Smart contracts, as a promising and powerful application on the Ethereum blockchain, have been growing rapidly in the past few years. Since they are highly vulnerable to different forms of attacks, their security becomes a top priority. However, existing security auditing techniques are either limited in fnding vulnerabilities (rely on pre-defned bug paterns) or very expensive (rely on program analysis), thus are insufcient for Ethereum.
This article presents policing challenges of investigating, evidencing and prosecuting organized cybercriminals for the crimes committed using cryptocurrencies such as Bitcoin. A set of best practices is discussed to tackle these challenges in real world investigations. This work is a result of collaboration with a number of stakeholders the policing and judicial ecosystem with the objective of investigating and prosecuting the new generation of organised cybercriminals. Concrete scenarios of using Bitcoins in a range of cybercrimes were developed as part of this project and the devices were analysed to extract evidence to assist prosecution of organised cybercriminals. We have also presented our return of experience for various stages of digital forensics analysis of devices used in Bitcoin transactions.
We provide enhanced security against insider attacks in services that manage extremely sensitive data. One example is a #MeToo use case where sexual harassment complaints are reported but only revealed when another complaint is filed against the same perpetrator. Such a service places tremendous trust on service operators which our work aims to relieve. To this end we introduce a new autonomous data management concept which transfers responsibility for the sensitive data from administrators to secure and verifiable hardware. The main idea is to manage all data access via a cluster of autonomous computation agents running inside Intel SGX enclaves. These EConfidante agents share a secret data key which is unknown to any external entity, including the data service administrators, thus eliminating many opportunities for data exposure. In this paper we describe a detailed design of the EConfidante system, its flow and how it is managed and implemented. Our #MeToo design also uses an immutable distributed ledger which is built using components from a Blockchain framework. We implemented a proof of concept of our system for the #MeToo use case and analyze its security properties and implementation details.
Jialiang Chang, Bo Gao, Hao Xiao, Jun Sun · 6 authors
Ethereum smart contracts are an innovation built on top of the blockchain technology, which provides a platform for automatically executing contracts in an anonymous, distributed, and trusted way. The problem is magnified by the fact that smart contracts, unlike ordinary programs, cannot be patched easily once deployed. It is important for smart contracts to be checked against potential vulnerabilities. In this work, we propose an alternative approach to automatically identify critical program paths (with multiple function calls including inter-contract function calls) in a smart contract, rank the paths according to their criticalness, discard them if they are infeasible or otherwise present them with user friendly warnings for user inspection. We identify paths which involve monetary transaction as critical paths, and prioritize those which potentially violate important properties. For scalability, symbolic execution techniques are only applied to top ranked critical paths. Our approach has been implemented in a tool called sCompile, which has been applied to 36,099 smart contracts. The experiment results show that sCompile is efficient, i.e., 5 seconds on average for one smart contract. Furthermore, we show that many known vulnerabilities can be captured if user inspects as few as 10 program paths generated by sCompile. Lastly, sCompile discovered 224 unknown vulnerabilities with a false positive rate of 15.4% before user inspection.
Domhnall Carlin, Philip OrKane, Sakir Sezer, Jonah Burgess
With the rise in worth and popularity of cryptocurrencies, a new opportunity for criminal gain is being exploited and with little currently offered in the way of defence. The cost of mining (i.e., earning cryptocurrency through CPU-intensive calculations that underpin the blockchain technology) can be prohibitively expensive, with hardware costs and electrical overheads previously offering a loss compared to the cryptocurrency gained. Off-loading these costs along a distributed network of machines via malware offers an instantly profitable scenario, though standard Anti-virus (AV) products offer some defences against file-based threats. However, newer fileless malicious attacks, occurring through the browser on seemingly legitimate websites, can easily evade detection and surreptitiously engage the victim machine in computationally-expensive cryptomining (cryptojacking). With no current academic literature on the dynamic opcode analysis of cryptomining, to the best of our knowledge, we present the first such experimental study. Indeed, this is the first such work presenting opcode analysis on non-executable files. Our results show that browser-based cryptomining within our dataset can be detected by dynamic opcode analysis, with accuracies of up to 100%. Further to this, our model can distinguish between cryptomining sites, weaponized benign sites, de-weaponized cryptomining sites and real world benign sites. As it is process-based, our technique offers an opportunity to rapidly detect, prevent and mitigate such attacks, a novel contribution which should encourage further future work.
Bitcoin is one of the most successful cryptocurrencies. Many people invest money on creating new Bitcoins because of Bitcoin's market increase. They actually buy hardware and power to participate in Bitcoin mining. The market value of Bitcoin has also absorbed cybercriminals. They steal the process cycles from victims' machines and use them in mining activities by malware programs. There have been several security reports about these types of malicious activities. Although there are methods to detect botnets, to the best of our knowledge, none of non-commercial and published papers present detection method for these types. In this paper, we present Botcointrap, a novel approach to identify Bitcoin miner botnets (called Botcoin) based on dynamic analysis of executable binary files. This method benefits from a parameter value that all Botcoins must use across their computations and detect them in the lowest level of execution; therefore, our method can be used to overcome weaknesses of many other approaches. Our evaluation shows that the proposed approach efficiently identifies all simulated Botcoins.
Florentin Guth, Valentin Wüstholz, Maria Christakis, Péter Müller
Smart contracts are programs that manage digital assets according to a certain protocol, expressing for instance the rules of an auction. Understanding the possible behaviors of a smart contract is difficult, which complicates development, auditing, and the post-mortem analysis of attacks. This paper presents the first specification mining technique for smart contracts. Our technique extracts the possible behaviors of smart contracts from contract executions recorded on a blockchain and expresses them as finite automata. A novel dependency analysis allows us to separate independent interactions with a contract. Our technique tunes the abstractions for the automata construction automatically based on configurable metrics, for instance, to maximize readability or precision. We implemented our technique for the Ethereum blockchain and evaluated its usability on several real-world contracts.
Michiel Van Beirendonck, Louis-Charles Trudeau, Pascal Giard, Alexios Balatsoukas‐Stimming
Lyra2REv2 is a hashing algorithm that consists of a chain of individual hashing algorithms and it is used as a proof-of-work function in several cryptocurrencies that aim to be ASIC-resistant. The most crucial hashing algorithm in the Lyra2REv2 chain is a specific instance of the general Lyra2 algorithm. In this work we present the first FPGA implementation of the aforementioned instance of Lyra2 and we explain how several properties of the algorithm can be exploited in order to optimize the design.
Decentralized cryptocurrencies feature the use of blockchain to transfer values among peers on networks without central agency. Smart contracts are programs running on top of the blockchain consensus protocol to enable people make agreements while minimizing trusts. Millions of smart contracts have been deployed in various decentralized applications. The security vulnerabilities within those smart contracts pose significant threats to their applications. Indeed, many critical security vulnerabilities within smart contracts on Ethereum platform have caused huge financial losses to their users. In this work, we present ContractFuzzer, a novel fuzzer to test Ethereum smart contracts for security vulnerabilities. ContractFuzzer generates fuzzing inputs based on the ABI specifications of smart contracts, defines test oracles to detect security vulnerabilities, instruments the EVM to log smart contracts runtime behaviors, and analyzes these logs to report security vulnerabilities. Our fuzzing of 6991 smart contracts has flagged more than 459 vulnerabilities with high precision. In particular, our fuzzing tool successfully detects the vulnerability of the DAO contract that leads to USD 60 million loss and the vulnerabilities of Parity Wallet that have led to the loss of USD 30 million and the freezing of USD 150 million worth of Ether.
Jul 1, 2018·2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData)
The number of deployed Internet of Things (IoT) devices has been increasing rapidly, and security has become significantly important in IoT environments. However, security issues remain challenging due to constraints of IoT devices. One critical security issue is that attacks tamper the firmware of IoT devices. Once the firmware is tampered, it is difficult to notice and recover the tampered firmware. For the integrity of firmware, this paper proposes a new blockchain-based firmware verification system, called Chain Veri. We overcome vulnerabilities of previous studies such as fudging firmware verification. Furthermore, unlike previous studies that presented only the concepts and ideas, we implement Chain Veri from scratch and carry out performance evaluation on storage consumption and CPU cycles to run Chain Veri on IoT device. Our results show that only 1.2MB of storage is used to verify 2,845 devices. Also, 1,692 CPU cycles are to generate a palette in ChainVeri.
Mandrita Banerjee, Junghee Lee, Qian Chen, Kim‐Kwang Raymond Choo
Internet-of-Things (IoT) is increasingly becoming the norm in both civilian and military settings. In this paper, we present a comprehensive security abstraction layer for IoT systems based on blockchain, which provides us a logical view of a system that comprises trusted devices. The goal of the proposed layer is to detect and isolate untrusted devices. The proposed abstraction layer provides three services, namely: authorization, authentication, and auditing by using blockchain and smart contract-based approaches. We adopt a hardware based approach, where dedicated hardware modules are used to monitor the behavior of the firmware without incurring excessive performance overhead.
Jul 1, 2018·2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData)
This publication explores global problem areas where properties offered by Blockchain provide workable solutions for the existing widely unsolved problems of Accountability, Traceability, Identification, Visibility vs. Privacy, and Connection of Non-Deterministic to Deterministic timed events. Using BlockChain-based transactions, we demonstrate that operations related to trust are reducible to five directly implementable cryptographic actions, which then create relationships to five categories of trust that we define in this document. The solution outlined will take the approach that the identified global problems will be solved by blockchain as cybersecurity of the future moves in a direction of individualized transactional-based security & privacy. Developers and organizations looking to implement new solutions or integrate blockchain into existing applications would be interested in this publication. Methods described provide workable solutions for implementing trust relationships using blockchain for positive use cases which can be related directly to cyber security industry solutions.
Kyoungmin Kim, Youngin You, Mookyu Park, Kyungho Lee
Distributed Denial of Service (DDoS) attacks are intense and are targeted to major infrastructure, governments and military organizations in each country. There are a lot of mitigations about DDoS, and the concept of Content Delivery Network (CDN) has been able to avoid attacks on websites. However, since the existing CDN system is fundamentally centralized, it may be difficult to prevent DDoS. This paper describes the distributed CDN Schema using Private Blockchain which solves the problem of participation of existing transparent and unreliable nodes. This will explain DDoS mitigation that can be used by military and government agencies.
Since Bitcoin appeared in 2009, various other cryptocurrencies have also begun to attract attention and supporters. At the same time, because many cryptocurrency investors want to make a profit using cryptocurrencies, cryptocurrency exchanges list them without any special or technical verification. Cryptocurrency developers often write white papers to describe their cryptocurrency's special techniques and expected future worth. However, based solely on the contents of the white paper and/or a surface inspection of the source code, we cannot know if the developer has simply leveraged existing code bases without incorporating novel functionality. In order to address this problem, we present a framework to measure the similarity between the source codes of cryptocurrencies for detecting plagiarism.
Jul 1, 2018·2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData)
Imposter devices pose serious threats. The majority of low-cost edge devices can easily be counterfeited or cloned; the supply chain is insufficiently secure. Reliability of deployed devices can be called into question simply because they might be counterfeit or cloned. It is a must to identify edge devices' sourcing uniquely and verify their validity periodically at runtime. We integrate blockchain technology to authenticate resource-constrained, low-cost edge devices. We use SRAM-based physically unclonable functions (PUFs)to generate unique “digital fingerprints” (device IDs). Registered manufacturers upload a cryptographic hash of each device ID to a “globally accessible” blockchain instance (key-value store or smart contract). While registering/designating a device locally, the end-user verifies whether the hash is present in that blockchain. We utilize a “locally permissioned” blockchain infrastructure (which is still a globally managed blockchain or, in future, a sidechain)to authenticate edge devices for a defense-in-depth approach. Devices can authenticated periodically to prevent device cloning. Target environments can be large and have varied trust among users and lack a specific perimeter; this “local” blockchain methodology is thus pertinent, especially since blockchains gain security over time. Our approach reduces the potential for classes of information leakage and types of sabotage in a critical infrastructure or large-scale deployment (such as a smart city)arising from imposter devices. This methodology protects against such imposters in mobile settings within an IoT infrastructure too.
Physical Unclonable Functions (PUFs) and Hardware Security
Jul 1, 2018·2018 IEEE International Conference on Internet of Things (iThings) and IEEE Green Computing and Communications (GreenCom) and IEEE Cyber, Physical and Social Computing (CPSCom) and IEEE Smart Data (SmartData)
Recently, despite the growing popularity of smart contracts, one serious concern is arising among both industry and academia, that is, whether they work autonomously without human intervention really as intended and, when we are not sure, how we can ensure that contracts meet particular requirements. To resolve this, we propose a new formal approach to smart contract development: Instead of defining contracts just as programs in conventional languages, they should be defined using formal logic so that we can verify whether they meet particular requirements and enforce them if necessary. The primary challenge is that expressive formal logic often turns out to be undecidable and consequently executable programs cannot be generated. As a solution, each contract definition is divided into two layers, namely specification layer in a decidable logic called Linear Dynamic Logic for verification and enforcement of requirements and rule layer for defining implementation details, while the consistency between the two layers is systematically guaranteed. Based on this, it also becomes possible to automatically generate executable contract programs from their formal specification, which leads to improving the trustworthiness of contracts. Evaluation on Hyperledger Fabric shows the feasibility and high effectiveness of our approach.
The increased deployment of Internet of Things (IoT) devices will make them targets for attacks. IoT devices can also be used as tools for committing crimes. In this regard, we propose FIF-IoT - a forensic investigation framework using a public digital ledger to find facts in criminal incidents in IoT-based systems. FIF-IoT collects interactions that take place among various IoT entities (clouds, users, and IoT devices) as evidence and store them securely as transactions in a public, distributed and decentralized blockchain network which is similar to the Bitcoin network. Hence, FIF-IoT eliminates a single entity's control over the evidence storage, avoids single-point-offailure on the storage media, and ensures high availability of evidence. FIF-IoT presents a framework that ensures integrity, confidentiality, anonymity, and non-repudiation of the evidence stored in the public digital ledger. Furthermore, FIF-IoT provides a mechanism to acquire evidence from the ledger and to verify the integrity of the obtained evidence. We present a case study of a forensic investigation to demonstrate that FIF-IoT is secure against evidence tampering. We also implement a prototype to evaluate the performance of FIF-IoT.
The anonymous and decentralized nature of cryptocurrencies has turned them into a powerful weapon in the cyberarsenal of national and international criminal groups by facilitating their illicit activities while evading prosecution. However, despite the numerous challenges that the international law enforcement community faces when investigating cryptocurrencies, a number of investigation opportunities do exist.
Chao Qu, Ming Tao, Jie Zhang, Xiaoyu Hong · 5 authors
With the fast development of mobile Internet, Internet of Things (IoT) has been found in many important applications recently. However, it still faces many challenges in security and privacy. Blockchain (BC) technology, which underpins the cryptocurrency Bitcoin, has played an important role in the development of decentralized and data intensive applications running on millions of devices. In this paper, to establish the relationship between IoT and BC for device credibility verification, we propose a framework with layers, intersect, and self-organization Blockchain Structures (BCS). In this new framework, each BCS is organized by Blockchain technology. We describe the credibility verification method and show how it provide the verification. The efficiency and security analysis are also given in this paper, including its response time, storage efficiency, and verification. The conducted experiments have been shown to demonstrate the validity of the proposed method in satisfying the credible requirement achieved by Blockchain technology and certain advantages in storage space and response time.
AbedAlqader Swedan, Ahmad N. Khuffash, Othman Othman, Ahmed Awad
As technology evolves, more and more devices are connected to the Internet. The popularity and increasing significance of cryptocurriences are drawing attention, and crybercriminals are trying to utilize the resources and steal the processing power of these devices. It is highly likely that there are billions of devices that are maliciously mining cryptocurrency for the benefit of a cybercriminal without noticing the damage they may be causing. This paper is proposed because there is a huge need to professionally defend and protect against the misuse of assets in order to avoid losses, both financially and operationally, and how it is possible to mitigate with this rising trend.
Development of secure methods for storing log files is of tremendous importance for cyber security. One of the first actions by a hacker upon penetrating a machine is editing the log files to remove evidence of their presence. We propose to improve the security of these log files through a blockchain based solution. We show how our solution can be used to help organizations to mutually protect their sensitive log data even if some of them are compromised. Our solution allows data confidentiality between the collaborative parties.
Petar Tsankov, Andrei Dan, Dana Drachsler Cohen, Arthur Gervais · 6 authors
Permissionless blockchains allow the execution of arbitrary programs (called smart contracts), enabling mutually untrusted entities to interact without relying on trusted third parties. Despite their potential, repeated security concerns have shaken the trust in handling billions of USD by smart contracts. To address this problem, we present Securify, a security analyzer for Ethereum smart contracts that is scalable, fully automated, and able to prove contract behaviors as safe/unsafe with respect to a given property. Securify's analysis consists of two steps. First, it symbolically analyzes the contract's dependency graph to extract precise semantic information from the code. Then, it checks compliance and violation patterns that capture sufficient conditions for proving if a property holds or not. To enable extensibility, all patterns are specified in a designated domain-specific language. Securify is publicly released, it has analyzed >18K contracts submitted by its users, and is regularly used to conduct security audits by experts. We present an extensive evaluation of Securify over real-world Ethereum smart contracts and demonstrate that it can effectively prove the correctness of smart contracts and discover critical violations.
Transactions in the cryptocurrency market has been extremely hot in recent years, with the price of cryptocurrency climbing all the way. Hackers have turned their attentions to cryptocurrencies, and have used various means to acquire cryptocurrencies illegally, which caused huge losses to the victims. Some browsers block malicious mining activities from the network protocol level, but they do not have the ability to detect mining samples themselves, and it is difficult to make effective detection of homogenous mining samples of the network layer. To solve these problems, based on the attack pattern of browser mining, the browser-based silent mining features are analyzed, and a method to detect browser silent mining behavior is proposed. This method drives known malicious mining samples, extracts heap snapshots and stack code features of a dynamically running browser, and performs automated detection based on recurrent neural network. By modifying the kernel code of Chrome, a browser-based silent miner detection prototype system BMDetector was designed and implemented. With 1159 samples detected and analyzed, experimental results show that the recognition rate of the original mining sample is 98%, and 92% for the encrypted and confused, which is an effective and feasible method.
The evidence has three properties including relevance, authenticity and legitimacy. For evidence, once implemented, it must not be tampered with and can always be traced back. For trust, the content can be forensics, so the relationship between each other is trustworthy and exchangeable value. Blockchain is a tamper-proof and unforgeable decentralized shared ledger that chunks data blocks chronologically into specific data structures and is cryptographically guaranteed. In this paper, we use the key technologies of blockchain to investigate and achieve collaborative security for IoT devices. This approach uses distributed crowd-sourcing to make tampering of critical data evidence (security). Combination of theoretical research and empirical validation, the paper tries to provide a technical operational and cost-effective solution for collaborative security with blockchain services and promoting the key data stability and self-healing ability.