surebet posted:

Keep calm, transaction malleability is not double spending (self.Bitcoin)
submitted 3 hours ago by malefizer

It is well known since years and means only that you have a different transaction ID than your service is showing. At the end you should see the exit at your spending address an usual, only with another tx id.

What does it: somebody on the network sees your tx and makes a identical copy of it with some extra data, to have a different hash value. He CAN NOT diverge the transaction to another target address or double spend it. BECAUSE crypto remains unbroken.

Chocobo posted:

jony ive aces posted:

quote:

Bitcoin core developer, Greg Maxwell, about this highly technical issue. Greg Maxwell and Peter Wuille are the core developers in consultation with Mt. Gox, as per their press release.

<gmaxwell> The Gox press release seems a little ‘spun’ to me. They portray characteristics of the Bitcoin system well known since at least 2011 (which even have their own wiki page ) as something new.

These characteristics are annoying but don’t inhibit basic operation. They are slowly being fixed – but fixing them completely will likely take years as they require changing all wallet software.

quote:

The flaw isn’t so much in Bitcoin as it is in exchange-systems. Many exchanges use the tx-id to uniquely identify transactions, but as it turns out, an attacker can change the tx-id without changing the actual transaction, rebroadcast the changed transaction (effectively creating a double-spend) and if his altered transaction gets accepted into a block instead of the legit transaction, the attacker receives his coins and can complain with the exchange that he didn’t. The exchange will then check their db, fetch the tx-id from it, look it up in the blockchain and not find it. So they could conclude that the transaction indeed failed and credit the account with the coins.

A simple workaround is to not use the tx-id to identify transactions on the exchange side, but the set of (amount, address, timestamp) instead. If a user complains about not receiving their withdrawal, support can look it up using these 3 variables. It takes a little bit more work from support, but it prevents this attack from succeeding.

While it’d be nice if the tx-id isn’t malleable, blaming this problem on a flaw in the protocol is quite a stretch.

Damiya posted:

lol

surebet posted:

gox back at 600, not sure if it's a dead catte bounce but if so expect good laffs soon

Erenthal posted:

my only question is why dont wizards of the coast step up to their responsibilities here

release a balance booster or something

hobbesmaster posted:

so reading between the lines someone cleaned out mtgox by spoofing transaction ids?

surebet posted:

https://bitcointalk.org/index.php?topic=8392.0

New Attack Vector
May 15, 2011, 05:00:58 PM

hobbesmaster posted:

so reading between the lines someone cleaned out mtgox by spoofing transaction ids?

unpacked robinhood posted:

If it actually happened, and mtgocks managed to replay their transaction log from the beginning and pinpoint the bogus transactions, what kind of entity would they be able to point the finger to ? Like an individual account, a particular pool ?

My question is who gets the scammer tag

FrozenVent posted:

the laffs market is an inverse derivative of the btc market, but with guaranteed capital

kiwid posted:

this means there is a lot of people selling and a lot of volume to be sold, right?

if not, can someone explain this chart to me?

unpacked robinhood posted:

If it actually happened, and mtgocks managed to replay their transaction log from the beginning and pinpoint the bogus transactions, what kind of entity would they be able to point the finger to ? Like an individual account, a particular pool ?

My question is who gets the scammer tag

hobbesmaster posted:

they'd know the account holder whose transaction was forged, but they could be an "innocent" bystander, they'd also have the address they sent the money to which could be followed i suppose. i dunno how good mtgox is at chasing people across train cars

Shifty Pony posted:

so the transaction id, which is used to uniquely identify a transaction, cannot be relied upon to identify a transaction?

quote:

According to Mt. Gox, they discovered a critical flaw in the design of Bitcoin, allowing people to 'steal' Bitcoins by changing the ID of a BTC withdrawal transaction after-the-fact, claiming to customer support that they never received it, and having them resend it. This would be a possibility, because the Bitcoin protocol does not 'sign' the transaction ID, and it could thus be spoofed. They go on playing the 'white knight', strongly implying that they've been the first to find said flaw, and are in talks with developers to get it fixed.

Except that's a big crock of poo poo.

The issue with spoofing a transaction ID does indeed exist, and is known as transaction malleability. However this is not, as Mt. Gox claims, a "new finding" - it has been known and documented for years. Consequently, the official Bitcoin daemon (bitcoind) does not rely on a transaction ID to determine if a transaction succeeded, and people writing their own implementation have been warned about this for those same years.

So why does Mt. Gox experience this issue? They run a custom Bitcoin daemon, with a custom implementation of the Bitcoin protocol. Their implementation, against all advice, does rely on the transaction ID, which makes this attack possible. They have actually been warned about it months ago by gmaxwell, and have apparently decided to ignore this warning.

In other words, this is not a vulnerability in the Bitcoin protocol, but an implementation error in Mt. Gox' custom Bitcoin software.

anthonypants posted:

yeah but it's not changing the destination address, it's changing the transaction's unique id hash
correct

this is good for bitcoin, because

Dr. Honked posted:

hold onto your butts, it's laff time

http://cryto.net/~joepie91/blog/2014/02/10/why-mtgox-is-full-of-poo poo/

Dr. Honked posted:

hold onto your butts, it's laff time

http://cryto.net/~joepie91/blog/2014/02/10/why-mtgox-is-full-of-poo poo/

Chocobo posted:

how long until the announcement that all of mtgox's bitcoins have been stolen using this vulnerability, but they will generously reimburse 25% of each stolen balance from their own personal wallets

mtgox has to end the same way every other bitcoin enterprise has ended

FMguru posted:

dont forget the part where mtgox's customers are over-the-moon excited to be getting back 25% of their money and how it shows what TRUE MEN OF HONOR the mtgox guys are for reaching into their own pockets to try and make their customers at least somewhat whole

hobbesmaster posted:

so reading between the lines someone cleaned out mtgox by spoofing transaction ids?

FrozenVent posted:

also they start a secondary market to resell mtgox debt

oh wait






THEY ALREADY DID THAT