Hong Kong – Poison Address Attacks.

Hong Kong – Poison Address Attacks.

The decentralized nature of blockchains offers remarkable opportunities for innovation and value transfer. However, this openness also introduces significant risks, particularly in the form of spam transactions. Just as email spam can clutter our inboxes, blockchains are susceptible to various forms of unwanted and malicious activity.

Among these threats, one of the most insidious is an “address poisoning attack,” a deceptive technique employed by malicious actors to target unsuspecting users and platforms. This attack leverages the inherent openness of blockchain technology to deceive users and steal their funds.

Recently, there has been a notable increase in the volume of address poisoning attacks, driven by several factors, including a sharp decline in “gas prices”. This article delves into the nature of address poisoning attacks, their effectiveness, and strategies for prevention, aiming to equip users with the knowledge needed to navigate the evolving crypto landscape safely.

What is an Address Poisoning Attack?

An address poisoning attack is a malicious tactic that aims to trick users into sending cryptocurrency to incorrect addresses. Unlike phishing attacks, which often rely on social engineering and the use of malicious websites, address poisoning operates within the blockchain’s infrastructure. The primary goal of the attacker is to “poison” a user’s address book by flooding it with addresses they control. This manipulation increases the likelihood that the user will mistakenly send funds to one of these fraudulent addresses in the future.

Why Address Poisoning Attacks are Effective

Address poisoning attacks are particularly effective for several reasons:

1. User Behavior: Many cryptocurrency users rely heavily on their transaction history for convenience, especially when sending funds to frequent contacts. This behavior is exploited by attackers, as users may inadvertently select a poisoned address when initiating a transaction.
2. Low Detection Rate: These attacks can be subtle and difficult to detect. Since the transactions involved are legitimate and appear in the user’s transaction history, it becomes challenging for users to recognize the threat until it is too late.
3. Cost-Effective for Attackers: Conducting an address poisoning attack is relatively inexpensive for attackers. They only need to send small amounts of cryptocurrency to poison the address book, while the potential returns from successful thefts can be substantial.

Deep Dive: How Address Poisoning Attacks Work

 Address poisoning attacks exploit the human tendency to reuse addresses from recent transactions. These attacks typically unfold by the following steps:

1. Initial Setup and Monitoring: The attacker identifies a notable wallet, such as one associated with a high-value account or frequently used address. They monitor the wallet’s activity on the blockchain using blockchain explorers and analytics tools to track movements and identify transaction patterns.
2. Generating Similar Addresses: The attacker generates addresses that closely resemble the target address. This process involves creating numerous addresses until one is found that meets specific similarity criteria, such as matching prefixes or suffixes.
3. Issuing Transactions: The attacker sends small amounts of cryptocurrency from a fake but similar address to the target’s wallet. These transactions are designed to be small enough to avoid raising suspicion but significant enough to appear in the target’s transaction history.
4. Poisoning the Address Book: As these transactions are recorded on the blockchain, the attacker’s addresses would appear in the target’s transaction history. The addresses are also crafted to look very similar to legitimate addresses the target has previously interacted with.
5. User Mistake: When the target user decides to send a larger amount of cryptocurrency, they often refer to their transaction history for convenience. Due to the address poisoning, the user sees multiple transactions involving addresses similar to the legitimate recipient’s address. In a moment of haste or oversight, the user would mistakenly select one of the attacker’s addresses.
6. Successful Theft: The target user sends a transaction to the attacker’s address instead of the intended recipient. Once the transaction is completed, the funds are under the attacker’s control, and by the time the target realizes the mistake, the transaction is usually irreversible.

Creating Similar Addresses in a Random Address Generation System

Even though the address creation process is inherently random, attackers can generate addresses until they find one that closely matches a target address. This process can be computationally intensive, potentially requiring the generation of millions of addresses, but it remains feasible for attackers so long as they follow the steps below:

1. Target an Existing Address: The attacker identifies an address that is frequently used by the victim (usually involving significant transactions).
2. Generate Addresses: Using the address creation method specific to the blockchain (e.g., Bitcoin), the attacker generates a multitude of new addresses.
3. Check Similarity: Each generated address is compared to the target address. If it meets the similarity criteria (such as having the same prefix or suffix), the address is retained; otherwise, it is discarded.
4. Repeat: The attacker continues generating addresses until a suitably similar one is found.

Conclusion

Address poisoning attacks represent a significant threat in the blockchain ecosystem, exploiting user behavior and the inherent characteristics of blockchain technology. As the volume of these attacks continues to rise, it is essential for users to be aware of the risks and take proactive measures to protect themselves.

We are experienced in dealing with cases involving address poisoning attacks and theft of cryptocurrency.