Abstract Web-based cryptocurrency mining attacks, also known as cryptojacking, become increasingly popular. A large number of diverse platforms (e.g., Windows, Linux, Android, and iOS) and devices (e.g., PC, smartphones, tablets, and even critical infrastructures) are widely impacted. Although a variety of detection approaches were recently proposed, it is challenging to apply these approaches to attack prevention directly. Instead, in this paper, we present a novel generic and accurate defense solution, called “MinerGate”, against cryptojacking attacks. To achieve the goal, MinerGate is designed as an extension of network gateways or proxies to protect all devices behind it. When attacks are identified, MinerGate can enforce security rules on victim devices, such as stopping the execution of related JavaScript code and alerting victims. Compared to prior approaches, MinerGate does not require any modification of browsers or apps to collect the runtime features. Instead, MinerGate focuses on the semantics of mining payloads (usually written in WebAssembly/asm.js), and semantic-based features. In our evaluation, we first verify the correctness of MinerGate by testing MinerGate in a real environment. Then, we check MinerGate’s performance and confirm MinerGate introduces relatively low overhead. Last, we verify the accuracy of MinerGate. For this purpose, we collect the largest WebAssembly/asm.js related code with ground truth to build our experiment dataset. By comparing prior approaches and MinerGate on the dataset, we find MinerGate achieves better accuracy and coverage (i.e., 99% accuracy and 98% recall). Our dataset will be available online, which should be helpful for more solid understanding of cryptojacking attacks.
Jan 1, 2020·Proceedings of the ... Annual Hawaii International Conference on System Sciences/Proceedings of the Annual Hawaii International Conference on System Sciences
Vikram Kanth, Ashley McaAbee, Murali Tummala, John McEachen
As the threat of cyber attack grows ever larger, new approaches to security are required. While there are several different types of intrusion detection systems (IDS), collaborative IDS (CIDS) offers particular promise in identifying distributed, coordinated attacks that might otherwise elude detection. Even for CIDS, there are unresolved issues associated with trusting participants and aggregating data. Blockchain technology appears capable of addressing those issues if practical implementation strategies can be developed. To that end, we implement an Ethereum blockchain-based CIDS leveraging pluggable authentication modules. Our system is specifically crafted to detect doorknob rattling attacks by immutably recording login activity in a blockchain-protected ledger.
Nuclear Power Plants (NPPs) are physically isolated from external networks and have different operational environments than conventional information technology (IT) systems. Accordingly, NPPs were regarded as safe from external cyber-attacks. However, it was later determined that isolated networks are not safe from cyber-attacks. Malicious data injection attacks on Programmable Logic Controllers (PLCs) deployed in the safety system of NPPs are critical to nuclear facilities, as they were in the Stuxnet attack. It is necessary to monitor the integrity of PLC data and protect the PLCs from cyber threats such as modification of deployed logic or setpoints. To address this problem, this paper proposes a novel system for monitoring data integrity of PLCs using blockchain technologies. Considering the NPP environment, we developed a private blockchain system to monitor the data integrity of PLCs. The new concept that is Proof of Monitoring (PoM) for data integrity of PLCs was proposed to overcome the limitation for applying the private blockchain to the cybersecurity of NPPs. Additionally, we developed an integrity monitoring system for the Reactor Protection System (RPS)-a safety system in NPPs-using the developed blockchain. It can detect cyber-attacks (such as false code injection attacks on PLCs) and monitor which PLC integrity has been compromised in real-time. A validation experiment using a false data injection attack on PLCs was performed on the developed system, and the results confirmed that the developed system successfully monitored the modification of data in the PLCs.
The OWASP Top Ten List is a widely-recognized tool for identifying vulnerabilities in web applications. Since blockchain-specific security guidance is currently lacking, mapping existing frameworks, such as OWASP, to the blockchain can help in the identification of potential vulnerabilities in blockchain systems. While the OWASP Top Ten List is designed to describe the vulnerabilities that web application developers face, nine of ten of the OWASP vulnerabilities also apply to blockchain systems. The exception, XML External Entities (XXE), is not applicable due to the lack of use of XML in blockchain.
The Internet of Things (IoT) which creates a hyper-connected society is playing a major role in the 4th industrial revolution. The IoT is being leveraged across various fields of business globally and the number of IoT devices is causing serious security concerns. Since the firmware update of an IoT device is necessary for its lifecycle, secure firmware update of the IoT device is being brought as the first step in IoT security. The Internet Engineering Task Force (IETF) Software Updates for Internet of Things (SUIT) working group has started to specify a software update architecture for IoT devices. However, the current SUIT working group adopts a traditional client-server model to distribute firmware images, which potentially causes security risks. The current approach of the SUIT working group is unable to solve a targeting issue and an author-disappearing issue, which is suggested in this paper. Therefore, in this work, we introduce a distributed firmware update architecture based on the SUIT firmware update architecture applying blockchain. Our update architecture can prevent the issues we concern through the characteristics of blockchain, such as decentralization, transparency, and irreversibility. The blockchain network has registration nodes that process registration of manifest and firmware image files from authors, and retrieval nodes that process downloading manifest and firmware image files. The firmware image files are stored in a distributed file system and the hash values of firmware image chunks are stored on the blockchain with manifest files. The proposed architecture in this paper enables the irreversible downloads even in the author-disappearing state and tolerant to a single point of failure.
Bitcoin is a virtual and decentralized cryptocurrency that operates in a peer-to-peer network providing a private payment mechanism. It is a multi-billion dollar cryptocurrency, and hundreds of other cryptocurrencies are created based on it. Bitcoin is based on Open-Source (OSS) software development, and OSS is a convenient way to qualitatively measure software development and growth. This thesis presents the first comprehensive study of the Bitcoin ecosystem in GitHub organized around 481 most popular and actively developed Bitcoin related projects over eight years (2010)(2011)(2012)(2013)(2014)(2015)(2016)(2017)(2018).
Mikhail Mandrykin, Jake O’Shannessy, Jacob Payne, Ilya Shchepetkov
As smart contracts are growing in size and complexity, it becomes harder and harder to ensure their correctness and security. Due to the lack of isolation mechanisms a single mistake or vulnerability in the code can bring the whole system down, and due to this smart contract upgrades can be especially dangerous. Traditional ways to ensure the security of a smart contract, including DSLs, auditing and static analysis, are used before the code is deployed to the blockchain, and thus offer no protection after the deployment. After each upgrade the whole code need to be verified again, which is a difficult and time-consuming process that is prone to errors. To address these issues a security protocol and framework for smart contracts called Cap9 was developed. It provides developers the ability to perform upgrades in a secure and robust manner, and improves isolation and transparency through the use of a low level capability-based security model. We have used Isabelle/HOL to develop a formal specification of the Cap9 framework and prove its consistency. The paper presents a refinement-based approach that we used to create the specification, as well as discussion of some encountered difficulties during this process.
Innovative solutions addressing product anti-counterfeiting and record provenance have been deployed across today's internationally spanning supply chain networks. These product anti-counterfeiting solutions are developed and implemented with centralized system architecture relying on centralized authorities or any form of intermediaries. Vulnerabilities of centralized product anti-counterfeiting solutions could possibly lead to system failure or susceptibility of malicious modifications performed on product records or various potential attacks to the system components by dishonest participant nodes traversing along the supply chain. Blockchain technology has progressed from merely with a use case of immutable ledger for cryptocurrency transactions to a programmable interactive environment of developing decentralized and reliable applications addressing different use cases globally. In this research, so as to facilitate trustworthy data provenance retrieval, verification and management, as well as strengthening capability of product anti-counterfeiting, key areas of decentralization and feasible mechanisms of developing decentralized and distributed product anti-counterfeiting and traceability ecosystems utilizing blockchain technology, are identified via a series of security and threat analyses performed mainly against NFC-Enabled Anti-Counterfeiting System (NAS) which is one of the solutions currently implemented in the industry with centralized architecture. A set of fundamental system requirements are set out for developing a blockchain-enabled autonomous and decentralized solution for supply chain anti-counterfeiting and traceability, as a secure and immutable scientific data provenance tracking and management platform in which provenance records, providing compelling properties on data integrity of luxurious goods, are recorded and verified automatically, for supply chain industry.
Smart contract has greatly improved the services and capabilities of blockchain, but it has become the weakest link of blockchain security because of its code nature. Therefore, efficient vulnerability detection of smart contract is the key to ensure the security of blockchain system. Oriented to Ethereum smart contract, the study solves the problems of redundant input and low coverage in the smart contract fuzz. In this paper, a taint analysis method based on EVM is proposed to reduce the invalid input, a dangerous operation database is designed to identify the dangerous input, and genetic algorithm is used to optimize the code coverage of the input, which construct the fuzzing framework for smart contract together. Finally, by comparing Oyente and ContractFuzzer, the performance and efficiency of the framework are proved.
The exploitation of smart-contract vulnerabilities can have catastrophic consequences such as the loss of millions of pounds worth of crypto assets. Formal verification can be a useful tool in identifying vulnerabilities and proving that they have been fixed. In this paper, we present a formalisation of Solidity and the Ethereum blockchain using the Solid language and its blockchain; a Solid program is obtained by explicating/desugaring a Solidity program. We make some abstractions that over-approximate the way in which Solidity/Ethereum behave. Based on this formalisation, we create Solidifier: a bounded model checker for Solidity. It translates Solid into Boogie, an intermediate verification language, that is later verified using Corral, a bounded model checker for Boogie. Unlike much of the work in this area, we do not try to find specific behavioural/code patterns that might lead to vulnerabilities. Instead, we provide a tool to find errors/bad states, i.e. program states that do not conform with the intent of the developer. Such a bad state, be it a vulnerability or not, might be reached through the execution of specific known code patterns or through behaviours that have not been anticipated.
This paper reviews the background and related studies in the areas of cloud systems, intrusion detection and blockchain applications against cyber attacks. This work aims to discuss collaborative anomaly detection systems for discovering insider and outsider attacks from cloud centres, including the technologies of virtualisation and containerisation, along with trusting intrusion detection and cloud systems using blockchain. Moreover, the ability to detect such malicious attacks is critical for conducting necessary mitigation, at an early stage, to minimise the impact of disruption and restore cloud operations and their live migration processes. This paper presents an overview of cloud architecture and categorises potential state-of-the-art security events based on their occurrence at different cloud deployment models. Network Intrusion Detection Systems (NIDS) in the cloud, involving types of classification and common detection approaches, are also described. Collaborative NIDSs for cloud-based blockchain applications are also explained to demonstrate how blockchain can address challenges related to data privacy and trust management. A summary of the research challenges and future research directions in these fields is also explained.
Distributed ledgers and blockchain technologies can improve system security and trustworthiness by providing immutable replicated histories of data. Blockchain is a linked list of blocks containing digitally signed transactions, a cryptographic hash of the previous block, and a timestamp stored in a decentralized and distributed network. The Internet of Things (IoT) is one of the application domains in which security based on blockchain is discussed. In this article, we review the structure and architectures of distributed IoT systems and explain the motivations, challenges, and needs of blockchain to secure such systems. However, there are substantial threats and attacks to blockchain that must be understood, as well as suitable approaches to mitigate them. We, therefore, survey the most common attacks to blockchain systems and the solutions to mitigate them, with the objective of assessing how malicious these attacks are in the IoT context.
Ákos Hajdu, Naghmeh Ivaki, Imre Kocsis, Attila Klenik · 8 authors
Blockchain has become particularly popular due to its promise to support business-critical services in very different domains (e.g., retail, supply chains, healthcare). Blockchain systems rely on complex middleware, like Ethereum or Hyperledger Fabric, that allow running smart contracts, which specify business logic in cooperative applications. The presence of software defects or faults in these contracts has notably been the cause of failures, including severe security problems. In this paper, we use a software implemented fault injection (SWIFI) technique to assess the behavior of permissioned blockchain systems in the presence of faulty smart contracts. We emulate the occurrence of general software faults (e.g., missing variable initialization) and also blockchain-specific software faults (e.g., missing require statement on transaction sender) in smart contracts code to observe the impact on the overall system dependability (i.e., reliability and integrity). We also study the effectiveness of formal verification (i.e., done by solc-verify) and runtime protections (e.g., using the assert statement) mechanisms in detection of injected faults. Results indicate that formal verification as well as additional runtime protections have to complement built-in platform checks to guarantee the proper dependability of blockchain systems and applications. The work presented in this paper allows smart contract developers to become aware of possible faults in smart contracts and to understand the impact of their presence. It also provides valuable information for middleware developers to improve the behavior (e.g., overall fault tolerance) of their systems.
With the rise in popularity of cryptocurrencies, distributed ledger technology is a term that has gained traction. The aim of this study is to review and comparethe distributed ledger technologies blockchain and directed acyclic graph, examining their internal structures as well as some platforms and existing areas of application. An implementation, the goal of which is to illustrate the components of a possible distributed ledger solution and how they might interact, has been made in the form of a smart contract deployed on a simulated distributed ledger network. To give some explanation to the foundations of distributed ledger technology, a brief overview is given on the topics of cryptography, underlying data structures, and the frameworks used in this study. The literature study has been conducted by collecting and reviewing primarily scientific articles on the topic of distributed ledger technologies and consensus algorithms, as well as white papers on selected distributed ledger platforms. The construction has been done using the framework Hyperledger Fabric. The result chapter reviews how the implemented smart contract fulfills the concrete goals. The study is concluded with a discussion regarding how distributed ledgers might possibly be used in thef uture, what might be done to further develop the implemented smart contract and some of the ethical concerns surrounding distributed ledger technology.
We address the absence of reliable tests on contract analyzers of smart contracts and present a systematic method to diversify test cases by combining smart-contract-specific bugs and static analysis barriers in this paper. Using contract analyzers is the most practical solution for building a secure blockchain service, but they are relatively immature and lacking stable performance metrics. Traditionally, performance reports only compare static contract analyzers with pre-defined test cases, such as the Juliet test suite. However, building such test suites is burdensome for smart contracts, which are frequently change. In this paper, we propose an automated method to assess contract analyzers of smart contracts by diversifying test cases. In the experimental results, we identified nine erroneous alarms in the state-of-the-art contract analyzers with automatically generated test cases on five vulnerabilities.
With the growing popularity of smart contracts, the problem of validation of their correctness becomes more and more relevant, but at the moment there are no universally recognized tools for their testing. In this paper, we propose to apply the mutational analysis to improve reliability of Solidity smart contracts. We identified wide spread errors in the source code of existing contracts and developed a RegularMutator tool for mutation analysis. It has shown its effectiveness in testing a large smart contracts project. As a result of our analysis, we managed to improve the test suites of the project to find the discovered defects and, increase the quality of the test suite.
Elvira Albert, Pablo Gordillo, Albert Rubio, Maria A. Schett
With the advent of smart contracts that execute on the blockchain ecosystem, a new mode of reasoning is required for developers that must pay meticulous attention to the gas spent by their smart contracts, as well as for optimization tools that must be capable of effectively reducing the gas required by the smart contracts. Super-optimization is a technique which attempts to find the best translation of a block of code by trying all possible sequences of instructions that produce the same result. This paper presents a novel approach for super-optimization of smart contracts based on Max-SMT which is split into two main phases: (i) the extraction of a stack functional specification from the basic blocks of the smart contract, which is simplified using rules that capture the semantics of the arithmetic, bit-wise, relational operations, etc. (ii) the synthesis of optimized blocks which, by means of an efficient Max-SMT encoding, finds the bytecode blocks with minimal gas cost whose stack functional specification is equal (modulo commutativity) to the extracted one. Our experimental results are very promising: we are able to optimize 55.41 % of the blocks, and prove that 34.28 % were already optimal, for more than 61000 blocks from the most called 2500 Ethereum contracts.
More than eight million smart contracts have been deployed into Ethereum, which is the most popular blockchain that supports smart contract. However, less than 1% of deployed smart contracts are open-source, and it is difficult for users to understand the functionality and internal mechanism of those closed-source contracts. Although a few decompilers for smart contracts have been recently proposed, it is still not easy for users to grasp the semantic information of the contract, not to mention the potential misleading due to decompilation errors. In this paper, we propose the first system named STAN to generate descriptions for the bytecodes of smart contracts to help users comprehend them. In particular, for each interface in a smart contract, STAN can generate four categories of descriptions, including functionality description, usage description, behavior description, and payment description, by leveraging symbolic execution and NLP (Natural Language Processing) techniques. Extensive experiments show that STAN can generate adequate, accurate, and readable descriptions for contract's bytecodes, which have practical value for users.
Cryptocurrencies have been a target for cybercriminal activities because of the pseudo-anonymity and privacy they offer. Researchers have been actively working on analyzing and developing innovative defensive mechanisms to prevent these activities. A significant challenge facing researchers is collecting datasets to train defensive systems to detect and analyze these cyberattacks. Our aims in this systematic review are to explore and aggregate the state of the art threats that have emerged with cryptocurrencies and the defensive mechanisms that have been proposed. We also discuss the threats type, scale, and how efficient the defensive mechanisms are in providing early detection and prevention. We also list out the resources that have been used to collect datasets, and we identify the publicly available ones. In this study, we extracted 1,221 articles from four top scientific and engineering databases and libraries in Computer Science: IEEE Xplore, ACM Digital Library, Elsevier's Scopus, and Crarivate's Web of Science. We defined inclusion, exclusion, and quality of assessment criteria, and after a detailed review process, 66 publications were included in the final review. Our analysis revealed that the literature contains a significant amount of research to detect and analyze several attack types, such as the high yield investment programs and pump and dump. These attacks have been used to steal millions of USD, abuse millions of connected devices, and have created even more significant loss in denial of services and productivity losses. We have found that the researchers use various sources to collect training datasets. Many authors have made their dataset publicly available. We have created a list of these datasets, which we have made available along with other supplementary websites, tools, and libraries that can be used in the data collection and analysis process.
Mauro C. Argañaraz, Mario Berón, Maria João Varanda Pereira, Pedro Rangel Henriques
Ethereum is the principal ecosystem based on blockchain that provides a suitable environment for coding and executing smart contracts, which have been receiving great attention due to the commercial apps and among the scientific community. The process of writing secure and well performing contracts in the Ethereum platform is a major challenge for developers. It consists of the application of non-conventional programming paradigms due to the inherent characteristics of the execution of distributed computing programs. Furthermore, the errors in the deployed contracts could have serious consequences because of the immediate linkage between the contract code and the financial transactions. The direct handling of the assets means that the errors can be more relevant for security and have greater economic consequences than a mistake in the conventional apps. In this paper, we propose a tool for the detection of vulnerabilities in high-level languages based on automatized static analysis.
With advancement in computer technology, financial technology has also evolved. Blockchain technology has evolved over the past decade; however, this has also resulted in some malicious attacks. To earn mining rewards of a blockchain, a new type of attack, called cryptojacking, has emerged in the online world. This attack uses the computer resources of a victim to obtain mining rewards without user confirmation. However, this monetization model was originally intended to replace advertising as a source of revenue for a website. To resolve such problems, a storage verification architecture based on smart contracts was proposed in the study. The decentralized system of blockchain enables users to identify and participate in verification of mining sites through Ethereum smart contracts.
Open access
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
In the last decade, smart contract security issues lead to tremendous losses, which has attracted increasing public attention both in industry and in academia. Researchers have embarked on efforts with logic rules, symbolic analysis, and formal analysis to achieve encouraging results in smart contract vulnerability detection tasks. However, the existing detection tools are far from satisfactory. In this paper, we attempt to utilize the deep learning-based approach, namely bidirectional long-short term memory with attention mechanism (BLSTM-ATT), aiming to precisely detect reentrancy bugs. Furthermore, we propose contract snippet representations for smart contracts, which contributes to capturing essential semantic information and control flow dependencies. Our extensive experimental studies on over 42,000 real-world smart contracts show that our proposed model and contract snippet representations significantly outperform state-of-the-art methods. In addition, this work proves that it is practical to apply deep learning-based technology on smart contract vulnerability detection, which is able to promote future research towards this area.