Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hacker Redirects Traffic From 19 Internet Providers to Steal Bitcoins

wired.com

Post reply on HN
Print view View original

51–60 of 69 posts

Re: Hacker Redirects Traffic From 19 Internet Providers to Steal Bitcoins

#51

Post by CalRobert »

pjc50 wrote: post #48
CalRobert wrote: post #43

Earlier quoted context omitted.

But the way this is implemented is "credit card companies will take 3% of every transaction they perform, and then give back a very small portion of that to counteract fraud". The power we give these organizations - basically a 3% tax on every transaction - is mind boggling.

Compared to the spread and inconvenience on $ -> bitcoin -> $ transactions, that's quite cheap. Keeping bitcoin online enough for convenient transactions carries the small but important risk of losing your entire wallet.

True, and there are benefits you get for that 3% (rental car insurance, reduced cost of a mugging, etc. etc.) but I still wonder if cash (not necessarily bitcoin) would be better for the system as a whole for everyday purchases.

Re: Hacker Redirects Traffic From 19 Internet Providers to Steal Bitcoins

#52

Post by tbarbugli »

tacoman wrote: post #24
scott_karana wrote: post #15

Wow. Not sure why they don't name-and-shame the ISP, but that's really ridiculous.

"the CTU research team provided the BGP evidence to the upstream ISP closest to the origin of the malicious activity." I think this likely means it's a smaller ISP.

Jack Bauer will take good care of this issue

Re: Hacker Redirects Traffic From 19 Internet Providers to Steal Bitcoins

#53

Post by runeks »

rdl wrote: post #27

It's mind boggling to me that this wasn't done a year or two ago. If bitcoin were genuinely anonymous (it isn't, because it's highly linkable, even if essentially pseudonymous), it would probably be vastly more dangerous in this way -- there would be billions of dollars spent on exploiting security outside bitcoin++ to steal bitcoin++.

> It's mind boggling to me that this wasn't done a year or two ago.

Two years ago, obtaining the same amount of bitcoins as this attack did would net you 1/100th the profit in dollars (bitcoins were around $6 a piece two years ago).

I think it's likely that attackers started considering this scheme around a year ago, when the bitcoin price shot up to $100, and the potential rewards became sizable.

Re: Hacker Redirects Traffic From 19 Internet Providers to Steal Bitcoins

#54

Post by dfox »

sergers wrote: post #20
scott_karana wrote: post #15

Wow. Not sure why they don't name-and-shame the ISP, but that's really ridiculous.

As a Canadian, using a Canadian ISP, I would like to know as well. Not entirely surprised regarding rogue employee possibility.

There are two things at play here: attacker has to have access to one ISP to inject the route (eg. rogue employee) and there has to be another ISP that accepts such route from BGP (I would say that filtering weirdly specific routes is good and common practice). When you have access to ISP network you don't have to inject things into BGP to attack your own customers.

Re: Hacker Redirects Traffic From 19 Internet Providers to Steal Bitcoins

#55

Post by danielweber »

superuser2 wrote: post #34
onewaystreet wrote: post #10

Earlier quoted context omitted.

The same thing can be said about credit cards. If there is a problem with Bitcoin (and I'm not sure that there is) it is that unlike with credit cards there is no possible recovery of stolen coins.

Converting stolen CC numbers to cash actually turns out to be difficult since government and other authorities can revoke the cards, freeze fraudulent merchant accounts, and seize assets once they've hit your bank accounts. You have to mitigate all of these risks and won't always be successful. If you manage to steal Bitcoin, you can transfer it all to your personal wallet in one transaction in broad daylight and, by…

There is good research that indicates that the bottleneck in electronic bank theft is finding the endpoints that are irreversible (think ATMs). Doubling the amount of stolen credit cards wouldn't come anywhere close to doubling the amount of money stolen out of the system.

With Bitcoin, every marginal theft adds 100% to the total Bitcoin thefts.

Re: Hacker Redirects Traffic From 19 Internet Providers to Steal Bitcoins

#56

Post by a3camero »

CalRobert wrote: post #43
xcubed wrote: post #39

Earlier quoted context omitted.

The difference is that with the Target breach, people knew that they would get their credit card $$ back.

But the way this is implemented is "credit card companies will take 3% of every transaction they perform, and then give back a very small portion of that to counteract fraud". The power we give these organizations - basically a 3% tax on every transaction - is mind boggling.

The credit card companies don't actually don't give up part of their 3%. Chargebacks are up to the merchant: http://en.wikipedia.org/wiki/Chargeback_fraud.

Re: Hacker Redirects Traffic From 19 Internet Providers to Steal Bitcoins

#57

Post by marcosdumay »

mrb wrote: post #4

I work in InfoSec and it is mind-boggling to see the sophistication levels of some of the Bitcoin heists, like this BGP incident. When was the last time you saw a BGP attack? 99.9% of real-world attacks don't even bother targetting such a core routing service. Another example: in March 2012, internal Linode management infrastructure was compromised to steal 47k BTC: http://blog.zorinaq.com/?e=67 http://www.theregiste…

Maybe I should buy some Bitcoin... Keeping a online wallet may be a great way to test a computer's security.

(Ok, half kidding, it's not secure, whatever computer I could talk about.)

Re: Hacker Redirects Traffic From 19 Internet Providers to Steal Bitcoins

#58

Post by marcosdumay »

bdamm wrote: post #17
kmod wrote: post #13

The finger-pointing at BGP is red herring: the problem is that the stratum protocol has zero authentication. If you can intercept those streams, you can trivially ask anyone to start mining for you instead. This could also have been done using DNS poisoning, ISP-side intercepts, or anything else in the standard bag of tricks. http://blog.kevmod.com/category/bitcoin/

Indeed, for bitcoin it's a solvable problem, however let's not let that distract us from the monumental revelation that BGP hacking is so easy to do that someone motivated by a relatively paltry reward can pull it off. This is one aspect of bitcoin that I really like, it shows us where the weaknesses are.

You're certainly not looking, because BGP insecurity is very old news.

Re: Hacker Redirects Traffic From 19 Internet Providers to Steal Bitcoins

#59

Post by hibikir »

superuser2 wrote: post #34
onewaystreet wrote: post #10

Earlier quoted context omitted.

The same thing can be said about credit cards. If there is a problem with Bitcoin (and I'm not sure that there is) it is that unlike with credit cards there is no possible recovery of stolen coins.

Converting stolen CC numbers to cash actually turns out to be difficult since government and other authorities can revoke the cards, freeze fraudulent merchant accounts, and seize assets once they've hit your bank accounts. You have to mitigate all of these risks and won't always be successful. If you manage to steal Bitcoin, you can transfer it all to your personal wallet in one transaction in broad daylight and, by…

I think this is really the sticking point that makes consumer Bitcoin adoption pretty much impossible, as the level of computer security required to keep Bitcoin safe and easy to use at the same time is just not something available to your average joe.

If your private key is compromised, the thief takes your entire balance, and there's nothing you can do about it. So you really want to keep it safe.

Lose your private key, lose everything it was protecting. So keeping the key in only one place, and one place where only you can access, is a big problem. There is nobody out there to give access to your money if you pass away. A hardware failure can be catastrophic.

The problem is that everything that makes the private key survive accidents makes it easier to hack. The way we treat something like this in a corporation is with things like shared secrets: Need 3 out of 5 people to use their issued keys so that the real private key protecting everything is revealed. And even with that level of effort, getting the key is still possible with enough effort.

Re: Hacker Redirects Traffic From 19 Internet Providers to Steal Bitcoins

#60

Post by dmm »

CalRobert wrote: post #51
pjc50 wrote: post #48

Earlier quoted context omitted.

Compared to the spread and inconvenience on $ -> bitcoin -> $ transactions, that's quite cheap. Keeping bitcoin online enough for convenient transactions carries the small but important risk of losing your entire wallet.

True, and there are benefits you get for that 3% (rental car insurance, reduced cost of a mugging, etc. etc.) but I still wonder if cash (not necessarily bitcoin) would be better for the system as a whole for everyday purchases.

Keep in mind that cash has costs too. It has to be counted and secured. You have to hire a security company to pick up deposits and most banks charge for cash deposits over a certain amount.
Post reply on HN