadcast it. It will get through, but MtGox still thinks it is invalid and returns balance.
I don't think I buy your explanation without providing more details.
Can you provided more details?
What is the new version of the bitcoin client that caused the problem?
When the version was released and when the problems started at MtGox?
What are the changes on the format that were problematic?
I understand that if your theory is correct, there should be initially stuck transactions that finally went through in the blockchain (the modified hacker's version). Can you provide examples of these transactions? (that appeared first in the list of stuck transactions and then went through).
Thanks for your support. Unfortunately, I cannot reveal my sources.
He's just posting a garbled rewrite of this post on Reddit. nullc has access to the same facts as me. His post is more into the actual technical details of the exploit. The intention of my post is to bring this topic to higher level because the concept itself is a real problem that exchanges should be aware of.
not really.
its just that mtgox instead of looking at their coins just looks if the tx they have created goes through - and only in that case subtracts some kind of internal balance.
i dont think any other service works this way. just crappy coders there.
but you may be right that this could be used to steal btc from gox. but i dont know if mtgox actually refunded tx which they think did not get through (but did because of the changed txid).
You may be right as I cannot be sure how other exchanges work, but I do know MtGox has a problem with "double refunding." This is the reason why they halted all BTC withdrawals. They are currently going through all the transactions to check which ones did go through.
Thanks for your post. I share the same conviction about a hack and the fact it's certainly limited.
Bitcoin exchanges are an easy and not risky target for hackers. Exchanges don't have the ressources to sue hackers. It's a miracle there is not more problems everyday!
On the other hand, I don't expect a lot from their tomorrow's announcement...
Bitcoin exchanges are an easy and not risky target for hackers. Exchanges don't have the ressources to sue hackers. It's a miracle there is not more problems everyday!
On the other hand, I don't expect a lot from their tomorrow's announcement...
Thanks for your support. Unfortunately, I cannot reveal my sources.
He's just posting a garbled rewrite of this post on Reddit. nullc has access to the same facts as me. His post is more into the actual technical details of the exploit. The intention of my post is to bring this topic to higher level because the concept itself is a real problem that exchanges should be aware of.
not really.
its just that mtgox instead of looking at their coins just looks if the tx they have created goes through - and only in that case subtracts some kind of internal balance.
i dont think any other service works this way. just crappy coders there.
but you may be right that this could be used to steal btc from gox. but i dont know if mtgox actually refunded tx which they think did not get through (but did because of the changed txid).
Thanks for your support. Unfortunately, I cannot reveal my sources.
He's just posting a garbled rewrite of this post on Reddit. nullc has access to the same facts as me. His post is more into the actual technical details of the exploit. The intention of my post is to bring this topic to higher level because the concept itself is a real problem that exchanges should be aware of.
Thanks for your support. Unfortunately, I cannot reveal my sources.
He's just posting a garbled rewrite of this post on Reddit. How could the transaction be changed without needing to be re-signed? I lack the technical knowledge to understand how what you describe is possible.
You don't touch the actual signature, but there are meta-data around it. In a recent version of the official bitcoin client the format of that meta-data has been tightened so the transaction data provided by MtGox is now being rejected by the latest official version. A hacker can then take the rejected raw txdata provided from MtGox, patch it and rebroadcast it. It will get through, but MtGox still thinks it is invalid and returns balance.
How could the transaction be changed without needing to be re-signed? I lack the technical knowledge to understand how what you describe is possible.
thanks for the reply!
seemed hoax to me, glad it is not related
seemed hoax to me, glad it is not related
Hi OP, I was told there wasa software could hack into gox account and "create" BTCs on the fly using fractions of micro transactions other users are doing.
there was a video of it online some time ago.
is there any connection or that is just hoax?
there was a video of it online some time ago.
is there any connection or that is just hoax?
I don't have any information on that. Even if that's true this particular issue is unrelated to that.
Have you considered that Gox could be turned into a Ponzi scheme by the technique described above.
It's not impossible of course, but I believe that the hacker attacks have caused limited damage. The main reason is that MtGox only allows 100 BTC withdrawals per day. Each unsuccessful withdrawal takes a week (before the balance is returned). This started two weeks ago and MtGox got warned early enough and took countermeasures before everything got out of control. This is the reason why they frozen all BTC withdrawals. I believe they'll be able to clean up everything, but it will take some time. It's certainly a very interesting situation. There are multiple different problems that magnifies the situation. Again, other exchanges could suffer from the same problem. As far as I understand, all the exchanges are currently being contacted and warned about the current situation.
Hi OP, I was told there wasa software could hack into gox account and "create" BTCs on the fly using fractions of micro transactions other users are doing.
there was a video of it online some time ago.
is there any connection or that is just hoax?
there was a video of it online some time ago.
is there any connection or that is just hoax?
Have you considered that Gox could be turned into a Ponzi scheme by the technique described above.
You failed to mention the possibility that they are lying about it being a technical problem and that they do not have all the funds they claim to (I.e. Solvency).
Don't be naive to think that this is not a possibility.
Ponzi operators work in the exact same manner. They try to buy more time with vague excuses.
Don't be naive to think that this is not a possibility.
Ponzi operators work in the exact same manner. They try to buy more time with vague excuses.
So the proper way to run a ponzi scheme is to broadcast failed transactions for all the world to see? Thanks that is good to know. The brilliance of people here is staggering.
If it buys them time why not?
They just claim the issue is "technical" which is vague BS for saying we need more time.
Thanks for your support. Unfortunately, I cannot reveal my sources.
Understood. Is it safe to say that for someone with some BTC in Gox, they should be somewhat comforted in the fact that the problem is identified and being worked on and they will receive their coins back in the near future?
I'm pretty sure that this is the case. Once they resolved all the transactions everything will return to normal. However, I fully understand people who lost faith in MtGox; it's a very natural reaction.
Jump to: