Crypto-currency Security under Scrutiny

Crypto-currency Security under Scrutiny

  12:47:00 AM    Science Lover

---

Reports that $500,000 worth of Bitcoin currency was stolen from one user's computer this week has highlighted the poor security of the digital cash and the systems available for managing it. For the currency to gain large-scale popularity, it may need to create or work with financial institutions—making Bitcoin less distinct from the conventional currencies some users hope to supplant.

An alleged robbery suggests Bitcoin—an anonymous,
decentralized currency may need bank-like institutions after all.

To use Bitcoin, a person downloads the official software client, which connects over the Internet to a global network of other copies of the program. Together, these implement the mathematical scheme that ensures that bitcoins can be transferred, created, and verified without any need for a central authority such as a bank (read How Bitcoin works).

That official client stores the security needed to use a stash of bitcoins with minimal security, in an unprotected file known as wallet.dat. In a forum post this week, a bitcoin user whose screen name was "allinvain" claimed that a remote attacker gained access to his or her wallet file and stole over 25,000 bitcoins. The value of a single bitcoin at the time of writing (just over $19) makes the alleged heist worth nearly $500,000, although in practice converting such a large number of bitcoins at once would be tricky. It is impossible for the alleged victim to know who stole the money because the cryptographic architecture of Bitcoin is designed to preserve the anonymity of people transferring the currency. Today the security company Symantec reported it had caught a piece of malicious software that infects computers over the Internet and attempts to steal wallet files.

The vulnerability highlighted by the controversy is very real, says Jeff Garzik, one of the lead developers of the official Bitcoin client and one of a few individuals who are the closest thing the currency has to official spokespeople. Today, anyone able to access the machines of Bitcoin users, either directly or remotely—via malicious software—can grab their wallet files, he acknowledges.



An upgraded version of the client, which will encrypt a person's wallet and ask for a password each time it is accessed, will be released in "just a week or two," says Garzik.

Yet users will still essentially be maintaining their own bank vaults on their computers. "[Wallet encryption] does nothing against many modern malware techniques, such as keystroke logging," says Garzik. He advises Bitcoin users to keep encrypted backups of their wallet files away from the Internet, for example on a USB stick, since the file is needed only when sending money to others.

This may be an option for technically minded early adopters. But if the currency is to be used more widely, a new generation of simple and secure tools for using bitcoins is needed, says Amir Taaki, who leads a U.K.-based consultancy of software developers working on a range of technologies for use with Bitcoin, which operates the exchange site Britcoin.

"Bitcoin is in the very early stages as a piece of software, and if you're a regular home user, then it's not for you at the moment," says Taaki. "It started as a plaything, and now we're at the stage that for Bitcoin to grow, it needs the software used to get money in and out to be more solid and secure."

Earning wider trust will likely require the Bitcoin ecosystem to become more like that of a conventional currency. Taaki and Garzik both say that in the future, there will be established, trustworthy exchanges to look after users' bitcoins, and online services to manage and disburse their cash.

That might go against the libertarian aspirations of some Bitcoin users, who are attracted by its decentralized nature and lack of any controlling authority. Yet the currency will still offer those features, says Patrick Strateman, a developer working on building more robust, secure software for bitcoin exchange sites. "The big difference here is that people will have a real option," says Strateman. "Everyone has the options offered by the old system, plus they have new options as well." Even if many users turn to bank-like organizations to keep their bitcoins safe, it will still be possible to use the less controlled (if riskier) methods that prevail today, he says.

Bitcoin exchanges would benefit from becoming friendlier to investigations of fraudulent transactions, says Taaki, though their doing so would make them even more like conventional banks. Claims by two U.S. senators last week that bitcoins' "untraceable" nature facilitated the purchase of illicit drugs were unfounded, says Taaki: the Bitcoin protocol is built around a public record of every transaction made with the currency. That log, called the "block chain," is maintained and stored by all Bitcoin clients and can be used to trace the movement of any and all bitcoins. But it records only the cryptic public keys that swapped funds, not the identities of the people using them. For example, an online version of the block chain can be used to see how the address "1KPTdMb6p7H3YCwsyFqrEmKGmsHqe1Q3jg" received 25,000 bitcoins this week, the transaction that allinvain complained about.

But Taaki says his Britcoin exchange will help authorities interpret the block chain in cases like money-laundering investigations, and could even correlate it with records of the identities of users of the exchange. The operator of the Mt Gox exchange, the largest bitcoin exchange in the world, has made a similar pledge, says Taaki. "We don't want Bitcoin to be outlawed by well-meaning but ignorant regulators."