Networks (Autonomous Systems-AS) allocate or revoke IP prefixes with the intervention of official Internet resource number authorities, and select and advertise policy-compliant paths towards these prefixes using the inter-domain routing system and its primary enabler, the Border Gateway Protocol (BGP). Securing BGP has been a long-term objective of several research and industrial efforts during the last decades, that have culminated in the Resource Public Key Infrastructure (RPKI) for the cryptographic verification of prefix-to-AS assignments. However, there is still no widely adopted solution for securing IP prefixes and the (AS-)paths leading to them; approaches such as BGPsec have seen minuscule deployment. In this work, we design and implement a Blockchain-based system that (i) can be used to validate both of these resource types, (ii) can work passively and does not require any changes in the inter-domain routing system (BGP, RPKI), and (iii) can be combined with currently available systems for the detection and mitigation of routing attacks. We present early results and insights w.r.t. scalability.
Sidra Malik, Volkan Dedeoglu, Salil S. Kanhere, Raja Jurdak
Traceability and integrity are major challenges for the increasingly complex supply chains of today's world. Although blockchain technology has the potential to address these challenges through providing a tamper-proof audit trail of supply chain events and data associated with a product life-cycle, it does not solve the trust problem associated with the data itself. Reputation systems are an effective approach to solve this trust problem. However, current reputation systems are not suited to the blockchain based supply chain applications as they are based on limited observations, they lack granularity and automation, and their overhead has not been explored. In this work, we propose TrustChain, as a three-layered trust management framework which uses a consortium blockchain to track interactions among supply chain participants and to dynamically assign trust and reputation scores based on these interactions. The novelty of TrustChain stems from: (a) the reputation model that evaluates the quality of commodities, and the trustworthiness of entities based on multiple observations of supply chain events, (b) its support for reputation scores that separate between a supply chain participant and products, enabling the assignment of product-specific reputations for the same participant, (c) the use of smart contracts for transparent, efficient, secure, and automated calculation of reputation scores, and (d) its minimal overhead in terms of latency and throughput when compared to a simple blockchain based supply chain model.
Custom tokens are an integral component of decentralized applications (dapps) deployed on Ethereum and other blockchain platforms. For Ethereum, the ERC20 standard is a widely used token interface and is interoperable with many existing dapps, user interface platforms, and popular web applications (e.g., exchange services). An ERC20 security issue, known as the "multiple withdrawal attack", was raised on GitHub and has been open since November 2016. The issue concerns ERC20's defined method approve() which was envisioned as a way for token holders to give permission for other users and dapps to withdraw a capped number of tokens. The security issue arises when a token holder wants to adjust the amount of approved tokens from N to M (this could be an increase or decrease). If malicious, a user or dapp who is approved for N tokens can front-run the adjustment transaction to first withdraw N tokens, then allow the approval to be confirmed, and withdraw an additional M tokens. In this paper, we evaluate 10 proposed mitigations for this issues and find that no solution is fully satisfactory. We then propose 2 new solutions that mitigate the attack, one of which fully fulfills constraints of the standard, and the second one shows a general limitation in addressing this issue from ERC20's approve method.
Blockchain gaming is an emerging entertainment paradigm. However, blockchain games are still suffering from security issues, due to the immature blockchain technologies and its unsophisticated developers. In this work, we analyzed the blockchain game architecture and reveal the possible penetration methods of cracking. We scanned more than 600 commercial blockchain games to summarize a security overview from the perspective of the web server and smart contract, respectively. We also conducted three case studies for blockchain games to show detailed vulnerability detection.
In proof-of-work (PoW)-based blockchain networks, the miners contribute their distributed computation in solving a crypto-puzzle competition to win the reward. To secure stable profits, some miners organize mining pools and share the rewards from the pool in proportion to each miner's contribution. However, some miners may exhibit malicious behaviors which cause a waste of distributed computation resource, even posing a threat on the efficiency of blockchain networks. In this paper, we propose a new game-theoretic framework to incentivize miners mining honestly and help to bring about a higher total welfare of blockchain networks. We first formulate the mining process as a noncooperative iterated game. We then propose a mechanism in terms of zero-determinant strategies (ZD strategies) to encourage the cooperative mining and improve the efficiency of mining in PoW-based blockchain networks. In addition, we theoretically analyze the maximum system welfare of the target pool through the method of optimization. Numerical illustrations are also presented to support our theoretical results.
Lyra2REv2 is a hashing algorithm that consists of a chain of individual hashing algorithms, and it is used as a proof-of-work function in several cryptocurrencies. The most crucial and exotic hashing algorithm in the Lyra2REv2 chain is a specific instance of the general Lyra2 algorithm. In this work, we present the first hardware implementation of the specific instance of Lyra2 that is used in Lyra2REv2 and we explain how several properties of this algorithm can be exploited in order to optimize the design. Moreover, we present an FPGA-based hardware implementation of a full miner chain for Lyra2REv2 on a Xilinx Multi-Processor System on Chip. Our proposed Lyra2REv2 miner chain is shown to be significantly more energy efficient than both a GPU and a commercially available FPGA-based miner. Finally, we also explain how our simplified Lyra2 and Lyra2REv2 architectures can be modified with minimal effort to also support the recent Lyra2REv3 chained hashing algorithm.
Afiya Ayman, Shanto Roy, Mohammad Amin Alipour, Áron Lászka
Blockchain-based platforms are emerging as a transformative technology that can provide reliability, integrity, and auditability without trusted entities. One of the key features of these platforms is the trustworthy decentralized execution of general-purpose computation in the form of smart contracts, which are envisioned to have a wide range of applications. As a result, a rapidly growing and active community of smart-contract developers has emerged in recent years. A number of research efforts have investigated the technological challenges that these developers face, introducing a variety of tools, languages, and frameworks for smart-contract development, focusing on security. However, relatively little is known about the community itself, about the developers, and about the issues that they face and discuss. To address this gap, we study smart-contract developers and their discussions on two social media sites, Stack Exchange and Medium. We provide insight into the trends and key topics of these discussions, into the developers' interest in various security issues and security tools, and into the developers' technological background.
Matteo Romiti, Aljosha Judmayer, Alexei Zamyatin, Bernhard Haslhofer
Dataset retrieved and used with the code hosted here for this paper published at WEIS 2019 Abstract Miners play a key role in cryptocurrencies such as Bitcoin: they invest substantial computational resources in processing transactions and minting new currency units. It is well known that an attacker controlling more than half of the network’s mining power could manipulate the state of the system at will. While the influence of large mining pools appears evenly split, the actual distribution of mining power within these pools and their economic relationships with other actors remain undisclosed. To this end, we conduct the first in-depth analysis of mining reward distribution within three of the four largest Bitcoin mining pools and examine their cross-pool economic relationships. Our results suggest that individual miners are simultaneously operating across all three pools and that in each analyzed pool a small number of actors (≤ 20) receives over 50% of all BTC payouts. While the extent of an operator’s control over the resources of a mining pool remains an open debate, our findings are in line with previous research, pointing out centralization tendencies in large mining pools and cryptocurrencies in general
Jiachi Chen, Xin Xia, David Lo, John Grundy · 6 authors
Smart contracts are programs running on a blockchain. They are immutable to change, and hence can not be patched for bugs once deployed. Thus it is critical to ensure they are bug-free and well-designed before deployment. A Contract defect is an error, flaw or fault in a smart contract that causes it to produce an incorrect or unexpected result, or to behave in unintended ways. The detection of contract defects is a method to avoid potential bugs and improve the design of existing code. Since smart contracts contain numerous distinctive features, such as the gas system. decentralized, it is important to find smart contract specified defects. To fill this gap, we collected smart-contract-related posts from Ethereum StackExchange, as well as real-world smart contracts. We manually analyzed these posts and contracts; using them to define 20 kinds of contract defects. We categorized them into indicating potential security, availability, performance, maintainability and reusability problems. To validate if practitioners consider these contract as harmful, we created an online survey and received 138 responses from 32 different countries. Feedback showed these contract defects are harmful and removing them would improve the quality and robustness of smart contracts. We manually identified our defined contract defects in 587 real world smart contract and publicly released our dataset. Finally, we summarized 5 impacts caused by contract defects. These help developers better understand the symptoms of the defects and removal priority.
With the frantic development of smart contracts on the Ethereum platform, its market value has also climbed. In 2016, people were shocked by the loss of nearly $50 million in cryptocurrencies from the DAO reentrancy attack. Due to the tremendous amount of money flowing in smart contracts, its security has attracted much attention of researchers. In this paper, we investigated several common smart contract vulnerabilities and analyzed their possible scenarios and how they may be exploited. Furthermore, we survey the smart contract vulnerability detection tools for the Ethereum platform in recent years. We found that these tools have similar prototypes in software vulnerability detection technology. Moreover, for the features of public distribution systems such as Ethereum, we present the new challenges that these software vulnerability detection technologies face.
Following Bitcoin's Nakamoto Consensus protocol (NC), hundreds of cryptocurrencies utilize proofs of work (PoW) to maintain their ledgers. However, research shows that NC fails to achieve perfect chain quality, allowing malicious miners to alter the public ledger in order to launch several attacks, i.e., selfish mining, double-spending and feather-forking. Some later designs, represented by Ethereum, Bitcoin-NG, DECOR+, Byzcoin and Publish or Perish, aim to solve the problem by raising the chain quality; other designs, represented by Fruitchains, DECOR+ and Subchains, claim to successfully defend against the attacks in the absence of perfect chain quality. As their effectiveness remains self-claimed, the community is divided on whether a secure PoW protocol is possible. In order to resolve this ambiguity and to lay down the foundation of a common body of knowledge, this paper introduces a multi-metric evaluation framework to quantitatively analyze PoW protocols' chain quality and attack resistance. Subsequently we use this framework to evaluate the security of these improved designs through Markov decision processes. We conclude that to date, no PoW protocol achieves ideal chain quality or is resistant against all three attacks. We attribute existing PoW protocols' imperfect chain quality to their unrealistic security assumptions, and their unsatisfactory attack resistance to a dilemma between "rewarding the bad" and "punishing the good". Moreover, our analysis reveals various new protocol-specific attack strategies. Based on our analysis, we propose future directions toward more secure PoW protocols and indicate several common pitfalls in PoW security analyses.
Many chatbots have been developed that provide a multitude of services through a wide range of methods. A chatbot is a brand-new conversational agent in the highspeed changing technology world. With the advance of Artificial Intelligence and machine learning, chatbots are becoming more and more popular. A chatbot is the extension of human interface mediums such as the phone and social platforms. Similarly, Cryptocurrency is a new extension of digital or virtual currency designed to work as a medium of exchange. In the current digital exchanging world, investors and interested parties are eager to know more information about, and the capabilites of, this new type of currency. One of the potential paths to retrieve the info automatically and quickly is through a chatbot. We explored the open source python library, Chatterbot, to apply Itchat API (a WeChat interface) with the aim of building a robot chatting application, I&C Chat, on the topic of cryptocurrency. First, we collected question and answer pairs datasets from Quora websites. Furthermore, we also created API calls to query the real time quote for the top 25 cryptocurrencies. Then we used the collected data to train our chatbot and implemented a logic adapter to receive the price quote of cryptocurrencies based on the incoming question. The Itchat API method will return the best matched answer to the asking party automatically. The response time of different questions has been investigated. The results imply that this application is quite useful, feasible and beneficial to the digital currency world.
After the meteoric rise in price, and subsequent public interest, of the cryptocurrency Bitcoin, a developing body of work has begun examining its impact on society. In recent months, as Bitcoin's price has rapidly declined, uncertainty and distrust have begun to overshadow early enthusiasm. In this late-breaking work, we investigated one of the largest and most important Bitcoin online communities, the r/Bitcoin Reddit forum. A vocal subgroup of users identify themselves as "true Bitcoiners", and justify their continued devotion to Bitcoin. These subreddit participants explained and justified their trust in Bitcoin in three primary ways: identifying characteristics of beneficial versus harmful Bitcoin users, diminishing the importance of problems, and describing themselves as loyal to Bitcoin over time.
Bitcoin blockchain technology is a distributed ledger of nodes authorizing transactions between anonymous parties. Its key actors are miners using computational power to solve mathematical problems for validating transactions. By sharing blockchain's characteristics, mining is a decentralized, transparent and unregulated practice, less explored in HCI, so we know little about miners' motivations and experiences, and how these may impact on different dimensions of trust. This paper reports on interviews with 20 bitcoin miners about their practices and trust challenges. Findings contribute to HCI theories by extending the exploration of blockchain's characteristics relevant to trust with the competitiveness dimension underpinning the social organization of mining. We discuss the risks of collaborative mining due to centralization and dishonest administrators, and conclude with design implications highlighting the need for tools monitoring the distribution of rewards in collaborative mining, tools tracking data centers' authorization and reputation, and tools supporting the development of decentralized pools.
The 51% attack is a technique which intends to fork a blockchain in order to conduct double-spending. Adversaries controlling more than half of the total hashing power of a network can perform this attack. In a similar way, n confirmation and selfish mining are two attack techniques that comprise a similar strategy to the 51% attack. Due to the immense attacking cost to perform the 51% attack, it was considered very unlikely for a long period. However, in recent times, the attack has befallen at a frequent pace, costing millions of dollars to various cryptocurrencies. The 51% attack strategy varies based upon the adopted consensus mechanism by a particular cryptocurrency, and it enables attackers to double-spend the same crypto-coin, restrict transactions, cancel blocks, and even have full control over the price of a cryptocurrency. A crypto-coin with a low hashing power is always jeopardized by the 51% attack due to the easily attainable hashing. In this paper, we analyze the real impact of the 51% attack, revealing serious weaknesses in consensus protocols that made this attack possible. We discuss the five most advanced protection techniques to prevent this attack and their main limitations. We conclude that in most cases, security techniques fail to provide real protection against the 51% attack because the weaknesses are inherited from the consensus protocols.
This paper presents an empirical analysis of Steemit, a key representative of the emerging incentivized social media platforms over Blockchains, to understand and evaluate the actual level of decentralization and the practical effects of cryptocurrency-driven reward system in these modern social media platforms. Similar to Bitcoin, Steemit is operated by a decentralized community, where 21 members are periodically elected to cooperatively operate the platform through the Delegated Proof-of-Stake (DPoS) consensus protocol. Our study performed on 539 million operations performed by 1.12 million Steemit users during the period 2016/03 to 2018/08 reveals that the actual level of decentralization in Steemit is far lower than the ideal level, indicating that the DPoS consensus protocol may not be a desirable approach for establishing a highly decentralized social media platform. In Steemit, users create contents as posts which get curated based on votes from other users. The platform periodically issues cryptocurrency as rewards to creators and curators of popular posts. Although such a reward system is originally driven by the desire to incentivize users to contribute to high-quality contents, our analysis of the underlying cryptocurrency transfer network on the blockchain reveals that more than 16% transfers of cryptocurrency in Steemit are sent to curators suspected to be bots and also finds the existence of an underlying supply network for the bots, both suggesting a significant misuse of the current reward system in Steemit. Our study is designed to provide insights on the current state of this emerging blockchain-based social media platform including the effectiveness of its design and the operation of the consensus protocols and the reward system.
The rise of ubiquitous deepfakes, misinformation, disinformation, propaganda and post-truth, often referred to as fake news, raises concerns over the role of Internet and social media in modern democratic societies. Due to its rapid and widespread diffusion, digital deception has not only an individual or societal cost (e.g., to hamper the integrity of elections), but it can lead to significant economic losses (e.g., to affect stock market performance) or to risks to national security. Blockchain and other Distributed Ledger Technologies (DLTs) guarantee the provenance, authenticity and traceability of data by providing a transparent, immutable and verifiable record of transactions while creating a peer-to-peer secure platform for storing and exchanging information. This overview aims to explore the potential of DLTs and blockchain to combat digital deception, reviewing initiatives that are currently under development and identifying their main current challenges. Moreover, some recommendations are enumerated to guide future researchers on issues that will have to be tackled to face fake news, disinformation and deepfakes, as an integral part of strengthening the resilience against cyber-threats on today's online media.
Bruno Rodrigues, Lukas Eisenring, Eder J. Scheid, Thomas Bocek · 5 authors
The volume of traffic generated by modern Distributed Denial-of-Service (DDoS) attacks suggests that centralized defenses are not the most effective approach to counter these attacks. An alternative to reduce the burden of detection and mitigation is to combine centralized defense systems, creating a global and cooperative protection system. However, existing approaches suffer from the complexity of deployment and operation across different systems. Blockchains appear in this scenario as an alternative to simplify the exchange of information in a cooperative defense. This work evaluates in both local and global experimentations the performance of the blockchain system proposed in [8] concerning the latency to perform the signaling of blacklisted addresses.
Muhammad Saad, Jeffrey Spaulding, Laurent Njilla, Charles Kamhoua · 7 authors
In this paper, we systematically explore the attack surface of the Blockchain technology, with an emphasis on public Blockchains. Towards this goal, we attribute attack viability in the attack surface to 1) the Blockchain cryptographic constructs, 2) the distributed architecture of the systems using Blockchain, and 3) the Blockchain application context. To each of those contributing factors, we outline several attacks, including selfish mining, the 51% attack, Domain Name System (DNS) attacks, distributed denial-of-service (DDoS) attacks, consensus delay (due to selfish behavior or distributed denial-of-service attacks), Blockchain forks, orphaned and stale blocks, block ingestion, wallet thefts, smart contract attacks, and privacy attacks. We also explore the causal relationships between these attacks to demonstrate how various attack vectors are connected to one another. A secondary contribution of this work is outlining effective defense measures taken by the Blockchain technology or proposed by researchers to mitigate the effects of these attacks and patch associated vulnerabilities
We performed the first systematic study of a new attack on Ethereum that steals cryptocurrencies. The attack is due to the unprotected JSON-RPC endpoints existed in Ethereum nodes that could be exploited by attackers to transfer the Ether and ERC20 tokens to attackers-controlled accounts. This study aims to shed light on the attack, including malicious behaviors and profits of attackers. Specifically, we first designed and implemented a honeypot that could capture real attacks in the wild. We then deployed the honeypot and reported results of the collected data in a period of six months. In total, our system captured more than 308 million requests from 1,072 distinct IP addresses. We further grouped attackers into 36 groups with 59 distinct Ethereum accounts. Among them, attackers of 34 groups were stealing the Ether, while other 2 groups were targeting ERC20 tokens. The further behavior analysis showed that attackers were following a three-steps pattern to steal the Ether. Moreover, we observed an interesting type of transaction called zero gas transaction, which has been leveraged by attackers to steal ERC20 tokens. At last, we estimated the overall profits of attackers. To engage the whole community, the dataset of captured attacks is released on https://github.com/zjuicsr/eth-honey.
Adnan Qayyum, Junaid Qadir, Muhammad Umar Janjua, Falak Sher
In recent years, `fake news' has become a global issue that raises unprecedented challenges for human society and democracy. This problem has arisen due to the emergence of various concomitant phenomena such as (1) the digitization of human life and the ease of disseminating news through social networking applications (such as Facebook and WhatsApp); (2) the availability of `big data' that allows customization of news feeds and the creation of polarized so-called `filter-bubbles'; and (3) the rapid progress made by generative machine learning (ML) and deep learning (DL) algorithms in creating realistic-looking yet fake digital content (such as text, images, and videos). There is a crucial need to combat the rampant rise of fake news and disinformation. In this paper, we propose a high-level overview of a blockchain-based framework for fake news prevention and highlight the various design issues and consideration of such a blockchain-based framework for tackling fake news.
21. yüzyıl bilgi ve iletişim teknolojilerinde önemli gelişmelere sahne olmuştur. Özellikle iletişim teknolojilerinde yaşanan kayda değer gelişmeler sonucu akıllı telefonların ortaya çıkması, interneti insanların günlük yaşantılarında sürekli kullandıkları bir teknoloji haline getirmiştir. Bu gelişmeler hayatın pek çok alanını değiştirdiği gibi ekonomik faaliyetleri de değiştirmiş ve bu faaliyetleri internet ortamına taşımıştır. Günümüzde bankacılık işlemlerinden, alışverişe kadar pek çok faaliyet internet üzerinden kolaylıkla yapılabilmektedir. Ancak internetin sunduğu bu kolaylıklar, güvenlik açıkları, verilerin çalınması gibi pek çok sorunu da beraberinde getirmektedir. Bu noktada blockchain teknolojisinin güvenlik açıklarına karşı korumalı ve bir ağ üzerinde şifrelenen verilerin yönetimini sağlayan dağınık bir veri tabanı oluşu, bu kronikleşmiş sorunların çözülmesinin yanı sıra günümüz ekonomilerinde yaşanan pek çok soruna da çözümler sunmaktadır. Bu çerçevede blockchain tabanlı ekosistemlerin oluşturulması amacıyla kamu/özel destekli pek çok platform hali hazırda çalışmalar yürütmektedir. Bu çalışmada, Blockchain’in altyapısını oluşturan teknoloji hakkında bilgi verilmiş ve bu teknolojinin kullanım alanları doğrultusunda uygulama alanları incelenmiştir.
This paper deals with design of the alternative secure Blockchain network framework to prevent damages from an attacker. The concept of the strategic alliance of the management is applied on the top of the recent developed stochastic game framework. This new enhanced hybrid theoretical model has been developed based on the combination of the conventional game theory, the fluctuation theory and the Blockchain Governance Game to find best strategies towards preparation for preventing a network malfunction from an attacker by making the strategic alliance with other genuine miners. Analytically tractable results for decision making parameters are fully obtained which enable to predict the moment for operations and deliver the optimal number of the alliance with other nodes to protect the Blockchain network. This research helps for whom considers the initial coin offering or launching new blockchain based services with enhancing the security features by alliance with the trusted miners within the decentralized network.