Kervins Nicolas, Yi Wang, George C. Giakos, Bingyang Wei · 5 authors
Blockchain is a technology that ensures data security by verifying database of records established in a decentralized and distributed network. Blockchain-based approaches have been applied to secure data in the fields of the Internet of Things, software engineering, healthcare systems, financial services, and smart power grids. However, the security of the blockchain system is still a major concern. We took the initiative to present a systematic study which sheds light on what defensive strategies are used to secure the blockchain system effectively. Specifically, we focus on blockchain data security that aims to mitigate the two data consistency attacks: double-spend attack and selfish mining attack. We employed the systematic approach to analyze a total of 40 selected studies using the proposed taxonomy of defensive strategies: monitoring, alert forwarding, alert broadcasting, inform, detection, and conceptual research design. It presents a comparison framework for existing and future research on blockchain security. Finally, some recommendations are proposed for blockchain researchers and developers.
Massimo Bartoletti, James Hsin-yu Chiang, Alberto Lluch Lafuente
Lending pools are decentralized applications which allow mutually untrusted users to lend and borrow crypto-assets. These applications feature complex, highly parametric incentive mechanisms to equilibrate the loan market. This complexity makes the behaviour of lending pools difficult to understand and to predict: indeed, ineffective incentives and attacks could potentially lead to emergent unwanted behaviours. Reasoning about lending pools is made even harder by the lack of executable models of their behaviour: to precisely understand how users interact with lending pools, eventually one has to inspect their implementations, where the incentive mechanisms are intertwined with low-level implementation details. Further, the variety of existing implementations makes it difficult to distill the common aspects of lending pools. We systematize the existing knowledge about lending pools, leveraging a new formal model of interactions with users, which reflects the archetypal features of mainstream implementations. This enables us to prove some general properties of lending pools, such as the correct handling of funds, and to precisely describe vulnerabilities and attacks. We also discuss the role of lending pools in the broader context of decentralized finance.
Given the short shelf life of blood products and a decrease in donor population, hospitals endeavor to achieve an equilibrium between shortage and outdating. Though collaborating and sharing blood among hospitals will result in a reasonable reduction in surplus and deficit, health regulations strongly discourage blood exchange among hospitals due to traceability issues. With the recent advancement in peer-to-peer networking, blockchains have been used for record transactions in businesses with the advantage of being timestamped. This research is one of the first to address the blood inventory management problem using the blockchain technique by forming a collaborative network of hospitals and exchanging blood in that system, enabling transparency and traceability. A novel clustering technique, called multi-criteria clustering (MCC), using a mixed-integer programming approach, is proposed to form the blockchain network that bases its clustering decisions on a number of conflicting criteria, such as collaboration preference, geographical distribution, hospital size, and operational heterogeneity. Subsequent to this, a mathematical model is developed to identify purchasing strategies for each hospital in a blockchain network, given the opportunity to share blood among other hospitals in that network. This two-phase approach is tested using hospital settings in a neighborhood of a metropolitan city. Sensitivity analysis is performed to evaluate the effectiveness of the blockchain system with respect to change in cost, shelf life, demand distribution, and coefficient of demand variation. Based on the results, it can be concluded that, for all settings, the proposed blockchain network significantly outperforms the current system with independently acting hospitals, in spite of the additional blockchain development and operating expenses that are incurred.
Khaled Ahmed, Sabry F. Saraya, John F. Wanis, Hesham Ali
The need to use a wide variety of online services is rising every day in today's digital age. In order to authenticate and authorize users to access services, identity management is essential. To solve several problems such as fragment identity repositories, aim for identity theft and data breaches and identity correlation, the evolution of identity models across siloes, centralized and presently self-sovereign identity based on distributed ledger is emerging. Self-sovereign identity returns the power to the proprietor of the identity and puts the user at the core of the model. In this paper, we propose a framework to identify scam bank service calls and avoid possible loss of personal accounts. Our framework is based on Hyperledger Indy, a public and permissioned Distributed Ledger Technology. The proposed framework strengthens the Know Your Customer process and enhances the trust of third party agencies delegated by banks to deliver many financial items.
Andrea Lisi, Andrea De Salve, Paolo Mori, Laura Ricci
Recommender Systems are very popular tools within the online community, suggesting to their users a big variety of items like products, videos, music and locations to visit. Moreover, users actively populate these systems sending and reading opinions under the form of reviews, and potentially obtaining a reward for their activities. However, such systems typically rely on a central authority that acts as a trusted party having total control over the system. Decentralized Recommender Systems have been proposed to solve such issue distributing the control and responsibility on the hands of their users, but leading to risks in case of disputes or misbehaviour. Based on a general architecture of a Decentralized Recommender System, in this paper we identify the potential unfair exchanges that may rise during the activity between two users, and we propose a solution based on the concept of atomic swaps inherited from the blockchain technology. Finally, we provide an attack model to show that the proposed solution creates fair processes.
Today, Online Social Networks (OSNs) represent an important communication channel in the daily life of many people in the world. OSNs are platforms where people are encouraged to interact, consume, generate, and share content with other users by establishing connections. However, they have several important issues, such as privacy and fake news, which have been the input to exploit new decentralized solution. Blockchain-based Online Social Media are decentralized Social Media where the Blockchain technology is used to reward users for their social activity. Several BOSMs have been proposed, however, their real benefits are still unknown, as is the behaviour of malicious users, such as bots and trolls. This paper proposes an analysis of the social behaviour of users and bots in Blockchain-based Online Social Media in order to highlight features that can be used in bots detection techniques. We consider Steemit as a case study because it is the most representative platform of its kind. Results show that bots are on average much more active than human users, thus suggesting that bots can be outlined using publicly available features.
José Eduardo de Azevedo Sousa, Vinícius Cunha Oliveira, Júlia Almeida Valadares, Alex Borges Vieira · 7 authors
O crescimento do interesse em Ethereum leva a preocupações relacionadas à sua segurança, dado que já houveram ataques que exploraram o seu mecanismo de tarifação ou Penny Attack. Esses ataques afetaram a rede ocasionando lentidão nas transações e há indícios que Ethereum continua susceptível a esse tipo de ataque. Analisamos o comportamento da rede Ethereum durante um Penny Attack, buscando técnicas de aprendizado de máquina para detectá-lo previamente, utilizando atributos das transações. Nossas técnicas tiveram AUC, Fb e recall superior a 94%, 82% e 98% respectivamente.
Yangguang Tian, Nan Li, Yingjiu Li, Paweł Szałachowski · 5 authors
Policy-based chameleon hash is a useful primitive for blockchain rewriting. It allows a party to create a transaction associated with an access policy, while another party who possesses enough rewriting privileges satisfying the access policy can rewrite the transaction. However, it lacks accountability. The chameleon trapdoor holder may abuse his/her rewriting privilege and maliciously rewrite the hashed object in the transaction without being identified. In this paper, we introduce policy-based chameleon hash with black-box accountability (PCHBA). Black-box accountability allows an attribute authority to link modified transactions to responsible transaction modifiers in case of dispute, in which any public user identifies those transaction modifiers from interacting with an access device/blackbox. We first present a generic framework of PCHBA. Then, we present a practical instantiation, showing its practicality through implementation and evaluation analysis.
Ensuring the integrity of executable binaries is of vital importance to systems that run and depend on them. Additionally, supply-chain attacks and security related bugs demonstrate that binaries, once deployed, may need to be revoked and replaced with updated versions.
In the news industry, as well as in social media, fake news detection and identification of news sources has become a central topic of discussion. In the era of digitization, anyone can easily generate or manipulate digital content and publish them on social media websites. On the one hand, these social networking platforms provide ample ease in modern-day communication but on the other hand, using such platforms has posed new challenges to real-world implementation like viral spreading of false/fake information with malicious intentions. In this paper, a naive blockchain and watermarking based social media framework is proposed to control the fake news propagation. We postulate a new blockchain model to mitigate existing challenges in this field. Moreover, the novel solution can help in reducing the spread of fake news by tracing the root or origin of the fake news on social media. Through our experimental results, we show that our blockchain-based solution is able to immediately stream data through a bloXroute server that can propagate data up to 100 times faster than conventional solutions.
Malka N. Halgamuge, Samurdika C. Hettikankanamge, Azeem Mohammad
A sharding mechanism could potentially be the solution to enhance the scalability of blockchain networks and makes the distributed ledger technology more feasible. Despite the scalability improvement, it increases the influence of malicious attacks on blockchain networks. We develop a comprehensive trust model by enhancing the trust score of nodes to minimize the adversary influences of malicious attacks in sharding based blockchain networks. Firstly, a penalty factor is incorporated into this trust model to decrease the probability of malicious nodes becoming leaders in the shards. Then, we examine the leader selection probability for varying penalty factors. We also observe the influence of the global reputation on the trust score for a varying number of nodes. Secondly, we increase the trustworthiness of nodes by including penalty factors and reputation scores to nodes that could then identify the malicious influence. The fair node distribution among shards is achieved by distributing the nodes with the same aggregated trustworthiness scores. Finally, we develop a probability distribution model to identify the probabilities of clustering corrupted nodes into single shards and the existence of such corrupted shards in the entire network. Uncorrupted or honest shard probability is shown to be higher in the RapidChain than the Elastico and OmniLedger sharding protocols. This could be as a result of the shard resiliency of the RapidChain (υ/2) protocol being more significant than that of the Elastico (υ/3) and in OmniLedger (υ/3) protocols. Low message complexity of single intra-shard consensus of the RapidChain protocol O(υ) may contribute to perform security algorithms more efficiently than that of the Elastico O(υ2) and OmniLedger O(υ) sharding protocols. The probabilities of clustering corrupted nodes into single shards can be estimated, and the existence of such corrupted shards in entire networks can be identified using the proposed model.
The application of blockchain has moved beyond cryptocurrencies, to applications such as credentialing and smart contracts. The smart contract allows ones to achieve fair exchange for values without relying on a centralized entity. However, as the smart contract can be automatically executed with token transfers, an attacker can seek to exploit vulnerabilities in smart contracts for illicit profits. Thus, this paper proposes a support vector machine (SVM)-based scanning system for vulnerabilities on smart contracts. Our evaluation on Ethereum demonstrate that we achieve a identification rate of over 90% based on several popular attacks.
Today’s rapidly changing world, is observing fast development of QR-code and Blockchain technologies. It is worth noting that these technologies have also received a boost for sharing. The user gets the opportunity to receive / send funds, issue invoices for payment and transfer, for example, Bitcoin using QR-code. This paper discusses the security of using the symbiosis of Blockchain and QR-code technologies, and the vulnerabilities that arise in this case. The following vulnerabilities were considered: fake QR generators, stickers for cryptomats, phishing using QR-codes, create Malicious QR-Codes for Hack Phones and Other Scanners. The possibility of creating the following malicious QR codes while using the QRGen tool was considered: SQL Injections, XSS (Cross-Site Scripting), Command Injection, Format String, XXE (XML External Entity), String Fuzzing, SSI (Server-Side Includes) Injection, LFI (Local File Inclusion) / Directory Traversal.
Natalia Trojanowska, Michał Kędziora, Moataz Hanif, Houbing Song
The purpose of this paper is to present Ethereum decentralized application development methodology with focus on security issues and its verification. We introduce key concepts that are related to developing decentralized applications and Crypto Collectibles games. Moreover, the requirements for blockchain projects were presented along with a selection of use case examples. The paper concerns the application design process issues, starting from the methodology used, going through the description of requirements and specification, ending up with the implementation. Finally, an overview of the issues associated with the security of Ethereum decentralized applications is presented. We compared guidelines from Ethereum Smart Contract Best Practices by ConsenSys, Smart Contract Security Verification Standard created by SecuRing, Decentralized Application Security Project introduced by NCC Group, Security Considerations from Solidity documentation, Ethereum Smart Contracts Security Recommendations from Guylando Knowledge Lists, and Smart Contract Weakness Classification and Test Cases. It was discussed which guideline should be followed and when should the verification take place, considering the life cycle of the application. The paper covers different security risks related to blockchain games along with examples of how vulnerabilities can arise, how they can be detected during security verification phase, and countermeasures to address them.
The production of counterfeit money has a long history. It refers to the creation of imitation currency that is produced without the legal sanction of government. With the growth of the cryptocurrency ecosystem, there is expanding evidence that counterfeit cryptocurrency has also appeared. In this paper, we empirically explore the presence of counterfeit cryptocurrencies on Ethereum and measure their impact. By analyzing over 190K ERC-20 tokens (or cryptocurrencies) on Ethereum, we have identified $2,117$ counterfeit tokens that target 94 of the 100 most popular cryptocurrencies. We perform an end-to-end characterization of the counterfeit token ecosystem, including their popularity, creators and holders, fraudulent behaviors and advertising channels. Through this, we have identified two types of scams related to counterfeit tokens and devised techniques to identify such scams. We observe that over 7,104 victims were deceived in these scams, and the overall financial loss sums to a minimum of \$ 17 million (74,271.7 ETH). Our findings demonstrate the urgency to identify counterfeit cryptocurrencies and mitigate this threat.
Continuous efforts are being made daily by organizations to develop special tools that can support the collection and organization of available information in order to prevent the spread of fake news. Nowadays, misinformation has been deemed as a great challenge especially with the raise of social media networks that are used as platforms for disseminating information in a digital form. This paper presents the implementation of a decentralized application deployed on the Ethereum blockchain, to be used as a tool for combating fake news and misinformation. The develop framework is proposed as a solution for publishing reliable news sources and enabling readers to self-verify the trustworthiness of the published source. An experimental scenario has been implemented that presents the effectiveness of the proposed framework.
Ability to perform fast analysis on massive public blockchain transaction data is needed in various finance applications such as tracing of fraudulent activities. The blockchain data that is synced as a node is accessible as a sequence of blocks containing transactions. This way of accessing transaction data, however, is too slow for applications that require a transaction graph to be constructed. We develop a cluster based system that constructs a distributed transaction graph in parallel. Since blockchain data is continuously growing, our parallel system also offers the advantage of being able to scale by simply increasing the number of nodes in the cluster. Our system has been developed using the MPI message passing interface. We report performance results from our system operating on the whole 9.5 million block (roughly 4 year) Ethereum mainnet blockchain data. We report timings obtained from tests involving distributed transaction graph construction, partitioning, page ranking of addresses, degree distribution and token transaction counting on a 16 node economical cluster set up on the Amazon cloud. In particular, our system is able to construct distributed graph of 658 million ether and 31 major token transactions in 188 seconds.
Gowri Ramachandran, Dániel Németh, David M. Neville, Dimitrii Zhelezov · 7 authors
The vast majority of the population is consuming news from various digital sources, including social networking applications such as Twitter and Facebook and other online digital platforms. Such Internet platforms provide malicious entities an opportunity to spread fake news and hoaxes to mislead the population. Besides, Internet users may start to form an opinion and make certain personal or business decisions based on misinformation, leading to undesirable consequences. This paper introduces WhistleBlower, a decentralized and open platform based on the blockchain and distributed ledger technology (DLT) for spotting fake news. The key components of WhistleBlower include a fake news processing engine powered by Artificial Intelligence (AI)/Machine Learning (ML) algorithms, a verifiable computation engine, and a token-curated registry (TCR). WhistleBlower allows the community members to participate in the fake news identification process by running the fake news detection algorithm on their nodes, which would then be validated by a verifiable computation engine to ensure that the public nodes executed the computation honestly and correctly. Whenever a news feed is submitted to WhistleBlower for fake news assessment, it issues a genuineness score, which can then be posted along with the news article to let the newsreaders gauge its legitimacy. However, the genuineness score's accuracy depends on the machine learning model's effectiveness that processes the news item. To improve the machine learning algorithm's reliability, we introduce a Token-curated registry, which enables the public and community members to challenge the algorithm used to estimate the genuineness score. TCR lets the community curate fake news detection algorithms by providing feedback to the ML/AI algorithm developers through the token-curated content moderation process. WhistleBlower is the first open and democratic fake news assessment platform that combines ML/AI, verifiable computation, and TCR to the best of our knowledge.
Smart contracts are programs running on top of the blockchain platform. With smart contract, users can use code to define arbitrary rules to manage their assets. However, the security vulnerabilities within those smart contracts have caused significant financial losses to their users. Existing smart contract verification tools based on symbolic execution are still not comprehensive in terms of the types of vulnerabilities detected. In this work, we present Artemis, an improved smart contract verification tool that can detect vulnerabilities that includes greedy, block information dependency, gasless send, and dangerous delegatecall. We have thoroughly evaluated our tool on 12899 smart contracts in terms of vulnerability detection effectiveness and efficiency. The experiment results show that the Artemis tool is precise and cost-effective for practical use.
Smart contracts on the Ethereum blockchain are notoriously known as vulnerable to external attacks. Many of their issues led to a considerably large financial loss as they resulted from broken payments by digital assets, e.g., cryptocurrency. Existing research focused on specific patterns to find such problems, e.g., reentrancy bug, nondeterministic recipient etc., yet may lead to false alarms or miss important issues. To mitigate these limitations, we designed the SafePay analysis framework to find unfair payments in Ethereum smart contracts. Compared to existing analyzers, SafePay can detect potential blockchain transactions with feasible exploits thus effectively avoid false reports. Specifically, the detection is driven by a systematic search for violations on fair value exchange (FVE), i.e., a new security invariant introduced in SafePay to indicate that each party “fairly” pays to others. The preliminary evaluation validated the efficacy of SafePay by reporting previously unknown issues and decreasing the number of false alarms.
In many organizations, permissioned blockchain networks are currently transitioning from a proof-of-concept stage to production use. A crucial part of this transition is ensuring awareness of potential threats to network operations. Due to the plethora of software components involved in distributed ledgers, threats may be difficult or impossible to detect without a structured monitoring approach. To this end, we conduct a survey of attacks on permissioned blockchains and develop a set of threat indicators. To gather these indicators, a data processing pipeline is proposed to aggregate log information from relevant blockchain components, enriched with data from external sources. To evaluate the feasibility of monitoring current blockchain frameworks, we determine relevant data sources in Hyperledger Fabric. Our results show that the required data is mostly available, but also highlight significant improvement potential with regard to threat intelligence, chaincode scanners and built-in metrics.