Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Detecting Monero Miners with Bpftrace

blog.px.dev

Post reply on HN
Print view View original

11–20 of 87 posts

Re: Detecting Monero Miners with Bpftrace

#11

Post by rosndo »

devops000 wrote: post #8
rosndo wrote: post #6

Earlier quoted context omitted.

So? Monero also makes it trivial to create a fake paper trail for the origins of your money.

When you will receive the bank wire from the exchange you need to provide to IRS the source of income. What will you say to them?

You provide them accounting from your fake business which accepts only monero payments for digital goods and doesn’t keep access logs?

This is really basic stuff. You will never be caught unless other evidence leads them from the original crime to you.

Unless you fuck up it’s not possible to link incoming Moneroj to any specific source, this means that you can fairly easily hide your money laundering activities even from somebody with full visibility into your business.

Re: Detecting Monero Miners with Bpftrace

#12

Post by m00dy »

blacksmith_tb wrote: post #7
m00dy wrote: post #2

How can we detect it inside the browser ?

Detect, or block? There are a few options for blocking, if you run uBlock Origin[1] the Resource Abuse list covers many. 1: https://github.com/gorhill/uBlock

Detect. How can we detect js-implemented monero miner inside a browser ? E.g. Is chrome dev tools exposing vm internals like in the blog post ?

Re: Detecting Monero Miners with Bpftrace

#13

Post by 323 »

rosndo wrote: post #11
devops000 wrote: post #8

Earlier quoted context omitted.

When you will receive the bank wire from the exchange you need to provide to IRS the source of income. What will you say to them?

You provide them accounting from your fake business which accepts only monero payments for digital goods and doesn’t keep access logs? This is really basic stuff. You will never be caught unless other evidence leads them from the original crime to you. Unless you fuck up it’s not possible to link incoming Moneroj to any specific source, this means that you can fairly easily hide your money laundering activities even…

You live in some fantasy land if you think you can just say "oh, I just received 100 dollars worth of Monero from 1 million unknown entities, my $100 million is totally legit, fuck off".

Unlike criminal law where you are "innocent until proven guilty", in most AML/KYC situations you are "guilty until proven innocent".

Re: Detecting Monero Miners with Bpftrace

#14

Post by vmception »

devops000 wrote: post #5

Monero is not anonymous anymore as soon as you want to convert to fiat.

It's been over half a decade since that stopped mattering, for me.

I've bought goods and services directly with Monero plenty of times. I've paid invoices that the merchant put in Bitcoin, while using a third party to pay in Monero, which the third party then paid in Bitcoin.

Now in the 2020s I can swap Monero directly to SECRET network, a Tindermint/Cosmos blockchain where all smart contract executions are private (such as the amount and quantity of your erc20-style wrapped Monero), allowing further bridging over to the EVM ecosystem for all the liquid DeFi trading activities, and Tornado cash if desired.

and the times when I use KYC to convert it to fiat, I haven't cared either. I like that the OTC desk or exchange doesn't even receive the address I sent from, much more similar to wiring from another bank account, where the receiving bank can't look at all your prior records and balances at the source of money and just has to assume the other place is compliant. it should be obvious that someone with an illicit source of their Monero will need to reintegrate their value into the broader economy first, so that they can account for it properly. with access to the entire DeFi ecosystem now, that is extremely easy.

all crypto users should restore that level of privacy.

Re: Detecting Monero Miners with Bpftrace

#15

Post by rspeele »

anonporridge wrote: post #9
garaetjjte wrote: post #4

>If these cryptojackers were to mine Bitcoin or Ethereum, their transaction details would be open to the public, making it possible for law enforcement to track them down That doesn't actually matter at all. Monero is used for these purposes probably just because it's mineable only on CPU, thus viable to mine on ordinary hardware. (Bitcoin requires ASIC and Ethereum high-end GPU)

Yep. Monero is explicitly designed to remain CPU mineable, so that theoretically it remains more decentralized and mined by individuals rather than an industrial complex like bitcoin and ethereum have become. Counterintuitively, I think this also makes it more susceptible to nation state attacks, since you can easily deputize fleets of existing CPUs to 51% attack the network, whereas no nation state on the planet can…

> no nation state on the planet can easily get enough sha256 ASIC miners to attack bitcoin

What if you set up several sock puppet mining pools, all supposedly independent and in competition with each other, and beat the existing pools on fees by enough that miners join you en masse? That would take some investment on your end as you would have to run pool infrastructure at a loss. But if you are a nation state, it's not a huge investment. You don't need to have any mining hardware of your own if you offer miners better returns for the use of their hardware than the other pools do.

Once your pools, taken together, have a dominant share of miners, I would think you could run a 51% attack without ever acquiring a single ASIC. The reputation of your pools will not survive but I think you could complete a 1 hour attack (reversing 6-conf transactions) before you lose the miners.

Would this work?

Re: Detecting Monero Miners with Bpftrace

#16

Post by unnouinceput »

Title is somehow misleading. This is not about uncovering Monero users in the wild and exposing them which are criminals, as I first believed when reading the title. This is about detecting unwanted Monero miner on your system. But if you're already pwned that an unwanted process is already running on your system, a Monero miner is the least of your worries.

Re: Detecting Monero Miners with Bpftrace

#17

Post by rosndo »

323 wrote: post #13
rosndo wrote: post #11

Earlier quoted context omitted.

You provide them accounting from your fake business which accepts only monero payments for digital goods and doesn’t keep access logs? This is really basic stuff. You will never be caught unless other evidence leads them from the original crime to you. Unless you fuck up it’s not possible to link incoming Moneroj to any specific source, this means that you can fairly easily hide your money laundering activities even…

You live in some fantasy land if you think you can just say "oh, I just received 100 dollars worth of Monero from 1 million unknown entities, my $100 million is totally legit, fuck off". Unlike criminal law where you are "innocent until proven guilty", in most AML/KYC situations you are "guilty until proven innocent".

You’re being ridiculous. Nobody is going to look at you twice for selling 1000x$5000 cryptocurrency trading courses a year, or even double that.

I’ve dealt with AML/KYC for cryptocurrency businesses with much higher volumes, nobody ever asked for anything crazy. Just basic accounting, website urls, linkedin profiles.

> You live in some fantasy land if you think you can just say "oh, I just received 100 dollars worth of Monero from 1 million unknown entities, my $100 million is totally legit, fuck off"

I think the only takeaway here is that “323” is too stupid and greedy to survive as a money launderer. Don’t try to cash out $100M in monero at once, live a wonderful life with $5-10M a year.

Re: Detecting Monero Miners with Bpftrace

#18

Post by anonporridge »

rspeele wrote: post #15
anonporridge wrote: post #9

Earlier quoted context omitted.

Yep. Monero is explicitly designed to remain CPU mineable, so that theoretically it remains more decentralized and mined by individuals rather than an industrial complex like bitcoin and ethereum have become. Counterintuitively, I think this also makes it more susceptible to nation state attacks, since you can easily deputize fleets of existing CPUs to 51% attack the network, whereas no nation state on the planet can…

> no nation state on the planet can easily get enough sha256 ASIC miners to attack bitcoin What if you set up several sock puppet mining pools, all supposedly independent and in competition with each other, and beat the existing pools on fees by enough that miners join you en masse? That would take some investment on your end as you would have to run pool infrastructure at a loss. But if you are a nation state, it's…

No.

You're still relying on this pool of independent miners to not defect after you initiate your attack.

Also a 6 block re-org is not unheard of and does happen naturally with the standard consensus rules on rare occasion. That's not enough to cause massive destruction of confidence. Security and confidence in your transaction's immutability has always been a continuous function of how much work has been piled on top of it, and how much energy it would take to redo that work. If you are transacting a very large amount of money, it behooves you to give it even more than 6 blocks for real confidence.

Re: Detecting Monero Miners with Bpftrace

#19

Post by bduerst »

rosndo wrote: post #17
323 wrote: post #13

Earlier quoted context omitted.

You live in some fantasy land if you think you can just say "oh, I just received 100 dollars worth of Monero from 1 million unknown entities, my $100 million is totally legit, fuck off". Unlike criminal law where you are "innocent until proven guilty", in most AML/KYC situations you are "guilty until proven innocent".

You’re being ridiculous. Nobody is going to look at you twice for selling 1000x$5000 cryptocurrency trading courses a year, or even double that. I’ve dealt with AML/KYC for cryptocurrency businesses with much higher volumes, nobody ever asked for anything crazy. Just basic accounting, website urls, linkedin profiles. > You live in some fantasy land if you think you can just say "oh, I just received 100 dollars worth…

>I’ve dealt with AML/KYC for cryptocurrency businesses with much higher volumes, nobody ever asked for anything crazy.

Were they legit businesses or illegal?

It makes a difference because there's more than just you and the KYC exchanges reporting, and it's survivor bias to assume they appear the same.

Re: Detecting Monero Miners with Bpftrace

#20

Post by wnevets »

dpacmittal wrote: post #10
devops000 wrote: post #8

Earlier quoted context omitted.

When you will receive the bank wire from the exchange you need to provide to IRS the source of income. What will you say to them?

Just sell an NFT to yourself.

relevant

https://fortune.com/2022/02/16/melania-trump-nft-auction/

Post reply on HN