Technical, forensic and organisational aspects of work with Monero cryptocurrency
The forensic, organisational and technical features of law enforcement agencies' work with the Monero cryptocurrency in the context of pre-trial investigation and operational search activities are analysed. The development of the Monero system is described. The reasons and trends of Monero use...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Kharkiv National University of Internal Affairs
2023-09-01
|
| Series: | Право і безпека |
| Subjects: | |
| Online Access: | http://pb.univd.edu.ua/index.php/PB/article/view/746 |
| _version_ | 1797637793389740032 |
|---|---|
| author | V. V. Nosov O. V. Manzhai V. O. Kovtun |
| author_facet | V. V. Nosov O. V. Manzhai V. O. Kovtun |
| author_sort | V. V. Nosov |
| collection | DOAJ |
| description | The forensic, organisational and technical features of law enforcement agencies' work with the Monero cryptocurrency in the context of pre-trial investigation and operational search activities are analysed. The development of the Monero system is described. The reasons and trends of Monero use by offenders are identified, and the scheme of operation of this payment system, which ensures its increased confidentiality, is shown. Examples of criminal offences in which Monero is used are presented. The functionality of OpenAlias to facilitate the work with Monero addresses is disclosed. The possibility of identifying participants in Monero transactions is studied. It is stated that there are currently no effective ways of such identification without knowledge of the public address and the corresponding keys, especially if users use additional security mechanisms such as connection to the TOR network.
The features of forensic investigation of computer equipment used to work with Monero are revealed. It is established that the most effective is the study of traces of work with Monero, which are removed from the relevant computer equipment of the person of interest. Useful information can be stored in RAM, on a disc, and partially in network traffic. The article identifies artefacts that should be taken into account during inspection and search. Atomic Swaps of XMR are modelled to determine the trace pattern and identify artefacts of increased attention during forensic procedures. The fact that an atomic swap was carried out to obfuscate traces may be evidenced by the presence of specific software files on the disc used for this purpose.
The algorithm for XMR withdrawal using multisig addresses has been proposed, from which funds can be withdrawn only when digital signatures of several persons are superimposed. The work of this algorithm in the test network Stagenet is modelled. It has been concluded that law enforcement agencies should focus on classical investigative measures to identify Monero users of interest. At the same time, there are effective mechanisms for documenting traces of work with the Monero payment system and proven methods for extracting passphrases to crypto-wallets and other sensitive information on the movement of funds in the Monero system from computer equipment. |
| first_indexed | 2024-03-11T12:54:25Z |
| format | Article |
| id | doaj.art-548475d384c0488aa3b602dc7d36ade4 |
| institution | Directory Open Access Journal |
| issn | 1727-1584 2617-2933 |
| language | English |
| last_indexed | 2024-03-11T12:54:25Z |
| publishDate | 2023-09-01 |
| publisher | Kharkiv National University of Internal Affairs |
| record_format | Article |
| series | Право і безпека |
| spelling | doaj.art-548475d384c0488aa3b602dc7d36ade42023-11-03T21:27:45ZengKharkiv National University of Internal AffairsПраво і безпека1727-15842617-29332023-09-0190310212510.32631/pb.2023.3.09746Technical, forensic and organisational aspects of work with Monero cryptocurrencyV. V. Nosov0O. V. Manzhai1V. O. Kovtun2Kharkiv National University of Internal AffairsKharkiv National University of Internal AffairsCyberpolice Department of the National Police of UkraineThe forensic, organisational and technical features of law enforcement agencies' work with the Monero cryptocurrency in the context of pre-trial investigation and operational search activities are analysed. The development of the Monero system is described. The reasons and trends of Monero use by offenders are identified, and the scheme of operation of this payment system, which ensures its increased confidentiality, is shown. Examples of criminal offences in which Monero is used are presented. The functionality of OpenAlias to facilitate the work with Monero addresses is disclosed. The possibility of identifying participants in Monero transactions is studied. It is stated that there are currently no effective ways of such identification without knowledge of the public address and the corresponding keys, especially if users use additional security mechanisms such as connection to the TOR network. The features of forensic investigation of computer equipment used to work with Monero are revealed. It is established that the most effective is the study of traces of work with Monero, which are removed from the relevant computer equipment of the person of interest. Useful information can be stored in RAM, on a disc, and partially in network traffic. The article identifies artefacts that should be taken into account during inspection and search. Atomic Swaps of XMR are modelled to determine the trace pattern and identify artefacts of increased attention during forensic procedures. The fact that an atomic swap was carried out to obfuscate traces may be evidenced by the presence of specific software files on the disc used for this purpose. The algorithm for XMR withdrawal using multisig addresses has been proposed, from which funds can be withdrawn only when digital signatures of several persons are superimposed. The work of this algorithm in the test network Stagenet is modelled. It has been concluded that law enforcement agencies should focus on classical investigative measures to identify Monero users of interest. At the same time, there are effective mechanisms for documenting traces of work with the Monero payment system and proven methods for extracting passphrases to crypto-wallets and other sensitive information on the movement of funds in the Monero system from computer equipment.http://pb.univd.edu.ua/index.php/PB/article/view/746cryptocurrencymonerolaw enforcement agenciescrime preventiontrace evidence. |
| spellingShingle | V. V. Nosov O. V. Manzhai V. O. Kovtun Technical, forensic and organisational aspects of work with Monero cryptocurrency Право і безпека cryptocurrency monero law enforcement agencies crime prevention trace evidence. |
| title | Technical, forensic and organisational aspects of work with Monero cryptocurrency |
| title_full | Technical, forensic and organisational aspects of work with Monero cryptocurrency |
| title_fullStr | Technical, forensic and organisational aspects of work with Monero cryptocurrency |
| title_full_unstemmed | Technical, forensic and organisational aspects of work with Monero cryptocurrency |
| title_short | Technical, forensic and organisational aspects of work with Monero cryptocurrency |
| title_sort | technical forensic and organisational aspects of work with monero cryptocurrency |
| topic | cryptocurrency monero law enforcement agencies crime prevention trace evidence. |
| url | http://pb.univd.edu.ua/index.php/PB/article/view/746 |
| work_keys_str_mv | AT vvnosov technicalforensicandorganisationalaspectsofworkwithmonerocryptocurrency AT ovmanzhai technicalforensicandorganisationalaspectsofworkwithmonerocryptocurrency AT vokovtun technicalforensicandorganisationalaspectsofworkwithmonerocryptocurrency |