{"id":379766,"date":"2021-12-11T19:00:00","date_gmt":"2021-12-11T16:00:00","guid":{"rendered":"https:\/\/en.buradabiliyorum.com\/what-is-an-eclipse-attack\/"},"modified":"2021-12-11T19:00:00","modified_gmt":"2021-12-11T16:00:00","slug":"what-is-an-eclipse-attack","status":"publish","type":"post","link":"https:\/\/buradabiliyorum.com\/en\/what-is-an-eclipse-attack\/","title":{"rendered":"#What is an eclipse attack?"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6af6ff9954cd3\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #dd3333;color:#dd3333\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #dd3333;color:#dd3333\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6af6ff9954cd3\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/buradabiliyorum.com\/en\/what-is-an-eclipse-attack\/#How_to_mitigate_eclipse_attacks\" >How to mitigate eclipse attacks<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/buradabiliyorum.com\/en\/what-is-an-eclipse-attack\/#What_are_the_consequences_of_an_eclipse_attack\" >What are the consequences of an eclipse attack?<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/buradabiliyorum.com\/en\/what-is-an-eclipse-attack\/#0-confirmation_double_spends\" >0-confirmation double spends<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/buradabiliyorum.com\/en\/what-is-an-eclipse-attack\/#N-confirmation_double_spends\" >N-confirmation double spends<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/buradabiliyorum.com\/en\/what-is-an-eclipse-attack\/#Weakening_competing_miners\" >Weakening competing miners<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/buradabiliyorum.com\/en\/what-is-an-eclipse-attack\/#How_does_an_eclipse_attack_work\" >How does an eclipse attack work?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/buradabiliyorum.com\/en\/what-is-an-eclipse-attack\/#What_is_an_eclipse_attack_in_blockchain\" >What is an eclipse attack in blockchain?<\/a><\/li><\/ul><\/nav><\/div>\n<p>&#8220;<strong>#What is an eclipse attack?<\/strong>&#8221;<\/p>\n<p style=\"float:right;margin:0 0 10px 15px;width:240px\"><img decoding=\"async\" src=\"https:\/\/images.cointelegraph.com\/images\/840_aHR0cHM6Ly9zMy5jb2ludGVsZWdyYXBoLmNvbS9zdG9yYWdlL3VwbG9hZHMvdmlldy8xNmEzNmZmZWUzNWRkMjY1MGJkNDIwMTU3NmI2YTNiMS5qcGc=.jpg\" class=\"type:primaryImage\"><\/p>\n<pre><code>                Eclipse attacks are a sort of cyberattack in which an attacker creates a fake environment around a single node or user, allowing the attacker to manipulate the node into doing a malicious action.\n                &lt;h2&gt;What can blockchain developers learn from eclipse attacks?&lt;\/h2&gt;&lt;p&gt;&lt;\/p&gt;&lt;p dir=\"ltr\"&gt;&lt;em&gt;Developers can familiarize themselves with the vulnerabilities in Bitcoin nodes that can be exploited to replace legitimate peer addresses with their own.&lt;\/em&gt;&lt;\/p&gt;&lt;ul&gt;&lt;li&gt;&lt;p dir=\"ltr\"&gt;Technically, when the node selects IP addresses from the tried bucket with timestamps, it increases the probability of the attacker getting selected. This is true even if the attacker only owns a small portion of these addresses. Chances of getting selected can also be increased by increasing the attack time.&lt;\/p&gt;&lt;\/li&gt;&lt;li&gt;&lt;p dir=\"ltr\"&gt;When an address bucket is full, one address is removed at random. If an attacker\u2019s IP is the one removed, then it can eventually be inserted if it is repeatedly sent to the node.&lt;\/p&gt;&lt;\/li&gt;&lt;\/ul&gt;&lt;p dir=\"ltr\"&gt;As you can see, attackers can exploit the above-mentioned vulnerabilities. However, there are also some ways to avoid them:\u00a0&lt;\/p&gt;&lt;ul&gt;&lt;li&gt;&lt;p dir=\"ltr\"&gt;IP address selection from the tried table could be done at random. This would reduce the chances of the selected peer being an attacker. If peer selection is randomized, then the attacker will not be successful even after having spent a lot of time in the attack.&lt;\/p&gt;&lt;\/li&gt;&lt;li&gt;&lt;p dir=\"ltr\"&gt;Use a deterministic <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/download-scripts-themes-apps\/\" data-internallinksmanager029f6b8e52c=\"9\" title=\"Download Scripts &amp; Themes &amp; Apps\" target=\"_blank\" rel=\"noopener\">app<\/a>roach to insert addresses of peers into fixed slots. This will reduce the chances of inserting an attacker\u2019s address into a different slot after having been evicted from the address bucket. A deterministic approach ensures that repeated insertion of addresses does not add value to an attack.\u00a0&lt;\/p&gt;&lt;\/li&gt;&lt;\/ul&gt;&lt;p dir=\"ltr\"&gt;As we mentioned, a lot of the vulnerabilities in Bitcoin have already been addressed. However, attacks on blockchain can still be carried out when attackers find other vulnerabilities. This is because blockchain networks are public.\u00a0&lt;\/p&gt;&lt;p dir=\"ltr\"&gt;The open-source culture followed by a lot of blockchain organizations may also give way to further vulnerabilities.&lt;\/p&gt;&lt;h2&gt;Differences between eclipse attack vs. Sybil attack&lt;\/h2&gt;&lt;p&gt;&lt;\/p&gt;&lt;p dir=\"ltr\"&gt;&lt;em&gt;Both attacks take place at the P2P network level. So what\u2019s the difference? \u00a0&lt;\/em&gt;\n<\/code><\/pre>\n<p>In an eclipse attack, most peers of a targeted user are malicious and therefore prevent the targeted user from connecting to a legitimate network. An eclipse attack is particularly useful in instances when a sender sends some Bitcoin (BTC) to someone and then also double spends these Bitcoin.\u00a0<\/p>\n<p>The sender then uses the attack to prevent the target user from finding out about the double spend.<\/p>\n<p>In a Sybil attack, a malicious actor or attacker attempts to spam the network with nodes under their control in an attempt to <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/game\/\" data-internallinksmanager029f6b8e52c=\"7\" title=\"Game\" target=\"_blank\" rel=\"noopener\">game<\/a> the network\u2019s reputation system. This includes false signaling of support using version bits. In summary, an eclipse attack targets a single user or party while a Sybil attack targets an entire network.<\/p>\n<p>In the context of Bitcoin, Sybil attacks are less harmful because nodes operate on consensus rules. Under these rules, any deviation will lead to having that same node DoS banned.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"How_to_mitigate_eclipse_attacks\"><\/span>How to mitigate eclipse attacks<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p dir=\"ltr\"><em>Theoretically, an attacker can eclipse any node as long as they have enough IP addresses.\u00a0<\/em><\/p>\n<p>Operators can mitigate this risk by blocking incoming connections. Also, they should only make outbound connections to specific nodes that they trust, such as those on a whitelist by other peers in the network. Researchers have pointed out, however, that if all participants adopt these measures, new nodes might not be able to join \u2014 making it an approach that cannot be done at scale.<\/p>\n<p>What the authors of \u2018Eclipse Attacks on Bitcoin\u2019s Peer-to-Peer Network\u2019 <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/eprint.iacr.org\/2015\/263.pdf\">suggest<\/a>, however, is to implement a few tweaks to the Bitcoin software. Some of these tweaks have already been <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/github.com\/bitcoin\/bitcoin\/blob\/v0.10.0\/doc\/release-notes.md\">implemented<\/a> since the paper was released. They work to make eclipse attacks costlier through minor changes in the code.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"What_are_the_consequences_of_an_eclipse_attack\"><\/span>What are the consequences of an eclipse attack?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p dir=\"ltr\"><em>When an attacker targets a network\u2019s user, there is usually a deeper motive for doing so. Typically, eclipse attacks can serve as gateways for more complex attacks and disruptions.<\/em><\/p>\n<h3><span class=\"ez-toc-section\" id=\"0-confirmation_double_spends\"><\/span>0-confirmation double spends<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p dir=\"ltr\">A user is at risk of a double-spend if they accept a transaction with no confirmations. By principle, although the transaction has already been broadcast, the sender can still create a new transaction and spend the funds somewhere else. Double spends can occur until a transaction has been included in a block and committed to the blockchain.\u00a0<\/p>\n<p>New transactions that have a higher fee can also be included before original transactions to invalidate earlier transactions. What\u2019s risky about this is that some individuals and businesses are in the practice of accepting 0-confirmation transactions.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"N-confirmation_double_spends\"><\/span>N-confirmation double spends<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p dir=\"ltr\">N-confirmation double spends are similar to 0-confirmation transactions. However, they require more complex preparation. Because a lot of businesses prefer to hold off on marking a payment as valid pending a certain number of confirmations, they can be vulnerable to attacks.\u00a0<\/p>\n<p>In this scenario, attackers eclipse both miners and merchants. They pull it off by setting up an order with the merchant and broadcasting the transaction to eclipsed miners. This leads the transaction to be confirmed and included in the blockchain. However, this specific chain is not the right one as the miner has been cut off from the network earlier.\u00a0<\/p>\n<p>The attacker then relays this blockchain version to the merchant, who then releases goods and\/or services believing that the transaction has already been confirmed.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Weakening_competing_miners\"><\/span>Weakening competing miners<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p dir=\"ltr\">Eclipsed nodes continue to operate as the target user is often unaware that they have been isolated from the legitimate network. As a result, miners will continue to mine blocks as usual. Blocks that are added will then be discarded upon syncing with their honest peers.\u00a0<\/p>\n<p>Large-scale eclipse attacks executed on major miners are usually used to carry out a 51% attack. However, due to the incredibly high cost to take over Bitcoin\u2019s hashing power majority, chances for this are still quite slim. At ~80TH\/s, an attacker would theoretically need more than 40TH\/s to succeed in such an attempt.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"How_does_an_eclipse_attack_work\"><\/span>How does an eclipse attack work?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p dir=\"ltr\"><em>Attackers typically use a botnet or phantom network to compromise a node and seal it off.<\/em><\/p>\n<p>Crypto eclipse attacks can be carried out because the nodes in a decentralized network cannot simultaneously connect with other nodes because of bandwidth limitations. As such, nodes connect with a limited set of neighboring nodes instead.\u00a0<\/p>\n<p>Hence, a malicious actor works to compromise the target user\u2019s connection with the limited set of nodes that it connects to. An attacker uses a phantom network or botnet to compromise a node. This network is created from host nodes and is used to flood a target node with internet protocol (IP) addresses. The target may then sync up with it when it reconnects to the blockchain network.\u00a0<\/p>\n<p>The attacker will then wait for the target to reconnect with malicious nodes or use a Distributed Denial of Service (DDoS) attack so that the target is forced to reconnect to the network.\u00a0<\/p>\n<p>The worst part is that once a target node is compromised, the attacker can feed it false data. Usually, the victim is unaware that the node has already been compromised. Some of the consequences of eclipse attacks in crypto projects are:<\/p>\n<ul>\n<li>\n<p dir=\"ltr\"><strong>Miner power disruption<\/strong>: Blocks can be excluded from a legitimate blockchain when an attacker tries to hide the fact that a block has already been mined from an eclipsed miner. This misleads the victim into wasting processing power and time computing already compromised blocks.<\/p>\n<\/li>\n<\/ul>\n<p>The attacker is then able to increase their hash rate within the network. Since an eclipsed miner is disconnected from the legitimate network, attackers can then launch attacks on multiple miners and launch a 51% attack on the network.\u00a0<\/p>\n<ul>\n<li>\n<p dir=\"ltr\"><strong>Double-spend attacks<\/strong>: \u00a0A victim that is isolated from its legitimate network may be misdirected by an attacker to accept a transaction that uses either of the two:<\/p>\n<ul>\n<li>\n<p dir=\"ltr\">An invalid input<\/p>\n<\/li>\n<li>\n<p dir=\"ltr\">The same input of an already-validated transaction on the legitimate network<\/p>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"What_is_an_eclipse_attack_in_blockchain\"><\/span>What is an eclipse attack in blockchain?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p dir=\"ltr\"><em>In an eclipse attack, a malicious actor isolates a specific user or node within a peer-to-peer (P2P) network.<\/em><\/p>\n<p>The attacker\u2019s goal is to obscure a user\u2019s view of the P2P network in preparation for more complex attacks or to cause <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/general\/\" data-internallinksmanager029f6b8e52c=\"3\" title=\"General\" target=\"_blank\" rel=\"noopener\">general<\/a> disruption. Eclipse attacks <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/www.geeksforgeeks.org\/sybil-attack\/\">share<\/a> similarities with Sybil attacks, however, their end goals are different.\u00a0<\/p>\n<p>They are similar in the sense that a certain network is flooded with fake peers. The difference, however, is that in an eclipse attack, a single node is attacked. In a Sybil attack, the entire network is attacked.\u00a0<\/p>\n<p>Moreover, attackers can start an eclipse attack by constructing many ostensibly independent overlay nodes via a Sybil attack. Attackers may use the overlay maintenance mechanism to mount an eclipse assault; hence, safeguards against Sybil attacks do not prevent eclipse attacks.<\/p>\n<p>Eclipse attacks are discussed comprehensively in the 2015 paper authored by researchers from Boston University and Hebrew University <a rel=\"nofollow noopener\" target=\"_blank\" href=\"https:\/\/eprint.iacr.org\/2015\/263.pdf\">entitled<\/a> \u2018Eclipse Attacks on Bitcoin\u2019s Peer-to-Peer Network.\u2019 In the said paper, the authors discussed their findings from launching eclipse attacks, as well as possible countermeasures.\u00a0<\/p>\n<p>In an eclipse attack, an attacker tries to redirect the target network participant\u2019s inbound and outbound connections from legitimate nodes to the attacker\u2019s nodes. By doing so, the target is sealed off from the actual network.\u00a0<\/p>\n<p>Since the target is disconnected from the blockchain ledger, the isolated node can then be manipulated by the attacker. An eclipse attack can lead to block mining disruptions as well as illegitimate transaction confirmations.\u00a0<\/p>\n<p>How easily blockchain attacks can be executed depends on the target blockchain network\u2019s underlying structure.<\/p>\n<blockquote><p><strong><span style=\"color: #ff6600;\">If you liked the article, do not forget to share it with your friends. Follow us on\u00a0<span style=\"color: #ff0000;\"><a style=\"color: #ff0000;\" href=\"https:\/\/news.google.com\/publications\/CAAqBwgKMLG0nwswvr63Aw\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Google News<\/a><\/span>\u00a0too, click on the star and choose us from your favorites.<\/span><\/strong><\/p><\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\">For forums sites go to <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/forum.buradabiliyorum.com\/\" target=\"_blank\" rel=\"noopener\">Forum.BuradaBiliyorum.Com<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<blockquote>\n<p style=\"text-align: center;\"><strong>If you want to read more <a href=\"https:\/\/buradabiliyorum.com\/en\/category\/news\/\" data-internallinksmanager029f6b8e52c=\"2\" title=\"News\" target=\"_blank\" rel=\"noopener\">News<\/a> articles, you can visit our <span style=\"color: #ff9900;\"><a style=\"color: #ff9900;\" href=\"https:\/\/en.buradabiliyorum.com\/general\/\" target=\"_blank\" rel=\"noopener\">General category.<\/a><\/span><\/strong><\/p>\n<\/blockquote>\n<p><span style=\"color: black;\"><a style=\"color: #ff9900;\" href=\"https:\/\/cointelegraph.com\/explained\/what-is-an-eclipse-attack\" target=\"_blank\" rel=\"noopener\">Source<\/a><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>&#8220;#What is an eclipse attack?&#8221; Eclipse attacks are a sort of cyberattack in which an attacker creates a fake environment around a single node or user, allowing the attacker to manipulate the node into doing a malicious action. &lt;h2&gt;What can blockchain developers learn from eclipse attacks?&lt;\/h2&gt;&lt;p&gt;&lt;\/p&gt;&lt;p dir=&#8221;ltr&#8221;&gt;&lt;em&gt;Developers can familiarize themselves with the vulnerabilities in Bitcoin&#8230;<\/p>\n","protected":false},"author":1,"featured_media":379767,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/images.cointelegraph.com\/images\/1024_aHR0cHM6Ly9zMy5jb2ludGVsZWdyYXBoLmNvbS9zdG9yYWdlL3VwbG9hZHMvdmlldy8xNmEzNmZmZWUzNWRkMjY1MGJkNDIwMTU3NmI2YTNiMS5qcGc=.jpg","fifu_image_alt":"","footnotes":""},"categories":[1],"tags":[],"class_list":["post-379766","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-general"],"_links":{"self":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/379766","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/comments?post=379766"}],"version-history":[{"count":0,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/posts\/379766\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media\/379767"}],"wp:attachment":[{"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/media?parent=379766"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/categories?post=379766"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/buradabiliyorum.com\/en\/wp-json\/wp\/v2\/tags?post=379766"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}