1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
|
Received: from sog-mx-4.v43.ch3.sourceforge.com ([172.29.43.194]
helo=mx.sourceforge.net)
by sfs-ml-2.v29.ch3.sourceforge.com with esmtp (Exim 4.76)
(envelope-from <jgarzik@bitpay.com>) id 1XFai2-0000Uf-2R
for bitcoin-development@lists.sourceforge.net;
Fri, 08 Aug 2014 03:19:14 +0000
Received-SPF: pass (sog-mx-4.v43.ch3.sourceforge.com: domain of bitpay.com
designates 209.85.213.176 as permitted sender)
client-ip=209.85.213.176; envelope-from=jgarzik@bitpay.com;
helo=mail-ig0-f176.google.com;
Received: from mail-ig0-f176.google.com ([209.85.213.176])
by sog-mx-4.v43.ch3.sourceforge.com with esmtps (TLSv1:RC4-SHA:128)
(Exim 4.76) id 1XFai0-0003LZ-TG
for bitcoin-development@lists.sourceforge.net;
Fri, 08 Aug 2014 03:19:14 +0000
Received: by mail-ig0-f176.google.com with SMTP id hn18so395388igb.9
for <bitcoin-development@lists.sourceforge.net>;
Thu, 07 Aug 2014 20:19:07 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=1e100.net; s=20130820;
h=x-gm-message-state:mime-version:in-reply-to:references:from:date
:message-id:subject:to:cc:content-type;
bh=7p3jh8ZKbiqgh2woiwfQyMhzJ6oxBPl1w3NTWDad+oo=;
b=inRWAxGSKEqrQIKd9M/tJcCFC1iTHtE7a3uZXocegrsj/jHpdq5TqCJmxay6Q/axJO
MKscaybkX6J7mg25AA+akpN1gwmiRF0HKdDadPwo7fhHP0OPeL58Bak//qMT1Xxvbll7
WxNiymVhLH23wCDt2U6hvcbeTQMuwzdrYF0SERFz6/JsEyCYpOpYROyMVMhAW/RIAfEv
rrDtTtSDjkhkLRfO/z8+Gq+JjDqQ17vaNg7IJFvy0RwyjX08NjAEAfv6Wb/4/nI71TO7
joejNEmtdaUMVQbVf43s0nfhv9td2EIVqgL4/zIEUlhAlJ9TrI4QYWSC5VWevatdcpKp
c6iA==
X-Gm-Message-State: ALoCoQmiOzM14TaNdrxUpckxRE2GNJ1HGzrBbpxw0PnautVE0Uh1ifcbjr+7fee2w6GmFUNAnWe6
X-Received: by 10.50.178.172 with SMTP id cz12mr1311954igc.22.1407467947461;
Thu, 07 Aug 2014 20:19:07 -0700 (PDT)
MIME-Version: 1.0
Received: by 10.107.10.78 with HTTP; Thu, 7 Aug 2014 20:18:47 -0700 (PDT)
In-Reply-To: <CAJna-HjzMO68KSXYG++X-8vzQCLurkrAAhfrVo9-AbaoYdqZhw@mail.gmail.com>
References: <CAPS+U9-ze_-gcYh1WNVJ5h8AZ8owoQX=8OUgNcKnaxgvjxZATA@mail.gmail.com>
<201408072345.45363.luke@dashjr.org>
<CAJna-HjzMO68KSXYG++X-8vzQCLurkrAAhfrVo9-AbaoYdqZhw@mail.gmail.com>
From: Jeff Garzik <jgarzik@bitpay.com>
Date: Thu, 7 Aug 2014 23:18:47 -0400
Message-ID: <CAJHLa0M3QOm5kL0Kit-DPeM9ftmuKcTZvr5kbsmyK8jtF7NeRQ@mail.gmail.com>
To: slush <slush@centrum.cz>
Content-Type: multipart/alternative; boundary=089e0149c57e0b49a4050015abd1
X-Spam-Score: 1.1 (+)
X-Spam-Report: Spam Filtering performed by mx.sourceforge.net.
See http://spamassassin.org/tag/ for more details.
-1.5 SPF_CHECK_PASS SPF reports sender host as permitted sender for
sender-domain
-0.0 SPF_PASS SPF: sender matches SPF record
1.7 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist
[URIs: dashjr.org]
1.0 HTML_MESSAGE BODY: HTML included in message
-0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
author's domain
0.1 DKIM_SIGNED Message has a DKIM or DK signature,
not necessarily valid
-0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
X-Headers-End: 1XFai0-0003LZ-TG
Cc: "bitcoin-development@lists.sourceforge.net"
<bitcoin-development@lists.sourceforge.net>
Subject: Re: [Bitcoin-development] Miners MiTM
X-BeenThere: bitcoin-development@lists.sourceforge.net
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: <bitcoin-development.lists.sourceforge.net>
List-Unsubscribe: <https://lists.sourceforge.net/lists/listinfo/bitcoin-development>,
<mailto:bitcoin-development-request@lists.sourceforge.net?subject=unsubscribe>
List-Archive: <http://sourceforge.net/mailarchive/forum.php?forum_name=bitcoin-development>
List-Post: <mailto:bitcoin-development@lists.sourceforge.net>
List-Help: <mailto:bitcoin-development-request@lists.sourceforge.net?subject=help>
List-Subscribe: <https://lists.sourceforge.net/lists/listinfo/bitcoin-development>,
<mailto:bitcoin-development-request@lists.sourceforge.net?subject=subscribe>
X-List-Received-Date: Fri, 08 Aug 2014 03:19:14 -0000
--089e0149c57e0b49a4050015abd1
Content-Type: text/plain; charset=UTF-8
You don't necessarily need the heavy weight of SSL.
You only need digitally signed envelopes between miner and pool[1].
[1] Unless the pool is royally stupid and will somehow credit miner B, if
miner B provides to the pool a copy of miner A's work.
On Thu, Aug 7, 2014 at 8:29 PM, slush <slush@centrum.cz> wrote:
> AFAIK the only protection is SSL + certificate validation on client side.
> However certificate revocation and updates in miners are pain in the ass,
> that's why majority of pools (mine including) don't want to play with
> that...
>
> slush
>
>
> On Fri, Aug 8, 2014 at 1:45 AM, Luke Dashjr <luke@dashjr.org> wrote:
>
>> On Thursday, August 07, 2014 11:02:21 PM Pedro Worcel wrote:
>> > Hi there,
>> >
>> > I was wondering if you guys have come across this article:
>> >
>> > http://www.wired.com/2014/08/isp-bitcoin-theft/
>> >
>> > The TL;DR is that somebody is abusing the BGP protocol to be in a
>> position
>> > where they can intercept the miner traffic. The concerning point is that
>> > they seem to be having some degree of success in their endeavour and
>> > earning profits from it.
>> >
>> > I do not understand the impact of this (I don't know much about BGP, the
>> > mining protocol nor anything else, really), but I thought it might be
>> worth
>> > putting it up here.
>>
>> This is old news; both BFGMiner and Eloipool were hardened against it a
>> long
>> time ago (although no Bitcoin pools have deployed it so far). I'm not
>> aware of
>> any actual case of it being used against Bitcoin, though - the target has
>> always been scamcoins.
>>
>>
>> ------------------------------------------------------------------------------
>> Infragistics Professional
>> Build stunning WinForms apps today!
>> Reboot your WinForms applications with our WinForms controls.
>> Build a bridge from your legacy apps to the future.
>>
>> http://pubads.g.doubleclick.net/gampad/clk?id=153845071&iu=/4140/ostg.clktrk
>> _______________________________________________
>> Bitcoin-development mailing list
>> Bitcoin-development@lists.sourceforge.net
>> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>>
>
>
>
> ------------------------------------------------------------------------------
> Want fast and easy access to all the code in your enterprise? Index and
> search up to 200,000 lines of code with a free copy of Black Duck
> Code Sight - the same software that powers the world's largest code
> search on Ohloh, the Black Duck Open Hub! Try it now.
> http://p.sf.net/sfu/bds
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>
>
--
Jeff Garzik
Bitcoin core developer and open source evangelist
BitPay, Inc. https://bitpay.com/
--089e0149c57e0b49a4050015abd1
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
<div dir=3D"ltr"><div><div>You don't necessarily need the heavy weight =
of SSL.<br><br></div>You only need digitally signed envelopes between miner=
and pool[1].<br><br></div>[1] Unless the pool is royally stupid and will s=
omehow credit miner B, if miner B provides to the pool a copy of miner A=
9;s work.<br>
<br></div><div class=3D"gmail_extra"><br><br><div class=3D"gmail_quote">On =
Thu, Aug 7, 2014 at 8:29 PM, slush <span dir=3D"ltr"><<a href=3D"mailto:=
slush@centrum.cz" target=3D"_blank">slush@centrum.cz</a>></span> wrote:<=
br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left=
:1px #ccc solid;padding-left:1ex">
<div dir=3D"ltr">AFAIK the only protection is SSL + certificate validation =
on client side. However certificate revocation and updates in miners are pa=
in in the ass, that's why majority of pools (mine including) don't =
want to play with that...<span class=3D"HOEnZb"><font color=3D"#888888"><di=
v>
<br></div><div>slush</div></font></span></div><div class=3D"HOEnZb"><div cl=
ass=3D"h5"><div class=3D"gmail_extra"><br><br><div class=3D"gmail_quote">On=
Fri, Aug 8, 2014 at 1:45 AM, Luke Dashjr <span dir=3D"ltr"><<a href=3D"=
mailto:luke@dashjr.org" target=3D"_blank">luke@dashjr.org</a>></span> wr=
ote:<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1p=
x #ccc solid;padding-left:1ex"><div><div>On Thursday, August 07, 2014 11:02=
:21 PM Pedro Worcel wrote:<br>
> Hi there,<br>
><br>
> I was wondering if you guys have come across this article:<br>
><br>
> <a href=3D"http://www.wired.com/2014/08/isp-bitcoin-theft/" target=3D"=
_blank">http://www.wired.com/2014/08/isp-bitcoin-theft/</a><br>
><br>
> The TL;DR is that somebody is abusing the BGP protocol to be in a posi=
tion<br>
> where they can intercept the miner traffic. The concerning point is th=
at<br>
> they seem to be having some degree of success in their endeavour and<b=
r>
> earning profits from it.<br>
><br>
> I do not understand the impact of this (I don't know much about BG=
P, the<br>
> mining protocol nor anything else, really), but I thought it might be =
worth<br>
> putting it up here.<br>
<br>
</div></div>This is old news; both BFGMiner and Eloipool were hardened agai=
nst it a long<br>
time ago (although no Bitcoin pools have deployed it so far). I'm not a=
ware of<br>
any actual case of it being used against Bitcoin, though - the target has<b=
r>
always been scamcoins.<br>
<br>
---------------------------------------------------------------------------=
---<br>
Infragistics Professional<br>
Build stunning WinForms apps today!<br>
Reboot your WinForms applications with our WinForms controls.<br>
Build a bridge from your legacy apps to the future.<br>
<a href=3D"http://pubads.g.doubleclick.net/gampad/clk?id=3D153845071&iu=
=3D/4140/ostg.clktrk" target=3D"_blank">http://pubads.g.doubleclick.net/gam=
pad/clk?id=3D153845071&iu=3D/4140/ostg.clktrk</a><br>
_______________________________________________<br>
Bitcoin-development mailing list<br>
<a href=3D"mailto:Bitcoin-development@lists.sourceforge.net" target=3D"_bla=
nk">Bitcoin-development@lists.sourceforge.net</a><br>
<a href=3D"https://lists.sourceforge.net/lists/listinfo/bitcoin-development=
" target=3D"_blank">https://lists.sourceforge.net/lists/listinfo/bitcoin-de=
velopment</a><br>
</blockquote></div><br></div>
</div></div><br>-----------------------------------------------------------=
-------------------<br>
Want fast and easy access to all the code in your enterprise? Index and<br>
search up to 200,000 lines of code with a free copy of Black Duck<br>
Code Sight - the same software that powers the world's largest code<br>
search on Ohloh, the Black Duck Open Hub! Try it now.<br>
<a href=3D"http://p.sf.net/sfu/bds" target=3D"_blank">http://p.sf.net/sfu/b=
ds</a><br>_______________________________________________<br>
Bitcoin-development mailing list<br>
<a href=3D"mailto:Bitcoin-development@lists.sourceforge.net">Bitcoin-develo=
pment@lists.sourceforge.net</a><br>
<a href=3D"https://lists.sourceforge.net/lists/listinfo/bitcoin-development=
" target=3D"_blank">https://lists.sourceforge.net/lists/listinfo/bitcoin-de=
velopment</a><br>
<br></blockquote></div><br><br clear=3D"all"><br>-- <br>Jeff Garzik<br>Bitc=
oin core developer and open source evangelist<br>BitPay, Inc. =C2=A0 =C2=A0=
=C2=A0<a href=3D"https://bitpay.com/" target=3D"_blank">https://bitpay.com=
/</a>
</div>
--089e0149c57e0b49a4050015abd1--
|
