[HN Gopher] Bitcoins, Blockchains, and Botnets
___________________________________________________________________
Bitcoins, Blockchains, and Botnets
Author : tantalor
Score : 67 points
Date : 2021-03-17 20:42 UTC (2 days ago)
(HTM) web link (blogs.akamai.com)
(TXT) w3m dump (blogs.akamai.com)
| sharemywin wrote:
| Not quite the same use case. But I wrote about something similar
| in 2016.
|
| I'm not a good writer so ignore the rambling.
|
| https://medium.com/@sharemywin/after-reading-avoiding-a-poin...
| redm wrote:
| Interesting idea that is sure to gain more traction, perhaps
| better implemented on ETH where they have more control. This
| implementation seems fatally flawed:
|
| "This means for $1 about 2,500 disruption transactions can be
| placed in the wallet. In the case of the current IP address, the
| Satoshi values that must be sent to the wallet by the operators
| to recover control total 43,262 Satoshis, or about $16.50. The
| quick math at current market prices for BTC suggests that for
| every $1 spent on disruption, the operators will need to spend
| over $41,000 ($16.50*2,500) to recover their operations and get
| the orphaned infected systems back to their (current) IP
| address."
| qqii wrote:
| Couldn't they just query outgoing transactions from the wallet?
|
| The estimates given also do not factor transaction fees
| (currently 0.00041 BTC ~= 25 USD) , the estimated costs are
| only in value given to the attacker.
|
| For this specific botnet continuous denial of service also
| doesn't make sense. The attacker could easily setup an upgrade
| at an ip that chooses a different public address.
| amouat wrote:
| I don't think they owned the wallet, so they couldn't make
| outgoing transactions. I assume they didn't want to use a
| wallet they did control in case it could be used to identify
| them.
| qqii wrote:
| It just seems like a very thin layer of plausible
| deniability, in the current setup they control wallets that
| send the transactions that also can be linked back to them.
| throwawayffffas wrote:
| Agreed, I think they didn't really put much thought into
| it. Their next version will look at only outgoing
| transactions. They could also use another coin for lower
| transaction fees.
| theamk wrote:
| I don't get it.
|
| This malware makes a single https request to https endpoint for
| which users can affect contents, api.blockcypher.com. This does
| not seem too much different from many other places which can be
| changed by user - reddit, hn user profile, airtable, github,
| comment section at random website, mailing list archive, etc...
|
| I'd think the solution is going to be the same, too: contact the
| server and ask them to block URL. In this case, blockcypher
| should detect the api calls with the right properties (address,
| query string, user agent) and return error code on them. If they
| feel creative, maybe return modified answer which will break
| malware's shell parser, but will not affect regular json calls.
|
| If the blockcypher refuses to cooperate, you deal with it like
| you do with bulletproof hosting: add hostname to malicious domain
| list and block at all protected customers' sites.
| sgeisler wrote:
| Well, the problem with that strategy is that there are many
| such explorers and returning wrong data isn't in their best
| interest. Remember that the recipient address doesn't need to
| be owned by the attacker, it could be one of a big exchange
| which is of interest. Also the whole process of getting stuff
| blocked fine granular enough to be viable may slow down
| blocking enough to be very profitable.
| mysterypie wrote:
| > _Infected machines will regularly check-in. These methods rely
| on domains and static IP addresses. Predictably these domains and
| IP addresses get identified, burned, and /or seized._
|
| Instead of seizing and shutting down the command and control
| system, why not let it run for awhile and secretly monitor who
| connects to it? Are the malware operators always connecting to
| the command and control system via Tor or equivalent? They never
| slip up? I find it amazing that these huge malware operators are
| so rarely tracked down.
| sgeisler wrote:
| The correct way to do this would be using OP_RETURN imo. This
| special opcode is meant for committing to data like this. So for
| example one could commit to 4 bytes representing the IP address.
| To ensure that only authorized parties can update the IP the
| client should only accept transactions that were sent from a
| certain address, meaning they are automatically signed with the
| authorized-party's key.
|
| Definitely an interesting use case for BTC to route around such
| censorship.
| tantalor wrote:
| tldr; use bitcoin wallet as DNS
| ur-whale wrote:
| Using the blockchain to publish ever fresh and indestructible
| information.
|
| Interesting use of the Bitcoin infrastructure.
|
| Put to work to semi-nefarious ends in this case, but likely not
| the only use case.
|
| Very nice.
| qqii wrote:
| Perhaps my reading is incorrect but why did theg decide to use
| all transactions (something they can't control) versus outgoing
| transactions (something they have sole control over)?
|
| It also relies solely on blockcypher's api. I wonder if they were
| contacted and what their stance was.
| ixwt wrote:
| The article says that the wallet might not be in their control.
| They believe it might be a part of a coin tumbling/washing
| operation.
|
| I think the main reason they don't use one they control is the
| potential to trace where the original funds come from. There
| might be things you can do to obfuscate things, like tumbling
| the coins. It's all a risk though.
| qqii wrote:
| But they have to control a wallet to send the transactions
| anyway, which could be tracked in the same way?
| jcpham2 wrote:
| a most excellent write-up, thanks
| ddtaylor wrote:
| The method they used of encoding the transactions into the output
| value of the transaction could be done a LOT cheaper if they just
| mine transaction hashes with 16-bits of prefixed data. It's not
| that hard to create a transaction over and over until you get the
| first 16-bits of it's hash exactly as you want (in essence this
| is basically what Bitcoin mining is, just simply on blocks
| instead of txs)
|
| Also they could just do it with 4 transactions at 8-bits each
| too.
| spinny wrote:
| This is something that we will see happen more and more in the
| future. We are moving slowly to a more decentralized
| infrastructure than the current one, it's only plausible that
| malware writers will adopt more decentralized techniques.
|
| I would probably use another crypto. Dogecoin would probably
| allow for a bigger payload at a smaller price. Eliminating the
| api calls described could be possible by implementing such a
| thing on ethereum, including a full client and running it in
| light mode. However the described method is much more light-
| weight
| jl2718 wrote:
| I hate the idea that lawfully skeptical/paranoid citizens get
| mixed up with this stuff by paying for these currencies because
| it appears to them like an acceptable trade-off versus the risks
| of financial authoritarianism. Crypto would have zero value if
| only criminals felt the need to use it.
| loceng wrote:
| Does it have value if criminals can use it freely? There will
| need to be the same functional centralized systems of justice,
| accountable, and enforcement.
| fakedang wrote:
| Lol, Bitcoin started as a (sort of) traceless currency for
| criminals, and back then it had an actual utility as a
| financial medium. You could get a fake ID, drugs or unmarked
| guns or whatever only with Bitcoin. Now it's just a fancy
| hoarding tool (and no, a highly volatile instrument is not a
| store for wealth).
| cwkoss wrote:
| I'd argue it started as a cryptography toy, then became a
| means of acquiring Pizza, then became a tool for criminals.
| fakedang wrote:
| The pizza use case happened once. Criminal transactions
| were happening by the thousands within months of that.
| jl2718 wrote:
| It was capitalizing a supply chain that had a lot of
| criminal activity in it, but still the value had to come
| from exchange with dollars. I guess there is a question of
| how many people and how much of the economy you sweep up in
| the term 'criminal', because, as I understand, the vast
| majority of money that flows into criminal enterprise comes
| from illegal drug users with legal source income. At this
| point though, we made billionaires out of those criminals
| because ordinary 100% lawful citizens around the world fear
| the financial mismanagement, corruption, and/or
| authoritarianism of their own governments, depending on
| where they live. That's sad. Terrible outcome really.
| ryanlol wrote:
| > Crypto would have zero value if only criminals felt the need
| to use it.
|
| Of course it would
___________________________________________________________________
(page generated 2021-03-19 23:03 UTC)