Slashdot Mirror

← Back to Stories (view on slashdot.org)

Researchers Discover Flaws in Digital Currency Monero That Could Reveal Identity of Users (wired.com)

Posted by msmash on from the not-as-strong-as-it-seems dept.

Researchers have discovered flaws in Monero, a digital currency that boasts a high degree of anonymity, that could lead to the identification of users. From a report: Monero is designed to mix up any given Monero "coin" with other payments, so that anyone scouring Monero's blockchain can't link it to any particular identity or previous transaction from the same source. But in a recent paper, a team of researchers from a broad collection of institutions -- including Princeton, Carnegie Mellon, Boston University, MIT, and the University of Illinois at Urbana-Champaign -- point to flaws in that mixing that make it possible to nonetheless extract individual transactions.

That shouldn't just worry anyone trying to stealthily spend Monero today. It also means evidence of earlier not-quite-untraceable payments remain carved into Monero's blockchain for years to come, visible for any snoop that cares to look.

35 comments

  1. But how do I buy? by Anonymous Coward · · Score: 0

    Gotta get 'em all! This is the best scam ever!

  2. A big LOL by Anonymous Coward · · Score: 0

    one more time, suckers!

    1. Re: A big LOL by Anonymous Coward · · Score: 0

      Why? I do all my crypto work from the library and other anon internet locations. Who cares if in 20 years they figure out I was at a library, I'll probably be dead anyway.

  3. A Fool and his Crypto Currency by bobstreo · · Score: 0

    Are soon parted... /s

    There is a reason there is FDIC insurance in the US...

    1. Re:A Fool and his Crypto Currency by bobbied · · Score: 1

      Are soon parted... /s

      There is a reason there is FDIC insurance in the US...

      Teddy Roosevelt did that FIDC thing in a somewhat successful effort to stem the tide of the great depression by printing a LOT of money to bail out the insolvent banks. This was designed to stop the bank runs that where sucking all the cash out of the economy by stuffing it into mattresses for safe keeping.

      It was the original "To BIG to fail" bail out, at taxpayers expense and we've not been able to stop doing it for every financial hiccup since.

      --
      "File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
    2. Re:A Fool and his Crypto Currency by vtcodger · · Score: 2

      Franklin, not Teddy. And Roosevelt might well have been more interested in protecting depositors than in protecting banks.

      --
      You can't see ANYTHING from a car, You've got to get out of the goddamned contraption and walk...Edward Abbey
    3. Re: A Fool and his Crypto Currency by Anonymous Coward · · Score: 0

      Cute but off topic. This article was about how the fool keeps the coin, but everyone knows the fool.

    4. Re:A Fool and his Crypto Currency by bobbied · · Score: 1

      Yes, Franklin.. Sorry for the mistake.

      Protecting depositors by bailing out banks... To get money back into circulation by getting it back into banks and not stuffed in mattresses... Sort of the "trickle down theory" if you think about it.

      Actually, I think the real benefit was to expand the money supply dramatically and quickly. Even with that, recovery was muted by the dust bowel and what Carter would have called a "general malaise" where the population was focused on possible impending doom and hesitant to take risks. The real recovery didn't start in earnest until the outbreak of WWII and the massive military spending by all sorts of countries buying arms from the USA...

      Of course.. The danger of this printing money thing is inflation, and eventually the price will be paid though the devaluation of savings because it buys less and less over time. In 1900 a million dollars was quite the mound of cash and almost nobody ever saw that much in their lifetimes, now days, many people see a million dollars go though their hands every few years.

      --
      "File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
    5. Re:A Fool and his Crypto Currency by BranMan · · Score: 1

      " In 1900 a million dollars was quite the mound of cash..."

      Actually, not so much - yes it was a LOT of money back then, but the US also printed $5,000 bills. So a million could be a neat little stack of 200 bills. Today, however, it's a mound.

  4. Anyone surprised... by YukariHirai · · Score: 3, Insightful

    Anyone who's surprised by this isn't suspicious enough of the idea that a currency built on a permanent public ledger of transactions could possibly be anonymous.

    1. Re:Anyone surprised... by Anonymous Coward · · Score: 0

      Even if the theory itself is sound, I can't understand how any programmer who has worked professionally for more than a few years could possibly trust this or any other digital currency. Think of how inept so many of the programmers you've worked with have been. Do you know for sure that all the programmers who coded this were the best and brightest? Even if they were, did one -- just one -- ever have a bad day, and no one else caught the bug... yet?

      Sure, they're fun to play around with, but putting your finances on the line with this stuff? Or if you really need anonymity, will you be putting your life on the line?

    2. Re:Anyone surprised... by rtb61 · · Score: 1

      I'm just waiting for the cheapest crypt currency exchange to open, you know the one run by a three letter agency. You know they will quietly snaffle one up and then will, instead of mining currency, they will mine data and then, first the big sharks who can not be allowed to run wild and then after some time all the little piranha will feel that noose tighten, when they start issuing more public arrest warrants and brag about taking over that exchange, good luck.

      --
      Chaos - everything, everywhere, everywhen
    3. Re:Anyone surprised... by gweihir · · Score: 0

      I am not surprised that this version still has flaws. Your argument is entirely bogus though and just shows that you do not understand security.

      --
      Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
    4. Re:Anyone surprised... by thegarbz · · Score: 1

      Just because its in a public ledger does not mean it isn't anonymous. What it means is that it is traceable within that ledger. In order to identify *who* actually did something you still need to go through an exercise of deanonymising the user. Just because you know that {cryptohash} bought realhash for $10 doesn't automatically tell you who {cryptohash} is.

      Kind of like this post here on Slashdot. If you take a careful look at your replies you may be able to deanonymise one of the Anonymous Cowards who replied to your post. But doing so relies entirely on *me* making a mistake allowing you to make the link.

    5. Re:Anyone surprised... by humankind · · Score: 1

      We've seen time and time again, how meta information can be much more revealing than people think.

      You don't have to necessarily make any mistakes to have previously thought details about a transaction become obvious. The most obvious way people's personal info is compromised is not through their own mistakes, but the mistake of a friend or business associate who gets compromised.

      In fact any digital-realm transaction, whether we're talking about crypto, e-mail or an internet post, is probably one of the least secure things a person can do.

      Handling material money is much safer and anonymous. For that reason it's unlikely to go away any time soon

    6. Re:Anyone surprised... by Anonymous Coward · · Score: 0

      Anyone who's surprised by this isn't suspicious enough of the idea that a currency built on a permanent public ledger of transactions could possibly be anonymous.

      Pretty much this.

      Information theory is not on your side if information is being recorded at that level.

      Time and time again things which are supposed to not do this, it turns out that other ways of looking at it will give data.

      Just wait until all of those transactions are decoded, combined, associated to individual people, and handed over to law enforcement and everyone else.

      All those people who thought cryptocurrency was going to be magical and 100% anonymous were placing a bet that nobody could come along and do this.

    7. Re:Anyone surprised... by YukariHirai · · Score: 1

      Really, it's more akin to my posts, rather than any Anonymous Cowards replying to my posts. There is the common thread, my username, attached to every post I've made. Looking at every post I've made and what I've said about my real life in them, one could build a profile on me - incomplete, but potentially enough to match to a profile from a different source.

      Cryptocurrencies will be less anonymous than that. In my posts I could be embellishing the truth (or outright lying) enough to throw off a match, though careful enough analysis would counteract that to some degree. But a cryptocurrency ledger would be more definite; X amount paid to Y on Z date. One transaction in itself pretty meaningless, but payments are generally going to be for something, and unless you're seriously paranoid, you're not using a different throwaway wallet with no other traceable links for every single transaction. A pattern of purchases can be associated with a pattern of real-world movement of goods or provision of services. And of course, if you or one of the other parties gets careless about even one of the transactions and it gets tied to you, everything gets tied to you.

  5. Cryptoscam everywhere! by Anonymous Coward · · Score: 1

    If so-called cryptocurrencies are really good innovation, why they attract so many criminals/criminal activity?
    Could it really be because, all cryptocurrencies themselves are scams, and that is why they attract all kinds of criminals/criminal activity?

    If so-called cryptocurrencies are really currency, why no company/store can use Bitcoin as currency anymore?
    Because the price of Bitcoin proved to be extremely unstable to use as a currency?
    Would the result be different, if Bitcoin replaced by any other "cryptocurrency"?
    Aren't all work the same way?

    Or, they are not actually virtual currency but virtual investment?
    But, if they are actually investment, why we need/want them?
    What would happen to world economy, if people invested in virtual investments, instead of real investments?

    Or, all so-called cryptocurrencies are actually just a modified Ponzi Schemes?
    (Price of cryptocurrencies would keep increasing in the long term (by their design), so it is equivalent of paying variable interest to all long term investors.)

    As more and more people invest in cryptocurrencies, it will become harder and harder to ban their trading everywhere!
    All cryptocurrencies need to be banned globally before it is too late!

  6. I beg to differ! by DontBeAMoran · · Score: 3, Funny

    The price of Dogecoin is extremely stable.

    From day one, one Dogecoin has always been equal to one Dogecoin.

    --
    #DeleteFacebook
  7. really by Anonymous Coward · · Score: 0

    "spend monero" hahahahha. kryptokurrency.

  8. Is this the same attack that keeps being reported? by FeelGood314 · · Score: 1

    Monero has several functions to create anonymity, each one on it's own doesn't do it but combined there is a nice proof that they do. Every 6 months some idiot points out that one of the functions can be beaten. It's so common I'm not even going to bother reading the paper this time.

  9. The cryptographers in the world, all hacked by raymorris · · Score: 1, Insightful

    It wouldn't matter if they WERE the best and brightest. If you study cryptography you learn about famous cryptographers such as Polybius, Trithemius, VigenÃre, Stager, Scherbius, Rivest, and Schneier. These are the best cryptographers the world has ever seen. They all have own thing in common - their creations have all been hacked, broken.

    A fundamental law is that it is easier to break something than to make that thing. Physicists call this "maximum entropy" - things naturally tend away from order and structure, things break more easily than they are made. Any cipher, any encryption, which can be made by people can broken by people.

    In cryptography, as in crime, one side has an almost insurmountable advantage. The cryptographer can come up with huge, complex systems with many parts. The cryptanalyst needs only find a single flaw, a single shortcoming or shortcut, anywhere in the system. Cryptonanalysists will amost always beat cryptographers for the same reason a determined police force will almost always find their murderer if they try hard enough - the murderer has to do everything perfect to get with it, the police only need to find that one stray hair, with its DNA, or one drop of blood under the carpet, to prove their case.

    1. Re:The cryptographers in the world, all hacked by Srin+Tuar · · Score: 1

      > Schneier

      Not all of Schneier's works have been broken yet, and many crypto algorithms have only been broken due to small key sizes, and not due to cryptanalysis.

      > Physicists call this "maximum entropy"

      I suspect entropy actually favors the cryptographer. After all, there is more order in a message decoded than the random noise of a encrypted message never decoded.

      > In cryptography, as in crime, one side has an almost insurmountable advantage.

      Right now that advantage rests with the encrypter. Its far easier to devise a new crypto algorithm that wont be broken for a few years, than to break one. Each cryptanalysis is a work of brilliance, even if the crypto code itself is uninspired and simple.

      In this case; we are talking about a historical attack: looking up old bitcoin or monero transactions some time after they had been used and trying to discern some order from them. If they have been used correctly, such as the way ssl does PFS, wherein the keys used at the time are only ever used once then forgotten, it becomes impossible to glean any record of past transactions unless you were party to them.

      In the case of something like a crypto currency, for a sufficent number of nodes in the past, given sufficient graph connectivity, there is plausible deniability and connectivity to nearly all other active nodes.

      That said, I do believe monero in particular is weak, but i expect upcoming maxwell's design for bitcoin will be stronger.

    2. Re:The cryptographers in the world, all hacked by jwymanm · · Score: 1

      His argument still stands that those who create and build something have everything going against their works in that a single flaw in their complex systems can bring the whole thing down. Kind of like creativity in general. Those who create are constantly ridiculed for not doing it well enough or thought out enough even by those who never create or do anything. Something made even worse by our consumer first society.

    3. Re:The cryptographers in the world, all hacked by CSMoran · · Score: 1

      A fundamental law is that it is easier to break something than to make that thing. Physicists call this "maximum entropy" - things naturally tend away from order and structure, things break more easily than they are made.

      Yep. And that's why atoms and molecules never form crystals, right? You've heard of non-decreasing entropy of a closed system and misconstrued it.
      The reality is that systems *minimize* Gibbs free energy, G=U+pV-TS. Entropy is only this "S" bit.

      --
      Every end has half a stick.
  10. Re:Is this the same attack that keeps being report by Anonymous Coward · · Score: 0

    Monero has several functions to create anonymity, each one on it's own doesn't do it but combined there is a nice proof that they do. Every 6 months some idiot points out that one of the functions can be beaten. It's so common I'm not even going to bother reading the paper this time.

    You're likely correct.

    There's a lot of pressure being put into killing cryptocurrencies by governments because a method of exchange they don't control means they can't use currency and banks to suppress otherwise-legal activities they do not like for purely political reasons.

    For example, "Operation Choke Point" is government threatening banks with audits and endless investigations if they do not refuse to do business with or handle transactions for certain businesses like medical marijuana dispensaries, strip/topless dancer clubs, adult book stores/sex-toy stores, and now including firearm makers, firearm retail stores, and their customers. The government is also contemplating using the same strategy to financially strangle political organizations, publications, websites, and news services that oppose increasing government power and scope.

    CitiGroup has just announced they will no longer handle any type of financial transactions by either businesses or individuals that involve the totally legal buying and selling of certain firearms like AR15s and accessories like "high capacity magazines", whatever that means, or the selling of any firearms to those under 21 who are legally allowed to purchase a firearm.

    In this way the government can side-step and bypass the BoR/civil rights by employing a third-party.

    s/ Hmm, "third party doctrine"...sounds familiar, where did I hear that? /s

    As a result, the firearms industry is now contemplating moving to cryptocurrency to bypass the financial blockade.

    As more and more perfectly legal businesses, political organizations, websites, and publications that government/politicians dislike are forced to move to cryptocurrencies, this method of digital wealth exchange may become quite stable and commonplace in the future.

    So, government and financial institutions are conspiring together to negate the BoR. There's a term for that sort of relationship between government and the private-sector.

    Fascism.

  11. Here's something anonymous permanently recorded. by Anonymous Coward · · Score: 0

    Now just because something is permanently recorded in a ledger doesn't automatically prevent it from being anonymous. Take this Slashdot post for example.

  12. Old news... by Daneel+Olivaw+R.+ · · Score: 1

    https://getmonero.org/2017/04/... FYI: the link is more than a year old.

    1. Re:Old news... by Anonymous Coward · · Score: 0

      not surprising. slashdot has more sheeple these days. From your link:

      "We think further emphasis should have been placed in the paper to explain that the claims are only minimally applicable with the state of Monero transactions since March 2016, with the relevance decreasing over time. Though it is mentioned that their first analysis method has little if any current or future relevance, the claims still include these transactions. 0-mixin transactions were prohibited in March 2016, and most transaction volume for the year occurred during and after August. Nevertheless, many of these post-March transactions have inputs that can be deducible, but the traceability typically is not as severe as with 0-mixin transactions. The transactions that are most vulnerable are those in 2014 and 2015, as well as some time needed for the network to recover."

  13. Re: Here's something anonymous permanently recorde by Anonymous Coward · · Score: 0

    #Dunce

  14. Did you even read the paper? by Anonymous Coward · · Score: 0

    This is mostly researchers rehashing (pardon the pun) the 0-mixin problem that Monero used to have. As for their comment on the sampling size - this is already being addressed and adjusted. They even say in their conclusion:

    "A report from Monero Research Labs cited the difficulty of frequently tuning parameters based on data collection (especially since the data collection mechanism itself becomes a potential target for an attacker hoping to alter the parameters) [16]. Fortunately, we provide preliminary evidence that the distribution of “spendtimes” changes very little over time. Hence we recommend a sampling procedure based on a model of spending times derived from blockchain data, as discussed in Section 6.1."

    This isn't really news to the people that are versed in Monero...the effect it actually has on your anonymity set going forward is negligible and the Monero Community is constantly looking for ways to raise the mixins while keeping the blocksize manageable.

  15. Re:Is this the same attack that keeps being report by humankind · · Score: 1

    In this way the government can side-step and bypass the BoR/civil rights by employing a third-party.

    Which amendment in the Bill of Rights says a company doesn't have the right to refuse to service another company?

  16. Re:Is this the same attack that keeps being report by BlueStrat · · Score: 1

    In this way the government can side-step and bypass the BoR/civil rights by employing a third-party.

    Which amendment in the Bill of Rights says a company doesn't have the right to refuse to service another company?

    It's the one right next to the amendment allowing the government to strong-arm and blackmail financial institutions with threats of endless investigations by government regulators into refusing to allow legal businesses to perform legal commercial transactions with law-abiding citizens for purely political reasons.

    Strat

    --
    Progressivism (aka US 'Liberalism'): Ideas so good they need a police/surveillance-state to enforce.
  17. We DID break SSL PFS. Mistake of fact there by raymorris · · Score: 1

    > If they have been used correctly, such as the way ssl does PFS, wherein the keys used at the time are only ever used once then forgotten, it becomes impossible to glean any record of past transactions

    SSL PFS has in fact been broken. Over 80% of web servers used group 1, most SSL VPNs used group 2, and all of the others used group 3 or 5. We know for sure group 1 was publicly factored, allowing the (backward) decryption of most web SSL. There is evidence that NSA factored group 2, allowing them to decrypt most SSL VPN sessions.

    Your very example of what can't be broken was broken, three years ago.

  18. That's not a flaw by Anonymous Coward · · Score: 0

    That's a Feature !

    All Crypto is monitored by various nation states... they might not know what you are doing at first but a lot of attention draws all arrows to you as a 'person of interest.'

    Stay Legal ! :-)