Feeds

MtGox fallout bogs down Bitcoin traders as malleability issue goes mainstream

No real risk to network as flood of traffic suspends trading for many

Protecting users from Firesheep and other Sidejacking attacks with SSL

BitCoin service providers are scrambling to fix their systems and address flaws as a mass of traffic has been spotted targeting the "transaction malleability" loophole which has been connected to the embattled MtGox exchange.

Bitcoin information service/CoinDesk is reporting distributed denial of service (DDoS) slowdowns on a number of exchanges, while the Bitstamp exchange said that it would be temporarily suspending some transactions while it deals with a flood of traffic.

At issue is an apparent rush of attempts related to a "transaction malleability" issue in which certain exchanges (including MtGox) could be duped into believing that a completed transaction had not yet been processed.

According to experts, the core Bitcoin service itself is not affected by the attack and no funds are in danger from the issue. At this point the issue is limited to a slowdown on the activity certain networks which use partially vulnerable systems.

The transaction malleability issue has come to a head in the Bitcoin community in recent days amidst coverage of the suspension of activity at MtGox. The issue, which has been known about for years, allows an attacker to attempt to spoof the metadata on a transaction request, causing confusion and possibly errors which could be then exploited by an attacker.

Andreas Antonopoulos, chief security officer with Blockchain, likened the issue to the refund policy at retail stores. Much like a customer bringing a receipt to a store seeking a refund, users could attempt to claim funds from an exchange reporting an incomplete transaction.

In this case, many such claims are being brought to Bitcoin exchanges, much like a customer bringing a shoebox stuffed with old receipts to a store. Lacking any actual authentication, however the requests will only succeed in slowing traffic.

Antonopoulos told The Reg that firms and exchanges which have already implemented the correct protections for managing and processing transactions are not going to be affected by the DDoS at all.

Despite the headaches caused by the flood of traffic, the Blockchain security boss sees the Bitcoin community as a whole becoming more robust and secure as a result of today's issues.

"This is forcing any implementations that are not 100 per cent best practices to shake out their bugs," he said.

"I expect by this time next week, transaction malleability will be a non-issue, at least as far as these implementations go."

The slowdown is the latest in what has been a busy month for the Bitcoin market. Earlier this month Apple caught a flurry of protests when it blocked the last of the remaining Bitcoin trading tools on the App Store for violating its restrictions on in-app transactions.

A few days later, MtGox drew headlines and customer ire when it said that it would be suspending some transactions, leading to further scrutiny and criticism of the company's business practices and handling of transactions.

In the meantime, Bitcoin proponents have maintained that the cryptocurrency itself remains strong and is poised to continue its push into the finance space. ®

The next step in data security

More from The Register

next story
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.