BitCluster Brings a New Way to Snoop Through BitCoin Transactions

Mining the wealth of information in the BitCoin blockchain is nothing new, but BitCluster goes a long way to make sense of the information you’ll find there. The tool was released by Mathieu Lavoie and David Decary-Hetu, PH.D. on Friday following their talk at HOPE XI.

I greatly enjoyed sitting in on the talk which began with some BitCoin basics. The cryptocurrency uses user generated “wallets” which are essentially addresses that identify transactions. Each is established using key pairs and there are roughly 146 million of these wallets in existence now

If you’re a thrifty person you might think you can get one wallet and use it for years. That might be true of the sweaty alligator-skin nightmare you’ve had in your back pocket for a decade now. It’s not true when it comes to digital bits —  they’re cheap (some would say free). People who don’t generate a new wallet for every transaction weaken their BitCoin anonymity and this weakness is the core of BitCluster’s approach.

Every time you transfer BitCoin (BTC) you send the network the address of the transaction when you acquired the BTCs and sign it with your key to validate the data. If you reuse the same wallet address on subsequent transactions — maybe because you didn’t spend all of the wallet’s coins in one transaction or you overpaid and have the change routed back to your wallet. The uniqueness of that signed address can be tracked across those multiple transactions. This alone won’t dox you, but does allow a clever piece of software to build a database of nodes by associating transactions together.

Mathieu’s description of first attempts at mapping the blockchain were amusing. The demonstration showed a Python script called from the command line which started off analyzing a little more than a block a second but by the fourth or fifth blocks hit the process had slowed to a standstill that would never progress. This reminds me of some of the puzzles from Project Euler.

bitcluster-how-it-worksAfter a rabbit hole of optimizations the problem has been solved. All you need to recreate the work is a pair of machines (one for Python one for mondoDB) with the fastest processors you can afford, a 500 GB SSD, 32 GB of RAM (but would be 64 better), Python 64-bit, and at least a week of time. The good news is that you don’t have to recreate this. The 200GB database is available for download through a torrent and the code to navigate it is up on GitHub. Like I said, this type of blockchain sleuthing isn’t new but a powerful open source tool like this is.

Both Ransomware and illicit markets can be observed using this technique. Successful, yet not-so-cautious ransomers sometimes use the same BitCoin address for all payments. For example, research into a 2014 data sample turned up a ransomware instance that pulled in $611k (averaging $10k per day but actually pulling in most of the money during one three-week period). If you’re paying attention you know using the same wallet address is a bad move and this ransomware was eventually shut down.

Illicit markets like Silk Road are another application for BitCluster. Prior research methods relied on mining comments left by customers to estimate revenue. Imagine if you had to guess at how well Amazon was doing reading customer reviews and hoping they mentioned the price? The ability to observe BTC payment nodes is a much more powerful method.

A good illicit market won’t use just one wallet address. But to protect customers they use escrow address and these do get reused making cluster analysis possible. Silk Road was doing about $800k per month in revenue at its height. The bulk of purchases were for less than $500 with only a tiny percentage above $1000. But those large purchases were likely to be drug purchases of a kilo or more. That small sliver of total transactions actually added up to about a third of the total revenue.

bitcluster-logoIt’s fascinating to peer into transactions in this manner. And the good news is that there’s plenty of interesting stuff just waiting to be discovered. After all, the blockchain is a historical record so the data isn’t going anywhere. BitCluster is intriguing and worth playing with. Currently you can search for a BTC address and see total BTC in and out, then sift through income and expense sorted by date, amount, etc. But the tool can be truly great with more development. On the top of the wishlist are automated database updates, labeling of nodes (so you can search “Silk Road” instead of a numerical address), visual graphs of flows, and a hosted version of the query tool (but computing power becomes prohibitive.)

Network Security Theatre

Summer is nearly here, and with that comes the preparations for the largest gathering of security researchers on the planet. In early August, researchers, geeks, nerds, and other extremely cool people will descend upon the high desert of Las Vegas, Nevada to discuss the vulnerabilities of software, the exploits of hardware, and the questionable activities of government entities. This is Black Hat and DEF CON, when taken together it’s the largest security conference on the planet.

These conferences serve a very important purpose. Unlike academia, security professionals don’t make a name for themselves by publishing in journals. The pecking order of the security world is determined at these talks. The best talks, and the best media coverage command higher consultancy fees. It’s an economy, and of course there will always be people ready to game the system.

Like academia, these talks are peer-reviewed. Press releases given before the talks are not, and between the knowledge of security researchers and the tech press is network security theatre. In this network security theatre, you don’t really need an interesting exploit, technique, or device, you just need to convince the right people you have one.

Continue reading “Network Security Theatre”

I Am Satoshi Nakamoto

OK, you got me. I’m not. Neither is Dorian Nakamoto, pictured above, and neither is this [Craig White] guy. Or at least, his supposed proof that he is “Satoshi” doesn’t stand up to scrutiny. Indeed, you can re-create it yourself and pretend to be “Satoshi” too.

If you haven’t been following along, “Satoshi Nakamoto” is the person or group of people who invented Bitcoin, and who holds a decent fortune’s worth of the currency. He’s been exceedingly careful at keeping his identity secret. So much so, that upon hearing another “We Found Satoshi” story in the news, we actually laughed at our wife this morning. But then it was picked up by the BBC and is forthcoming in the Economist. Serious journalism.

Well, if you read the BBC piece, they note that “Security expert Dan Kaminsky said the procedure was almost ‘maliciously resistant’ to validation.” Hint: If Dan “DNSSEC” Kaminsky can’t verify a signature, there’s a good chance it’s not the real deal.

The really embarrassing part is that this [Craig White] character claimed to be Satoshi in December 2015. If he actually were Satoshi, who is probably a cryptographic genius, do you think it would take him five months to figure out a cryptographically sound way of proving his identity? Nope.

So here’s how he did it, according to [Patrick McKenzie]’s GitHub, linked above. There is a hashed secret out there that only “Satoshi” knows. Hashes are one-way functions; they produce a number that’s easy to calculate if you know the original data, but devilishly hard to work from the hash backwards to get the data out. This hashed value is public, and part of the blockchain, so we can be pretty sure that it hasn’t been altered.

[Craig] claimed to have some text from Sartre hashed with “Satoshi’s” key, and that this proves his identity. But instead of providing the hash of the Sartre text, [Craig] apparently substituted a hash from the blockchain. When this supposed Sartre hash is validated against the blockchain, of course, it works. In short, he swapped hashes, and people failed to notice.

So I’m not “Satoshi”, and neither is this guy. Who is? The mystery continues. And given how careful “Satoshi” has been so far, it’s likely to remain so for a long while. But one thing’s for sure, when “he” does choose to reveal himself, it won’t be difficult to verify. After all “Satoshi” knows “Satoshi’s” password.

Image via the BBC, of another guy who isn’t “Satoshi”.

(Late Edit: Here’s another really nice writeup, this one by [ErrataRob].)

Applications for the Bitcoin Blockchain

Bitcoin, the libertarian’s dream currency, is far past the heady days of late 2013. When one Bitcoin was worth $1000 USD, there was no end to what could be done; new, gigantic mining rigs were being created, every online store jumped onto the bandwagon, and the price of Bitcoin inevitably crashed. Right now, the exchange rate sits at about $280 USD per coin, valuing all the Bitcoins ever mined somewhere around $4 Billion USD. That’s a lot of coins out there, and a lot of miners constantly verifying the integrity of the greatest thing to come from the Bitcoin community: the blockchain.

The bitcoin is just a record, or the ledger, of every transaction that has ever occurred on the Bitcoin network. It’s distributed, and the act of mining coins creates new blocks, or another set of data committed to the blockchain for eternity. While magical Internet money™ is by far the most visible product of the blockchain, developers, investors, and other people in the know are gushing about the possibilities of what can be done with a distributed record that can’t practically be altered and can’t be deleted.

[Jon Matonis], a figurehead for the entire cryptocurrency movement, recently said Bitcoin has become the strongest computer in the world, and stronger than all of the top 500 supercomputers combined. All of this computational power is effectively funneled in to verifying the integrity of the blockchain.

Bitcoin and other cryptocurrencies are not just a completely anonymous payment system; that’s only a side effect of the blockchain. The blockchain is the only inherently valuable part of a bitcoin; each transaction is logged in the blockchain, providing incredible security over how every coin is spent. No currency in the history of mankind has ever had a record of how every dollar or denarius is spent, and at the very least makes for very interesting economics research. Now, thousands of researchers across the globe are wondering what else the blockchain can do; tapping the power of the most powerful computer on the planet must have some interesting applications, and in the last few months, a few ideas have popped up.

Continue reading “Applications for the Bitcoin Blockchain”

Tracking Bitcoin With The ESP8266

[Kendrick] was looking for something to do with an ESP8266 WiFi module, and since he loves Bitcoin and Arduino, the obvious solution was to make a Bitcoin price tracker.

The ESP8266 is a complete microcontroller with a WiFi chip and a few pins for a serial connection. It’s certainly possible to write some firmware for the ESP to get the current conversion rate of Bitcoin, but for simplicity’s sake, [Kendrick] chose to use an Arduino for this project. He’s using a 5V Arduino, and the ESP operates on 3.3V logic, but a few Zeners take care of the logic level conversion.

The code running on the Arduino checks the CoinDesk API minute, parses the JSON coming from the API, and prints the current Bitcoin price to the serial port. For tracking the current conversion rate of Bitcoin, it’s vastly overkill. This project could have a few interesting applications, from hooking up a few seven-segment displays, to an RGB LED mood lamp that keeps track of this magic Internet money.

The Most Powerful Bitcoin Mining Rig Yet

In days of yore, one could mine Bitcoin without much more than an AMD graphics card. Now, without specialized hardware it’s unlikely that you’ll make any appreciable headway in the bitcoin world. This latest project, however, goes completely in the other direction: [Ken] programmed a 55-year-old IBM mainframe to mine Bitcoin. Note that this is technically the most powerful rig ever made… if you consider the power usage per hash.

Engineering wordplay aside, the project is really quite fascinating. [Ken] goes into great detail about how Bitcoin mining actually works, how to program an assembly program for an IBM 1401 via punch cards, and even a section about networking a computer from this era. (Bonus points if he can get to load!) The IBM boasts some impressive stats for the era as well: It can store up to 16,000 characters in memory and uses binary-coded decimal. All great things if you are running financial software in the early ’60s or demonstrating Bitcoin in the mid-2010s!

If it wasn’t immediately obvious, this rig will probably never mine a block. At 80 seconds per hash, it would take longer than the lifetime of the universe to do, but it is quite a feat of computer science to demonstrate that it is technically possible. This isn’t the first time we’ve seen one of [Ken]’s mainframe projects, and hopefully there are more gems to come!

Hackaday wants all your Bitcoin

Bitcoin, the solution to the two generals’ problem, an economic case study in the history of currency, and the reason AMD graphics cards were so expensive a few years ago, is now accepted in The Hackaday Store.

Yes, we have a store, loaded up with swag, tools, and cool toys. We’re always stocking more  If you have coin sitting around, you can pick up a great little logic analyzer, a 3D printer, an ingenius two channel multimeter, ESP8266 boards, the ever popular Hackaday swag and a ton more. That 3D printer will cost you ฿ 3.75. A Mooshimeter is just ฿ 0.50.

It’s the perfect time to turn magical Internet money into something with real, intrinsic value, before the value of Bitcoin drops even more. Sure, we accept government-backed currency as well… but when will you have the chance to spend those hard-mined dollars hashes?