Bitcoin Forum

Other => Beginners & Help => Topic started by: dhenson on April 11, 2013, 01:50:10 AM



Title: Today's DDOS / MT.GOX manipulation observation
Post by: dhenson on April 11, 2013, 01:50:10 AM
I'm posting here as my account can't yet post elsewhere. 

Today during the massive sell-off/mtgox panic the panic started with a couple of very large sells followed by what appeared to be a massive DDOS comapign.  This rendered mtgox all but unusable, and their API stream was spotty at best.  What was interesting was the buy orders that were already placed in anticipation of the crash.

By refreshing bitcoin.clarkmoody.com I was able to watch the sell orders that had already been placed prior to the DDOS (assumption) and noticed that there were quite a few evenly spaced huge buy orders already in the queue.  every 10 dollars or so there would be a 2000+ btc order ready to be gobbled up by the panicking market sellers.

Using this info could we not predict the next DDOS attack and sell early, in preparation for re-entering at a lower point?  If we notice evenly spaced out orders for thousands of btc well below the current trading level (for example, orders for 2000 btc at 100,110,120,130 when it's currently trading at 220) we can assume a DDOS is imminent.

Thoughts?



Title: Re: Today's DDOS / MT.GOX manipulation observation
Post by: paraipan on April 11, 2013, 01:53:37 AM
I'm posting here as my account can't yet post elsewhere. 

Today during the massive sell-off/mtgox panic the panic started with a couple of very large sells followed by what appeared to be a massive DDOS comapign.  This rendered mtgox all but unusable, and their API stream was spotty at best.  What was interesting was the buy orders that were already placed in anticipation of the crash.

By refreshing bitcoin.clarkmoody.com I was able to watch the sell orders that had already been placed prior to the DDOS (assumption) and noticed that there were quite a few evenly spaced huge buy orders already in the queue.  every 10 dollars or so there would be a 2000+ btc order ready to be gobbled up by the panicking market sellers.

Using this info could we not predict the next DDOS attack and sell early, in preparation for re-entering at a lower point?  If we notice evenly spaced out orders for thousands of btc well below the current trading level (for example, orders for 2000 btc at 100,110,120,130 when it's currently trading at 220) we can assume a DDOS is imminent.

Thoughts?



Hmm interesting, didn't know that. Thanks for sharing.


Title: Re: Today's DDOS / MT.GOX manipulation observation
Post by: xrobau on April 11, 2013, 01:55:19 AM
I don't think that there's any dispute that people are DDOSing Gox in order to drive down the market price. However, this has been a reasonably recent phenomenon, and while their DDOS protection is already at 'Pretty damn Good', they need to step it up to 'Amazon' levels of DDOS protection.  I'm sure they'll do it sooner rather than later.

--Rob


Title: Re: Today's DDOS / MT.GOX manipulation observation
Post by: PRESSPLAY on April 11, 2013, 01:55:46 AM
Anyone know how many posts aere required to post in the forums?


Title: Re: Today's DDOS / MT.GOX manipulation observation
Post by: Trongersoll on April 11, 2013, 01:58:00 AM
hmmm, sounds like somebodys figured out how to play the system. the solution is to think long term and ignore the short term.


Title: Re: Today's DDOS / MT.GOX manipulation observation
Post by: OnPointDesign on April 11, 2013, 02:04:11 AM
I'm posting here as my account can't yet post elsewhere. 

Today during the massive sell-off/mtgox panic the panic started with a couple of very large sells followed by what appeared to be a massive DDOS comapign.  This rendered mtgox all but unusable, and their API stream was spotty at best.  What was interesting was the buy orders that were already placed in anticipation of the crash.

By refreshing bitcoin.clarkmoody.com I was able to watch the sell orders that had already been placed prior to the DDOS (assumption) and noticed that there were quite a few evenly spaced huge buy orders already in the queue.  every 10 dollars or so there would be a 2000+ btc order ready to be gobbled up by the panicking market sellers.

Using this info could we not predict the next DDOS attack and sell early, in preparation for re-entering at a lower point?  If we notice evenly spaced out orders for thousands of btc well below the current trading level (for example, orders for 2000 btc at 100,110,120,130 when it's currently trading at 220) we can assume a DDOS is imminent.

Thoughts?



astute observation. Thank im sure someone will note this and thanks for potentially saving us all millions.


Title: Re: Today's DDOS / MT.GOX manipulation observation
Post by: keatonatron on April 11, 2013, 02:15:48 AM
I am also curious to explore the suspicion of deliberate DoS attacks versus automated buy/sell systems bugging out/using poor programming/reacting unsupervised.

Once I had a mistake in my programming that uses the Mt. Gox API, and the next time I logged into my account I had 70+ pages of buy requests all stating "insufficient funds"  :P

Mt. Gox is supposed to change things so they won't accept orders bigger than your account can fund, which should prevent what I just mentioned from happening, but that wouldn't have prevented my program from sending 70 pages of sell requests that Mt. Gox servers would have to filter through.

I don't think lil' ol' me could cause many problems for Mt. Gox, but if there was something similar going on with many people at once, I could see how the Gox servers could get bogged down with well-intentioned yet erroneous requests.


Title: Re: Today's DDOS / MT.GOX manipulation observation
Post by: TheHalfWit on April 11, 2013, 02:18:47 AM
I wonder if MTGOX will take steps to prevent this kind of gaming in the future.


Title: Re: Today's DDOS / MT.GOX manipulation observation
Post by: enter`name`here on April 11, 2013, 02:25:36 AM
Little doubt this was orchestrated, massive lag on gox combined with the main chart sites and the forms going down, hmmm....

I trade on a smaller exchange so the lag didnt affect me too much but I felt blind without my charts :(.


Title: Re: Today's DDOS / MT.GOX manipulation observation
Post by: hlynur on April 11, 2013, 02:39:12 AM
Hello there,
it's my first post so please no bashing for some dumb newbie questioning.
I'm relatively fresh to bitcoins, started watching the market for 2 months and went in three weeks ago.
And damn was it a rollercoaster ride until right now!
Just have to state that I'm not in the game because of quick wins with speculation but for longterm investment, since the pensionsystem in germany is going down the drain
and I have some deep faith in the system of bitcoin as a resource (as which I see it now) and hopefully someday a real everyday currency.
but I should get to the point:

so I'm watching the mt. gox chart right now being manipulated by some bots for nearly three hours
and I'm amused by the line crawling up and down like a caterpillar in search of the next branch.
Fortunately I read the forums (thanks for all the information here and the relaxed behaviour with such attacks) and I'm holding strong to my few coins (first thing I learned  8)).
There's one thing I simply don't understand:

Why do the guys at mt. gox not just simply pull the plug, shut down their market
and take some time for figuring out what to do about it?

The longer this goes on the more the market is disturbed by this stuff. (or is it self regulatory and by the next morning everything's okay again)


Title: Re: Today's DDOS / MT.GOX manipulation observation
Post by: brendm on April 11, 2013, 03:07:22 AM
That's an interesting observation, dhenson.  I definitely had the feeling that the crash today was orchestrated and manipulated, and since it appears to have been successful, once can only expect that there will be more of them.

What I would prefer to see happen is to have the tier 1 internet providers push down rules to requiring the adoption of source IP address verification and disabling of recursive DNS from non-trusted addresses to solve the largest DDoS attacks from happening.  It's long been known how to stop DDoS amplication attacks from happening, so it would be helpful to have the loopholes closed down through the hierarchy of service providers - especially in the US where the most open recursive DNS servers are located.  Markets will always be manipulated, and bots are allowed on stock and fiat currency exchanges so it would be odd - and particularly ironic given the roots of Bitcoins - to disallow their (ie. "pull the plug") on their use in bitcoin exchanges.

Also, it would be really helpful for Bitcoins on the whole that there would be more competition in the exchanges. Or we need our one major exchange to do a better job. I read in the MtGox blog that people don't understand how hard what they are doing is... and that's probably true, but they need to step up their game, and if that costs too much then they need to raise fees to raise money to step up their game. A queue of 19000 people for verification and trade latencies of over an hour isn't going to cut it. So much hinges on MtGox either being a highly effective exchange, or else MtGox having lots of competition. If we keep on course where there is one major exchange that is overwhelmed, then the momentum that BTC has as an alternative international currency will decrease.

We also need exchanges that can reduce volatility by allowing short-selling - people who short currencies (or stocks) have a bad reputation, but they do help substantially with volatility by creating sales during run-ups. Pretty much everyone who has been around currencies (and commodities and stocks) for a while can spot a bubble, and people shorting (or borrowing a currency in order to sell it) counter-act price increases with increasing price sales. Short selling doesn't solve the problem of bubbles, but it definitely helps with decreasing volatility. Until there are some tools for allowing shorting, we will continue to see dramatic BTC <-> fiat currency volatility


Title: Re: Today's DDOS / MT.GOX manipulation observation
Post by: hlynur on April 11, 2013, 03:29:36 AM
sorry for copy and paste from the senior forums, but just wanted to throw in this statement with impressing numbers from mt. gox facebook page (35 min ago):
https://www.facebook.com/MtGox
Quote
Hi everyone, just a quick update on the situation and what happened last night.

First of all we would like to reassure you but no we were not last night victim of a DDoS but instead victim of our own success!

Indeed the rather astonishing amount of new account opened in the last few days added to the existing one plus the number of trade made a huge impact on the overall system that started to lag. As expected in such situation people started to panic, started to sell Bitcoin in mass (Panic Sale) resulting in an increase of trade that ultimately froze the trade engine!

To give you an idea of how impressive things were here are some numbers that we would love to share with you guys:
- The number of trades executed triple in the last 24hrs.
- The number of new account opened went from 60k for March alone to 75k new account created for the first few days of April! We now have roughly 20,000 new accounts created each day.

Due to these facts we have been busy working on improving things since last week and our team has been working around the clock to improve Mt.Gox to catch up with the demand. We will continue to release several updates today and in the coming few days to improve our system overall performance.

Also please note that we may have to close the exchange for two hours in the next 12 to 24hrs to add several new servers to our system.

Thank you for your understanding and continuous support!

I'm curious about the coming months with 75k traders throwing their money on the market, in combination with the big impact on the media and the current situation in europe.
(Slowenia seems to be the next shaky candidate and cyprus perhaps have to sell their gold reserves)  
looks like the rough times have just begun.


Title: Re: Today's DDOS / MT.GOX manipulation observation
Post by: tumak on April 11, 2013, 03:32:27 AM
https://i.imgur.com/cwYjgev.png


Title: Re: Today's DDOS / MT.GOX manipulation observation
Post by: Numberless on April 11, 2013, 03:35:04 AM
sorry for copy and paste from the senior forums, but just wanted to throw in this statement with impressing numbers from mt. gox facebook page (35 min ago):
https://www.facebook.com/MtGox
Quote
Hi everyone, just a quick update on the situation and what happened last night.

First of all we would like to reassure you but no we were not last night victim of a DDoS but instead victim of our own success!

Indeed the rather astonishing amount of new account opened in the last few days added to the existing one plus the number of trade made a huge impact on the overall system that started to lag. As expected in such situation people started to panic, started to sell Bitcoin in mass (Panic Sale) resulting in an increase of trade that ultimately froze the trade engine!

To give you an idea of how impressive things were here are some numbers that we would love to share with you guys:
- The number of trades executed triple in the last 24hrs.
- The number of new account opened went from 60k for March alone to 75k new account created for the first few days of April! We now have roughly 20,000 new accounts created each day.

Due to these facts we have been busy working on improving things since last week and our team has been working around the clock to improve Mt.Gox to catch up with the demand. We will continue to release several updates today and in the coming few days to improve our system overall performance.

Also please note that we may have to close the exchange for two hours in the next 12 to 24hrs to add several new servers to our system.

Thank you for your understanding and continuous support!

I'm curious about the coming months with 75k traders throwing their money on the market, in combination with the big impact on the media and the current situation in europe.
(Slowenia seems to be the next shaky candidate and cyprus perhaps have to sell their gold reserves) 
looks like the rough times have just begun.

Thanks for pointing this out, it might have slipped past me otherwise.  When I first read that I thought they said they were going to be closing for 12 to 24 hours lol.  Then again with how well the service was functioning the past day, they may as well have been closed that long. 


Title: Re: Today's DDOS / MT.GOX manipulation observation
Post by: zwizzle on April 11, 2013, 04:14:06 AM
Some very intuitive and forward thinking going on here, love it.


Title: Re: Today's DDOS / MT.GOX manipulation observation
Post by: bohanz on April 11, 2013, 04:35:38 AM
Mt.Gox's post still doesn't explain the large buys. Good observation OP


Title: Re: Today's DDOS / MT.GOX manipulation observation
Post by: keatonatron on April 11, 2013, 05:13:04 AM
Mt.Gox's post still doesn't explain the large buys. Good observation OP

Probably just people preparing for the worst. Also, exact multiples of 10 is a logical price point, so it's natural that many people's bids will congregate at all the 10's and 20's.

If I were to think up a quick-and-easy price point to use as a "just in case" bid order, I'd just go with something like $120. So would a lot of other people. Only a crazy person would go with something random like $127.28315  ;D


Title: Re: Today's DDOS / MT.GOX manipulation observation
Post by: hlynur on April 11, 2013, 05:20:00 AM
I try to imagine this number. 75k accounts in 1 1/2 months and the following consequences.
The rise of created accounts is nearly the same as the exponential price gain of bitcoin in the last weeks.
(despite the drop today)

I'm really stunned by the way this whole experiment is gathering (i still see it as that, because imo the "real" big players are still not in the game and that time will come sooner than later)

I can't wait for the future of bitcoin and what (senseless?) attempts the governments and financial regulators will start to put it behind bars.
The comparison is perhaps kind of naive (i'm just a cgi artist, programming is not really my strength)
but if they really try to ban bitcoin with laws, is it possible to handle the bitcoin system in the same way the piratebay is secured?

Because the only other possibilities would point straight towards a kind of "regulated" (as said if that is even possible) sideway currency integrated into the existing market or bitcoins could only be traded via tax havens (which is perhaps kind of logical because in europe there's a beginning chase for tax refugees and these countries already are the shelter for most betting companies for example).

Perhaps i miss the point or I'm wildly speculating right now after my third cup of tea and 4th cigarette  ;D
but it could be that with the ongoing obsolescence of fiat money, tax refugees really start turning to bitcoins in the future (only as the price rises. right now bitcoins are not the best possibility to transfer such large amounts of money). For tax havens it's much more easier to get some servers running and trading bitcoins instead of doing the old phantom company style and trying to blur the money flow.

...it's kind of sad in a way but bitcoin could become more and more attractive for tax refugees in combination as a eventually side playground beneath existing stock exchange for exactly those speculating assholes who were the reason in the beginning that bitcoin emerged...
(otherwise these pricks could have greater interests in bitcoin as a nonspeculative currency because it's not fluctuating. Perhaps that evolves to a possibility for the little man to finally outwit them and profit on their destructive behaviour towards the society)

oh bitcoin where will your future lay....

it's funny that every bigger step of humanity has always these two faces of a coin in its ecosystem.

but compared to the developement of the internet as it is today in times of partially senseless overregulation in fear of probably pushing the next possible revolutions at a certain point like during the Arab spring, I'm confident that somehow the whole idea will find its way over the centuries.
(It always has! And perhaps no matter what kind of money is put into bitcoin in the future, the more the better.
It's goldrushtime and I hope that hype can regulate itself over the years with a following prosperity for everyone)

uh kind of went off- topic on this one  ::), sorry for that and eventual grammatical disasters, don't bash me, I'm just a fascinated overslept excited newbie starting to get into the think tank (perhaps some operator put my post in a "mysterious future monologue"-thread)

.....where were we

ah... ;)

back to mt. gox


Title: Re: Today's DDOS / MT.GOX manipulation observation
Post by: dhenson on April 11, 2013, 06:12:57 AM
Mt.Gox's post still doesn't explain the large buys. Good observation OP

Probably just people preparing for the worst. Also, exact multiples of 10 is a logical price point, so it's natural that many people's bids will congregate at all the 10's and 20's.

If I were to think up a quick-and-easy price point to use as a "just in case" bid order, I'd just go with something like $120. So would a lot of other people. Only a crazy person would go with something random like $127.28315  ;D

What I'm trying to point out isn't the exact price point of each buy order, rather the fact that such large orders were made ahead of the crash.  We're talking about someone (or multiple someone's) with MILLIONS of dollars in ridiculously low buy orders.  If someone seriously had that kind of cash sitting in a mtgox account, don't you think they would have already bought to ride the crazy wave that was currently occurring?

I'm not saying it's proof... but it definitely points to forewarning.  If mtgox is now claiming that a DDOS did not occur, then one would have to speculate that that insider manipulation could have been in play.  I mean, how hard would it be for an IT guy or someone with access to mtgox hardware to make a small tweak to negatively effect trading?

All I'm really saying is pay attention to those home run ridiculously low buy orders... when they start popping up, you may want to get ready for a quick sell.


Title: Re: Today's DDOS / MT.GOX manipulation observation
Post by: rezurect on April 11, 2013, 06:44:30 AM
I believe, like every other currency on Forex, some amount of manipulation of prices is possible. To what extent, depends on the size of the Player. Most of us might be too small , to drive the market individually but a really large player could easily drive prices up buying if his purse runs in in 10 of millions. I`m pretty sure a lot of investment guys might have hopped on to BTC to make a quick buck.


Title: Re: Today's DDOS / MT.GOX manipulation observation
Post by: joemmm on April 11, 2013, 07:23:49 AM
Wut, you always leave big some breaking orders way below current going rate.. Those orders were already there.


Title: Re: Today's DDOS / MT.GOX manipulation observation
Post by: ex-trader on April 11, 2013, 07:53:31 AM

If all this was caused by only their trading system lag, then why did other exchanges all go offline at the same time as well as the forum here being overloaded. Either the entire Bitcoin ecosystem is built using Intel 286s, or there's a little more to this than than meets the eye.


Title: Re: Today's DDOS / MT.GOX manipulation observation
Post by: shamntalk on April 11, 2013, 07:56:09 AM
Oh please not that again. Mtgox have confirmed they was no DDOS. They just can't scale their operations. They aren't sorry either. https://mtgox.com/press_release_20130411.html
Repeat after me: there was no ddos, and no conspiracy to crash btc. People panic sold, that's all.


Title: Re: Today's DDOS / MT.GOX manipulation observation
Post by: wordofmouth on April 11, 2013, 09:22:41 AM
^^ they have NOT been ddos attacked...and the rate lost 100USD !


Mtgox is offline btw


Title: Re: Today's DDOS / MT.GOX manipulation observation
Post by: ccl on April 11, 2013, 09:24:19 AM
Oh please not that again. Mtgox have confirmed they was no DDOS. They just can't scale their operations. They aren't sorry either. https://mtgox.com/press_release_20130411.html
Repeat after me: there was no ddos, and no conspiracy to crash btc. People panic sold, that's all.

Confirmed no DDOS: https://bitcointalk.org/index.php?topic=172991.msg1801862;topicseen#msg1801862


Title: Re: Today's DDOS / MT.GOX manipulation observation
Post by: Jennsky on April 11, 2013, 10:28:29 AM
If you watch the 0.02s, and there are many of them, they are coming from HFTs (High Frequency Traders) pushing the price up, up, up and they sell sell sell, using the 0.02s to drive the price to lows and then buy, buy, buy.
Watch the activity with the 0.02 orders. You can see it happening.

I suppose the exchanges could limit the number of trades allowed per second/minute. But the HFTs might go elsewhere... causing the problem on other exchanges. Does MtGox lose money if that happens, or would it restore confidence to its users.

Or should we look into becoming HFTs ourselves and ignore the bright future bitcoin could have as a currency and trash it like a used toy for some greedy profit taking today.

Just wondering.


Title: Re: Today's DDOS / MT.GOX manipulation observation
Post by: oda.krell on April 11, 2013, 02:49:26 PM
(can I post here already? not sure. guess I'll find out in a second.)

Here's what I posted a few moments ago on a related thread on reddit:

Assuming spamming of micro transactions was in fact the reason for the crash (that, and of course herd animal behavior of panicked traders), shouldn't this be easily solvable?

One solution would be to demand a small fixed fee for each transaction, making it more costly for spammers to perform such an attack.

Or alternatively, and perhaps a bit more elegant would be implementing an algorithm that evaluates, based on a traders current behavior, this trader's "spam potential". Based on a few simple heuristics (number of orders per hour of that trader, average size of orders) the algorithm assigns each trader some numerical value that expresses how much like a "spammer" the trader behaves. Then, if the trading system starts suffering from lags, each trader whose "spam potential" number has reached a certain threshold will see his ability to buy/sell throttled (but the effect wears off over time).

Wouldn't that stop the problem immediately, at almost no cost (there would be the occasional false positive with the spam filter, but that's a small price to pay I think). Why doesn't mtgox implement such a trivial solution? What do they have to gain from having their trading book flooded with useless spam? And I also simply don't see what they possibly could gain from allowing such an easy way to manipulate the market.


Title: Re: Today's DDOS / MT.GOX manipulation observation
Post by: tumak on April 12, 2013, 03:19:18 AM
https://i.imgur.com/HaEmtdq.png

AKA: Lag/DDOS no longer to blame.


Title: Re: Today's DDOS / MT.GOX manipulation observation
Post by: theprofileth on April 12, 2013, 03:27:08 AM
Guys you know that panic selling caused the massive windfall right? You are literally talking metagame about panic selling...


Title: Re: Today's DDOS / MT.GOX manipulation observation
Post by: mehransaam on April 12, 2013, 03:42:14 AM
Anyone know how many posts aere required to post in the forums?

5 posts or replies, and Total time logged in 4 hours.