Eclipse Attack

What is an Eclipse Attack?

An eclipse attack is a comparatively simple attack that a hostile actor may use to disrupt network nodes. The attack, as the name implies, seeks to conceal a participant's view of the peer-to-peer network to cause broad disruption or prepare for more complex attacks.

On the surface, eclipse attacks appear to be similar to Sybil attacks. While they have some similarities (the malicious actor will overwhelm the network with phony peers), their ultimate purpose is different. An eclipse attack targets a single node (for reasons mentioned later), but a Sybil attack is a network-wide attack aimed to exploit the protocol's reputational system.

Working Mechanism of an Eclipse Attack

Bitcoin miners need specialized equipment to generate new blocks, whereas non-mining (or full) nodes can run on minimal processing resources. This contributes to Bitcoin's decentralization because anyone may set up a node on low-spec equipment. 

To stay in sync with the whole network, the software keeps a database of transactions that it integrates with its immediate peers. Bandwidth is a major limitation for numerous nodes. Even though many devices are operating on the software, the average device is unlikely to connect directly to most of them due to constraints in the Bitcoin program, which only allows for a maximum of 125 connections. 

The malicious actor will ensure that all of the target's connections are routed to attacker-controlled nodes in an eclipse attack. The entity will initially flood the target with its IP addresses, which the victim would almost certainly connect to once their program is restarted. 

A restart can be forced, or the attacker might wait for it to happen. Once this occurs, the unwary victim is at the discretion of the rogue nodes; with no perspective of the larger network, the attacker can feed them erroneous data.