In an eclipse attack, often many nodes in the network are malicious, and these nodes overwrite correct information with false data to mislead users. During the eclipse attack process, the attacker isolates their target. The attacker can prevent the victim from seeing their own wallet or transactions that occur on the network or can cause them to see false information.
Eclipse attacks can occur when nodes in a decentralized network cannot connect to each other simultaneously. Nodes connect to their preferred nodes to get better performance. For example, if a Bitcoin node has eight connections to other nodes, and an attacker gains access to all of those nodes, they can prevent miners from adding new blocks to the network. While the Bitcoin blockchain has 8 nodes, the Ethereum network has 13 nodes.
How Does an Eclipse Attack Work?
In a successful eclipse attack, the attacker isolates and blocks transactions or the current ledger. In decentralized networks, nodes cannot connect to all other nodes simultaneously, which makes this type of attack possible. Instead, nodes are grouped with different nodes. The level of effort required for a successful eclipse attack varies depending on the structure or size of the network.
During an eclipse attack, attackers try to ensure that all connections to the targeted node are controlled by malicious nodes, and then the attacker fills the target node with their own IP addresses. Afterward, the attacker waits for the targeted node to connect to the malicious nodes, which can be achieved by using a Distributed Denial of Service (DDoS) attack. Once the targeted node is compromised, the malicious actors can present false data to the targeted node.
Here are some situations caused by Eclipse attacks:
- Double Spending
- Miner Power Outage
Double Spending
A node isolated by an attacker can be directed to accept a transaction, causing double spending or invalid entries.
Miner Power Outage
The attacker tries to hide that a block has already been mined by a miner. By doing so, the attacker wastes the victim's processing power and time to compute blocks.
What Are the Consequences of an Eclipse Attack?
0-confirmation double-spending
When a person accepts an unconfirmed transaction, they can expect a double-spending situation. Even though the transaction has already been made, the sender can create another transaction and spend the funds again.
N-confirmation double-spending
N-confirmation double-spending attacks are more complex than 0-confirmation ones. Transfers must receive a certain number of confirmations to be considered valid, which creates a security vulnerability. Attackers can leave miners and users "in the dark." When an investor makes a transaction, they transfer it to the miners in the dark. All of this leads to the incorrect recording of the transaction on the wrong blockchain.
How to Prevent an Eclipse Attack?
An attacker can isolate a node they target with IP addresses. The most well-known way to prevent this is for an operator to block transmitted connections and only be connected to some nodes. However, if all users use this method, new nodes cannot join the network. Preventing an eclipse attack is difficult, but there are some factors that can make it more difficult to occur:
- If a random node selection is made, it is difficult for the attacker to predict which nodes they will create to target their victim.
- IP addresses or the number of nodes can be limited.
- Nodes store a lot of information about different nodes they encounter, and this information is still accessible when a node leaves and rejoins the network.
