The bachelor's thesis "Analysis and forensic investigation of Bitcoin cryptocurrency" deals with creation of methodology for searching for Bitcoin on computer device, practical application of the methodology and comparison of obtained results with proffesional forensic tools. Theoretical part contains detailed description of how Bitcoin cryptocurrency works, it's storage ways and comparison with alternative cryptocurriencies which would be, from technological aspect, more appropriate to use for non-tracable transactions.
Phan The Duy, Hien Do Hoang, Do Thi Thu Hien, Nguyen Ba Khanh · 5 authors
Despite bringing many benefits of global network configuration and control, Software Defined Networking (SDN) also presents potential challenges for both digital forensics and cybersecurity. In fact, there are various attacks targeting a range of vulnerabilities on vital elements of this paradigm such as controller, Northbound and Southbound interfaces. In addition to solutions of security enhancement, it is important to build mechanisms for digital forensics in SDN which provide the ability to investigate and evaluate the security of the whole network system. It should provide features of identifying, collecting and analyzing log files and detailed information about network devices and their traffic. However, upon penetrating a machine or device, hackers can edit, even delete log files to remove the evidences about their presence and actions in the system. In this case, securing log files with fine-grained access control in proper storage without any modification plays a crucial role in digital forensics and cybersecurity. This work proposes a blockchain-based approach to improve the security of log management in SDN for network forensics, called SDNLog-Foren. This model is also evaluated with different experiments to prove that it can help organizations keep sensitive log data of their network system in a secure way regardless of being compromised at some different components of SDN.
Mrunali Chopade, Sana Khan, Uzma Shaikh, Renuka Pawar
The fundamental aim of digital forensics is to discover, investigate and protect an evidence, increasing cybercrime enforces digital forensics team to have more accurate evidence handling. This makes digital evidence as an important factor to link individual with criminal activity. In this procedure of forensics investigation, maintaining integrity of the evidence plays an important role. A chain of custody refers to a process of recording and preserving details of digital evidence from collection to presenting in court of law. It becomes a necessary objective to ensure that the evidence provided to the court remains original and authentic without tampering. Aim is to transfer these digital evidences securely using encryption techniques.
Alex Groce, Josselin Feist, Gustavo Grieco, Michael D. Colburn
An important problem in smart contract security is understanding the\nlikelihood and criticality of discovered, or potential, weaknesses in\ncontracts. In this paper we provide a summary of Ethereum smart contract audits\nperformed for 23 professional stakeholders, avoiding the common problem of\nreporting issues mostly prevalent in low-quality contracts. These audits were\nperformed at a leading company in blockchain security, using both open-source\nand proprietary tools, as well as human code analysis performed by professional\nsecurity engineers. We categorize 246 individual defects, making it possible to\ncompare the severity and frequency of different vulnerability types, compare\nsmart contract and non-smart contract flaws, and to estimate the efficacy of\nautomated vulnerability detection approaches.\n
Protecting sensitive medical data, including prescription and pill data, during its handling and storage is critical in the digital era. Data vaults that protect privacy provide a strong way to protect this information, guaranteeing that patient information is kept private but yet available for authorised uses. Focussing on the safe preservation of pharmaceutical data, this project investigates the creation of sophisticated algorithms for privacy-preserving data vaults. We start by contrasting the suggested innovative technique, which combines elements of Zero-Knowledge Proofs with Enhanced Homomorphic Encryption, with other known cryptographic and data masking algorithms, such as Differential Privacy, Secure Multi-Party Computation, and Homomorphic Encryption. Data integrity, computational efficiency, and resistance to different attack vectors are some of the characteristics used in the comparison.As the results show, the suggested method offers aimproved performance against confidentiality compromises, especially in real-time data retrieval scenarios, while existing techniques offer varied degrees of efficiency and security. But this comes with more implementation complexity and processing overhead. Improved security characteristics, like less data leakage and strong user authentication systems, are benefits of the suggested approach. Large-scale applications may experience latency problems and require more powerful hardware, which are drawbacks.The trade-offs between various data privacy strategies are highlighted in this study, and it also highlights the necessity for on-going innovation in privacy-preserving technology, which makes a contribution to the region.
Stefan Schorradt, Edita Bajramović, Felix Freiling
With industrial control systems (ICSs) being increasingly networked, the need for sound forensic capabilities for such systems increases. One vital source of information in forensic investigation are log files. Techniques for secure logging aim to protect log files from manipulation. We investigate how a blockchain can enable secure logging for ICSs. We argue that a blockchain fits well both into general models of secure logging and into the Purdue model for ICSs. We report on experiences from connecting the syslog functionality of a Siemens SIMATIC S7-1500 programmable logic controller to the public Ethereum blockchain network. While the level of manipulation protection is comparably high, the transaction time for the public Ethereum blockchain severely limits the usefulness of this type of secure logging for ICSs.
Illicit crypto-mining leverages resources stolen from victims to mine cryptocurrencies on behalf of criminals. While recent works have analyzed one side of this threat, i.e.: web-browser cryptojacking, only commercial reports have partially covered binary-based crypto-mining malware.
Evidence and witness play an important role to investigate crime and lawful jurisdiction in any case. But often, the victims do not get justice due to the middlemen and the altered evidences in the centralized network. Block chain is an ideal solution to ensure transparency till the highest hierarchy of jurisdiction using a decentralized peer to peer network to store data which is immutable. It is like a distributed ledger working on the proof of work algorithm that validates each amendment and modification made in a particular chain. Evichain inculcates the transparency and security of the same decentralized network in the crime investigation process. It is an application on which the entire data regarding any particular investigation is stored in a block chain with limited people having access rights. It also includes cases filed by the victims themselves. Every amendment made in the block chain is validated. Also the data access is restricted to the users with that specific private key.
Data stored in different kinds of Database management systems is always prone to tampering through internal or external sources. To detect such malicious changes in the database we use various Database Tampering Detection methods. A major find in this area was to use one-way cryptographic hash functions as well as use of digital watermarking to detect any tamper in the data. But these techniques won't work on Distributed Database. In this paper, we have put forth the idea of using a Distributed Database to store data and we can easily detect any malicious transaction using Blockchain technology in it. It is simply a digital ledger bound using cryptographic principles.
Digital and Cyber Forensics
Advanced Malware Detection Techniques
Advanced Steganography and Watermarking Techniques
The decentralized nature of blockchain technologies can well match the needs of integrity and provenances of evidences collecting in digital forensics (DF) across jurisdictional borders. In this paper, a novel blockchain-based DF investigation framework in the Internet of Things (IoT) and social systems environment is proposed, which can provide proof of existence and privacy preservation for evidence items examination. To implement such features, we present a block-enabled forensics framework for IoT, namely, IoT forensic chain (IoTFC), which can offer forensic investigation with good authenticity, immutability, traceability, resilience, and distributed trust between evidential entitles as well as examiners. The IoTFC can deliver a guarantee of traceability and track provenance of evidence items. Details of evidence identification, preservation, analysis, and presentation will be recorded in chains of block. The IoTFC can increase trust of both evidence items and examiners by providing transparency of the audit train. The use case demonstrated the effectiveness of the proposed method.
Kroz ovaj rad precizno je objašnjeno kako izgraditi novu kriptovalutu po uzoru na već postojeću kriptovalutu. Opisane su tehnologije koje se koriste kako bi kriptovaluta funkcionirala. Pripremljeni su potrebni programi za izgradnju klijenta kriptovalute na sustavu Linux i objašnjena njegova svrha. Nakon toga je napravljena izmjena postojeće kriptovalute. Razlozi izmjene određenih parametara su detaljno objašnjeni. Navedeni su mogući problemi pri izradi i njhova rješenja. Na kraju je izgrađena kriptovaluta i podignuta mreža čvorova.
While significant advancements have been made in the field of multimedia forensics to detect altered content, existing techniques mostly focus on enabling the content recipient to verify the content integrity without any inputs from the content creator. In many application scenarios, the creator has a strong incentive to establish the provenance and integrity of the multimedia data created and released by him. Hence, there is a strong need for mechanisms that allow the content creator to prove the authenticity of the released content. Since blockchain technology provides an immutable distributed database, it is an ideal solution for reliably time-stamping content with its creation time and storing an irrefutable signature of the content at the time of its creation. However, a simple digital signature scheme does not allow modification of the content after the initial commitment. Authorized multimedia content alteration by its creator is often necessary (e.g., redaction of faces to protect the privacy of individuals in a video, redaction of sensitive fields in a text document) before the content is distributed. The main contributions of this paper are: (i) a novel sanitizable signature scheme that enables the content creator to prove the integrity of the redacted content, while preventing the recipients from reconstructing the redacted segments based on the published commitment, and (ii) a blockchain-based solution for securely managing the sanitizable signature. The proposed solution employs a robust hashing scheme using chameleon hash function and Merkle tree to generate the initial signature, which is stored on the blockchain. The auxiliary data required for the integrity verification step is retained by the content creator and only a signature of this auxiliary data is stored on the blockchain. Any modifications to the multimedia content requires only updating the signature of the auxiliary data, which is securely recorded on the blockchain. We demonstrate that the proposed approach enables verification of integrity of redacted multimedia content without compromising the content privacy requirements.
Digital Media Forensic Detection
Advanced Steganography and Watermarking Techniques
Michael Fröwis, Thilo Gottschalk, Bernhard Haslhofer, Christian Rückert · 5 authors
Analyzing cryptocurrency payment flows has become a key forensic method in law enforcement and is nowadays used to investigate a wide spectrum of criminal activities. However, despite its widespread adoption, the evidential value of obtained findings in court is still largely unclear. In this paper, we focus on the key ingredients of modern cryptocurrency analytics techniques, which are clustering heuristics and attribution tags. We identify internationally accepted standards and rules for substantiating suspicions and providing evidence in court and project them onto current cryptocurrency forensics practices. By providing an empirical analysis of CoinJoin transactions, we illustrate possible sources of misinterpretation in algorithmic clustering heuristics. Eventually, we derive a set of legal key requirements and translate them into a technical data sharing framework that fosters compliance with existing legal and technical standards in the realm of cryptocurrency forensics. Integrating the proposed framework in modern cryptocurrency analytics tools could allow more efficient and effective investigations, while safeguarding the evidential value of the analysis and the fundamental rights of affected persons.
This paper examines the way in which blockchain technology can be used to improve the verification of integrity of evidence in digital forensics. Some background into digital forensic practices and blockchain technology are discussed to provide necessary context. A particular scalable method of verifying point-in-time existence of a piece of digital evidence, using the OpenTimestamps (OTS) service, is described, and tests are carried out to independently validate the claims made by the service. The results demonstrate that the OTS service is highly reliable with a zero false positive and false negative error rate for timestamp attestations, but that it is not suitable for timesensitive timestamping due to the variance of the accuracy of timestamps induced by block confirmation times in the Bitcoin blockchain.
Stanislav Dashevskyi, Yury Zhauniarovich, Olga Gadyatskaya, Aleksandr Pilgun · 5 authors
Cryptojacking applications pose a serious threat to mobile devices. Due to the extensive computations, they deplete the battery fast and can even damage the device. In this work we make a step towards combating this threat. We collected and manually verified a large dataset of Android mining apps. In this paper, we analyze the gathered miners and identify how they work, what are the most popular libraries and APIs used to facilitate their development, and what static features are typical for this class of applications. Further, we analyzed our dataset using VirusTotal. The majority of our samples is considered malicious by at least one VirusTotal scanner, but 16 apps are not detected by any engine; and at least 5 apks were not seen previously by the service. Mining code could be obfuscated or fetched at runtime, and there are many confusing miner-related apps that actually do not mine. Thus, static features alone are not sufficient for miner detection. We have collected a feature set of dynamic metrics both for miners and unrelated benign apps, and built a machine learning-based tool for dynamic detection. Our BrenntDroid tool is able to detect miners with 95% of accuracy on our dataset. This preprint is a technical report accompanying the paper "Dissecting Android Cryptocurrency Miners" published in ACM CODASPY 2020.
The technological evolution brought by the Internet of things (IoT) comes with new forms of cyber-attacks exploiting the complexity and heterogeneity of IoT networks, as well as, the existence of many vulnerabilities in IoT devices. The detection of compromised devices, as well as the collection and preservation of evidence regarding alleged malicious behavior in IoT networks emerge as a areas of high priority. This paper presents a blockchain-based solution, which is designed for the smart home domain, dealing with the collection and preservation of digital forensic evidence. The system utilizes a private forensic evidence database, where the captured evidence is stored, along with a permissioned blockchain that allows providing security services like integrity, authentication, and non-repudiation, so that the evidence can be used in a court of law. The blockchain stores evidences' metadata, which are critical for providing the aforementioned services, and interacts via smart contracts with the different entities involved in an investigation process, including Internet service providers, law enforcement agencies and prosecutors. A high-level architecture of the blockchain-based solution is presented that allows tackling the unique challenges posed by the need for digitally handling forensic evidence collected from IoT networks.
With the rapid development and application of the Internet, the amount of electronic data based on computer and computer network has exploded. Specific and effective electronic data play an increasingly important role in proving the facts of a case. The most important issue of electronic evidence is trust and security. However, electronic evidence is stored in the centralized database at present, and there are data security and trust problems. This paper proposes an electronic evidence preservation model based on blockchain to ensure the data safe and reliable.
This article provides a brief overview of blockchain or distributed ledger technology for archivists and records managers. While in the nascent stage, records are already being created or managed by blockchains. Therefore, it is necessary for archivists and records managers to become familiar with the basics of the technology, along with its benefits and shortcomings, in order to make informed decisions regarding the accessioning of blockchain systems and/or their use in managing record authenticity.