Technical, forensic and organisational aspects of work with Monero cryptocurrency
Abstract
The forensic, organisational and technical features of law enforcement agencies' work with the Monero cryptocurrency in the context of pre-trial investigation and operational search activities are analysed. The development of the Monero system is described. The reasons and trends of Monero use by offenders are identified, and the scheme of operation of this payment system, which ensures its increased confidentiality, is shown. Examples of criminal offences in which Monero is used are presented. The functionality of OpenAlias to facilitate the work with Monero addresses is disclosed. The possibility of identifying participants in Monero transactions is studied. It is stated that there are currently no effective ways of such identification without knowledge of the public address and the corresponding keys, especially if users use additional security mechanisms such as connection to the TOR network.
The features of forensic investigation of computer equipment used to work with Monero are revealed. It is established that the most effective is the study of traces of work with Monero, which are removed from the relevant computer equipment of the person of interest. Useful information can be stored in RAM, on a disc, and partially in network traffic. The article identifies artefacts that should be taken into account during inspection and search. Atomic Swaps of XMR are modelled to determine the trace pattern and identify artefacts of increased attention during forensic procedures. The fact that an atomic swap was carried out to obfuscate traces may be evidenced by the presence of specific software files on the disc used for this purpose.
The algorithm for XMR withdrawal using multisig addresses has been proposed, from which funds can be withdrawn only when digital signatures of several persons are superimposed. The work of this algorithm in the test network Stagenet is modelled. It has been concluded that law enforcement agencies should focus on classical investigative measures to identify Monero users of interest. At the same time, there are effective mechanisms for documenting traces of work with the Monero payment system and proven methods for extracting passphrases to crypto-wallets and other sensitive information on the movement of funds in the Monero system from computer equipment.
Downloads
References
Bahamazava, K., & Nanda, R. (2022). The shift of DarkNet illegal drug trade preferences in cryptocurrency: The question of traceability and deterrence, Forensic Science International: Digital Investigation, 4. https://doi.org/doi:10.1016/j.fsidi.2022.301377.
Biryukov, A., & Tikhomirov, S. (2019, June 17–19). Deanonymization and Linkability of Cryptocurrency Transactions Based on Net-work Analysis [Conference presentation abstract]. Conference Proceedings “2019 IEEE European Symposium on Security and Privacy”, Stockholm, Sweden. https://doi.org/10.1109/eurosp.2019.00022.
Damgård, I., Ganesh, C., Khoshakhlagh, H., Orlandi, C., & Siniscalchi, L. (2021, May 17–21). Balancing Privacy and Accountability in Blockchain Identity Management [Conference presentation abstract]. Conference Proceedings “Topics in Cryptology – CT-RSA 2021”. Stockholm, Sweden. https://doi.org/10.1007/978-3-030-75539-3_23.
Handaya, W. B. T., Yusoff, M. N., & Jantan, A. (2020). Machine learning approach for detection of fileless cryptocurrency mining malware. Journal of Physics: Conference Series, 1450. https://doi.org/10.1088/1742-6596/1450/1/012075.
Keller, P., Florian, M., & Böhme, R. (2021). Collaborative Deanonymization [Conference presentation abstract]. Financial Cryptography and Data Security : FC 2021 International Workshops, Berlin, Germany. https://doi.org/10.1007/978-3-662-63958-0_3.
Kethineni, S., & Cao, Y. (2020). The Rise in Popularity of Cryptocurrency and Associated Criminal Activity. International Criminal Justice Review, 30(3), 325–344. https://doi.org/10.1177/1057567719827051.
Koerhuis, W., Kechadi, T., & Le-Khac, N.-A. (2020). Forensic analysis of privacy-oriented cryptocurrencies. Forensic Science International: Digital Investigation, 33. https://doi.org/10.1016/j.fsidi.2019.200891.
Kumar, A., Fischer, C., Tople, S., & Saxena, P. A (2017, September 11–15). Traceability Analysis of Monero’s Blockchain [Conference presentation abstract]. 22nd European Symposium “Computer Security – ESORICS 2017”, Oslo, Norway. DOI: https://doi.org/10.1007/978-3-319-66399-9_9.
Musch, M., Wressnegger, C., Johns, M., & Rieck, K. (2019, August 26–29). Thieves in the Browser [Conference presentation abstract]. Proceedings of the 14th International Conference on Availability, Reliability and Security, Canterbury, United Kingdom. https://doi.org/10.1145/3339252.3339261.
Nosov, V. V. & Manzhai, I. A. (2021). Certain Aspects of the Analysis of Cryptocurrency Transactions during the Prevention and Investigation of Crimes. Law and Safety, 1(80), 93–100. https://doi.org/10.32631/pb.2021.1.13.
Nosov, V. V., Manzhai, O. V. & Panchenko, Ye. V. (2022). Analysis of Ethereum transactions during the prevention and investigation of criminal offenses. Law and Safety, 4(87), 108–124. https://doi.org/10.32631/pb.2022.4.09.
Pastrana, S., & Suarez-Tangil, G. (2019, October 21–23). A First Look at the Crypto-Mining Malware Ecosystem [Conference presentation abstract]. IMC’19: ACM Internet Measurement Conference, Amsterdam, Netherland. https://doi.org/10.1145/3355369.3355576.
Peili, L., & Haixia, X. (2020). Blockchain User Anonymity and Traceability Technology. Journal of Electronics & Information Technology, 42(5), 1061–1067. https://doi.org/10.11999/JEIT190813.
Russo, M., Šrndić, N., & Laskov, P. (2021). Detection of illicit cryptomining using network metadata. EURASIP Journal on Information Security, 11. https://doi.org/10.1186/s13635-021-00126-1.
Rüth, J., Zimmermann, T., Wolsing, K., & Hohlfeld, O. (2018). Digging into Browser-based Crypto Mining [Conference presentation abstract]. IMC’18: Internet Measurement Conference, Boston, United States. https://doi.org/10.1145/3278532.3278539.
Sampson, J. (2018). Secret digital coin mining and trading is a threat to your business. Computer Fraud & Security, 4, 8–10. https://doi.org/10.1016/s1361-3723(18)30032-0.
Tramer, F., Boneh, D., & Paterson, K. G. (2020, August 12–14). Remote Side-Channel Attacks on Anonymous Transactions [Conference presentation abstract]. SEC’20: 29th USENIX Conference of Security Symposium, United States. https://www.usenix.org/conference/usenixsecurity20/presentation/tramer.
Wijaya, D. A., Liu, J., Steinfeld, R., & Liu, D. (2018, August 1–3). Monero Ring Attack: Recreating Zero Mixin Transaction Effect [Conference presentation abstract]. 17th IEEE International Conference on Trust, Security and Privacy in Computing and Communications / 12th IEEE International Conference on Big Data Science and Engineering, New York, United States. https://doi.org/10.1109/TrustCom/BigDataSE.2018.00165.
Zhang, Y. & Xu, H. (2022). Accountable Monero System with Privacy Protection. Security and Communication Networks, 22. https://doi.org/10.1155/2022/7746341.
Zimba, A., Wang, Z., Mulenga, M., & Odongo, N. H. (2018). Crypto Mining Attacks in Information Systems: An Emerging Threat to Cyber Security. Journal of Computer Information Systems, 60(4). https://doi.org/10.1080/08874417.2018.147.
Copyright (c) 2023 V. V. Nosov, O. V. Manzhai, V. O. Kovtun
This work is licensed under a Creative Commons Attribution 4.0 International License.
