Feeds

MtGox fallout bogs down Bitcoin traders as malleability issue goes mainstream

No real risk to network as flood of traffic suspends trading for many

Next gen security for virtualised datacentres

BitCoin service providers are scrambling to fix their systems and address flaws as a mass of traffic has been spotted targeting the "transaction malleability" loophole which has been connected to the embattled MtGox exchange.

Bitcoin information service/CoinDesk is reporting distributed denial of service (DDoS) slowdowns on a number of exchanges, while the Bitstamp exchange said that it would be temporarily suspending some transactions while it deals with a flood of traffic.

At issue is an apparent rush of attempts related to a "transaction malleability" issue in which certain exchanges (including MtGox) could be duped into believing that a completed transaction had not yet been processed.

According to experts, the core Bitcoin service itself is not affected by the attack and no funds are in danger from the issue. At this point the issue is limited to a slowdown on the activity certain networks which use partially vulnerable systems.

The transaction malleability issue has come to a head in the Bitcoin community in recent days amidst coverage of the suspension of activity at MtGox. The issue, which has been known about for years, allows an attacker to attempt to spoof the metadata on a transaction request, causing confusion and possibly errors which could be then exploited by an attacker.

Andreas Antonopoulos, chief security officer with Blockchain, likened the issue to the refund policy at retail stores. Much like a customer bringing a receipt to a store seeking a refund, users could attempt to claim funds from an exchange reporting an incomplete transaction.

In this case, many such claims are being brought to Bitcoin exchanges, much like a customer bringing a shoebox stuffed with old receipts to a store. Lacking any actual authentication, however the requests will only succeed in slowing traffic.

Antonopoulos told The Reg that firms and exchanges which have already implemented the correct protections for managing and processing transactions are not going to be affected by the DDoS at all.

Despite the headaches caused by the flood of traffic, the Blockchain security boss sees the Bitcoin community as a whole becoming more robust and secure as a result of today's issues.

"This is forcing any implementations that are not 100 per cent best practices to shake out their bugs," he said.

"I expect by this time next week, transaction malleability will be a non-issue, at least as far as these implementations go."

The slowdown is the latest in what has been a busy month for the Bitcoin market. Earlier this month Apple caught a flurry of protests when it blocked the last of the remaining Bitcoin trading tools on the App Store for violating its restrictions on in-app transactions.

A few days later, MtGox drew headlines and customer ire when it said that it would be suspending some transactions, leading to further scrutiny and criticism of the company's business practices and handling of transactions.

In the meantime, Bitcoin proponents have maintained that the cryptocurrency itself remains strong and is poised to continue its push into the finance space. ®

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
prev story

Whitepapers

Best practices for enterprise data
Discussing how technology providers have innovated in order to solve new challenges, creating a new framework for enterprise data.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?