Aaron Zimba, Zhaoshun Wang, Mwenge Mulenga, Nickson Herbert Odongo
The popularity of cryptocurrencies has continued to grow drastically over the past decade and this has drawn significant attention to various threat actors. Cybercriminals are now employing unconventional means to acquire cryptocurrencies at the expense of benign Internet users. This paper investigates the state-of-the-art crypto mining attacks by examining the malware code and the behavioral analysis upon execution. It examines the two most common attack approaches; web browser-based crypto mining which leverages JavaScript and installable binary crypto mining where the malware runs in memory. Furthermore, the paper investigates how cybercriminals endeavor to establish a persistence mechanism and avoid detection. The results from static and dynamic analysis uncover the techniques employed by the malware to exploit potential victims. Indicators of compromise are drawn from the uncovered artifacts which can be used as inputs to intrusion detection systems to help mitigate such cyber-attacks.
Online portals include an increasing amount of user feedback in form of ratings and reviews. Recent research highlighted the importance of this feedback and confirmed that positive feedback improves product sales figures and thus its success. Online portals' operators act as central authorities throughout the overall review process. In the worst case, operators can exclude users from submitting reviews, modify existing reviews, and introduce fake reviews by fictional users. This paper presents ReviewChain, a decentralized review approach. Our approach avoids central authorities by using blockchain technologies, decentralized apps and storage. It enables users to submit and retrieve untampered reviews. We highlight the implementation challenges encountered when realizing our approach on the public Ethereum blockchain. Then, we discuss possible design alternatives and their trade-offs regarding costs, security, and trustworthiness. Finally, we analyze which design decision should be chosen to support specific trade-offs and present resulting combinations of decentralized blockchain technologies, also with conventional centralized technologies.
James Tapsell, Raja Naeem Akram, Konstantinos Markantonakis
Bitcoin is a decentralised digital currency that relies on cryptography rather than trusted third parties such as central banks for its security. Underpinning the operation of the currency is a peer-to-peer (P2P) network that facilitates the execution of transactions by end users, as well as the transaction confirmation process known as bitcoin mining. The security of this P2P network is vital for the currency to function and subversion of the underlying network can lead to attacks on bitcoin users including theft of bitcoins, manipulation of the mining process and denial of service (DoS). As part of this paper the network protocol and bitcoin core software are analysed, with three bitcoin message exchanges (the connection handshake, GETHEADERS/HEADERS and MEMPOOL/INV) found to be potentially vulnerable to spoofing and use in distributed denial of service (DDoS) attacks. Possible solutions to the identified weaknesses and vulnerabilities are evaluated, such as the introduction of random nonces into network messages exchanges.
The past decade has witnessed the rapid evolution in blockchain technologies, which has attracted tremendous interests from both the research communities and industries. The blockchain network was originated from the Internet financial sector as a decentralized, immutable ledger system for transactional data ordering. Nowadays, it is envisioned as a powerful backbone/framework for decentralized data processing and data-driven self-organization in flat, open-access networks. In particular, the plausible characteristics of decentralization, immutability, and self-organization are primarily owing to the unique decentralized consensus mechanisms introduced by blockchain networks. This survey is motivated by the lack of a comprehensive literature review on the development of decentralized consensus mechanisms in blockchain networks. In this paper, we provide a systematic vision of the organization of blockchain networks. By emphasizing the unique characteristics of decentralized consensus in blockchain networks, our in-depth review of the state-of-the-art consensus protocols is focused on both the perspective of distributed consensus system design and the perspective of incentive mechanism design. From a game-theoretic point of view, we also provide a thorough review of the strategy adopted for self-organization by the individual nodes in the blockchain backbone networks. Consequently, we provide a comprehensive survey of the emerging applications of blockchain networks in a broad area of telecommunication. We highlight our special interest in how the consensus mechanisms impact these applications. Finally, we discuss several open issues in the protocol design for blockchain consensus and the related potential research directions.
Muhammad Saad, Aziz Mohaisen, Charles Kamhoua, Kevin Kwait · 5 authors
In this paper, we look at the use of hash-based, one-time signatures in the context of the Blockchain systems and demonstrate how the replacement of currently utilized schemes into a one-time signature can help deter double-spending. Towards this goal, we make the following contributions. 1) We introduce a notion of double- spending deterrence, a form of malleability that does not require pre-authorization from the signer to create a signature on an arbitrary message using two previously signed messages. It is used as a penalty to deter double-spending and disincentivize forgery. 2) We study features of various one-time signature schemes, and we demonstrate their effectiveness in thwarting double-spending. 3) We explore the design space of applying our methodology to the Blockchain system with a clear example and design options to deter double-spending. The results reported in this paper are promising, and open several new directions.
Ransomware is a type of malware that encrypts the files of infected hosts and demands payment, often in a crypto-currency like Bitcoin. In this paper, we create a measurement framework that we use to perform a large-scale, two-year, end-to-end measurement of ransomware payments, victims, and operators. By combining an array of data sources, including ransomware binaries, seed ransom payments, victim telemetry from infections, and a large database of bitcoin addresses annotated with their owners, we sketch the outlines of this burgeoning ecosystem and associated third-party infrastructure. In particular, we are able to trace the financial transactions, from the acquisition of bitcoins by victims, through the payment of ransoms, to the cash out of bitcoins by the ransomware operators. We find that many ransomware operators cashed out using BTC-e, a now-defunct Bitcoin exchange. In total we are able to track over $16 million USD in likely ransom payments made by 19,750 potential victims during a two-year period. While our study focuses on ransomware, our methods are potentially applicable to other cybercriminal operations that have similarly adopted Bitcoin as their payment channel.
In order for malicious software to receive configuration information or commands, malware needs to be able to locate and connect to its owner. As hard-coded addresses are easy to block and thus render the malware installation inoperable, malware writers have turned to dynamically generated addresses. Domain generation algorithms (DGA) generate a list of candidate domain names, each valid for only a short time, at which the malware installation searches for its command & control (C&C) server. As DGAs generate a large list of potential domains - out of which one or a few is actually in use -, they leave a characteristic trace of many failed DNS lookups (NXDomain) in the network, and in result most DGAs can be efficiently detected. In this paper we describe an entirely new principle of domain generation, actively deployed in the Cerber ransomware, which finds and coordinates with its owner based on transaction information in the bitcoin blockchain. This allows the malware author to dynamically update the location of the server in realtime, and as the malware directly goes to the right location no longer generates a sequence of NXDomain responses. We describe the concept of coordination via the blockchain, and report results on a year-long observation of the assets used in the Cerber campaign.
Nguyen B. Truong, Tai‐Won Um, Bo Zhou, Gyu Myoung Lee
In recent years, Blockchain has been expected to create a secure mechanism for exchanging not only for cryptocurrency but also for other types of assets without the need for a powerful and trusted third-party. This could enable a new era of the Internet usage called the Internet of Value (IoV) in which any types of assets such as intellectual and digital properties, equity and wealth can be digitized and transferred in an automated, secure, and convenient manner. In the IoV, Blockchain is used to guarantee security of transactions that the transactions are nearly impossible to be altered; thus it is impractical to retract once a transaction is confirmed. Therefore, to strengthen the IoV, before making any transactions it is crucial to evaluate trust between participants for reducing the risk of dealing with malicious peers. In this article, we clarify the concept of IoV and propose a trust-based IoV model including a system architecture, components and features. Then, we present a trust platform in the IoV considering two concepts, Experience and Reputation, originated from Social Networks for evaluating trust between two any peers in the IoV. The Experience and Reputation are characterized and calculated using mathematical models with analysis and simulation in the IoV environment. We believe this paper consolidates the understandings about IoV technologies and demonstrates how trust is evaluated and used to strengthen the IoV. It also opens important research directions on both IoV and trust in the future.
The use of technology has become important at this point in helping to meet human needs.Due to the increasing use of technology, new challenges are brought in the process of democracy as most people today don’t trust their governments, making elections is very important in modern democracy . Elections have a great importance in determining who will rule a nation or an organization or it can be said as it is an event that decides the fate of any nation. In modern democracy, elections are very important but large sections of society around the world do not trust their election system which is a major concern for democracy. Even the world’s largest democracies like India, United States, still suffer from a flawed electoral system. Vote rigging, hacking of EVM (Electronic voting machine), election manipulation, and polling booth capturing are the major issues in the current voting system The blockchain is said as emerging, decentralized, and distributed technology that promises to enhance different aspects of many industries. Expanding e-voting into blockchain technology could be the solution to eliminate the present concerns in e-voting system There is no doubt that the ever changing concept of the blockchain, which is the backbone of the famous cryptocurrency Bitcoin has triggered the start of a new era in the Internet and the online services. While most people focus only on bitcoin and other cryptocurrencies; there are in fact, many operations, both administrative and fintech that can only be done online/offline can now safely be moved to the Internet as online services because of immutability of blockchain. What makes blockchain a powerful tool is its smarts contracts and many features which overcomes traditional systems. Smart contracts are meaningful pieces of codes, to be integrated in the blockchain and executed as scheduled in every step of blockchain updates. E-votin, is another trending, yet critical, topic related to the online services. The blockchain with the smart contracts, emerges as a good candidate to use in developments of safer, cheaper, more secure, more transparent, and easier-to-use e-voting systems.Due to its consistency, widespread use, and provision of smart contracts logic, Ethereum and its network is one of the most suitable ones. An e-voting system must be secure, as it should not allow duplicated votes and be fully transparent, while protecting the privacy of the attendees. In this project, we have implemented and tested an e-voting application as a smart contract for the Ethereum network using the Ethereum and the Solidity language.
Jakob Demant, Rasmus Munksgaard, David Décary-Hêtu, Judith Aldridge
Objective: There is broad agreement in the literature on the transformative potential of drug cryptomarkets that allow sourcing on a global market and consequently the circumvention of existing supply chains between producer and end user. We examine whether the transformative potential of drug cryptomarkets has been realized in two ways: Are cryptomarket drug sellers found in production and transit countries? and Do we see the increased use of shipping across international borders over time? Method: Using data collected by the DATACRYPTO software tool between 2013 and 2016, we characterize cryptomarket buyer behavior through the product reviews (i.e., sales transactions) posted on 15 cryptomarkets. Findings: Cryptomarket drug sellers are predominantly based in countries of Europe, North America, and Oceania. For both cannabis resin and cocaine sold on cryptomarkets, we find that known production and transit countries are not the primary sources of supplied drugs but rather key countries of consumption. In the case of 3,4-methylenedioxymethamphetamine, we observe that the Netherlands, a known production country, is the largest supplier. We further observe tendencies over time toward increased localization of cryptomarkets with regard to product destinations. Discussion: Though cryptomarkets offer a potentially global platform for drug distribution, they do not tend to be used as such. We explain our results with reference to buyers’ preferences regarding safety, risk, and convenience, alongside structural limitations for cryptomarket use such as bitcoin availability.
Cyberattacks are nowadays moving rapidly. They are customized, multi-vector, staged in multiple flows and targeted. Moreover, new hacking playgrounds appeared to reach mobile network, modern architectures and smart cities. For that purpose, malware use different entry points and plug-ins. In addition, they are now deploying several techniques for obfuscation, camouflage and analysis resistance. On the other hand, antiviral protections are positioning innovative approaches exposing malicious indicators and anomalies, revealing assumptions of the limitations of the anti-antiviral mechanisms. Primarily, this paper exposes a state of art in computer virology and then introduces a new concept to create undetectable malware based on the blockchain technology. It summarizes techniques adopted by malicious software to avoid functionalities implemented for viral detection and presents the implementation of new viral techniques that leverage the blockchain network.
Being the largest blockchain with the capability of running smart contracts, Ethereum has attracted wide attention and its market capitalization has reached 20 billion USD. Ethereum not only supports its cryptocurrency named Ether but also provides a decentralized platform to execute smart contracts in the Ethereum virtual machine. Although Ether's price is approaching 200 USD and nearly 600K smart contracts have been deployed to Ethereum, little is known about the characteristics of its users, smart contracts, and the relationships among them. To fill in the gap, in this paper, we conduct the first systematic study on Ethereum by leveraging graph analysis to characterize three major activities on Ethereum, namely money transfer, smart contract creation, and smart contract invocation. We design a new approach to collect all transaction data, construct three graphs from the data to characterize major activities, and discover new observations and insights from these graphs. Moreover, we propose new approaches based on cross-graph analysis to address two security issues in Ethereum. The evaluation through real cases demonstrates the effectiveness of our new approaches.
Over the last few years, research on Bitcoin and other cryptocurrencies has snowballed across many disciplines: technical fields, economics, law, public policy, finance, accounting, and others. As the uses of blockchain technology behind Bitcoin expand, more disciplines will be drawn to its study and the research will greatly expand. This paper provides an assessment of the current state of the literature. From a comprehensive search of the literature that resulted in an original sample of 13,507 results, a final sample of 1,206 papers on Bitcoin are categorised and mapped across six disciplines.
Online portals include an increasing amount of user feedback in form of ratings and reviews. Recent research highlighted the importance of this feedback and confirmed that positive feedback improves product sales figures and thus its success. However, online portals' operators act as central authorities throughout the overall review process. In the worst case, operators can exclude users from submitting reviews, modify existing reviews, and introduce fake reviews by fictional consumers. This paper presents ReviewChain, a decentralized review approach. Our approach avoids central authorities by using blockchain technologies, decentralized apps and storage. Thereby, we enable users to submit and retrieve untampered reviews. We highlight the implementation challenges encountered when realizing our approach on the public Ethereum blockchain. For each implementation challange, we discuss possible design alternatives and their trade-offs regarding costs, security, and trustworthiness. Finally, we analyze which design decision should be chosen to support specific trade-offs and present resulting combinations of decentralized blockchain technologies, also with conventional centralized technologies.
Soon after its introduction in 2009, Bitcoin has been adopted by cyber-criminals, which rely on its pseudonymity to implement virtually untraceable scams. One of the typical scams that operate on Bitcoin are the so-called Ponzi schemes. These are fraudulent investments which repay users with the funds invested by new users that join the scheme, and implode when it is no longer possible to find new investments. Despite being illegal in many countries, Ponzi schemes are now proliferating on Bitcoin, and they keep alluring new victims, who are plundered of millions of dollars. We apply data mining techniques to detect Bitcoin addresses related to Ponzi schemes. Our starting point is a dataset of features of real-world Ponzi schemes, that we construct by analysing, on the Bitcoin blockchain, the transactions used to perform the scams. We use this dataset to experiment with various machine learning algorithms, and we assess their effectiveness through standard validation protocols and performance metrics. The best of the classifiers we have experimented can identify most of the Ponzi schemes in the dataset, with a low number of false positives.
Danda B. Rawat, Laurent Njilla, Kevin Kwiat, Charles Kamhoua
In this paper, we design, develop, and evaluate a novel information sharing (iShare) framework for cybersecurity with the goal of protecting confidential information and networked infrastructures from future cyber-attacks. The proposed iShare framework leverages the Blockchain concept used in Bitcoin systems where multiple organizations/agencies participate for information sharing (without violating their privacy) to secure and monitor their cyberspace. Note that the Bitcoin for financial transactions has already demonstrated that there is a trusted, auditable sharing with peer-to-peer communications accompanied by a public ledger. The main aim of the Blockchain-based iShare framework is to constantly collect high-resolution, cyber-attack information across organizational boundaries of which the organizations have no specific knowledge or control over any other organizations' data or damage caused by cyber-attacks. In the proposed iShare framework, the decentralized nature of the Blockchain and digitally signed transactions ensure that an adversary cannot pose as a legitimate organization/user or cannot control/hamper the system because of the digital-signatures and cannot learn anything from the public ledger that has just hashed pointers. Moreover, we analyze the security attacks by outsiders (not participating in the iShare) using a Stackelberg game.
The aim of this study is to review the literature growth and author productivity of Blockchain technology research from 2008 to March 2017. 801 articles were retrieved from Scopus database and analyzed with bibliometrics approach using different perspective views. The author productivity was derived using the Lotka’s law and K-S test was performed to verify the reliability. The result indicates that the number of literatures on Blockchain is still increasing. Three stages of Blockchain research change were discovered. In 2008 to 2013, the topics were related to the Bitcoin and cryptocurrencies; in 2014 to 2015, the number of Bitcoin literatures grew rapidly; after 2016, a lot of researchers are paying attention to the techniques of Blockchain and smart contract. Moreover, the distribution of author productivity meets the study of Lotka. This study presents state-of-the-art and abstract the trend of Blockchain research regarding several perspectives of bibliometrics analysis.
Husam Al Jawaheri, Mashael Al Sabah, Yazan Boshmaf, Aiman Erbad
With the rapid increase of threats on the Internet, people are continuously seeking privacy and anonymity. Services such as Bitcoin and Tor were introduced to provide anonymity for online transactions and Web browsing. Due to its pseudonymity model, Bitcoin lacks retroactive operational security, which means historical pieces of information could be used to identify a certain user. We investigate the feasibility of deanonymizing users of Tor hidden services who rely on Bitcoin as a payment method by exploiting public information leaked from online social networks, the Blockchain, and onion websites. This, for example, allows an adversary to link a user with @alice Twitter address to a Tor hidden service with private.onion address by finding at least one past transaction in the Blockchain that involves their publicly declared Bitcoin addresses.
To demonstrate the feasibility of this deanonymization attack, we carried out a real-world experiment simulating a passive, limited adversary. We crawled 1.5K hidden services and collected 88 unique Bitcoin addresses. We then crawled 5B tweets and 1M BitcoinTalk forum pages and collected 4.2K and 41K unique Bitcoin addresses, respectively. Each user address was associated with an online identity along with its public profile information. By analyzing the transactions in the Blockchain, we were able to link 125 unique users to 20 Tor hidden services, including sensitive ones, such as The Pirate Bay and Silk Road. We also analyzed two case studies in detail to demonstrate the implications of the resulting information leakage on user anonymity. In particular, we confirm that Bitcoin addresses should always be considered exploitable, as they can be used to deanonymize users retroactively. This is especially important for Tor hidden service users who actively seek and expect privacy and anonymity.
Husam Al Jawaheri, Mashael Al Sabah, Yazan Boshmaf, Aiman Erbad
With the rapid increase of threats on the Internet, people are continuously seeking privacy and anonymity. Services such as Bitcoin and Tor were introduced to provide anonymity for online transactions and Web browsing. Due to its pseudonymity model, Bitcoin lacks retroactive operational security, which means historical pieces of information could be used to identify a certain user. We investigate the feasibility of deanonymizing users of Tor hidden services who rely on Bitcoin as a payment method by exploiting public information leaked from online social networks, the Blockchain, and onion websites. This, for example, allows an adversary to link a user with @alice Twitter address to a Tor hidden service with private.onion address by finding at least one past transaction in the Blockchain that involves their publicly declared Bitcoin addresses. To demonstrate the feasibility of this deanonymization attack, we carried out a real-world experiment simulating a passive, limited adversary. We crawled 1.5K hidden services and collected 88 unique Bitcoin addresses. We then crawled 5B tweets and 1M BitcoinTalk forum pages and collected 4.2K and 41K unique Bitcoin addresses, respectively. Each user address was associated with an online identity along with its public profile information. By analyzing the transactions in the Blockchain, we were able to link 125 unique users to 20 Tor hidden services, including sensitive ones, such as The Pirate Bay and Silk Road. We also analyzed two case studies in detail to demonstrate the implications of the resulting information leakage on user anonymity. In particular, we confirm that Bitcoin addresses should always be considered exploitable, as they can be used to deanonymize users retroactively. This is especially important for Tor hidden service users who actively seek and expect privacy and anonymity.
This paper presents the implementation of an interactive Zero Knowledge Password authentication scheme for commercial Web sites. In this scheme, a legitimate prover (client) can exchange a secret code (password) with a remote skeptic (server), in order to reveal his/her identification. Based on the validity of the secret code the skeptic then allows the prover to login to the site and access the web services. This paper introduces a protocol that integrates the concepts of Discrete Logarithm Problem (DLP) and Zero-Knowledge Proofs (ZKP). The protocol consists of three entities, namely, the prover, the skeptic, and the facilitator who interact with one another to generate the secret code. When tested, the time to carry out various operations related to this protocol was reasonably small (under 4 seconds). Our scheme is resistant to man-in-the-middle attack and discourages replaying previously intercepted secret codes. We also propose two modifications to our basic scheme to make it resistant against the attack on Integrity and Denial of Service attack (DOS).
Large-scale rumor spreading could pose severe social and economic damages. The emergence of online social networks along with the new media can even make rumor spreading more severe. Effective control of rumor spreading is of theoretical and practical significance. This paper takes the first step to understand how the blockchain technology can help limit the spread of rumors. Specifically, we develop a new paradigm for social networks embedded with the blockchain technology, which employs decentralized contracts to motivate trust networks as well as secure information exchange contract. We design a blockchain-based sequential algorithm which utilizes virtual information credits for each peer-to-peer information exchange. We validate the effectiveness of the blockchain-enabled social network on limiting the rumor spreading. Simulation results validate our algorithm design in avoiding rapid and intense rumor spreading, and motivate better mechanism design for trusted social networks.
Many cryptocurrencies rely on Blockchain for its operation. Blockchain serves as a public ledger where all the completed transactions can be looked up. To place transactions in the Blockchain, a mining operation must be performed. However, due to a limited mining capacity, the transaction confirmation time is increasing. To mitigate this problem many ideas have been proposed, but they all come with own challenges. We propose a novel parallel mining method that can adjust the mining capacity dynamically depending on the congestion level. It does not require an increase in the block size or a reduction of the block confirmation time. The proposed scheme can increase the number of parallel blockchains when the mining congestion is experienced, which is especially effective under DDoS attack situation. We describe how and when the Blockchain is split or merged, how to solve the imbalanced mining problem, and how to adjust the difficulty levels and rewards. We then show the simulation results comparing the performance of binary blockchain and the traditional single blockchain.
Open access
Blockchain Technology Applications and Security
Advanced Steganography and Watermarking Techniques