Ralph Holz, Diego Perino, Matteo Varvello, Johanna Amann · 9 authors
In late 2017, a sudden proliferation of malicious JavaScript was reported on the Web: browser-based mining exploited the CPU time of website visitors to mine the cryptocurrency Monero. Several studies measured the deployment of such code and developed defenses. However, previous work did not establish how many users were really exposed to the identified mining sites and whether there was a real risk given common user browsing behavior. In this paper, we present a retroactive analysis to close this research gap. We pool large-scale, longitudinal data from several vantage points, gathered during the prime time of illicit cryptomining, to measure the impact on web users. We leverage data from passive traffic monitoring of university networks and a large European ISP, with suspected mining sites identified in previous active scans. We corroborate our results with data from a browser extension with a large user base that tracks site visits. We also monitor open HTTP proxies and the Tor network for malicious injection of code. We find that the risk for most Web users was always very low, much lower than what deployment scans suggested. Any exposure period was also very brief. However, we also identify a previously unknown and exploited attack vector on mobile devices.
Tai D. Nguyen, Long Hoang Pham, Jun Sun, Yun Lin · 5 authors
Smart contracts are Turing-complete programs that execute on the infrastructure of the blockchain, which often manage valuable digital assets. Solidity is one of the most popular programming languages for writing smart contracts on the Ethereum platform. Like traditional programs, smart contracts may contain vulnerabilities. Unlike traditional programs, smart contracts cannot be easily patched once they are deployed. It is thus important that smart contracts are tested thoroughly before deployment. In this work, we present an adaptive fuzzer for smart contracts on the Ethereum platform called sFuzz. Compared to existing Solidity fuzzers, sFuzz combines the strategy in the AFL fuzzer and an efficient lightweight multi-objective adaptive strategy targeting those hard-to-cover branches. sFuzz has been applied to more than 4 thousand smart contracts and the experimental results show that (1) sFuzz is efficient, e.g., two orders of magnitude faster than state-of-the-art tools; (2) sFuzz is effective in achieving high code coverage and discovering vulnerabilities; and (3) the different fuzzing strategies in sFuzz complement each other.
Traditional IT security mechanisms are generally not well-suited for IoT devices, where processing and network connectivity should be kept at minimal. Consequently, IoT devices have been recently identified as an easy target for cyber-attacks, like for example on the Mirai botnet Distributed Denial of Service attacks in 2016, where various devices were hacked into and taken over. Different solutions have been developed aiming at guaranteeing the security at both the devices application layer and the network layers. Few succeeded to deliver the flexibility necessary for IoT devices. Even fewer have implemented an effective threats detection system, and just a handful have realised all the previous in a fully decentralised fashion, including this one. This Distributed Ledger Technology (DLT) attestation system is maintained and supported by most, or all, IoT devices because it is based on a light-weight DLT protocol. It comprises of a system for authorisation and authentication for the individual devices as well as includes an anomalies detection system based on smart contracts. A demonstration was built to support a Smart City use case. The objective is to guarantee, in a decentralised manner, the security of low computational power devices executing the sensing function and their connectivity, and therefore the correct functioning of the system. On the demonstrator, the system was ran using DLT supported by the sensors connectivity bridge (built using Raspberry Pi’s). The system proved to be rapid to develop, flexible with regards to systems changes and resilient to attacks to both individual IoT devices and to the DLT.
Andreas Penzkofer, Bartosz Kuśmierz, Angelo Capossele, William H. Sanders · 5 authors
In recent years several distributed ledger technologies based on directed acyclic graphs (DAGs) have appeared on the market. Similar to blockchain technologies, DAG-based systems aim to build an immutable ledger and are faced with security concerns regarding the irreversibility of the ledger state. However, due to their more complex nature and recent popularity, the study of adversarial actions has received little attention so far. In this paper we are concerned with a particular type of attack on the IOTA cryptocurrency, more specifically a Parasite Chain attack that attempts to revert the history stored in the DAG structure, also called the Tangle. \nIn order to improve the security of the Tangle, we present a detection mechanism for this type of attack. In this mechanism, we embrace the complexity of the DAG structure by sampling certain aspects of it, more particularly the distribution of the number of approvers. We initially describe models that predict the distribution that should be expected for a Tangle without any malicious actors. We then introduce metrics that compare this reference distribution with the measured distribution. Upon detection, measures can then be taken to render the attack unsuccessful. We show that due to a form of the Parasite Chain that is different from the main Tangle it is possible to detect certain types of malicious chains. We also show that although the attacker may change the structure of the Parasite Chain to avoid detection, this is done so at a significant cost since the attack is rendered less efficient.
Νικόλαος Αλεξόπουλος, Emmanouil Vasilomanolakis, Stéphane Le Roux, Steven Rowe · 5 authors
Sophisticated mass attacks, especially when exploiting zero-day vulnerabilities, have the potential to cause destructive damage to organizations and critical infrastructure. To timely detect and contain such attacks, collaboration among the defenders is critical. By correlating real-time detection information (threat indicators) from multiple sources, defenders can detect attacks and take the appropriate measures in time. However, although the technical tools to facilitate collaboration exist, real-world adoption of such collaborative security mechanisms is still underwhelming. This is largely due to a lack of trust and participation incentives for companies and organizations. This paper proposes TRIDEnT, a novel collaborative platform that aims to enable parties to exchange network threat indicators, thus increasing their overall detection capabilities. TRIDEnT allows parties that may be in a competitive relationship, to selectively advertise, sell and acquire threat indicators in the form of (near) real-time peer-to-peer streams. To demonstrate the feasibility of our approach, we instantiate our design in a decentralized manner using Ethereum smart contracts and provide a fully functional prototype.
In recent years we have seen a great deal of attention to the topic of security analysis in smart contracts, especially those developed for the Ethereum blockchain. As a result, there seems to be an evergrowing demand for secure smart contracts to protect what could potentially be worth billions. In this paper, we introduce Etherolic as a robust, scalable and efficient fuzzing tool based on concolic testing for performing security analysis on smart contracts. Our approach works based on a successful combination of dynamic taint tracking (DTA) and concolic testing that allows users to analyze the bytecode of smart contracts being run on the Ethereum Virtual Machine. Moreover, Etherolic is not only able to identify a wide spectrum of recent vulnerabilities in smart contracts, but also it generates exploits to trigger unknown errors in the code. In order to demonstrate the usefulness of our approach, we evaluated Etherolic on a crafted benchmark suite, comprising several real-world and synthetic smart contracts along with 98 safety features. The result of our preliminary evaluation reveals 204 security violations in the benchmarks.
Michael Coblenz, Jonathan Aldrich, Brad A. Myers, Joshua Sunshine
Some blockchain programs (smart contracts) have included serious security vulnerabilities. Obsidian is a new typestate-oriented programming language that uses a strong type system to rule out some of these vulnerabilities. Although Obsidian was designed to promote usability to make it as easy as possible to write programs, strong type systems can cause a language to be difficult to use. In particular, ownership, typestate, and assets, which Obsidian uses to provide safety guarantees, have not seen broad adoption together in popular languages and result in significant usability challenges. We performed an empirical study with 20 participants comparing Obsidian to Solidity, which is the language most commonly used for writing smart contracts today. We observed that Obsidian participants were able to successfully complete more of the programming tasks than the Solidity participants. We also found that the Solidity participants commonly inserted asset-related bugs, which Obsidian detects at compile time.
Ajay K. Gogineni, S. Swayamjyoti, Devadatta Sahoo, Κ. K. Sahu · 5 authors
Vulnerability detection and safety of smart contracts are of paramount importance because of their immutable nature. Symbolic tools like OYENTE and MAIAN are typically used for vulnerability prediction in smart contracts. As these tools are computationally expensive, they are typically used to detect vulnerabilities until some predefined invocation depth. These tools require more search time as the invocation depth increases. Since the number of smart contracts is increasing exponentially, it is difficult to analyze the contracts using these traditional tools. Recently a machine learning technique called Long Short Term Memory (LSTM) has been used for binary classification, i.e., to predict whether a smart contract is vulnerable or not. This technique requires nearly constant search time as the invocation depth increases. In the present article, we have shown a multi-class classification, where we classify a smart contract in Suicidal, Prodigal, Greedy, or Normal categories. We used Average Stochastic Gradient Descent Weight-Dropped LSTM (AWD-LSTM), which is a variant of LSTM, to perform classification. We reduced the class imbalance (a large number of normal contracts as compared to other categories) by considering only the distinct opcode combination for normal contracts. We have achieved a weighted average Fbeta score of 90.0%. Hence, such techniques can be used to analyze a large number of smart contracts and help to improve the security of these contracts.
The convergence of fifth-generation (5G) communication and the Internet-of-Things (IoT) has dramatically increased the diversity and complexity of the network. This change diversifies the attacker’s attack vectors, increasing the impact and damage of cyber threats. Cyber threat intelligence (CTI) technology is a proof-based security system which responds to these advanced cyber threats proactively by analyzing and sharing security-related data. However, the performance of CTI systems can be significantly compromised by creating and disseminating improper security policies if an attacker intentionally injects malicious data into the system. In this paper, we propose a blockchain-based CTI framework that improves confidence in the source and content of the data and can quickly detect and eliminate inaccurate data for resistance to a Sybil attack. The proposed framework collects CTI by a procedure validated through smart contracts and stores information about the metainformation of data in a blockchain network. The proposed system ensures the validity and reliability of CTI data by ensuring traceability to the data source and proposes a system model that can efficiently operate and manage CTI data in compliance with the de facto standard. We present the simulation results to prove the effectiveness and Sybil-resistance of the proposed framework in terms of reliability and cost to attackers.
Lo‐Yao Yeh, Peggy Joy Lu, Szu-Hao Huang, Jiun‐Long Huang
IoT devices provide a significant medium for distributed denial-of-service (DDoS) attacks. In 2016, a large-scale DDoS attack, named Dyn, caused massive damage to several well-known companies. One effective countermeasure is observing previous network traffic information or abnormal behavior determined by the host machines and determining the latest DDoS-attack IP addresses. Because of the lack of a fair exchange mechanism, most security operation centers (SOCs) are unwilling to share their real-time DDoS data. In this article, we propose a decentralized DDoS data exchange platform, namely SOChain, using blockchain technology to overcome the trust and fairness issues. The platform incentivizes SOCs through the DDoS_coin token. The more DDoS information an SOC contributes, the more coins it earns. To confirm the validity of uploaded information, we enlist a content verifier to examine uploaded abnormal IP addresses. Moreover, the verifier is incentivized by the DDoS_coin. To decrease the management effort, the entire flow is automatically executed in smart contract deployed onto the blockchain system. To address the issue of privacy in smart contracts, we devise a novel dual-level Bloom filter to enable efficient searches with privacy protection. Herein, a verifiable method is designed without revealing the information to public.
Vyper has been proposed as a new high-level language for Ethereum smart contract development due to numerous security vulnerabilities and attacks witnessed on contracts written in Solidity since the system's inception. Vyper aims to address these vulnerabilities by providing a language that focuses on simplicity, auditability and security. We present a survey where we study how well-known and commonly-encountered vulnerabilities in Solidity feature in Vyper's development environment. We analyze all such vulnerabilities individually and classify them into five groups based on their status in Vyper. To the best of our knowledge, our survey is the first attempt to study security vulnerabilities in Vyper.
Vyper has been proposed as a new high-level language for Ethereum smart\ncontract development due to numerous security vulnerabilities and attacks\nwitnessed on contracts written in Solidity since the system's inception. Vyper\naims to address these vulnerabilities by providing a language that focuses on\nsimplicity, auditability and security. We present a survey where we study how\nwell-known and commonly-encountered vulnerabilities in Solidity feature in\nVyper's development environment. We analyze all such vulnerabilities\nindividually and classify them into five groups based on their status in Vyper.\nTo the best of our knowledge, our survey is the first attempt to study security\nvulnerabilities in Vyper.\n
As the indispensable trading platforms of the ecosystem, hundreds of cryptocurrency exchanges are emerging to facilitate the trading of digital assets. While, it also attracts the attentions of attackers. A number of scam attacks were reported targeting cryptocurrency exchanges, leading to a huge mount of financial loss. However, no previous work in our research community has systematically studied this problem. In this paper, we make the first effort to identify and characterize the cryptocurrency exchange scams. We first identify over 1,500 scam domains and over 300 fake apps, by collecting existing reports and using typosquatting generation techniques. Then we investigate the relationship between them, and identify 94 scam domain families and 30 fake app families. We further characterize the impacts of such scams, and reveal that these scams have incurred financial loss of 520k US dollars at least. We further observe that the fake apps have been sneaked to major app markets (including Google Play) to infect unsuspicious users. Our findings demonstrate the urgency to identify and prevent cryptocurrency exchange scams. To facilitate future research, we have publicly released all the identified scam domains and fake apps to the community.
Increasingly growing Cryptocurrency markets have become a hive for scammers to run pump and dump schemes which is considered as an anomalous activity in exchange markets. Anomaly detection in time series is challenging since existing methods are not sufficient to detect the anomalies in all contexts. In this paper, we propose a novel hybrid pump and dump detection method based on distance and density metrics. First, we propose a novel automatic thresh-old setting method for distance-based anomaly detection. Second, we propose a novel metric called density score for density-based anomaly detection. Finally, we exploit the combination of density and distance metrics successfully as a hybrid approach. Our experiments show that, the proposed hybrid approach is reliable to detect the majority of alleged P & D activities in top ranked exchange pairs by outperforming both density-based and distance-based methods.
Ningyu He, Ruiyi Zhang, Lei Wu, Haoyu Wang · 8 authors
The EOSIO blockchain, one of the representative Delegated Proof-of-Stake (DPoS) blockchain platforms, has grown rapidly recently. Meanwhile, a number of vulnerabilities and high-profile attacks against top EOSIO DApps and their smart contracts have also been discovered and observed in the wild, resulting in serious financial damages. Most of EOSIO's smart contracts are not open-sourced and they are typically compiled to WebAssembly (Wasm) bytecode, thus making it challenging to analyze and detect the presence of possible vulnerabilities. In this paper, we propose EOSAFE, the first static analysis framework that can be used to automatically detect vulnerabilities in EOSIO smart contracts at the bytecode level. Our framework includes a practical symbolic execution engine for Wasm, a customized library emulator for EOSIO smart contracts, and four heuristics-driven detectors to identify the presence of four most popular vulnerabilities in EOSIO smart contracts. Experiment results suggest that EOSAFE achieves promising results in detecting vulnerabilities, with an F1-measure of 98%. We have applied EOSAFE to all active 53,666 smart contracts in the ecosystem (as of November 15, 2019). Our results show that over 25% of the smart contracts are vulnerable. We further analyze possible exploitation attempts against these vulnerable smart contracts and identify 48 in-the-wild attacks (25 of them have been confirmed by DApp developers), resulting in financial loss of at least 1.7 million USD.
Mining pools have become dominant in today's bitcoin mining network, where miners can pool their powers together for reduced variance of block mining and steadier stream of potential income. Along with the continuous evolvement of mining pools are the increasingly intense competitions among them. Recent empirical studies have shown that the distributed denial-of-service (DDoS) attack is one of the most common ways for competing mining pools to sabotage the rivals and earn illegitimate rewards. Existing efforts have been made on using static game models to analyze the interactions between mining pools, and derive the Nash Equilibrium and optimal attacking strategies in a one-time static context. To better understand the impact of such DDoS attacks, in this paper, we take a starkly different approach, and for the first time address the dynamics in mining pool attacks. Specifically, we start by formulating the interactive competition among mining pools as a general-sum stochastic game. Then we propose an efficient Nash learning algorithm to obtain the near optimal attacking strategy that maximizes the expected long-term utility. Our theoretical analysis and extensive experimental results both show that the proposed strategy outperforms the baseline myopic learning algorithm, which only aims at maximizing the revenue in the current time stage. These findings, together with our proposed stochastic game model and learning algorithm, are expected to provide more practical guidelines for mining pools to survive and thrive in the highly-competitive bitcoin ecosystem.
In recent years, smart contracts have suffered major exploits, cost- ing millions of dollars. Unlike traditional programs, smart contracts are deployed on a blockchain. As such, they cannot be modified once deployed. Though various tools have been proposed to detect vulnerable smart contracts, the majority fails to protect vulnera- ble contracts that have already been deployed on the blockchain. Only very few solutions have been proposed so far to tackle the issue of post-deployment. However, these solutions suffer from low precision and are not generic enough to prevent any type of attack. In this work, we introduce ÆGIS, a dynamic analysis tool that protects smart contracts from being exploited during runtime. Its capability of detecting new vulnerabilities can easily be extended through so-called attack patterns. These patterns are written in a domain-specific language that is tailored to the execution model of Ethereum smart contracts. The language enables the description of malicious control and data flows. In addition, we propose a novel mechanism to streamline and speed up the process of managing attack patterns. Patterns are voted upon and stored via a smart contract, thus leveraging the benefits of tamper-resistance and transparency provided by the blockchain. We compare ÆGIS to current state-of-the-art tools and demonstrate that our solution achieves higher precision in detecting attacks. Finally, we perform a large-scale analysis on the first 4.5 million blocks of the Ethereum blockchain, thereby confirming the occurrences of well reported and yet unreported attacks in the wild.
In recent years, smart contracts have suffered major exploits, costing\nmillions of dollars. Unlike traditional programs, smart contracts are deployed\non a blockchain. As such, they cannot be modified once deployed. Though various\ntools have been proposed to detect vulnerable smart contracts, the majority\nfails to protect vulnerable contracts that have already been deployed on the\nblockchain. Only very few solutions have been proposed so far to tackle the\nissue of post-deployment. However, these solutions suffer from low precision\nand are not generic enough to prevent any type of attack.\n In this work, we introduce {\\AE}GIS, a dynamic analysis tool that protects\nsmart contracts from being exploited during runtime. Its capability of\ndetecting new vulnerabilities can easily be extended through so-called attack\npatterns. These patterns are written in a domain-specific language that is\ntailored to the execution model of Ethereum smart contracts. The language\nenables the description of malicious control and data flows. In addition, we\npropose a novel mechanism to streamline and speed up the process of managing\nattack patterns. Patterns are voted upon and stored via a smart contract, thus\nleveraging the benefits of tamper-resistance and transparency provided by the\nblockchain. We compare {\\AE}GIS to current state-of-the-art tools and\ndemonstrate that our solution achieves higher precision in detecting attacks.\nFinally, we perform a large-scale analysis on the first 4.5 million blocks of\nthe Ethereum blockchain, thereby confirming the occurrences of well reported\nand yet unreported attacks in the wild.\n
Christos Karapapas, Iakovos Pittaras, Nikos Fotiou, George C. Polyzos
Decentralized systems, such as distributed ledgers and the InterPlanetary File System (IPFS), are designed to offer more open and robust services. However, they also create opportunities for illegal activities. We demonstrate how these technologies can be used to launch a ransomware as a service campaign. We show that criminals can transact with affiliates and victims without having to reveal their identity. Furthermore, by exploiting the robustness and resilience to churn of IPFS, as well as the decentralized computing capabilities of Ethereum, criminals can remain offline during most procedures, with many privacy guarantees.
Ethereum, the largest blockchain for running smart contracts, charges the people who send transactions to deploy or invoke smart contracts for thwarting resource abuse. The amount of transaction fee depends on the size of that contract and the operations executed by that contract. Consequently, smart contracts with inefficient code will waste money. In this article, we propose and develop the first tool, namedGasChecker, for automatically identifying gas-inefficient code in smart contracts, and conduct the first empirical study on the prevalence of gas-inefficient code in the deployed smart contracts. More precisely, we first summarize ten gas-inefficient programming patterns and propose a new approach based on symbolic execution (SE) to detect them in the bytecode of smart contracts. To make our approach scalable to analyze millions of smart contracts, we parallelize SE by tailoring it to the MapReduce programming model, and propose a new feedback-based load balancing strategy to effectively utilize cloud resources. Extensive experiments show thatGasCheckerscales well with the increase of workers. The empirical study demonstrates that lots of real smart contracts contain various inefficient code. Manual investigation demonstrates that only 2.5 percent of discovered gas-inefficient instances are false positives.
Smart cities have emerged as a hub of intelligent applications (e.g., intelligent transportation systems, smart parking, smart homes, and e-healthcare) to provide ambient-assisted living and quality of experience to wide communities of users. The smooth execution of these applications depends on reliable data transmission between various smart devices and machines. However, the exponential increase in data traffic due to the growing dependency of end users on smart city applications has created various bottlenecks (e.g., channel congestion, manual flow configurations, limited scalability, and low flexibility) on the conventional network backbone, which can degrade the performance of any designed solution in this environment. To mitigate these challenges, SDN emerges as a powerful new technology that provides global visibility of the network by decoupling the control logic from the forwarding devices. The abstraction of network services in SDN architecture provides more flexibility for network administrators to execute various applications. In SDN architecture, the decision making process is handled by a logically centralized controller, which may have a single point of failure. An adversary/ attacker can compromise the controller using different types of attacks (e.g., eavesdropping, man-in-the middle attack, and distributed denial of service) in order to gain total control of the network by updating the flow table entries at the data plane or hindering control plane operations. Therefore, to cope with the aforementioned challenges, new strategies and solutions are required for securing the SDN-enabled network architecture at different planes and their associated interconnections. In this article, various security issues and different attack vectors are discussed along with possible solutions. To mitigate various attacks, BlockSDN, a blockchain as a service framework, for SDN is proposed. The architecture of permissioned blockchain is presented followed by two attack scenarios, 1) a malware compromised switch at the data plane and 2) distributed denial of service attack at the control plane, to demonstrate the applicability of the BlockSDN framework for various future applications. Finally, the open issues and challenges with respect to the design of blockchain solutions for SDN in smart city applications are also discussed.