Obviously everyone who uses something like XMR for privacy should be running their own node. But we know in the end a lot of people don't.
Below is not my work and way above my pay-grade in terms of what is happeningPassed to me from a link to a .onion discussion. I'm sure it's probably posted in a few other places too.
There was more in terms of what could be done in the quoted post that I did not copy.
What we know so far about the world wide tracing and deanonymization operation
Chainalysis, based on the leaked video presentation directly from Chainalysis themselves, shows that their operation is successful and it continues to run even now as we write this article. Lets break down the facts shortly first and then follow up with consequences and possible countermeasures to resist those attacks. The Chainalysis-like attacks are ongoing and will only increase in time. Simply because the current design of Monero allows it.
Chainalysis:
1. is running large amount of poisoned Monero nodes through their world-wide operation and their own admins. They call them “our administrators” in the presentation.
- if one is using remote node (any remote node except his own), he can easily be the victim of the Chanalysis ongoing deanonymization attack.
- anyone can run the large amount of the poisoned Monero nodes and provide the same attack too and there is no way to find out.
2. is indirectly stating that of their administrator was, now defunct, the node.moneroworld.com. There is an unknown amount of other Chainalysis administrators around the world running the poisoned nodes for them now.
- that was the reason the other knowledgeable Monero users called the site as an infiltration. The website is down now.
- There is no way as of now to identify those poisoned Monero nodes, used by the naive Monero users as their remote nodes.
- using the Monero remote node doesn’t utilize the important Dandelion++ feature of Monero, available only if you run your own node
- there can be other actors doing the same as Chainalysis making the picture even more ugly
3. is capable to serve the poisoned RingCT decoys to the unsuspicious Monero remote node users, through their own poisoned Monero nodes.
- if the user is using the poisoned Monero node of Chainalysis the node can serve the user the poisoned decoys for his transaction, rendering the RingCT feature of Monero useless.
- Such user has the anonymity set 1:1 and is completely transparent and ready for extremely precise deanonymization attacks
4. is collecting all available metadata like IP addresses, transaction time stamps, transaction size and fees and some others
- this is an another nice example to see how the metadata and its concealment are important in the security posture.
- the logged metadata are used to pinpoint and potentially deanonymize the users through combined attacks with the help of the data from the contracted ISPs (see below)
5. is contracting ISPs from various nation states to get certain data from around the world
- this is the nasty part, where the metadata from the blockchain are helping the Chainalysis to link the transactions with the real world identity of the compromised Monero users
- This is working even if one uses Tor, VPNs or any other proxy, depending on many other factors
- see below the example of the combined deanonymization attack
6. is linking the transactions with the known IPs of centralized exchanges to freeze the funds and force the exchanges to ask users for KYC.
- during the cashout or exchange process the compromised users commit mistakes trusting (non existent) Monero shielding, while their transactions, after using the poisoned Monero nodes, are completely transparent[
/quote]
