Giuseppe Destefanis, Michele Marchesi, Marco Ortu, Roberto Tonelli · 6 authors
Smart Contracts have gained tremendous popularity in the past few years, to the point that billions of US Dollars are currently exchanged every day through such technology. However, since the release of the Frontier network of Ethereum in 2015, there have been many cases in which the execution of Smart Contracts managing Ether coins has led to problems or conflicts. Compared to traditional Software Engineering, a discipline of Smart Contract and Blockchain programming, with standardized best practices that can help solve the mentioned problems and conflicts, is not yet sufficiently developed. Furthermore, Smart Contracts rely on a non-standard software life-cycle, according to which, for instance, delivered applications can hardly be updated or bugs resolved by releasing a new version of the software. In this paper we advocate the need for a discipline of Blockchain Software Engineering, addressing the issues posed by smart contract programming and other applications running on blockchains.We analyse a case of study where a bug discovered in a Smart Contract library, and perhaps "unsafe" programming, allowed an attack on Parity, a wallet application, causing the freezing of about 500K Ethers (about 150M USD, in November 2017). In this study we analyze the source code of Parity and the library, and discuss how recognised best practices could mitigate, if adopted and adapted, such detrimental software misbehavior. We also reflect on the specificity of Smart Contract software development, which makes some of the existing approaches insufficient, and call for the definition of a specific Blockchain Software Engineering.
Reproducibility is the ability of recreating identical binaries under pre-defined build environments. Due to the need of quality assurance and the benefit of better detecting attacks against build environments, the practice of reproducible builds has gained popularity in many open-source software repositories such as Debian and Bitcoin. However, identifying the unreproducible issues remains a labour intensive and time consuming challenge, because of the lacking of information to guide the search and the diversity of the causes that may lead to the unreproducible binaries. In this paper we propose an automated framework called RepLoc to localize the problematic files for unreproducible builds. RepLoc features a query augmentation component that utilizes the information extracted from the build logs, and a heuristic rule-based filtering component that narrows the search scope. By integrating the two components with a weighted file ranking module, RepLoc is able to automatically produce a ranked list of files that are helpful in locating the problematic files for the unreproducible builds. We have implemented a prototype and conducted extensive experiments over 671 real-world unreproducible Debian packages in four different categories. By considering the topmost ranked file only, RepLoc achieves an accuracy rate of 47.09%. If we expand our examination to the top ten ranked files in the list produced by RepLoc, the accuracy rate becomes 79.28%. Considering that there are hundreds of source code, scripts, Makefiles, etc., in a package, RepLoc significantly reduces the scope of localizing problematic files. Moreover, with the help of RepLoc, we successfully identified and fixed six new unreproducible packages from Debian and Guix.
Due to their rapid growth and deployment, Internet of things (IoT) devices have become a central aspect of our daily lives. However, they tend to have many vulnerabilities which can be exploited by an attacker. Unsupervised techniques, such as anomaly detection, can help us secure the IoT devices. However, an anomaly detection model must be trained for a long time in order to capture all benign behaviors. This approach is vulnerable to adversarial attacks since all observations are assumed to be benign while training the anomaly detection model. In this paper, we propose CIoTA, a lightweight framework that utilizes the blockchain concept to perform distributed and collaborative anomaly detection for devices with limited resources. CIoTA uses blockchain to incrementally update a trusted anomaly detection model via self-attestation and consensus among IoT devices. We evaluate CIoTA on our own distributed IoT simulation platform, which consists of 48 Raspberry Pis, to demonstrate CIoTA's ability to enhance the security of each device and the security of the network as a whole.
Danda B. Rawat, Laurent Njilla, Kevin Kwiat, Charles Kamhoua
In this paper, we design, develop, and evaluate a novel information sharing (iShare) framework for cybersecurity with the goal of protecting confidential information and networked infrastructures from future cyber-attacks. The proposed iShare framework leverages the Blockchain concept used in Bitcoin systems where multiple organizations/agencies participate for information sharing (without violating their privacy) to secure and monitor their cyberspace. Note that the Bitcoin for financial transactions has already demonstrated that there is a trusted, auditable sharing with peer-to-peer communications accompanied by a public ledger. The main aim of the Blockchain-based iShare framework is to constantly collect high-resolution, cyber-attack information across organizational boundaries of which the organizations have no specific knowledge or control over any other organizations' data or damage caused by cyber-attacks. In the proposed iShare framework, the decentralized nature of the Blockchain and digitally signed transactions ensure that an adversary cannot pose as a legitimate organization/user or cannot control/hamper the system because of the digital-signatures and cannot learn anything from the public ledger that has just hashed pointers. Moreover, we analyze the security attacks by outsiders (not participating in the iShare) using a Stackelberg game.
While the rapid development of IoT devices is changing our daily lives, some particular issues hinder the massive deployment of IoT devices. For example, current network ID management system cannot handle so many new terminals; there is no agreed security standards for IoT manufacturers to follow when designing their products. The whole IoT industry is expecting the breakthrough in network infrastructure and the development of novel security mechanisms that can enable the flexible, secure and reliable access and management of IoT devices. Bitcoin, first released in 2009, breeds the decentralized Blockchain technology. The decentralization, anonymity and proof of security characteristics of Blockchain can prevent collusion and single point failure of a centralized server. We believe that the application of Blockchain into the IoT system can clear the obstacles facing the development of IoT architecture and security. To this end, we propose an out-of-band two-factor authentication scheme for IoT devices based on Blockchain infrastructure. We implemented the IoT and Blockchain integrated system with Eris Blockchain and equivalent computing devices to emulate IoT devices. The overheads to run Blockchain and smart contract services on the emulator devices are measured. The BeagleBone Black and Raspberry Pi 3 nodes have an average memory usage of 29.5M, and the CPU usage of 29.55% and 13.35%, respectively.
Smart contracts---stateful executable objects hosted on blockchains like Ethereum---carry billions of dollars worth of coins and cannot be updated once deployed. We present a new systematic characterization of a class of trace vulnerabilities, which result from analyzing multiple invocations of a contract over its lifetime. We focus attention on three example properties of such trace vulnerabilities: finding contracts that either lock funds indefinitely, leak them carelessly to arbitrary users, or can be killed by anyone. We implemented MAIAN, the first tool for precisely specifying and reasoning about trace properties, which employs inter-procedural symbolic analysis and concrete validator for exhibiting real exploits. Our analysis of nearly one million contracts flags 34,200 (2,365 distinct) contracts vulnerable, in 10 seconds per contract. On a subset of3,759 contracts which we sampled for concrete validation and manual analysis, we reproduce real exploits at a true positive rate of 89%, yielding exploits for3,686 contracts. Our tool finds exploits for the infamous Parity bug that indirectly locked 200 million dollars worth in Ether, which previous analyses failed to capture.
It is undeniable that artificial intelligence (AI) and blockchain concepts are spreading at a phenomenal rate. Both technologies have distinct degree of technological complexity and multi-dimensional business implications. However, a common misunderstanding about blockchain concept, in particular, is that blockchain is decentralized and is not controlled by anyone. But the underlying development of a blockchain system is still attributed to a cluster of core developers. Take smart contract as an example, it is essentially a collection of codes (or functions) and data (or states) that are programmed and deployed on a blockchain (say, Ethereum) by different human programmers. It is thus, unfortunately, less likely to be free of loopholes and flaws. In this article, through a brief overview about how artificial intelligence could be used to deliver bug-free smart contract so as to achieve the goal of blockchain 2.0, we to emphasize that the blockchain implementation can be assisted or enhanced via various AI techniques. The alliance of AI and blockchain is expected to create numerous possibilities.
Roberto Tonelli, G. A. Pierro, Marco Ortu, Giuseppe Destefanis
Smart contracts (SC) are software programs that reside and run over a blockchain. The code can be written in different languages with the common purpose of implementing various kinds of transactions onto the hosting blockchain. They are ruled by the blockchain infrastructure with the intent to automatically implement the typical conditions of traditional contracts. Programs must satisfy context-dependent constraints which are quite different from traditional software code. In particular, since the bytecode is uploaded in the hosting blockchain, the size, computational resources, interaction between different parts of the program are all limited. This is true even if the specific programming languages implement more or less the same constructs as that of traditional languages: there is not the same freedom as in normal software development. The working hypothesis used in this article is that Smart Contract specific constraints should be captured by specific software metrics (that may differ from traditional software metrics). We tested this hypothesis on 85K Smart Contracts written in Solidity and uploaded on the Ethereum blockchain. We analyzed Smart Contracts from two repositories "Etherscan" and "Smart Corpus" and we computed the statistics of a set of software metrics related to Smart Contracts and compared them to the metrics extracted from more traditional software projects. Our results show that generally, Smart Contract metrics have more restricted ranges than the corresponding metrics in traditional software systems. Some of the stylized facts, like power law in the tail of the distribution of some metrics, are only approximate but the lines of code follow a log-normal distribution which reminds us of the same behaviour already found in traditional software systems.
The conventional grid and power system infrastructure is monitored using a centralized approach. Wherein remote terminal units are governed using a master control facility. In the wake of dispersed generations where every consumer is also becoming a producer with solar powered PV panels or wind, managing power is becoming a difficult task. This situation can become unmanageable in an event of cyber-attack on a smart grid.The objective of this paper is to use Block Chain Technology (BCT) to manage data of a power system. Initially, we will consider an attack on a switch of SMIB and issues arising out of it. Then we model two more cases where, BCT will aid in management of power.
Ence Zhou, Hua Song, Bingfeng Pi, Jun Sun · 7 authors
Currently, Bitcoin and Ethereum are the two most popular cryptocurrency systems, especially Ethereum. It permits complex financial transactions or rules through scripts, which is called smart contracts. Since Ethereum smart contracts hold millions of dollars, their execution correctness is crucial against attacks which aim at stealing the assets. In this paper, we proposed a security assurance method for smart contract source code to find potential security risks. It contains two main functions, the first is syntax topological analysis of smart contract invocation relationship, to help developers to understand their code structure clearly; the second is logic risk (which may lead to vulnerabilities) detection and location, and label results on topology diagram. For developers' convenience, we have built a static analysis tool called SASC to generate topology diagram of invocation relationship and to find potential logic risks. We have made an evaluation on 2,952 smart contracts, experiment results proved that our method is intuitive and effective.
Blockchain technology has attracted increasing attention in recent years. One reason of this new trend is the introduction of on-chain smart contracts enabling the implementation of decentralized applications in trust-less environments. Along with its adoption, attacks exploiting smart contract vulnerabilities are inevitably growing. To counter these attacks and avoid breaches, several approaches have been explored such as documenting vulnerabilities or model checking using formal verification. However, these approaches fail to capture the Blockchain and users behavior properties. In this paper, we propose a novel formal modeling approach to verify a smart contract behavior in its execution environment. We apply this formalism on a concrete smart contract example and analyze its breaches with a statical model checking approach.
Shelly Grossman, Ittai Abraham, Guy Golan-Gueta, Yan Michalevsky · 7 authors
Callbacks are essential in many programming environments, but drastically\ncomplicate program understanding and reasoning because they allow to mutate\nobject's local states by external objects in unexpected fashions, thus breaking\nmodularity. The famous DAO bug in the cryptocurrency framework Ethereum,\nemployed callbacks to steal $150M. We define the notion of Effectively Callback\nFree (ECF) objects in order to allow callbacks without preventing modular\nreasoning.\n An object is ECF in a given execution trace if there exists an equivalent\nexecution trace without callbacks to this object. An object is ECF if it is ECF\nin every possible execution trace. We study the decidability of dynamically\nchecking ECF in a given execution trace and statically checking if an object is\nECF. We also show that dynamically checking ECF in Ethereum is feasible and can\nbe done online. By running the history of all execution traces in Ethereum, we\nwere able to verify that virtually all existing contracts, excluding the DAO or\ncontracts with similar known vulnerabilities, are ECF. Finally, we show that\nECF, whether it is verified dynamically or statically, enables modular\nreasoning about objects with encapsulated state.\n
Traditional database with no prior security measures is becoming challenging in the era of data technology. Database storage on a central location with single point of failure and vulnerable to cyber attacks is getting exposed to big risk of being hacked with the evolution of powerful machines and modern hacking techniques. Since its commencement, the BlockChain technology has shown a promising performance for application buildup in diversed fields of life from cryptocurrency to smart contracts and decentralized applications. Although multiple studies on privacy, data confidentiality and security issues of BlockChain are performed but a systematic examination is still needs attention. In this thesis work we conduct a systematic study about the vulnerabilities of BlockChain system and review the security enhancement solutions that may point to a good future direction for further research into the area of BlockChain technology and its applications. Smart contracts are self-executable objects hosted on the 2nd generation blockchain like Ethereum, carry billions of SEK worth of cryptocoins and cannot be updated once deployed. Smart contracts are generally considered secure objects but the systematic analysis of technology and source code exposes a new class of vulnerabilities which are more likely an ethical aspect of programming than the software coding errors. Besides the literature review we empower our results with a static code analysis especially with the perspective of cyber forensics.
matthew baldree, paul widhalm, brandon hill, Matteo Ortisi
In this paper, we present a tool that provides trading recommendations for cryptocurrency using a stochastic gradient boost classifier trained from a model labeled by technical indicators. The cryptocurrency market is volatile due to its infancy and limited size making it difficult for investors to know when to enter, exit, or stay in the market. Therefore, a tool is needed to provide investment recommendations for investors. We developed such a tool to support one cryptocurrency, Bitcoin, based on its historical price and volume data to recommend a trading decision for today or past days. This tool is 95.50% accurate with a standard deviation of 0.54%. From our analysis, we conclude that Bitcoin is a unique asset with similarities to gold. As a young asset, it lacks economic fundamentals making it very difficult to predict. By leveraging technical momentum indicators to provide buy, sell, and hold markers or labels, a tool can be developed that performs as good or better than a buy and hold trading strategy in a bear market, bull market or both markets.
Open access
Advanced Steganography and Watermarking Techniques
Defending against distributed denial of service (DDoS) attacks in the Internet is a fundamental problem. One practical approach to addressing DDoS attacks is to redirect all destination (e.g., via DNS or BGP) to a third-party, DDoS protection-as-a-service provider (e.g., Cloudflare and Akamai), which is well provisioned and equipped with proprietary filtering mechanisms to remove attack traffic before passing the remaining traffic to the destination. Although such an approach is appealing, as it requires no modification to the existing Internet infrastructure and can scale to handle very large attacks, recent industrial interviews with more than 100 interviewees from over 10 industry segments reveal that this approach alone is not sufficient, especially for large organizations (e.g., Web hosting companies and government) that cannot afford to allow third-parity security-service providers to terminate their network connections. Instead, these organizations have to rely on their ISPs to filter attack traffic. In this paper, we discuss the challenges faced by the ISPs in order to disrupt the Internet security-service market and sketch our solutions, powered by smart contracts.
Husam Basil Al Jawaheri, Mashael Al Sabah, Yazan Boshmaf
Recently, more than 100,000 cases for ransomware attacks were reported in the Middle East, Turkey and Africa region [2]. Ransomware is a malware category that limits the access of users to their files by encrypting them. This malware requires victims to pay in order to get access to the decryption keys. In order to remain anonymous, ransomware requires victims to pay through the Bitcoin network. However, due to an inherent weakness in Bitcoin's anonymity model, it is possible to link identities hidden behind Bitcoin addresses by analyzing the blockchain, Bitcoin's public ledger where all of the history of transactions is stored. In this work, we investigate the feasibility of linking users, as identities represented by Bitcoin's public addresses, to addresses owned by entities operating ransomware. To demonstrate how such linking is possible, we crawled BitcoinTalk, a famous forum for Bitcoin related discussions, and a subset of Twitter public datasets. Out of nearly 5B tweets and 1M forum pages, we found 4.2K and 41K unique online identities, respectively, along with their public personal information and Bitcoin addresses. Then we expanded these datasets of users by using closure analysis, where a Bitcoin address is used to identify a set of other addresses that are highly likely to be controlled by the same user. This allowed us to collect thousands more Bitcoin addresses for the users. By analyzing transactions in the blockchain, we were able to link 6 unique identities to different ransomware operators including CryptoWall [1] and WannaCry [3]. Moreover, in order to get insights into the economy and activity of these Ransomware addresses, we analyzed the money flow of these addresses along with the timestamps associated with transactions involving them. We observed that ransomware addresses were active from 2014 to 2017, with an average lifetime of nearly 62 days. While some addresses were only active during a certain year, others were operating for more than 3 years. We also observed that the revenue of these malware exceeds USD 6M for CryptoWall, and ranges from USD 3.8K to USD 700K for ransomware such as WannaCry and CryptoLocker, with an average number of transactions of nearly 52. One address associated with CryptoLocker ransomware also had a large amount of Bitcoins worth more than USD 34M at the time of writing. Finally, we believe that such type of analysis can potentially be used as a forensic tool to investigate ransomware attacks and possibly help authorities trace the roots of such malware. 1- «Ransom Cryptowall.» Symantec. June 14, 2014. Accessed November 01, 2017. https://www.symantec.com/security_response/writeup.jsp?docid = 2014-061923-2824-99.2 - Varghese, Joseph. «Ransomware could be deadly, cyber security expert warns.» Gulf Times. May 05, 2017. Accessed November 01, 2017. http://www.gulf times.com /story/546937/Ransomware-could-be-deadly-cyber-security-expert-w.3- Woollaston, Victoria. «WannaCry ransomware: what is it and how to protect yourself.» WIRED. June 28, 2017. Accessed November 01, 2017. http://www.wired.co.uk/article/wannacry-ransomware-virus-patch .
C. Kouzinopoulos, Γεώργιος Σπαθούλας, Konstantinos M. Giannoutakis, Konstantinos Votis · 9 authors
Blockchain is a distributed ledger technology that became popular as the foundational block of the Bitcoin cryptocurrency. Over the past few years it has seen a rapid growth, both in terms of research and commercial usage. Due to its decentralized nature and its inherent use of cryptography, Blockchain provides an elegant solution to the Byzantine Generals Problem and is thus a good candidate for use in areas that require a decentralized consensus among untrusted peers, eliminating the need for a central authority. Internet of Things is a technology paradigm where a multitude of small devices, including sensors, actuators and RFID tags, are interconnected via a common communications medium to enable a whole new range of tasks and applications. However, existing IoT installations are often vulnerable and prone to security and privacy concerns. This paper studies the use of Blockchain to strengthen the security of IoT networks through a resilient, decentralized mechanism for the connected home that enhances the network self-defense by safeguarding critical security-related data. This mechanism is developed as part of the Safe-Guarding Home IoT Environments with Personalised Real-time Risk Control (GHOST) project.
Due to their rapid growth and deployment, Internet of things (IoT) devices have become a central aspect of our daily lives. However, they tend to have many vulnerabilities which can be exploited by an attacker. Unsupervised techniques, such as anomaly detection, can help us secure the IoT devices. However, an anomaly detection model must be trained for a long time in order to capture all benign behaviors. This approach is vulnerable to adversarial attacks since all observations are assumed to be benign while training the anomaly detection model.