<p>DNS seeders exist in order to bootstrap new nodes to the network. Nodes maintain a database of IP addresses for other nodes that they can connect to which they build by requesting IP addresses of other nodes from the nodes that they have already connected to. However new nodes have never connected to the network, so they use the DNS seeders to get this information.</p>
<p>New nodes will use DNS to request IP addresses for the hardcoded DNS seeder domains. These are supposed to be IP addresses of random nodes on the network that have also met some metric (defined by the seeder operator) for being &quot;good&quot; (e.g. high uptime). However these nodes are not used directly. Rather the new node will briefly connect to the nodes returned by the seeders to ask for more node IP addresses, and then try connecting to those IPs.</p>
<p>Since the DNS seeder operators can affect which nodes new nodes will try to connect to, an attacker with control over a DNS seeder could use this to perform an eclipse attack. To successfully eclipse attack a node, that node needs to be only connected to nodes controlled by the attacker. If they have a connection to just one honest node, they will be able to receive the main chain and will therefore not be eclipsed.</p>
<p>To increase the probability that there is at least one honest connection, multiple DNS seeders will be queried at the same time. This makes it harder for one DNS seeder to dominate the entire address database. As long as the node has received addresses from an honest DNS seeder, it should be able to make an honest connection to the network.</p>
<p>Additionally, there are other safeguards against eclipse attacks in general. These include disconnecting nodes that advertise low work blockchains, disconnecting nodes that refuse to accept a higher work chain offered by the node, and restricting the number of outbound connections to each <code>/16</code> or ASN. All of these increase the cost to an eclipse attacker as they will need to have nodes on many different networks and have done a lot of work in order to mine a blockchain that would be accepted by the node.</p>
<p>Overall, compromise of a single DNS seeder is not catastrophic as the only nodes affected are new ones, there are other seeders new nodes will be querying, and there are safeguards in place to make eclipse attacks difficult.</p>

CC BY-SA 4.0
2023-01-04T23:48:15.493Z
2023-01-04T23:48:15.493Z
Ava Chow
<p>Recently Bitcoin Core developer Luke-jr was hacked and has stated that we should consider anything owned by him to be compromised. This would include his DNS seeder at <code>dnsseed.bitcoin.dashjr.org</code>. If an attacker has indeed compromised this DNS seeder, what could they do and what safeguards exist to mitigate the effects of such a compromise?</p>

CC BY-SA 4.0
2023-08-07T12:32:04.373Z
What's the status on this? Does Luke still consider his DNS seeder compromised? If so it should be removed from the DNS seeds in the Core repo right?
Michael Folkson
<network><attack><peer-discovery><dns>
What can an attacker do if they compromise a DNS seeder?
Ava Chow
# What can an attacker do if they compromise a DNS seeder?

(Asked by: username_0 on 2023-01-04)

Recently Bitcoin Core developer Luke-jr was hacked and has stated that we should consider anything owned by him to be compromised. This would include his DNS seeder at `dnsseed.bitcoin.dashjr.org`. If an attacker has indeed compromised this DNS seeder, what could they do and what safeguards exist to mitigate the effects of such a compromise?

**Tags:** network, attack, peer-discovery, dns

> **Comments:**
> **username_1**: What's the status on this? Does Luke still consider his DNS seeder compromised? If so it should be removed from the DNS seeds in the Core repo right?  

---

## 1 answers

### Answer by username_0 on 2023-01-04. Score: 6 | Accepted answer

DNS seeders exist in order to bootstrap new nodes to the network. Nodes maintain a database of IP addresses for other nodes that they can connect to which they build by requesting IP addresses of other nodes from the nodes that they have already connected to. However new nodes have never connected to the network, so they use the DNS seeders to get this information.

New nodes will use DNS to request IP addresses for the hardcoded DNS seeder domains. These are supposed to be IP addresses of random nodes on the network that have also met some metric (defined by the seeder operator) for being "good" (e.g. high uptime). However these nodes are not used directly. Rather the new node will briefly connect to the nodes returned by the seeders to ask for more node IP addresses, and then try connecting to those IPs.

Since the DNS seeder operators can affect which nodes new nodes will try to connect to, an attacker with control over a DNS seeder could use this to perform an eclipse attack. To successfully eclipse attack a node, that node needs to be only connected to nodes controlled by the attacker. If they have a connection to just one honest node, they will be able to receive the main chain and will therefore not be eclipsed.

To increase the probability that there is at least one honest connection, multiple DNS seeders will be queried at the same time. This makes it harder for one DNS seeder to dominate the entire address database. As long as the node has received addresses from an honest DNS seeder, it should be able to make an honest connection to the network.

Additionally, there are other safeguards against eclipse attacks in general. These include disconnecting nodes that advertise low work blockchains, disconnecting nodes that refuse to accept a higher work chain offered by the node, and restricting the number of outbound connections to each `/16` or ASN. All of these increase the cost to an eclipse attacker as they will need to have nodes on many different networks and have done a lot of work in order to mine a blockchain that would be accepted by the node.

Overall, compromise of a single DNS seeder is not catastrophic as the only nodes affected are new ones, there are other seeders new nodes will be querying, and there are safeguards in place to make eclipse attacks difficult.


---

