It’s quite evident how these days, attacks assume new forms along with transformations in the types of services that are widely used by consumers in a given period of time. Needless to mention, malware or malicious activities will find their presence in new applications and services as they evolve to occupy a prominent position in people’s lives.
Last year a few noteworthy things happened in terms of cryptocurrencies. The IRS won their case against Coinbase and over 14,000 people who traded over $20,000 USD in 2015 now have to face the IRS. Exchanges in Asia started forcing KYC (Know Your Customer) requirements on customers as did most of the rest of the world. Bitfinex decided to block all U.S. customers in November of 2017 due to regulatory issues and uncertainty. What this means is that Bitcoin and cryptocurrency is becoming harder to trade anonymously and without paying taxes. This is what happens because of legitimacy from regulation, lawful trade and taxation. I am not saying there isn’t much debate still regarding the legality, legitimacy or utility of cryptocurrencies; I’m saying 2017 had a significant change in how it is viewed. Today, the SEC in the U.S. has been discussing forcing cryptocurrency exchanges to register with the SEC and there is no definitive answer to what this is going to mean or if it is going to happen.
To read Part 1 of the series, click here.
To read Part 2 of the series, click here.
A blockchain implementation in the IoT world is probably not best served by a public blockchain based on Proof of Work. The inefficient consumption, not to say waste, of energy to generate Proof of Work is pretty much orthogonal with the premise of IoT devices, which have to consume less energy and are in some cases battery powered. POW comes at a severe cost and it does not add much value to the use case of a distributed ledger used within a consortium of partners. Hence the implementation based on Proof of Stake provides a better starting point for any attempt to chainify an IoT ecosystem where a consortium of partners is adopting a new business application. The security would then be based on a limited number of centralized nodes or cloud servers and by design it does not rely on independence of central trust as do the public cryptocurrencies. Most blockchain use cases I came across start from the assumption that there is a set of parties or a consortium of partners that have a common interest in a specific ledger, and while it might serve the larger public in terms of better quality and faster service, the consumer is not directly concerned with or interested in the ledger itself, only the parties who provide the service and rely on the ledger for remuneration will be.
To view Part 1 of this blog series, click here.
Circling back to our main interest, the world of the IoT. In order to create a blockchain shared between autonomous devices that fulfills the security properties required to ensure operation of the ecosystem, the ‘good’ devices need to accumulate a minimum 51% share of the compute power in the system. To put this requirement in perspective, consider a Raspberry PI version 3, which represents a fairly well equipped IoT device in terms of memory, storage capacity and CPU power – know that most of the current IoT devices are far behind in terms of their computing capabilities. A RPi3 is able to generate about 10 hashes per second for the Ethereum POW. Your kid’s gaming rig, equipped with an Nvidia GTX1070 GPU, is able to perform this task at a rate of 25.1 million hashes per second. Meaning that in general, to have the same probability of completing the Proof of Work before any hacker with a modern day PC, the system needs to be composed of at least 2.5 million RPi3 devices. Or to put it differently, any IoT system using the same distributed trustless consensus paradigm used by Bitcoin needs to be larger than 2.5 million devices before it could be deemed secure from DoS and reverse attacks by individuals. This is not even taking into account government-sponsored or organized crime hackers as they have access to far more powerful systems, or people who have purposefully built hardware based on FPGAs typically used to efficiently mine Bitcoins.
Cryptocurrencies allow people to move money the same way they move information on the internet. As of June 25, 2017 more than 900 different cryptocurrencies are being traded. As of July 2017, the most popular and alpha cryptocurrency, the Bitcoin (BTC), has a market cap of over $40 billion USD and trades with daily volumes averaging $1 billion with peaks up to $2 billion per 24h. Blockchain, the foundational technology behind all cryptocurrencies, is not an easy-to-understand technology as it is a weird combination of cryptography, distributed systems, economics, game theory, some graph technology, and politics. The most common reason for the existence of the many different blockchains for cryptocurrency are ethically dubious money-making schemes. Most investors and consumers are incapable of evaluating the blockchain technology details and convinced themselves that blockchains will make them loads of money and/or make the internet secure and/or overthrow the government. Besides providing real opportunities for cyber criminals and high risk traders, the blockchain has sparked the interest of many industries, IoT being one of them. As the era of IoT is upon us and the number of IoT devices and size of IoT ecosystems is growing exponentially, blockchain is tipped as one of the technologies that will fuel the future of IoT.
What does the word “decentralization” mean to you? In general terms it stands for distribution of functions and responsibilities to less involved parties. For some people decentralization carries negative connotations and implies inefficiency and inaccurate performance of mechanisms. In most cases this standpoint may carry much conviction, but not in terms of bitcoin exchange and its underlying principles.
It has long been known that if you want to participate in the Darknet marketplaces, you’ll need to exchange your money into Bitcoin. Bitcoin was written by someone using the alias Satoshi Nakamoto in 2008 as an anonymous and decentralized currency. We’ve written in the past about how to buy Bitcoin. Today, for various reasons, we are seeing it become mainstream.
Ransom attacks on companies are becoming big business. Many businesses say they will not pay, but when attacked, find that they do. But how do they pay? Bitcoin. Just like having insurance policies, companies are now investing in keeping Bitcoin around for business continuity against DDoS attacks as well as Malware CryptoLocker and Data Extortion attacks.
Bitcoin (BTC) is a cryptocurrency payment system based off of the blockchain, a core component of the digital currency. The blockchain was introduced by a pseudonymous creator, Satoshi Nakamoto, in 2008 and open sourced for the currency in 2009. The blockchain serves as a public ledger that records all Bitcoin transactions. One of Bitcoin’s main features is the fact that the system is a decentralized peer-to-peer payment network with no central authority, which means that it provides a certain level of anonymity with no central point of failure, though most services and business that use Bitcoin are centralized in one way or another. While there are numerous legitimate uses for Bitcoin like investing, paying friends or shopping, a number of criminals have adopted the currency for selling services and deploying ransom campaigns due to its level of anonymity.
Threat Alert: Bitcoin Exchanges and Websites Experiencing DDoS Attacks
Over the last several months, our ERT Research team has noticed a growing trend of attackers targeting Bitcoin exchanges and websites that deal with Bitcoin directly. These websites are increasingly becoming the target of DDoS attacks for a number of reasons. First, they are mainly targeted by extortionists, but they are also experiencing attacks from competition and user aggression.
Bitcoin-related sites attract a lot of attention and demand from their users, but this also plays against them. This dedicated user base requires instant access and live updates about market conditions and the current value of Bitcoin. When these services go down, thousands of users are left locked out of their accounts, which can result in reputation damage or financial loss for their users. This is also why extortionists choose to target these sites; not only do they have Bitcoin on hand, but some are not willing to go offline even for a moment due to the fear of losing clients.
David Monahan is Research Director for Enterprise Management Associates (EMA) and is a featured guest blogger.
DDoS attacks have become commonplace these days. The offending attackers may be hacktivists, cyber-criminals, and nation states or just about anyone else with an Internet grudge and a PayPal or Bitcoin account. These attacks themselves often require no technical skill. Someone with a bone to pick can simply purchase the use of any number of nodes on one or more botnets for an hourly fee (long term rate discounts available); use a Graphical User Interface (GUI) to organize the attack and then launch it.
