9 ms·
Mt. Gox under DDoS attack as bitcoin price surges
- wladimir 14y agoOne thing with Bitcoin that still needs to be decentralized is the exchanges. This shows again that mtgox is the achilles heel. Sure, there are many other exchanges and ways to sell/buy, but it's telling (and sad) that DDoSing mtgox is an effective price manipulation method. As the stakes grow higher Bitcoin is turning into an interesting endeavor in building resilent systems and preventing Single Points of Failure.
- TazeTSchnitzel 14y agoIt is already decentralised in the sense that there are plenty of alternatives, and there are "over-the-counter" places like Bitcoin's #bitcoin-otc.
- wladimir 14y agoI know that. But for some reason there is an extreme reliance on mtgox for price information. Even trades in -otc are usually based on the mtgox price. So maybe I worded it wrong, it's not so much trade that is centralized but the trade/price broadcasting.
- TazeTSchnitzel 14y agoAh, I see. Well, there are some sources that aggregate data, like Bitcoin Charts: http://bitcoincharts.com/markets/ http://bitcoincharts.com/markets/
- deleted 14y ago[deleted]
- wladimir 14y agoAgreed. Still, bitcoincharts is a centralized site too, and could be DDoSed, overloaded, blocked, etc. Maybe ticker/trade data could be spread over a gossip network as well. That's not as trivial as it sounds, though, for example how to check that trades are real and not just spam/manipulation. Maybe some way of authenticating exchanges by signing the packets (but then -otc would be left out... maybe their reputation system could be integrated somehow).
- mtgx 14y agoIf the banks ever start adopting it, then trading Bitcoins should become pretty decentralized.
- wladimir 14y agoIn what sense are banks decentralized? Aren't those too-big-to-fail giants what we're trying to get away from in the first place? :-)
- oleganza 14y agoThe reason for a lack of easy to use exchanges is the artificial cost of entry. You cannot simply set up a website to trade coins for money with some friends because of licensing, regulations, capital requirements etc. If you were free to move your money how you want on the internet without questions asked, we would have many exchanges (and probably wouldn't need Bitcoin in the first place).
- tlrobinson 14y agoThis is one of promises of Ripple. It will be interesting to see how it plays out.
- skore 14y ago> What can you do? > Like our favorite author here at Tibanne says… Don’t Panic! > “Panic-selling is a wide-scale selling of an investment which causes a sharp decline in prices.[...]” (Source: Wikipedia) But... But I want it to crash! Just a little! So I can finally buy lots of bitcoins myself!
- lucb1e 14y agoI want it to crash too! Like, drop to half the price and then http://3.bp.blogspot.com/_JZ0rN-zdg2M/TU_NRnvhGfI/AAAAAAAAAF8/XqZUhPrSz90/s1600/dagobert_duck.jpg http://3.bp.blogspot.com/_JZ0rN-zdg2M/TU_NRnvhGfI/AAAAAAAAAF...
- viraptor 14y agoI don't think it can crash anymore. Not like the last time anyway. Too many people know that the price will go back again and want this to happen. (me included) What that means in practice is that some people will buy after 5% drop, more after 10%, even more after 15%, etc... I don't believe anymore that we can have a proper crash in this situation. If we do, the price will bounce back in a matter of seconds. I'm probably not the only one keeping an open order to buy as many bitcoins as possible at below £5. Lack of sell-stop orders on mtgox also means there's nothing to balance them out (apart from automatic trading).
- davidw 14y agoA lot of people wanted tulip prices to rise again, as well.
- buro9 14y agoAny day now
- viraptor 14y agoI agree on the bubble phase being similar, but disagree on what would happen afterwards. Tulips becoming cheap meant that everyone suddenly had access, but the amount was still more limitted than in case of BTC. Also the time of each transaction was not even close to what happens at mtgox. There are thousands of orders just waiting to be filled the moment the price moves. On the other hand physical goods shipment took weeks/months. So while both events may have a similar cause/progress... there's a huge difference in how the market itself works.
- lucb1e 14y agoIt's a bird....It's a plane...It's Cloudflare! Edit: Oh they're already using it? Guess they can't save the day then... MtGox seem to be up now though.
- nwh 14y agoMost Bitcoin websites, Mt. Gox included, are already behind CloudFlare. Worryingly, this means they have surrendered their SSL private keys to a secondary company.
- wladimir 14y agoWorryingly, indeed. To me it appears that the "cloud" is the next bastion of centralization and "too big to fail"s. In this case, instead of providing services in a decentralized fashion that makes it hard to attack, they hide behind ever larger and stronger behemoths. In the case of cloudflare there is no great data loss if they disappear, though they could intercept passwords and private data (can you trust them? who has access? what if they are hacked?). But when a service such as gmail (suddenly) disappears... it would be devastating to many people. Much like the failure of a bank.
- gphil 14y agoYeah, but you also already have to trust the certificate authority, your ISP, your employees who have access to the server...the list goes on. Furthermore, I believe the way it works is that clients make an SSL connection to CloudFlare, who makes another SSL connection to your service (using different key pairs.) Granted, they still get to see all your traffic unencrypted, but it all just comes back to trust.
- lmm 14y agoSSL is end-to-end; the ISP is just one more untrusted carrier. And I would expect MtGox to have access controls around employee access to their servers. Both MtGox and their certificate authority have much stronger incentives to play nice than CloudFlare do.
- api 14y agoAnyone remember EFNet IRC in the mid-1990s? Bitcoin is going to be like that, except real money is at stake.
- skrebbel 14y agoI remember EFNet allright, but I've still no clue what you're talking about. At least to my understanding, EFNet was (is?) an IRC network. With channels. Where people chat. Maybe I missed some relevant history?
- yebyen 14y agoI think he's remembering #e or something like that, where I spent a great part of my childhood (before it moved to Freenode and forked to #gah) where things happened before the public knew, such as VA Linux, E17, offended.co.uk (author of feh), and MythTV. And ferite. (a c-like scripting language that I love, with regex's)
- api 14y agoBasically, the old IRC protocol was pretty brittle. You could break the network with DDOS attacks, exploits, etc. in order to get "ops" on IRC channels. This resulted in a sort of emergent hacker game called channel wars. Massive attacks were constantly being launched, to the point that running an IRC server became a way to have a serious target painted on your connection.
- yebyen 14y agoOh yes. Now I remember EFnet in the 90's.
- deleted 14y ago[deleted]
- andyzweb 14y agoI'm still banned for life from EFNet for some mid 90's transgressions.
- trotsky 14y agoMt. Gox is in the midst of a major technical overhaul of its exchange. Gay-Bouchery said Mt. Gox is rebuilding its trading platform from the ground up. We're throwing out our entire OLTP system, but trust us - the lag and error pages that have been popping up on our heaviest trading day of the year are caused by hackers.
- deleted 14y ago[deleted]
- CapitalistCartr 14y agoAttackers. They're not hackers, they're vandals throwing eggs at your house.
- Karunamon 14y agoYes it's entirely more likely that they're breaking their own service (which with transaction fees is their primary income source) rather than some person or group screwing with the exchange in order to influence the price.
- trotsky 14y agoHeh. I'm suggesting their trading platform is having trouble scaling, not that they're doing it on purpose.
- brokentone 14y agoLargest DDoS attack? A mighty claim without any numbers. I thought we just had the largest attack on Spamhaus the other week anyway? Oh well, I quit tech news stories.
- swinglock 14y agoI assume against Mt. Gox.
- SethMurphy 14y agoWith all the vague claims about attacks and building a "bullet proof" system I have a hard time trusting them any more than a trader at a big bank selling their own complicated financial instrument. He seems to be trying to manipulate the prices with these statements too. Good thing it is unregulated. Oh yeah, and "He warned bitcoin traders not to panic or invest more money than they're willing to lose." IMHO this is a straight up admission it is a speculative investment and not a real currency at the moment.
- jimktrains2 14y agoI'm pretty sure that Grade A bonds, CDs, and IRAs, among few others, accounts are the only types of investments that one should consider putting more money then they're willing to loose into. Bitcoins is a ForEx market, and like any ForEx market, you can lose money, quickly.
- gibybo 14y agoTechnically speaking, an IRA is just a (brokerage|bank) account with a special tax designation. It won't stop you from putting all your money in a penny stock or out of the money options, for example.
- jimktrains2 14y agoAh. I thought they were a combination of various things that made them fairly stable, or more so than a 401(k) anyway. Thanks for the clarification.
- jbooth 14y agoUnless you do most of your financial transactions in bitcoin, you're treating it as a speculative investment. If you're buying bitcoins in order to make an online purchase, you're using it as a currency. If you're buying bitcoins, then selling them back to dollars/whatever when you need money, you're treating it as speculation.
- rmrfrmrf 14y ago
- NelsonMinar 14y agoIn this article Mt Gox says that the attacks are to manipulate the currency. My first guess was this was a shakedown; it's not uncommon for organized criminal gangs to DDOS a site until they pay a ransom. Grey market sites are particularly vulnerable to extortion; online gambling, for instance.
- baby 14y agoWhat kind of sources do you have to back up this theory? Never heard of that before.
- deleted 14y ago[deleted]
- NelsonMinar 14y agoThe main source I've read on DDOS extortion is "Fatal System Error". It's largely about Barrett Lyon's company Prolexic, a company specifically providing DDOS protection for online casinos. But that's just one example, I think there are many more. I have zero specific evidence that there's been DDOS extortion against BitCoin providers, but it sure seems plausible.
- waterlesscloud 14y agoProlexic is also the company providing DDOS protection for MtGox. Source: MagicalTux (person who runs Gox) in freenode #mtgox.
- eli 14y agoHere's a similar example: https://sealswithclubs.eu/currently-experiencing-a-ddos-attack/ https://sealswithclubs.eu/currently-experiencing-a-ddos-atta... And the concept is hardly new: http://news.bbc.co.uk/2/hi/technology/4579623.stm http://news.bbc.co.uk/2/hi/technology/4579623.stm
- kgo 14y agoSome Russians tried this in May 2011 during the last bubble. MtGox was transparent about it. https://bitcointalk.org/index.php?topic=7494.0 https://bitcointalk.org/index.php?topic=7494.0
- tlrobinson 14y agoThe lag of six or seven seconds before a trade is executed "is not acceptable," I don't understand what a DDoS has to do with trade lag. They're DDoSing the website, not the trading engine, right? 6 or 7 seconds is bad enough, but it's a huge understatement. MtGox's trading engine "lag" can grow to absurd numbers, it was like 10 minutes a couple days ago. I honestly can't comprehend how it gets this bad. It should be on the order of micro or milli seconds. It's not like matching up trades is computationally expensive. Anyone have an explanation?
- M4v3R 14y ago6, 7 seconds? Few days ago there was a 1 HOUR lag. I am not kidding. All MtGox APIs have lagged a whole frickin' hour behind their trading engine. Now THAT was bad. And I see more than 60 seconds lag nearly every day. Edit: Seems you updated the post, so now my is obsolete :). Anyway, their official explanation is that the engine is so slow because when iterating over the whole orderbook, which is huge, they have to check if every offer has enough funds for it to be executed. This is a design flaw and they want to fix it by not letting you to place a order without sufficient funds in the first place.
- tlrobinson 14y agoThat sounds like terrible software engineering and doesn't inspire confidence.
- M4v3R 14y agoActually for them it's a feature, and there is an API call for that: http://mtgox.com/api/1/generic/order/lag http://mtgox.com/api/1/generic/order/lag Currently: "lag_secs":85.319123
- TomatoTomato 14y agoNow: {"result":"success","return":{"lag":588717,"lag_secs":0.588717,"lag_text":"0.588717 seconds"}}
- jpdus 14y agoDoes anyone had a withdrawal request processed by Mt.Gox during the last days? I requested 2 withdrawals more than a week ago and didnt receive any funds nor do the requests show up in my account history...
- saosebastiao 14y agoBitcoin makes for some great speculation, but I absolutely cannot treat it as a currency until the prices stabilize independent of the exchange used.
- ChuckMcM 14y agoFascinating stuff. Since there is no legal authority behind Bitcoin (meaning people with jails and a willingness to use them) there are incentives to find ways to manipulate it in these sorts of ways, and little risk. I don't doubt for a minute that the authorities find this amusing since they would no doubt rather a currency outside anyone's jurisdiction got established and so people who destabilize it are "friends" of a sort. That makes them less likely to intervene. That combination makes BitCoin sort of like [1] Eve Online, but with drugs instead of spaceships. I wonder if this will lead to the creation of 'recovery agents' like the art world has, usually former thieves or investigators who work for insurance companies for a percentage of the recovered value. [1] in the sense that you can scheme and plan large takeovers and heists and the "outside" world doesn't care.
- saraid216 14y agoEVE Online has drugs, too. #justsaying
- kiba 14y agoBuying drugs for bitcoin just happens to be the most famous use, because the media love to pay attention to Silk Road. So when everyone think about bitcoin, silk road comes to mind. Everything else associated with bitcoin just get left behind because it is boring.
- tolmasky 14y agoI know this is a commonly held belief, and quite possibly also the correct legal interpretation of the situation, but I find it so strange. A currency is just what we call a currency. If tomorrow my friends and I decide to start trading goods for bicycles, then our bicycles become currency. I don't see how that would all of a sudden make it OK to steal each other's bicycles, or somehow put bicycles outside the scope of existing laws. If I went to the police and said "Someone stole my bicycle", it would seem crazy for them to respond with "haha should have kept that value in USD instead sucker!" Every physical good we have has only the value we instill in it in our minds. The absolute best analogue to this is chips at a casino. Chips really are a parallel currency. They can buy you anything within the mini economy of the host casino (and additionally are accepted by other fringe elements in said city). They can be exchanged back for USD as well. Despite this, the authorities in Las Vegas take casino chip theft very seriously. Now people can go out of their way to explain how chips aren't really currency for whatever reason they want. To that I could then respond "fine, but in that case I also don't believe bitcoin to be currency either, just my own digital property, like an iTunes song. So I still expect to have these digital assets protected by the law".
- someOtherName 14y agoBecause what is "Mt. Gox"??? https://encrypted.google.com/search?q=Mt.+Gox https://encrypted.google.com/search?q=Mt.+Gox https://mtgox.com/ https://mtgox.com/ "Mt.Gox is the world's most established Bitcoin exchange."
- jmgao 14y agoIt's a Magic the Gathering Online card exchange.
- nsoun 14y agoAre there patterns in flow traffic that monitoring tools could help detect/mitigating a DDoS like this?