Since the emergence of Ethereum, blockchain-based decentralized applications (DApps) have become increasingly popular and important. To balance the security, performance, and costs, a DApp typically consists of two layers: an on-chain layer to execute transactions and store crucial data on the blockchain and an off-chain layer to interact with users. A DApp needs to synchronize its off-chain layer with the on-chain layer proactively. Otherwise, the inconsistent data in the off-chain layer could mislead users and cause undesirable consequences, e.g., loss of transaction fees. However, transactions sent to the blockchain are not guaranteed to be executed and could even be reversed after execution due to chain reorganization. Such non-determinism in the transaction execution is unique to blockchain. DApp developers may fail to perform the on-chain-off-chain synchronization accurately due to their lack of familiarity with the complex transaction lifecycle. In this work, we investigate the challenges of synchronizing on-chain and off-chain data in Ethereum-based DApps. We present two types of bugs that could result in inconsistencies between the on-chain and off-chain layers. To help detect such on-chain-off-chain synchronization bugs, we introduce a state transition model to guide the testing of DApps and propose two effective oracles to facilitate the automatic identification of bugs. We build the first testing framework, DArcher, to detect on-chain-off-chain synchronization bugs in DApps. We have evaluated DArcher on 11 popular real-world DApps. DArcher achieves high precision (99.3%), recall (87.6%), and accuracy (89.4%) in bug detection and significantly outperforms the baseline methods. It has found 15 real bugs in the 11 DApps. So far, six of the 15 bugs have been confirmed by the developers, and three have been fixed. These promising results demonstrate the usefulness of DArcher.
Gomanth Bere, Bohyun Ahn, Justin J. Ochoa, Taesic Kim · 6 authors
The importance of cybersecurity for inverters has been significantly increasing as inverters become smarter by using advanced network and computing power from cyber systems. This paper explores potential attacks targeting firmware of smart inverters and how blockchain technology can be applied to mitigate the firmware modification attacks. A breakthrough method includes an automated firmware integrity check, an anomaly detection algorithm, and recovery creating patch using local distributed ledgers. The proposed method is implemented in Internet-of-Thing (IoT) security modules as clients of a blockchain network and validated by experiments. The proposed method is transformative to other networked power electronic devices.
To ensure the proper functioning and performance of Industrial grade Internet of Things devices (IIoT) in Industry 4.0 networks, it is critical to identify the capabilities and malfunctions of their component devices (e.g., sensors, actuators, and controllers) and detect potential misbehavior arising due to cyber-attacks, and misconfiguration. We envision future IoT devices embed behavioral profiles throughSecurity-by-Contract(S×C) that are easy to validate and verify against network security policies; manufacturers to provide manufacturer usage description (MUD) profiles as amanifestfor the devices to signal to the network what sort of access and network functionality they require to properly function. We design authentication in the IoT onboarding process, employ blockchains to a verifiable and immutable repository to store this network manifests, that is signed and verifiable with S×C basedsmart contractsby the device manufacturer, or industry authority. The integrated framework combines blockchains and S×C security contracts, MUD-based behavioral fingerprinting, and software-defined-networking for managing the security of IIoT ecosystems. Finally, the proposed scheme is validated in a simulated IoT environment on various performance parameters.
Blockchain Technology Applications and Security
Physical Unclonable Functions (PUFs) and Hardware Security
DDoS attacks have plagued the Internet for more than 20 years, and it is becoming even violent with the development of IoT. Therefore, it is an essential defense method to trace back DDoS sources. Traditional IP traceback methods have different limitations in a large storage space, increasing marking cost, and low credibility. To solve these problems, a lightweight DDoS attack blockchain-based tracing scheme (LDBT) is proposed, which can deny malicious traffic access to the LAN. First, to avoid secondary DDoS attacks caused by excessive recording information, a digest method is presented and installed on all routers in the LAN. It is used to transfer a huge number of packets to a fixed format, which can keep the scheme lightweight regardless of whether DDoS occurs or not. Second, we present a trusted fuzzy tracing method that searches for DDoS sources efficiently. Under the proposed scheme, the digest data are reliable owing to the decentralization and immutability of the blockchain platform. It also overcomes the problem that edge routers cannot provide precise detection information because the digest is only used to track. Experimental results show that the scheme searches the sources of malicious traffic with high accuracy, and the communication overhead constantly remains at a low level of 80 KB/s. Furthermore, the tracing time of our scheme increases linearly instead of an exponential growth by the hop count.
Laura Rodríguez de Lope, Johnny Choque, Andres Sanchez Sandaza, Jorge Fernandez Valdes · 8 authors
During the last decade Internet of Things has become one of the key technologies in supporting digital transformation of several ecosystems such urban or industry ones. The huge amount of data generated in such contexts as well as the imperative requirements in terms of trustworthiness, authenticity and integrity make compulsory the adoption of the proper solutions fitting those requirements. This paper presents the design, implementation and validation of a distributed ledger technology architecture emphasizing services linked to data valorization.
Cloud computing technologies have dominated more that a decade. Wider adoption of cloud based processing has given rise to different architectural patterns. Cloud native applications have emerged out ensuring application agility and scalability. But they have their own challenges in terms of security. In the last few years, blockchain technology has found its applicability in non-cryptocurrency areas as well. This paper illustrates how blockchain can be used to address security challenges for the cloud native applications. This work focuses challenges and possible blockchain based solution in the areas of network security, identity management, authentication, container security and audit log for forensics.
Tsuyoshi Taniguchi, Harm Griffioen, Christian Doerr
Malware, like all products and services, evolves with bursts of innovation. These advances usually happen whenever security controls get ''good enough'' to significantly impact the revenue stream of malicious actors, and in the past we have seen the malware ecosystem to adopt concepts such as code obfuscation, polymorphism, domain-generation algorithms (DGAs), as well as virtual machine and sandbox evasion whenever defenses were able to perform consistent and pervasive suppression of these threats.
Swarna Madhuri Pichikala, G Rachana, H Sanjanapatel, Saumya Shanu · 5 authors
Any software or file that we download from the internet has no way to verify if it is legit and does not contain a malware. An anti-virus just uses a centralised database. Building a blockchain solution around this which allows people who download any file from the internet to verify and approve that it is malicious or not is the need of the hour.In recent years, blockchain technology stands as some solution to everything due to its features like decentralization, persistency, anonymity, and auditability. The antivirus softwares detects whether a file is malicious or not and removes whichever file found malicious. These softwares try to be effective as much as their virus database allows them to be. These virus databases usually will have signatures of malicious behaviour. When a file is checked for maliciousness, its signature is checked if it matches or not with any of the existing signatures. If it is, then it is declared malicious and not allowed to download else file is quarantine or sent to lab analysis. Regarding the lab analysis and report, it depends on that particular antivirus software. Whatever can be the method of deciding whether a file is malicious or not but it takes time to analyse it, decide and add that particular file's signature to antivirus software's database within which any person would have downloaded that file. Here is where distributed and decentralized feature of blockchain is used to update the blockchain with the new malicious file's signature. By doing this every node in the network will be able to decide on whether the particular file from internet is malicious or not.
Ethereum Smart Contracts based on Blockchain Technology (BT)enables monetary transactions among peers on a blockchain network independent of a central authorizing agency. Ethereum smart contracts are programs that are deployed as decentralized applications, having the building blocks of the blockchain consensus protocol. This enables consumers to make agreements in a transparent and conflict-free environment. However, there exist some security vulnerabilities within these smart contracts that are a potential threat to the applications and their consumers and have shown in the past to cause huge financial losses. In this study, we review the existing literature and broadly classify the BT applications. As Ethereum smart contracts find their application mostly in e-commerce applications, we believe these are more commonly vulnerable to attacks. In these smart contracts, we mainly focus on identifying vulnerabilities that programmers and users of smart contracts must avoid. This paper aims at explaining eight vulnerabilities that are specific to the application level of BT by analyzing the past exploitation case scenarios of these security vulnerabilities. We also review some of the available tools and applications that detect these vulnerabilities in terms of their approach and effectiveness. We also investigated the availability of detection tools for identifying these security vulnerabilities and lack thereof to identify some of them
With the increase of the adoption of blockchain technology in providing decentralized solutions to various problems, smart contracts have become more popular to the point that billions of US Dollars are currently exchanged every day through such technology. Meanwhile, various vulnerabilities in smart contracts have been exploited by attackers to steal cryptocurrencies worth millions of dollars. The automatic detection of smart contract vulnerabilities therefore is an essential research problem. Existing solutions to this problem particularly rely on human experts to define features or different rules to detect vulnerabilities. However, this often causes many vulnerabilities to be ignored, and they are inefficient in detecting new vulnerabilities. In this study, to overcome such challenges, we propose the VSCL framework to automatically detect vulnerabilities in smart contracts on the blockchain. More specifically, first, we utilize novel feature vector generation techniques from bytecode of smart contract since the source code of smart contracts are rarely available in public. Next, the collected vectors are fed into our novel metric learning-based deep neural network(DNN) to get the detection result. We conduct comprehensive experiments on a large-scale benchmark, and the quantitative results demonstrate the effectiveness and efficiency of our approach.
Blockchain technology's (BT) Ethereum Smart Contracts allows programmable transactions that involve the transfer of monetary assets among peers on a BT network independent of a central authorizing agency. Ethereum Smart Contracts are programs that are deployed as decentralized applications, having the building blocks of the blockchain consensus protocol. This technology enables consumers to make agreements in a transparent and conflict-free environment. However, the security vulnerabilities within these smart contracts are a potential threat to the applications and their consumers and have shown in the past to cause huge financial losses. In this paper, we propose a framework that combines static and dynamic analysis to detect Denial of Service (DoS) vulnerability due to an unexpected revert in Ethereum Smart Contracts. Our framework, SmartScan, statically scans smart contracts under test (SCUTs) to identify patterns that are potentially vulnerable in these SCUTs and then uses dynamic analysis to precisely confirm their exploitability of the DoS-Unexpected Revert vulnerability, thus achieving increased performance and more precise results. We evaluated SmartScan on a set of 500 smart contracts collected from the Etherscan. Our approach shows an improvement in precision and recall when compared to available state of the art techniques.
Nikolay Ivanov, Jianzhi Lou, Ting Chen, Jin Li · 5 authors
Ethereum holds multiple billions of U.S. dollars in the form of Ether cryptocurrency and ERC-20 tokens, with millions of deployed smart contracts algorithmically operating these funds. Unsurprisingly, the security of Ethereum smart contracts has been under rigorous scrutiny. In recent years, numerous defense tools have been developed to detect different types of smart contract code vulnerabilities. When opportunities for exploiting code vulnerabilities diminish, the attackers start resorting to social engineering attacks, which aim to influence humans -- often the weakest link in the system. The only known class of social engineering attacks in Ethereum are honeypots, which plant hidden traps for attackers attempting to exploit existing vulnerabilities, thereby targeting only a small population of potential victims. In this work, we explore the possibility and existence of new social engineering attacks beyond smart contract honeypots. We present two novel classes of Ethereum social engineering attacks - Address Manipulation and Homograph - and develop six zero-day social engineering attacks. To show how the attacks can be used in popular programming patterns, we conduct a case study of five popular smart contracts with combined market capitalization exceeding $29 billion, and integrate our attack patterns in their source codes without altering their existing functionality. Moreover, we show that these attacks remain dormant during the test phase but activate their malicious logic only at the final production deployment. We further analyze 85,656 open-source smart contracts, and discover that 1,027 of them can be used for the proposed social engineering attacks. We conduct a professional opinion survey with experts from seven smart contract auditing firms, corroborating that the exposed social engineering attacks bring a major threat to the smart contract systems.
Jon Stephens, Kostas Ferles, Benjamin Mariano, Shuvendu K. Lahiri · 5 authors
Smart contracts are programs that run on the blockchain and digitally enforce the execution of contracts between parties. Because bugs in smart contracts can have serious monetary consequences, ensuring the correctness of such software is of utmost importance. In this paper, we present a novel technique, and its implementation in a tool called SMARTPULSE, for automatically verifying temporal properties in smart contracts. SMARTPULSE is the first smart contract verification tool that is capable of checking liveness properties, which ensure that "something good" will eventually happen (e.g., "I will eventually receive my refund"). We experimentally evaluate SMARTPULSE on a broad class of smart contracts and properties and show that (a) SMARTPULSE allows automatically verifying important liveness properties, (b) it is competitive with or better than state-of-the-art tools for safety verification, and (c) it can automatically generate attacks for vulnerable contracts.
The advancement of internet technology, cybersecurity, and the distributed system has enabled the development and establishment of electronic voting systems. This study focuses on the design and architecture of a secure and auditable electronic voting system that consists of a website, database system, and blockchain. The Ethereum blockchain is chosen due to its smart contract that is suitable for applications such as e-voting. The implementation is done using the Go language, and the Ethereum blockchain is accessible through the e-voting website. Initial testing and evaluation results show that the proposed design and architecture of the e-voting system allows a secure transaction to take place and auditable at the same time. Several configurations on the blockchain, such as block size, gas limit, and the number of sealers, could be modified to boost the performances further.
Miguel A. Prada-Delgado, Gero Dittmann, Ilie Circiumaru, Jens Jelitto
Counterfeiting is a major problem in many industries, causing hundreds of billions of dollars in damages every year. Digital twins further increase a product's value, making it critical to secure the link between the physical and digital world. An entire industry has sprung up to address this problem with a wide variety of product-authentication technologies, or crypto anchors, offering many different trade-offs between supported product surface, security level, price sensitivity, ease of use, etc. Each crypto-anchor vendor provides their own APIs for commissioning, verification and monitoring which makes it hard for application developers to support many of them. This paper introduces a platform that provides a generic model of an object secured by a crypto anchor, supporting any number of product authentication technologies by means of crypto-anchor plugins. Applications programmed against this generic model can immediately interoperate with any of the plugged-in crypto anchors. We present a blockchain architecture for the platform whose decentralization matches the highly differentiated industry structure. We've implemented the system on Hyperledger Fabric.
Physical Unclonable Functions (PUFs) and Hardware Security
With the tremendous growth of IoT application, providing security to IoT systems has become more critical. In this paper, a technique is presented to ensure the safety of Internet of Things (IoT) devices. This technique ensures hardware and software security of IoT devices. Blockchain technology is used for software security and hardware logics are used for hardware security. For enabling a Blockchain, Ethereum Network is used for secure peer-to-peer transmission. A prototype model is also used using two IoT nodes to demonstrate the security logic.
Internet of Things (IoT) is a relatively new concept in computer science that connects devices with constrained resources to insecure internet through different technologies. IoT's fundamental components, including the wireless sensor networks and the internet, have an unsecured foundation that leads to DoS attacks, namely, sinkhole, blackhole, and grey hole attacks. To maintain the integrity and security of the IoT networks, many researchers implemented distributed ledgers in IoT environments. In this paper, we designed a hybrid framework between blockchain and IoT devices; the aim is to secure data transmission in IoT networks using blockchain technology to defend against DoS attacks. Our framework is called HFSDT-IoT. The method proposed in this paper consists of two phases to maintain security in the IoT. In the first phase, both a list of attackers and a safe list based on the Ethereum Proof-of-Stake (PoS) protocol is used, which complemented by utilizing the proposed IDSs Intrusion Detection System to discover malicious things. In the second phase, to decrease the obstacles in facilitating communication between blockchains, the inter-blockchain communication model creates a network of multiple blockchains with secp256k1 encryption used for heterogeneous blockchains. The experimental results of simulated scenarios show the HFSDT-IoT strategy can achieve better results when DoS attacks were launched compared to other blockchain-based methods, namely Bubble of Trust and Credibility Verification Method.
Christian Bräm, Marco Eilers, Péter Müller, Robin Sierra · 5 authors
Smart contracts are programs that execute inside blockchains such as Ethereum to manipulate digital assets. Since bugs in smart contracts may lead to substantial financial losses, there is considerable interest in formally proving their correctness. However, the specification and verification of smart contracts faces challenges that do not arise in other application domains. Smart contracts frequently interact with unverified, potentially adversarial outside code, which substantially weakens the assumptions that formal analyses can (soundly) make. Moreover, the core functionality of smart contracts is to manipulate and transfer resources; describing this functionality concisely requires dedicated specification support. Current reasoning techniques do not fully address these challenges, being restricted in their scope or expressiveness (in particular, in the presence of re-entrant calls), and offering limited means of expressing the resource transfers a contract performs.
In this paper, we present a novel specification methodology tailored to the domain of smart contracts. Our specification constructs and associated reasoning technique are the first to enable: (1) sound and precise reasoning in the presence of unverified code and arbitrary re-entrancy, (2) modular reasoning about collaborating smart contracts, and (3) domain-specific specifications based on resources and resource transfers, which allow expressing a contract's behavior in intuitive and concise ways and exclude typical errors by default. We have implemented our approach in 2vyper, an SMT-based automated verification tool for Ethereum smart contracts written in the Vyper language, and demonstrated its effectiveness in succinctly capturing and verifying strong correctness guarantees for real-world contracts.
Christian Bräm, Marco Eilers, Péter Müller, Robin Sierra · 5 authors
Smart contracts are programs that execute inside blockchains such as Ethereum to manipulate digital assets. Since bugs in smart contracts may lead to substantial financial losses, there is considerable interest in formally proving their correctness. However, the specification and verification of smart contracts faces challenges that do not arise in other application domains. Smart contracts frequently interact with unverified, potentially adversarial outside code, which substantially weakens the assumptions that formal analyses can (soundly) make. Moreover, the core functionality of smart contracts is to manipulate and transfer resources; describing this functionality concisely requires dedicated specification support. Current reasoning techniques do not fully address these challenges, being restricted in their scope or expressiveness (in particular, in the presence of re-entrant calls), and offering limited means of expressing the resource transfers a contract performs. In this paper, we present a novel specification methodology tailored to the domain of smart contracts. Our specification constructs and associated reasoning technique are the first to enable: (1) sound and precise reasoning in the presence of unverified code and arbitrary re-entrancy, (2) modular reasoning about collaborating smart contracts, and (3) domain-specific specifications based on resources and resource transfers, which allow expressing a contract's behavior in intuitive and concise ways and exclude typical errors by default. We have implemented our approach in 2vyper, an SMT-based automated verification tool for Ethereum smart contracts written in the Vyper language, and demonstrated its effectiveness in succinctly capturing and verifying strong correctness guarantees for real-world contracts.