📅 Original date posted:2014-08-07
📝 Original message:> the only protection is SSL + certificate validation on client side.
However certificate revocation and updates in miners are pain in the ass,
that's why majority of pools (mine including) don't want to play with
that...
Another solution which would have less overhead would be to implement
something akin to what openssh does. The OpenSSH client stores a
certificate fingerprint, which is then verified automatically upon further
connections to the server.
The initial connection needs to be verified manually by the operator,
though.
> Certificate validation isn't needed unless the attacker can do a direct
MITM
at connection time, which is a lot harder to maintain than injecting a
client.reconnect. This, combined with your concern about up to date
certs/revokes/etc, is why BFGMiner defaults to TLS without cert checking for
stratum.
Seems to me that it would correctly mitigate the attack mentioned in the
wired article. I am surprised that miners are not worried about losing
their profits, I would personally be quite annoyed.
2014-08-08 12:37 GMT+12:00 Christopher Franko <chrisjfranko at gmail.com>:
> What exactly makes bitcoin less of a target than a "scamcoin" which I
> suspect means anything that != bitcoin?
>
>
> On 7 August 2014 20:29, slush <slush at centrum.cz> wrote:
>
>> AFAIK the only protection is SSL + certificate validation on client side.
>> However certificate revocation and updates in miners are pain in the ass,
>> that's why majority of pools (mine including) don't want to play with
>> that...
>>
>> slush
>>
>>
>> On Fri, Aug 8, 2014 at 1:45 AM, Luke Dashjr <luke at dashjr.org> wrote:
>>
>>> On Thursday, August 07, 2014 11:02:21 PM Pedro Worcel wrote:
>>> > Hi there,
>>> >
>>> > I was wondering if you guys have come across this article:
>>> >
>>> > http://www.wired.com/2014/08/isp-bitcoin-theft/
>>> >
>>> > The TL;DR is that somebody is abusing the BGP protocol to be in a
>>> position
>>> > where they can intercept the miner traffic. The concerning point is
>>> that
>>> > they seem to be having some degree of success in their endeavour and
>>> > earning profits from it.
>>> >
>>> > I do not understand the impact of this (I don't know much about BGP,
>>> the
>>> > mining protocol nor anything else, really), but I thought it might be
>>> worth
>>> > putting it up here.
>>>
>>> This is old news; both BFGMiner and Eloipool were hardened against it a
>>> long
>>> time ago (although no Bitcoin pools have deployed it so far). I'm not
>>> aware of
>>> any actual case of it being used against Bitcoin, though - the target has
>>> always been scamcoins.
>>>
>>>
>>> ------------------------------------------------------------------------------
>>> Infragistics Professional
>>> Build stunning WinForms apps today!
>>> Reboot your WinForms applications with our WinForms controls.
>>> Build a bridge from your legacy apps to the future.
>>>
>>> http://pubads.g.doubleclick.net/gampad/clk?id=153845071&iu=/4140/ostg.clktrk
>>> _______________________________________________
>>> Bitcoin-development mailing list
>>> Bitcoin-development at lists.sourceforge.net
>>> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>>>
>>
>>
>>
>> ------------------------------------------------------------------------------
>> Want fast and easy access to all the code in your enterprise? Index and
>> search up to 200,000 lines of code with a free copy of Black Duck
>> Code Sight - the same software that powers the world's largest code
>> search on Ohloh, the Black Duck Open Hub! Try it now.
>> http://p.sf.net/sfu/bds
>>
>> _______________________________________________
>> Bitcoin-development mailing list
>> Bitcoin-development at lists.sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>>
>>
>
>
> ------------------------------------------------------------------------------
> Want fast and easy access to all the code in your enterprise? Index and
> search up to 200,000 lines of code with a free copy of Black Duck
> Code Sight - the same software that powers the world's largest code
> search on Ohloh, the Black Duck Open Hub! Try it now.
> http://p.sf.net/sfu/bds
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20140808/b550abc2/attachment.html>;
Pedro Worcel [ARCHIVE] /
npub10u…z72j8
2023-06-07 15:24:59
in reply to nevent1q…malm
Author Public Key
npub10u058zpa2pmy5ljudd4vkmuh6tdy70y5weqhhzqq7ltefua38qhq2z72j8Published at
2023-06-07 15:24:59Event JSON
{
"id": "d3113b83247635e8f04b2df52ef07657eed2eb92e7e4845020d9bd5e17909410",
"pubkey": "7f1f43883d50764a7e5c6b6acb6f97d2da4f3c9476417b8800f7d794f3b1382e",
"created_at": 1686151499,
"kind": 1,
"tags": [
[
"e",
"6cef07af0faac9707f80f8840d2c81c59eb26cce03afa7fdc1332a0b02a13efb",
"",
"root"
],
[
"e",
"9e6f506d7c3e31a42d58e5e060809ae6e7d3d8795dc75485f15ddea957c31c30",
"",
"reply"
],
[
"p",
"3062c27cd0a25d3773bed6de26d13a14535bebbb48531ff66e3a3031171aa7f2"
]
],
"content": "📅 Original date posted:2014-08-07\n📝 Original message:\u003e the only protection is SSL + certificate validation on client side.\nHowever certificate revocation and updates in miners are pain in the ass,\nthat's why majority of pools (mine including) don't want to play with\nthat...\n\nAnother solution which would have less overhead would be to implement\nsomething akin to what openssh does. The OpenSSH client stores a\ncertificate fingerprint, which is then verified automatically upon further\nconnections to the server.\n\nThe initial connection needs to be verified manually by the operator,\nthough.\n\n\u003e Certificate validation isn't needed unless the attacker can do a direct\nMITM\nat connection time, which is a lot harder to maintain than injecting a\nclient.reconnect. This, combined with your concern about up to date\ncerts/revokes/etc, is why BFGMiner defaults to TLS without cert checking for\nstratum.\n\nSeems to me that it would correctly mitigate the attack mentioned in the\nwired article. I am surprised that miners are not worried about losing\ntheir profits, I would personally be quite annoyed.\n\n\n\n2014-08-08 12:37 GMT+12:00 Christopher Franko \u003cchrisjfranko at gmail.com\u003e:\n\n\u003e What exactly makes bitcoin less of a target than a \"scamcoin\" which I\n\u003e suspect means anything that != bitcoin?\n\u003e\n\u003e\n\u003e On 7 August 2014 20:29, slush \u003cslush at centrum.cz\u003e wrote:\n\u003e\n\u003e\u003e AFAIK the only protection is SSL + certificate validation on client side.\n\u003e\u003e However certificate revocation and updates in miners are pain in the ass,\n\u003e\u003e that's why majority of pools (mine including) don't want to play with\n\u003e\u003e that...\n\u003e\u003e\n\u003e\u003e slush\n\u003e\u003e\n\u003e\u003e\n\u003e\u003e On Fri, Aug 8, 2014 at 1:45 AM, Luke Dashjr \u003cluke at dashjr.org\u003e wrote:\n\u003e\u003e\n\u003e\u003e\u003e On Thursday, August 07, 2014 11:02:21 PM Pedro Worcel wrote:\n\u003e\u003e\u003e \u003e Hi there,\n\u003e\u003e\u003e \u003e\n\u003e\u003e\u003e \u003e I was wondering if you guys have come across this article:\n\u003e\u003e\u003e \u003e\n\u003e\u003e\u003e \u003e http://www.wired.com/2014/08/isp-bitcoin-theft/\n\u003e\u003e\u003e \u003e\n\u003e\u003e\u003e \u003e The TL;DR is that somebody is abusing the BGP protocol to be in a\n\u003e\u003e\u003e position\n\u003e\u003e\u003e \u003e where they can intercept the miner traffic. The concerning point is\n\u003e\u003e\u003e that\n\u003e\u003e\u003e \u003e they seem to be having some degree of success in their endeavour and\n\u003e\u003e\u003e \u003e earning profits from it.\n\u003e\u003e\u003e \u003e\n\u003e\u003e\u003e \u003e I do not understand the impact of this (I don't know much about BGP,\n\u003e\u003e\u003e the\n\u003e\u003e\u003e \u003e mining protocol nor anything else, really), but I thought it might be\n\u003e\u003e\u003e worth\n\u003e\u003e\u003e \u003e putting it up here.\n\u003e\u003e\u003e\n\u003e\u003e\u003e This is old news; both BFGMiner and Eloipool were hardened against it a\n\u003e\u003e\u003e long\n\u003e\u003e\u003e time ago (although no Bitcoin pools have deployed it so far). I'm not\n\u003e\u003e\u003e aware of\n\u003e\u003e\u003e any actual case of it being used against Bitcoin, though - the target has\n\u003e\u003e\u003e always been scamcoins.\n\u003e\u003e\u003e\n\u003e\u003e\u003e\n\u003e\u003e\u003e ------------------------------------------------------------------------------\n\u003e\u003e\u003e Infragistics Professional\n\u003e\u003e\u003e Build stunning WinForms apps today!\n\u003e\u003e\u003e Reboot your WinForms applications with our WinForms controls.\n\u003e\u003e\u003e Build a bridge from your legacy apps to the future.\n\u003e\u003e\u003e\n\u003e\u003e\u003e http://pubads.g.doubleclick.net/gampad/clk?id=153845071\u0026iu=/4140/ostg.clktrk\n\u003e\u003e\u003e _______________________________________________\n\u003e\u003e\u003e Bitcoin-development mailing list\n\u003e\u003e\u003e Bitcoin-development at lists.sourceforge.net\n\u003e\u003e\u003e https://lists.sourceforge.net/lists/listinfo/bitcoin-development\n\u003e\u003e\u003e\n\u003e\u003e\n\u003e\u003e\n\u003e\u003e\n\u003e\u003e ------------------------------------------------------------------------------\n\u003e\u003e Want fast and easy access to all the code in your enterprise? Index and\n\u003e\u003e search up to 200,000 lines of code with a free copy of Black Duck\n\u003e\u003e Code Sight - the same software that powers the world's largest code\n\u003e\u003e search on Ohloh, the Black Duck Open Hub! Try it now.\n\u003e\u003e http://p.sf.net/sfu/bds\n\u003e\u003e\n\u003e\u003e _______________________________________________\n\u003e\u003e Bitcoin-development mailing list\n\u003e\u003e Bitcoin-development at lists.sourceforge.net\n\u003e\u003e https://lists.sourceforge.net/lists/listinfo/bitcoin-development\n\u003e\u003e\n\u003e\u003e\n\u003e\n\u003e\n\u003e ------------------------------------------------------------------------------\n\u003e Want fast and easy access to all the code in your enterprise? Index and\n\u003e search up to 200,000 lines of code with a free copy of Black Duck\n\u003e Code Sight - the same software that powers the world's largest code\n\u003e search on Ohloh, the Black Duck Open Hub! Try it now.\n\u003e http://p.sf.net/sfu/bds\n\u003e _______________________________________________\n\u003e Bitcoin-development mailing list\n\u003e Bitcoin-development at lists.sourceforge.net\n\u003e https://lists.sourceforge.net/lists/listinfo/bitcoin-development\n\u003e\n\u003e\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20140808/b550abc2/attachment.html\u003e",
"sig": "7c448c3d490e4e5f19c1c630b04e5bdfa1920b5b982a79abee26c1537a65fab96378f5ab1b0f2d841b0d4ea910b24c2c59055efb648e8603e21543420502b9fa"
}