Would any of the current botnets be able to launch and sustain a 51% attack?

Question

The "owners" of botnets probably runs them as businesses, meaning that they will always seek profit-optimization. Do you believe that it is a matter of time before they will seek to launch and sustain a 51% attack on Bitcoins?

If one were to achieve a 51% attack, one would probably not get any significant amount of Bitcoins exchanged into ordinary currencies, before the value of Bitcoins would plummet. Also, I believe that at the moment, there are too few merchants that accept Bitcoins, so one would not be able to order anything of significant value before merchants would react to the fraud. Do you believe that the reason why botnets have not attacked Bitcoin, is that they would not have enough to gain, or is it because they do not have enough hashing power?

Answer 1

If you want to profit from Bitcoins, you would not want to work against it (as was explained by Satoshi in his original paper). A 51% attack would not bring you profit, rather it would make everyone involved in the project loose, as Bitcoin's reputation would be damaged.

The other thing is getting enough hashing power. Unless you target mining-specific machines, chances of getting higher-end mining-compatible graphics cards isn't too high. So the trojan would have to rely on getting a lot of moderately powered PCs, and in order to launch a 51% attack, the botnet would have to be quite big. The biggest botnets, consisting of over 100'000 computers could potentially accomplish this, but so far Bitcoin isn't a prime target for botnet activity.

Answer 2

DeathAndTaxes' answer covers the main point:

Botnets are composed of computers with a wide range of hardware (mostly medium/low end) and you need very specific high end hardware to efficiently mine bitcoins.

I just want to add a few things about botnets. The largest botnets are estimated to have more than 1 million computers. So while the math makes an attack theoretically possible right now, in practice this is highly unlikely to happen. Here are a few reasons:

• Nodes are not constantly up. A botnet with millions of infected computers has a percentage of offline nodes because most people do not leave the computer up all the time

• Sustaining a 51% attack with a botnet is hard because people would notice the increase in CPU/GPU activity and would most likely shutdown their computer and investigate the problem

• Botnets work because people don't know that their computer is infected. Launching an attack like this would make people run anti-virus scans to find out what is causing the heat and the noise. A botnet owner can make thousands of dollars with stolen credit card data and DDoS attacks. They will not risk losing that just to launch an attack like this. It is not worth it.

Answer 3

No.

The greatest element of security has come from the rise of specialized equipment.

Lets look at it in abstract form. If attackers and defenders have equivalent hardware then it becomes a numbers game. To "block" 100K attackers would require 100K defenders. Since botnets can be very large this is a dangerous dynamic. If the defenders are 5x as powerful then it only takes 20K defenders to hold off 100K attackers.

High end GPU are relatively rare in computing world and even more rare among botnet victims. A top of the line CPU can achieve 20MH/s while a top of the line GPU can achieve 800MH/s. That isn't a 5x multiplier but a 40x multiplier. Botnet nodes tend to be older systems with variety of CPU some far less capable than 20MH/s. Even a few year old CPU is much less capable. A Pentium IV for example only achieves 1 MH/s. It takes 800x Pentiums IV CPU to achieve the same hashing power as a single HD 6990.

So specialization has given the Bitcoin network a huge advantage over attackers. If we assume the average botnet CPU is capable of only 5 MH/s then to achieve 8TH/s of power would require 1.6 million botnet nodes. The rise of FPGA in time will make the Bitcoin network even more efficient giving defenders an even larger advantage over the average botnet node.

Answer 4

In order to control 50% of the network assuming your introducing new hashing power you would need to match the current network hash rate.

So for example if the current network hash rate is 8GH/s the botnet would need to be able to at least match this number. Assuming a PC with a gpu can mine at a rate of 200Mh/s your looking at 40,000 computers. As not every machine has a suitable ATI graphics card it likely at lot of machines would only be able to cpu mine. For cpu mining at a rate of around 20MH/s your looking at 400,000 PC's - I don't think any botnets exist this size.

Obviously botnet owners do not need to worry about electricity costs so whether it is profitable for them depends on the opportunity cost of other forgoing normal operation.