The financial crime landscape is evolving along with the digitization in financial services. In this context, laws and regulations cannot efficiently cope with a fast-moving industry such as finance, which translates in late adoption of measures and legal voids, providing a fruitful landscape for malicious actors. In parallel, blockchain technology and its promising features such as immutability, verifiability, and authentication, enhance the opportunities of financial forensics. In this paper, we focus on an embezzlement scheme and we provide a forensic-by-design methodology for its investigation. In addition, the feasibility and adaptability of our approach can be extended and embrace digital investigations on other types of schemes. We provide a functional implementation based on smart contracts and we integrate standardised forensic flows and chain of custody preservation mechanisms. Finally, we discuss the benefits and challenges of the symbiotic relationship between blockchain and financial investigations, along with future research directions.
In Proof-of-Work Blockchain-based systems, the ledger is kept consistent through some participants solving cryptopuzzles, usually referred to as block mining. Conventional wisdom asserts that the mining protocol is incentive-compatible. However, whether some strategic mining behaviors occur in practice or not, has been the subject of extensive debate. In this paper, we target this question by detecting anomalies in the statistics of consecutive blocks among several popular cryptocurrency systems. Firstly, we measure the inequality of mining revenue distribution in each system. Secondly, we propose a statistical method to identify the selfish mining (SM) behavior, a mining attack strategy posited by Eyal and Sirer in 2014. Our method is based on abnormal (statistically significant) high probability of continuously mining blocks. Finally, we extend our method to detect the mining cartels, in which miners secretly get together and share information about newly mined blocks. Our analysis will contribute to the research of fairness in cryptocurrency mining by providing evidence that the aforementioned strategic mining behaviors do take place in practice.
In recent years, networked computers are extensively used in every aspect of our daily lives. Besides, the anonymous structure of the Internet results in an increase in the number of attacks not only for individual users but also for local area networks. Current attacks are more sophisticated, and they are developed by experienced intruders with the use of automated malware production methods. These organized intrusions can go over the defense lines of the systems due to the weakness of the detection/prevention mechanisms or carelessness of individual users. After sneaking into the system, these attacks can work until they are detected, and they can access many critical resources of the company. Earlier detection of these attacks is very trivial issue for the security admins. This can be accomplished by acquiring the signature (critical information) of the newest attacks as early as possible. One suggested solution is the use of a Threat Information Sharing system, which is set up between security firms and authorities. This approach enables the distribution of the marks of the recent (zero-day) attacks and the development of some proactive prevention mechanisms for them. The use of both peer to peer and centralized sharing mechanisms have some inherited deficiencies. Therefore, in this paper, a pure decentralized cyber security information sharing system is proposed with the use of blockchain technology. A controlled decision-making mechanism, authorization termination, and rule-sets maintenance are proposed to make distributed decisions within the system. For making a decision, two smart contracts should be used in the blockchain. One holds the positive votes while the other holds the negative ones. Members of the system are able to access cyber threat data by using company-related queries. The system can facilitate the integration of many data sources into cyber security management system. Additionally, it enables to collect in a single repository that can be accessed for implementing real-time cyber security applications.
Financial Intelligence Units (FIUs) hold a central position in the chain of actors responsible for the monitoring of money movements in the European Union. In support of their role, which is to receive, analyse and disseminate suspicious transaction reports, they have been furnished with significant information processing powers. At present, FIUs feature prominently in the EU’s anti-money laundering and counterterrorist financing agendas and plans to further enhance their powers of information exchange are underway. At the same time, however, the legal challenges that arise from their constant empowerment, particularly for the protection of personal data, are being overlooked. This article focuses on the cooperation between FIUs in the EU and argues that the latter takes place under a complex legal framework, which raises significant challenges for data protection. In particular, it highlights the present-day uncertainty over the data protection framework that governs their operations and discusses whether FIUs should be subject to the General Data Protection Regulation or to its law enforcement counterpart, the Police Data Protection Directive. The remaining of the article focuses on the ‘ FIU.net ’ – the decentralized network for information exchanges between EU FIUs – and on the data protection challenges that emerged from the recent integration of this network into Europol.
Tim K. Mackey, Ken Miyachi, Danny Fung, Samson Qian · 5 authors
BACKGROUND: An estimated US $2.6 billion loss is attributed to health care fraud and abuse. With traditional health care claims verification and reimbursement, the health care provider submits a claim after rendering services to a patient, which is then verified and reimbursed by the payer. However, this process leaves out a critical stakeholder: the patient for whom the services are actually rendered. This lack of patient participation introduces a risk of fraud and abuse. Blockchain technology enables secure data management with transparency, which could mitigate this risk of health care fraud and abuse. OBJECTIVE: The aim of this study is to develop a framework using blockchain to record claims data and transactions in an immutable format and to enable the patient to act as a validating node to help detect and prevent health care fraud and abuse. METHODS: We developed a health care fraud and abuse blockchain technical framework and prototype using key blockchain tools and application layers including consensus algorithms, smart contracts, tokens, and governance based on digital identity on the Ethereum platform (Ethereum Foundation). RESULTS: Our technical framework maps to the claims adjudication process and focuses on Medicare claims, with the US Centers for Medicare and Medicaid Services (CMS) as the central authority. A prototype of the framework system was developed using the blockchain platform Ethereum (Ethereum Foundation), with its design features, workflow, smart contract functions, system architecture, and software implementation outlined. The software stack used to build the system consisted of a front-end user interface framework, a back-end processing server, and a blockchain network. React was used for the user interface framework, and NodeJS and an Express server were used for the back-end processing server; Solidity was the smart contract language used to interact with a local Ethereum blockchain network. CONCLUSIONS: The proposed framework and the initial prototype have the potential to improve the health care claims process by using blockchain technology for secure data storage and consensus mechanisms, which make the claims adjudication process more patient-centric for the purposes of identifying and preventing health care fraud and abuse. Future work will focus on the use of synthetic or historic CMS claims data to assess the real-world viability of the framework.
Ransomware is malicious software (malware) that blocks access to someone’s computer system or files on the system and subsequently demands a ransom to be paid for unlocking the computer or files. Ransomware is considered one of the main threats in cybercrime today. Cryptoware is a specific type of ransomware, which encrypts files on computer systems. The ransom is often demanded in bitcoins. Based on desk research, a series of interviews, and the investigation of several police files, this paper investigates the modi operandi in which cybercriminals use ransomware and cryptoware to make profits and how they launder these profits. Two models, based on the payment of the ransom via vouchers and via bitcoins respectively, are identified and described. These methods allow criminals to launder profits in relative anonymity and prevent the seizure of the illegally obtained money.
<p>The sudden development of the COVID-19 pandemic exposed the limitations in modern healthcare systems to handle public health emergencies. It is evident that adopting innovative technologies such as blockchain can help in effective planning operations and resource deployments. Blockchain technology can play an important role in the healthcare sector such as improved clinical trial data management by reducing delays in regulatory approvals, streamline the communication between diverse stakeholders of the supply chain etc. Moreover, the spread of misinformation has intensely increased during the outbreak and existing platforms lack the ability to validate the authenticity of data, causing people to panic and act irrationally. Thus, developing a blockchain-based tracking system is important to ensure that the information received by the public and government agencies are reliable and trustworthy. In this paper, we focus on blockchain abilities to track the COVID-19 data collected from various sources including news, healthcare professionals, researchers etc, verify and append them in a secure and trusted distributed ledger. Thus, we propose a generic framework using Ethereum smart contracts and oracles to track real-time data related to the number of new cases, deaths and recovered cases obtained from trusted sources. We present detailed algorithms that capture the interactions between stakeholders in the network. The smart contract code was developed and tested in Remix environment. We present the cost and security analysis incurred by the stakeholders and highlight the challenges and future directions of our work. Our work demonstrates that the proposed solution is economically feasible and ensures data integrity, security, transparency, data traceability among stakeholders. </p>
The Bisq DAO is a core component of Bisq, a decentralized cryptocurrency exchange. The purpose of the Bisq DAO is to decentralize the governance and finance functions of the exchange. However, by interacting with the Bisq DAO, participants necessarily publish data to the Bitcoin blockchain and broadcast additional data to the Bisq peer-to-peer network. We examine the privacy cost to participants in sharing this data. Specifically, we use a novel address clustering heuristic to construct the one-to-many mappings from participants to addresses on the Bitcoin blockchain and augment the address clusters with data stored within the Bisq peer-to-peer network. We show that this technique aggregates activity performed by each participant: trading, voting, transfers, etc. We identify instances where participants are operating under multiple aliases, some of which are real-world names. We identify the dominant transactors and their role in a two-sided market. We conclude with suggestions to better protect the privacy of participants in the future.
In recent years, blockchain technology has created a new cryptocurrency world and has attracted a lot of attention. It also is rampant with various scams. For example, phishing scams have grabbed a lot of money and has become an important threat to users' financial security in the blockchain ecosystem. To help deal with this issue, this paper proposes a systematic approach to detect phishing accounts based on blockchain transactions and take Ethereum as an example to verify its effectiveness. Specifically, we propose a graph-based cascade feature extraction method based on transaction records and a lightGBM-based Dual-sampling Ensemble algorithm to build the identification model. Extensive experiments show that the proposed algorithm can effectively identify phishing scams.
Ransomware is malicious software (malware) that blocks access to someone’s computer system or files on the system and subsequently demands a ransom to be paid for unlocking the computer or files. Ransomware is considered one of the main threats in cybercrime today. Cryptoware is a specific type of ransomware, which encrypts files on computer systems. The ransom is often demanded in bitcoins. Based on desk research, a series of interviews, and the investigation of several police files, this paper investigates the modi operandi in which cybercriminals use ransomware and cryptoware to make profits and how they launder these profits. Two models, based on the payment of the ransom via vouchers and via bitcoins respectively, are identified and described. These methods allow criminals to launder profits in relative anonymity and prevent the seizure of the illegally obtained money.
On the blockchain, cryptocurrencies play a role similar to cash, while cryptographic tokens are a universal tool for handling rights and assets. Software wallets interact with blockchains in general and with smart contracts (on-chain programs) in particular. Some wallets are realized (partly) as smart contracts with the intent to increase trust and security by being transparent and by offering features like daily limits, approvals, multiple signatures, and recovery mechanisms. Ethereum is the most prominent platform for both, tokens and smart contracts, and thus also for wallet contracts. We discuss several methods for identifying wallet contracts in a semi-automatic manner by looking at the deployed bytecodes and their interaction patterns. Furthermore, we differentiate characteristics of wallets in use, and group them into six types.
The Bitcoin system keeps its ledger consistent in a blockchain by solving cryptographic problems, in a method called "Proof-of-Work". The conventional wisdom asserts that the mining protocol is incentive-compatible. However, Eyal and Sirer in 2014 have discovered a mining attack strategy called selfish mining (SM), in which a miner (or a mining pool) publishes the blocks it mines selectively instead of immediately. SM strategy would have the impact of wasting resources of honest miners. Scholars proposed various extensions of the SM strategy and approaches to defense the SM attack. Whether selfish mining occurs in practice or not, has been subject of extensive debate. For the first time, in this paper we propose a method to identify selfish miners by detecting anomalies in the properties of consecutive blocks' statistics. Furthermore, we extend our method to detect the mining cartels, in which miners secretly get together and share timely information. Our results provide evidence that these strategic behaviors take place in practice.
Over the past few years, there has been a growth in activity, public knowledge, and awareness of cryptocurrencies and related blockchain technology. As the industry has grown, there has also been an increase in scams looking to steal unsuspecting individuals' cryptocurrency. Many of the scams operate on visually similar but seemingly unconnected websites, advertised by malicious social media accounts, which either attempt an advance-fee scam or operate as phishing websites. This paper analyses public online and blockchain-based data to provide a deeper understanding of these cryptocurrency scams. The clustering technique DBSCAN is applied to the content of scam websites to discover a typology of advance-fee and phishing scams. It is found that the same entities are running multiple instances of similar scams, revealed by their online infrastructure and blockchain activity. The entities also manufacture public blockchain activity to create the appearance that their scams are genuine. Through source and destination of funds analysis, it is observed that victims usually send funds from fiat-accepting exchanges. The entities running these scams cash-out or launder their proceeds using a variety of avenues including exchanges, gambling sites, and mixers.
Long before the creation of blockchain platforms, the rise of personal computing and Internet connectivity brought with it a digital, online dimension of the material world, leading to the socio-technical construct known as ‘digital identity’. After the online discussion boards and emailing lists of the early 90s, individuals started socializing via the Internet more predominantly using social networks. One specific type of platform links this online socializing and transacting to blockchain-based spaces: dark web marketplaces. Identified as second-generation cryptocommunities, dark web marketplaces deployed cryptography for the use of pseudonymous identity, for communication, but also currency. This paper explores two questions in this fascinating space: what was the role of identity on the Silk Road, and what governance lessons can be drawn from this illustration for the purpose of applying them to more recent cybercommunities such as Ethereum? The paper is structured as follows. The first part describes the Silk Road and sketches its essential characteristics. The second part looks at how individuals could become platform users on the Silk Road, by analyzing the contractual relationship between the Silk Road and an individual user based on the rights and obligations enshrined in the Silk Road Terms of Service (ToS). The third part critically reflects on arbitrariness as the main pitfall arising out of the private regulatory framework created by the Silk Road, and contributes to existing narratives surrounding the regulatory nature of code by proposing a code-as-procedure perspective for analyzing this regulatory framework. Part four concludes.
Rafael Ziolkowski, Gianluca Miscione, Gerhard Schwabe
Blockchain comes with the promise of being a disruptive technology with the potential for novel ways of interaction in a wide range of applications. Following broader application, scholarly interest in the technology is growing, though an extensive analysis of blockchain applications from a governance perspective is lacking to date. This research pays special attention to the governance of blockchain systems and illustrates decision problems in 14 blockchain systems from four application domains. Based on academic literature, semi-structured interviews with representatives from those organizations, and content analysis of grey literature, common problems in blockchain governance have been singled out and contextualized. Studying their enactment revealed their relevance to major organizational theories in what we labelled “Patrolling the borders,” “External Legitimation,” “Reduction of Discretionality,” and “Temporal Management.” The identification of these problems enriches the scarce body of knowledge on the governance of blockchain systems, resulting in a better understanding of how blockchain governance links to existing concepts and how it is enacted in practice.
Ajay K. Gogineni, S. Swayamjyoti, Devadatta Sahoo, Κ. K. Sahu · 5 authors
Vulnerability detection and safety of smart contracts are of paramount importance because of their immutable nature. Symbolic tools like OYENTE and MAIAN are typically used for vulnerability prediction in smart contracts. As these tools are computationally expensive, they are typically used to detect vulnerabilities until some predefined invocation depth. These tools require more search time as the invocation depth increases. Since the number of smart contracts is increasing exponentially, it is difficult to analyze the contracts using these traditional tools. Recently a machine learning technique called Long Short Term Memory (LSTM) has been used for binary classification, i.e., to predict whether a smart contract is vulnerable or not. This technique requires nearly constant search time as the invocation depth increases. In the present article, we have shown a multi-class classification, where we classify a smart contract in Suicidal, Prodigal, Greedy, or Normal categories. We used Average Stochastic Gradient Descent Weight-Dropped LSTM (AWD-LSTM), which is a variant of LSTM, to perform classification. We reduced the class imbalance (a large number of normal contracts as compared to other categories) by considering only the distinct opcode combination for normal contracts. We have achieved a weighted average Fbeta score of 90.0%. Hence, such techniques can be used to analyze a large number of smart contracts and help to improve the security of these contracts.
The convergence of fifth-generation (5G) communication and the Internet-of-Things (IoT) has dramatically increased the diversity and complexity of the network. This change diversifies the attacker’s attack vectors, increasing the impact and damage of cyber threats. Cyber threat intelligence (CTI) technology is a proof-based security system which responds to these advanced cyber threats proactively by analyzing and sharing security-related data. However, the performance of CTI systems can be significantly compromised by creating and disseminating improper security policies if an attacker intentionally injects malicious data into the system. In this paper, we propose a blockchain-based CTI framework that improves confidence in the source and content of the data and can quickly detect and eliminate inaccurate data for resistance to a Sybil attack. The proposed framework collects CTI by a procedure validated through smart contracts and stores information about the metainformation of data in a blockchain network. The proposed system ensures the validity and reliability of CTI data by ensuring traceability to the data source and proposes a system model that can efficiently operate and manage CTI data in compliance with the de facto standard. We present the simulation results to prove the effectiveness and Sybil-resistance of the proposed framework in terms of reliability and cost to attackers.
Blockchain technology has become a paradigm shift to digital transactions. It has brought massive potentials in many fields, such as financial services, energy, healthcare and Internet of Things. As often occurs with innovative technologies, it has suffered from several critical Cybersecurity threats and vulnerabilities.
Christos Karapapas, Iakovos Pittaras, Nikos Fotiou, George C. Polyzos
Decentralized systems, such as distributed ledgers and the InterPlanetary File System (IPFS), are designed to offer more open and robust services. However, they also create opportunities for illegal activities. We demonstrate how these technologies can be used to launch a ransomware as a service campaign. We show that criminals can transact with affiliates and victims without having to reveal their identity. Furthermore, by exploiting the robustness and resilience to churn of IPFS, as well as the decentralized computing capabilities of Ethereum, criminals can remain offline during most procedures, with many privacy guarantees.
Sinyong Choi, Kyung-Shick Choi, Yesim Sungu-Eryilmaz, Heekyung Park
The Darknet and Bitcoins have been widely utilized by those who wish to anonymously perform illegal activities in cyberspace. Restricted in many countries, gambling websites utilize Bitcoin payments that allow users to freely engage in illegal gambling activities with the absence of a formal capable guardian. Despite the urgency and limited knowledge available to law enforcement regarding this issue, few empirical studies have focused on illegal gambling websites. The current study attempts to examine the characteristics and operations of online gambling websites on both the Darknet and Surface Web, which allow Bitcoin payments. The findings suggest that both websites on the Surface Web and Darknet have similar and distinctive features that attract and encourage online users to engage in extensive illegal gambling activities and potentially other illegal activities as well. The study concludes with policy recommendations to remedy the issue of online gambling.
Antonio López Vivar, Alberto Turégano Castedo, Ana Lucila Sandoval Orozco, Luis Javier García Villalba
Smart contracts have gained a lot of popularity in recent times as they are a very powerful tool for the development of decentralised and automatic applications in many fields without the need for intermediaries or trusted third parties. However, due to the decentralised nature of the blockchain on which they are based, a series of challenges have emerged related to vulnerabilities in their programming that, given their particularities, could have (and have already had) a very high economic impact. This article provides a holistic view of security challenges associated with smart contracts, as well as the state of the art of available public domain tools.
Popular Blockchain-based cryptocurrencies, like Bitcoin, are increasingly being used maliciously for illegal trades. In order to trace and analyze suspected Bitcoin transactions and addresses, address clustering methods and Bitcoin flow analysis methods are gaining attention recently. However, existing methods only focus on Bitcoin addresses and flow, and neglect other important information, such as transaction structure and behavior features. In order to exploit all useful features of transactions, this paper proposes a Bitcoin transaction network analytic method for facilitating Blockchain forensic investigation based on an extended safe Petri Net. The structural features and dynamic semantics of Petri net are used in our proposed model to define the static and dynamic features of Bitcoin transactions. Nineteen features have been identified to define Bitcoin transaction patterns for analyzing and finding suspected addresses. Bitcoin gene has been embedded into the Petri net transitions to trace and analyze Bitcoin flow accurately. Finally, marginal distribution analysis of Bitcoin transaction features and data visualization techniques are used to eliminate some false positive samples further and to improve the accuracy of identifying suspected addresses. The proposed Bitcoin transaction network analytic method provides a reliable forensic investigation model along with a prototype platform which is beneficial for financial security. The efficiency of our proposed method is empirically verified based on a real-life case study analysis.