Feeds

MtGox fallout bogs down Bitcoin traders as malleability issue goes mainstream

No real risk to network as flood of traffic suspends trading for many

3 Big data security analytics techniques

BitCoin service providers are scrambling to fix their systems and address flaws as a mass of traffic has been spotted targeting the "transaction malleability" loophole which has been connected to the embattled MtGox exchange.

Bitcoin information service/CoinDesk is reporting distributed denial of service (DDoS) slowdowns on a number of exchanges, while the Bitstamp exchange said that it would be temporarily suspending some transactions while it deals with a flood of traffic.

At issue is an apparent rush of attempts related to a "transaction malleability" issue in which certain exchanges (including MtGox) could be duped into believing that a completed transaction had not yet been processed.

According to experts, the core Bitcoin service itself is not affected by the attack and no funds are in danger from the issue. At this point the issue is limited to a slowdown on the activity certain networks which use partially vulnerable systems.

The transaction malleability issue has come to a head in the Bitcoin community in recent days amidst coverage of the suspension of activity at MtGox. The issue, which has been known about for years, allows an attacker to attempt to spoof the metadata on a transaction request, causing confusion and possibly errors which could be then exploited by an attacker.

Andreas Antonopoulos, chief security officer with Blockchain, likened the issue to the refund policy at retail stores. Much like a customer bringing a receipt to a store seeking a refund, users could attempt to claim funds from an exchange reporting an incomplete transaction.

In this case, many such claims are being brought to Bitcoin exchanges, much like a customer bringing a shoebox stuffed with old receipts to a store. Lacking any actual authentication, however the requests will only succeed in slowing traffic.

Antonopoulos told The Reg that firms and exchanges which have already implemented the correct protections for managing and processing transactions are not going to be affected by the DDoS at all.

Despite the headaches caused by the flood of traffic, the Blockchain security boss sees the Bitcoin community as a whole becoming more robust and secure as a result of today's issues.

"This is forcing any implementations that are not 100 per cent best practices to shake out their bugs," he said.

"I expect by this time next week, transaction malleability will be a non-issue, at least as far as these implementations go."

The slowdown is the latest in what has been a busy month for the Bitcoin market. Earlier this month Apple caught a flurry of protests when it blocked the last of the remaining Bitcoin trading tools on the App Store for violating its restrictions on in-app transactions.

A few days later, MtGox drew headlines and customer ire when it said that it would be suspending some transactions, leading to further scrutiny and criticism of the company's business practices and handling of transactions.

In the meantime, Bitcoin proponents have maintained that the cryptocurrency itself remains strong and is poised to continue its push into the finance space. ®

3 Big data security analytics techniques

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Arts and crafts store Michaels says 3 million credit cards exposed in breach
Meanwhile, Target investigators prepare for long process in nabbing hackers
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.