Preparing for Bad Actors

No, not Nicholas Cage.

Inevitably, bad actors will attempt to take advantage of our network. Unless we are proactive, it could really be devastating to the project.

Precedent
Helium is plagued by GPS spoofing. Scammers have installed hundreds of hotspots in a single room when they normally must be spaced 300 maters apart. They have raked in 10’s of millions in HNT. Helium was extremely slow to act and only attempted to fix the problem this last month.

Chia has been experiencing a “duststorm” for nearly a year. Their feeless system is being taken advantage of by creating millions of micro transactions. This is filling up the SSD’s in smaller nodes and forcing them offline (happened to me).

What will they attempt on us?
We don’t know exactly how people attempt to take advantage of us. But there are some obvious threats. I don’t have any qualms sharing these, people more clever than me will think of more sneaky things.

Some that come to mind:
Faking capacity - It is possible to trick an OS into thinking a drive is larger than it really is. This is a common ebay scam. It may also be possible to cheat on CPU or memory size.

OS download source - The OS may have a limited attack surface, but how secure is the site hosting the bootimage? Could it be replaced with something malicious?

Bandwidth Abuse - A 40U rack on a dial up connection adds nothing to the network and inflated the amount of TFT. People are really start to build up their server farms. I often check with them on their bandwidth and so far its been good. I know bandwidth monitoring is in the works but a close eye should be kept on this until then.

Lets brainstorm on solutions to these and identifying other potential weaknesses.
(note bandwidth discussion has been taking place on another thread)

4 Likes

Hi @FLnelson. Indeed people always find dubious ways to extract value (=money) from a project. If I may expand your throughs a little there are two main categories to consider:

  • farming: extract more value than what the real hardware represents
  • cultivation: use (more) capacity without payout the appropriate amount of TFT’s for it.

The other cases you mentioned we already have eyes on. Bandwidth is going to be tested and indexed and will be a requirement that gets tested to make the monthly minting minimal requirements. Fake zero-OS’s (forked zero-OS’s with some extra functionality like. backdoors etc.) is covered by so called certified capacity. Certifief hardware is booting a single version of zero-OS that is signed. You cannot boot a non-signed version of zero-OS. Today the signing is done by ThreeFold (Titan’s being the first certified hardware in the physical form) but in the future, we want to create more certified hardware providers done by people that we (we being the DAO…) know and trust (we are strong believers that trust is a people business, not just an algorithm business).

2 Likes