[HOME] [DOWNLOAD] [DOCS] [NEWS] [SUPPORT] [TIPS] [ISSUES] [DONATE]

"Oakstar" & "Monkeystar" programs targeting Bitcoin (and others) since at least 2013

Cryptocurrency fans should be nervous - did I ever mention that cash is king :wink:

https://theintercept.com/2018/03/20/the-nsa-worked-to-track-down-bitcoin-users-snowden-documents-reveal/

Classified documents provided by whistleblower Edward Snowden show that the National Security Agency indeed worked urgently to target bitcoin users around the world and wielded at least one mysterious source of information to “help track down senders and receivers of Bitcoins,” according to a top-secret passage in an internal NSA report dating to March 2013. The data source appears to have leveraged the NSA’s ability to harvest and analyze raw, global internet traffic while also exploiting an unnamed software program that purported to offer anonymity to users, according to other documents.

[…]

The NSA collected some bitcoin users’ password information, internet activity, and a type of unique device identification number known as a MAC address, a March 29, 2013 NSA memo suggested. In the same document, analysts also discussed tracking internet users’ internet addresses, network ports, and timestamps to identify “BITCOIN Targets.”

[…]

It also suggested powerful search capabilities against bitcoin targets, hinting that the NSA may have been using its XKeyScore searching system, where the bitcoin information and wide range of other NSA data was cataloged, to enhance its information on bitcoin users. An NSA reference document indicated that the data source provided “user data such as billing information and Internet Protocol addresses.”

[…]

Green, who co-founded and currently advises a privacy-focused bitcoin competitor named Zcash, echoed those sentiments, saying that the NSA’s techniques make privacy features in any digital currencies like Ethereum or Ripple “totally worthless” for those targeted.

The NSA’s interest in cryptocurrency is “bad news for privacy, because it means that in addition to the really hard problem of making the actual transactions private … you also have to make sure all the network connections [are secure],” Green added. Green said he is “pretty skeptical” that using Tor, the popular anonymizing browser, could thwart the NSA in the long term. In other words, even if you trust bitcoin’s underlying tech (or that of another coin), you’ll still need to be able to trust your connection to the internet and if you’re being targeted by the NSA, that’s going to be a problem.

Take home messages if you read the whole article:

  • Cryptocurrencies will not survive the gaze of advanced adversaries, as crypto founders like Mr ZCash even admit.

  • Confirmation that adversaries will set up VPN providers or other “privacy-focused” products as honeypots to further their aim.

  • Advanced adversaries regularly use paralell construction to bust balls everywhere.

  • Tapping the internet backbone is par for the course for advanced adversaries.

  • The Intercept/Guardian and others with access to the source docs should have done a Wikileaks and dumped all of this information years ago, so people would be properly informed and potentially protected, instead of drip feeding it at a rate which will take hundreds of years to disclose everything.

  • Snowden should have dumped all these docs with Assange - a major miscalculation on his part.

  • Advanced adversaries consistently target anything that provides a modicum of privacy.

  • The law if not uniformly applied is not a law at all i.e. circumvention of jurisprudence principles. There is a rule for the small people (you) and the behemoths (military-industrial-surveillance complex).

Based on government intent, points of potential failure, and complexity in achieving proper anonymity, cryptocurrencies are a bar too high for anonymous transactions.

If that isn’t discouraging, then how about adding insult to injury – some 15 year old kid just found a stealth backdoor to pwn hardware currency wallets, in this case the Ledger Nano S and Ledger Blue. Yeah it requires physical access, but it puts the “tamper-proof” claims of the designers to the sword.

https://arstechnica.com/information-technology/2018/03/a-tamper-proof-currency-wallet-just-got-trivially-backdoored-by-a-15-year-old/

On Tuesday, a 15-year-old from the UK proved these claims wrong. In a post published to his personal blog, Saleem Rashid demonstrated proof-of-concept code that had allowed him to backdoor the Ledger Nano S, a $100 hardware wallet that company marketers have said has sold by the millions. The stealth backdoor Rashid developed is a minuscule 300-bytes long and causes the device to generate pre-determined wallet addresses and recovery passwords known to the attacker. The attacker could then enter those passwords into a new Ledger hardware wallet to recover the private keys the old backdoored device stores for those addresses.

Using the same approach, attackers could perform a variety of other nefarious actions, including changing wallet destinations and amounts for payments so that, for instance, an intended $25 payment to an Ars Technica wallet would be changed to a $2,500 payment to a wallet belonging to the backdoor developer. The same undetectable backdoor works on the $200 Ledger Blue, which is billed as a higher-end device. Variations on the exploit might also allow so-called “evil maid attacks,” in which people with brief access to the device could compromise it while they clean a user’s hotel room.

Yeh, I’ll be giving cryptocurrencies a pass I think , but I’m sure this will start InfoWars part II. Flame on! :wink:

I don’t think anyone is surprised by this “revelation”

We will see, Mr. “Zcash” and his project definitely won’t.

Obviously Green is going to pump his bastard Shitcoin,since when do Ripple and Ethereum have privacy features Mr. Green?

I bet that 80+% of those “privacy” Services that opened after the Snowden “Leaks” are part of that.

Its obvious why they didn’t do that, they need those Headlines to fund their shitty “News” platform.

"What I did was that I worked in partnership with the journalists who received the material. As a condition of receiving the material they agreed, prior to publication, to run these stories by the government. Not for the government to censor them, but for the government to be able to look at these and go “look, this isn’t going to get anybody killed, this isn’t going to put a human agent behind enemy lines at risk” or something like that. “This isn’t going to make Al Qaeda be able to bomb buildings.” And I think the value of this model has been proven to be quite effective."
https://www.forbes.com/sites/runasandvik/2015/05/10/what-edward-snowden-said-at-the-nordic-media-festival/2/#6538e68a5efb
I guess he was more concerned about Government pawns getting hurt

It’s almost like thats the whole Point of Governments, a great monopole that gives more Power to a few and takes away everything from the dumb masses who gave it to them.

Not really, you can spend Bitcoin in Paper form like Cash, no need to send anything.

Can you store your Cash in your Head ? I can store my Bitcoins there :stuck_out_tongue:

Flame on

Take heed of the Tor Project docs:

https://trac.torproject.org/projects/tor/wiki/doc/bitcoin

It is a fairly common belief that using Bitcoin over the Tor network will allow a user to pay for various goods or services while maintaining full anonymity. Unfortunately, that is far from what one can realistically expect to achieve.

[…]

Dangers

As outlined in recent research, the Bitcoin blockchain can be traced and followed. This makes using the currency over the Tor network futile in the effort to increase anonymity. Example:

  • John posts his BTC address on Twitter
  • He receives a donation to his BTC wallet (A)
  • John goes to an onion service and makes a purchase
  • He transfers the cost from (A) to the public address of the site §, and in turn receives his items or services.

While the first 3 steps involve non-anonymous identities and transfers, John has an expectation of anonymity for the fourth step. Unfortunately this is a false expectation. Example of a deanonymising effort:

  • Sally crawls and subsequently parses Twitter for BTC addresses
  • Sally also crawls and subsequently parses onion services for BTC addresses
  • She also parses the Bitcoin blockchain
  • Sally discovers the address of (A), linking it to John’s identity.
  • She also discovers the onion service’s public address §
  • Sally finds the transaction record in the blockchain of A > P, and subsequently links Johns identity to the transaction

Because of this, even chaining wallets from one associated with a personal identity to one that is not before completing the transaction is also useless, as the chain of transactions is still present. Further, Bitcoin is retroactively and forever in the future exploitable to this tracing, making any transactions that have or will happen vulnerable.

[…]

“So is there any way to effectively use BTC anonymously then?”

Not really, no. Short of some financial acrobatics and a serious amount of effort, your transactions will be forever susceptible to tracking.

Note that the Tor Project does not vouch for the security or anonymity of alternatives to Bitcoin or any other future cryptocurrency. They also don’t believe tumbling is fool-proof going forward.

No word on off-the-chain Transactions ?
I don’t get the point your trying to make , yes its an Open Ledger , yes its not anonymous only pseudonymous (atm) , so ? Thats common knowledge and written in the Whitepaper , so your debunking half ass journalism that says otherwise, great.
Flame on

To state the obvious, the point is the fanbois out there in the main mistakenly believe cryptos are fully anonymous when paired with Tor, when all the evidence points to the contrary.

I see no evidence of this being common knowledge. People still use PoliceBook in the misguided belief that it is a social network, rather than the surveillance platform it really is. The general punter is lazy, and won’t read whitepapers.

While you may know otherwise, you’re in the minority. Meanwhile, tons of people continue to buy their illicit goodies off the “Dark Web” because they think they’re anonymous. Epic fail. (They should chat to their neighbor instead and use cash).

“Cryptocurrencies = anonymous” is a bit like the urban myth in the anonymity-minded community that “VPNs + Tor = better anonymity” when stacks of information from solid sources (Tor Project etc.) suggest otherwise.

Some ideas won’t die (Freddie Kruger style), no matter how many times they are shot down.

Sure. :grin:

The adoration for these gimmicks is lost on me. Consider the downsides:

  • Volatile in price.
  • Pseudoanonymous at best.
  • Many points of failure (software, hardware/software wallets, dodgy tumbling sites, phishing expeditions etc.).
  • Already under the gaze of spooks.
  • Recent track record of various sites having had 100s of millions stolen due to inept operators or crap coding in latest version of fanboiscoin.
  • Limited utility i.e. not yet widely supported.
  • Limited transaction speed i.e. does not scale well to replace current financial system transactions.
  • Waste a ton of energy in fanboiscoin mining.
  • etc.

Upsides:

  • They give tech geeks a stiffie.
  • They allow latest iteration of fanboiscoin IPO to make the founder a shitload of cash, who then retires to Asia with Thai bride 30 years his junior, while holders of said coin get reamed as the ponzi euphoria ebbs away. :stuck_out_tongue:

Basically cryptocurrencies are a solution in search of a problem in their current form.

1 Like

Spreading propaganda about decentralized currencies (and thus subliminally recommending government issued Fiat Currency) is adorable. No clear agenda at all. /s

Use cash to buy BTC @ LocalBitcoins.com over Tor.

No ID required.

Send BTC to wherever you like.

Not that difficult to remain anonymous. Thus the great success of dark net markets as a whole.

FUD on.

Common knowledge to privacy and anonymity enthusiast - Yes. To the general population - No. Most people think that all is needed to stay anonymous is using Tor. Therefor using bitcoin over Tor is safe. Reading past forum posts/questions (unfortunately) confirms this.

torjunkies' post may not be useful to you. However I think for the large majority its very useful.

Stating fact = subliminally recommending govt issued fiat currency ?

Looks like the tard has another conspiracy theory. How quaint.

Are you kidding me??? Tor is compromised! right??

You really think the mostly unsuccessful dark net markets shows how easy it is to stay anonymous.

lay off the bubonics

Are Ad Hominem Fallacies the only tool in your toolbox, toolbox?

No need to respond. It’s rhetorical, and no one cares.

Saying as nothing you contribute is rational i.e everything is a conspiracy. There is nothing really worth rebutting.

except you :wink:

@BubonicChronicWhonix Don’t use weasel words to start a flame war and stay civil please. I don’t want to ban you. The fact that people disagree with you doesn’t make them a “spy”.

It might work but its a very limited workaround. Physical trades involve an exchange rate premium than the online exchanges and expose participants to robbery and physical harm. Privacy should be baked into the protocol itself if its to be advertised as a feature.

“Briefcase” cryptography where rich people exchange locked suitcases sent by couriers is not a practical substitute for the masses wanting to exchange confidential data with people they never met before.

An impartial observer might think you have the wrong person.

I believe the Infowars battlefield requires another volley to be unleashed, since we’ve learned from this thread that “everyone” knows that Bitcoin is not anonymous. Right? :stuck_out_tongue_winking_eye:

Consequently, Monero and other alternatives are promoted - the search for the holy grail i.e. thistimeitsREALLYanonymouscoin.

Good luck with that:

https://www.wired.com/story/monero-privacy/

[…]

But one group of researchers has found that Monero’s privacy protections, while better than Bitcoin’s, still aren’t the cloak of invisibility they might seem.

Monero is designed to mix up any given Monero “coin” with other payments, so that anyone scouring Monero’s blockchain can’t link it to any particular identity or previous transaction from the same source. But in a recent paper, a team of researchers from a broad collection of institutionsincluding Princeton, Carnegie Mellon, Boston University, MIT, and the University of Illinois at Urbana-Champaignpoint to flaws in that mixing that make it possible to nonetheless extract individual transactions.

That shouldn’t just worry anyone trying to stealthily spend Monero today. It also means evidence of earlier not-quite-untraceable payments remain carved into Monero’s blockchain for years to come, visible for any snoop that cares to look.

[…]

“The mental model that people have today for Monero is a simplistic one, that these transactions are private. That model is just incorrect,” says Andrew Miller, a researcher at the University of Illinois at Urbana-Champaign who worked on the paper. “There’s information that’s revealed and not covered up by Monero’s cryptography.”

[…]

But researchers now point to two distinct cracks in Monero’s untraceability, one of which was fixed in its early 2017 revamp, and one that still lingers today, even as Monero coders have taken steps to fix it. Both problems relate to how Monero hides the source of a payment, essentially by mixing the coin someone spends with a sampling of other coins used as decoys known as “mixins.”

[…]

In any mix of one real coin and a set of fake coins bundled up in a transaction, the real one is very likely to have been the most recent coin to have moved prior to that transaction. Before a recent change from Monero’s developers, that timing analysis correctly identified the real coin more than 90 percent of the time, virtually nullifying Monero’s privacy safeguards. After that change to how Monero chooses its mixins, that trick now can spot the real coin just 45 percent of the timebut still narrows down the real coin to about two possibilities, far fewer than most Monero users would like.

[…]

Perhaps more disturbingly for Monero users who spent coins before its privacy improvements, indelible fingerprints could lead to their front door. And that points to a more fundamental problem for cryptocurrencies offering privacy: Any security flaw discovered in the future might apply retroactively, allowing observers to dig up old skeletons buried in the currency’s blockchain.

“You have a permanent record of everything taking place. If, down the road, someone finds a vulnerability that can reveal what happened in the past, you may still be at risk,” says Carnegie Mellon’s Christin. “We don’t know what the future holds.”

Noted (permanent blockchain record = bad).

Purchasing with cash on the other hand shows zip permanent records under the right circumstances / careful fieldcraft i.e. you took a sum of money out, and it was spent. On what? Ans: unknown (if done correctly), since there is no evidence they are tracking serials on banknotes.

See also:

https://www.coindesk.com/monero-link-transactions-debate/

Ok i send you cash and you send me Bitcoin, lets see who can stay anonymous…

  • Against what do you wish it to be stable? Aka stable coin.
  • Stable against USD?
  • How much value did USD loose since inception?
  • What about fiat money?
  • Hyper inflation happened before. Can happen again.
  • What about fiat money systemic risk, USA and worldwide government debt crisis?
  • To whom are governments worldwide even in debt to? Who’s the ultimate beneficial owner natural person? Ever wondered why the creditors are never discussed only "we are in debt" mantra? Who’s we?
  • How much USD (or any government currency) is in circulation? Where can I look that up? How much USD will be printed? What is the maximum amount of USD to be ever printed? Answers to these are hard to find out for USD but easy for BTC.

Monero promising or fixable at all?
Monero has flaws but on the other than Tor’s blog post “one cell is enough” looks more devastating.

Applies to Tor as well?

The technology is in its infancy. Similar arguments have applied to the early internet.

Mining algorithm: Proof of stake/research rather than proof of work?

Encrypted internet is also permanently recorded in hope it can be decrypted later on.

Yeah, there are tons of issues with crypto currencies but so far none are inherent / unfixable?

I think a more fair comparison is bank money (fully traceable) with Bitcoin.

I am yet to see a demonstration of someone able to track transactions on Monero blockchain.

So:

  1. Use Monero instead of Bitcoin as much as possible.

  2. If you must obtain bitcoin, always generate a new address for that (can be done offline), then change it to Monero behind Tor in sites such as shapeshift and only then use it.

  3. If shapeshift asks for a refund address, give an address you generate for this purpose and only for this transaction.

  4. There are many ways to obtain bitcoin that don’t include submitting an ID. Some of them will have other risks, there are ways to solve that or at least minimize the risk. For example, the ratings on sites such as localbitcoins or paxful. A seller with 3,000 deals done with 1,000 different users, with 99%+ positive feedback and an account older than 1 year, can theoretically still scam you for a $100 transaction. Perhaps he faked all those other deals just to get your $100. Possible but not very likely is it?

  5. Volatile, yes, it’s a problem. Solution: only hold a quantity you need to use in the short term. Bitcoin may go to $20,000 again or down to $4,000 next month and to $1,000 by the end of the year. I don’t speculate. I use it when I need to.

  6. Slow. Yes, it can be a pain. You need to plan ahead or pay a high fee per transaction. I’d say it’s certainly far, very far, from getting any meaningful chunk of business from fiat. Hopefully technology will be improved. We need confirmations in seconds and not in minutes or hours.

But I think something was missed here. Cryptos try to get away from central control. But you know what? people want central control. People want to be able to blame someone when the money is lost. People want insurance, someone responsible, they want “forgot password” feature and so on. Someone that takes care of them. They don’t get it in crypto as it meant to be used. So what do they do? they put it in exchanges. Then of course there can be no anonymity and no control.

[Imprint] [Privacy Policy] [Cookie Policy] [Terms of Use] [E-Sign Consent] [DMCA] [Investors] [Priority Support] [Professional Support]