7

With the version 0.6, Bitcoin introduced the DNS servers that populate the initial peers for new clients. How secure are those servers in terms of being immune to takedown attacks, or injection of malicious data?

Improve this question
2
  • It doesn't matter that much since this is one seed method among several and an attacker would have to control all 8 of your outbound connections to cause you harm. So far as I know, the provided DNS seeds weren't audited for security against attacks from the outside but just were provided by people who were themselves trustworthy and who were able to offer the service. For example, one is run by Vladimir Marchenko.
    – David Schwartz
    May 2, 2012 at 5:29
  • Vladimir did run a DNS seed, but it was removed from bitcoind's source code in october 2011 (at his request). See my post below for more details.
    – Pieter Wuille
    May 5, 2012 at 1:40

1 Answer 1

Reset to default
9

There are some differences between DNS seeding and the IRC method. IRC used to function as a meeting point; essentially a centralized broadcast system to let (all) other nodes know about your existance, but it failed to answer the query "who is online now?". This means that when using IRC as a publically reachable node, you would often see a peak of incoming connections quickly, but little activity afterwards. Obviously, it was also vulnerable to DOS attacks as a centralized point of failure.

DNS seeds are much more intended to work as seeds: they provide nodes with a few reliable entry points into the network, but let the actual discovery of new nodes be done by the network itself (peers exchange other peer's IP addresses). Futhermore, the DNS system is capable of server much larger numbers of nodes.

To answer your actual question: the DNS servers themselves may be be vulnerable to attacks, but it is important to realize that they are far less essential to the network than IRC was. Also, the 4 active DNS seeds are operated by different people, and managed quite differently:

  • Jeff's node (bitseed.xf2.org), is currently a static list, updated mostly manually and infrequently, but hosted very reliably.
  • Matt's node (dnsseed.bluematt.me), is served by a BIND server (typical DNS server software), which is fed a fresh list of reliable nodes by a crawler every few minutes or seconds.
  • Luke's (dnsseed.bitcoin.dashjr.org) and my node (seed.bitcoin.sipa.be) run a custom DNS server+crawler system, which reports a random set of reliable nodes for each query.

One further remark on your question: the DNS seeding system was introduced in v0.3.21 (april 2011), and turned on by default in v0.3.24 (juli 2011). Since 0.6.0 (march 2012), IRC seeding is off by default. As of 0.8.2 (not yet released), IRC support will be removed entirely.

Improve this answer
2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.