Is this man-in-the-middle double-spending attack against Bitcoin viable? There is an almost trivial double-spending attack against Bitcoin if an attacker has a MITM (man-in-the-middle) attack against a victim: the attacker prevents all blocks from being seen, and replaces them with their own.  The argument against this I've read online is that "it will take an extremely long time for the attacker to generate their own blocks, so the victim will notice there's something wrong".

But what about the following attack?


Attacker "Mallory" has a MITM attack against victim "Alice".  Say it takes Mallory T minutes to generate a block, where T &gt;&gt; 10
When the N-th block is generated on the network, Mallory waits C*N minutes before forwarding it to Alice  (here C is a small arbitrary constant, and N=1 is the first block generated on the network after the MITM attack begins).  In other words, only a small amount of time is added to each block, but Alice's blockchain gets further and further behind the "real" blockchain as time goes on.
Let M=6*T/C.  After M blocks, Alice's blockchain will be C*M = 6*T minutes behind the real blockchain.  Mallory starts generating blocks against the real blockchain's head at this point.  She inserts a malicious fake transaction into the first block she finds, and fills the rest with transactions from the real blockchain.
By the time Alice catches up to that point of the blockchain, Mallory will have generated 6 blocks, enough to make Alice believe the malicious transaction has been confirmed.


In other words, Mallory builds up time for herself to generate some blocks by adding C extra minutes between each block.  Once she's accumulated enough time, she then "spends" it to generate some fake blocks.

Alice still sees a block ~every 10+C minutes, so as long as C is small she never notices anything is wrong.  She also sees her own transactions eventually going through, just with an extra delay of N*C minutes.

Does Bitcoin somehow protect against this?  Or is this a legitimate double-spending attack?
Is this man-in-the-middle double-spending attack against Bitcoin viable?
To complete a double spending attack on Bitcoin as described, you need to be able to present an alternate block that is otherwise valid and with valid proof of work.
To create such a block in a 10-minute average requires as much mining power as exists in all the rest of the network (a 51% attack).
Yes, Mallory can delay Alice from receiving a new block but, Mallory must also successfully present Alice with a valid alternate block. There is one significant failing:

The proposed attack suggests insertion of a malicious fake transaction (temporary may be a better word) into a maliciously crafted block, a temporary transaction we suppose is Mallory paying to Alice while on the real blockchain Mallory is paying to herself.
Mallory puts Alice on drip-feed only giving new blocks slowly so that the real blockchain is ahead.
After Mallory lets the real blockchain get far enough ahead Mallory wants to build a fake block on top of a real block {blockheight-6}
Mallory requires as much mining power as exists in all of the rest of the mining network in order to solve the malicious block in a 10-minute average. Note that even in that case since it is an average it could take as long as 20-minutes. So, with approximately 25,681,575,019 GH/s[1] of mining power the attack can probably be carried out unnoticed. With half as much mining power as exists in all of the rest of the network Mallory would be able to solve a new block in a 20-minute average or, about 40-minutes max.

The problem in completing a 51% attack is revealed when it is understood that one modest Bitcoin miner is probably capable of just 13,500 GH/s.
Setting aside plausibility, the transaction would need to be of exceptionally large value to be financially viable.
EDIT: On the point that with 1% of the mining power a block can be generated in an average of 16 hours (max 32 hours) this is in theory not totally implausible, however, it should be noted that would still require currently ~19023 Antminer S9's. Also, if you test drip feeding the node in a laboratory environment to get 16~32 hours behind to see how the node behaves I doubt that Alice would not notice, even more so if also waiting for 6 confirmations. If Mallory also had access to Alice's computer to replace the software with a modified version then the attack becomes more realistic. Note that Mallory will still need to make private arrangements to distribute work amongst her miners i.e. a private mining pool.
rel:
[1] https://blockchain.info/stats