From: "F L" <bitcoin@hellokitty•com.sg>
To: bitcoin-dev@lists•linuxfoundation.org
Subject: [bitcoin-dev] Bitcoin XTs Tor IP blacklist downloading system has significant privacy leaks.
Date: Wed, 19 Aug 2015 00:31:30 +0100 [thread overview]
Message-ID: <20150818233130.7A22815F000@c-in3ws--03-03.sv2.lotuslive.com> (raw)
[-- Attachment #1: Type: text/plain, Size: 1347 bytes --]
Bitcoin XT contains an unmentioned addition which periodically downloads
lists of Tor IP addresses for blacklisting, this has considerable privacy
implications for hapless users which are being prompted to use the
software. The feature is not clearly described, is enabled by default,
and has a switch name which intentionally downplays what it is doing
(disableipprio). Furthermore these claimed anti-DoS measures are
trivially bypassed and so offer absolutely no protection whatsoever.
Connections are made over clearnet even when using a proxy or
onlynet=tor, which leaks connections on the P2P network with the real
location of the node. Knowledge of this traffic along with uptime metrics
from bitnodes.io can allow observers to easily correlate the location and
identity of persons running Bitcoin nodes. Denial of service can also be
used to crash and force a restart of an interesting node, which will
cause them to make a new request to the blacklist endpoint via the
clearnet on relaunch at the same time their P2P connections are made
through a proxy. Requests to the blacklisting URL also use a custom
Bitcoin XT user agent which makes users distinct from other internet
traffic if you have access to the endpoints logs.
https://github.com/bitcoinxt/bitcoinxt/commit/73c9efe74c5cc8faea9c2b2c785a2f5b68aa4c23
[-- Attachment #2: Type: text/html, Size: 1633 bytes --]
next reply other threads:[~2015-08-18 23:36 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-08-18 23:31 F L [this message]
2015-08-18 23:56 ` Andrew LeCody
2015-08-19 0:00 ` Patrick Strateman
2015-08-19 1:08 Christophe Biocca
2015-08-19 1:36 ` Peter Todd
2015-08-19 1:48 ` Gregory Maxwell
2015-08-19 2:25 ` Peter Todd
2015-08-19 15:45 ` Mike Hearn
2015-08-19 18:51 ` Btc Drak
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150818233130.7A22815F000@c-in3ws--03-03.sv2.lotuslive.com \
--to=bitcoin@hellokitty$(echo .)com.sg \
--cc=bitcoin-dev@lists$(echo .)linuxfoundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox