The attacker has to exploit a few vulnerabilities to replace legitimate peer addresses with their own addresses. Some of the vulnerabilities in Bitcoin nodes that can be exploited are as follows:
- The node selects the IP addresses from the tried bucket with recent timestamps, which increases the probability of the attacker getting selected even if the attacker owns a small portion of the tried bucket addresses. The attacker can increase the chances by increasing the attack time.
- Whenever an address bucket is filled, one of the addresses is removed randomly. Since the removed address is random, if an attacker's IP is removed from the bucket, it can be eventually inserted by repeatedly sending it to the node. ...