Dusting Attacks - Reading Assignment

[Dimitar_Stefanov]

The goal of dusting attack is to collect the dust eventually in a wallet and identify the identity and potentially blackmail them.

Above

Some are tryong by capturing those little dust transactions

[Raulitiu]

1. What is the goal of a dusting attack?
   Break the privacy of bitcoin and cryptocurrency users.

2. If a dusting attack is successful, how is the victim at risk?
   Can use the attak to elaborate phishing attacks or cyber-extortion threats to the user.

3. Do deterministic wallets protect against dusting attacks?
   No

4. What features did Samourai Wallet add to protect against dusting attacks?
   The Samourai Wallet team implemented a real-time alert for dust tracking as well as a “Do Not Spend” feature that let users mark suspicious funds, so these are not included in future transactions.

[firepol]

Ah, true, also in EOS it doesn’t make sense a dusting attack I guess, as it’s so easy to just track the address and see all transactions coming and and going out, just as you could do on Ethereum.

So this seems more a spam attack, like when your e-mail is exposed in some website and someday some crawlers picks it up and it ends in the hand of spammers…

In EOS it’s really annoying, they know my address and continue to send spam news… it’s like e-mail in the first days, without spam filters…

[CryptoDragon]

1. What is the goal of a dusting attack?
   The goal is to find out which public addresses belong to the same wallet, making it easier to deanonmyze the user.

2. If a dusting attack is successful, how is the victim at risk?
   phishing or extortion attacks

3. Do deterministic wallets protect against dusting attacks?
   no, dusting attacks can potentially link different public addresses.

4. What features did Samourai Wallet add to protect against dusting attacks?
   the wallet alerts the users of suspicious dusting funds, and the user can mark them not to be used in future transactions.

[legoboy85]

@Grant_Hawkins

Read the page from Binance Academy on Dusting Attacks. Answer the questions and post your answers below:

Binance Academy

What Is a Dusting Attack? | Binance Academy

Have you received a small amount of unsolicited cryptocurrency into your wallet? You may be a victim of a Dusting Attack. Learn about dusting attacks.

1. What is the goal of a dusting attack?
2. If a dusting attack is successful, how is the victim at risk?
3. Do deterministic wallets protect against dusting attacks?
4. What features did Samourai Wallet add to protect against dusting attacks?

1. The goal is to eventually be able to link the dusted addresses and wallets to their respective companies or individuals.
2. If successful, the attackers may use this knowledge against their targets, either through elaborated phishing attacks or cyber-extortion threats.
3. No, because when a user spends funds there is (usually) no way to prevent it from using those dust funds.
   https://hackernoon.com/beware-the-dusting-attack-that-endangers-the-privacy-of-blockchain-transactions-0lhn3229
4. The Samourai Wallet team implemented a real-time alert for dust tracking as well as a “Do Not Spend” feature that let users mark suspicious funds, so these are not included in future transactions.

[Drojc17]

Hey @Grant_Hawkins , what about if you send the dust funds on the exchange. Probably the track is lost there?

[dAnijboned]

1. What is the goal of a dusting attack?
   Link addresses and wallets to a specific user or company. Deanonymize the blockchain.

2. If a dusting attack is successful, how is the victim at risk?
   The victim may be a target for phishing attacks or even extortion practices.

3. Do deterministic wallets protect against dusting attacks?
   If you spend your “dusting” funds it will not protect you against this attacks.

4. What features did Samourai Wallet add to protect against dusting attacks?
   A realtime alert for dusting attacks and a Do Not Spend feature for suspicious funds.

[Grant_Hawkins]

I have many different Bitcoin addresses: some to accept donations on Github, some for my darknet store. All of my accounts come from the same seed. Let’s imagine my darknet store’s address gets dusted.

Now I want to deposit my Github donations to an exchange to pay my rent. My wallet, with the master private key, might deposit the dust UTXO into the exchange too. Now whoever dusted the darknet account can see that it’s in a transaction with a UTXO from my Github page. Busted!

@jopo

[Drojc17]

Hei, thank you for the reply but I have problem with understanding it.

What means All of my accounts come from the same seed?

Do you have both addresses (Github and darknet store) generated in same wallet, or two different wallets (lets say 2 ledger nano S Ledgers).

Could 2 different addresses in same wallet be somehow conected together prior of making any transactions?

Thank you

BR

[Dejan]

1. What is the goal of a dusting attack?
   • To de-anonymize your cryptocurrency wallet, by linking UTXO’s together until a transaction history may lead to your identity, through sending small amounts of cryptocurrency to your addresses which may end up in a new transaction (which would link up multiple addresses of yours).
2. If a dusting attack is successful, how is the victim at risk?
   • It is now know the victim posesses a desireable asset for wich the victim may be targeted with extortion or computer hacking.
3. Do deterministic wallets protect against dusting attacks?
   • No, they only make it easier for you to use multiple addresses and thereby spreading the risk a bit.
4. What features did Samourai Wallet add to protect against dusting attacks?
   • Tagging dust transactions to avoid spending them. If you don’t spend that dust UTXO, then they cant link up addresses.

[diogozas]

1- Break the privacy of bitcoin and cryptocurrency.

2- The transactional activity of these wallets is then tracked down by the attackers, who perform a combined analysis of several addresses as an attempt to identify the person or company behind each wallet. If successful, the attackers may use this knowledge against their targets, either through elaborated phishing attacks or cyber-extortion threats.

3- In deterministic wallets, a brand new Bitcoin address is created for every new receiving transaction or payment request as a way to preserve users privacy. But if dusting funds are moved attackers are still able to trace them.

4- They implemented a real-time alert for dust tracking as well as a “Do Not Spend” feature that let users mark suspicious funds, so these are not included in future transactions. If a dust fund is not moved, attackers are not able to make the connections they need to “de-anonymize” the wallets.

[BitbyBit]

1. The goal of a dusting attack is to discover the connection between all of the “target” transactions and by doing that pinpoint him/her for a direct attack.
2. If the attack is successful then the victim is at risk for Phishing, Ransomware, Cryptojacking attacks.
3. No, because once you make a transaction with that “dust” no matter from which wallet, the attacker could connect the dots that will lead to you at the end.
4. Samurai wallet uses in wallet alert when “dust” deposited into your addresses. Also has the feature to mark those suspicious satoshi’s and not sending them.

[andrewfleming]

1. What is the goal of a dusting attack?
The goal of a dusting attack is to deanonymize crypto holders by linking multiple addresses to one wallet.

2. If a dusting attack is successful, how is the victim at risk?
The victim is at risk for coercion because the attacker linked their crypto addresses to their wallet and ultimately to the individual.

3. Do deterministic wallets protect against dusting attacks?
Deterministic wallets do not protect users against dusting attacks. Regardless of how addresses are created, the goal of a dusting attack is to link multiple addresses.

4. What features did Samourai Wallet add to protect against dusting attacks?
Samourai Wallet added a “Do Not Spend” feature to their wallet as well as a real-time alert for dust tracking.

[AlexanderG]

1. What is the goal of a dusting attack?
To figure out who is behind the address. (de-anonymize the user)

2. If a dusting attack is successful, how is the victim at risk?
Their real identity is uncoverd which can be used for phishing attempts and blackmail (scams) or really anything else that has to do with ur identity.
3. Do deterministic wallets protect against dusting attacks?
No, since the dusting transactions can be sent to any address, does not really matter which address it uses as long as it’s an address that sends the transactions further (with the “dust” on it)
4. What features did Samourai Wallet add to protect against dusting attacks?
A wallet where you can prohibit certain inputs to be used. So if u see that you have recived a very small sum on bitcoin u can prohibit the wallet from using it.

[cme]

@Grant_Hawkins

• What is the goal of a dusting attack?
• If a dusting attack is successful, how is the victim at risk?
• Do deterministic wallets protect against dusting attacks?
• What features did Samourai Wallet add to protect against dusting attacks?

1. to follow utxo or account wallet moves until possible identification of the wallet owner
2. the ‘victim’ once identified can be arrested if it is a criminal, or if the ‘victim’ was dusted by ‘criminals’ could be targeted to be attacked by pishing, spam or other malicious actions
3. no, once publickey receiced something the publickey/address is known in the blockchain, so anyone can send dust to the any address known in the blockchain.
4. Samourai Wallet can be configured to ignore sending/selecting utxo from received dust ‘amounts’, so that the user does not need to care to select by himself what utxo coins to use in a normal use of wallet funds/balances.

[begood]

1. To identify the person/entity behind a specific wallet & track its activity.
2. Its financial activity is to be seen/known.
3. No because those “dust” funds remains this type of wallet.
   4.They froze those “dust” funds.

[thenjose]

1- Deanonymize users of wallets by linking transactions together from the public ledger.

2- The victim is usually a target of a Phishing attack or cyber extorsion… it could also be a subject of an investigation run by authorities.

3- i understand they do when funds are being moved between a personal wallet and an exchange in which you were submitted to KYC. Because you Identity info is recorded in the exchange server, and that makes it easier for attackers to know who are if they see frequent transactions between the exchange and the same address.

4- The Do not spend feature and a real time tracker of dust transactions.

[krampus4570]

1. To track the activities of wallets with the intent to identify the owner.
2. Once identified the owner, the owner can be targeted with a variety of other attacks.
3. Not necessarily. If funds from the dust attack are used, they can be tracked.
4. The ability to detect and alert users to funds from potential dusting attacks.

[Grant_Hawkins]

@Drojc17

Could 2 different addresses in same wallet be somehow conected together prior of making any transactions?

Not prior to making any transactions. It’s a good point.

They could only be connected if UTXOs from both addresses are used as inputs to the same transaction, or linked through chain analysis.

[rickyd]

1. What is the goal of a dusting attack?

The goal is to be able to analyze transactions and unmask the identity of wallet owners.

2. If a dusting attack is successful, how is the victim at risk?

Attackers can use knowledge of a user’s wallet addresses to engage in phishing attacks or extortion.

3. Do deterministic wallets protect against dusting attacks?

Somewhat, as new addresses are used for each transaction.

4. What features did Samourai Wallet add to protect against dusting attacks?

Samourai implemented an alert system to report potential dusting transactions. They also enabled a ‘do not spend’ feature, so that you can earmark potential dusting transactions to stay in your wallet. If these UTXO’s are not respent, it isn’t possible for attachers to analyze your transactions and determine common ownership of addresses.