00:07:48 37.27.0.0/16 belongs to Hetzner. But isnt your own node on Hetzner too 😉 00:11:34 node3 is hetzner, and in another range 00:11:51 ive handed over 345 potential malicious nodes over for investigation 00:12:31 37.187.74.171 is node3 00:15:03 so im certain the 37.27 node you list will be added to a banlist , thanks, and hopefully the others. all they do is purchase more ip's but we can try 01:43:40 moneroworld much sus. but original homepage 01:43:48 much html skilz 05:34:38 kewbit, I wish there also was a place to buy virtual hats for Monero. I know there are some marketplaces like this that accept BTC already. 05:46:36 *virtual* hats? 05:46:42 why not physical hats 06:02:12 as in, nft??? 06:02:50 How do you even detect the malicious nodes in the first place ? 06:11:14 neromonero1024, kinda, but without the redundancy of the blockchain since they're in a particular game anyway - innovation! 06:12:04 I'm assuming it's by looking at the ownership of the ip address? 06:12:16 I'm assuming it's by looking at the ownership of the ip address? 06:12:16 edit: honestly, I'd also like to know the details 06:17:57 Not sure about hat but I’ve for all 4 minecon capes on my account 😂 06:18:14 Not sure about hats but I’ve for all 4 minecon capes on my account 😂 06:19:49 As a child, I thought I would get a legit Minecraft license as an adult. But with Microsoft account and shenanigans like chat control - I guess this is not happening, staying a pirate) 06:21:00 https://m.youtube.com/watch?v=wsO-Td0hqXo - If you were wondering about your full node spec 06:22:23 So... Were some nodes using hijacked addresses or what? 06:23:14 🤷‍♂️ 06:51:36 ah i think that's from this article https://www.digilol.net/blog/chainanalysis-malicious-xmr.html 06:59:19 <3​21bob321:monero.social> proxying 07:07:56 one of these can prevents Chainalysis from compromising your privacy. Running your own node/using tor/FCMP++ 14:38:52 Is there stats to know what percentage of monero transactions are broadcasted/relayed over Tor ? 14:40:03 I tried to make something tricky before but it's not fully reliable 14:42:24 On torrc I open 2 socks proxy 14:42:26 One normal and one with OnionTrafficOnly 14:42:28 On monerod I do --proxy (proxy-1) --tx-proxy tor,(proxy2) 14:42:30 Node network traffic is routed over tor but can use exit nodes, when it's for transaction relaying it forces to only use hidden services to relay transactions 14:43:33 I wanted to use proxy-2 for basic node traffic but it wasn't fully reliable 14:45:27 But if all nodes were using tx-proxy, it could make dandelion++ over killed because it's wrapped in tor 14:45:38 But if all nodes were using tx-proxy, it could make dandelion++ overkilled because it's wrapped in tor 16:09:13 https://cointelegraph.com/news/chainalysis-leak-monero-traceability 16:09:22 Lul 16:09:57 https://matrix.monero.social/_matrix/media/v1/download/monero.social/gisLVsbVehwSsCpOrJWWKfOb 16:10:03 Also which one of y’all forgot to check their email lol 16:12:36 Best they could think of is to send a DM to Monero twitter account 16:12:51 Or worse, Discord 16:18:32 “We are excited to announce that we completely dropped the ball and allowed disinformation about the currency to spread” 16:35:21 lol 16:35:59 we can neither disallow or allow people to spread lies 17:35:36 Owner of https://captaincanaryllc.com / 185.218.124.120 contacted me. We managed to verify it's not a proxy. Either a false positive or proxy is rotating over multiple nodes in a round robin. 21:07:14 https://protos.com/no-moneros-privacy-didnt-suddenly-break-in-this-viral-video/ 21:08:22 decent article but what is that? 21:08:24 >They recommended IP-obfuscating services like Dandelion. 22:14:28 what 22:14:32 dandelion is a vpn now? 22:33:14 greetings all! I'm reporting on the recent Chainanalysis training video that did a kiddy investigation with internal Chainanalysis tooling. This was picked up by CoinTelegraph which did terrible reporting on it (I don't think they even saw the video), and tried to make it seem like XMR is traceable. When watching the video its obvious tracing XMR 22:33:15 is almost impossible, and I'm hoping to do a better write up to set the record straight, including getting comments from you all. For those interested, the article will be posted on https://takebackourtech.org 22:33:15 You can find the video I'm referring to here: https://archive.org/details/chainalysis_XMR 22:33:15 I would appreciate any comments from the community or Monero contributors on the issue and the following questions: 22:33:16 - Given that Chainanalysis is running Monero nodes, one could assume the IRS and other entities are running Monero nodes in the hopes that people connect directly to them (or reverse proxying them), exposing their IP address. Is this a valid threat, and is there anyway to identify malicious nodes and get them blacklisted from the network? 22:33:16 - The video at around 20:00 minutes refers to the Chainanalysis tool ruling out decoy transaction using different heuristics, such as previously being spent. In the video, it ruled out many decoy outputs and the instructor says to 'ignore' those. How feasible is it for Chainanalysis to do this, and what heuristics might they be using? 22:33:17 Thank you in advance. 22:34:39 Guest28 regarding the nodes question, this will help you: https://www.digilol.net/blog/chainanalysis-malicious-xmr.html 22:34:40 Nodes are nodes and they cannot be identified unless they exhibit strnage behavior like what is mentioned here 22:34:43 By the way, m-relay is a relay to Matrix. Look for the username inside the relay message 22:34:55 What I didn't see in the video was any discussion of the false positive rate of these techniques. That's a big criticism I have about many blockchain surveillance companies, as a scientist: There is little evaluation of the uncertainty inherent in their findings. That can easily cause false accusations, just like people in the past were falsely accused based on unscientific analys 22:34:56 is of arson patterns, ballistics, and bite marks in criminal forensics. 22:35:20 To answer your first question: 22:35:20 Spy nodes can play two roles. First, they can act as malicious remote nodes to de-anonymize users who do not run their own nodes and instead use remote nodes to submit transactions to the network. If users connect to those remote nodes without any proxy like a VPN, Tor, or I2P, then their home IP addresses can be exposed. 22:35:40 Second, they can listen for transactions as they are relayed between nodes to try to find which node was the first one broadcast the transaction, which is the actual source node of the transaction. As the Chainalysis employee said, the Dandelion++ protocol implemented in Monero in 2020 made this type of de-anonymization attack much more difficult. There's an alternative to Dandeli 22:35:40 on++ called Clover that could provide better privacy in certain cases. Myself and other Monero Research Lab researchers may evaluate Clover for possible implementation in Monero. 22:35:57 No one needs permission to join the Monero network. It is decentralized. There is not a reliable way to know which nodes may be spy nodes if the spies decide to blend in, but Monero's node connection code tries to be connect to a diversity of IP addresses in the IP address space to avoid connecting to too many nodes that may be controlled by one entity. 22:37:08 There are a couple of solutions to the remote node problem. First, users can run a node on their own computer instead of relying on a remote node that may be malicious. In the most recent version of the Monero GUI wallet, pruning was enabled by default ( https://github.com/monero-project/monero-gui/releases/tag/v0.18.3.4 ). Pruning cuts the required disk space to run a node in hal 22:37:10 f. Before the change in the pruning default, I performed an analysis of the safety of having more pruned nodes on the network in Appendix B of https://github.com/Rucknium/misc-research/blob/main/Monero-Black-Marble-Flood/pdf/monero-black-marble-optimal-fee-ring-size.pdf 22:38:07 If users cannot run their own node, they can use a proxy like Tor to connect to remote nodes. There are still some risks when using remote nodes like nodes lying about the necessary transaction fees, but at least a proxy will shield a user's IP address from the malicious node. Users can ask someone they trust to run a node for them, and only connect to that node. 22:38:36 On the second question: 22:39:02 Can you run a node if you can't have it active 24/7? Like, only turn it on when you're actively using it? 22:40:00 BlueyHealer: yes, but it will take couple minutes to sync it up 22:40:04 B​lueyHealer: Yes. But for best privacy it is good to have it running for as much time as you can so that an adversary cannot get more timing information. 22:40:29 or longer than a couple minutes depending on your hardware :D 22:41:08 In their case study, a large consolidation transaction was helpful to Chainalysis to generate a hypothesis of which ring members were the real spend. They had information about transaction outputs sent by a single coin swapper, MorphSwap. Large consolidations are known to be risky with ring signatures when an adversary has a large amount of information about which outputs a single 22:41:08 user owns. Chainalysis basically performs an Eve-Alice-EVE (EAE) attack, an attack that the Monero Research Lab has theorized. Chainalysis use the consolidation transaction for the first leg of the attack and then the IP address gathered by a malicious remote Monero node for the second leg. 22:41:22 Ah, okay. So it is fine if I run it like I run my torrents, whenever the laptop is on. 22:41:30 Thanks? 22:41:38 Different transaction fees was at the top of their list of ways to distinguish transactions. I worked on fee uniformity a lot last year. I developed a formula for the privacy risk of the non-uniform fees, identified non-uniform fees in the blockchain data, and asked Exodus wallet to fix their non-standard Monero fees. Justin Berman fixed some fee uniformity issues in MyMonero a fe 22:41:38 w years ago. Links: 22:41:39 s/?/! 22:42:00 https://github.com/Rucknium/misc-research/blob/main/Monero-Fungibility-Defect-Classifier/pdf/classify-real-spend-with-fungibility-defects.pdf 22:42:00 https://github.com/Rucknium/misc-research/tree/main/Monero-Nonstandard-Fees 22:42:02 https://old.reddit.com/r/Monero/comments/176e1zr/privacy_advisory_exodus_desktop_users_update_to/ 22:42:04 https://github.com/mymonero/mymonero-core-cpp/pull/36 22:42:27 In the future, Monero could consider requiring standard fees by blockchain consensus rules. It's tricky because you're messing with economic forces. If you're clumsy when you do that, economic forces have a way of messing with _you_. 22:43:11 END. Guest28: You can refer to me as Rucknium, a statistician with the Monero Research Lab. 22:55:45 rucknium, Thank you for that thoughtful and informative reply. I've captured it and will make sure your full response is included in the article. 22:55:46 Follow up: You mention the consolidation transactions, I just want to make sure i'm understanding this correctly. In this case MorphToken was cooperating with the attacker and shared its local Monero transactions that were related to this user. Because they could confirm that these outputs were previously spent, it helped identify the co-spends 22:55:46 made later on? 23:10:03 In my opinion, the video isn't completely clear about this. Maybe there are three ways that the parent transaction outputs could have been labeled "MorphToken" (Sorry, I called it MorphSwap before). 23:10:15 1) (Least amount of info given to Chainalysis.) There was no formal relationship between Chainalysis and MorphToken. Chainalysis used its spy nodes to figure out which node was broadcasting MorphToken-related transactions. This kind of analysis would have a lot of error because of Dandelion++. 23:10:23 2) (Medium amount of info given to Chainalysis.) MorphToken told Chainalysis which transactions it sent, but did not give any other info. This would mean that Chainalysis would know which transaction outputs MorphToken was responsible for, but not which user they were sent to. So this would allow Chainalysis to narrow things down. 23:10:32 3) (Most info given to Chainalysis.) MorphToken collected a lot of information about swaps, including possible personally identification info about people like IP address and which coins they were swapping from. (i.e. if a cluster of bitcoin addresses were swapping frequently with Morphtoken, then likely the same user was swapping many times.) This info is possibly given to Chainalysis.