Bitcoin Alert Key Disclosure and DoS Risk Analysis

Vulnerability Key Information Vulnerability Overview Subject: [bitcoin-dev] Alert key disclosure Date: July 2, 2018 Author: Bryan Bishop Main Vulnerability Potential Service Attacks Denial of Service (DoS) Attack: - Due to the use of mappings with unlimited size, attackers can exploit the Alert key to perform DoS attacks, causing nodes to crash or be terminated due to memory exhaustion. Affected Systems and Recommended Actions Affected Systems: - Nodes containing the old Bitcoin alert system (running v0.12.x or older versions) - Certain altcoins and software that still use the old Alert System may also be affected. Recommended Actions: - Upgrade to the latest version to avoid using the deprecated alert system - Bitcoin will issue a final alert (including the maximum ID number) requiring all vulnerable nodes to upgrade. Preventing Secondary Spread and Abuse Private Key Disclosed: - Bitcoin Core developers, after research, chose to disclose the Alert key for the following purposes: - To reduce the risk of the Alert key being abused by unknown third parties. - To prevent potential DoS attack issues caused by the key. Multiple Keys Disclosed: Both public and private keys for mainnet and testnet are disclosed. Additional Links [0] Original email thread: https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2016-September/013104.html [2] Information about Alert System retirement: https://bitcoin.org/en/alert/2016-11-01-alert-retirement

Goal Reached Thanks to every supporter — we hit 100%!

Bitcoin Alert Key Disclosure and DoS Risk Analysis