The authentication process is the main step which should be used to confirm that the user is the legitimate one and give the access only for him. Recently, Two Factor Authentication (2FA) schemes have been used by most of the applications to add an extra layer of security on the login process and solve the vulnerabilities of using only one factor for authentication. OTP-SMS is one of the most common methods which has been used in 2FA. However, attackers found a way to attack this method and gain an access to the user’s account without their permission. In this paper, we proposed a new 2FA framework for OTP-SMS method to prevent different attacks, mainly Man In The Middle (MITM) attack and third party attack. The proposed framework is based on the use of Blockchain technology, which add more security and better environment for authentication process. The proposed framework uses an encrypted OTP, which generated by smart contract and uses also its hash value to send it to the application/website to complete the authentication process. We introduced a comparison between our proposed framework and other two frameworks which uses Blockchain to secure OTP-SMS. Our framework found to be secure against MITM and third party attacks and the computation time and complexity are less than other frameworks.
Ransomware represents a class of malicious applications that encrypts the files of infected system and demands from victims a payment in cryptocurrency in order to receive the decryption key. The mainstream adoption of cryptocurrencies increased the number of ransomware attack. The outbreaks had risen in complexity and received mass-media attention in 2017 when two destructive campaigns crippled companies and institutions around the world. These outbreaks continue at an accelerated pace even though efforts are made to improve the detection and mitigation of ransomware. The purpose of this research is to assess the efficiency of current malware analysis methods and technologies in the detection of ransomware. The experiments presented here were performed using antivirus engines and dynamic malware analysis against live obfuscated ransomware samples.
Advances in Blockchain and distributed ledger technologies are driving the rise of incentivized social media platforms over Blockchains, where no single entity can take control of the information and users can receive cryptocurrency as rewards for creating or curating high-quality contents. This paper presents an empirical analysis of Steemit, a key representative of the emerging incentivized social media platforms over Blockchains, to understand and evaluate the actual level of decentralization and the practical effects of cryptocurrency-driven reward system in these modern social media platforms. Similar to Bitcoin, Steemit is operated by a decentralized community, where 21 members are periodically elected to cooperatively operate the platform through the Delegated Proof-of-Stake (DPoS) consensus protocol. Our study performed on 539 million operations performed by 1.12 million Steemit users during the period 2016/03 to 2018/08 reveals that the actual level of decentralization in Steemit is far lower than the ideal level, indicating that the DPoS consensus protocol may not be a desirable approach for establishing a highly decentralized social media platform. In Steemit, users create contents as posts which get curated based on votes from other users. The platform periodically issues cryptocurrency as rewards to creators and curators of popular posts. Although such a reward system is originally driven by the desire to incentivize users to contribute to high-quality contents, our analysis of the underlying cryptocurrency transfer network on the blockchain reveals that more than 16% transfers of cryptocurrency in Steemit are sent to curators suspected to be bots and also finds the existence of an underlying supply network for the bots, both suggesting a significant misuse of the current reward system in Steemit. Our study is designed to provide insights on the current state of this emerging blockchain-based social media platform including the effectiveness of its design and the operation of the consensus protocols and the reward system.
As one of the representative Delegated Proof-of-Stake (DPoS) blockchain platforms, EOSIO's ecosystem grows rapidly in recent years. A number of vulnerabilities and corresponding attacks of EOSIO's smart contracts have been discovered and observed in the wild, which caused a large amount of financial damages. However, the majority of EOSIO's smart contracts are not open-sourced. As a result, the WebAssembly code may become the only available object to be analyzed in most cases. Unfortunately, current tools are web-application oriented and cannot be applied to EOSIO WebAssembly code directly, which makes it more difficult to detect vulnerabilities from those smart contracts. In this paper, we propose \toolname, a static analysis tool that can be used to detect vulnerabilities from EOSIO WASM code automatically. We focus on one particular type of vulnerabilities named \textit{fake-transfer}, and the exploitation of such vulnerabilities has led to millions of dollars in damages. To the best of our knowledge, it is the first attempt to build an automatic tool to detect vulnerabilities of EOSIO's smart contracts. The experimental results demonstrate that our tool is able to detect fake transfer vulnerabilities quickly and precisely. EVulHunter is available on GitHub\footnote{Tool and benchmarks: https://github.com/EVulHunter/EVulHunter} and YouTube\footnote{Demo video: https://youtu.be/5SJ0ZJKVZvw}.
In the past few years in many countries people have experienced the erosion of trust in the main pillars of democracy, the voting and election systems. Many authors envisage the blockchain technology as a tool for restoration of trust (Tapscott 2016; Swislow 2016; Shin 2016). Our research is aimed at the potential use of blockchain technology in social systems for enhancing trust and increasing participation. We aim to explore whether the blockchain technology is suitable for voting or elections in large communities and the issues to be addressed for real world applications to leverage democratic rights. Our final conclusion is that there are both theoretical and practical obstacles in the way of such direct applications.
Tin Tironsakkul, Manuel Maarek, Andrea Eross, Mike Just
Since the creation of Bitcoin, transaction tracking is one of the prominent means for following the movement of Bitcoins involved in illegal activities. Although every Bitcoin transaction is recorded in the blockchain database, which is transparent for anyone to observe and analyse, Bitcoin's pseudonymity system and transaction obscuring techniques still allow criminals to disguise their transaction trail. While there have been a few attempts to develop tracking methods, there is no accepted evaluation method to measure their accuracy. Therefore, this paper investigates strategies for transaction tracking by introducing two new tainting methods, and proposes an address profiling approach with a metrics-based evaluation framework. We use our approach and framework to compare the accuracy of our new tainting methods with the previous tainting techniques, using data from two real Bitcoin theft transactions and several related control transactions.
Networks (Autonomous Systems-AS) allocate or revoke IP prefixes with the intervention of official Internet resource number authorities, and select and advertise policy-compliant paths towards these prefixes using the inter-domain routing system and its primary enabler, the Border Gateway Protocol (BGP). Securing BGP has been a long-term objective of several research and industrial efforts during the last decades, that have culminated in the Resource Public Key Infrastructure (RPKI) for the cryptographic verification of prefix-to-AS assignments. However, there is still no widely adopted solution for securing IP prefixes and the (AS-)paths leading to them; approaches such as BGPsec have seen minuscule deployment. In this work, we design and implement a Blockchain-based system that (i) can be used to validate both of these resource types, (ii) can work passively and does not require any changes in the inter-domain routing system (BGP, RPKI), and (iii) can be combined with currently available systems for the detection and mitigation of routing attacks. We present early results and insights w.r.t. scalability.
A double-spend attack is one of the major security issues in most blockchain systems, but it is difficult to successfully launch unless an adversary has massive computing power. In this paper, we introduce a new attack model that combines a double-spend attack with a Sybil attack in the Bitcoin network. We present analysis results that a double-spending attacker can make a block propagation delay by conducting Sybil attacks and increase the probability of winning the mining race, thus successfully launching the double-spend attack. We develop the probability of success of this new attack in mathematics forms and analyze this attack model from the perspective of economics. We present the attacker's break-even point in various situations and demonstrate the effect of the proposed attack.
Blockchain-related discussions have become increasingly prevalent in programming Q&A websites, such as Stack Overflow and other Stack Exchange communities. Analyzing and understanding those discussions could provide insights about the topics of interest to practitioners, and help the software development and research communities better understand the needs and challenges facing developers as they work in this new domain. Prior studies propose the use of LDA to study the Stack Exchange discussions. However, a simplistic use of LDA would capture the topics in discussions blindly without keeping in mind the variety of the dataset and domain-specific concepts. Specifically, LDA is biased towards larger sized corpora; and LDA-derived topics are not linked to higher level domain-specific concepts. We propose an approach that combines balanced LDA (which ensures that the topics are balanced across a domain) with the reference architecture of a domain to capture and compare the popularity and impact of discussion topics across the Stack Exchange communities. Popularity measures the distribution of interest in discussions, and impact gauges the trend of popularity over time. We made a number of interesting observations, including: (1) Bitcoin, Ethereum, Hyperledger Fabric and Corda are the four most commonly-discussed blockchain platforms on the Stack Exchange communities. (2) A broad range of topics are discussed across the various platforms of distinct layers in our derived reference architecture. (3) The Application layer topics exhibit the highest popularity (33.2 percent) and fastest growth in topic impact since November 2015. (4) The Application, API, Consensus and Network layer topics are discussed across the studied blockchain platforms, but exhibit different distributions in popularity. (5) The impact of architectural layer topics exhibits an upward trend, but is growing at different speeds across the studied blockchain platforms. The breakdown of the topic impact across the architectural layers is relatively stable over time except for the Hyperledger Fabric platform. Based on our findings, we highlighted future directions and provided recommendations for practitioners and researchers.
Sidra Malik, Volkan Dedeoglu, Salil S. Kanhere, Raja Jurdak
Traceability and integrity are major challenges for the increasingly complex supply chains of today's world. Although blockchain technology has the potential to address these challenges through providing a tamper-proof audit trail of supply chain events and data associated with a product life-cycle, it does not solve the trust problem associated with the data itself. Reputation systems are an effective approach to solve this trust problem. However, current reputation systems are not suited to the blockchain based supply chain applications as they are based on limited observations, they lack granularity and automation, and their overhead has not been explored. In this work, we propose TrustChain, as a three-layered trust management framework which uses a consortium blockchain to track interactions among supply chain participants and to dynamically assign trust and reputation scores based on these interactions. The novelty of TrustChain stems from: (a) the reputation model that evaluates the quality of commodities, and the trustworthiness of entities based on multiple observations of supply chain events, (b) its support for reputation scores that separate between a supply chain participant and products, enabling the assignment of product-specific reputations for the same participant, (c) the use of smart contracts for transparent, efficient, secure, and automated calculation of reputation scores, and (d) its minimal overhead in terms of latency and throughput when compared to a simple blockchain based supply chain model.
Fake news has become a major problem in the cyberspace with far reaching consequences. The open access and unregulated social networks are popular attack vectors that are frequently used to propagate misinformation. To fight this problem, several naïve solutions have been proposed, including a blockchain implementation of news feed to distinguish facts from fiction. However, the size of social networks and the design constructs of blockchain add several new challenges that impede the real world deployment of such solutions. In this paper, we postulate a new blockchain system that overcomes the existing challenges and limits the spread of fake news across the network. Towards that, we analyze the information workflow in the social networks and construct an optimal detection system that can be effectively deployed with minimal overhead. Moreover, our proposed solution can be extended beyond social networks to other online platforms.
Custom tokens are an integral component of decentralized applications (dapps) deployed on Ethereum and other blockchain platforms. For Ethereum, the ERC20 standard is a widely used token interface and is interoperable with many existing dapps, user interface platforms, and popular web applications (e.g., exchange services). An ERC20 security issue, known as the "multiple withdrawal attack", was raised on GitHub and has been open since November 2016. The issue concerns ERC20's defined method approve() which was envisioned as a way for token holders to give permission for other users and dapps to withdraw a capped number of tokens. The security issue arises when a token holder wants to adjust the amount of approved tokens from N to M (this could be an increase or decrease). If malicious, a user or dapp who is approved for N tokens can front-run the adjustment transaction to first withdraw N tokens, then allow the approval to be confirmed, and withdraw an additional M tokens. In this paper, we evaluate 10 proposed mitigations for this issues and find that no solution is fully satisfactory. We then propose 2 new solutions that mitigate the attack, one of which fully fulfills constraints of the standard, and the second one shows a general limitation in addressing this issue from ERC20's approve method.
Blockchain gaming is an emerging entertainment paradigm. However, blockchain games are still suffering from security issues, due to the immature blockchain technologies and its unsophisticated developers. In this work, we analyzed the blockchain game architecture and reveal the possible penetration methods of cracking. We scanned more than 600 commercial blockchain games to summarize a security overview from the perspective of the web server and smart contract, respectively. We also conducted three case studies for blockchain games to show detailed vulnerability detection.
The world economy is embracing the next generation currency, i.e., cryptocurrencies, which dates back to 2009 when Satoshi Nakamoto made Bitcoin publicly available. Rooted from the nature of decentralization and anonymity of blockchain, the cryptocurrencies have, unfortunately, been leveraged for illicit activities by the criminals. The good news is that typical cryptocurrencies, such as Bitcoin, have to publicly publish their transactions, known as a graph, to retain their ultimate goal of trustless and decentralized transaction verification, which lends law enforcement a means to deanonymizing cryptocurrencies. At meantime, graph learning is an extremely powerful tool to extract the latent features of each vertex in a graph to fulfill various tasks, such as, classifying graph vertices. In this work, we discuss the promises and challenges of exploiting graph learning to deanonymizing cryptocurrencies, which can aid the cyberfighters to circumvent cryptocurrency-based illicit activities.
Unsolicited, and most likely spoofed, robot calls are not just an annoyance, but also carry a potential threat with the onset of automation, impersonation, and even voice manipulation technologies as malicious elements attempt to use deception to steal sensitive information or invoke action. Despite steps taken to protect consumers, the issue appears to be far from under control. In this paper, we propose a solution to use blockchain as a platform to share spam transactions through a peer-to-peer mechanism that will maintain a global database of reported spam transactions in order to identify and trace spam activity effectively. Storing spam transactions on a distributed ledger with consensus-based approval of transactions adds reliability to the data and can optimize the data points that will be available to spam detection algorithms in order to fight spam effectively. As this is peer to peer-based sharing, there is no need to rely on thirdparty providers for storing and sharing this data to the users. Every spam call received will be added as a detailed transaction on the blockchain to execute a smart contract that will calculate the trustworthiness of the caller. Call records are used to identify spam transactions while the blockchain ledgers store this data. We discuss the relevance and advantages of a distributed ledger to store these transactions. This paper does not aim at solving the spam problem with an optimized detection algorithm but evaluates the characteristics and performance of the blockchain as a distributed ledger and its relevance to serve as a platform for peer-to-peer spam detection mechanisms. We evaluate different blockchain metrics like transaction processing rates, gas costs and ledger sizes and discuss how they scale in order to store the spam reports data on the blockchain.
In proof-of-work (PoW)-based blockchain networks, the miners contribute their distributed computation in solving a crypto-puzzle competition to win the reward. To secure stable profits, some miners organize mining pools and share the rewards from the pool in proportion to each miner's contribution. However, some miners may exhibit malicious behaviors which cause a waste of distributed computation resource, even posing a threat on the efficiency of blockchain networks. In this paper, we propose a new game-theoretic framework to incentivize miners mining honestly and help to bring about a higher total welfare of blockchain networks. We first formulate the mining process as a noncooperative iterated game. We then propose a mechanism in terms of zero-determinant strategies (ZD strategies) to encourage the cooperative mining and improve the efficiency of mining in PoW-based blockchain networks. In addition, we theoretically analyze the maximum system welfare of the target pool through the method of optimization. Numerical illustrations are also presented to support our theoretical results.
Lyra2REv2 is a hashing algorithm that consists of a chain of individual hashing algorithms, and it is used as a proof-of-work function in several cryptocurrencies. The most crucial and exotic hashing algorithm in the Lyra2REv2 chain is a specific instance of the general Lyra2 algorithm. In this work, we present the first hardware implementation of the specific instance of Lyra2 that is used in Lyra2REv2 and we explain how several properties of this algorithm can be exploited in order to optimize the design. Moreover, we present an FPGA-based hardware implementation of a full miner chain for Lyra2REv2 on a Xilinx Multi-Processor System on Chip. Our proposed Lyra2REv2 miner chain is shown to be significantly more energy efficient than both a GPU and a commercially available FPGA-based miner. Finally, we also explain how our simplified Lyra2 and Lyra2REv2 architectures can be modified with minimal effort to also support the recent Lyra2REv3 chained hashing algorithm.
The anonymity and de-anonymity of blockchain and Bitcoin have always been a hot topic in blockchain related research. Since Bitcoin was created by Nakamoto in 2009, it has, to some extent, deviated from its currency attribute as a trading medium but instead turned into an object for financial investment and operations. In this paper, the power-law distribution that the Bitcoin network obeys is given, while traditional de-anonymous methods such as clustering fail to satisfy it. Therefore, considering the profit-oriented characteristics of Bitcoin traders in such occasion, we put forward a deanonymous heuristic approach that recognizes and analyzes the behavioral patterns of financial High-Frequency Transactions(HFT), with real-time exchange rate of Bitcoin involved. Basing on the heuristic approach, finally we established the de-anonymous method that matches the activity information of the IP with the transaction records in blockchain. Experiments on IP matching method are applied to the actual data. It turns out that similar behavioral pattern between IP and transaction records are shown, which indicates the superiority of IP matching method.
Afiya Ayman, Shanto Roy, Mohammad Amin Alipour, Áron Lászka
Blockchain-based platforms are emerging as a transformative technology that can provide reliability, integrity, and auditability without trusted entities. One of the key features of these platforms is the trustworthy decentralized execution of general-purpose computation in the form of smart contracts, which are envisioned to have a wide range of applications. As a result, a rapidly growing and active community of smart-contract developers has emerged in recent years. A number of research efforts have investigated the technological challenges that these developers face, introducing a variety of tools, languages, and frameworks for smart-contract development, focusing on security. However, relatively little is known about the community itself, about the developers, and about the issues that they face and discuss. To address this gap, we study smart-contract developers and their discussions on two social media sites, Stack Exchange and Medium. We provide insight into the trends and key topics of these discussions, into the developers' interest in various security issues and security tools, and into the developers' technological background.
Matteo Romiti, Aljosha Judmayer, Alexei Zamyatin, Bernhard Haslhofer
Dataset retrieved and used with the code hosted here for this paper published at WEIS 2019 Abstract Miners play a key role in cryptocurrencies such as Bitcoin: they invest substantial computational resources in processing transactions and minting new currency units. It is well known that an attacker controlling more than half of the network’s mining power could manipulate the state of the system at will. While the influence of large mining pools appears evenly split, the actual distribution of mining power within these pools and their economic relationships with other actors remain undisclosed. To this end, we conduct the first in-depth analysis of mining reward distribution within three of the four largest Bitcoin mining pools and examine their cross-pool economic relationships. Our results suggest that individual miners are simultaneously operating across all three pools and that in each analyzed pool a small number of actors (≤ 20) receives over 50% of all BTC payouts. While the extent of an operator’s control over the resources of a mining pool remains an open debate, our findings are in line with previous research, pointing out centralization tendencies in large mining pools and cryptocurrencies in general
Jiachi Chen, Xin Xia, David Lo, John Grundy · 6 authors
Smart contracts are programs running on a blockchain. They are immutable to change, and hence can not be patched for bugs once deployed. Thus it is critical to ensure they are bug-free and well-designed before deployment. A Contract defect is an error, flaw or fault in a smart contract that causes it to produce an incorrect or unexpected result, or to behave in unintended ways. The detection of contract defects is a method to avoid potential bugs and improve the design of existing code. Since smart contracts contain numerous distinctive features, such as the gas system. decentralized, it is important to find smart contract specified defects. To fill this gap, we collected smart-contract-related posts from Ethereum StackExchange, as well as real-world smart contracts. We manually analyzed these posts and contracts; using them to define 20 kinds of contract defects. We categorized them into indicating potential security, availability, performance, maintainability and reusability problems. To validate if practitioners consider these contract as harmful, we created an online survey and received 138 responses from 32 different countries. Feedback showed these contract defects are harmful and removing them would improve the quality and robustness of smart contracts. We manually identified our defined contract defects in 587 real world smart contract and publicly released our dataset. Finally, we summarized 5 impacts caused by contract defects. These help developers better understand the symptoms of the defects and removal priority.
With the frantic development of smart contracts on the Ethereum platform, its market value has also climbed. In 2016, people were shocked by the loss of nearly $50 million in cryptocurrencies from the DAO reentrancy attack. Due to the tremendous amount of money flowing in smart contracts, its security has attracted much attention of researchers. In this paper, we investigated several common smart contract vulnerabilities and analyzed their possible scenarios and how they may be exploited. Furthermore, we survey the smart contract vulnerability detection tools for the Ethereum platform in recent years. We found that these tools have similar prototypes in software vulnerability detection technology. Moreover, for the features of public distribution systems such as Ethereum, we present the new challenges that these software vulnerability detection technologies face.