As of today, most of the Internet of Things (IoT) devices work in a centralized environment. With IoT devices having to execute thousands of operations per second, it has become difficult for centralized systems to handle such platforms. Also, factors like operational and maintenance cost of these server machines and danger of DoS(Denial of Service) attack on such servers has threatened the practitioners to come up with a more distributed way of storing the contents. With its decentralized and privacy preserving features, blockchain technology fits well into the scheme of things. This mitigates the quintessential challenges faced in most of the centralized systems. In this paper, we are focusing on the new firmware update scheme to perform the update operations securely. We propose a blockchain based solution for managing firmware updates in IoT. Improper management of devices and distribution of firmware updates from the device vendor could sabotage the IoT ecosystem. The objective of this proposed scheme is to verify and distribute the firmware binaries securely to the IoT device deployed by the device vendor. The PUSH-based method is used for a firmware update in which verification of firmware is done by Hash Chain. It preserves the integrity of firmware by linking the latest version information by previous versions information with the help of a smart contract mechanism.
Subsequent to the introduction of Bitcoin, the field of cryptocurrency has seen unprecedented growth. Mobile applications known as wallets often facilitate user interaction to these cryptocurrencies. With a perceived real world value these wallets are a target for attackers. Unlike mainstream financial services applications, cryptocurrency wallets are not subject to the same stringent security requirements of their regulated counterparts. In this paper, we examine the security profiles of commonly used Android cryptocurrency applications. We examine these applications for common vulnerabilities outlined by OWASP mobile top 10. We establish a baseline for our tests by evaluating commonly used banking and trading applications. We compare the results from our baseline test and establish the state of security provided by cryptocurrency wallet applications. The paper also examines the possible privacy implications of mobile applications. We report that the conventional financial services applications are only marginally better than cryptocurrency application in security provisions but they provide greater privacy.
This paper reports on the development of a formal symbolic process virtual machine (FSPVM) denoted as FSPVM-E for verifying the reliability and security of Ethereum-based services at the source code level of smart contracts, and a Coq proof assistant is employed for both programming the system and for proving its correctness. The current version of FSPVM-E adopts execution-verification isomorphism, which is an application extension of Curry-Howard isomorphism, as its fundamental theoretical framework to combine symbolic execution and higher-order logic theorem proving. The four primary components of FSPVM-E include a general, extensible, and reusable formal memory framework, an extensible and universal formal intermediate programming language denoted as Lolisa, which is a large subset of the Solidity programming language using generalized algebraic datatypes, the corresponding formally verified interpreter of Lolisa, denoted as FEther, and assistant tools and libraries. The self-correctness of all components is certified in Coq. Currently, FSPVM-E supports the ERC20 token standard, and can automatically and symbolically execute Ethereum-based smart contracts, scan their standard vulnerabilities, and verify their reliability and security properties with Hoare-style logic in Coq. To the best of authors' knowledge, the present work represents the first hybrid formal verification system implemented in Coq for Ethereum smart contracts that is applied at the Solidity source code level.
Venkatachalapathy S. K. Balagurusamy, Christian James Cabral, S. Coomaraswamy, Emmanuel Delamarche · 22 authors
Blockchain technology can increase visibility in supply-chain transactions and lead to more accurate tracing of goods as well as provide evidence of whether a product is authentic or not. A shared, distributed ledger or blockchain alone, however, does not guarantee correct and trustworthy supply-chain traceability. We argue that blockchain technology (and any other digital traceability solution) must be enhanced with methods to “anchor” physical objects into information technology, Internet-of-Things and blockchain systems. Only when trust from the digital domain is extended to the physical domain can the movement of goods be accurately traced (e.g., for callbacks and provenance) and product authenticity determined. In this paper, we introduce the concept of crypto anchors, propose a classification and system architecture, and give implementation examples for different use cases and industries.
Blockchain Technology Applications and Security
Advanced Malware Detection Techniques
Physical Unclonable Functions (PUFs) and Hardware Security
Smart contracts, which are widely recognized as key components of blockchain technology, enable automatic execution of agreements. Since each smart contract is a computer program that autonomously runs on a blockchain platform, their development requires much effort and care compared with the development of more common programs. In this paper, we propose a technique to automatically generate a smart contract from a human-understandable contract document that is created using a document template and a controlled natural language (CNL). The automation is based on a mapping from the document template and the CNL to a formal model that can define the terms and conditions in a contract including temporal constraints and procedures. The formal model is then translated into an executable smart contract. We implemented a toolchain that generates smart contracts of Hyperledger Fabric from template-based contract documents via a formal model. We then evaluated the feasibility of our approach through case studies of two types of real-world contracts in different domains.
Christof Ferreira Torres, Mathis Steichen, Radu State
Modern blockchains, such as Ethereum, enable the execution of so-called smart contracts - programs that are executed across a decentralised network of nodes. As smart contracts become more popular and carry more value, they become more of an interesting target for attackers. In the past few years, several smart contracts have been exploited by attackers. However, a new trend towards a more proactive approach seems to be on the rise, where attackers do not search for vulnerable contracts anymore. Instead, they try to lure their victims into traps by deploying seemingly vulnerable contracts that contain hidden traps. This new type of contracts is commonly referred to as honeypots. In this paper, we present the first systematic analysis of honeypot smart contracts, by investigating their prevalence, behaviour and impact on the Ethereum blockchain. We develop a taxonomy of honeypot techniques and use this to build HoneyBadger - a tool that employs symbolic execution and well defined heuristics to expose honeypots. We perform a large-scale analysis on more than 2 million smart contracts and show that our tool not only achieves high precision, but is also highly efficient. We identify 690 honeypot smart contracts as well as 240 victims in the wild, with an accumulated profit of more than $90,000 for the honeypot creators. Our manual validation shows that 87% of the reported contracts are indeed honeypots.
Paul J. Taylor, Tooska Dargahi, Ali Dehghantanha, Reza M. Parizi · 5 authors
Since the publication of Satoshi Nakamoto's white paper on Bitcoin in 2008, blockchain has (slowly) become one of the most frequently discussed methods for securing data storage and transfer through decentralized, trustless, peer-to-peer systems. This research identifies peer-reviewed literature that seeks to utilize blockchain for cyber security purposes and presents a systematic analysis of the most frequently adopted blockchain security applications. Our findings show that the Internet of Things (IoT) lends itself well to novel blockchain applications, as do networks and machine visualization, public-key cryptography, web applications, certification schemes and the secure storage of Personally Identifiable Information (PII). This timely systematic review also sheds light on future directions of research, education and practices in the blockchain and cyber security space, such as security of blockchain in IoT, security of blockchain for AI data, and sidechain security.
Open access
Blockchain Technology Applications and Security
Advanced Malware Detection Techniques
Advanced Steganography and Watermarking Techniques
Smart contracts are programs running on top of blockchain platforms. They interact with each other through well-defined interfaces to perform financial transactions in a distributed system with no trusted third parties. But these interfaces also provide a favorable setting for attackers, who can exploit security vulnerabilities in smart contracts to achieve financial gain. This paper presents SmartScopy, a system for automatic synthesis of adversarial contracts that identify and exploit vulnerabilities in a victim smart contract. Our tool explores the space of \emph{attack programs} based on the Application Binary Interface (ABI) specification of a victim smart contract in the Ethereum ecosystem. To make the synthesis tractable, we introduce \emph{summary-based symbolic evaluation}, which significantly reduces the number of instructions that our synthesizer needs to evaluate symbolically, without compromising the precision of the vulnerability query. Building on the summary-based symbolic evaluation, SmartScopy further introduces a novel approach for partitioning the synthesis search space for parallel exploration, as well as a lightweight deduction technique that can prune infeasible candidates earlier. We encoded common vulnerabilities of smart contracts in our query language, and evaluated SmartScopy on the entire data set from etherscan with $>$25K smart contracts. Our experiments demonstrate the benefits of summary-based symbolic evaluation and show that SmartScopy outperforms two state-of-the-art smart contracts analyzers, Oyente and Contractfuzz, in terms of running time, precision, and soundness. Furthermore, running on recent popular smart contracts, SmartScopy uncovers 20 vulnerable smart contracts that contain the recent BatchOverflow vulnerability and cannot be precisely detected by existing tools.
In the pharmaceutical industry, process validation tasks are based on the raw data and its derived analytical results generated from the process. Process validation failure affects both patient safety and the economic success of the manufacturing company. Hence, data integrity is highly critical in this area. Regulatory agencies, such as the Food and Drug Administration (FDA), reacted to past data integrity breaches by publishing new guidelines on data integrity for the correct handling of data in the pharmaceutical context. In this contribution, we want to show how data integrity can be improved on a technological level, removing the need for trusted third parties and centralized systems for this task. Therefore, we implemented an approach that uses existing tools, currently mostly used by software developers, and combined them with a new smart contract built on top of the Ethereum blockchain. In a case study, we test how data manipulation or backdating of results can be easily detected and how regulatory agencies can audit the complete data flow from the regulatory report back to the original raw data. The results of this contribution outline a possible road map for the development of production-ready tools, such as versioned database systems that natively interoperate with distributed ledgers. This will improve the trustworthiness of pharmaceutical manufacturing data by both protecting the intellectual property of the industrial company and improving the safety of the patients. <i>LAY ABSTRACT:</i> In the pharmaceutical industry, economically driven manufacturing companies are regulated and controlled by regulatory agencies. The pharmaceutical manufacturing companies need to produce large amounts of process and analytical data to show that their products are safe for patients. As the decisions of the regulatory agencies rely on this data, manufacturing companies need to prove how their generated data can be protected from technical breaches or data manipulation. As of today, the available technical solutions to provide data integrity are not working well enough. Regulatory agencies have published multiple documents highlighting the current data integrity issues. In this contribution, we show how blockchain, a technology that multiple cryptocurrencies like Bitcoin rely on, can help to improve the integrity of manufacturing data and data science analysis procedures. Therefore, we combined a smart contract on the Ethereum blockchain with tools currently mostly used by software developers. The presented workflow shows how data integrity can be guaranteed on a technological level without the need for trusted third parties.
In this paper we revisit the mining strategies in proof of work based cryptocurrencies and propose two strategies, we call smart and smarter mining, that in many cases strictly dominate honest mining. In contrast to other known attacks, like selfish mining, which induce zero-sum games among the miners, the strategies proposed in this paper increase miners' profit by reducing their variable costs (i.e., electricity). Moreover, the proposed strategies are viable for much smaller miners than previously known attacks, and surprisingly, an attack performed by one miner is profitable for all other miners as well. While saving electricity power is very encouraging for the environment, it is less so for the coin's security. The smart/smarter strategies expose the coin to under 50\% attacks and this vulnerability might only grow when new miners join the coin as a response to the increase in profit margins induced by these strategies.
Attacks on transactions of Ethereum could be dangerous because they could lead to a big loss of money. There are many tools detecting vulnerabilities in smart contracts trying to avoid potential attacks. However, we found that there are still many missed vulnerabilities in contracts. Motivated by this, we propose a methodology to reinforce EVM to stop dangerous transactions in real time even when the smart contract contains vulnerabilities. Basically, the methodology consists of three steps: monitoring strategy definition, opcode-structure maintenance and EVM instrumentation. Monitoring strategy definition refers to the specific rule to test whether there is a dangerous operation during transaction execution. Opcode-structure maintenance is to maintain a structure to store the rule related opcodes and analyze it before an operation execution. EVM instrumentation inserts the monitoring strategy, interrupting mechanism and the opcode-structure operations in EVM source code. For evaluation, we implement EVM*on js-evm, a widely-used EVM platform written in javascript. We collect 10 contracts online with known bugs and use each contract to execute a dangerous transaction, all of them have been interrupted by our reinforced EVM*, while the original EVM permits all attack transactions. For the time overhead, the reinforced EVM*is slower than the original one by 20-30%, which is tolerable for the financial critical applications.
Notice of Violation of IEEE Publication Principles"AQUACHAIN -Water Supply-Chain Management using Distributed Ledger Technology"by Nibi Maouriyan, A.G. Achudh Krishnain the Proceedings of the 3rd International Conference on Computing and Communications Technologies (ICCCT), 2019, pp. 204-207After careful and considered review of the content and authorship of this paper by a duly constituted expert committee, this paper has been found to be in violation of IEEE’s Publication Principles.This paper is a duplication of the original text from the paper cited below. The original text was copied without attribution (including appropriate references to the original author(s) and/or paper title) and without permission.Due to the nature of this violation, reasonable effort should be made to remove all past references to this paper, and future references should be made to the following article:"Blockchain-based Traceability in Agri-Food Supply Chain Management: A Practical Implementation"by Miguel Pincheira Caro, Muhammad Salek Ali, Massimo Vecchio, Raffaele Giaffredain the Proceedings of the IoT Vertical and Topical Summit on Agriculture - Tuscany (IOT Tuscany), 2018Water shortage is fast becoming one of the biggest crises of this century. The recent, exponential rise in adoption of the most disparate Internet of Things (IoT) devices and technologies has reached also Water supply chains, drumming up substantial research and innovation interest towards developing reliable, auditable and transparent traceability systems. Current IoT-based traceability and provenance systems for water supply chains are built on top of centralized infrastructures and this leaves room for unsolved issues and major concerns, including data integrity, tampering and single points of failure. Blockchains, the distributed ledger technology underpinning cryptocurrencies such as Bitcoin, represent a new and innovative technological approach to realizing decentralized trustless systems. This will also eliminate corruption due to unmaintained record of sources. Indeed, the inherent properties of this digital technology provide fault-tolerance, immutability, transparency and full traceability of the stored transaction records, as well as coherent digital representations of physical assets and autonomous transaction executions. This paper presents Aqua-chain, a fully decentralized, blockchain-based traceability solution for Water supply chain management, able to seamless integrate IoT devices producing and consuming digital data along the chain. To effectively assess Aqua-chain, first, we defined a classical use-case within the given vertical domain, namely from-supplier-to-buyer. Then, we developed and deployed such use-case, achieving traceability using blockchain implementation, Ethereum. Finally, we evaluated and compared the performance deployments, in terms of latency, CPU, and network usage, also highlighting its main pros and cons.
Radhesh Krishnan Konoth, Rolf van Wegberg, Veelasha Moonsamy, Herbert Bos
In this study, we examine the behavior and profitability of modern malware that mines cryptocurrency. Unlike previous studies, we look at the cryptocurrency market as a whole, rather than just Bitcoin. We not only consider PCs, but also mobile phones, and IoT devices. In the past few years, criminals have attacked all these platforms for the purpose of cryptocurrency mining. The question is: how much money do they make? It is common knowledge that mining Bitcoin is now very difficult, so why do the criminals even target low-end devices for mining purposes? By analyzing the most important families of malicious cryptocurrency miners that were active between 2014 and 2017, we are able to report how they work, which currency they mine, and how profitable it is to do so. We will see that the evolution of the cryptocurrency market with many new cryptocurrencies that are still CPU minable and offer better privacy to criminals and have contributed to making mining malware attractive again -- with attackers generating a continuous stream of profit that in some cases may reach in the millions.
With the rapid development and application of the Internet, the amount of electronic data based on computer and computer network has exploded. Specific and effective electronic data play an increasingly important role in proving the facts of a case. The most important issue of electronic evidence is trust and security. However, electronic evidence is stored in the centralized database at present, and there are data security and trust problems. This paper proposes an electronic evidence preservation model based on blockchain to ensure the data safe and reliable.
We study selfish mining in Ethereum. The problem is combinato-rially more complex than in Bitcoin because of major differences in the reward system and a different difficulty adjustment formula. Equivalent strategies in Bitcoin do have different profitabilities in Ethereum. The attacker can either broadcast his fork one block by one, or keep them secret as long as possible and publish them all at once at the end of an attack cycle. The first strategy is damaging for substantial hashrates, and we show that the second strategy is even worse. This confirms what we already proved for Bitcoin: Selfish mining is most of all an attack on the difficulty adjustment formula. We show that the current reward for signaling uncle blocks is a weak incentive for the attacker to signal blocks. We compute the profitabilities of different strategies and find out that for a large parameter space values, strategies that do not signal blocks are the best ones. We compute closed-form formulas for the apparent hashrates for these strategies and compare them. We use a direct combinatorics analysis with Dyck words to find these closed-form formulas.
Crypto-mining attacks have emerged as a new generation of web-based attacks which have seen cybercriminals eschew the infamous crypto ransomware. The watering hole attack vector has by far been the most widely employed attack methodology but it faces the task of luring the victim to the infected web resources. However, cryptojacking injection presents a paradigm shift to web-based crypto-mining attacks in that it eliminates the need for a pivotal third-party such as the exploitable web server. Thus, instead of attacking credit card and other private information of e-commerce users, attackers seek to maliciously abuse a victim’s CPU to generate cryptocurrency. In this paper, we investigate and evaluate cryptojacking injection – a state-of-the-art web-centric attack vector in the crypto-mining attacks landscape. We formulate an attack model based on finite state machines which depicts the various breaches of confidentiality, integrity and availability in the web system as the attack progresses. We show how this new attack vector attacks some of the core components of e-commerce (URL, HTTP and HTML) to generate Monero crypto currency from benign web users. We evaluate our modeling approach with a series of experiments with two attack scenarios using different operating systems. Results show that the attack is indeed cross-platform and feasible on any operating system of a browser-capable device. We analyze the generated network traffic during the attack and draw features such as URLs and the parsed files, the associated cryptographic hashes, and the IP addresses of the crypto-mining domains. These, together with host-based features such as exhaustive CPU usage can be used as indicators of compromise and subsequently act as feed into intrusion detection systems.
The paper presents a BlockChain based distributed framework to manage Antimalware database efficiently. With increased efficiency in computation and network connectivity, systems are delivering better performances day by day. However, the opportunities of initiating malicious activities through malwares are being increased as well. In this work, we propose a distributed framework of Antimalware database management using customized BlockChain that enhances system security by initiating distributed malware prevention program. Due to distributed in nature, BlockChain can ensure better data management without involving any third party.
Mobile Network Operator (MNO) and Mobile Virtual Network Operator (MVNO) evidence have become an important evidentiary focus in the courtroom. This type of evidence is routinely produced as business records under U.S. Federal Rules of Evidence for use in the emerging discipline of Forensic Cell Site Analysis. The research was undertaken to determine if evidence produced by operators should be classified as digital evidence and, if so, what evidence handling methodologies are appropriate to ensure evidence integrity. This research project resulted in the creation of a method of determining if business records produced by MNO/MVNO organizations are digital evidence and whether evidentiary integrity is maintained in the conveyance of evidence between MNO/MVNO records custodians, law enforcement investigators and attorneys in criminal and civil cases. Block-chain based Distributed Ledger Technology was examined as a feasible evidence integrity maintenance solution.
Seung Min Kim, Tacklim Lee, Seunghwan Kim, Lee Won Park · 5 authors
The Smart Grid has emerged to address the shortcomings of one-way existing grid systems, and is the next generation power grid infrastructure that applies smart ICT (Information Communication Technology) to existing grid. The Smart Grid is expected to greatly improve the efficiency and reliability of future power systems with the demand for renewable energy resources. However, because major power facilities are interconnected through communication networks, Smart Grid’s cyber security is becoming an important issue. Cyber-attacks by malicious intruders can lead to serious incidents such as massive outages and the destruction of power network infrastructure, since the cyber-attacks can damage energy data, starting with personal information leakage from grid members. Therefore, as a solution to this issue we will suggest a secure smart energy management system based on the blockchain. The blockchain is a distributed data processing technology in which all users participating in the network distribute and store data. Applying blockchain technology to the Smart Grid will enable more secure management of energy data, and furthermore, it will contribute to the development of the future smart energy industry in the future.
In Software-Defined Networking (SDN), Northbound Interface provides APIs, which allow network applications to communicate with SDN controllers. However, a malicious application can access to SDN controller and perform illegal activities via these APIs. Although some studies proposed AAA (Authentication, Authorization, Accounting) systems to protect SDN controllers from malicious applications, their proposed systems also exist several limitations. Attackers can compromise a system, then modify its database or files to gain higher privileges. This system can be taken down because of Single Point of Failure threat. To enhance security for the Northbound interface, we propose a novel system using blockchain, namely BlockAS. It is used to authenticate, authorize and monitor accessing critical controller resources from applications. Specifically, BlockAS leverages blockchain features to maintain the immutability and decentralization of credential data. Our proposed system has five key properties: immutability of database, decentralization, authentication, authorization, and accounting to enhance security for SDN controller and its offered services.