Centralized Digital Coin Exchanges


#1

From the network security and availability point of view, it is preferred that digital exchange uses their own IP addresses. Our researches shows that 90% of the digital exchanges are hosted in Cloudflare, AWS or Incapsula. Also none of the digital exchanges uses their own IP addresses.

Couple of issues are identified.

  1. Too much centralized, traditional banks online transactions are more decentralized

  2. Your addresses are summarized with other services when the cloud service provider advertise the IP segments to internet, which means a bad actor can advertise a detailed prefix so that you are not reachable from the internet until the upstream ISPs identify and stop the bad actor ( IP highjacking).

  3. Less redundancy as not multihomed.

We are concerned as network engineers, whether these issues are thought or not.
Would like to know what the network designers of BISQ think regarding our above concern.

Best Regards,
Ganga


#2

Can you provide the source of this data and also the actual research please?


#3

Furthermore @ganganath Bisq is open source and all the reference documents can be found on github.

All the answers to your questions are here : https://github.com/bisq-network/docs/blob/master/dao/phase-zero.adoc#Part-I


#4

We checked all the known digital coin exchanges to see what IP addresses they used to host their site(Gateway for users) to buy and sell. I am not talking about master nodes or other relay nodes working in the background.

Attached diagram shows the most of the Digital Coin Exchanges.


#5

Hi Nolaan,

Thanks I will go through it. Hope I will find the information I am looking for.


#6

Please do because bisq sits on top of Tor and trades are made in a P2P fashion. I was hoping for data with text and number, not a picture.

Regards


#7

This is not that much of unknown information. You just need to check the network status of other organizations. Let me think again before sending it to you.

I think that BISC exchange will be unreachable if /24 network is advertised to internet by a bad actor.
Do you think this is not a problem with your technology?

Then it is really great to heat.

Best Regards,
Ganga


#8

I’m not sure I understand this part. Can you elaborate a little be more for me please. ELI5


#9

Sure,

bisq.network
54.250.174.92
AS16509
54.250.128.0/18
Amazon
Japan

Above is the the address of the BISQ exchange.
Now assume somebody say 54.250.174.0/24 is available in Russia or Brazil or India, then internet believes it, until Amazon complains to those ISPs who believed that information.

You may search internet on ‘IP Prefix hijacking’ for details.

Internet works on a protocol called BGP. Most specific information ( routing prefix) get prioritized.
Even Amazon is keep on advertising to the internet saying 54.250.128.0/18 is Amazon, if a small network operator with an AS may advertise 54.250.174.0/24 as them self.
So all the traffic from the internet to bisq.network goes to them and not to Amazon. It is called IP Prefix highjacking.
Of course after a couple of hours we can stop that but some times it takes longer.

This is why it is important to have your own addresses and AS number when critical services are running.

I hope to provide you more information.
Please keep in touch.

Best Regards,
Ganga


#10

These are some famous highjacking.
A small prefix hijack like a /24 or /20 is almost not discussed as it happens daily basis.

There are mechanisms such as RPKI but in reality it is not fully implemented.
You may ask Amazon to advertise /24s then this issue is addressed.

Of course there are other advantages of having your own network like the banks do.
More control
robust DDoS prevention mechanism
Better redundancy
You need a network engineer but considering a major digital exchange this is of course not a cost


#11

Thank you for the clarification, now I better understand your concerns. Again, Bisq is decentralized read the white paper to understand what you are dealing with. I’m not sure how practical this approach will be apart then distributing fake executable but then those executable must hijack the p2p network to make an attack workable. Anyway if you want more info Manfred will help you. Unless the white paper answers your questions.


#12

I understand that a bad actor can’t steel the coins. It is almost not possible to disturb the P2P communications. What I am saying is that it possible to block users accessing bisq exchange site over the internet. It is an availability issue not a security threat.


#13

White paper doesn’t answer my question. It is very clear that site availability ( able to being access the site by users) is challenged in the BGP Protocol level.


#14

I did a test in my office network blocking bisq.network, bisq.io for myself. There were no issues for using the BISQ P2P applications.
Also kept on blocking the tor servers the P2P application selecting.
Still the P2P client selects another tor node.
Some how it keeps on working. Very nice.


#15

We want to host a BISQ node in our network. How to get more information.


#16

There is only the java application GUI that is found on the github and download sections. Mac/Windows/Linux. There is no headless/CLI version. There seems to be a language barrier here. Also…who is “WE”, who do you represent?


#17

We are an ISP in Japan in Okinawa also having a private global WAN to drag IX traffic around the world for our users. We do have plenty of bandwidth on our global WAN so looking forward to utilize them to make revenue.


#18

Upcoming release will even have Tor pluggable transports support.


#19

Good, hope it works in China.


#20

I think you mix up the exchange part and the website part.
bisq.network 54.250.174.92 AS16509 is only the Website.
And the whole exchange will run without it. As it is using Tor for it’s communication you only need one woking Tor entry node.

Generally on BGB security:
You are right the BGP is the internet backbone protocol, if you mess with it you can do bad things. But the bad things don’t go undetected, every BGP peer can see your manipulation and you will face consequences.
Maybe loose your AS.

So I’m personally not afraid of BGP manipulation.

Best Emzy