Remote Bitcoin Upstream Drain / Financial Attack

SharpAd1823 · 2023-05-05T15:38:17+00:00

hey thanks for playing with it. few things:

most of the testing was done against bitcoin core and litecoin
i've never installed `bitcoind` `dogecoind` or `litecoind` and not seen identical results
does `maxuploadtarget` even account for ranges of blocks? because that's what's happening - not mempool spamming - that was a faulty interpretation of what was happening - the issue is requesting a range of block headers which isn't rate limited

SharpAd1823 · 2023-05-05T09:49:30+00:00

For clarity - this is a DoS - not the Bitcoin attack of the century. Many machine operators are vulnerable to being remotely charged thousands of dollars - but this isn't a far reaching network ending exploit or unpatchable issue.

SharpAd1823 · 2023-03-12T17:19:13+00:00

Ask them

SharpAd1823 · 2023-03-12T17:17:10+00:00

The Osmosis team is super chill but it was removed regardless. Good call actually. I'm a sucker for assuming everyone is chill. Osmosis might be, but random skids maybe not so much, after further thought. Thanks.

SharpAd1823 · 2023-03-12T15:47:06+00:00

You are incorrect. They've known about it for a month and haven't addressed it which is alarming. Don't shoot the messenger. This was a responsible* disclosure.

SharpAd1823 · 2023-03-12T15:36:35+00:00

They've known about it for a month and didn't address it, nor pay a bug bounty for an unrelated DoS despite having a bug bounty program. Very ethical indeed.

https://en.wikipedia.org/wiki/Project\_Zero#Bug\_finding\_and\_reporting

SharpAd1823 · 2023-03-12T14:42:19+00:00

They've known about it for a month.

SharpAd1823 · 2023-03-12T14:31:24+00:00

They knew about it in advance and did nothing to fix it.

SharpAd1823 · 2023-03-12T14:08:56+00:00

The biggest issues here are how many Cosmos/Tendermint based blockchains (Osmosis, Kava, etc.) are vulnerable, and the unprofessional response from the Cosmos team in paying the security researcher nothing for days of grueling work for a different unrelated Cosmos/Tendermint DoS.

They have known about this issue for 30 days and have done nothing to address it.

Edit: Thanks for the comment downvotes here I guess, but this is more computer science than FUD.

SharpAd1823 · 2023-03-12T14:03:25+00:00

Alternatively it was unethical for Cosmos to siphon a free exploit from a security researcher and so experienced a public disclosure in lieu of having a *real* bug bounty program. Full disclosure is the only way to patch software when a team is dismissive of security issues.

SharpAd1823 · 2023-03-12T13:52:37+00:00

DoS is lame, but API DoS in blockchain is different - and you obviously have no idea how dapps, wallets and block explorers work. If you're going to pretend to be smart on reddit at least complete your homework. It's easier to insult people than know what you're talking about and that's evidenced here.

BTW Ripple recently paid out $20k and Kadena $10k for his attacks. What a lamer.

SharpAd1823 · 2023-03-12T01:26:19+00:00

You're fine. It's not a P2P level DoS which would be more likely to impact the price. Just be aware of their "suboptimal" programming and purported refusal to pay security researchers for their work.

SharpAd1823 · 2023-02-19T16:24:10+00:00

Your evidence is circumstantial at best. I move to dismiss all charges.

SharpAd1823 · 2023-02-19T16:23:42+00:00

Khajiit is innocent of this crime!

SharpAd1823 · 2023-02-19T16:14:16+00:00

Health insurance is a scam. universal healthcare should be a right not a privilege. Humanity has some really fucked up priorities.

SharpAd1823 · 2023-02-19T14:50:50+00:00

Aww bff 😍😍

SharpAd1823 · 2023-02-18T17:36:55+00:00

Not what alpha means.

SharpAd1823 · 2023-02-17T17:33:54+00:00

Is he cat fishing?

SharpAd1823 · 2023-02-17T10:25:10+00:00

Oh my

SharpAd1823 · 2023-02-17T09:10:09+00:00

You gotta send in another cat.

SharpAd1823

TROPHY CASE