What can be done about the no-transaction block relayer (currently 71.123.170.150)?

An unknown major solo miner (currently IP 71.123.170.150), most likely a botnet, is relaying blocks with zero transactions. Two weeks ago this miner constituted ~15% of the network, now it constitutes ~30%. If the growth rate continues, in about two weeks this miner (most likely a botnet) will control more than half of the network, theoretically allowing a 51% attack. It has already orphaned two perfectly valid blocks. (Thread on BitcoinTalk)

It seems to me we have an imminent threat to Bitcoin itself. Requiring transactions to be included in a block won't work; the miner can just send coins to itself. Blacklisting IPs in the client won't work; the miner can easily switch IPs. How can we stop this?

BinaryMage

Posted 2012-03-31T16:21:56.437

Reputation: 1 336

Maybe possible to prevent mystery miner to grow by using a formule to decrease payment for higher hashrates – None – 2013-06-26T08:48:26.923

I think that you're wrong about it going from 15% to 30%. See this post

– D.H. - bitcoin.se – 2012-03-31T18:13:04.600

@D.H. I was using the data as according to Blockchain.info.

– BinaryMage – 2012-03-31T18:18:09.723

1Assuming the growth rate in % can be constant is a common fallacy. – o0'. – 2012-04-02T07:39:32.243

@Lohoris You are entirely correct. I think you will agree, however, that there is a possibility of the % rate remaining constant (botnets generally grow exponentially at the start), and since it could pose a serious threat to the network, IMO being perhaps overly cautionary is never a bad thing. – BinaryMage – 2012-04-02T23:45:34.307

1@BinaryMage no, it is absolutely impossible for a % of growth to be constant. You'll run out of % points as you progress, since the % total is fixed, so this just can't happen. Furthermore, even a constant (non %) growth is very difficult to achieve, let alone an exponential one (though this is at least possible, to a point). – o0'. – 2012-04-03T11:43:22.837

1@Lohoris I suppose I should have clarified. Going from 15% to 30% of the network indicates hashing growth of over 100%. (more than doubling) It is entirely possible, but not necessarily likely, that it would double again in the next two weeks. Now, the percentage share of the network obviously cannot grow beyond 100%. But if the botnet grew at the same rate as in the past two weeks, it would reach ~46% of the network, and 50% in a few days. Does that make more sense? – BinaryMage – 2012-04-04T00:36:18.910

Answers

There are too many issues rolled up into this question, I'll try to address each separately.

The fact that the miner does not include transactions is not a problem. Miners have a right to exclude transactions, even all transactions. Senders can include tx fees if they want to improve the chances of being included quickly (if the miner excludes transactions due to its nature of operation an individual fee won't help much, but if the general fee level increases, 0-tx miners will be much less profitable and thus less influential).
The fact that there is a mining botnet is a problem insomuch as we don't want Bitcoin to be an enabler of harmful activities, but it does not harm Bitcoin itself. It is likely that new FPGA- and ASIC-based mining products will make CPU-based botnets less effective.
Orphaned blocks are a normal occurrence in the functioning of the network, and an occasional orphan by this particular miner is of no concern.
If the miner starts rejecting longer branches (as in a 51% attack) it is a problem, but it is a heavily discussed core problem which is not specific to botnets and is not yet resolved. I am of the opinion that a proof-of-stake system can drastically mitigate the problem (and will probably make botnets less effective miners).
If we want as a matter of principle to discourage blocks that have little or no transactions, we can include some measure of transaction volume in the branch selection criterion. One such measure is Bitcoin days destroyed. It is resistant to manipulation by sending the same coins to oneself again and again, because such coins will only destroy few days each time.

Meni Rosenfeld

Posted 2012-03-31T16:21:56.437

Reputation: 18 542

1Proof-of-stake is worse in every critically important way. It not only concentrates wealth letting the rich gain most of the mining. By the same point that the barrier to entry for the monopolist is higher, so is the barrier to removing the monopolist. The monopolist can harm the network without harming himself because it gives him the power to fork the system. Govts have deep pockets and hate anonymity. War on Terror is an example that majority are sheep and will follow the official forks. Once you lose decentralized control, you'll never be able to compete to get it back! THINK PLEASE! – Shelby Moore III – 2013-03-20T20:26:51.113

My main question was about the possibility of a 51% attack, but thanks for elaborating. Your proof-of-stake implementation proposal on the wiki is extremely useful, linking it for reference.

– BinaryMage – 2012-03-31T18:30:48.440

As the miner is obeying the protocol rules, one can't do much without altering the protocol. You could require the client to reject blocks that don't include some transactions that should be in the blocks, limit mining only to people with some accepted keys to sign a transaction or the like, but in the end this would probably not solve the problem.

If it was later in Bitcoin maturity, it wouldn't be much of an issue - block rewards will be coming mainly from transactions, so someone rejecting all transactions wouldn't be earning much. If this was an attempt at destroying the Bitcoin network, however, it would still be a problem.

What the Bitcoin community can do is get more mining power into the network, for example by raising the price of Bitcoins so they would be more profitable. You could also contact the owner of that IP address (since it links to a web page if typed in the address bar) for explanations.

ThePiachu

Posted 2012-03-31T16:21:56.437

Reputation: 41 594

The website is likely that of a PC in the botnet - it's a personal site. Domain is registered to a Bryan Wyatt in Texas. – BinaryMage – 2012-03-31T18:27:07.197

3I suspect that the server behind that IP was compromised, and thus contacting him won't gain you much beyond reducing the botnet by one member. – CodesInChaos – 2012-03-31T18:42:39.650

As the mystery miner continues to grow prior to 51%, it will only delay legitimate transactions. Economic factors should limit profitability of zero transaction blocks, as the value of a bitcoin would decline when usage of the network becomes hampered enough to become a deterrent rather than an incentive.

As the exchange value of a bitcoin falls, it wouldn't make sense to commit resources to mining in the first place. Going the other way, a rise in bitcoin prices would encourage network expansion - including mining. That would increase the 51% mark, making it more difficult for the mystery miner to attain the majority.

Also, if the miner is a botnet, ASIC/FPGA mining should make it a transient threat. Halving of the block reward within the next several months will cut profitability of zero transaction mining as well. This is assuming the 51% level is not achieved, allowing economic forces to remain the primary means of limiting this miner.

miscreanity

Posted 2012-03-31T16:21:56.437

Reputation: 99