8 ms·

It's highly unlikely that high-profile Bitcoin busts will require meaningful advances in cryptography: they're far, far more likely to be appsec work -- perhaps

by patio11 14y ago

It's highly unlikely that high-profile Bitcoin busts will require meaningful advances in cryptography: they're far, far more likely to be appsec work -- perhaps inspired appsec work -- of the kind routinely conducted by intermediate programmers with weeks of specialized training. Let me put some round numbers on the cost of various attacks: Major result in cryptography: $X0 million to $X00 million+ (nation-state adversary) Subtle bug in the Satoshi client C code: $100,000 (trivially within the reach of organized crime or a single highly motivated attacker) Bust any Bitcoin-using Ruby on Rails (&tc) application: $20k probably, upper bounded by $100k where you'd produce (as an industrial biproduct) a RCE on any arbitrary Rails site Compromise the security of a non-trivial number of Bitcoin users via spearphishing / targeted malware / etc: $1,000 If you're a thief who doesn't have access to any computer skills or the above sums of money, have no fear, it is likely that the Bitcoin economy still has multiple options for you to get in on the ground floor of exciting new ways to steal things. [P.S. I'm routinely pessimistic about Bitcoins for a lot of reasons, but the software security angle keeps coming back to me because it's so easy to explain. If you think I'm overly pessimistic, consider the track record on HN of "people who know what the threat environment banks operate in looks like" versus "Bitcoin advocates" has been in predicting observable future outcomes of e.g. Bitcoin bucket shops in advance.]

wslh 14y ago
Sorry, I don't understand your reasoning. What is the difference of running a bitcoin app to, say, a forex site in terms of security? and what do you mean with major result in cryptography? Other cryptographic protocols can be broken too. What makes bitcoin special?
- ISL 14y ago
  SHA256 underpins Bitcoin. Break SHA256, and you win.
  - nadaviv 14y ago
    Break SHA256, and you can cause hash collisions that allows you to easily mine blocks until 51% of the network switches to a better hashing algorithm (which should happen pretty quick, because it'll be obvious that someone broke it). To steal users money, you'd have to break ECDSA. Edit: I wasn't 100% exact. It gives you more [1] than easily mining blocks, but still not that much power so that I would call it "Winning". [1] https://en.bitcoin.it/wiki/Weaknesses#Attacker_has_a_lot_of_computing_power https://en.bitcoin.it/wiki/Weaknesses#Attacker_has_a_lot_of_...
    - tptacek 14y ago
      And you're more confident in ECDSA why?
    - betterunix 14y ago
      Compute hashes faster than the rest of the network and you win. The "51% attack" is a polynomial time attack, which is not an acceptable security margin in cryptography.
      - reedlaw 14y ago
        It seems the "51% attack" can be mitigated simply by waiting for 6 or more confirmations before sending off merchandise or in the case of an exchange, allowing withdrawal of funds. Those who can't wait that long can rely on 3rd parties who attempt to take on fraud in exchange for transaction fees, similar to the current credit card system.
        betterunix 14y ago
        That is not true. The attack works regardless of how many confirmations you wait for.
        reedlaw 14y ago
        How so? Isn't a double spend only possible if the attacker's blockchain fork endures for the customary 6 blocks it takes to confirm a transaction? A single block fork would be ignored by the majority chain and thus the attacker's chain transactions would be useless.
  - Nursie 14y ago
    I'm not sure why people think that the only possible compromise is breaking SHA256 or other algirithm. It's perfectly possible to create trivially breakable cryptosystems using these algorithms. Not saying that the bitcoin blockchain or protocol suffers from this, but implementation and protocol flaws are often a far more fruitful source of compromises. If BTC has none of those then colour me impressed because at some point or other most of the big name systems (OpenSSH and OpenSSL spring to mind) have had revisions for various exploit-related reasons. We won't know for some years of course.
  - venomsnake 14y ago
    It was already broken ... on debian. When the random was limited to 0-65535.
- patio11 14y ago
  What is the difference of running a bitcoin app to, say, a forex site in terms of security? It depends on what you mean by "forex site". If you mean "a bucket shop, which uses as its source of random numbers currency fluctuations", then a forex site is approximately as risky as a bitcoin exchange, modulo the fact that the forex frontend almost certainly has no lever on it which will actually cause outgoing wires and the bitcoin exchange almost certainly does. That's actually a pretty big modulo, come to think of it. [Edit to add: This is just talking about software security. Bitcoin exchanges have a legal security problem which forex sites don't, because you can use Bitcoin exchanges to move money and you can't conveniently do that with forex sites.] If by "forex site" you mean e.g. a bank's foreign currency trading desk, you're asking me to compare the US Army and the Boy Scouts in terms of potential to conquer arbitrary nations. what do you mean with major result in cryptography? SHA-256 has some time complexity associated with it. A major result in cryptography gives some variant of attack against it with radically lower time complexity than we currently think attacking it requires: say, it allows a speedup of 2X, 4X, etc etc. (It is unlikely, but conceivable, that it would go to O(1) all at once.) This is like every other cryptographic algorithm. Producing major cryptographic results is hard. Weaponizing them is harder, still: 2X improvement probably doesn't make any attacks practical which weren't practical before, it just posts a "Warning: this algorithm will die in the foreseeable future, transition off at the earliest convenience" notice to all interested parties. But, again, Bitcoin advocates love wrapping themselves up in crypto because it makes them feel secure. Crypto is one teeny tiny little bit of their systemic security. It isn't the important bit. That's a very impressive looking deadbolt you have, there, and defeating it would probably be pretty difficult, but the pane of unreinforced glass right next to it looks a little promising and, if you check with your 17-year old architect who is doing this in his spare time, he might be able to confirm that your house only has two walls and no ceiling.
- dclusin 14y ago
  The biggest difference is that in forex there is a clear distinction between trading and "clearing." Trading occurs when two people agree to trade (SURPRISE!) a specified amount of two (or more) currencies for a given rate of exchange at some point in the future. Clearing is the part where the money actually changes hands. You're probably asking yourself, "But what happens when someone agrees to a trade but the transaction doesn't clear?" This is referred to as counterparty risk. Counterparty risk is pretty self explanatory: the risk that the other person doesn't pay you. Therefore, compromising the exchange doesn't necessarily mean the end of the world since the "front office" (place where trading happens) is logically separated from the "back office" (place where money changes hands etc). As an aside, this is why France is in the process of regulating the movement of employees between the back office and the front office. If you are familiar with how both systems work then it becomes trivial to start hiding your trading activities and positions. The most damning part about compromising, say, a forex exchange, is that you get to take a peek at everyones trading history and hidden orders. So if you compromise the exchange and see that fund X has an open resting order for 20b EUR/USD @ some price you can then use this information to profit from. Or alternatively based upon the data you abscond with, it then becomes possible to reverse engineer their trading strategies. This is a bit different than a bitcoin exchange as my understanding is that the clearing and trading occur all at once and there is no separation. E.g. the exchange occurs as soon as the two parties agree. Although this eliminates counterparty risk it poses significant (insurmountable?) problems for the way automated trading currently works today. Another difference is that the vast majority of forex trading volume happens between institutional investors (usually on behalf of a corporate which is just trying to pay workers in another country) or other hedge funds. This makes security vastly easier since all of these servers are walled off from the public internet and the traffic they exchange never hits the public internet. Additionally it is also reasonable to expect that the system administrators of the end users understand how to operate a computer and keep it relatively secure :). Not always the case, but the assumption. Edit: Additionally, the clearing is handled by the counterparties themselves and not the exchange. With bitcoin the exchange handles everything and thus is the central point of failure.
  - jcrites 14y ago
    > E.g. the exchange occurs as soon as the two parties agree. Although this eliminates counterparty risk it poses significant (insurmountable?) problems for the way automated trading currently works today. Could you elaborate on this? I'm interested to understand why this presents a problem. Isn't it a good thing for both parties?
mrb 14y ago
"If you're a thief who doesn't have access to any computer skills or the above sums of money, have no fear, it is likely that the Bitcoin economy still has multiple options for you to get in on the ground floor of exciting new ways to steal things." Exactly. Low-tech ways of stealing bitcoins is precisely what we are seeing the most in the community right now. Thieves who merely sweet-talk people on the forum and convince them to invest in their "businesses" (ponzi schemes, fake ASIC preorders, etc), then receiving the money, and running away. Cost for the thief: at most $100 (setting up a website to advertise the fake business). For example just 2 months ago, a fraudster advertised his company selling Bitcoin ASIC mining hardware (www.labsnovo.com, now taken down) by posting a comment to my blog... This is very sad to see because every freaking time, some people fall for it. You may have 4 out of 5 posts on the forums reporting one of these scheme as a "LIKELY FRAUD" in all caps, yet there are always a few people who ignore these warnings and just try to invest anyway. sigh
- rsync 14y ago
  Is it illegal to steal bitcoins ? If so, why ? And how is it different (at least in the eyes of the law) than stealing a wand from someone in Ultima Online ? In fact, let me go further - does not a "real" currency issuer have a vested interest in not judging bitcoin theft to be illegal ? If it's illegal, that bestows a certain legitimacy ...
  - conover 14y ago
    Wouldn't if be the difference between fraud and a violation of a game's terms of service?
  - Egregore 14y ago
    Recently I've read an article that Belorusian police investigated stealing of a virtual tank from "World of Tanks", found it and returned it to the original owner.
  - jebeng 14y ago
    If you were to hack into someones account and take it, I would think that is illegal. Obviously if you were to steal it ingame that would not be illegal. It's almost certainly illegal to steal bitcoins. I guess I'm referring to US law here, but I would expect it to be illegal in any country that has computer crime laws. And sure it is in the currency issuer's interest to do do that, if think in strict terms of maximising the value of the issued currency. But that doesn't mean the currency issuer will take every action available to do so. The bigger picture is much more complicated than that.
derefr 14y ago
> the software security angle keeps coming back to me because it's so easy to explain Or, to rephrase the standard pitch for Bitcoin: a bitcoin is as easy to steal as a credit card number, and as untraceable when it disappears as cash. ;)
- nadaviv 14y ago
  Not quite. Credit card numbers can be (and mostly are) stolen from websites that accepts them. That's not true for Bitcoin - you have to gain access to the customers computers that stores the private keys. In that regard, Bitcoin is actually much more secure. Edit: I just want to add that I think its really silly that most of the online transactions are still done by a series of numbers that can be easily copied and re-used by whoever gets them. We should have much better solutions by now.
  - tptacek 14y ago
    The financial system bears much of the cost of fraud, and avoids externalizing the cost of poor security. That's not true of Bitcoin, where losses are for the most part irrevocable. Bitcoin might be more "secure" in some fiddly sense, but the credit card system is much safer for normal people.
    - sillysaurus 14y ago
      Bitcoin might be more "secure" in some fiddly sense, but the credit card system is much safer for normal people. A chargeback system is a protocol requiring centralized trust. A company will no doubt implement this. Centralized trust is of course necessary. One could argue that it defeats the point of bitcoin. Yet that's not true, if you think of bitcoin as being a currency (rather than a "secure" currency, or any other label). If it's a currency, then a chargeback protocol is simply a company waiting to happen. And the company would necessarily have to be large, because it has to bear the cost of fraud. Luckily, PayPal has already done a lot of the homework necessary to pull off such an endeavor. Lastly, it doesn't matter what normal people use. It matters what will become convenient for normal people to use. That's a subtle distinction, because it means as soon as infrastructure is built then people may start using it by default.
awt 14y ago
What is a better way to maintain a distributed ledger? Also, is it even theoretically possible to get bitcoin security right in your opinion? Is it practical?
- tptacek 14y ago
  This first question comes up all the time in security threads and you should know the answer is "it doesn't matter". If the threat/concern/flaw/whatever is valid, the person who raises it doesn't need to have a better alternative.
  - awt 14y ago
    His points are valid not only against Bitcoin, but against a large set of existing e-commerce sites and technologies. I think he would be more convincing if he could come up with some attacks that were unique to Bitcoin and would justify the undercurrent of his comment -- that Bitcoin is bound to fail, and fail badly enough that it will be of no use to anyone except scammers.
    - patio11 14y ago
      I think he would be more convincing if he could come up with some attacks that were unique to Bitcoin "Find any combination of inputs (say, of the executable script that Bitcoin runs by design) which gives you an RCE on one instance of the satoshi client, fan out the attacker-chosen code to the entire network, root (a large percentage of) the network at once." is my usual example of a hypothetical attack. People keep telling me that this can't happen. Your call on whether you find them or me more credible. I have no particular dog in that fight -- no change in the Bitcoin price affects my net worth. (If Bitcoin imploding would cause me to be impoverished, I might buy a pair of the rose-tinted lenses that some folks seem to be wearing.)
      - tptacek 14y ago
        This is obviously just one example of a link in Bitcoin that is weaker than SHA2. An even weaker link would be the appsec quality of the largest Bitcoin transacting sites.

by patio11 14y ago

wslh 14y ago

Sorry, I don't understand your reasoning. What is the difference of running a bitcoin app to, say, a forex site in terms of security? and what do you mean with major result in cryptography? Other cryptographic protocols can be broken too. What makes bitcoin special?

ISL 14y ago
SHA256 underpins Bitcoin. Break SHA256, and you win.
- nadaviv 14y ago
  Break SHA256, and you can cause hash collisions that allows you to easily mine blocks until 51% of the network switches to a better hashing algorithm (which should happen pretty quick, because it'll be obvious that someone broke it). To steal users money, you'd have to break ECDSA. Edit: I wasn't 100% exact. It gives you more [1] than easily mining blocks, but still not that much power so that I would call it "Winning". [1] https://en.bitcoin.it/wiki/Weaknesses#Attacker_has_a_lot_of_computing_power https://en.bitcoin.it/wiki/Weaknesses#Attacker_has_a_lot_of_...
  - tptacek 14y ago
    And you're more confident in ECDSA why?
  - betterunix 14y ago
    Compute hashes faster than the rest of the network and you win. The "51% attack" is a polynomial time attack, which is not an acceptable security margin in cryptography.
    - reedlaw 14y ago
      It seems the "51% attack" can be mitigated simply by waiting for 6 or more confirmations before sending off merchandise or in the case of an exchange, allowing withdrawal of funds. Those who can't wait that long can rely on 3rd parties who attempt to take on fraud in exchange for transaction fees, similar to the current credit card system.
      - betterunix 14y ago
        That is not true. The attack works regardless of how many confirmations you wait for.
        reedlaw 14y ago
        How so? Isn't a double spend only possible if the attacker's blockchain fork endures for the customary 6 blocks it takes to confirm a transaction? A single block fork would be ignored by the majority chain and thus the attacker's chain transactions would be useless.
- Nursie 14y ago
  I'm not sure why people think that the only possible compromise is breaking SHA256 or other algirithm. It's perfectly possible to create trivially breakable cryptosystems using these algorithms. Not saying that the bitcoin blockchain or protocol suffers from this, but implementation and protocol flaws are often a far more fruitful source of compromises. If BTC has none of those then colour me impressed because at some point or other most of the big name systems (OpenSSH and OpenSSL spring to mind) have had revisions for various exploit-related reasons. We won't know for some years of course.
- venomsnake 14y ago
  It was already broken ... on debian. When the random was limited to 0-65535.
patio11 14y ago
What is the difference of running a bitcoin app to, say, a forex site in terms of security? It depends on what you mean by "forex site". If you mean "a bucket shop, which uses as its source of random numbers currency fluctuations", then a forex site is approximately as risky as a bitcoin exchange, modulo the fact that the forex frontend almost certainly has no lever on it which will actually cause outgoing wires and the bitcoin exchange almost certainly does. That's actually a pretty big modulo, come to think of it. [Edit to add: This is just talking about software security. Bitcoin exchanges have a legal security problem which forex sites don't, because you can use Bitcoin exchanges to move money and you can't conveniently do that with forex sites.] If by "forex site" you mean e.g. a bank's foreign currency trading desk, you're asking me to compare the US Army and the Boy Scouts in terms of potential to conquer arbitrary nations. what do you mean with major result in cryptography? SHA-256 has some time complexity associated with it. A major result in cryptography gives some variant of attack against it with radically lower time complexity than we currently think attacking it requires: say, it allows a speedup of 2X, 4X, etc etc. (It is unlikely, but conceivable, that it would go to O(1) all at once.) This is like every other cryptographic algorithm. Producing major cryptographic results is hard. Weaponizing them is harder, still: 2X improvement probably doesn't make any attacks practical which weren't practical before, it just posts a "Warning: this algorithm will die in the foreseeable future, transition off at the earliest convenience" notice to all interested parties. But, again, Bitcoin advocates love wrapping themselves up in crypto because it makes them feel secure. Crypto is one teeny tiny little bit of their systemic security. It isn't the important bit. That's a very impressive looking deadbolt you have, there, and defeating it would probably be pretty difficult, but the pane of unreinforced glass right next to it looks a little promising and, if you check with your 17-year old architect who is doing this in his spare time, he might be able to confirm that your house only has two walls and no ceiling.
dclusin 14y ago
The biggest difference is that in forex there is a clear distinction between trading and "clearing." Trading occurs when two people agree to trade (SURPRISE!) a specified amount of two (or more) currencies for a given rate of exchange at some point in the future. Clearing is the part where the money actually changes hands. You're probably asking yourself, "But what happens when someone agrees to a trade but the transaction doesn't clear?" This is referred to as counterparty risk. Counterparty risk is pretty self explanatory: the risk that the other person doesn't pay you. Therefore, compromising the exchange doesn't necessarily mean the end of the world since the "front office" (place where trading happens) is logically separated from the "back office" (place where money changes hands etc). As an aside, this is why France is in the process of regulating the movement of employees between the back office and the front office. If you are familiar with how both systems work then it becomes trivial to start hiding your trading activities and positions. The most damning part about compromising, say, a forex exchange, is that you get to take a peek at everyones trading history and hidden orders. So if you compromise the exchange and see that fund X has an open resting order for 20b EUR/USD @ some price you can then use this information to profit from. Or alternatively based upon the data you abscond with, it then becomes possible to reverse engineer their trading strategies. This is a bit different than a bitcoin exchange as my understanding is that the clearing and trading occur all at once and there is no separation. E.g. the exchange occurs as soon as the two parties agree. Although this eliminates counterparty risk it poses significant (insurmountable?) problems for the way automated trading currently works today. Another difference is that the vast majority of forex trading volume happens between institutional investors (usually on behalf of a corporate which is just trying to pay workers in another country) or other hedge funds. This makes security vastly easier since all of these servers are walled off from the public internet and the traffic they exchange never hits the public internet. Additionally it is also reasonable to expect that the system administrators of the end users understand how to operate a computer and keep it relatively secure :). Not always the case, but the assumption. Edit: Additionally, the clearing is handled by the counterparties themselves and not the exchange. With bitcoin the exchange handles everything and thus is the central point of failure.
- jcrites 14y ago
  > E.g. the exchange occurs as soon as the two parties agree. Although this eliminates counterparty risk it poses significant (insurmountable?) problems for the way automated trading currently works today. Could you elaborate on this? I'm interested to understand why this presents a problem. Isn't it a good thing for both parties?

mrb 14y ago

"If you're a thief who doesn't have access to any computer skills or the above sums of money, have no fear, it is likely that the Bitcoin economy still has multiple options for you to get in on the ground floor of exciting new ways to steal things." Exactly. Low-tech ways of stealing bitcoins is precisely what we are seeing the most in the community right now. Thieves who merely sweet-talk people on the forum and convince them to invest in their "businesses" (ponzi schemes, fake ASIC preorders, etc), then receiving the money, and running away. Cost for the thief: at most $100 (setting up a website to advertise the fake business). For example just 2 months ago, a fraudster advertised his company selling Bitcoin ASIC mining hardware (www.labsnovo.com, now taken down) by posting a comment to my blog... This is very sad to see because every freaking time, some people fall for it. You may have 4 out of 5 posts on the forums reporting one of these scheme as a "LIKELY FRAUD" in all caps, yet there are always a few people who ignore these warnings and just try to invest anyway. sigh

rsync 14y ago
Is it illegal to steal bitcoins ? If so, why ? And how is it different (at least in the eyes of the law) than stealing a wand from someone in Ultima Online ? In fact, let me go further - does not a "real" currency issuer have a vested interest in not judging bitcoin theft to be illegal ? If it's illegal, that bestows a certain legitimacy ...
- conover 14y ago
  Wouldn't if be the difference between fraud and a violation of a game's terms of service?
- Egregore 14y ago
  Recently I've read an article that Belorusian police investigated stealing of a virtual tank from "World of Tanks", found it and returned it to the original owner.
- jebeng 14y ago
  If you were to hack into someones account and take it, I would think that is illegal. Obviously if you were to steal it ingame that would not be illegal. It's almost certainly illegal to steal bitcoins. I guess I'm referring to US law here, but I would expect it to be illegal in any country that has computer crime laws. And sure it is in the currency issuer's interest to do do that, if think in strict terms of maximising the value of the issued currency. But that doesn't mean the currency issuer will take every action available to do so. The bigger picture is much more complicated than that.

derefr 14y ago

> the software security angle keeps coming back to me because it's so easy to explain Or, to rephrase the standard pitch for Bitcoin: a bitcoin is as easy to steal as a credit card number, and as untraceable when it disappears as cash. ;)

nadaviv 14y ago
Not quite. Credit card numbers can be (and mostly are) stolen from websites that accepts them. That's not true for Bitcoin - you have to gain access to the customers computers that stores the private keys. In that regard, Bitcoin is actually much more secure. Edit: I just want to add that I think its really silly that most of the online transactions are still done by a series of numbers that can be easily copied and re-used by whoever gets them. We should have much better solutions by now.
- tptacek 14y ago
  The financial system bears much of the cost of fraud, and avoids externalizing the cost of poor security. That's not true of Bitcoin, where losses are for the most part irrevocable. Bitcoin might be more "secure" in some fiddly sense, but the credit card system is much safer for normal people.
  - sillysaurus 14y ago
    Bitcoin might be more "secure" in some fiddly sense, but the credit card system is much safer for normal people. A chargeback system is a protocol requiring centralized trust. A company will no doubt implement this. Centralized trust is of course necessary. One could argue that it defeats the point of bitcoin. Yet that's not true, if you think of bitcoin as being a currency (rather than a "secure" currency, or any other label). If it's a currency, then a chargeback protocol is simply a company waiting to happen. And the company would necessarily have to be large, because it has to bear the cost of fraud. Luckily, PayPal has already done a lot of the homework necessary to pull off such an endeavor. Lastly, it doesn't matter what normal people use. It matters what will become convenient for normal people to use. That's a subtle distinction, because it means as soon as infrastructure is built then people may start using it by default.

awt 14y ago

What is a better way to maintain a distributed ledger? Also, is it even theoretically possible to get bitcoin security right in your opinion? Is it practical?

tptacek 14y ago
This first question comes up all the time in security threads and you should know the answer is "it doesn't matter". If the threat/concern/flaw/whatever is valid, the person who raises it doesn't need to have a better alternative.
- awt 14y ago
  His points are valid not only against Bitcoin, but against a large set of existing e-commerce sites and technologies. I think he would be more convincing if he could come up with some attacks that were unique to Bitcoin and would justify the undercurrent of his comment -- that Bitcoin is bound to fail, and fail badly enough that it will be of no use to anyone except scammers.
  - patio11 14y ago
    I think he would be more convincing if he could come up with some attacks that were unique to Bitcoin "Find any combination of inputs (say, of the executable script that Bitcoin runs by design) which gives you an RCE on one instance of the satoshi client, fan out the attacker-chosen code to the entire network, root (a large percentage of) the network at once." is my usual example of a hypothetical attack. People keep telling me that this can't happen. Your call on whether you find them or me more credible. I have no particular dog in that fight -- no change in the Bitcoin price affects my net worth. (If Bitcoin imploding would cause me to be impoverished, I might buy a pair of the rose-tinted lenses that some folks seem to be wearing.)
    - tptacek 14y ago
      This is obviously just one example of a link in Bitcoin that is weaker than SHA2. An even weaker link would be the appsec quality of the largest Bitcoin transacting sites.