MTGOX hits $570 "A bug in the bitcoin software makes it possible for someone to"

[btcmad1337]

Show me why other exchanges do not have this problem with withdrawals but ONLY MTGOX?

Remember MTGOX is using a custom version of the bitcoin software. This is likely the reason they have issues with their exchange platform.

Because the attack involves mining your own block, hence requires lots of hash power so is difficult to execute unless you've got stacks of hashpower. It may also be noticed by a smaller exchange when they noticed their balance is much lower than it should be. A couple hundred BTC missing from Mt Gox wouldn't go noticed, it would go noticed from cryptsy.

They will most likely try to execute this attack on other exchanges unless the devs push a fix fast which they are working on right now.

[oda.krell]

Gox is willing to damage the reputation of the *entire* Bitcoin ecosystem, so *they* don't have to take the blame for not implementing their wallet software properly.

Have any of you actually looked at this flaw?

It's been a known flaw for a while, here is the fix:
https://gist.github.com/sipa/8907691

Find me one Bitcoin wallet software that has this fixed as of right now and I will pay you 1BTC. HINT: there are none.

Reading comprehension isn't your strong side, huh?

<gmaxwell> Oh there is a “problem” in the Bitcoin protocol, known since at least 2011 (see the link I gave). But for normal applications, not involving unconfirmed transactions, it shouldn’t cause any severe problems because wallets can handle it locally.

Don't blame on the protocol what can be contained locally.


@Blitz

I don't share your cynicism on this one. I'm not "butthurt" the slightest, in fact, I profited nicely of this swing. But mtgox *is* in a very real sense a major factor in limiting usefulness and reliability of BTC as a whole. It would benefit everyone if they were taken out of the equation.

[Teodor]

MTgox should be completely ignored...

I don't think so, as others are following and also dropping... people get scared and sell so the price drops... we'll see what's next in the market.

[Ekaros]

Show me why other exchanges do not have this problem with withdrawals but ONLY MTGOX?

Remember MTGOX is using a custom version of the bitcoin software. This is likely the reason they have issues with their exchange platform.

Because the attack involves mining your own block, hence requires lots of hash power so is difficult to execute unless you've got stacks of hashpower. It may also be noticed by a smaller exchange when they noticed their balance is much lower than it should be. A couple hundred BTC missing from Mt Gox wouldn't go noticed, it would go noticed from cryptsy.

They will most likely try to execute this attack on other exchanges unless the devs push a fix fast which they are working on right now.

Who wants to keep their wealth on service that doesn't exactly track their funds or audit them regularly?

[btcmad1337]

Don't blame on the protocol what can be contained locally.

So your saying we should ignore all the bitcoind API documentation which tracks by txid and everyone should be responsible for making their own systems for tracking payments?

Reading comprehension isn't your strong side, huh?

Please find me a wallet that prevents the transaction ID from being modified in-transit. Thats all I said. There are none so if your tracking payment by transaction ID's which is something almost everyone does then your vulnerable.

[mmortal03]

"MtGox will resume bitcoin withdrawals to outside wallets once the issue outlined above has been properly addressed in a manner that will best serve our customers."

Put another way: We will hold all our customers' bitcoins hostage, to save ourselves from an alleged potential few who might scam us, until the community does what we please -- and we will do this even though there is probably another way for us work around the problem in the near term. Also, we don't care about spreading fear and crashing the price in the meantime by coming out with a press release that fixes nothing; come on, now, why would we want to work behind the scenes with the devs until a solution is developed and THEN put out a release?

[seriouscoin]

Don't blame on the protocol what can be contained locally.

So your saying we should ignore all the bitcoind API documentation which tracks by txid and everyone should be responsible for making their own systems for tracking payments?

Reading comprehension isn't your strong side, huh?

Please find me a wallet that prevents the transaction ID from being modified in-transit. Thats all I said. There are none so if your tracking payment by transaction ID's which is something almost everyone does then your vulnerable.

Any bitcoin-QT since 2012 idiot.

[btcmad1337]

Any bitcoin-QT since 2012 idiot.

Nope wrong. There are none. If you can find one thats available right now I'll pay you 1BTC. I'm putting my money where my mouth is.

[btcmad1337]

Who wants to keep their wealth on service that doesn't exactly track their funds or audit them regularly?

The whole point of Bitcoin is so you can take control of your own money and can transact without having to trust third parties.

Why did you give your money to to Gox? should have kept it in your wallet

[oda.krell]

Reading comprehension isn't your strong side, huh?

Please find me a wallet that prevents the transaction ID from being modified in-transit. Thats all I said. There are none so if your tracking payment by transaction ID's which is something almost everyone does then your vulnerable.

You're technically correct on that point. But it's only one exchange, mtgox, that allowed this limitation to grow unchecked into a major problem, you agree? The problem is removed if only sufficiently* confirmed transactions are accepted. (* I'll admit I don't know how deep into the chain they need to be before the risk is neutralized)


EDIT: I'll admit, I reacted unfairly to your first post on this. You did, in fact, only point out it a real flaw. But maybe you can see that this thread is about discussing mtgox' responsibilities. And they *are* fully responsible for not locally adressing and containing a know flaw. That's the basic point I would make here.

[btcmad1337]

You're technically correct on that point. But it's only one exchange, mtgox, that allowed this limitation to grow unchecked into a major problem, you agree? The problem is removed if only sufficiently* confirmed transactions are accepted. (* I'll admit I don't know how deep into the chain they need to be before the risk is neutralized)

Your misunderstanding here is how it works

I deposit money into gox and withdraw it

mtgox sends it to my address and it get transaction ID A

I mine a block and include the transaction in my block, but as the miner I can CHANGE THE TRANSACTION ID TO B.

I then tell MtGox staff that transaction A didn't confirm. They check it and they see transaction A was rejected and will never confirm but what they don't realize is it was just changed to transaction B by me, so they resend the transaction.



Profit.

[Ekaros]

You're technically correct on that point. But it's only one exchange, mtgox, that allowed this limitation to grow unchecked into a major problem, you agree? The problem is removed if only sufficiently* confirmed transactions are accepted. (* I'll admit I don't know how deep into the chain they need to be before the risk is neutralized)

Your misunderstanding here is how it works

I deposit money into gox and withdraw it

mtgox sends it to my address and it get transaction ID A

I mine a block and include the transaction in my block, but as the miner I can CHANGE THE TRANSACTION ID TO B.

I then tell MtGox staff that transaction A didn't confirm. They check it and they see transaction A was rejected on the blockchain but what they don't realize is it was just changed to transaction B by me, so they resend the transaction.



Profit.

And no one knows how long it took for them to notice that numbers don't quite line up in their balance sheet...

[btcmad1337]

And no one knows how long it took for them to notice that numbers don't quite line up in their balance sheet...

no one knows how much was stolen. It's quite difficult to noticed 10BTC missing out of hundreds of thousands. You could easily write that off as a mistake. That could be extra transaction fees that accumulated.

But the thing I will say is once this attack was executed it would be very obvious what has happened because when Gox tries to spend the change those transactions won't work etc etc.

[oda.krell]

You're technically correct on that point. But it's only one exchange, mtgox, that allowed this limitation to grow unchecked into a major problem, you agree? The problem is removed if only sufficiently* confirmed transactions are accepted. (* I'll admit I don't know how deep into the chain they need to be before the risk is neutralized)

Your misunderstanding here is how it works

I deposit money into gox and withdraw it

mtgox sends it to my address and it get transaction ID A

I mine a block and include the transaction in my block, but as the miner I can CHANGE THE TRANSACTION ID TO B.

I then tell MtGox staff that transaction A didn't confirm. They check it and they see transaction A was rejected and will never confirm but what they don't realize is it was just changed to transaction B by me, so they resend the transaction.



Profit.

I'm not a dev, so I can be corrected on this one, but to my understanding the solution is for mtgox to check their outputs and keep track of them, before deciding to trust the claim and resend the tx.

[VanillaHeaven]

MTgox should be completely ignored...

It's not their fault bitcoin is broke... 

But it's their fault they spread FUD about something that's not true. It's not BTC that is the problem, it's Mtgox internal system.
http://www.cryptocoinsnews.com/2014/02/10/mt-gox-blames-bitcoin-core-developer-greg-maxwell-responds/

I trust Maxwell more than I trust Mtgox.

[Asrael999]

You're technically correct on that point. But it's only one exchange, mtgox, that allowed this limitation to grow unchecked into a major problem, you agree? The problem is removed if only sufficiently* confirmed transactions are accepted. (* I'll admit I don't know how deep into the chain they need to be before the risk is neutralized)

Your misunderstanding here is how it works

I deposit money into gox and withdraw it

mtgox sends it to my address and it get transaction ID A

I mine a block and include the transaction in my block, but as the miner I can CHANGE THE TRANSACTION ID TO B.

I then tell MtGox staff that transaction A didn't confirm. They check it and they see transaction A was rejected and will never confirm but what they don't realize is it was just changed to transaction B by me, so they resend the transaction.



Profit.

and they don't notice that they have paid another "unauthorised" transaction? Transaction ID B will still show as a payment by them - and they will not know why they made that payment (by unauthorised I mean a transaction without a corresponding withdrawl request on their system). If they are not running a double check on every outgoing transaction to ensure against employees quietly defrauding them if nothing else, then they deserve to fail.

[mmortal03]

...

I then tell MtGox staff that transaction A didn't confirm. They check it and they see transaction A was rejected and will never confirm but what they don't realize is it was just changed to transaction B by me, so they resend the transaction.



Profit.

Can they not just go back to such conversations with people that claimed this, and then figure out who was scamming them? Is there some sort of plausible deniability here for the scammer in this method that I'm missing, or not?

[ehoffman]

I would have said that Gox is dead, especially in light of spreading this FUD...  But then again, I'm sure we'll still find morons going back to it and maintaining it...  As there's still morons who went back to 50BTC after doing this same exact sh!t...

[Ekaros]

...

I then tell MtGox staff that transaction A didn't confirm. They check it and they see transaction A was rejected and will never confirm but what they don't realize is it was just changed to transaction B by me, so they resend the transaction.



Profit.

Can they not just go back to such conversations with people that claimed this, and then figure out who was scamming them? Is there some sort of plausible deniability here for the scammer in this method that I'm missing, or not?

They should know who got extra coins out, but if they cleared their account there isn't much to do. There is even possibility they didn't provide real ID...

[Boxman90]

They worded this pretty nicely, I must say. Let me bold up the proper translation:

MtGox language: "A bug in the Bitcoin software"

Proper English: "A bug in OUR Bitcoin software."

That is all there is to this. Thanks for panicing on the other exchanges.