Received-SPF: pass (sog-mx-1.v43.ch3.sourceforge.com: domain of petertodd.org
	designates 62.13.148.100 as permitted sender)
	client-ip=62.13.148.100; envelope-from=pete@petertodd.org;
	helo=outmail148100.authsmtp.co.uk; 
Date: Sat, 23 May 2015 14:26:21 -0400
From: Peter Todd <pete@petertodd.org>
To: bitcoin-development@lists.sourceforge.net
Message-ID: <20150523182621.GA12761@savin.petertodd.org>
References: <20150212064719.GA6563@savin.petertodd.org>
	<20150504043601.GA14728@savin.petertodd.org>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="rwEMma7ioTxnRzrJ"
Content-Disposition: inline
In-Reply-To: <20150504043601.GA14728@savin.petertodd.org>
User-Agent: Mutt/1.5.21 (2010-09-15)
Subject: [Bitcoin-development] Replace-by-fee v0.10.2 - Serious DoS attack
 fixed! - Also novel variants of existing attacks w/ Bitcoin XT and Android
 Bitcoin Wallet
Precedence: list


--rwEMma7ioTxnRzrJ
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

My replace-by-fee patch is now available for the Bitcoin Core v0.10.2
release:

    https://github.com/petertodd/bitcoin/tree/replace-by-fee-v0.10.2

This release fixes a serious DoS attack present in previous releases.
Upgrading is strongly recommended for relay nodes, and mandatory for
miners. Users of Luke-Jr's gentoo distribution should either disable RBF
until a patch is released, or run their node behind a patched node.

Previously replacements that spent outputs the transactions they
conflicted with would be accepted. This would lead to orphaned
transactions in the mempool, a potential bandwidth DoS attack for relay
nodes, and even worse, on mining nodes would cause Bitcoin to crash when
CreateNewBlock() was called.

Thanks goes to to Suhas Daftuar for finding this issue.


Additionally, while investigating this issue I found that
Andresen/Harding's relay doublespends patch=B9, included in Bitcoin XT=B2,
also fails to verify that doublespends don't spend outputs of the
transactions they conflict with. As the transactions aren't accepted to
the mempool the issue is simply a variant of the bandwidth DoS attack
that's a well-known issue of Bitcoin XT. However, interestingly in
testing I found that Schildbach's Android Bitcoin Wallet=B3 fails to
detect this case, and displays the transaction as a valid unconfirmed
transaction, potentially leading to the user being defrauded with a
doublespend.  While a well-known issue in general - Schildbach's
implementation trusts peers to only send it valid transactions and
doesn't even detect doublespends it receives from peers - it's
interesting how in this case the attacker doesn't need to also do a
sybil attack.

1) https://github.com/bitcoin/bitcoin/pull/3883
2) https://github.com/bitcoinxt/bitcoinxt
3) https://play.google.com/store/apps/details?id=3Dde.schildbach.wallet

--=20
'peter'[:-1]@petertodd.org
0000000000000000026ca21b4a83e1a818be96db4b532b7e9be2f60d47efff0a

--rwEMma7ioTxnRzrJ
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----

iQGrBAEBCACVBQJVYMZIXhSAAAAAABUAQGJsb2NraGFzaEBiaXRjb2luLm9yZzAw
MDAwMDAwMDAwMDAwMDAxMDcwNTFjNDhhYzA5NjNhN2QzM2I1M2Y3NTllMTVmNGNk
ZDYyNDk5ZTAzMDcwZDUvFIAAAAAAFQARcGthLWFkZHJlc3NAZ251cGcub3JncGV0
ZUBwZXRlcnRvZC5vcmcACgkQJIFAPaXwkfv0RAf+OIqDXO1+sfD18Yjn7k0w2sn8
AfEgRvyZJ3d6XBT7REtM8wh6V0ljKx7bIrPPW91vQFl+4bIvWFnrMVfq4iRbLhd6
J9N26A7al+sMhO/UFpUl1BaMjMGkvt9Qi6aahcQxvNGn43ne4Rd09VvXwM8bsXDD
Cnx2InWhvuPYDWWU3QHSr87xLUWCSRFUQncsMfUHibwHxCcPSrPDAcajqxCEnjV7
WT46A3e/sFCysGX06ujVUBEQ0jR+K/I+vF1HY9fQ2g90pYTcIgj8sP76XWHDtFjY
POyOo+7bqBvP4+HD1hlBph3SoEd8yy9zKzj6ZB4bGrQcwv/+5mUBN3WfFwJzMg==
=KUHR
-----END PGP SIGNATURE-----

--rwEMma7ioTxnRzrJ--