Go Back   Ultimate Web Site Drop Down Menu Forum > News and Information > General Web Trends and News
Register FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
Thread Tools Display Modes
Unread 02-11-2014, 06:22 AM
sl4shd0t
Posts: n/a
  #1  
Default Surrogate Database Key, Not Bitcoin Protocol Flaw, To Blame For Mt Gox Problems

An anonymous reader writes "Bitcoin values dropped sharply over the weekend after the largest trading exchange, MtGox, revealed that an investigation into unusual trading activity turned up a flaw in the underlying Bitcoin software that allowed an attacker to double withdrawal a transaction" Not so fast according to database experts: the real problem is that Mt Gox (and other exchanges) are using a surrogate transaction id rather than a natural key in their databases: "The flaw isn't so much in Bitcoin as it is in exchange-systems. Many exchanges use the tx-id to uniquely identify transactions, but as it turns out, an attacker can change the tx-id without changing the actual transaction, rebroadcast the changed transaction (effectively creating a double-spend) and if his altered transaction gets accepted into a block instead of the legit transaction, the attacker receives his coins and can complain with the exchange that he didn't. The exchange will then check their db, fetch the tx-id from it, look it up in the blockchain and not find it. So they could conclude that the transaction indeed failed and credit the account with the coins. ... A simple workaround is to not use the tx-id to identify transactions on the exchange side, but the (amount, address, timestamp) instead."

Read more of this story at Slashdot.









More...
Reply With Quote
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump


All times are GMT. The time now is 08:41 PM.


Powered by vBulletin® Version 3.0.1
Copyright ©2000 - 2017, Jelsoft Enterprises Ltd.