8 ms·
Tell HN: Executing a 51% attack on a real live CryptoCurrency, livestream
Hey all, On Oct 13, 3:00 CDT, 4:00 EDT 1:00 PST I'm going to do a 51% attack against the cryptocurrency Einsteinium (i'll do the biggest, most established coin I can afford to attack, I'm putting in $50 of my money and if you want to donate you can 18YvVAxEMYxowSYEmWVtY75ZUdKXXk2vQc (If that's against the rules feel free to remove it Admins)) :
1. Demonstrate how easy these attacks are for anyone to do.
2. Generally teach people about the nuts and bolts of these attacks and potential mitigations.
If you want to watch it, https://www.twitch.tv/geocold https://www.twitch.tv/geocold
Event link: https://www.twitch.tv/events/NyJSsF3hQkGHdnsKA2f4JQ https://www.twitch.tv/events/NyJSsF3hQkGHdnsKA2f4JQ
- piracy1 8y agoFeel free to ask me any questions, I'll try to answer them all.
- ersiees 8y agoWhat these attacks are about is stealing money, right? Is that your plan? Why do you want donations to steal something or if you don’t steal anything how will you change the chain?
- piracy1 8y agoGenerally, an attacker would deposit money in an exchange, exchange that money, withdraw it, then overwrite the transaction. I don't plan to do this. I'll either just do the overwriting part or just deposit like a dollar and not exchange or withdraw it. This is meant to just be educational.
- tomglynch 8y agoI understand you're doing it to be educational - though what stops someone else taking advantage of your 51% attack and performing a double spend?
- ema 8y agoNothing really. Except since this 51% attack is pre-announced people can choose to not accept any transaction as confirmed until the attack is over.
- deleted 8y ago[deleted]
- gunlaw22 8y agoIs this posted for a quick p and d scheme?
- F_r_k 8y agoWhat time UTC ?
- raws 8y ago8:00 PM UTC
- jwilk 8y agoWhy PM?
- zamadatix 8y agoBecause that's when it is?
- jwilk 8y agoYeah, but how was that conclusion reached? 3:00 CDT = 8:00 UTC, but the original post didn't mention AM or PM. Is PM the default in US?
- zamadatix 8y agoThe event link from the original post says: DATE & TIME Saturday, Oct 13 4:00 PM EDT But yes, generally 4 AM isn't the most common stream start time :).
- exikyut 8y agos/UTC/$yourtimezone/: http://www.thetimezoneconverter.com/ http://www.thetimezoneconverter.com/
- ralexstokes 8y agoDo you have an estimate for how expensive the attack will be? Are you renting hardware from the cloud? Any chance they will hardfork before you can attack?
- piracy1 8y agoI'm not 100% sure what coin i'll attack. If people donate I might try for Vertcoin which will be $300-500 to attack. But if I stick with Einsteinium it will be very cheap, maybe $20-40. They could hardfork but I doubt they will. It's also sort of hard to implement a solution that quickly.
- dannyw 8y agoHow about Bytecoin? I’m sure if you post an address you’ll get more than you spend in donations.
- piracy1 8y agoBytecoin would take maybe a thousand, 4 or 5 if we want to get a transaction confirmed in an exchange. I'll do the biggest coin I can I'll put in $50 of my own money If anyone wants to donate you can: bitcoin:18YvVAxEMYxowSYEmWVtY75ZUdKXXk2vQc
- akerro 8y agohttps://www.crypto51.app/ https://www.crypto51.app/ https://www.crypto51.app/coins/EMC2.html https://www.crypto51.app/coins/EMC2.html
- piracy1 8y agoA great site. I made a version of it in python a while back and wanted to turn it into a website but never got around to it. Glad they did it for me but a lil sad I never got the media attention it got :(
- 8y ago
- hobofan 8y agoA 51% attack against small blockchains is like taking a lollipop from a toddler.
- knocte 8y agoA smaller blockchain might seem like a toddler compared to the big old bitcoin, however you shouldn't dismiss that the biggest shitcoins in market capitalization have a decent amount of people invested in them. Take in account a 51% attack causes a double-spend. A double-spend targetting a transaction of a big amount costs the same as if you target a transaction of a small amount. This means that whoever performs this attack could just wait until the perfect victim comes in (think: a big transaction from/to a hotwallet of a big exchange). This, in the end, could cause a big loss to some user of the exchange (especially if the exchange doesn't take responsibility for the issue); which could mean a lot more value than a lollipop. Key takeaway from this IMO: don't invest in shitcoins, err.. altcoins sorry.
- piracy1 8y ago^ This. Also, I agree that it's fairly trivial. That is the point, I want to show people how easy it is and maybe prompt developers to implement mitigations. I also just want to talk about 51% attacks because I think they're neat.
- ghayes 8y agoYou should demonstrate an effective use of double-spend in your 51% attack, since there’s a lot of FUD around what can happen with a 51% attack. As in, people may assume you can drain accounts with 51% control, as opposed to double-spend transactions that did not yet hit high confirmation counts.
- piracy1 8y ago" As in, people may assume you can drain accounts with 51% control" This is categorically incorrect. I'll make sure to mention that.
- jwilk 8y agoCDT, EDT, PST? I have no idea what this means. Please don't use time zone abbreviations. They are neither human- nor machine-readable.
- piracy1 8y agoCentral Daylight Time, Eastern Daylight Time, Pacific Standard Time.
- jwilk 8y agoThese names are still meaningless outside USA.
- rstrstrst 8y agoDid the EU already ban Google?
- thomasfoster96 8y agoIf you search for ‘CDT’ in Australia it will give you results for Australian Central Daylight Time, for example.
- ziomanzo 8y agolol, I taught you were gonna show us how it works on some testnet. If you are for real, this will be very educational! tell us every detail please! The costs, hashpower, what exactly are you going to do? double spend?...
- ziomanzo 8y agoor you are trying to hack us? with creating an account?
- piracy1 8y agoWhat account?
- Havoc 8y agoIsn't that kinda mean towards whoever set up the coin? Not saying don't do it...bit think it might ruin someone's day even if it is intended as educational
- ema 8y agoI think how to judge this attack depends on how the coin presents itself. If they're clear about being in a phase of the project where such attacks are feasible then it's just vandalism, but if they're presenting a more flattering image of their project then demonstrating a 51% attack is a service to the public.
- throwawaylolx 8y agoIf they are in that phase, then they shouldn't be on exchanges.
- Rainymood 8y agoI probably do not understand enough of the blockchain technology but you announcing this ... why can't they ramp up their security?
- Improvotter 8y agoBecause in order to "ramp up their security", they'd need more users which makes this attack harder. Security isn't like a knob that you turn.
- lalaland1125 8y agoYou actually can increase security in a straightforward manner. Just increase the mining rewards and pay for it with inflation.
- throwawaylolx 8y agoThey can just rent more hash power than OP during the live stream.
- tgsovlerkhgsel 8y agoThe security of proof-of-work based blockchains (which most of them are) is based on the assumption that the majority of participating nodes (or rather miners) as measured by the work they do, i.e. computing power, are honest. Attacking a big, established blockchain like Bitcoin would require you to get more mining power than the rest of the network, which means massive datacenters of special purpose hardware. Attacking a small blockchain still requires you to get more mining power than the rest of the network, but since there are not too many miners, you can rent enough mining power to have more than the rest of the network for an affordable price.
- rrssh 8y agoIn the process, the attacker will legitimately get some currency, which is supposed to incentivize them to not actually attack the network, because it will affect the value of the coins they got − that's it, that's the only protection.
- chris_mc 8y agoIsn't this massively illegal? You're basically DoSing a network. Possibly theft as well!
- saagarjha 8y agoWhy would it be? You’re just mining like any other person, except you’re doing it faster than anyone else. I think the poster has mentioned that this is purely for educational purposes; they’re not trying to steal everyone else’s money.
- koolba 8y agoOn the contrary, you're contributing to the success of the coin by dedicating your personal resources to increase the total hash rate. It's not a denial of service, it's explicitly providing the mining service that the coin is asking it's participants to provide. Now using that temporary hash rate imbalance to issue an explicit double spend attack could be considered fraud. But that's a totally separate.
- paulcole 8y agoTry calling the cops about a 51% attack on your Einsteinium and see what happens lol.
- jeanlucas 8y agoFinally someone can prove those claims of how much it costs, if this is legit.
- zhte415 8y agoI think you've already done it. A central bank cannot run a blockchain level of trust that is smaller than they are. And nor can shipping companies, and basically anyone. If you're not sure another party isn't in control of the 51% of the chain, nothing is safe.
- loceng 8y agoWhich then requires a centralized authority, of members who trust the systems/processes and people in place, if going to use blockchain technology..
- jamieweb 8y agoWhat are you going to stream? Setting up the miners physically or a screencast of the configuration? Or something else?
- deleted 8y ago[deleted]
- deleted 8y ago[deleted]
- applelover 8y agowill it be pumpped during attacking?
- copex 8y agoCan't we take profit too with this attack? It would affect the whole blockchain, so we can also send an amount of that coin to an exchange when you start the fork. Then we will have the amount restored when the fork becomes the real of the coin.
- someno 8y agoI hope you realise Einsteinium has introduced dPoW algo to harden their blockchain security several weeks ago? They checkpoint to the Bitcoin blockchain every 10 minutes on average. You have not prepared accordingly, have you?
- ziomanzo 8y ago?
- luna239 8y agoWhat account?
- luna239 8y agoWe apologize. This content is no longer available.
- sauravt 8y agoDid anyone watch it live ?
- bitspill 8y agoWas banned by Twitch before the demonstration so switched to stream.me who also banned him, says he'll record it and post a video later instead last I saw
- tiotempestade 8y agoIs there a recording of this? I've missed the thing!