How big of a deal are these mining system exploiters?

[Marlo Stanfield]

https://bitcointalk.org/?topic=441465.msg7282674#msg7282674

How big of a flaw is this? What can be done about this?

Between this and Ghash.io being 50% at this point(could this even be another attack by Ghash?), are we looking at the biggest technical threat to bitcoin since the hard fork?

[1715355679]

1715355679

[1715355679]

1715355679

[1715355679]

1715355679

[1715355679]

1715355679

[1715355679]

1715355679

[1715355679]

1715355679

[ajareselde]

https://bitcointalk.org/?topic=441465.msg7282674#msg7282674

How big of a flaw is this? What can be done about this?

Between this and Ghash.io being 50% at this point(could this even be another attack by Ghash?), are we looking at the biggest technical threat to bitcoin since the hard fork?

like i allready said somewhere, ghash.io just needs to place another server, to reduce the load, and everything will be fine.
they can also keep the hashrate, it doesnt matter if they have it spread out across their servers.

[franky1]

https://bitcointalk.org/?topic=441465.msg7282674#msg7282674

How big of a flaw is this? What can be done about this?

Between this and Ghash.io being 50% at this point(could this even be another attack by Ghash?), are we looking at the biggest technical threat to bitcoin since the hard fork?

like i allready said somewhere, ghash.io just needs to place another server, to reduce the load, and everything will be fine.
they can also keep the hashrate, it doesnt matter if they have it spread out across their servers.

that wont work

because they still have their same code. even spread over 1000000 servers if all servers have code that says reward=200btc. and it gets mined. due to the fact that 51% of miners combined say that 200 coins is acceptable. then it gets accepted.

i said months ago, you dont ned to spend multiple millions to buy enough ASICS to get 51% of the network. you just need either to own a pool and have atleast 51% of the community join you. or bribe several pools/servers which would equate to 51% to agree to use your code

[ljudotina]

https://bitcointalk.org/?topic=441465.msg7282674#msg7282674

How big of a flaw is this? What can be done about this?

Between this and Ghash.io being 50% at this point(could this even be another attack by Ghash?), are we looking at the biggest technical threat to bitcoin since the hard fork?

like i allready said somewhere, ghash.io just needs to place another server, to reduce the load, and everything will be fine.
they can also keep the hashrate, it doesnt matter if they have it spread out across their servers.

that wont work

because they still have their same code. even spread over 1000000 servers if all servers have code that says reward=200btc. and it gets mined. due to the fact that 51% of miners combined say that 200 coins is acceptable. then it gets accepted.

i said months ago, you dont ned to spend multiple millions to buy enough ASICS to get 51% of the network. you just need either to own a pool and have atleast 51% of the community join you. or bribe several pools/servers which would equate to 51% to agree to use your code

Pools mean rats ass if there are no miners in them. If change is not good for miners too, they will just leave that pool and join another.

[DannyHamilton]

that wont work

because they still have their same code. even spread over 1000000 servers if all servers have code that says reward=200btc. and it gets mined. due to the fact that 51% of miners combined say that 200 coins is acceptable. then it gets accepted.

Accepted by whom?

Why would anybody's client accept such a block?

How is it any different than if they do the same thing with 10% of the mining power (or 90%)?

[DeathAndTaxes]

because they still have their same code. even spread over 1000000 servers if all servers have code that says reward=200btc. and it gets mined. due to the fact that 51% of miners combined say that 200 coins is acceptable. then it gets accepted.

An invalid block is still invalid no matter who mined it.  Bitcoin clients follow the longest VALID chain.

[Marlo Stanfield]

I'm not sure how these replies relate to the theft of shares from the link I posted. How does Ghash have anything to do with it (other than me throwing my speculative question related to their involvement)?

The 51% thing is a big deal but I wanted to talk about the fact that there seems to be a critical flaw with the way mining pools currently work that people can exploit(not >50% attacks, read my original link). The 200-300 BTC that the pool lost is a lot. What really makes me worry is that people can do it on p2pool and no one can stop them as far as I can tell. And we want people using p2pool but no one is going to want to if it's being exploited.

[gweedo]

This is only a big deal to the mining pools because it is someone robbing them and there users of money.

[windpath]

I'm not sure how these replies relate to the theft of shares from the link I posted. How does Ghash have anything to do with it (other than me throwing my speculative question related to their involvement)?

The 51% thing is a big deal but I wanted to talk about the fact that there seems to be a critical flaw with the way mining pools currently work that people can exploit(not >50% attacks, read my original link). The 200-300 BTC that the pool lost is a lot. What really makes me worry is that people can do it on p2pool and no one can stop them as far as I can tell. And we want people using p2pool but no one is going to want to if it's being exploited.

This is not a sensible attack on p2pool, the only way to do it would be to withhold a p2pool share that would currently solve a block, the withholding party would NOT get the block reward, but neither would the pool, on p2pool it would essentially just be throwing away the block solution and no one would benefit...

[DeathAndTaxes]

I'm not sure how these replies relate to the theft of shares from the link I posted. How does Ghash have anything to do with it (other than me throwing my speculative question related to their involvement)?

The 51% thing is a big deal but I wanted to talk about the fact that there seems to be a critical flaw with the way mining pools currently work that people can exploit(not >50% attacks, read my original link). The 200-300 BTC that the pool lost is a lot. What really makes me worry is that people can do it on p2pool and no one can stop them as far as I can tell. And we want people using p2pool but no one is going to want to if it's being exploited.

This is not a sensible attack on p2pool, the only way to do it would be to withhold a p2pool share that would currently solve a block, the withholding party would NOT get the block reward, but neither would the pool, on p2pool it would essentially just be throwing away the block solution and no one would benefit...

That is no different than any other pool.  The point of the attack is to pay a little to hurt the pool more.  If an attacker makes up 10% of the pool they can take a 10% reduction in mining income to make the pool look horrible (consistent 10% or worse "bad luck").  This would drive miners into "luckier" pools and possibly kill the pool off completely.  So rhetorical question, who directly benefits if a smaller pool (to include p2pool) is wiped out?

[Este Nuno]

I'm not sure how these replies relate to the theft of shares from the link I posted. How does Ghash have anything to do with it (other than me throwing my speculative question related to their involvement)?

The 51% thing is a big deal but I wanted to talk about the fact that there seems to be a critical flaw with the way mining pools currently work that people can exploit(not >50% attacks, read my original link). The 200-300 BTC that the pool lost is a lot. What really makes me worry is that people can do it on p2pool and no one can stop them as far as I can tell. And we want people using p2pool but no one is going to want to if it's being exploited.

This is not a sensible attack on p2pool, the only way to do it would be to withhold a p2pool share that would currently solve a block, the withholding party would NOT get the block reward, but neither would the pool, on p2pool it would essentially just be throwing away the block solution and no one would benefit...

That is no different than any other pool.  The point of the attack is to pay a little to hurt the pool more.  If an attacker makes up 10% of the pool they can take a 10% reduction in mining income to make the pool look horrible (consistent 10% or worse "bad luck").  This would drive miners into "luckier" pools and possibly kill the pool off completely.  So rhetorical question, who directly benefits if a smaller pool (to include p2pool) is wiped out?

At least with Ghash they can't really gain much any longer from people moving to their pool at this point since they've already breached 50%. I mean they could, but at this point I have to assume they're not stupid enough to continue pushing their numbers in to the 50s. At least publicly.

Perhaps they did this before and it has paid off for them in the form of more people going to their pool. And now we're seeing these record numbers partially as a result of this attack? Maybe it worked too well?

[jjc326]

https://bitcointalk.org/?topic=441465.msg7282674#msg7282674

How big of a flaw is this? What can be done about this?

Between this and Ghash.io being 50% at this point(could this even be another attack by Ghash?), are we looking at the biggest technical threat to bitcoin since the hard fork?

like i allready said somewhere, ghash.io just needs to place another server, to reduce the load, and everything will be fine.
they can also keep the hashrate, it doesnt matter if they have it spread out across their servers.

that wont work

because they still have their same code. even spread over 1000000 servers if all servers have code that says reward=200btc. and it gets mined. due to the fact that 51% of miners combined say that 200 coins is acceptable. then it gets accepted.

i said months ago, you dont ned to spend multiple millions to buy enough ASICS to get 51% of the network. you just need either to own a pool and have atleast 51% of the community join you. or bribe several pools/servers which would equate to 51% to agree to use your code

Exactly.  I totally agree. I think Bitcoin could get taken down fairly easily for a small amount of money.  That is the reason this needs to be addressed if we really want Bitcoin to become widely accepted.  I mean, a terrorist organization would easily pay $100 million to take downt he US financial system (if it was Bitcoin mean) 

[Jason]

At least with Ghash they can't really gain much any longer from people moving to their pool at this point since they've already breached 50%. I mean they could, but at this point I have to assume they're not stupid enough to continue pushing their numbers in to the 50s. At least publicly.

Perhaps they did this before and it has paid off for them in the form of more people going to their pool. And now we're seeing these record numbers partially as a result of this attack? Maybe it worked too well?

What about something like this:

Here's another potentially likely GHash scenario:

• GHash sells most of its available bitcoins for fiat
• GHash achieves 51+% on purpose knowing it will trigger a selloff
• GHash buys back the bitcoins at a greatly reduced price
• GHash points its miners to other pools to alleviate the threat
• Bitcoin price rises again and GHash realizes a large profit from market manipulation

This seems like a low-risk strategy, generates a tidy profit for GHash, and can probably be done several times before the community catches on so long as they wait long enough between runups.

If you believe that they are so beneficent that they would never try anything like this, then perhaps you'd like to buy some shares I have in the Golden Gate bridge for sale?

In fact, when they point their own miners at other pools, they could (as you suggest) even be employing block withholding attacks to induce miners there to switch pools when the miners notice the luck is running below average or to force the pool operators to raise their rates in the case of PPS pools.

[millsdmb]

Check out this too. http://www.reddit.com/r/Bitcoin/comments/282z7a/im_selfish_mining_at_ghashio/

Hello, I control somewhere between 50 TH/s and 2 PH/s(can't be too specific for security reasons) of hashing power. Today, I have been pointing some of this at Ghash.IO, and selfish mining to hinder their profits. I withhold blocks I find, and do not send them. I encourage others to do the same(towards Ghash.IO), to destroy this pool that is deliberately trying to harm Bitcoin.
Thanks.

[Marlo Stanfield]

At least with Ghash they can't really gain much any longer from people moving to their pool at this point since they've already breached 50%. I mean they could, but at this point I have to assume they're not stupid enough to continue pushing their numbers in to the 50s. At least publicly.

Perhaps they did this before and it has paid off for them in the form of more people going to their pool. And now we're seeing these record numbers partially as a result of this attack? Maybe it worked too well?

What about something like this:

Here's another potentially likely GHash scenario:

• GHash sells most of its available bitcoins for fiat
• GHash achieves 51+% on purpose knowing it will trigger a selloff
• GHash buys back the bitcoins at a greatly reduced price
• GHash points its miners to other pools to alleviate the threat
• Bitcoin price rises again and GHash realizes a large profit from market manipulation

This seems like a low-risk strategy, generates a tidy profit for GHash, and can probably be done several times before the community catches on so long as they wait long enough between runups.

If you believe that they are so beneficent that they would never try anything like this, then perhaps you'd like to buy some shares I have in the Golden Gate bridge for sale?

In fact, when they point their own miners at other pools, they could (as you suggest) even be employing block withholding attacks to induce miners there to switch pools when the miners notice the luck is running below average or to force the pool operators to raise their rates in the case of PPS pools.

They definitely could be doing this. Then when they buy back they make a big public statement saying how they're committed to bitcoin ect and they lower their hashrate down to the low 30s and everyone is happy.

[bluemeanie1]

something bizarre is going on that is certain.

-bm

[Este Nuno]

something bizarre is going on that is certain.

-bm

I'm guessing there's no way to ever prove who is behind all of this.

I guess we can just ask ourselves, who benefits?

[Jason]

Someone over on Reddit posted a patch to Luke's latest BFGminer which provides a command line option to turn on block withholding attacks.

The post is in the "I'm selfish mining at ghashio" thread.  Here's the link they posted for convenience:  http://pastebin.com/d1ptqDFv

I can think of several incentives to use such an attack:

• To prevent a pool like GHash from cornering the mining market (and thus causing prices to fall) by negatively impacting their luck.  This should providing incentive for miners to switch to another pool
• To attack pools other than one's own in order to entice their users to come to your own pool

The second incentive seems like it would only work for individuals/groups in direct control of a large amount of hashing power -- such as GHash/CEX.

Perhaps this will turn out to be just the sort of tool the Bitcoin community needs to keep mining pools from gaining too much market share?  Or perhaps it will usher in a new stage of mining wars.  Either way, it seems like it has the potential to alter the balance of power by giving the mining community some power to punish misbehaving pools.

[Marlo Stanfield]

Someone over on Reddit posted a patch to Luke's latest BFGminer which provides a command line option to turn on block withholding attacks.

The post is in the "I'm selfish mining at ghashio" thread.  Here's the link they posted for convenience:  http://pastebin.com/d1ptqDFv

I can think of several incentives to use such an attack:

• To prevent a pool like GHash from cornering the mining market (and thus causing prices to fall) by negatively impacting their luck.  This should providing incentive for miners to switch to another pool
• To attack pools other than one's own in order to entice their users to come to your own pool

The second incentive seems like it would only work for individuals/groups in direct control of a large amount of hashing power -- such as GHash/CEX.

Perhaps this will turn out to be just the sort of tool the Bitcoin community needs to keep mining pools from gaining too much market share?  Or perhaps it will usher in a new stage of mining wars.  Either way, it seems like it has the potential to alter the balance of power by giving the mining community some power to punish misbehaving pools.

Wow, things just got even more interesting!

[justusranvier]

Perhaps this will turn out to be just the sort of tool the Bitcoin community needs to keep mining pools from gaining too much market share?  Or perhaps it will usher in a new stage of mining wars.  Either way, it seems like it has the potential to alter the balance of power by giving the mining community some power to punish misbehaving pools.

If a situation arises where it's no longer safe to accept hashing power from random members, then pools would have to restrict themselves to only working with trusted participants. Presumably that would make pools a lot smaller, and there'd be more of them.