2

I just came across this thread on Twitter discussing Zcash and Monero usage in Dark-Net Markets. This quote bothers me:

too much risk that an "airdrop attack" deanonymizes a chain like Monero

@lightcoin 4:59 AM - 13 May 2018

What is an airdrop attack? How can it deanonymize the chain? Does this affect the whole chain or only targeted accounts?

  • Kind of explained there ^. Not sure if it's appropriate to flag it as a duplicate though. – dEBRUYNE May 20 '18 at 10:15
  • Thanks, that does indeed answer my question even though the question is not about the attack itself. – Waqar Lim May 20 '18 at 11:13
2

I'm guessing this refers to the "mass social engineering" attack where people are "paid" to use their Monero keys against the network. If you can get enough people to "de-anonymize" their transactions, the remaining anonymity pool decreases.

It works like this:

  • someone forks monero, and sets their starting chain to be a copy of the existing monero chain
  • that person tells others that they are now the owners of coins on that new chain (due to copying the original monero chain)
  • the only way to use these coins is by using your monero keys (again, due to copying the original monero chain)

The clever part is that the fork is worth nothing, but psychology will likely make people think it is worth something, so some fraction of Monero users will then use it, most likely to dump on an exchange, assuming anyone wants to buy it.

So far, so good. The trick is that if you send an existing monero output on both chains after the fork, it will create two rings for that output. These rings can either be different (if each software selects a random one), or the same (if each software reuses the first ring to be made). In the first case, you end up with two different things with one output in common, which means this is the real spent output. In the second case, no extra info can be deduced and you're safe.

So this will expose the real spent output in your transaction. If enough people do this, then this exposes more outouts as being spent. In turn, an observer can make deductions to decrease the effective ring size of other transactions using this output in rings. If enough people do this, this can have an effect on overall ring signature strength in the network.

The other two protection mechanisms (stealth addressing and ring confidential transactions) are unaffected by this.

Current Monero includes a shared ring database where it stores used rings, so you should always end up in the second case and be safe. However, if you use the same keys on two different computers/VMs, then you'll need to tell Monero (or the other fork) about used rings so they can be reused (see How can individuals safeguard themselves and the community against a key reusing fork? for details).

So this was a problem till recently, but the Monero team added this shared ring database to counter that attack. Someone forking Monero and trying this again might remove this safety protocol, but then it'd be pretty obvious they're attacking the network, and not just being dumb.

Now, this all relies on people thinking the fork created money and they can claim it by reusing their keys this way. However, the forkers will never pay you any money. Where does this "new" money come from then ? It just comes from others who think that fork might have value and buy these coins. It's just smoke and mirrors.

So, in short, this "airdrop attack" is a clever social manipulation to make people think they can get money by sabotaging themselves, and the Monero network as a result, and Monero now has automated defenses against it. If succesful at scale, this can decrease the strength of ring signatures on the whole network, but does not impact stealth addressing nor confidential transactions, the other two privacy layers in Monero.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.