Social engineering (SE) attacks (also called social hacking) refer to various methods used by cybercriminals to exploit the weak nature of human beings rather than the logical and physical security measures used by organizations. This research paper studies the various methods of SE used by criminals to exploit the psychological vulnerabilities of human beings. On this basis, the paper proposes a new defense categorization of SE attacks based on two security principles: dual control (i.e., more than one entity to complete the task) and split knowledge (i.e., dual controlling of the knowledge to complete the task). We describe how those measures could stop SE attacks and avoid human weaknesses. Then, we propose an original new SE defense model that implements the security principles using blockchain technology to both dual control the transactions and record them safely for organizations. The proposed model’s first aim is to avoid the dependence on the cognitive or psychological status of the victim and enable more verification steps to be taken in a fast and flexible manner. The paper demonstrates the quick and easy adoption of the existing private blockchain platform to implement the proposed SE defense model.
Bei der illegalen Nutzung von Kryptowährungen liefern sich Straftäter:innen, die versuchen, neue Technologie auszunutzen, Ermittler:innen, die versuchen, Straftaten aufzudecken oder zu unterbinden und Gesetzgeber, die versuchen, die Nutzung zu regulieren, ein Wettrennen. Den Strafverfolgungsbehörden stellen sich zahlreiche Herausforderungen, etwa die Ermittlung von Straftäter:innen, das Fehlen eines rechtlichen Rahmens für die Strafverfolgung sowie von Instrumenten und Ausbildung um Straftaten vorzubeugen oder sie zu unterbinden. Um die Beziehung zwischen Kryptowährungsdelikten und Ermittlungs- und Präventionsmethoden zur digitalen Disruption besser zu verstehen, wird der Forschungsstand analysiert. Ziel ist es, die Praxis, z. B. die Polizei, bei Prävention, Störung und Reduzierung von Delikten zu unterstützen. Die Ergebnisse informieren über Kategorien und Umfang illegaler Aktivitäten sowie den Einfluss von Kryptowährungsmärkten auf Kriminalität, beides wichtige Aspekte für Strafverfolgungsbehörden. Außerdem wurden Ermittlungs- und Präventionsmethoden für digitale Disruption aus der Sicherheitsforschung identifiziert; diese werden hinsichtlich Empfehlungen für weitere Forschung diskutiert. Ebenso wird der Einfluss illegaler Aktivitäten als Treiber des Kryptowährungsmarktes diskutiert. Es wird angenommen, dass die illegale Nutzung von Kryptowährungen zwar zahlenmäßig zunimmt, das Volumen im Verhältnis zum gesamten Markt jedoch abnimmt. Allerdings ist der Kenntnisstand über Umfang, Ausmaß und Veränderungsrate in den verschiedenen Deliktsbereichen uneinheitlich, und es besteht noch kein Konsens über ein einheitliches Berechnungsmodell. Der Text schließt mit einer Reihe von Empfehlungen.
Smart contracts emerged as programs running on the blockchain. Security is one of the major concerns against smart contracts which also exist various vulnerabilities as for any other traditional programs. What was worse, security vulnerabilities in smart contracts may lead to irreversible economic losses. Hence, there is an apparent demand for security audits of contracts before deployment. In recent years, a large number of smart contract vulnerability detection tools have emerged. The methods used by these tools include formal verification, symbolic execution, machine learning, and fuzz testing. These methods can well analyze vulnerabilities, but there are still limitations. In this paper, we optimized and extended the Mythril symbolic execution tool. The optimized pruning algorithm improves the speed of symbolic execution, while the proposed detection algorithm for Transaction Order Dependence vulnerability expands the range of detecting vulnerability. In addition, a machine learning vulnerability detection model is introduced as an auxiliary detection method, which is used to build the complete smart contract vulnerability detection system. The experimental results show that the proposed system reduces the execution time, and improves the accuracy as well as the recall of vulnerability detection compared with the original Mythril tool.
SMT. M. VANI, M. Doshi, Amit A. Nanavati, A. Kundu
Blockchain platforms and smart contracts are vulnerable to security breaches. Security breaches of smart contracts have led to huge financial losses in terms of cryptocurrencies and tokens. In this paper, we present a systematic survey of vulnerability analysis of smart contracts. We begin by providing a brief about the major types of attacks and vulnerabilities that are present in smart contracts. Then we discuss existing frameworks, methods and technologies used for vulnerability detection. We summarise our findings in a table which lists each framework and the attacks it protects against.
Esta tese oferece uma análise dos fundamentos da Decentralized Finance, particularmente das tokens não fungíveis e dos desafios que estas inovações representam para o arcabouço legal da União Europeia contra o branqueamento de capitais e financiamento do terrorismo. Por um lado, a tese irá analisar as mudanças que estas inovações podem trazer ao mercado da arte e à indústria criativa. Por outro lado, centrarse-á nos riscos de crime financeiro que advêm da maior facilidade em ocultar os produtos do crime na blockchain.
Identity management is the process of setting and organizing the roles and access privileges of a user’s identity. The current identity management system is centralized and is controlled by a single entity. Users’ privacy concerns are not in their best interest. Users have very little to no control over their data. The centralized system becomes a single point of failure which is prone to attack that leads to users losing their data privacy if these centralized systems are breached. Therefore we propose a Blockchain-based decentralized Identity Management System that makes use of self-sovereign identity, decentralized identifiers, and verifiable credentials. It also gives users the ability to choose from a very large number of identity providers instead of just a select few corporations. The main advantages of the proposed solution include the elimination of the need for a central authority for identity verification and identity data management, the reduction of time spent on identity verification, the ability to share data with permission, and the ability to verify the origin of the data while sharing.
Organised crime and cybercriminals use Bitcoin, a popular cryptocurrency, to launder money and move it across borders with impunity. The UK and other countries have legislation to recover the proceeds of crime from criminals. Recent UK case law has recognised cryptocurrency assets as property that can be seized and realised under the Proceeds of Crime Act (POCA). To seize a cryptocurrency asset generally requires access to the private key. Anecdotal evidence suggests that if cryptocurrency is not seized quickly after enforcement action has taken place, it will be transferred to other wallets making it difficult to seize at a future time. We investigate how Bitcoin could be seized from an Electrum or Ledger hardware wallet, during a law enforcement search, using live forensic techniques and a dictionary attack. We conduct a literature review examining the state-of-the-art in Bitcoin application forensics and Bitcoin wallet attacks. Concluding, that there is a gap in research on Bitcoin wallet security and that a significant proportion of the available literature comes from a small group of academics working with industry and law enforcement (Volety et al. 2019; Van Der Horst et al., 2017; Zollner et al., 2019). We then forensically examine the Electrum software wallet and the Ledger Nano S hardware wallet, to establish what artefacts can be recovered to assist in the recovery of Bitcoin from the wallets. Our main contribution is a proposed framework for Bitcoin forensic triage, a collection tool to recover Bitcoin artefacts and identifiers, and two proof of concept dictionary-attack tools written in Python and OpenCL. We then evaluate these tools to establish if an attack is practicable using a low-cost cluster of public cloud-based Graphics Processing Unit (GPU) instances. During our investigation, we find a weakness in Electrum's storage of encrypted private keys in RAM. We leverage this to make around 2.4 trillion password guesses. We also demonstrate that we can conduct 16.6 billion guesses against a password protected Ledger seed phrase.
Smart contracts are commonly used to build finance-related decentralized applications. If a smart contract vulnerability is exploited by an attacker, the contract owner may suffer financial losses. We focus on a particular class of smart contract vulnerabilities that require a specific sequence of multiple transactions to trigger, which we call multi-transaction sequence vulnerabilities. Due to the combinatorial explosion problem caused by the huge number of possible transaction sequences, the efficiency and scalability for existing security analyzers to detect multi-transaction sequence vulnerabilities are limited. To alleviate the problem, we propose a vulnerability detection approach based on symbolic execution and inter-path data dependency. In the approach, we first traverse paths in a contract, and record read and write operations of each path. Then, we selectively execute paths which are conducive to discovering vulnerabilities during the subsequent detection process according to inter-path data dependencies. By pruning out most paths that are not relevant to vulnerabilities, we improve the efficiency and scalability of detecting multi-transaction sequence vulnerabilities. We evaluate our approach on 442 contracts collected from CVE reports and 104 contracts with Ether leakage and suicide defects. The experimental results show that our approach reaches an average 2x speedup comparing to Mythril.
Exchanges serve an essential role in the cryptocurrency ecosystem. It is through exchanges that most people acquire Bitcoin and other cryptocurrencies, often avoiding the blockchain entirely. Because so many customers put their trust and financial resources in exchanges, it is no surprise that they have long been targets of cybercriminal actors. This paper examines 822 cryptocurrency exchanges operational from 2010–2022. We find that 40% of these exchanges subsequently shut down. Using regression and survival analysis, we investigate the factors that could precipitate the closure of exchanges. Consistent with prior work, we find some evidence that experiencing security breaches are associated with closure. However, we find that the strongest effects are connected to how the exchange operates. Exchanges that only trade cryptocurrencies and not fiat face approximately 60% greater odds of shutting down than those that trade both. Trading more coins is negatively associated with failure. Meanwhile, exchanges that permit US customers shut down more quickly, which suggests that the regulatory environment may affect exchange lifetimes.
Ian W. Gray, Jack Cable, Benjamin P. Brown, Vlad Cuiujuclu · 5 authors
Ransomware operations have evolved from relatively unsophisticated threat actors into highly coordinated cybercrime syndicates that regularly extort millions of dollars in a single attack. Despite dominating headlines and crippling businesses across the globe, there is relatively little in-depth research into the modern structure and economics of ransomware operations.In this paper, we leverage leaked chat messages to provide an in-depth empirical analysis of Conti, one of the largest ransomware groups. By analyzing these chat messages, we construct a picture of Conti’s operations as a highly-profitable business, from profit structures to employee recruitment and roles. We present novel methodologies to trace ransom payments, identifying over $80 million in likely ransom payments to Conti and its predecessor – over five times as much as in previous public datasets. As part of our work, we will publish a dataset of 666 labeled Bitcoin addresses related to Conti and an additional 75 Bitcoin addresses of likely ransom payments. Future work can leverage this case study to more effectively trace – and ultimately counteract – ransomware activity.
Bitcoin is one of the decentralized cryptocurrencies powered by a peer-to-peer blockchain network. Parties who trade in the bitcoin network are not required to disclose any personal information. Such property of anonymity, however, precipitates potential malicious transactions to a certain extent. Indeed, various illegal activities such as money laundering, dark network trading, and gambling in the bitcoin network are nothing new now. While a proliferation of work has been developed to identify malicious bitcoin transactions, the behavior analysis and classification of bitcoin addresses are largely overlooked by existing tools. In this paper, we propose BAClassifier, a tool that can automatically classify bitcoin addresses based on their behaviors. Technically, we come up with the following three key designs. First, we consider casting the transactions of the bitcoin address into an address graph structure, of which we introduce a graph node compression technique and a graph structure augmentation method to characterize a unified graph representation. Furthermore, we leverage a graph feature network to learn the graph representations of each address and generate the graph embeddings. Finally, we aggregate all graph embeddings of an address into the address-level representation, and engage in a classification model to give the address behavior classification. As a side contribution, we construct and release a large-scale annotated dataset that consists of over 2 million real-world bitcoin addresses and concerns 4 types of address behaviors. Experimental results demonstrate that our proposed framework outperforms state-of-the-art bitcoin address classifiers and existing classification models, where the precision and F1-score are 96% and 95%, respectively. Our implementation and dataset are released, hoping to inspire others.
Advances in technology, easy access to the internet, inconsistent rules and regulations, inadequate police training on cybercrime, and the complexity of international or multiorganizational collaboration in police operations have created new forms of cybercrime. Illegal cryptomarkets/darknet marketplaces transactions on the hidden web use cryptocurrency as a payment method, which makes it difficult to trace the identity of sellers and buyers. The internet and Dark Web browsers have also provided tools for criminals to conduct cyberattacks on businesses, infrastructure, education, health care, government, and even individual citizens with little impunity. The cross-border nature of cybercrimes, lack of uniformity in regulations, difficulties in collecting digital evidence, and identifying the physical location of the perpetrators have proven to be challenging tasks for police. Lack of public awareness of police jurisdiction of cybercrimes and limited police training on cyber technology and digital evidence gathering are some critical gaps identified in this chapter.
This study examines the behaviour of cryptocurrencies’ returns to stock market volatility and cybercrime in the South African economy. The study makes us Generalized Autoregressive Score Model (GAS) investigate the time-varying correlation between cryptocurrencies’ returns and cybercrime, and cryptocurrencies’ returns and stock market volatility by making use of daily time series data on different four types of Cryptocurrencies, Bitcoin, Ethereum, Tether and BNB from January 2019 to December 2021. The study also makes use of the regime-switching approach to regime-switching impacts on the cryptocurrencies’ returns. The empirical results obtained showed that cybercrime, on average, has negative impacts on the cryptocurrencies’ returns and the time-varying correlation between stock market volatility and each of the cryptocurrencies’ returns is largely positive. The stock market volatility impact is found to be regime-switching dependent. The study recommends that efforts to reduce cybercrime activities must be reinforced to deepen the use of digital currencies and policy measures must be taken to ensure reduced or moderate stock market volatility.
Jiho Choi, Junghoon Park, Woocheol Kim, Jin‐Hyeok Park · 6 authors
The recent advent of play-to-earn (P2E) systems in massively multiplayer online role-playing games (MMORPGs) has made in-game goods interchangeable with real-world values more than ever before. The goods in the P2E MMORPGs can be directly exchanged with cryptocurrencies such as Bitcoin, Ethereum, or Klaytn via blockchain networks. Unlike traditional in-game goods, once they had been written to the blockchains, P2E goods cannot be restored by the game operation teams even with chargeback fraud such as payment fraud, cancellation, or refund. To tackle the problem, we propose a novel chargeback fraud prediction method, PU GNN, which leverages graph attention networks with PU loss to capture both the players' in-game behavior with P2E token transaction patterns. With the adoption of modified GraphSMOTE, the proposed model handles the imbalanced distribution of labels in chargeback fraud datasets. The conducted experiments on three real-world P2E MMORPG datasets demonstrate that PU GNN achieves superior performances over previously suggested methods.
As a matter of fact, Ransomware Attack is considered an essential threat to cyber security. This type of intimidation often causes an immense loss. For instance, the electronic records of medical healthcare have been one of the main targets of Ransomware attacks. This could be attributed to the fact that sensitive data belongs to patients. In this paper, we use Blockchain technology to be an appropriate solution for Ransomware attacks. It is believed that the procedures taken by this technology, specifically in the health sector, will create a defense wall that would protect patients' data. We mainly intend in this paper to enhance Medical Healthcare Records (MHR)-based healthcare through the utilization of the Ethereum Network to treat and investigate unusual transactions. In order to achieve this objective, an astute arrangement has been developed so that MHR will be sent via the Ethereum Blockchain network. Thus, MHRs are protected from any Ransomware attacks, especially from those attackers who pretend to be patients and attempt to penetrate the web through their claimed records. Finally, the recommended system could be evaluated through the metrics utilized for evaluating performance, including the cost that reduced the cost to 855304 Wei and the execution time for raising patient records on Ethereum Network compared to the standard system by 60%, immutability, data storage, and estimated time required by attackers to attack the block.
Gibran Gómez, Pedro Moreno-Sánchez, Juan Caballero
Cybercriminals often leverage Bitcoin for their illicit activities. In this work, we propose back-and-forth exploration, a novel automated Bitcoin transaction tracing technique to identify cybercrime financial relationships. Given seed addresses belonging to a cybercrime campaign, it outputs a transaction graph, and identifies paths corresponding to relationships between the campaign under study and external services and other cybercrime campaigns. Back-and-forth exploration provides two key contributions. First, it explores both forward and backwards, instead of only forward as done by prior work, enabling the discovery of relationships that cannot be found by only exploring forward (e.g., deposits from clients of a mixer). Second, it prevents graph explosion by combining a tagging database with a machine learning classifier for identifying addresses belonging to exchanges.
Wafaa N. Al-Sharu, Majdi K. Qabalin, Muawya Naser, Omar A. Saraerh
One of the most extensively used technologies for improving the security of IoT devices is blockchain technology. It is a new technology that can be utilized to boost the security. It is a decentralized peer-to-peer network with no central authority. Multiple nodes on the network mine or verify the data recorded on the Blockchain. It is a distributed ledger that may be used to keep track of transactions between several parties. No one can tamper with the data on the blockchain since it is unchangeable. Because the blocks are connected by hashes, the transaction data is safe. It is managed by a system that is based on the consensus of network users rather than a central authority. The immutability and tamper-proof nature of blockchain security is based on asymmetric cryptography and hashing. Furthermore, Blockchain has an immutable and tamper-proof smart contract, which is a logic that enforces the Blockchain’s laws. There is a conflict between the privacy protection needs of cyber-security threat intelligent (CTI) sharing and the necessity to establish a comprehensive attack chain during blockchain transactions. This paper presents a blockchain-based data sharing paradigm that protects the privacy of CTI sharing parties while also preventing unlawful sharing and ensuring the benefit of legitimate sharing parties. It builds a full attack chain using encrypted threat intelligence and exploits the blockchain’s backtracking capacity to finish the decryption of the threat source in the attack chain. Smart contracts are also used to send automatic early warning replies to possible attack targets. Simulation tests are used to verify the feasibility and efficacy of the suggested model.
Open access
Blockchain Technology Applications and Security
Cybercrime and Law Enforcement Studies
Advanced Steganography and Watermarking Techniques
Blockchain technology has been invented as a fundamental technique to the cryptocurrency Bitcoin in 2008, which is decentralized, consensus and cryptographic leger. However, due to the anonymity of the Blockchain, Bitcoin has been becoming one critical finance platform applied to transfer or hidden criminal income by offenders. Bitcoin crime refers to criminal activities which use Bitcoin as a criminal tools, criminal object or criminal settlement. Typical bitcoin crimes include online gambling, money laundering, fraud and more. To address these issues, our work aims to propose an efficient method to find transactions related with Bitcoin crime in the Bitcoin network. Which will efficiently support regulators to combat Bitcoin crimes. Through collecting and concluding kinds of Bitcoin crimes, we find several typical relation patterns among Bitcoin transactions with respect to crimes, and then construct and analysis a bitcoin criminal transaction network. At last, we study a graph neural network model with attention mechanisms to detect illegal transactions. Experimental results show that our method can achieve better classification accuracy, and has the ability to efficiently detect criminal clues and locate related illegal transactions.
With the development of Web 3.0 which emphasizes decentralization, blockchain technology ushers in its revolution and also brings numerous challenges, particularly in the field of cryptocurrency. Recently, a large number of criminal behaviors continuously emerge on blockchain, such as Ponzi schemes and phishing scams, which severely endanger decentralized finance. Existing graph-based abnormal behavior detection methods on blockchain usually focus on constructing homogeneous transaction graphs without distinguishing the heterogeneity of nodes and edges, resulting in partial loss of transaction pattern information. Although existing heterogeneous modeling methods can depict richer information through metapaths, the extracted metapaths generally neglect temporal dependencies between entities and do not reflect real behavior. In this paper, we introduce Time-aware Metapath Feature Augmentation (TMFAug) as a plug-and-play module to capture the real metapath-based transaction patterns during Ponzi scheme detection on Ethereum. The proposed module can be adaptively combined with existing graph-based Ponzi detection methods. Extensive experimental results show that our TMFAug can help existing Ponzi detection methods achieve significant performance improvements on the Ethereum dataset, indicating the effectiveness of heterogeneous temporal information for Ponzi scheme detection.
<title>Abstract</title> In recent years, cryptocurrencies have been used as a new way to conduct transactions and transfer money among individuals, so the volume of daily transactions in their networks has reached to several billion dollars. The anonymity of users alongside the high security and privacy properties has led many criminals to the cryptocurrency networks to carry out their illegal transactions. However, public access to the blockchain of Bitcoin and many other cryptocurrencies, allows individuals and financial institutions to obtain information about some of these activities. Several approaches, such as investigating financial flow in the blockchain, statistical analysis, and machine learning methods, have been introduced to detect illegal transactions. This paper uses a deep learning model based on a graph convolutional network and multi-layer perceptron to classify Bitcoin transactions based on their applications. We extract several features from the transaction graph, then by doing some preprocessing on our data, we train a model, which is able to predict illicit transactions with an f1-score of 97.09% which outperforms previous approaches to this problem.
Bitcoin is the most common cryptocurrency involved in cyber scams. Cybercriminals often utilize pseudonymity and privacy protection mechanism associated with Bitcoin transactions to make their scams virtually untraceable. The Ponzi scheme has attracted particularly significant attention among the Bitcoin fraudulent activities. This paper considers a multi-class classification problem to determine whether a transaction is involved in Ponzi schemes or other cyber scams, or is a non-scam transaction. We design a specifically designed crawler to collect data and propose a novel Attention-based Long Short-Term Memory (A-LSTM) method for the classification problem. The experimental results show that the proposed model has better efficiency and accuracy than existing approaches, including Random Forest, Extra Trees, Gradient Boosting, and classical LSTM. With correctly identified scam features, our proposed A-LSTM achieves an F1-score over 82% for the original data and outperforms the existing approaches.
Yaser Issam Aljanabi, Aso Ahmed Majeed, Kamal H. Jihad, Banaz Anwer Qader
The key target of Distributed Denial-of-Service (DDoS) attacks is to interrupt and suspend any available online services either executed for professional or personal gains. These attacks originate from the fast advancement in the number of insecure technologies. The attacks are caused due to the easy access to internet and advent of technology resulting to exponential growth of traffic volumes. DDoS attack remains most leading security risks to provisioning services. Also, the current embraced security mechanism for defense lacks flexibility and adequate resources to combat these attacks. Hence, there is need to embrace various other critical resources, where they can share the problem of mitigation. In addition, emerging technologies for instance smart contracts and blockchain offers for the sharing of these potential attacks information in an entirely automated and distributed manner. This paper recommends for a blockchain design which combines smart contracts and Machine Learning (ML) technologies, by presenting new ideal opportunities towards efficient DDoS mitigation solutions in variety of cooperative domains. Furthermore, the key advantage and benefits of this structure is deployment of still existing distributed and public infrastructure to blacklisted IP address or even advertise white, and the application of such an infrastructure with further defense mechanisms to current attacks of DDoS, deprived of considering distribution mechanisms or specialized registries, which facilitates the implementation of procedures across diverse domains. This paper further presents the demonstration and implementation features of this blockchain structure, discussion and study findings over these smart contracts and ML technologies. The study further concludes by recommending use of smart contract in collaborative block-chain design with ML for mitigating future attack of DDoS.
V. P. Sriram, Shouvik Sanyal, Madan Mohan Laddunuri, Mathiraj Subramanian · 10 authors
Blockchain technology ensures data security through an integrated system whereby it collects, arranges, stores, and disseminates information in different blocks. This technology thus enables adding the data to the network. Once data has been added to the network, no one can alter the data set either by adding or deleting it. Further, this technology also helps to track and check the changes if anything is made to a blockchain, as the changes remain in the database forever. Since this technology uses lots of systems in a blockchain, it will regularly download its data, arranging, and keeping the copy locally. Locating the data errors and cyberattacks in advance by analyzing the data documented, it employs the consent of various participants and accomplishments in cryptography. With this backdrop, the chapter has attempted to disclose the basics of blockchain technology in data security, why blockchain in cybersecurity, how it ensures cybersecurity, its benefits, its innovative uses, and the future of cybersecurity in the online business platforms.