Defeating Spy Nodes on the Monero Network
summary
Network scans find spy nodes on roughly 31% selection probability of candidate peers (1,843 spy IPs among ~4,67 reachable addresses), concentrated in a few /24 subnets including six fully leased subnets, and previously estimated to account for up to 40% of reachable addresses and ~15% of privacy‑sensitive outbound connections. Dandelion++ leaks stem traffic from unreachable nodes; subnet dduplication reduces spy candidates from 31% to 9% in simulation; Practical proof of storage raises operating cost for proxies but adds node load and deployment complexity.
AI-written summary · about
chapters (14)
- 0:00Spy nodes on Monero
- 1:46Privacy risks of own nodes
- 2:51Outbound vs inbound connections
- 5:17Dandelion++ for transaction privacy
- 7:03Detecting spy nodes via peer ID
- 9:39Spy node prevalence and impact
- 10:44Spy nodes in subnets
- 12:10Network threats to confidentiality
- 14:41Ban lists limitations
- 15:46Tor and I2P countermeasures
- 17:55Clover vs Dandelion++
- 20:47Subnet duplication to reduce spy nodes
- 22:52Proof of storage to deter spy nodes
- 24:59Summary and further research
related talks
44mNetsec is Dead(?): Modern Network Fingerprinting for...
41mInternet Spelunking: IPv6 Scanning and Device Fingerprinting
43mAttack or Noise?: Tracking and Evaluating the Impact of Internet-Wide Survey Scanners
26mSpy vs Spy: Anonymous Messaging
37mHiding the Rings: The Importance of P2P Encryption in Monero
08mPrivacy and Security
52mInvestigating DDOS - Architecture Actors and Attribution
35mTrying to De-Anonymize I2P Network Participants