Bitcoin
University of Luxembourg researchers have discovered how to reveal the identities of bitcoin users from their IP addresses Reuters

Researchers from the University of Luxembourg have demonstrated that it is possible to figure out the IP address and therefore the identity of individuals who pay for transactions anonymously online using bitcoins.

In an open-access paper entitled Deanonymisation of clients in Bitcoin P2P network, the researchers explain bitcoins do not protect the IP addresses of users, and these can be linked to the user's transactions in real time, even if the client uses different pseudonyms for each transaction.

Virtual currency has come into vogue this year, particularly as it can be used to anonymously pay for potentially illegal items, and numerous underground markets have sprung up selling drugs and firearms through the Tor Anonymity network (known as the dark web or deep web).

Unfortunately, the researchers say Tor is not really able to protect a bitcoin user's identity from a would-be hacker, as the bitcoin's built-in denial of service (DoS) protection can be exploited.

How it works

The researchers say a hacker could discover the identity of a bitcoin user by using several computers and spending just under €1,500 (£1,190, $1,871) on such a deanonymisation attack.

There are several ways for a hacker to generate a malformed message and pretend it has been sent by a user on the peer-to-peer bitcoin network, even if the message has been sent from one of Tor's exit nodes.

The malformed message increases the penalty score of the IP address, and when the score exceeds 100, the user is immediately banned for 24 hours.

For example, say there are 1,008 Tor exit nodes. The hacker just needs to establish 1,008 connections and send a few megabytes of data to all connections from the Tor exit nodes to Bitcoin servers.

Once the attacker knows what all the servers are and the bitcoin users have been banned from accessing these servers using Tor, they will then have to access the servers the normal way.

"We demonstrate that the use of Tor does not rule out the attack as Tor connections can be prohibited for the entire network," the authors write in their paper.

"It shows that the level of network anonymity provided by Bitcoin is quite low. Several features of the Bitcoin protocol makes the attack possible. In particular, we emphasise that the stable set of only eight entry nodes is too small, as the majority of these nodes' connections can be captured by an attacker."

Tricking bitcoin servers to reveal IP addresses

Every time the user's client makes a connection to an entry node of the bitcoin server, its address (perhaps an IP address associated with a major internet service provider) will be advertised.

Once the hacker knows this address, he can trick the bitcoin server into revealing the IP address of the user.

"The crucial idea of our attack is to identify each client by an octet of outgoing connections it establishes. This octet of Bitcoin peers [entry nodes] serves as a unique identifier of a client for the whole duration of a user session and will differentiate even those users who share the same NAT IP address," the authors stress.

"As soon as the attacker receives the transaction from just two to three entry nodes he can with very high probability link the transaction to a specific client."

The researchers warn the lack of authentication within the bitcoin network needs to be rectified, since it is easy to trick nodes into blacklisting the IP addresses of seemingly misbehaving connections.

They added: "We figured out that very short messages may cause a day IP ban, which can be used to separate a given node or the entire network from anonymity services such as proxy servers or Tor. If the Bitcoin community wishes to use Tor, this part of the protocol must be reconsidered."

Related