full image - Repost: Deanonymization - from Tor to Monero compromises! (from Reddit.com, Deanonymization - from Tor to Monero compromises! )
Mining:
Exchanges:
Donations:
Recently we've been seeing many cases of deanonymization that are raising concern. Is it mishaps in user OpSec? or are they new vulnerabilities exploited by LE agencies? Lets begin with TOR De-anonymization Let us begin with a refresher, when connecting to TOR, your information and data packets are routed through 3 random servers otherwise called "Relays". Each of these relays encrypts traffic with its own keys, which theoretically makes deanonymizing a user extremely difficult. Tor connections are made in the 3 Relay order mentioned above. which can also be detailed as:Entry Relay (Guard)Mid RelayExit Relay The way tor relays are usually exploited by scammers is via exit relays, although a very complex and sophisticated process, theoretically an attacker can poison the exit relays and manipulate certain data packets, such as XMR addresses and other sensitive financial entries. Again, possible but very complex and sophisticated. According to tor metrics 28% of tor Relays are based in the USA and Germany, and with 10% being in germany it makes sense with the recent deanonymization that occured. The way we can identify state actors is usually by looking at a single entity running a high volume of entry relays on tor, which would virtually allow them to expose user information.So we see German LE de-anonymizing users, and we also see heavy relay hosting in germany. to me it only makes sense to assume that German LE is taking that route. The safest route to take for users in that said region is to host their own relays and not rely on a random connection. as there's a possibility for the german user to be laying in LE's lap 1 out of 10 times. Monero De-anonymization Chainanalysis is running large amount of poisoned Monero nodes through their world-wide operation and their own admins. Running these said nodes like the defunct node.moneroworld.com allows them to collect sensitive metadata like IP addresses, Transaction volumes, fees and much more. They then forward the said information to LE and Crypto exchanges to fight privacy enthusiasts using the network. The only feasible way to avoid such a threat at the moment is to run your own node instead of using a remote node and while using your own node, utilizing Dandelion++. An example of the combined deanonymization attack against the Monero users – who is Joe: Joe sits at home and connects to Tor from his home router. He believes this is not an issue, because in his country the Tor is not illegal. He opens up his Monero wallet and connects to the Monero remote node, waits for the sync from the remote node and once ready, he sends the transaction to his business partner as usually. It is April 1st 2024, 12:00:01AM. The transaction is 120kB in size. The remote node he connects to is run by the Chanalysis and it is poisoned but he is not aware of it. The financial flows of his whole operation is closely monitored and it is largely transparent. He makes 5 such transactions per day with different time stamps and transaction sizes. While he uses remote nodes, there is a high chance that many of his transactions are not as anonymous as he thought it to be. His RingCT in those poisoned transactions is not 16:1 as by default in Monero now, but 1:1 now as he was served the poisoned, spent decoys by the poisoned remote node and his transactions are, for the adversary, completely transparent now. He is not suspicious and he continues his business as usual. Chanalysis is monitoring his transactions closely and can identify and track down high percentage of his transactions and link them together. They can see the exit IP of his transactions is the Tor exit node, because by using the Monero remote node he cannot utilize the Dandelion++ feature and sends the transaction directly to the poisoned remote node and the node knows this is the real exit IP address. Chanalysis contracted the US and German ISPs and they send them their required data from April 1st 2024, 12:00AM and they focus on Tor users, which is nicely visible. By contracting the US and Germany, Chanalysis gets the data flows from about 50% of the existing Tor nodes. They check the first transaction from the April 1st, if any of the Tor users was online at that time, sent a packets close to the Monero transaction. There are 20 people with the similarity. They check the 2nd Joe’s transaction from the day that took place at 12:20:01AM. Now only 2 people are return similarities. They get the 2rd transaction from 12:40:27AM and after few transactions and days they are quite confident that the origin of the poisoned transactions is the IP address that is registered on Joe Naive, exposed Street 1, App 1Z, Soonlot.So as users with the evolution of our threat model, we should improve our OpSec, we should start running our own nodes, relays and continuously evaluate our own flaws. if we continue to evolve, we will only make things harder for them, they have the state level funding, they have the time, but we should have the will to stand against them!I have read the rules
Social Media Icons