Hacklog Volume 1 Anonymity: it security & Ethical Hacking Handbook

12.2 Crypto-currencies
Concerning payments, instead, crypto-currencies are the method accepted by
the online community: such currencies are acknowledged across different places
(physical regions included) and, with the proper precautions, can make the user
untraceable.
12.2.1 Precautions with Crypto-currencies
Obviously,  it  depends  on  the  crypto-currency,  but  you  should  keep  in  mind
that transfers are within the public domain in most of the structures of this kind,
so that, if the owner of an address is identified, all their transactions and those of
their  contacts  are  exposed  as  well.  The  most  stupid  thing  you  can  do  is  telling
everyone about a payment address (called wallet) which is used for questionable
or even illegal transactions.
12.2.2 Bitcoin
Bitcoin is the most popular crypto-currency in the web, and allows to make
transactions  anonymously,  with  the  proper  precautions,  outside  the  control  of
States and Banks; the BTC technology is based on a de-centralized network, in
order to avoid any possible manipulation of the network and attacks against the
infrastructures storing the crypto-currency.
We  will  cover  Bitcoin  since  it’s  the  most  socially  accepted  currency  on  the
web: there are many others (I recommend to keep a eye on Ethereum
[154]
), each
with  their  own  features,  however  it  would  be  pointless  mentioning  dozens  of
crypto-currencies that may vanish at any moment.
12.2.2.1 How Bitcoins work
Bitcoins  are  stored  in  a  Wallet  and  can  be  transferred  just  like  any  other
online e-banking service – if you’ve ever used PayPal you know what I mean –
but they do not depend on any bank, are not taxable and, to some extent, are also
anonymous.  Going  back  to  wallets,  they  can  be  software  and  web-based.
Actually, you can also find some hybrid types (like
blockchain.info
) that allow to
access  the  wallet  both  from  a  locally  installed  program  and  a  web  interface.  If
you don’t trust external wallets, you can always install the client from the official
website  (
bitcoin.org
)  or  use  alternate  ones  (like
electrum.org
)  but  it  will  take

---

some time before the wallets get aligned with the Bitcoin network.
Each  wallet  is  matched  with  an  address,  a  unique  alpha-numeric  code
identifying  the  wallet  in  the  network,  somewhat  equivalent  to  a  telephone
number,  that  will  send  or  receive  Bitcoins.  The  address  is  generated  during  the
first installation of the program or in the service subscription stage; furthermore,
you  can  have  more  wallets  simultaneously,  and  exchanging  Bitcoins  between
them  free  of  charge.  Wallets  must  be  secured  by  a  password  and  a  passphrase:
these elements ensure that the only legit owner can use them, and allow to use
the wallet even only temporarily within an Operating System. It is then advisable
to make regular backups of your wallets and encrypt them considering what we
explained in the “Encryption” chapter.
Let’s revise some general rules for Bitcoins:
-
     
Bitcoins are digital: BTCs cannot be printed on paper (or, at least, they’re
not officially acknowledged).
-
Bitcoins are distributed: there are no servers managing Bitcoins.
-
     
Bitcoins  are  divisible:  having  1  BTC  today  means  having  hundreds  of
dollars. The most commonly used currency is the mBTC (it worths 0.001 BTC).
-
     
Bitcoin is opensource: the software source code is open for modifications
and available to everyone
-
     
Bitcoin  is  (almost)  anonymous:  all  transactions  are  public,  but  only
addresses  can  be  identified.  If  their  ownership  is  known,  privacy  will  be
compromised.
12.2.2.2 How to obtain Bitcoins
Essentially, you can get Bitcoins in two ways:
•Generating them: in the IT world, this is known as Mining. Crypto-currency
emerged  as  a  distributed  currency,  therefore  it  is  “mined”  to  be  created  (hence
the use of the term ‘mining’). Downloading the mining software, you can create
an actual currency you can use to purchase goods and services. Since it became
quite popular, however, many experts and companies aim to generate more and
more crypto-currencies, thus obstructing any form of competition.

---

•Purchasing them: this is obviously the simplest method. You can find many
different  crypto-currency  markets,  trading  any  type  of  currency  (Bitcoin,
Litecoin,  Anoncoin,  Primecoin  and  so  on)  for  real  money.  One  of  the  most
popular is
LocalBitcoins.com
, which allows to contact other people of your town
(or  country)  and  purchase  them  using  different  payment  methods:  Debit  card,
Bank Transfer, PayPal, Western Union and so on. Some forums (like
inforge.net
)
allow to purchase them from different users through the escrow method.
•Exchanging them: Bitcoins can also be used as a traded commodity for other
currencies  (including  real  money).  Sites  like
BTC-E.com
,
bitstamp.net
,
coinbase.com
and others offer purchasing services, including crypto-currencies.
Unlike the transactions among private parties, these sites require users personal
information  like  passports  or  driving  licenses,  actually  threatening  the  users
privacy. Furthermore, you can find many services managing their platforms with
online wallets: one of them, Mt. Got, unexpectedly ceased its services in 2014,
causing a loss of $ 387 millions to their customers; its CEO was also involved in
a fraudulent bankruptcy scandal.
12.2.2.3 Making Bitcoins untraceable
Bitcoin is often called “the anonymous digital coin”. This statement is wrong
for two reasons:
1.It is not a coin, but a currency
2.It is not anonymous (not intrinsically)
Each  Bitcoin  transaction  is  traced:  you  can  verify  it  by  visiting  the
BlockChain.info
. If you purchase Bitcoins, you will see your transaction on the
site.  This  can  be  a  problem  for  your  privacy,  hence  you  may  need  to  hide  the
traces of your Bitcoins.
For  the  sake  of  clarity,  if  we  have  a  website  where  we  ask  for  donations
showing the address next to our full name and then we purchase some marijuana
from the Dark Net... well, everyone will know we smoke pot!
Mixing Service
One  of  the  methods  to  “clean”  BTCs  is  using  a  shared  Bitcoin  container
known as a mixing (or tumbler) service: all users of a service put their Bitcoins

---

together, then they roll them out onto different transactions, changing the game
and  then  deciding  the  amount  to  withdraw  from  the  online  wallet.  The  system
works depositing a certain amount: a 1-3% fee is applied and it will take at least
6 transactions before returning available.
In other words, a registered user sends some Bitcoins to a mixing service: the
latter  will  roll  them  out,  making  them  anonymous.  Once  this  is  done,  the  user
will receive them on a wallet they consider as the safest.
You can find many different interesting projects providing this service on the
web:  Helix  by  Grams,
bitcoinblender.net