When initially running a cryptocurrency client, it needs to fetch peers from a centralized source. If an attacker gains control of all of a client's default peers servers, they would be able to restrict the client's access to the rest of the peers. Then, they can give the client fake data and there would be no way for the client to tell.

Are we just ignoring this issue because it'll be hard to gain control of the servers?

... it needs to fetch peers from a centralized source.

Not exactly. Once you are connected to the network, you will begin to receive lists of IP addresses and ports of known clients.

There is a list of seednodes built into Bitcoin. These addresses are only used as a last resort.

After you connect to the network once, you won't need to use the DNS seeds, etc. anymore. The Bitcoin network has a system which allows every network participant to (over time) get the IP addresses of all other network participants. Bitcoin stores this info in a local database(peers.dat) and contacts these nodes when it next starts.

Are we just ignoring this issue because it'll be hard to gain control of the servers?

Note that if user have found out that he is under attack, he just needs to connect to one real Bitcoin node. It would be "quite difficult" for an attacker to pull this off, and probably not financially worth the while.

If an attacker gains control of all of a client's default peers servers, they would be able to restrict the client's access to the rest of the peers.

No, because if the DNS servers were shut down, everyone would just post their node ips in their signature on bitcointalk.org or their facebooks or any million other sites.

Then it just requires new participants to find ONE IP address somewhere and that node will send you a list of more IPs and so on.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.