Monero nodes behind NATs are not safe from eclipse attacks.

Blockchains rely on computers talking to each other across a network. In an eclipse attackeclipse attackAn attack where a malicious actor takes over all of a node's connections to the network, so the node only sees what the attacker wants it to see., a bad actor surrounds a target computer by controlling all of its connections, cutting it off from honest peers. People believed that unreachable nodes—computers hidden behind network setups called NATs that block incoming connections—were naturally safe from these attacks. Researchers proved this belief is wrong. They created two attacks on Monero's peer-to-peer network that require zero incoming access to the victim. First, the attacker poisons the peer address lists on open computers. Those open computers then pass the bad addresses along to the hidden targets. Next, the attack takes advantage of how Monero regularly updates outgoing links, kicking out good peers until only malicious ones remain. The researchers found that attackers can reliably trap these hidden computers in stable, long-lived eclipse states, and they suggested fixes to stop the problem.

Why it matters

Monero users who run nodes behind home routers or firewalls are considered safer from network isolation attacks. This paper shows those nodes are actually vulnerable, and an attacker can fully control their view of the network. That means an attacker could feed them false transaction data, potentially enabling double-spending or privacy leaks.

Questions answered