2

I have read this paper of Eclipse attack. And I want to konw that what resources are needed to implement an Eclipse attack? IP addresses and investing attack time are needed, and is there anything else you need? Thank you for your answer!

Eclipse Attacks on Bitcoin’s Peer-to-Peer Network

Improve this question

2 Answers 2

Reset to default
2

Maybe the most important thing you need is to come up with a good strategy, because various countermeasures have been implemented against the eclipse attack presented in the paper by Heilman et al.

See this article for a detailed overview, but in short, it has become a lot harder to take control over the Tried tables of addrman, making successful eclipse attacks harder.

So just following the approach outlined in the paper (filling the New tables of the victim's addrman with junk IPs and the Tried tables with attacker-controlled IPs) is not going to work in today's network, you will need to be more creative. Accordingly, the resources you are going to need depend a lot on what your actual approach is going to look like.

Improve this answer
0

To increase the probability of successfully pulling off an eclipse attack an attacker would want access to as many resources as they can get. Significant network hash rate to feed your victim blocks with significant proof of work would mean you don't need to attempt a "from genesis" eclipse attack and instead operate on or around the current blockchain tip. Alternatively if you have access to a botnet or a denial of service (DoS) vulnerability you could try knocking your victim's existing peers offline and attempt to replace them. Without significant network hash rate though it will take an extremely long time to generate the blocks at the current difficulty level.

A "from genesis" eclipse attack could in theory be pulled off with just a few IP addresses and/or control of multiple DNS seeds if you could ensure that your victim doesn't connect to any honest peers. (A single honest peer should keep the victim aware of the network recognized blockchain.) This attack would be attempted through feeding your victim an entirely different blockchain from genesis though your victim may be alerted by checkpoints in Bitcoin Core's code that lets them know the network's recognized blockchain is different to the blockchain they have been validating up until now.

So in summary, the more resources and the more tools an attacker has the greater the probability of a successful attack. However, it is never certain that it will succeed as it does rely on the victim not doing cross checks and not having additional infrastructure to flag an attempted eclipse attack.

Improve this answer
8
  • Eclipse attacks have nothing to do with hashrate. It's just about making a victim node only have attacker connections. Once a victim is eclipsed, the attacker can leverage it to mount other attacks, like censoring transactions/blocks, double spending, selfish mining, feeding a forked chain...; which may require hashrate, but those aren't part of the Eclipsing itself.
    – Pieter Wuille
    Commented Nov 1, 2021 at 13:37
  • I think we disagree then on how we are defining eclipse attack. I would include what the attacker does (e.g. double spend, feed blocks that rest of network isn't aware of) after successfully eclipsing a victim as part of the eclipse attack. You seem to want to define an eclipse attack as just the eclipsing part and not the part that ends up hurting the victim. If the victim is eclipsed but the attacker continues to feed them the actual blockchain the victim doesn't get hurt!
    – Michael Folkson
    Commented Nov 1, 2021 at 13:41
  • 1
    I'm just following the definition from the paper; "We presented an eclipse attack on bitcoin’s peer-to-peer network that undermines bitcoin’s core security guarantees, allowing attacks on the mining and consensus system, including N-confirmation double spending and adversarial forks in the blockchain.".
    – Pieter Wuille
    Commented Nov 1, 2021 at 13:52
  • Hmm interesting. An eclipse attack on "the network" doesn't make much sense to me. Surely the whole point is to target a particular victim or subset of the network. The only thing you can do to the entire network is (as the paper says) undermine guarantees which doesn't sound to me like you are carrying out a specific attack.
    – Michael Folkson
    Commented Nov 1, 2021 at 13:59
  • The fact that it is an attack on the network doesn't mean it isn't targetting a specific victim or victims.
    – Pieter Wuille
    Commented Nov 1, 2021 at 14:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.