Would any of the current botnets be able to launch and sustain a 51% attack?

The "owners" of botnets probably runs them as businesses, meaning that they will always seek profit-optimization. Do you believe that it is a matter of time before they will seek to launch and sustain a 51% attack on Bitcoins?

If one were to achieve a 51% attack, one would probably not get any significant amount of Bitcoins exchanged into ordinary currencies, before the value of Bitcoins would plummet. Also, I believe that at the moment, there are too few merchants that accept Bitcoins, so one would not be able to order anything of significant value before merchants would react to the fraud. Do you believe that the reason why botnets have not attacked Bitcoin, is that they would not have enough to gain, or is it because they do not have enough hashing power?

David

Posted 2011-11-12T11:11:00.760

Reputation: 3 304

Answers

If you want to profit from Bitcoins, you would not want to work against it (as was explained by Satoshi in his original paper). A 51% attack would not bring you profit, rather it would make everyone involved in the project loose, as Bitcoin's reputation would be damaged.

The other thing is getting enough hashing power. Unless you target mining-specific machines, chances of getting higher-end mining-compatible graphics cards isn't too high. So the trojan would have to rely on getting a lot of moderately powered PCs, and in order to launch a 51% attack, the botnet would have to be quite big. The biggest botnets, consisting of over 100'000 computers could potentially accomplish this, but so far Bitcoin isn't a prime target for botnet activity.

ThePiachu

Posted 2011-11-12T11:11:00.760

Reputation: 41 594

3One correction even 100,000 computers would be insufficient. Most computers don't have OpenCL capable GPU. CPU mining is rather weak with top of the line CPU pushing <20MH/s. The average botnet node is often a 4 or 5 year old XP box which was lackluster when built and is unlikely to push 20MH/s. Maybe 5MH/s. So 100K nodes would "only" be 500GH/s. At 5MH/s it would take ~1.6 million botnet nodes w/ average CPU to gain 51% control. Of course a 8TH/s botnet could generate ~$21K a day by mining instead of attacking. – DeathAndTaxes – 2011-11-13T02:50:27.997

Edited my answer to "potentially accomplish this". – ThePiachu – 2011-11-13T11:44:28.660

DeathAndTaxes' answer covers the main point:

Botnets are composed of computers with a wide range of hardware (mostly medium/low end) and you need very specific high end hardware to efficiently mine bitcoins.

I just want to add a few things about botnets. The largest botnets are estimated to have more than 1 million computers. So while the math makes an attack theoretically possible right now, in practice this is highly unlikely to happen. Here are a few reasons:

Nodes are not constantly up. A botnet with millions of infected computers has a percentage of offline nodes because most people do not leave the computer up all the time
Sustaining a 51% attack with a botnet is hard because people would notice the increase in CPU/GPU activity and would most likely shutdown their computer and investigate the problem
Botnets work because people don't know that their computer is infected. Launching an attack like this would make people run anti-virus scans to find out what is causing the heat and the noise. A botnet owner can make thousands of dollars with stolen credit card data and DDoS attacks. They will not risk losing that just to launch an attack like this. It is not worth it.

nmat

Posted 2011-11-12T11:11:00.760

Reputation: 10 879

2Your second bullet point - noticing activity isn't true. A smart attacker will simply keep the attack chain private. There will no warning signs the attack is occuring. Once attacker has a longer chain than the "legit" chain it will publish the chain at once. Clients will see this new "Attack chain" as longer and replace the existing chain instantly. The only warning will be after the fact when transactions simply go from confirmed to unconfirmed or invalid. – DeathAndTaxes – 2011-11-14T17:48:32.210

@DeathAndTaxes My second and third points are very similar. An attacker mining a private chain would see the hashing power the botnet constantly dropping because people would notice the heat/noise and shutdown the computer. So even if you start with a 8Thash botnet, that number will decrease with time and a lot of nodes will "clean" themselves from the infection. – nmat – 2011-11-15T02:17:33.053

@nmat If you do have enough zombies, each only needs to do a small little amount and it adds up to alot. – Pacerier – 2012-06-18T06:25:49.313

No.

The greatest element of security has come from the rise of specialized equipment.

Lets look at it in abstract form. If attackers and defenders have equivalent hardware then it becomes a numbers game. To "block" 100K attackers would require 100K defenders. Since botnets can be very large this is a dangerous dynamic. If the defenders are 5x as powerful then it only takes 20K defenders to hold off 100K attackers.

High end GPU are relatively rare in computing world and even more rare among botnet victims. A top of the line CPU can achieve 20MH/s while a top of the line GPU can achieve 800MH/s. That isn't a 5x multiplier but a 40x multiplier. Botnet nodes tend to be older systems with variety of CPU some far less capable than 20MH/s. Even a few year old CPU is much less capable. A Pentium IV for example only achieves 1 MH/s. It takes 800x Pentiums IV CPU to achieve the same hashing power as a single HD 6990.

So specialization has given the Bitcoin network a huge advantage over attackers. If we assume the average botnet CPU is capable of only 5 MH/s then to achieve 8TH/s of power would require 1.6 million botnet nodes. The rise of FPGA in time will make the Bitcoin network even more efficient giving defenders an even larger advantage over the average botnet node.

DeathAndTaxes

Posted 2011-11-12T11:11:00.760

Reputation: 8 269

In order to control 50% of the network assuming your introducing new hashing power you would need to match the current network hash rate.

So for example if the current network hash rate is 8GH/s the botnet would need to be able to at least match this number. Assuming a PC with a gpu can mine at a rate of 200Mh/s your looking at 40,000 computers. As not every machine has a suitable ATI graphics card it likely at lot of machines would only be able to cpu mine. For cpu mining at a rate of around 20MH/s your looking at 400,000 PC's - I don't think any botnets exist this size.

Obviously botnet owners do not need to worry about electricity costs so whether it is profitable for them depends on the opportunity cost of other forgoing normal operation.

Ben Reeves

Posted 2011-11-12T11:11:00.760

Reputation: 2 848