The involvement of digital identity in almost all online services contributes to the growing reliance on Identity Management Systems (IDMS) that establish, verify, and manage digital identities. However, digital identities are still kept in central repositories. Which are controlled by a single authority that may have many vulnerabilities due to low security, leading attackers to exploit these vulnerabilities and causing various security breaches such as identity theft or disclosure of sensitive information. Additionally, powerful entities who have access to these repositories, could gather and abuse users' information without their knowledge or consent. The concept of Self-sovereign Identity (SSI) allows users to exert ownership of their identity and gain insight into how their data is being used. The development of Blockchain technology has made a breakthrough in achieving SSI by giving individuals the ability to be the final arbiter of who can access and use their own identity. This paper overviews the traditional identity management (IdM) models and presents the next generation of distributed IDMS using Blockchain technology that targets user-centricity and eliminates the identity provider as a trusted third party. Furthermore, It gives an analysis of the recent Blockchain-based IdM solutions, discussing their architecture, components, and features. It also, reveals their weaknesses to identify the gaps between these solutions for future secure IDMS.
Cryptocurrencies are gaining prominence among individuals and companies alike, resulting in the growing adoption of so-called cryptocurrency wallet applications, as these simplify transactions. These wallets are available in a myriad of different forms and specifications. All of them are susceptible to various ways the attacker can exploit the vulnerabilities and steal money from victims. Cryptocurrency wallets create a unique field as they combine features of password managers, banking applications, and the need to keep their users and their transactions anonymous. We collect the findings from previous literature to provide an overview of the different attack surfaces, possible countermeasures, and further research. Existing literature focused on one of the features mentioned before, while we considered all of them. Our systematic study shows that there is a considerable variety of attack vectors, which we have divided into six subcategories, (i) Memory and Storage, (ii) Operating Systems, (iii) Software Layer, (iv) Network Layer, (v) Blockchain Protocol, and (vi) Others. We have found a large gap between the possible countermeasures and their actual adoption. Therefore, we provide a list of possible directions for future research to tackle this gap.
Nilesh P. Sable, Rahul Ganpatrao Sonkamble, Vijay U. Rathod, Swati Shirke · 6 authors
Web3 is the next evolution of the internet, which uses blockchains, cryptocurrencies, and NFTs to return ownership and authority to the consumers. The potential of Web3 is highlighted by the creation of decentralized applications (dApps), which are more secure, transparent, and tamper-proof than their centralized counterparts, allowing for new business models that were previously impossible on the traditional internet.Web3 also focuses on user privacy, where users have more control over their personal data and can choose to share only what they want. The emergence of Web3 represents an exciting new frontier in blockchain technology, and its focus on decentralization, user privacy, and trustless systems has the potential to transform the way we interact with the internet.Web3 authentication is required for enhanced security, increased privacy, and simplified user interface. Traditional login procedures and an authorization flow using web3 authentication work together seamlessly. However, there are several challenges associated with Web3, including scalability and regulatory issues. Chain Authentication and Authorization (CAA) is a multi-layer security mechanism that allows users to choose the security layer that suits them, just like a heavy iron chain, where the user and CAA developers act as blacksmith and form their security protocol that suits them. CAA is a solution to the challenges associated with Web3 authentication and authorization, and it focuses on creating a secure and decentralized authentication and authorization system that is scalable, flexible, and user-friendly.
Disinformation and fake news are used by multiple actors to manipulate and influence the public with the purpose of gaining a series of advantages. This paper describes a promising solution to the increased spread of disinformation on the Internet. Our approach leverages blockchain technology combined with both crowd intelligence and federated artificial intelligence to develop efficient capabilities that address the disinformation phenomenon. The blockchain-based architecture of the platform creates a decentralized ecosystem that ensures transparency and trust, enabling the users to make correctly informed decisions in the face of disinformation. The key differentiating factor of the platform is the incorporation of both crowd and artificial intelligence in a system that can identify and respond to disinformation quickly and efficiently. The presented architecture can be used to build reactive and proactive platforms to effectively challenge disinformation.
Marzooq Hadi Marzooq Alyami, Reem Alhotaylah, Sawsan Alshehri, Abdullah Alghamdi
With the rapid development of technology in all fields, including the financial field, people have flocked to invest in cryptocurrencies, sometimes without prior knowledge or experience. This has prompted hackers to prey on inexperienced investors through many types of fraud and attacks, especially phishing attacks. Cryptocurrency investment transactions take place without intermediaries such as banks and monetary institutions. Investing in cryptocurrencies is a form of peer-to-peer transaction and takes place without the involvement of physical wallets. This study addresses cases where people may become victims of phishing attacks due to the nature of cryptocurrency investments. The aim of this study was to understand the concepts of various phishing attacks on cryptocurrencies and to measure the awareness of cryptocurrency investors in the Arab Gulf countries regarding the security risks associated with cryptocurrency investments. This research was conducted by distributing a questionnaire among cryptocurrency investors and collecting and analyzing all the survey responses. The results reveal a lack of awareness about how to deal with the security risks associated with cryptocurrency investments. The research concludes that the majority of cryptocurrency investors are unaware of how to deal with phishing attacks. Finally, we address future research directions and recommend actions that can be taken to increase investorsâ awareness of this issue.
Abstract The permanent availability and relative obscurity of blockchains is the perfect ground for using them for malicious purposes. However, the use of blockchains by malwares has not been characterized yet. This paper analyses the current state of the art in this area. One of the lessons learned is that covert communications for malware have received little attention. To foster further defence-oriented research, a novel mechanism (dubbed Smart-Zephyrus) is built leveraging smart contracts written in Solidity. Our results show that it is possible to hide 4 Kb of secret in 41 s. While being expensive (around USD 1.82 per bit), the provided stealthiness might be worth the price for attackers.
Danda Prudhvi Krishna, R. Ramaguru, K. Praveen, M. Sethumadhavan · 7 authors
OAuth2.0 is a Single Sign-On approach that helps to authorize users to log into multiple applications without re-entering the credentials. Here, the OAuth service provider controls the central repository where data is stored, which may lead to third-party fraud and identity theft. To circumvent this problem, we need a distributed framework to authenticate and authorize the user without third-party involvement. This paper proposes a distributed authentication and authorization framework using a secret-sharing mechanism that comprises a blockchain-based decentralized identifier and a private distributed storage via an interplanetary file system. We implemented our proposed framework in Hyperledger Fabric (permissioned blockchain) and Ethereum TestNet (permissionless blockchain). Our performance analysis indicates that secret sharing-based authentication takes negligible time for generation and a combination of shares for verification. Moreover, security analysis shows that our model is robust, end-to-end secure, and compliant with the Universal Composability Framework.
With the increase of intelligent voice phishing and the increasing reliance on open banking systems, there has been a rise in cases where individuals' personal information has been exposed, resulting in significant financial losses for the victims. Non-face-to-face transactions in the financial sector face challenges such as customer identification, ensuring transaction integrity, and preventing transaction rejection. Blockchain-based distributed ledgers have been proposed as a solution, but their adoption is limited due to the difficulty of managing private keys and the burden of gas fees management. This paper proposes a non-face-to-face P2P real-time token payment system that minimizes the risk of key loss by storing private keys in a keystore file and database through a server-based key management module. The proposed system simplifies token creation and management through a server-based token management module and implements an automatic gas charging function for smooth token transactions. Transaction integrity and non-repudiation are ensured through a transaction confirmation module that uses transaction IDs without exposing personal information. Furthermore, advanced security measures such as blocking foreign IP access and DDoS defense are implemented to securely protect user data. The proposed system aims to provide a convenient, secure, and accessible online payment solution to the public by implementing a self-authentication function using a web application that is not limited to smart phones or application platforms.
The smart contract, a self-executing program on the blockchain, is key to programmable finance. However, the rise of smart contract use has also led to an increase in vulnerabilities that attract illegal activity from hackers. Traditional manual approaches for vulnerability detection, relying on domain experts, have limitations such as low automation and weak generalization. In this paper, we propose a deep learning approach that leverages domain-specific features and an attention mechanism to accurately detect vulnerabilities in smart contracts. Our approach reduces the reliance on manual input and enhances generalization by continuously learning code patterns of vulnerabilities, specifically detecting various types of vulnerabilities such as reentrancy, integer overflow, forced Ether injection, unchecked return value, denial of service, access control, short address attack, tx.origin, call stack overflow, timestamp dependency, random number dependency, and transaction order dependency vulnerabilities. In order to extract semantic information, we present a semantic distillation approach for detecting smart contract vulnerabilities. This approach involves using a syntax parser, Slither, to segment the code into smaller slices and word embedding to create a matrix for model training and prediction. Our experiments indicate that the BILSTM model is the best deep learning model for smart contract vulnerability detection task. We looked at how domain features and self-attentiveness mechanisms affected the ability to identify 12 different kinds of smart contract vulnerabilities. Our results show that by including domain features, we significantly increased the F1 values for 8 different types of vulnerabilities, with improvements ranging from 7.35% to 48.58%. The methods suggested in this study demonstrate a significant improvement in F1 scores ranging from 4.18% to 38.70% when compared to conventional detection tools like Oyente, Mythril, Osiris, Slither, Smartcheck, and Securify. This study provides developers with a more effective method of detecting smart contract vulnerabilities, assisting in the prevention of potential financial losses. This research provides developers with a more effective means of detecting smart contract vulnerabilities, thereby helping to prevent potential financial losses.
We identify a subtle security issue that impacts mechanism design in scenarios in which agents can absolutely commit to strategies. Absolute commitments allow the strategy of an agent to depend on the commitments made by the other agents. This changes fundamental game-theoretic assumptions by inducing a meta-game in which agents choose which strategies they commit to. We say that a game that is unaffected by such commitments is Stackelberg resilient and show that computing it is intractible in general, although it can be computed efficiently for two-player games of perfect information. We show the intuitive, but technically non-trivial result, that, if a game is resilient when some number of players have the capacity to make commitments, it is also resilient when these commitments are available to fewer players. We demonstrate the non-triviality of Stackelberg resilience by analyzing two escrow mechanisms from the literature. These mechanisms have the same intended functionality, but we show that only one is Stackelberg resilient. Our model is particularly relevant in Web3 scenarios, where these absolute commitments can be realized by the automated and irrevocable nature of smart contracts. Our work highlights an important issue in ensuring the secure design of Web3. In particular, our work suggests that smart contracts already deployed on major blockchains may be susceptible to these attacks.
Saba Abdulbaqi Salman, Sufyan Al-Janabi, Ali Makki Sagheer
Electronic voting has become popular in democratic countries, and thus the cyber security of this system is demanded. In this paper, some attacks were made on a proposed electronic election model based on blockchain technology, where the impact of each attack (Sybil, DDoS, Eclipse, Selfish mining, 51% attack) was calculated, and the time in which it achieved 51% of the attack was calculated. In this study, we investigate of Blockchain technologyâs attack surface, focusing on general blockchains. The following factors show how these attacks have an impact on the proposed model: 1) The cryptographic architecture of the Blockchain. 2) The distributed architecture of systems using Blockchain. 3) The Blockchain application context. For each of these factors, we identify several attacks, including selfish mining, 51% attack, sybil attacks, eclipse attacks, distributed denial-of-service (DDos) attacks, consensus delay (due to selfish behavior or distributed denial-of-service attacks), blockchain forks, orphan blocks, block swallowing, wallet theft, smart contract attacks, and privacy attacks.
During long-distance flight, unmanned aerial vehicles (UAVs) need to perform cross-domain authentication to prove their identity and receive information from the ground control station (GCS). However, the GCS needs to verify all drones arriving at the area it is responsible for, which leads to the GCS being unable to complete authentication in time when facing cross-domain requests from a large number of drones. Additionally, due to potential threats from attackers, drones and GCSs are likely to be deceived. To improve the efficiency and security of cross-domain authentication, we propose an efficient blockchain-based cross-domain authentication scheme for the Internet of Drones (BCDAIoD). By using a consortium chain with a multi-chain architecture, the proposed method can query and update different types of data efficiently. By mutual authentication before cross-domain authentication, drones can compose drone groups to lighten the authentication workload of domain management nodes. BCDAIoD uses the notification mechanism between domains to enable path planning for drones in advance, which can further improve the efficiency of cross-domain authentication. The performance of BCDAIoD was evaluated through experiments. The results show that the cross-domain authentication time cost and computational overhead of BCDAIoD are significantly lower those of than existing methods when the number of drones is large.
A blockchain-based decentralized application (DApp) refers to an application typically using web pages or mobile applications as the front-end and smart contracts as the back-end. The front-end of the DApp helps users generate transactions and send them to the userâs blockchain wallet. After the user signs and confirms the transaction using the blockchain wallet, the transaction will invoke the smart contract of the DApp. However, users bear the following risks when using DApps because of the potential inconsistent behaviors in DApps. First, the DApp front-end may generate incorrect transactions inconsistent with usersâ intentions. Second, the smart contract may have misbehaviors when executing the transactions. Inconsistent behaviors of DApps not only lead to user confusion but also cause significant financial losses. In this paper, we proposed a novel approach to identify inconsistent behaviors of DApps on EVM-compatible blockchains by contrasting the behaviors of DApps that derived from the front-end, blockchain wallet, and smart contracts, respectively. We implemented our approach into a prototype named DAppHunter. We have applied DAppHunter on 92 real-world DApps of Ethereum and Binance Smart Chain and successfully identified 37 DApps with inconsistent behaviors. We confirmed that 35 of them are scam DApps and over 5 million blockchain addresses are at risk of becoming victims of these inconsistent DApps.
Smart contracts in blockchains have been increasingly used for high-value business applications. It is essential to check smart contracts' reliability before and after deployment. Although various program analysis and deep learning techniques have been proposed to detect vulnerabilities in either Ethereum smart contract source code or bytecode, their detection accuracy and scalability are still limited. This paper presents a novel framework named MANDO-HGT for detecting smart contract vulnerabilities. Given Ethereum smart contracts, either in source code or bytecode form, and vulnerable or clean, MANDO-HGT custom-builds heterogeneous contract graphs (HCGs) to represent control-flow and/or function-call information of the code. It then adapts heterogeneous graph transformers (HGTs) with customized meta relations for graph nodes and edges to learn their embeddings and train classifiers for detecting various vulnerability types in the nodes and graphs of the contracts more accurately. We have collected more than 55K Ethereum smart contracts from various data sources and verified the labels for 423 buggy and 2,742 clean contracts to evaluate MANDO-HGT. Our empirical results show that MANDO-HGT can significantly improve the detection accuracy of other state-of-the-art vulnerability detection techniques that are based on either machine learning or conventional analysis techniques. The accuracy improvements in terms of F1-score range from 0.7% to more than 76% at either the coarse-grained contract level or the fine-grained line level for various vulnerability types in either source code or bytecode. Our method is general and can be retrained easily for different vulnerability types without the need for manually defined vulnerability patterns.
In recent years, Blockchain-based Online Social Media (BOSM) platforms have evolved fast due to the advancement of blockchain technology. BOSM can effectively overcome the problems of traditional social media platforms, such as a single point of trust and insufficient incentives for users, by combining a decentralized governance structure and a cryptocurrency-based incentive model, thereby attracting a large number of users and making it a crucial component of Web3. BOSM allows users to downvote low-quality content and aims to decrease the visibility of low-quality content by sorting and filtering it through downvoting. However, this feature may be maliciously exploited by some users to undermine the fairness of the incentive, reduce the quality of highly visible content, and further reduce users' enthusiasm for content creation and the attractiveness of the platform. In this paper, we study and analyze the downvoting behavior using four years of data collected from Steemit, the largest BOSM platform. We discovered that a significant number of bot accounts were actively downvoting content. In addition, we discovered that roughly 9% of the downvoting activity might be retaliatory. We did not detect any significant instances of downvoting on content for a specific topic. We believe that the findings in this paper will facilitate the future development of user behavior analysis and incentive pattern design in BOSM and Web3.
Blockchain systems often rely on rationality assumptions for their security, expecting that nodes are motivated to maximize their profits. These systems thus design their protocols to incentivize nodes to execute the honest protocol but fail to consider out-of-band collusion. Existing works analyzing rationality assumptions are limited in their scope, either by focusing on a specific protocol or relying on non-existing financial instruments. We propose a general rational attack on rationality by leveraging an external channel that incentivizes nodes to collude against the honest protocol. Our approach involves an attacker creating an out-of-band bribery smart contract to motivate nodes to double-spend their transactions in exchange for shares in the attacker's profits. We provide a game theory model to prove that any rational node is incentivized to follow the malicious protocol. We discuss our approach to attacking the Bitcoin and Ethereum blockchains, demonstrating that irrational behavior can be rational in real-world blockchain systems when analyzing rationality in a larger ecosystem. We conclude that rational assumptions only appear to make the system more secure and offer a false sense of security under the flawed analysis.
Dr. P. N. Fale, Payal Dahe, Namita Shendre, Priyanshu Khadaskar · 6 authors
Fake products create a huge negative impact in the market for both buyers and sellers. The sellers fails to deliver the product as per the consumers expectations and the consumers starts to doubt the quality and standards of the company which ultimately results in the negative marketing of the brand whose fake products are being circulated in the market. The most critical part about counterfeit products is that it can be harmful for the consumers. Since, the fake or counterfeit products are not restricted to any particular sector in the market therefore it has become important for us to detect these products and find a way to keep them out of the market. These products can be dangerous if we consider very dominating sectors of market like pharmaceutical and food supplies. To tackle such problems, we need to maintain a data, which is easily accessible to consumers where they can verify the details about the products and build a level of trust regarding the product authenticity. As we all know that no product is safe from counterfeiting due to the continuous growth in counterfeit products in the supply chain. It is degrading company's name and their profit; it also affects the customer, for example if this counterfeiting is done in pharmaceutical field, then it will directly affect the customer's health. To counter this problem, the research work has been proposed but not perfected. In this proposed approach, we will be using Blockchain technology to find genuineness of the product. Blockchain technology is generally a ledger system, which holds all the data of the transactions that take place on it. The unique thing about this technology is that the ledger that we mentioned here is a distributed ledger across a peer-to-peer network. Also, we propose a system where we store product's detail and its ownership status on architecture provided by Ethereum. We will be using QR code, which will be scanned by customer such that he/she will be able to find out the details of the product as manufacturing details, current owner etc. and will be able to determine whether the product is fake or real.
Blockchain denial of service (BDoS) and selfish mining are the two most crucial attacks on blockchain technology. A classical DoS attack targets the computer network to limit, restrict, or stop accessing the system of authorized users which is ineffective against renowned cryptocurrencies like Bitcoin, Ethereum, etc. Unlike the conventional DoS, the BDoS affects the system's mechanism design to manipulate the incentive structure to discourage honest miners to participate in the mining process. In contrast, in a selfish mining attack, the adversary miner keeps its discovered block private to fork the chain intentionally that aiming to increase the incentive of the adversary miner. This paper proposed a technique to successfully avoid BDoS and selfish mining attacks. The existing infrastructure of blockchain technology does not need to be changed a lot to incorporate the proposed solution.
S Nandini, S Chandana, P M Charanya, Dhanya Suryamath · 5 authors
Non-governmental organizations or NGOs, are primarily nonprofit groups, and a large portion of them are supported by members of NGO and public donations. The credibility of an NGO is substantially enhanced and donor confidence is greatly increased by maintaining transparency regarding how donations are used. Donor organizations provide funding to non-governmental organizations(NGOs) in developing various initiatives such as economic development, womenâs empowerment, promoting education, responding to calamities and natural disasters. Due to some NGOsâ involvement in the misuse of funds, some donor agencies cease to have faith in NGOs method of operation. This system is decentralized, not owned or operated by a single person or organization but rather shared among users. We have developed a blockchain-based Donation System capable of decentralizing the resources used by a given organization. The user may create any new organization and others will be allowed to donate money in the organization. As a result, the public become the true owners of the resources, and the charity fund system as a whole becomes more transparent. Blockchain technology and distributed ledgers can reduce operational costs and bring us closer to real-time transactions between financial institutions. System uses cross chain protocol for reliably exchanging information without third party in a multiple Blockchain system
Bitcoin transactions include unspent transaction outputs (UTXOs) as their inputs and generate one or more newly owned UTXOs at specified addresses. Each U TXO can only be used as an input in a transaction once, and using it in two or more different transactions is referred to as a double-spending attack. Ultimately, due to the characteristics of the Bitcoin protocol, double-spending is impossible. However, problems may arise when a transaction is considered final even though i ts finality has not been fully guaranteed in order to achieve fast payment. In this paper, we propose an approach to detecting Bitcoin double-spending attacks using a graph neural network (GNN). This model predicts whether all nodes in the network contain a given payment transaction in their own memory pool (mempool) using information only obtained from some observer nodes in the network. Our experiment shows that the proposed model can detect double-spending with an accuracy of at least 0.95 when more than about 1% of the entire nodes in the network are observer nodes.