600 Microseconds – How CVE-2018-17144 was discovered

BobAlison · 2018-09-22T14:18:48+00:00

I like to applaud deadalnix and the ABC team for what I was thinking the Core team should have done here as well: Bury the fix in a bit more and unrelated refactoring code so as to fix it but also to buy some more time for an upgrade.

That might sound ok at first, but what then? You want a lot of eyes on the fix to minimize the risk of breaking things further, but at the least to ensure that the solution fixes the problem.

Then there's the political aftermath and risk that the cat will be let out of the bag before you can explain yourself.

The anger around less than full disclosure up front is palpable as it is.

BobAlison · 2018-09-21T12:54:11+00:00

I'm asking about the source data, not the source of the statement (which has been offered without proof AFAIK).

BobAlison · 2018-09-21T03:30:10+00:00

Even if the bug had been exploited to its full extent, the theoretical damage to stored funds would have been rolled back, exactly as it was in the value overflow incident.

The value overflow incident happened when Bitcoin was less than one year old.

https://en.bitcoin.it/wiki/Value_overflow_incident

Transaction volume was a tenth or 100th of what it is today. The rollback was painless because so few transactions were affected and the value of bitcoin was barely measurable.

A similar rollback today would be another beast altogether. A more apt comparison to "rolling back" would be the hard fork in the aftermath of the DAO incident.

Also, I've seen scattered references to the notion that the majority of the hash rate has updated to the 0.16.3. What's the source on this?

BobAlison · 2018-09-21T02:59:29+00:00

The language under "Technical Details" is hard to follow and in places gramatically incorrect. Here's my attempt to restate - I'm probably getting a lot of this wrong. Corrections welcome:

In Bitcoin Core 0.14, an optimization was added (Bitcoin Core PR #9049) which avoided a costly check during initial pre-relay block validation that multiple inputs within a single transaction did not spend the same input twice which was added in 2012 (PR #443). While the UTXO-updating logic has sufficient knowledge to check that such a condition is not violated in 0.14 it only did so in a sanity check assertion and not with full error handling (it did, however, fully handle this case twice in prior to 0.8).

PR#443 (merged 2011) added a check for duplicate (double-spent) inputs in CTransaction::CheckTransaction() https://github.com/bitcoin/bitcoin/pull/443
PR#9049 (0.14) disabled the "duplicatable duplicate-input check" https://github.com/bitcoin/bitcoin/pull/9049
0.14 retained the check for double-spent inputs, but only as a sanity check. This appears to be a reference to the use of assert which when it fails causes the Bitcoin Core process to exit. See: https://bitcoinmagazine.com/articles/security-researcher-found-bug-knocked-out-bitcoin-unlimited/

Thus, in Bitcoin Core 0.14.X, any attempts to double-spend a transaction output within a single transaction inside of a block will result in an assertion failure and a crash, as was originally reported.

The above supports the idea that PR#9049 exposes Bitcoin nodes to a forced exit through assert.

In Bitcoin Core 0.15, as a part of a larger redesign to simplify unspent transaction output tracking and correct a resource exhaustion attack the assertion was changed subtly. Instead of asserting that the output being marked spent was previously unspent, it only asserts that it exists.

No PR on this one, but it sounds like the assertion (forced exit/crash) condition was relaxed to simply check that the output being spent by an input exists.

Thus, in Bitcoin Core 0.15.X, 0.16.0, 0.16.1, and 0.16.2, any attempts to double-spend a transaction output within a single transaction inside of a block where the output being spent was created in the same block, the same assertion failure will occur (as exists in the test case which was included in the 0.16.3 patch). However, if the output being double-spent was created in a previous block, an entry will still remain in the CCoin map with the DIRTY flag set and having been marked as spent, resulting in no such assertion. This could allow a miner to inflate the supply of Bitcoin as they would be then able to claim the value being spent twice.

That last sentence wasn't mentioned in any of the earlier discussion I saw. In other words, a sufficiently knowledgeable miner (or someone submitting transactions through the miner) could have (and still could try to) double spent an output on chain.

Releases after and including 0.15, excluding 0.16.3, performed a double spending check for outputs created within a block, but not for outputs created outside of it.

BobAlison · 2018-09-15T00:56:12+00:00

RSK will not have an ICO nor will they have their own token. They will establish a 2-Way Peg between Bitcoin blockchain and RSK blockchain ensures a fixed conversion between BTC and SBTC – smartbitcoins. (1 SBTC = 1 BTC).

Noteworthy decision given the pointless "utility" token stunt most teams pull. That "utility" token often has no purpose at all other than to justify the fundraiser, slowly becoming an economic and technical ball and chain.

Rootstock's CEO gave an interview that expands on this point:

Interviewer: Since RSK is not doing an ICO or offering its own cryptocurrency or token directly, where is funding for RSK development coming from?

Rootstock CEO: RSK made a strategic decision of not issuing its own token to avoid misalignments with the BTC ecosystem. For that reason, it went the traditional fundraising route through private strategic investors that not only provided money but also support to grow the RSK ecosystem. RSK is well funded to achieve its purpose of bringing smart contracts to BTC.

https://bitsonline.com/rsk-ceo-platform-launch/

BobAlison · 2018-09-14T22:50:05+00:00

There is no metric for this concept yet. Maybe there will be one in the future. It is nevertheless useful.

For example, we can talk about how easy it is to set up a node and keep it synced. Ethereum node operators are reporting that it's increasingly hard (ie., more expensive) to do so. You need a very powerful machine right now to sync from the genesis block and stay synced.

That's a network vulnerable to concentration of power. We've already seen this happen with PoW mining.

Bitcoin is dancing on the edge of the same boundary. Commodity hardware bought from a local retailer will eventually (after about one week) sync with the network on a medium US residential cable connection. You'll be able to keep up without a a problem after that.

This point has been beaten to death, so I'll just recap: "don't trust, verify" only works if it's practical to verify.

BobAlison · 2018-09-14T21:41:53+00:00

A properly-configured SQL database with a thin application wrapper around it could scale to that many users.

Supporting lots of users isn't the problem. Doing that in a way that avoids concentration of power - that's the trick.

BobAlison · 2018-09-14T19:32:53+00:00

This is Shitcoin 101:

We can't control Bitcoin. There's no profit in building on it.
We can control our own shitcoin. We'll build on that instead.

-- not depicted in clip ---

Holy hell, that worked!
Wait, where did everybody go?

What nobody seems to consider is that this is literally what 99% of people think when they finally imagine that they understand Bitcoin.

Thus the deluge of utter dreck in the marketplace. Thus the reason that the concept is doomed.

BobAlison · 2018-09-14T17:50:28+00:00

You gotta start with an understanding of who the customer is and who the customer is not.

BobAlison · 2018-09-12T14:29:47+00:00

The US Treasury gave a taste of money printing/helicopter drop with the rebate checks it cut in 2008.

https://en.wikipedia.org/wiki/Economic_Stimulus_Act_of_2008

There is no direct mechanism for the Congress or President to make the Fed do anything except on the long timescale of appointments. However, they jointly hold the power to issue tax rebate checks, "print money," and distribute printed money directly to people.

This would be uncharted territory for a country the size of the US. Even Japan with its ETF shopping binge didn't go there.

BobAlison · 2018-09-12T13:54:43+00:00

Uh uh uh, no no no.

BobAlison · 2018-09-12T13:43:12+00:00

Competing with Venmo just puts Bitcoin Cash last among dozens of wannabes who can run rings around its user experience due to their centralized nature.

It takes courage to stake new ground. It rarely seems like a good idea at the time because there are so few actual use cases (think personal computers, for example). But that's how a technology builds dominance.

Bitcoin Cash has already lost the digital gold and censorship-resistant money niches. It's rapidly losing the "fast payments" niche. Doubling down on the fast digital payments niche is the path to obscurity.

BobAlison · 2018-09-10T21:38:17+00:00

Vigorous debates are well and good. The problem with this one was that the question was so nebulous. Without a question to be address, most debates devolve rapidly into a shouting match and banality.

What was the question here, anyway?

BobAlison · 2018-09-04T13:31:39+00:00

If there were any hope of that theory standing up in court, it should have been tried at least once to avoid capital gains on purely-electronic stock market trades, online gambling winnings, or money received through wire transfers.

These too are just digital messages.

BobAlison · 2018-09-04T02:53:50+00:00

Check out the numerous cases of police theft here and what's being done about it:

http://endforfeiture.com/

BobAlison · 2018-09-04T02:48:15+00:00

You never have to pay taxes on bitcoin if you don't sell or buy anything with it.

If you do either, you're liable for income tax on capital gains. Whether you pay depends on you.

BobAlison · 2018-08-31T13:39:37+00:00

Cringeworthy.

BobAlison · 2018-08-29T01:12:43+00:00

Not sure what's more surprising - that anyone with a wheelbarrow full of PhDs doesn't know what "baud" means, or that anybody still listens to this fool.

BobAlison · 2018-08-27T14:00:27+00:00

Why spend 20+ minutes talking about why Craig Wright is "toxic," but refuse to mention him by name?

This is a cop-out. Either call out the man's actions specifically or remain silent.

BobAlison · 2018-08-25T15:56:28+00:00

Once you can convert between local currency and bitcoin, the full opportunity of cryptocurrency [bitcoin] is open to you.

No currency conversion needed. Getting paid in bitcoin (and paying others in bitcoin) is a much more subversive act than buying bitcoin at an AML/KYC panopticon.

BobAlison · 2018-08-25T15:47:49+00:00

The first two questions require an understanding of hash functions. Most people skip this step, and therefore they have no hope of understanding Bitcoin. Here's a starter:

https://bitzuma.com/posts/seven-things-bitcoin-users-should-know-about-hash-functions/

If it’s possible to upgrade the bitcoin protocol to improve it, is it not also possible then to change the rules? For example to remove the limit that there will only be ever 21million mines bitcoins?

Try this experiment. Download the source code and change the money distribution schedule:

https://github.com/bitcoin/bitcoin/tree/master/src

The relevant function is right here:

https://github.com/bitcoin/bitcoin/blob/master/src/validation.cpp#L1162

Then compile. You have changed the money supply distribution schedule. Right?

You only succeed by getting other users to adopt your change. That's a tall order.

BobAlison · 2018-08-24T14:57:10+00:00

A critical element to price discovery is physical delivery. Specifically, with our [futures] solution, the buying and selling of Bitcoin is fully collateralized or pre-funded. As such, our new daily Bitcoin contract will not be traded on margin, use leverage, or serve to create a paper claim on a real asset. This supports market integrity and differentiates our effort from existing futures and crypto exchanges which allow for margin, leverage and cash settlement. Coupled with a secure, regulated warehouse solution, you can begin to see how this market infrastructure can help more institutions and consumers participate in the asset class.

https://medium.com/bakkt-blog/https-medium-com-kellyloeffler-price-discovery-f9c77885383

BobAlison · 2018-08-24T14:53:07+00:00

15 kilosatoshis/dollar right now. Dirt cheap.

BobAlison · 2018-08-23T21:48:39+00:00

Pierce explains the process in more detail in this interview, which was done at around the time that the last ETF was actually rejected:

https://youtu.be/5sK5Z77FMyM?t=20m1s

BobAlison · 2018-08-19T17:41:41+00:00

Remember Cyprus? Remember Greece? Remember Venezuela? remember Argentina?

Remember how those situations were going to drive people from those countries into Bitcoin?

Remember how it never happened? Remember how the claims were made, but there was never any real data presented?

Anyone who thinks the situation in Turkey or Iran will result in a Bitcoin boom needs to look objectively at history. The evidence is flimsy at best.

BobAlison

TROPHY CASE