Dusting Attack. A threat to Blockchain anonymity. – George Giamouridis
A key feature of the Blockchain, is users anonymity. When someone joins the Blockchain network doesn’t require to provide any personal information to create transactions and propagate them in the network. All transactions are public and visible from everyone (in the public ledger), but because of the cryptography no one can find the real identity of their creators.
The Dust
Dust is a very small amount of coins (tokens). Think of having 1 BTC in your wallet and you want to send 0.9 of them somewhere. When you create your transaction a tiny amount of BTC will be bind for mining fees (let’s say 0.5 BTC). So, the total amount of tokens you are going to spend is 0.950 BTC. That means that your wallet’s balance is now 0.05 BTC.
Now if you want to make a new transaction (with the balance of 0.05 BTC in your wallet), you won’t be able to do it because this amount is not enough for the transaction and the fees. So now this tiny amount of BTC that left in your wallet is theoretically useless and most users don’t even care about it. This amount is called dust.
Dusting Attack
As we told before Blockchain offers anonymity to its users by using cryptography. The question is “can we break this anonymity and identify Blockchain users?”.
Dusting attacks were first shown up in the Bitcoin network, but now they have been spread also in others crypto networks.
Some crypto holders prefer to use HD (hierarchical deterministic) wallets for higher anonymity. HD wallets imply a lot of addresses for a certain user, so 1 BTC for example can be spread in 4 different addresses that belong to the same user.
What scammers do, is sending small amounts of tokens to these addresses. Those amounts are included in their UTXO (Unspent Transaction Output). After this, a combined analysis of these addresses is executed to identify which addresses belongs to a certain user.
This operation becomes easier because most users keep some of their money in exchanges accounts and some other inside their wallets.
So, by performing a dust attack their personal data on the exchange service can be associated with their personal wallets data.
Published at Sat, 28 Sep 2019 16:18:45 +0000
{flickr|100|campaign}
