How to Hack Blockchain Systems
Abstract
In this talk, we will present a method to evaluate empirically the effectiveness of several attacks against distributed ledgers and blockchain technologies. The method was commonly used to attack distinct blockchain protocols currently used to trade digital assets. These protocols were deployed in existing networks, like the Ethereum ETH mainnet, the R3 consortium and POA Core.
In short, the method aims at reaching a situation where an attacker double spends some of the digital assets she owns. The success of the attack outlines a security vulnerability as the same assets are spent in two distinct transactions, hence violating the integrity of the corresponding ledger. It consists of four simple successive steps: (i) delaying messages between groups of blockchain participants, (ii) transferring digital assets in one of these groups, (iii) waiting for this transaction to be committed for victims to be misled, and finally (iv) transferring the same digital assets elsewhere.
The implementation of this method depends on the considered protocol in use but was shown successful to demonstrate the Attack of the Clones [3] and the Balance Attack [6, 2]. The key idea is to replicate the mainnet of a running blockchain system in a sandboxed testnet environment using virtual machine nodes connected via a local area network within a lab facility, like the Global Environment for Networking Innovation [4]. These nodes are typically con- trolled with OpenStack. Delaying network messages is achieved through man- in-the-middle attacks (like BGP-hijacking or ARP-spoofing) using Quagga [1] and Open vSwitch. An essential component that we learned while refining our method was to wait for the first transaction to be committed [5] to be able to fool the victim participants.
Biographies of the Speakers
Parinya Ekparinya is a recipient of the Royal Thai Government Scholarship to pursue a PhD degree in the School of Computer Science at the University of Sydney. Parinya completed his master’s degree in information technology also from the University of Sydney in 2015 and his bachelor’s degree in computer engineering from King Mongkut’s Institute of Technology Ladkrabang (KMITL) in 2009. With years of experience working in the field of network security, he is always keen to work on practical solutions to address real-world security issues. His research interests include distributed system security as well as the emerging network technologies such as software-defined networking and network function virtualization.
Guillaume Jourjon is a Senior Research Scientist at the Information Security and Privacy Research Group at Data61. During his career, he has pursued research excellence in the field of distributed computing systems capable of operating at large scale over a realistic network. His work spans from basic services such as reliable communication to enhanced services such as a secured and private channel to distributed computing applications. He has been involved and lead numerous large-scale collaborative EU and US research projects including GENI and FIRE.
Vincent Gramoli is a Visiting Professor at EPFL and an Associate Professor at the University of Sydney where he heads the Concurrent Systems Research Group. Prior to this, he was affiliated with INRIA, Cornell University and CSIRO. Vincent received his PhD from University of Rennes and his Habilitation from Sorbonne University. His research interests lie in distributed systems and security. During 2018-2019, he chaired the Blockchain Technical Commit- tee of the Australian Computer Society. He is a Future Fellow of the Australian Research Council.
References:
[1] Quagga Software Routing Suite. https://www.quagga.net/.
[2] Parinya Ekparinya, Vincent Gramoli, and Guillaume Jourjon. Impact of man-in-the-middle attacks on Ethereum. In Proceedings of the 37th IEEE International Symposium on Reliable Distributed Systems (SRDS’18), pages 11–20, Oct 2018.
[3] Parinya Ekparinya, Vincent Gramoli, and Guillaume Jourjon. The Attack of the Clones against Proof-of-Authority. In Proceedings of the Network and Distributed Systems Security Symposium (NDSS’20), Feb. 2020.
[4] Rick McGeer, Mark Berman, Chip Elliott, and Robert Ricci, editors. The GENI Book. Springer International Publishing, Cham, 2016.
[5] Christopher Natoli and Vincent Gramoli. The Blockchain Anomaly. In 2016 IEEE 15th Int. Symp. Netw. Comput. and Applications (NCA’16), pages 310–317, October 2016.
[6] Christopher Natoli and Vincent Gramoli. The Balance Attack or why fork- able blockchains are ill-suited for consortium. In 47th IEEE/IFIP Int. Conf. Dependable Syst. and Netw. (DSN’17), Jun 2017.