Three researchers have put forward a procedure that can associate the pseudonyms used in Bitcoin transactions with the IP address of the user. They even have a way of disabling the Tor network so that you can't hide behind it. In principle, this means that a monitoring agent could put together a complete ledger of transactions that a user engaged in.

One of the attractions of the entire Bitcoin algorithm and implementation is that its distributed architecture makes anonymity fairly easy to achieve. A transaction is identified by a pseudonym that is a hash of the users public key. All transactions are public, anyone can read the Bitcoin block chain, but it is generally assumed that you can't discover which two parties are involved in a transaction only their hashed public key. The identify of the owners of the Bitcoins involved in the transaction can be confirmed by the fact that they have the corresponding private key. 

The attack method shows how to associate the pseudonym used in transactions with the IP address of the user. Even if the user is behind a NAT and so shares an IP address the attack can identify different users and their transactions. But first we have to deal with the use of Tor to further anonymous the transaction. 

If you really want to keep your identity hidden then using the Tor network hides your true IP address from the world by routing all of you data packets though the Tor network. The researchers have invented an interesting attack on the the way the Bitcoin peer to peer P2P network accepts connections. Bitcoin as well as defining the technology to create the non-central administration of the block chain also defined how the P2P network of Bitcoin servers and clients work together and it is this part of the technology that is used in the attack on user identity. 

The Bitcoin P2P has a build in protection against a DOS attack. If a Bitcoin server receives a malformed message it increments a penalty score for the machine that the message came from. When a machines score reaches 100 it is banded from interacting with the Bitcoin P2P for 24 hours. There are even single messages that result in a score of 100 and an instant ban. The researchers suggest that all you have to do to disable Tor from reaching the Bitcoin P2P is to connect via as many Tor servers and possible and get them all banned. As there are only 1008 Tor exit nodes at  the moment this isn't a difficult task. 

With the Tor network disabled for 24 hours all Bitcoin transactions have to make use of assigned IP address and users might be happy to continue working because of the anonymity the use of the pseudonym seems to provide - this is where the second flaw in the Bitcoin P2P network comes into play. 

Each client that connects to the Bitcoin P2P makes eight connections to servers which it stays connected to until it is restarted. The researchers explain how it is possible with a reasonably high probability to discover which set of eight servers a client is connected to and to then associate transactions that originate with those eight servers. By monitoring the P2P network it is eventually possible to work out which transactions and hence pseudonym corresponds to which IP address. If the IP address is shared the method can still distinguish the different users by their different entry point connections. 

Once you have the pseudonym IP address connection then you can put together a ledger of transactions for that particular user. 

The bottom line is that it is quite cheap to find out what a particular IP user has been up to with their Bitcoins. 

Comments

Make a Comment or View Existing Comments Using Disqus

or email your comment to: comments@i-programmer.info