In enterprise business applications, large volumes of data are generated daily, encoding business logic and transactions. Those applications are governed by various compliance requirements, making it essential to provide audit logs to store, track, and attribute data changes. In traditional audit log systems, logs are collected and stored in a centralized medium, making them prone to various forms of attacks and manipulations, including physical access and remote vulnerability exploitation attacks, and eventually allowing for unauthorized data modification, threatening the guarantees of audit logs. Moreover, such systems, and given their centralized nature, are characterized by a single point of failure. To harden the security of audit logs in enterprise business applications, in this work we explore the design space of blockchain-driven secure and transparent audit logs. We highlight the possibility of ensuring stronger security and functional properties by a generic blockchain system for audit logs, realize this generic design through BlockAudit, which addresses both security and functional requirements, optimize BlockAudit through multi-layered design in BlockTrail, and explore the design space further by assessing the functional and security properties the consensus algorithms through comprehensive evaluations. The first component of this work is BlockAudit, a design blueprint that enumerates structural, functional, and security requirements for blockchain-based audit logs. BlockAudit uses a consensus-driven approach to replicate audit logs across multiple application peers to prevent the single-point-of-failure. BlockAudit also uses the Practical Byzantine Fault Tolerance (PBFT) protocol to achieve consensus over the state of the audit log data. We evaluate the performance of BlockAudit using event-driven simulations, abstracted from IBM Hyperledger. Through the performance evaluation of BlockAudit, we pinpoint a need for high scalability and high throughput. We achieve those requirements by exploring various design optimizations to the flat structure of BlockAudit inspired by real-world application characteristics. Namely, enterprise business applications often operate across non-overlapping geographical hierarchies including cities, counties, states, and federations. Leveraging that, we applied a similar transformation to BlockAudit to fragment the flat blockchain system into layers of codependent hierarchies, capable of processing transactions in parallel. Our hierarchical design, called BlockTrail, reduced the storage and search complexity for blockchains substantially while increasing the throughput and scalability of the audit log system. We prototyped BlockTrail on a custom-built blockchain simulator and analyzed its performance under varying transactions and network sizes demonstrating its advantages over BlockAudit. A recurring limitation in both BlockAudit and BlockTrail is the use of the PBFT consensus protocol, which has high complexity and low scalability features. Moreover, the performance of our proposed designs was only evaluated in computer simulations, which sidestepped the complexities of the real-world blockchain system. To address those shortcomings, we created a generic cloud-based blockchain testbed capable of executing five well-known consensus algorithms including Proof-of-Work, Proof-of-Stake, Proof-of-Elapsed Time, Clique, and PBFT. For each consensus protocol, we instrumented our auditing system with various benchmarks to measure the latency, throughput, and scalability, highlighting the trade-off between the different protocols.
Smart contracts on blockchain systems implement business logic and directly handle important assets. Although smart contracts play these critical roles, it is hard for users interacting with the system to understand the real behavior of the deployed bytecodes of smart contracts. The quirks of smart contracts, such as code reuse and limited unique datasets, make it challenging to recognize the functional details of smart contracts. In this paper, we propose a new method for characterizing bytecode-only smart contracts by automatically assigning multiple attribute tags. Using a deep learning approach, our system, the ScanAT, extracts attribute tags from the source code and metadata of known smart contracts and trains their bytecode with the attribute tags. The ScanAT then infers attribute tags from the bytecode of smart contracts alone. Our experiments show that ScanAT can achieve 81% accuracy in predicting attribute tags, using convolutional neural networks and a customized autoencoder.
Block-chain world is very dynamic and there is need for strong governance and underlying technology architecture to be robust to face challenges. This paper considers Ethereum, a leading block chain. We deep dive into the nature of this block chain, wherein for software upgrades forks are performed. They types of forks and impact is discussed. A specific Ethereum hack led to a hard fork and focus is provided on understanding the hack and overcoming it from a novel approach. The current model has been unable to handle multiple Ethereum attacks. Thus the current approach is compared against a novel approach providing a security and scaling solution. Here the architecture draws upon combining block-chain layers into operating system level. The approach can have tremendous benefits to block chain world and improve the way decentralized application teams perform. The benefits of the novel architecture is discussed. The approach helps safe guard block chain projects, making them safer and chain agnostic.
Stephan Zöllner, Kim‐Kwang Raymond Choo, Nhien‐An Le‐Khac
Bitcoin is popular not only with consumers, but also with cybercriminals (e.g., in ransomware and online extortion, and commercial online child exploitation). Given the potential of Bitcoin to be involved in a criminal investigation, the need to have an up-to-date and in-depth understanding on the forensic acquisition and analysis of Bitcoins is crucial. However, there has been limited forensic research of Bitcoin in the literature. The general focus of existing research is on postmortem analysis of specific locations (e.g. wallets on mobile devices), rather than a forensic approach that combines live data forensics and postmortem analysis to facilitate the identification, acquisition, and analysis of forensic traces relating to the use of Bitcoins on a system. Hence, the latter is the focus of this paper where we present an open source tool for live forensic and postmortem analysing automatically. Using this open source tool, we describe a list of target artifacts that can be obtained from a forensic investigation of popular Bitcoin clients and Web Wallets on different web browsers installed on Windows 7 and Windows 10 platforms.
Pinchen Cui, Julie Dixon, Ujjwal Guin, Daniel DiMase
The complexity of the electronics supply chain has grown significantly due to the expansion of globalization in the 21st century. Electronic parts are now manufactured, distributed, and sold globally. Ensuring the security and integrity of the supply chain has become extremely challenging due to the widespread infiltration of untrusted hardware, specifically, counterfeit and cloned parts. Especially, the provenance of microelectronics and commercial off-the-shelf (COTS) parts becomes prohibitively difficult to track and calls for immediate solutions. In this paper, we present a non-destructive way of ensuring the traceability of electronic parts in the supply chain. We have implemented a blockchain-based framework, which helps to track and trace every chip while they are circulating in the supply chain. The proposed framework is built upon a permissioned blockchain. Hyperledger is used for implementing this framework. A detailed analysis is carried out to present the feasibility of our proposed approach.
Open access
Physical Unclonable Functions (PUFs) and Hardware Security
The adoption of blockchain based distributed ledgers is growing fast due to their ability to provide reliability, integrity, and auditability without trusted entities. One of the key capabilities of these emerging platforms is the ability to create self-enforcing smart contracts. However, the development of smart contracts has proven to be error-prone in practice, and as a result, contracts deployed on public platforms are often riddled with security vulnerabilities. This issue is exacerbated by the design of these platforms, which forbids updating contract code and rolling back malicious transactions. In light of this, it is crucial to ensure that a smart contract is secure before deploying it and trusting it with significant amounts of cryptocurrency. To this end, we introduce the VeriSolid framework for the formal verification of contracts that are specified using a transition-system based model with rigorous operational semantics. Our model-based approach allows developers to reason about and verify contract behavior at a high level of abstraction. VeriSolid allows the generation of Solidity code from the verified models, which enables the correct-by-design development of smart contracts.
The second generation of blockchain represented by smart contracts has been developing vigorously in recent years. However, frequent smart contract vulnerability incidents pose a serious risk to blockchain ecosystem security. Since current symbol execution tools often fall into path explosion and thus lead to inefficient detection, this paper expands Mythril's framework to optimize its performance. Firstly, it finds out potential vulnerable code regions using static analysis and identifies critical paths that may have security defects. Then, aiming at the problem that traditional search algorithms cannot actively locate and explore critical paths, this paper presents a multi-objective oriented path search (MOPS) strategy based on path priority. This strategy guides dynamic symbolic execution to cover critical paths quickly, avoiding blind traversal of program execution paths. Finally, it describes security rules and proposes corresponding detection logics for different vulnerability categories. This paper analyzes over 1000 smart contracts extracted from Etherscan. Compared with existing tools based on symbolic execution, the proposed method can reduce time consumption by around 35% while ensuring the accuracy of vulnerability detection. Moreover, existing tools often issue warnings that do not actually cause financial losses. But the proposed method only concentrates on code regions related to transfer of funds, so it can reduce the false alarm rate to some extent.
Ayushi Sharma, Shashwat Tiwari, Nitin Arora, S. C. Sharma
Blockchain is an emerging technology that can radically improve transactions security at banking, supply chain, and other transaction networks. It's estimated that Blockchain will generate $3.1 trillion in new business value by 2030. Essentially, it provides the basis for a dynamic distributed ledger that can be applied to save time when recording transactions between parties, remove costs associated with intermediaries, and reduce risks of fraud and tampering. This book explores the fundamentals and applications of Blockchain technology. Readers will learn about the decentralized peer-to-peer network, distributed ledger, and the trust model that defines Blockchain technology. They will also be introduced to the basic components of Blockchain (transaction, block, block header, and the chain), its operations (hashing, verification, validation, and consensus model), underlying algorithms, and essentials of trust (hard fork and soft fork). Private and public Blockchain networks similar to Bitcoin and Ethereum will be introduced, as will concepts of Smart Contracts, Proof of Work and Proof of Stack, and cryptocurrency including Facebook's Libra will be elucidated. Also, the book will address the relationship between Blockchain technology, Internet of Things (IoT), Artificial Intelligence (AI), Cybersecurity, Digital Transformation and Quantum Computing. Readers will understand the inner workings and applications of this disruptive technology and its potential impact on all aspects of the business world and society. A look at the future trends of Blockchain Technology will be presented in the book.
Smart contract security is an emerging research area that deals with security issues arising from the execution of smart contracts in a blockchain system. Generally, a smart contract is a piece of executable code that automatically runs on the blockchain to enforce an agreement preset between parties involved in the transaction. As an innovative technology, smart contracts have been applied in various business areas, such as digital asset exchange, supply chains, crowdfunding, and intellectual property. Unfortunately, many security issues in smart contracts have been reported in the media, often leading to substantial financial losses. These security issues pose new challenges to security research because the execution environment of smart contracts is based on blockchain computing and its decentralized nature of execution. Thus far, many partial solutions have been proposed to address specific aspects of these security issues, and the trend is to develop new methods and tools to automatically detect common security vulnerabilities. However, smart contract security is systematic engineering that should be explored from a global perspective, and a comprehensive study of issues in smart contract security is urgently needed. To this end, we conduct a literature review of smart contract security from a software lifecycle perspective. We first analyze the key features of blockchain that can cause security issues in smart contracts and then summarize the common security vulnerabilities of smart contracts. To address these vulnerabilities, we examine recent advances in smart contract security spanning four development phases: 1) security design; 2) security implementation; 3) testing before deployment; and 4) monitoring and analysis. Finally, we outline emerging challenges and opportunities in smart contract security for blockchain engineers and researchers.
Michael Rodler, Wenting Li, Ghassan Karame, Lucas Davi
Recently, a number of existing blockchain systems have witnessed major bugs and vulnerabilities within smart contracts. Although the literature features a number of proposals for securing smart contracts, these proposals mostly focus on proving the correctness or absence of a certain type of vulnerability within a contract, but cannot protect deployed (legacy) contracts from being exploited. In this paper, we address this problem in the context of re-entrancy exploits and propose a novel smart contract security technology, dubbed Sereum (Secure Ethereum), which protects existing, deployed contracts against re-entrancy attacks in a backwards compatible way based on run-time monitoring and validation. Sereum does neither require any modification nor any semantic knowledge of existing contracts. By means of implementation and evaluation using the Ethereum blockchain, we show that Sereum covers the actual execution flow of a smart contract to accurately detect and prevent attacks with a false positive rate as small as 0.06% and with negligible run-time overhead. As a by-product, we develop three advanced re-entrancy attacks to demonstrate the limitations of existing offline vulnerability analysis tools.
Christof Ferreira Torres, Julian Schütte, Radu State
The capability of executing so-called smart contracts in a decentralised manner is one of the compelling features of modern blockchains. Smart contracts are fully fledged programs which cannot be changed once deployed to the blockchain. They typically implement the business logic of distributed apps and carry billions of dollars worth of coins. In that respect, it is imperative that smart contracts are correct and have no vulnerabilities or bugs. However, research has identified different classes of vulnerabilities in smart contracts, some of which led to prominent multi-million dollar fraud cases. In this paper we focus on vulnerabilities related to integer bugs, a class of bugs that is particularly difficult to avoid due to some characteristics of the Ethereum Virtual Machine and the Solidity programming language.
Internet of Things is widely used in many fields such as industry, medical care, education, and supply chain. With the participation of multi-authorized entities, a large number of dynamic data will be generated in the basic dimension of time. The operations on these data have to be safe and traceable for use in various forensics and decisions. Therefore, the key point of dynamic data security protection is to reject tampering of unauthorized users and to realize the process in evidence and tracing of the dynamic data operation. In order to find a solution to the problem above, an optimization of dynamic data traceability mechanism based on consortium blockchain is proposed in this article. First, a mathematical model for the security of dynamic data storage has been established, followed by analysis on honest behavior motive of individual node decision-making in group game and distributed node cooperation essence in specific industry background. After that, ownership transition function and the architecture of the dynamic data storage system are optimized; quality and growth characteristics of the system under stochastic state model are analyzed. Result shows that the solution can effectively avoid potential attacks such as tampering and faking under approved accession mode. The mechanism has good application value while ensuring the dynamic data storage security.
Smart Grids is an emerging technology promising significant changes in the economy and the social sphere. One among many challenges in their development and distribution is security. Considering recent hackers attacks on energy grids and taking into account the distributed structure of these systems the use of traditional means of computer protection and the search for a crime figure becomes more difficult or impossible. In this article, we introduce some application areas of smart grid forensic science, discuss the opportunities, and outline the open issues in the topic. We summarized challenges for forensic in Smart Grids in connection with a Blockchain and proposed a decentralized transaction platform based on Blockchain tailored to the energy sector with all the latest technology such as advanced metering infrastructure, distributed generation, etc.
Xu Wang, Xuan F. Zha, Guangsheng Yu, Wei Ni · 8 authors
Ethereum, as the first Turing-complete blockchain platform, provides various application program interfaces for developers. Although blockchain has highly improved security, faulty configuration and usage can result in serious vulnerabilities. In this paper, we focus on the security vulnerabilities of the official Go-version Ethereum client (geth). The vulnerabilities are because of the insecure API design and the specific Ethereum wallet mechanism. We demonstrate attacks exploiting these vulnerabilities in an Ethereum testbed. The vulnerabilities are confirmed by the scanning results on the public Internet. Finally, corresponding countermeasures against attacks are provided to enhance the security of the Ethereum platform.
We propose and compare two approaches to identify smart contracts as token systems by analyzing their public bytecode. The first approach symbolically executes the code in order to detect token systems by their characteristic behavior of updating internal accounts. The second approach serves as a comparison base and exploits the common interface of ERC-20, the most popular token standard. We present quantitative results for the Ethereum blockchain, and validate the effectiveness of both approaches using a set of curated token systems as ground truth. We observe 100% recall for the second approach. Recall rates of 89% (with well explainable missed detections) indicate that the first approach may also be able to identify "hidden" or undocumented token systems that intentionally do not implement the standard. One possible application of the proposed methods is to facilitate regulator' tasks of monitoring and policing the use of token systems and their underlying platforms.
Wesley Joon-Wie Tann, Xing Han, Sourav Sen Gupta, Yew-Soon Ong
Symbolic analysis of security exploits in smart contracts has demonstrated to be valuable for analyzing predefined vulnerability properties. While some symbolic tools perform complex analysis steps, they require a predetermined invocation depth to search vulnerable execution paths, and the search time increases with depth. The number of contracts on blockchains like Ethereum has increased 176 fold since December 2015. If these symbolic tools fail to analyze the increasingly large number of contracts in time, entire classes of exploits could cause irrevocable damage. In this paper, we aim to have safer smart contracts against emerging threats. We propose the approach of sequential learning of smart contract weaknesses using machine learning---long-short term memory (LSTM)---that allows us to be able to detect new attack trends relatively quickly, leading to safer smart contracts. Our experimental studies on 620,000 smart contracts prove that our model can easily scale to analyze a massive amount of contracts; that is, the LSTM maintains near constant analysis time as contracts increase in complexity. In addition, our approach achieves $99\%$ test accuracy and correctly analyzes contracts that were false positive (FP) errors made by a symbolic tool.
Jianbo Gao, Han Liu, Chao Liu, Qingshan Li · 6 authors
While Ethereum smart contracts enabled a wide range of blockchain applications, they are extremely vulnerable to different forms of security attacks. Due to the fact that transactions to smart contracts commonly involve cryptocurrency transfer, any successful attacks can lead to money loss or even financial disorder. In this paper, we focus on the overflow attacks in Ethereum, mainly because they widely rooted in many smart contracts and comparatively easy to exploit. We have developed EASYFLOW, an overflow detector at Ethereum Virtual Machine level. The key insight behind EASYFLOW is a taint analysis based tracking technique to analyze the propagation of involved taints. Specifically, EASYFLOW can not only divide smart contracts into safe contracts, manifested overflows, well-protected overflows and potential overflows, but also automatically generate transactions to trigger potential overflows. In our preliminary evaluation, EASYFLOW managed to find potentially vulnerable Ethereum contracts with little runtime overhead. A demo video of EASYFLOW is at https://youtu.be/QbUJkQI0L6o.
Bitcoin is the leading cryptocurrency in the world with a total marketcap of nearly USD 33 billion, [1] with 370,000 transactions recorded daily[2]. Pseudo-anonymous, decentralized peer-to-peer electronic cash systems such as Bitcoin have caused a paradigm shift in the way that people conduct financial transactions and purchase goods. Although cryptocurrencies enable users to securely and anonymously exchange money, they can also facilitate illegal criminal activities. Therefore, it is imperative that law enforcement agencies develop appropriate analytical processes that will allow them to identify and investigate criminal activities in the Blockchain (a distributed ledger). In this paper, INTERPOL, through the INTERPOL Global Complex for Innovation, proposes a Bitcoin analytical framework and a software system that will assist law enforcement agencies in the real-time analysis of the Blockchain while providing digital crime analysts with tracing and visualization capabilities. By doing so, it is feasible to render transactions decipherable and comprehensible for law enforcement investigators and prosecutors. The proposed solution is evaluated against three criminal case studies linked to Darknet markets, ransomware and DDoS extortion.
Son zamanlarda; blok zinciri tabanlı kripto para ödeme sistemleri(bitcoin, ethereum) oldukça popüler olmuştur. Merkezi olmayan eşler arası(P2P) ağ yapısına sahip olan bu sistemde tüm işlemler, sadece ekleme yapılabilen bir ana defterde(ledger) tutulmaktadır. Madenciler ise bu ağ yapısındaki düğümleri oluşturmaktadır, her madenci defterin yerel kopyasına sahiptir. Blok zincirinde, PoW uzlaşma protokolü işlemi onaylamakta ve zincire yeni blok eklenmesine izin vermektedir. Ödülü almak için, madenciler eşler arası ağda işlemi tamamlamak için birbirleriyle yarışırlar. Ödül sistemi, blok zinciri kullanan bitcoin’i popülerleştirmiş, fakat aynı zamanda saldırganların blok zincirine ilgisini artırmıştır. Saldırganlar tarafından blok zincirinin madenci havuzuna ve ağ yapısının güvenliğine farklı saldırılar yapılmıştır. Bu makalede, blok zinciri alt yapısına karşı mevcut saldırılar sunulmuştur. İlk bölümlerde, P2P mimarisine, uzlaşma protokolüne ve işlemlere yönelik saldırı tipleri araştırılmıştır. Bu bölümde, %51 saldırısı, Çift harcama, Finney, Vector76, Kaba Kuvvet, Sybil, Eclipse, Denge gibi saldırılar açıklanmış ve çözümler önerilmiştir. Daha sonra, Bencil madencilik ve Blok Atma, Blok Tutma(BWH), Blok Tutma Sonrası Çatallanma(FAW), Havuz sıçrama saldırısı, Cezalandırıcı Çatallanma ile Kara Listeye Alma, Köpük saldırısı ve Rüşvet Saldırısı gibi madencilik havuzuna karşı saldırılar incelenmiş ve savunma stratejileri sunulmuştur. Son bölümde de blok zinciri altyapısında kullanılan kriptografi’nin geleceği üzerinde tartışılmış ve Post Kuantum Kriptografi’nin etkilerinden bahsedilmiştir
Open access
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques
Interest in cryptocurrencies has skyrocketed since their introduction a decade ago, with hundreds of billions of dollars now invested across a landscape of thousands of different cryptocurrencies. While there is significant diversity, there is also a significant number of scams as people seek to exploit the current popularity. In this paper, we seek to identify the extent of innovation in the cryptocurrency landscape using the open-source repositories associated with each one. Among other findings, we observe that while many cryptocurrencies are largely unchanged copies of Bitcoin, the use of Ethereum as a platform has enabled the deployment of cryptocurrencies with more diverse functionalities.
Blockchain and Tangle are data structures used to create an immutable public record of data insured by a network of peer-to-peer participants who maintain a set of constantly growing data records known as ledgers. Blockchain and Tangle technologies are a decentralized solution that guarantees the exchange of large amounts of trusted messages, among billions of connected IoT devices, which are very valuable as they are valid and complete. This highly encrypted and secure peer-to-peer messaging mechanism is adopted in this project to manage the processing of IoT transactions and the coordination between the devices that interact with the process. To maintain private transactions, secure and trustless, the distributed consensus algorithms are responsible for validating and choosing transactions and recording them in the global ledger. The results showed that the speed of the consensus algorithms can affect the creation in real time of reliable stories that track the events of the IoT networks. After incorporating Complex Event Processing that allows selecting only those high level events, it is possible to get an improvement in many situations. The result is a Middleware system that provides a framework for the construction of large-scale computer applications that use Complex Events Processing and different decentralized ledgers such as the blockchain of Ethereum or IOTA Tangle, for secure data storage.
A wave of alternative coins that can be effectively mined without specialized hardware, and a surge in cryptocurrencies' market value has led to the development of cryptocurrency mining ( cryptomining ) services, such as Coinhive, which can be easily integrated into websites to monetize the computational power of their visitors. While legitimate website operators are exploring these services as an alternative to advertisements, they have also drawn the attention of cybercriminals: drive-by mining (also known as cryptojacking ) is a new web-based attack, in which an infected website secretly executes JavaScript code and/or a WebAssembly module in the user's browser to mine cryptocurrencies without her consent. In this paper, we perform a comprehensive analysis on Alexa's Top 1 Million websites to shed light on the prevalence and profitability of this attack. We study the websites affected by drive-by mining to understand the techniques being used to evade detection, and the latest web technologies being exploited to efficiently mine cryptocurrency. As a result of our study, which covers 28 Coinhive-like services that are widely being used by drive-by mining websites, we identified 20 active cryptomining campaigns. Motivated by our findings, we investigate possible countermeasures against this type of attack. We discuss how current blacklisting approaches and heuristics based on CPU usage are insufficient, and present MineSweeper, a novel detection technique that is based on the intrinsic characteristics of cryptomining code, and, thus, is resilient to obfuscation. Our approach could be integrated into browsers to warn users about silent cryptomining when visiting websites that do not ask for their consent.
Morit Zwang, Shahar Somin, Alex Pentland, Yaniv Altshuler
The Ethereum blockchain network is a decentralized platform enabling smart contract execution and transactions of Ether (ETH) [1], its designated cryptocurrency. Ethereum is the second most popular cryptocurrency with a market cap of more than 100 billion USD, with hundreds of thousands of transactions executed daily by hundreds of thousands of unique wallets. Tens of thousands of those wallets are newly generated each day. The Ethereum platform enables anyone to freely open multiple new wallets [2] free of charge (resulting in a large number of wallets that are controlled by the same entities). This attribute makes the Ethereum network a breeding space for activity by software robots (bots). The existence of bots is widespread in different digital technologies and there are various approaches to detect their activity such as rule-base, clustering, machine learning and more [3,4]. In this work we demonstrate how bot detection can be implemented using a network theory approach.