This Bitcoin Core update will protect full node operators from hacks

Core developers have released an update to the world’s most popular Bitcoin software that will protect node operators from malicious actors introducing a fake version of Bitcoin’s blockchain. The revision, which developers have designated Bitcoin Core 25717, also adds defenses against various Denial-of-Service (DoS) attacks.

When a node operator downloads Bitcoin Core software for the first time, they must also download the current Bitcoin blockchain (a large, 426GB file). During this initial block download, the old software would only perform relatively rudimentary checks of block headers to check for a canonical version of the blockchain.

Bitcoin Core 25717, however, adds a long-awaited “Headers Presync” phase to the software’s pre-synchronization protocol. The upgrade replaces easy-to-hack, hard-coded values in Headers Presync with far more secure Proof of Work puzzles. This protects node operators from a malicious actor introducing a fake version of Bitcoin’s blockchain into their node.

A full node operator in Bitcoin stores the entire blockchain since inception, including every transaction that has occurred since 2009. In this way, operators can fully validate any proposed transactions — on their own hard drive, without trusting anyone — to guarantee that nobody double-spends coins.

Other improvements in Bitcoin Core 25717

In addition to addressing vulnerabilities in the initial block download, Bitcoin Core 25717’s new Headers Presync adds security during synchronization. Because a new block of data is added to Bitcoin every 10 minutes, nodes must sync again after they download the 426GB file. As time goes by, nodes must also synchronize periodically, especially after power or internet outages. Bitcoin Core 25717 improves the security of these syncs.

The software update also addresses DoS attack vectors, which can prevent nodes from downloading the canonical blockchain. In addition, the update reduces memory “overhead” by downloading presync data before downloading the entire blockchain.

Finally, the update also adds support for transient, one-time, Invisible Internet Project (I2P) addresses. I2P is a network layer for censorship-resistant, anonymous, peer-to-peer communication.

Read more: This Twitter account documents Bitcoin eating the world

Is Bitcoin still vulnerable to other hacks?

With over a decade of operation and a multi-hundred billion dollar bounty that no hacker has yet been able to steal, experts generally agree that hacking Bitcoin is becoming increasingly unlikely. Considering the sheer amount of mining machines securing Bitcoin, a 51% attack has become prohibitively expensive.

Any other attack, such as hacking the GitHub repository or compromising a Bitcoin Core lead maintainer, would have to introduce a change and get past other lead maintainers, node operators, and miners. A compromised full node that accidentally downloaded a fake blockchain would be incompatible with the Bitcoin network because the data on its blockchain would not “agree” with the data on other nodes.

At least one attempt to sidestep user consensus — a Bitcoin fork called Bitcoin XT — failed because it couldn’t get enough supporters on board.

Bitcoin Core 25717 provides an additional layer of security by making it more difficult to introduce a malicious blockchain into new full nodes or to conduct DoS attacks. Bitcoin Core’s update makes nodes less likely to accept malicious data or suffer silent attacks that prevent them from downloading the valid, canonical Bitcoin chain.

For more informed news, follow us on Twitter and Google News or listen to our investigative podcast Innovated: Blockchain City.