1

So I am currently working on a project using bitcoin. I started with a full node that I tried to secure following the best practices available online.

Then, I set up an electrum server that was connected to the full node and on top of which I linked a software wallet, being most of the time a cold one. In order to follow up this particular server' status, I added it to a notification service provided by this website. And that's when things started to get weird.

I suddently started to see the full node being always 1 to 2 blocks behind the current block height. I then saw 3 connections on average to the electrum server from IP addresses that I didn't own. Finally, I saw that my wallet descriptor has been changed and that the receiving addresses of the wallet have been modified. So everytime I would receive a new transaction, it would generate a new address that was not derived from my private key.

But here is the most interesting part. For testing purpose, I had made an incoming transaction to that wallet, days before, using the first generated address that I will call "A". After I started to have doubts, I went back to verify the list of generated addresses and I couldn't find "A" anymore. It was visualy replaced by a random address "B", with the same transaction but no other information has changed (txid, inputs, outputs...). That list was different from the list I used to see in the wallet.

That's when I came back to the electrum server, seeing new connections every second, from different IP addresses. I thought "I'm being DDOSing". After seeing my full node being always late catching the last block, I was finally sure that I was victim of a sybil attack.

I then started to mitigate the attack by doing some tasks on the wallet, the electrum server and the bitcoin core node. I am not sure if it will be enough but like someone said to me one day, "there are lots of things to consider... and security-wise etc. it's a huge undertaking with lots of risks."

Edit : Adding the following question.

Question : How was it possible for the attacker to change the descriptor and the receiving address of my wallet, through the electrum server? Is there any other vulnerabilities I should be aware of in order to mitigate the risks ?

Improve this question
2
  • 1
    Hi nourou4them, I don't see a question in your post.
    – Vojtěch Strnad
    Commented Jul 16, 2022 at 14:04
  • @VojtěchStrnad I just added it.
    – nourou4them
    Commented Jul 16, 2022 at 14:19

1 Answer 1

Reset to default
3

It sounds to me like you are either running a compromised version of Bitcoin Core (https://bitcoincore.org/) or Electrum (https://electrum.org/) or your laptop is compromised. A sybil attack is when all your peers are controlled by a malicious party and they control what transactions and blocks you see from the rest of the network. The attacker doesn't have access to your wallet, private keys, address generation, descriptors etc in a sybil attack scenario. I would recommend you install fresh verified versions of Bitcoin Core and Electrum on a different machine and if available use a hardware wallet/signer which is much harder for an attacker to compromise.

Improve this answer
5
  • I have installed core from bitcoincore website, then verified it following the "Linux verification instructions" in the "download" page. For the electrum server, it was the fulcrum one, and I just installed from the official repo.
    – nourou4them
    Commented Jul 16, 2022 at 20:15
  • How would you explain that after I discovered the attack and mitigated it, and after I restarted the node and the server, everything came back like before. I found again the descriptor and the receiving addresses I used to know ? It seems to me I was seeing a mirage, so it looked also like a MiM.
    – nourou4them
    Commented Jul 16, 2022 at 20:21
  • 1
    @norou4them: If you are installing the right versions of Core and Electrum then that only leaves your machine as compromised. You may be being man in the middled sure. But that's not what we refer to as a "sybil attack".
    – Michael Folkson
    Commented Jul 17, 2022 at 13:45
  • Indeed. Do you have any best practice guide to secure an ubuntu machine hosting a node ?
    – nourou4them
    Commented Jul 18, 2022 at 11:17
  • 1
    @nourou4them: I don't, no. You could ask on the Security StackExchange security.stackexchange.com. Unless you're an expert I would install Bitcoin Core and Electrum on new hardware and not install anything non Bitcoin related on that hardware. The more you install the greater the attack surface.
    – Michael Folkson
    Commented Jul 18, 2022 at 12:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.