Is this man-in-the-middle double-spending attack against Bitcoin viable?
Is this man-in-the-middle double-spending attack against Bitcoin viable?
To complete a double spending attack on Bitcoin as described, you need to be able to present an alternate block that is otherwise valid and with valid proof of work.
To create such a block in a 10-minute average requires as much mining power as exists in all the rest of the network (a 51% attack).
Yes, Mallory can delay Alice from receiving a new block but, Mallory must also successfully present Alice with a valid alternate block. There is one significant failing:

The proposed attack suggests insertion of a malicious fake transaction (temporary may be a better word) into a maliciously crafted block, a temporary transaction we suppose is Mallory paying to Alice while on the real blockchain Mallory is paying to herself.
Mallory puts Alice on drip-feed only giving new blocks slowly so that the real blockchain is ahead.
After Mallory lets the real blockchain get far enough ahead Mallory wants to build a fake block on top of a real block {blockheight-6}
Mallory requires as much mining power as exists in all of the rest of the mining network in order to solve the malicious block in a 10-minute average. Note that even in that case since it is an average it could take as long as 20-minutes. So, with approximately 25,681,575,019 GH/s[1] of mining power the attack can probably be carried out unnoticed. With half as much mining power as exists in all of the rest of the network Mallory would be able to solve a new block in a 20-minute average or, about 40-minutes max.

The problem in completing a 51% attack is revealed when it is understood that one modest Bitcoin miner is probably capable of just 13,500 GH/s.
Setting aside plausibility, the transaction would need to be of exceptionally large value to be financially viable.
EDIT: On the point that with 1% of the mining power a block can be generated in an average of 16 hours (max 32 hours) this is in theory not totally implausible, however, it should be noted that would still require currently ~19023 Antminer S9's. Also, if you test drip feeding the node in a laboratory environment to get 16~32 hours behind to see how the node behaves I doubt that Alice would not notice, even more so if also waiting for 6 confirmations. If Mallory also had access to Alice's computer to replace the software with a modified version then the attack becomes more realistic. Note that Mallory will still need to make private arrangements to distribute work amongst her miners i.e. a private mining pool.
rel:
[1] https://blockchain.info/stats