There has been quite some coverage about Bitcoin in last couple of months. For those that did not pay attention, Bitcoin is a crypto currency that is decentralized and works in a peer-to-peer network. It is a pretty fascinating project by a Japanese researcher (maybe – his real identity has not been confirmed) and in case you are interested in it you can find some information at http://www.bitcoin.org/. Some background Couple of weeks ago I started doing some research on how Bitcoin works. I found it amazing that for a scheme so wide spread (there are probably tens of thousands, if not hundreds of thousands of active users) that not a lot of technical documentation is available, apart from Satoshi’s paper available on the main web site, which does not really go into implementation details. One of the features of Bitcoin that gets mentioned quite often is its anonymity. Basically, Bitcoin has a digital wallet which allows you to process incoming and create new transactions. A user has one or more (preferably many) public/private key pairs which identify him. In the Bitcoin system, when you want to send Bitcoins to someone, you sign a transaction that is taking some of your Bitcoins (which you received through a transaction or mining – more about this later) to the destination address. All addresses are unique 40 digit hexadecimal numbers (RIPEMD160(SHA256(public key)) with some extra conversion to Base-58. You can have as many as you want of these and this is one of the ways for Bitcoin to allow anonymity. Since you can use a different public/private key pair for every transaction (and you can transfer Bitcoins to your other addresses) it can be difficult (but not impossible) to track the owner. One thing to keep in mind is that all Bitcoin transactions are public – every node knows everything about every transaction. How do you get new coins? In order to confirm a transaction, it has to be included in a block. A block (https://en.bitcoin.it/wiki/Blocks) contains a hash pointing to a previous block (so the blocks are chained, this is what makes spoofing exponentially difficult with generation of more blocks), some other data and a Merkle root hash of all transactions validated by this block. Now comes the best part – all this data is hashed together (SHA256(SHA256(block)) and the resulting hash has to satisfy some requirements. The requirements state that the resulting hash has to start with a certain number of zeros. So, for example if the resulting hash has 7 leading zeros it is valid. How do we find a valid block? Besides the payload a nonce is embedded to which gets constantly changed. Simply speaking, the node that is generating the block brute forces all possible values until it finds a valid hash that satisfies the previously mentioned requirement. As you can see, this is an extremely complex task that, with fastest gear (and I’m talking about loads of GPU cards) can take days if not months. So a logical question is: why would anyone do that? The node that finds a valid block (mines it, in Bitcoin’s terminology) gets awarded (currently) 50 Bitcoin. With 1 Bitcoin being around 7.3 USD currently, this means that for each solved block the node that found it gets ~350 USD. Sounds good? Besides this, the solver also gets a certain fee for transactions that have been validated so in reality more than 50 Bitcoin will be awarded to the solver (this is the incentive to keep solving the tasks even after all Bitcoins have been awarded). Finally, another important thing about blocks is that it should take approximately 10 minutes to solve a block. The network itself measures how long it took to solve 2016 blocks (it should be about two weeks) and modifies the difficultly accordingly (so if more people start solving this, the difficulty gets higher). My CPU > your CPU There are legitimate groups of users that join so called mining pools in order to find new valid hashes. The pool owner runs a special algorithm that sends partial tasks to all nodes participating in mining. Different pools have different rules, but today it is common that they share received Bitcoin between participating nodes, depending on how much each node has participated. There are many open source, free Bitcoin mining programs that are specially optimized for GPU’s. Couple of months ago we started first seeing malware stealing Bitcoin wallets (basically doing transactions to their owners) and lately Bitcoin mining pools used by malware started being increasingly popular. Perfect extortion weapon Just about when I was to finish this diary (which will probably be only first in the series about Bitcoin), we received a very interesting e-mail from one of our readers who wanted to remain anonymous. He received an e-mail from an attacker asking him to pay 100 Bitcoin to a certain address or his site will be a target of a DDoS attack. We’ve seen such extortion e-mails many times in the past (as always – do not pay) but using Bitcoin is a new twist. As I previously wrote, while it is not 100% anonymous, it can be very close to this and, depending on how careful the attacker is, it can be very difficult to trace the transaction. As Bitcoin is gaining more attention it will be interesting to see what future will bring. Rest assured that we will keep an eye on it. -- I will be teaching next: Web App Penetration Testing and Ethical Hacking - SANS Pen Test Hackfest Europe 2022 - Berlin |
Bojan 403 Posts ISC Handler Sep 5th 2011 |
Thread locked Subscribe |
Sep 5th 2011 1 decade ago |
You absolutely can be anonymous with Bitcoin. It doesn't provide anonymity - Bitcoin only enables anonymity by not requiring a link between people and their bitcoin addresses. I can create my bitcoin addresses/keys offline and money can be sent/transferred/assigned to those addresses without them ever touching the internet. As for sending money anonymously, your bitcoin client can connect to it's peers via tor and/or other open public wifi. Or, you could simply transmit those addresses/keys over sneakernet to your intended party where they could import and spend them. They could be traded like this indefinitely like cash gets handed around so their origin is completely unknown. See BitBills for an example of this.
|
Anonymous |
Quote |
Sep 6th 2011 1 decade ago |
For a more social commentary look at BitCoins check out ButtCoin.org (yes a dumb name). It doesn't touch on this matter but might be interesting for those wanting to get into it to hear a contrasting point of view on the human/social engineering aspects.
|
Anonymous |
Quote |
Sep 6th 2011 1 decade ago |
One wonders, what are the problems being solved.
Is the crowd solving random problems or breaking a bank's transfer authentication scheme. |
GordonM 17 Posts |
Quote |
Sep 6th 2011 1 decade ago |
@Tuxavant - thanks for mentioning BitBills, looks like a really interesting concept :)
Everyone, thanks for comments, keep them coming. |
Bojan 403 Posts ISC Handler |
Quote |
Sep 6th 2011 1 decade ago |
@Gordon Mit the problems being solved are simply hashes of all the transactions contained in a block of transactions where the hash matches a mask value (has a certain number of leading bits that equal zero). These leading zeros allow for a "sliding" difficulty of computation so the network can moderate the generation of new bitcoins to once every 10 minutes.
|
Bojan 2 Posts |
Quote |
Sep 7th 2011 1 decade ago |
A system for receiving money is not a 'weapon'.
|
Bojan 28 Posts |
Quote |
Sep 13th 2011 1 decade ago |
I think it is important to understand that the technology underpins bitcoin (the blockchain) can be used for far more applications than just currency. Yes the currency is psudoanonymus and will is some way or form aid criminal activity, but not more that other fiat currencies does today, already. I think the good will outweigh the bad. Similar to the way the web evolved.
If you are interested in blockchain technology or decentralized applications I urge you to check out <a href="https://cryptojunction.com/cryptocurrency/ethereum/">Ethereum</a>. |
Bojan 1 Posts |
Quote |
Apr 9th 2016 6 years ago |
Sign Up for Free or Log In to start participating in the conversation!