5 ms·

The most typical way to profit from this, is to have quite a bit of ETC, and then sell it on an exchange or buy something expensive. This transaction would then

The most typical way to profit from this, is to have quite a bit of ETC, and then sell it on an exchange or buy something expensive. This transaction would then end up on the block chain, and eventually be considered secure / part of history. Privately, you are building a chain where said transaction did _not_ occur. Because your hash rate is high enough, you are generating blocks at at least the pace of the public chain. You keep mining your chain (without your transaction) privately until the bank transfer from the exchange goes through, or you are sure whatever you bought is on its way. Then you broadcast your private chain as soon as it has at least one block more than the public chain and voila, you have your ETC back and the USD/EUR/crypto you sold it for (or the product you bought). You can have your cake and eat it too. This is because the rule of most cryptocurrencies is that the longest chain is the truth, and everyone mines on top of the longest chain. If a longer chain appears out of nowhere, all miners will jump on top of this one. There is no such thing as "finality" in most cryptocurrencies, where something becomes actually (read: much more) irreversible. Of course, doing this only makes sense if what you gain outweighs the costs of performing such an attack. Note that you typically _cannot_ steal coins from specific wallets, as you do not have the keys to those coins. You can however censor transactions that you may not want, but the above is a common way to benefit from a 51% attack.

naveen99 8y ago
so to be safe, an exchange should require more confirmations depending on size of deposit. Basically the number of confirmations you could finance an attack for with the deposit.
- Klathmon 8y ago
  Yes, and most do. Many will semi-routinely increase the number of confirmations during times where it could be necessary (like chain splits or network upgrade events), or adjust the number of confirmations depending on the size of the currency and overall usage. Another mitigation is to shut down trading until the attack is over. Maintaining a 51% attack is expensive (assuming there is at least SOME usage of the coin), and if you just say "we won't be doing business for the next 24 hours", the attacker now has to maintain that attack for the next 24 hours, and if the company wants, they can just extend the time. Eventually (hopefully!) the attacker will run out of money, and the "correct" chain will take it over again.
  - jeremyjh 8y ago
    The attack cannot be observed until it is accomplished. Naturally the chain will be long enough to target the exchange the spend was made at.
    - Klathmon 8y ago
      it can't be observed until it's acted on, but it may not be done after the first "attack", especially if it's cheap enough to launch on that specific coin.
- pietjepuk88 8y ago
  I'm not sure how easy it would be for exchanges to implement variable confirmations depending on the amount transferred, but I would say that what you suggest is a very reasonable way to limit the risk of suffering such an attack. I would say that especially exchanges that support fringe coins would better look into something like that. Even if the exchange's potential loss is only a couple hundred or thousand dollars, it's worth doing in my opinion, even if only to avoid the technical or legal hassle that would otherwise follow. I would say that most (other) fringe coins are not as easily attacked as ETC was. They have very illiquid markets, and you cannot really sell a significant amount of them before you basically just deplete the order books. And merchants are typically not accepting anything other than the major coins either. I guess ETC was still riding along on its partially shared name/history with its bigger brother. Eventually, some more details on the double spend transactions might shed some light on who suffered a loss in this case. It might be an exchange, but most of them require KYC nowadays (so it becomes hard to get away with).
- alkonaut 8y ago
  Shouldn’t any sale/transaction be considered “not final” (goods can’t be shipped, for example) until the official chain has progressed to a point where you can be sure the cost of producing a censored fork is higer than the transaction in question? That is: you buy something expensive then it might not ship for a month or two. I guess you could buy a hundred gadgets at $100 each from a hundred places in one day and then produce a fork censoring your whole $10k shopping spree?
  - hippich 8y ago
    you can't predict that - the alternative chain is mined privately and it is a matter of amount at stake how long this mining will continue.
    - alkonaut 8y ago
      But in the publicly visible (longest, official) chain, can't I estimate the effort that was used to mine from a certain transaction up to the head? Say the transaction I want to hide is b, then the attacker would need to mine a longer alternative chain (c', d'...). If transaction b was for $1000 and we can estimate that the mining of the visible chain c...f is at least $2k with a conservative estimate, can't we estimate that the attackers chain c'...g' must cost something at least vaguely proportoinal to that as well? Is it not even possible to make a conservative guesstimate of cost-vs-chain-length? a<-b<-c<-d<-e<-f \ c'<-d'<-e'<-f'<-g'
sf_rob 8y ago
Upvoted for explaining the attack well but RE:longest chain, Blocks are added at a standard rate so the chain with the greatest accrued work is the "truth".
- pietjepuk88 8y ago
  You are totally correct :) I figured it would be easier to forgo the explanation of "difficulty" and difficulty adjustments (which ETC/ETH do much quicker than e.g. Bitcoin does).
CWuestefeld 8y ago
Of course, doing this only makes sense if what you gain outweighs the costs of performing such an attack. If the hardware to accomplish the attack is available for your use, the cost of the mining should net out at zero-ish, because you're also getting the rewards for doing the mining. So the net cost of the attack is just the overhead for the mining hardware. Coincidentally, economist Alex Tabarrok just wrote about this today: https://marginalrevolution.com/marginalrevolution/2019/01/bitcoin-much-less-secure-people-think.html https://marginalrevolution.com/marginalrevolution/2019/01/bi...
- pietjepuk88 8y ago
  Yes, I would guess that coins sharing an algorithm with a much bigger brother (in hash rate) are particularly susceptible. Of course, the perceived security and valuation of many coins is somewhat tied together, and I can imagine many miners would avoid attacks on other (smaller brother) chains because they might end up hurting themselves as well. But it only takes one (big enough) actor to do serious damage to a smaller brother coin, possibly looking to gain financially, or maybe just to undermine its credibility/valuation. To do the latter, I would say continuously forcing many large reorgs is the way to go.

naveen99 8y ago

so to be safe, an exchange should require more confirmations depending on size of deposit. Basically the number of confirmations you could finance an attack for with the deposit.

Klathmon 8y ago
Yes, and most do. Many will semi-routinely increase the number of confirmations during times where it could be necessary (like chain splits or network upgrade events), or adjust the number of confirmations depending on the size of the currency and overall usage. Another mitigation is to shut down trading until the attack is over. Maintaining a 51% attack is expensive (assuming there is at least SOME usage of the coin), and if you just say "we won't be doing business for the next 24 hours", the attacker now has to maintain that attack for the next 24 hours, and if the company wants, they can just extend the time. Eventually (hopefully!) the attacker will run out of money, and the "correct" chain will take it over again.
- jeremyjh 8y ago
  The attack cannot be observed until it is accomplished. Naturally the chain will be long enough to target the exchange the spend was made at.
  - Klathmon 8y ago
    it can't be observed until it's acted on, but it may not be done after the first "attack", especially if it's cheap enough to launch on that specific coin.
pietjepuk88 8y ago
I'm not sure how easy it would be for exchanges to implement variable confirmations depending on the amount transferred, but I would say that what you suggest is a very reasonable way to limit the risk of suffering such an attack. I would say that especially exchanges that support fringe coins would better look into something like that. Even if the exchange's potential loss is only a couple hundred or thousand dollars, it's worth doing in my opinion, even if only to avoid the technical or legal hassle that would otherwise follow. I would say that most (other) fringe coins are not as easily attacked as ETC was. They have very illiquid markets, and you cannot really sell a significant amount of them before you basically just deplete the order books. And merchants are typically not accepting anything other than the major coins either. I guess ETC was still riding along on its partially shared name/history with its bigger brother. Eventually, some more details on the double spend transactions might shed some light on who suffered a loss in this case. It might be an exchange, but most of them require KYC nowadays (so it becomes hard to get away with).
alkonaut 8y ago
Shouldn’t any sale/transaction be considered “not final” (goods can’t be shipped, for example) until the official chain has progressed to a point where you can be sure the cost of producing a censored fork is higer than the transaction in question? That is: you buy something expensive then it might not ship for a month or two. I guess you could buy a hundred gadgets at $100 each from a hundred places in one day and then produce a fork censoring your whole $10k shopping spree?
- hippich 8y ago
  you can't predict that - the alternative chain is mined privately and it is a matter of amount at stake how long this mining will continue.
  - alkonaut 8y ago
    But in the publicly visible (longest, official) chain, can't I estimate the effort that was used to mine from a certain transaction up to the head? Say the transaction I want to hide is b, then the attacker would need to mine a longer alternative chain (c', d'...). If transaction b was for $1000 and we can estimate that the mining of the visible chain c...f is at least $2k with a conservative estimate, can't we estimate that the attackers chain c'...g' must cost something at least vaguely proportoinal to that as well? Is it not even possible to make a conservative guesstimate of cost-vs-chain-length? a<-b<-c<-d<-e<-f \ c'<-d'<-e'<-f'<-g'

sf_rob 8y ago

Upvoted for explaining the attack well but RE:longest chain, Blocks are added at a standard rate so the chain with the greatest accrued work is the "truth".

pietjepuk88 8y ago
You are totally correct :) I figured it would be easier to forgo the explanation of "difficulty" and difficulty adjustments (which ETC/ETH do much quicker than e.g. Bitcoin does).

CWuestefeld 8y ago

Of course, doing this only makes sense if what you gain outweighs the costs of performing such an attack. If the hardware to accomplish the attack is available for your use, the cost of the mining should net out at zero-ish, because you're also getting the rewards for doing the mining. So the net cost of the attack is just the overhead for the mining hardware. Coincidentally, economist Alex Tabarrok just wrote about this today: https://marginalrevolution.com/marginalrevolution/2019/01/bitcoin-much-less-secure-people-think.html https://marginalrevolution.com/marginalrevolution/2019/01/bi...

pietjepuk88 8y ago
Yes, I would guess that coins sharing an algorithm with a much bigger brother (in hash rate) are particularly susceptible. Of course, the perceived security and valuation of many coins is somewhat tied together, and I can imagine many miners would avoid attacks on other (smaller brother) chains because they might end up hurting themselves as well. But it only takes one (big enough) actor to do serious damage to a smaller brother coin, possibly looking to gain financially, or maybe just to undermine its credibility/valuation. To do the latter, I would say continuously forcing many large reorgs is the way to go.