Incident report: Denial-of-Service (Feather Wallet) (featherwallet.org)

submitted 6 months ago* (last edited 6 months ago) by chillband@monero.town to c/monero@monero.town

8 comments fedilink hide all child comments

Explains in detail why Feather versions 2.6.5 and below are no longer able to send transactions.

Upgrade Feather to 2.6.6 or above to fix the issue.

all 10 comments

sorted by: hot top controversial new old

[-] Nononynous@monero.town 5 points 6 months ago

Again, thanks to the featherwallet's developer for theses fixes. All theses investigations about spam attacks really shows how membership proof implementations matters

[+] Synnr@sopuli.xyz 1 points 6 months ago

[deleted]

[-] tobtoht@monero.town 3 points 6 months ago

In version 2.6.7 you can send the same coin without waiting for the 10 block confirmation.

I can't reproduce this. The 10 block lock-time is a consensus rule, so the transaction would get rejected by the network. Is that what happened?

[-] Synnr@sopuli.xyz 2 points 6 months ago* (last edited 6 months ago)

Oops I was wrong, it looks like I have a penny left in the sending wallet so it was just a lucky coincidence on amounts sent during testing.

[-] Synnr@sopuli.xyz 1 points 6 months ago

I just noticed your username. Thank you for the project, Feather is amazing. I have a question though. I know Ruckinum ran an analysis and thinks this is not a black marble flood, but I can't help but think it's a way go somehow break the anonymity of monero, whether just sent amounts, or received amounts, which would still give a wealth of information.

I don't believe this is a random (D)DoS/spam. This is a deanon attack. I know it in my gut. I don't know enough about the internals of monero but I think you might.

Specifically...

The bug was triggered when the number of RingCT outputs on the blockchain exceeded 100 million

For instance, this transaction was constructed using a manipulated output distribution. Can you determine what the true spend is? Notice that all ring members are older than 1y 200d except for one 6-day-old output. Unless the user checks the ring on a block explorer and knows what to look out for, they would not notice that their transactions are being fingerprinted.

My understanding is that the 16 (or 15+real?) rings are all real, prior transactions. Are the transactions reused? If not, then they exhaust the supply of rings and now have great statistical advantage going forward. If they are reused, then they can tell the real spend by discarding any spend that's been used more than once. Is that correct?

I can't help but believe this is part of something larger, along with all the previous attacks in the last 2 years and now Samourai, Liquid pulling out of US, attacks on tor, RISAA and mandatory KYC on US cloud providers and domain registrars...

On that note, we've known LE has tools for years now (Chainalysis and 1-2 others) that can in some circumstances give a lead on who a target is, likely via statistical analysis. The tools are only available to law enforcement so the methods aren't known. My thoughts are, in no particular order:

They run or have compromised a lot of 'activist' nodes and xpubs are sent to the nodes in light wallets, unsure if this is how it works, or if that was unique to Samourai's whirlpool design. If this was the case, light wallets use currently online available servers, so chances are a user connects their wallet to tens of servers. Users who run their own nodes would be unaffected but I think the majority of monero users use light nodes.
They have tools that monitor public ledger chains, and watch the amounts in/out. You use an exchange service to trade $500 of BTC to XMR, the amounts (fees included) are correlated over time, leading to known persons selling via KYC services. Probably least likely option but unsure how XMR works in depth.
They run and/or work with (gag order) no-KYC major services that would have that information, as well as other more 'centralized' helpful no-KYC exchange services that know exactly what amount and address the funds are going to and where they came from.

[-] Rucknium@monero.town 2 points 6 months ago

I know Ruckinum ran an analysis and thinks this is not a black marble flood, but I can’t help but think it’s a way go somehow break the anonymity of monero, whether just sent amounts, or received amounts, which would still give a wealth of information.

I didn't run a quantitative analysis of the large number of 150-input transactions on May 2. I just guessed that it's not an actual black marble flood since it doesn't fit the definition or attack model of Noether, Noether, & Mackenzie (2014) and Chervinski, Kreutz, & Yu (2021).

Are the transactions reused?

Yes, each output can be re-used an unlimited number of times as a decoy in other transactions.

If they are reused, then they can tell the real spend by discarding any spend that’s been used more than once. Is that correct?

No. If every output that is created is spent, then on average each output will appear in 16 rings of other transactions. A Monero wallet do not check how many times an output has been used by other transactions when it is deciding which outputs to select as decoys.

They run or have compromised a lot of ‘activist’ nodes and xpubs are sent to the nodes in light wallets, unsure if this is how it works, or if that was unique to Samourai’s whirlpool design. If this was the case, light wallets use currently online available servers, so chances are a user connects their wallet to tens of servers. Users who run their own nodes would be unaffected but I think the majority of monero users use light nodes.

In normal operation, most Monero wallets do not send an "xpub" (in Monero this would be the Private View Key). The terminology can be confusing. In Monero, a "light wallet" is a wallet where the user gives a view key to a server to perform the blockchain scan on behalf of the user. The person or company running the server can see which transactions belong to the user and how much XMR is being sent to them. The MyMonero wallet works like this. Feather is not a light wallet with this definition, despite its name. Feather wallet and most wallets like Cake, Stack, the GUI/CLI wallets, etc., ask a local node (on the user's own machine) or remote node (on someone else's machine) for the entire blockchain data during a period of time and do the decryption of the wallets' transactions on the user's own device. That's why wallet sync takes a long time for those wallets when they are opened after being closed for a long time.

The remote nodes can collect some limited data like the user's IP address (if the user is not using Tor) and the last time the user synced the wallet. A malicious remote node can attempt to give the user a false decoy/output distribution (this is what Feather was trying to prevent with the initial, but flawed, code) and it can give the user's wallet an incorrect fee to pay (but the user can notice that the fee is too high and disconnect from the remote node. More information about remote node privacy is in Breaking Monero Episode 07: Remote Nodes (sorry for YouTube link. Use your favorite private YouTube front-end to view it): https://www.youtube.com/watch?v=n6Bxp0k7Uqg

[-] PipedLinkBot@feddit.rocks 2 points 6 months ago

Here is an alternative Piped link(s):

https://www.piped.video/watch?v=n6Bxp0k7Uqg

Piped is a privacy-respecting open-source alternative frontend to YouTube.

I'm open-source; check me out at GitHub.

[-] Synnr@sopuli.xyz 1 points 6 months ago

Thank you for answering my questions. Having much more knowledge in this area, what is your gut feeling about it being not random spam DDoS, but a way to get some type of sensitive data, that can make identifying users easier? Happy to receive a PM and won't share.