Wilfridus Bambang Triadi Handaya, Mohd Najwadi Yusoff, Aman Jantan
Abstract Cybercrime is the highest threat to every private company and government agency in the world. Using synergistic threats to attack provides many success alternatives that lead to the same goal, which is to take over the network and carry out illegal mining activities using CPU resources from the victim’s computer. One of the main motives for the success of this criminal business is its relatively low cost and high return of investment. Using the infection chain method in carrying out cryptocurrency mining malware attacks with fileless techniques involves loading malicious code into system memory. Monero (XMR) is by far the highest popular cryptocurrency among threat actor installing mining malware because it comes with full anonymity and resistance to an application-specific circuit mining (ASIC). This work proposes a better method for classifying conventional malware and cryptocurrency mining malware. On the other hand, grouping specific of suitable features extracted from the sources of EMBER dataset shown as malware and need to categorize as a cryptocurrency mining malware. The proposed approach is defining a better algorithm for enhancing accuracy and efficiency for cryptocurrency mining malware detection.
Alex Groce, Josselin Feist, Gustavo Grieco, Michael D. Colburn
An important problem in smart contract security is understanding the\nlikelihood and criticality of discovered, or potential, weaknesses in\ncontracts. In this paper we provide a summary of Ethereum smart contract audits\nperformed for 23 professional stakeholders, avoiding the common problem of\nreporting issues mostly prevalent in low-quality contracts. These audits were\nperformed at a leading company in blockchain security, using both open-source\nand proprietary tools, as well as human code analysis performed by professional\nsecurity engineers. We categorize 246 individual defects, making it possible to\ncompare the severity and frequency of different vulnerability types, compare\nsmart contract and non-smart contract flaws, and to estimate the efficacy of\nautomated vulnerability detection approaches.\n
Protecting sensitive medical data, including prescription and pill data, during its handling and storage is critical in the digital era. Data vaults that protect privacy provide a strong way to protect this information, guaranteeing that patient information is kept private but yet available for authorised uses. Focussing on the safe preservation of pharmaceutical data, this project investigates the creation of sophisticated algorithms for privacy-preserving data vaults. We start by contrasting the suggested innovative technique, which combines elements of Zero-Knowledge Proofs with Enhanced Homomorphic Encryption, with other known cryptographic and data masking algorithms, such as Differential Privacy, Secure Multi-Party Computation, and Homomorphic Encryption. Data integrity, computational efficiency, and resistance to different attack vectors are some of the characteristics used in the comparison.As the results show, the suggested method offers aimproved performance against confidentiality compromises, especially in real-time data retrieval scenarios, while existing techniques offer varied degrees of efficiency and security. But this comes with more implementation complexity and processing overhead. Improved security characteristics, like less data leakage and strong user authentication systems, are benefits of the suggested approach. Large-scale applications may experience latency problems and require more powerful hardware, which are drawbacks.The trade-offs between various data privacy strategies are highlighted in this study, and it also highlights the necessity for on-going innovation in privacy-preserving technology, which makes a contribution to the region.
Illicit crypto-mining leverages resources stolen from victims to mine cryptocurrencies on behalf of criminals. While recent works have analyzed one side of this threat, i.e.: web-browser cryptojacking, only commercial reports have partially covered binary-based crypto-mining malware.
Evidence and witness play an important role to investigate crime and lawful jurisdiction in any case. But often, the victims do not get justice due to the middlemen and the altered evidences in the centralized network. Block chain is an ideal solution to ensure transparency till the highest hierarchy of jurisdiction using a decentralized peer to peer network to store data which is immutable. It is like a distributed ledger working on the proof of work algorithm that validates each amendment and modification made in a particular chain. Evichain inculcates the transparency and security of the same decentralized network in the crime investigation process. It is an application on which the entire data regarding any particular investigation is stored in a block chain with limited people having access rights. It also includes cases filed by the victims themselves. Every amendment made in the block chain is validated. Also the data access is restricted to the users with that specific private key.
The decentralized nature of blockchain technologies can well match the needs of integrity and provenances of evidences collecting in digital forensics (DF) across jurisdictional borders. In this paper, a novel blockchain-based DF investigation framework in the Internet of Things (IoT) and social systems environment is proposed, which can provide proof of existence and privacy preservation for evidence items examination. To implement such features, we present a block-enabled forensics framework for IoT, namely, IoT forensic chain (IoTFC), which can offer forensic investigation with good authenticity, immutability, traceability, resilience, and distributed trust between evidential entitles as well as examiners. The IoTFC can deliver a guarantee of traceability and track provenance of evidence items. Details of evidence identification, preservation, analysis, and presentation will be recorded in chains of block. The IoTFC can increase trust of both evidence items and examiners by providing transparency of the audit train. The use case demonstrated the effectiveness of the proposed method.
Kroz ovaj rad precizno je objašnjeno kako izgraditi novu kriptovalutu po uzoru na već postojeću kriptovalutu. Opisane su tehnologije koje se koriste kako bi kriptovaluta funkcionirala. Pripremljeni su potrebni programi za izgradnju klijenta kriptovalute na sustavu Linux i objašnjena njegova svrha. Nakon toga je napravljena izmjena postojeće kriptovalute. Razlozi izmjene određenih parametara su detaljno objašnjeni. Navedeni su mogući problemi pri izradi i njhova rješenja. Na kraju je izgrađena kriptovaluta i podignuta mreža čvorova.
Michael Fröwis, Thilo Gottschalk, Bernhard Haslhofer, Christian Rückert · 5 authors
Analyzing cryptocurrency payment flows has become a key forensic method in law enforcement and is nowadays used to investigate a wide spectrum of criminal activities. However, despite its widespread adoption, the evidential value of obtained findings in court is still largely unclear. In this paper, we focus on the key ingredients of modern cryptocurrency analytics techniques, which are clustering heuristics and attribution tags. We identify internationally accepted standards and rules for substantiating suspicions and providing evidence in court and project them onto current cryptocurrency forensics practices. By providing an empirical analysis of CoinJoin transactions, we illustrate possible sources of misinterpretation in algorithmic clustering heuristics. Eventually, we derive a set of legal key requirements and translate them into a technical data sharing framework that fosters compliance with existing legal and technical standards in the realm of cryptocurrency forensics. Integrating the proposed framework in modern cryptocurrency analytics tools could allow more efficient and effective investigations, while safeguarding the evidential value of the analysis and the fundamental rights of affected persons.
This paper examines the way in which blockchain technology can be used to improve the verification of integrity of evidence in digital forensics. Some background into digital forensic practices and blockchain technology are discussed to provide necessary context. A particular scalable method of verifying point-in-time existence of a piece of digital evidence, using the OpenTimestamps (OTS) service, is described, and tests are carried out to independently validate the claims made by the service. The results demonstrate that the OTS service is highly reliable with a zero false positive and false negative error rate for timestamp attestations, but that it is not suitable for timesensitive timestamping due to the variance of the accuracy of timestamps induced by block confirmation times in the Bitcoin blockchain.
Stanislav Dashevskyi, Yury Zhauniarovich, Olga Gadyatskaya, Aleksandr Pilgun · 5 authors
Cryptojacking applications pose a serious threat to mobile devices. Due to the extensive computations, they deplete the battery fast and can even damage the device. In this work we make a step towards combating this threat. We collected and manually verified a large dataset of Android mining apps. In this paper, we analyze the gathered miners and identify how they work, what are the most popular libraries and APIs used to facilitate their development, and what static features are typical for this class of applications. Further, we analyzed our dataset using VirusTotal. The majority of our samples is considered malicious by at least one VirusTotal scanner, but 16 apps are not detected by any engine; and at least 5 apks were not seen previously by the service. Mining code could be obfuscated or fetched at runtime, and there are many confusing miner-related apps that actually do not mine. Thus, static features alone are not sufficient for miner detection. We have collected a feature set of dynamic metrics both for miners and unrelated benign apps, and built a machine learning-based tool for dynamic detection. Our BrenntDroid tool is able to detect miners with 95% of accuracy on our dataset. This preprint is a technical report accompanying the paper "Dissecting Android Cryptocurrency Miners" published in ACM CODASPY 2020.
The technological evolution brought by the Internet of things (IoT) comes with new forms of cyber-attacks exploiting the complexity and heterogeneity of IoT networks, as well as, the existence of many vulnerabilities in IoT devices. The detection of compromised devices, as well as the collection and preservation of evidence regarding alleged malicious behavior in IoT networks emerge as a areas of high priority. This paper presents a blockchain-based solution, which is designed for the smart home domain, dealing with the collection and preservation of digital forensic evidence. The system utilizes a private forensic evidence database, where the captured evidence is stored, along with a permissioned blockchain that allows providing security services like integrity, authentication, and non-repudiation, so that the evidence can be used in a court of law. The blockchain stores evidences' metadata, which are critical for providing the aforementioned services, and interacts via smart contracts with the different entities involved in an investigation process, including Internet service providers, law enforcement agencies and prosecutors. A high-level architecture of the blockchain-based solution is presented that allows tackling the unique challenges posed by the need for digitally handling forensic evidence collected from IoT networks.
This article provides a brief overview of blockchain or distributed ledger technology for archivists and records managers. While in the nascent stage, records are already being created or managed by blockchains. Therefore, it is necessary for archivists and records managers to become familiar with the basics of the technology, along with its benefits and shortcomings, in order to make informed decisions regarding the accessioning of blockchain systems and/or their use in managing record authenticity.
The systematic integration of the Internet of Things (IoT) and Cyber-Physical Systems (CPS) into the supply chain to increase operational efficiency and quality has also introduced new complexities to the threat landscape. The myriad of sensors could increase data collection capabilities for businesses to facilitate process automation aided by Artificial Intelligence (AI) but without adopting an appropriate Security-by-Design framework, threat detection and response are destined to fail. The emerging concept of Smart Workplace incorporates many CPS (e.g. Robots and Drones) to execute tasks alongside Employees both of which can be exploited as Insider Threats. We introduce and discuss forensic-readiness, liability attribution and the ability to track moving Smart SPS Objects to support modern Digital Forensics and Incident Response (DFIR) within a defence-in-depth strategy. We present a framework to facilitate the tracking of object behaviour within Smart Controlled Business Environments (SCBE) to support resilience by enabling proactive insider threat detection. Several components of the framework were piloted in a company to discuss a real-life case study and demonstrate anomaly detection and the emerging of behavioural patterns according to objects' movement with relation to their job role, workspace position and nearest entry or exit. The empirical data was collected from a Bluetooth-based Proximity Monitoring Solution. Furthermore, a key strength of the framework is a federated Blockchain (BC) model to achieve forensic-readiness by establishing a digital Chain-of-Custody (CoC) and a collaborative environment for CPS to qualify as Digital Witnesses (DW) to support post-incident investigations.
Mobile Network Operator (MNO) and Mobile Virtual Network Operator (MVNO) evidence have become an important evidentiary focus in the courtroom. This type of evidence is routinely produced as business records under U.S. Federal Rules of Evidence for use in the emerging discipline of Forensic Cell Site Analysis. The research was undertaken to determine if evidence produced by operators should be classified as digital evidence and, if so, what evidence handling methodologies are appropriate to ensure evidence integrity. This research project resulted in the creation of a method of determining if business records produced by MNO/MVNO organizations are digital evidence and whether evidentiary integrity is maintained in the conveyance of evidence between MNO/MVNO records custodians, law enforcement investigators and attorneys in criminal and civil cases. Block-chain based Distributed Ledger Technology was examined as a feasible evidence integrity maintenance solution.
Yijun Yu, Danny Barthaud, Blaine Price, Arosha K. Bandara · 6 authors
Unmanned Aerial Vehicles (UAVs), or drones, are increasingly expected to operate in spaces populated by humans while avoiding injury to people or damaging property. However, incidents and accidents can, and increasingly do, happen. Traditional investigations of aircraft incidents require on-board flight data recorders (FDRs); however, these physical FDRs only work if the drone can be recovered. A further complication is that physical FDRs are too heavy to mount on light drones, hence not suitable for forensic digital investigations of drone flights. In this paper, we propose a self-adaptive software architecture, LiveBox, to make drones both forensic-ready and regulation compliant. We studied the feasibility of using distributed technologies for implementing the LiveBox reference architecture. In particular, we found that updates and queries of drone flight data and constraints can be treated as transactions using decentralised ledger technology (DLT), rather than a generic time-series database, to satisfy forensic tamper-proof requirements. However, DLTs such as Ethereum, have limits on throughput (i.e. transactions-per-second), making it harder to achieve regulation-compliance at runtime. To overcome this limitation, we present a self-adaptive reporting algorithm to dynamically reduce the precision of flight data without sacrificing the accuracy of runtime verification. Using a real-life scenario of drone delivery, we show that our proposed algorithm achieves a 46% reduction in bandwidth without losing accuracy in satisfying both tamper-proof and regulation-compliant requirements.
This paper proposes the use of a blockchainbased structure in order to store evidences in a digital forensics investigation. The traditional chain of evidence is augmented with properties of immutability and traceability, thanks to a cryptographic process. The blockchain is constructed by forensics experts by adding evidences through the process. Since the blockchain is immutable, it can be shared among the different parties involved in a prosecution in order to review the chain of evidence and build their case. Furthermore, the blockchain structure can be applied to other forensics fields, like drugs, firearms, NDA. This blockchain is called a Digital Evidence Inventory (DEI) and is part of a wider framework encompassing a Forensics Confidence Rating (FCR) structure, in order to give experts the ability to rate the level of confidence for each evidence and a Global Digital Timeline (GDT) to order evidence through time. The whole framework is called ‘Aldiana’.
Cloud forensics is an intelligent evolution of digital forensics that defends against cyber-crimes. However, centralized evidence collection and preservation minimizes the reliability of digital evidence. To resolve this severe problem, this paper proposes a novel digital forensic architecture using fast-growing Software-Defined Networking (SDN) and Blockchain technology for Infrastructure-as-a-Service (IaaS) cloud. In this proposed forensic architecture, the evidence is collected and preserved in the blockchain that is distributed among multiple peers. To protect the system from unauthorized users, Secure Ring Verification based Authentication (SRVA) scheme is proposed. To strengthen the cloud environment, secret keys are generated optimally by using Harmony Search Optimization (HSO) algorithm. All data are encrypted based on the sensitivity level and stored in the cloud server. For encryption, Sensitivity Aware Deep Elliptic Curve Cryptography (SA-DECC) algorithm is presented. For every data stored in the cloud, a block is created in the SDN controller and the history of data is recorded as metadata. In each block, the Merkle hash tree is built by using Secure Hashing Algorithm-3 (SHA-3). Our system allows users to trace their data by deploying Fuzzy based Smart Contracts (FCS). Finally, evidence analysis is enabled by constructing Logical Graph of Evidence (LGoE) collected from the blockchain. Experiments are conducted in an integrated environment of java (for cloud and blockchain) and network simulator-3.26 (for SDN). The extensive analysis shows that proposed forensic architecture shows promising results in Response time, Evidence insertion time, Evidence verification time, Communication overhead, Hash computation time, Key generation time, Encryption time, Decryption time and total change rate.
Stephan Zöllner, Kim‐Kwang Raymond Choo, Nhien‐An Le‐Khac
Bitcoin is popular not only with consumers, but also with cybercriminals (e.g., in ransomware and online extortion, and commercial online child exploitation). Given the potential of Bitcoin to be involved in a criminal investigation, the need to have an up-to-date and in-depth understanding on the forensic acquisition and analysis of Bitcoins is crucial. However, there has been limited forensic research of Bitcoin in the literature. The general focus of existing research is on postmortem analysis of specific locations (e.g. wallets on mobile devices), rather than a forensic approach that combines live data forensics and postmortem analysis to facilitate the identification, acquisition, and analysis of forensic traces relating to the use of Bitcoins on a system. Hence, the latter is the focus of this paper where we present an open source tool for live forensic and postmortem analysing automatically. Using this open source tool, we describe a list of target artifacts that can be obtained from a forensic investigation of popular Bitcoin clients and Web Wallets on different web browsers installed on Windows 7 and Windows 10 platforms.
Presented here is a functional implementation of Distributed Ledger Technology applied to the task of cataloguing CCTV video evidence. We describe and demonstrate a prototype camera that participates in blockchain creation in real time, and the system designed to manage and coordinate its distribution and use. This application is of specific interest to law enforcement agencies charged with the management of high volumes of CCTV evidence. We discuss applicability and scalability with reference to simulation results and real-world testing. The combination of blockchain technology with a novel digital watermarking application is demonstrated here providing immediate benefit against an existing real-world problem of trustworthy evidence protection in distributed network environments.
Open access
Advanced Steganography and Watermarking Techniques
Smart contracts are a new paradigm that emerged with the rise of the blockchain technology. They allow untrusting parties to arrange agreements. These agreements are encoded as a programming language code and deployed on a blockchain platform, where all participants execute them and maintain their state. Smart contracts are promising since they are automated and decentralized, thus limiting the involvement of third trusted parties, and can contain monetary transfers. Due to these features, many people believe that smart contracts will revolutionize the way we think of distributed applications, information sharing, financial services, and infrastructures. To release the potential of smart contracts, it is necessary to connect the contracts with the outside world, such that they can understand and use information from other infrastructures. For instance, smart contracts would greatly benefit when they have access to web content. However, there are many challenges associated with realizing such a system, and despite the existence of many proposals, no solution is secure, provides easily-parsable data, introduces small overheads, and is easy to deploy. In this paper we propose PDFS, a practical system for data feeds that combines the advantages of the previous schemes and introduces new functionalities. PDFS extends content providers by including new features for data transparency and consistency validations. This combination provides multiple benefits like content which is easy to parse and efficient authenticity verification without breaking natural trust chains. PDFS keeps content providers auditable, mitigates their malicious activities (like data modification or censorship), and allows them to create a new business model. We show how PDFS is integrated with existing web services, report on a PDFS implementation and present results from conducted case studies and experiments.
One of the main issues in digital forensics is the management of evidences. From the time of evidence collection until the time of their exploitation in a legal court, evidences may be accessed by multiple parties involved in the investigation that take temporary their ownership. This process, called Chain of Custody (CoC), must ensure that evidences are not altered during the investigation, despite multiple entities owned them, in order to be admissible in a legal court. Currently digital evidences CoC is managed entirely manually with entities involved in the chain required to fill in documents accompanying the evidence. In this paper, we propose a Blockchain-based Chain of Custody (B-CoC) to dematerialize the CoC process guaranteeing auditable integrity of the collected evidences and traceability of owners. We developed a prototype of B-CoC based on Ethereum and we evaluated its performance.