author: aman
Blog VIII - Part I - Day 20
Hey there, Sorry for time being away.
In the complete series the main focus was to get the undergrads of my college to a kind of “ROAD” that is not taken “usually”. This was something out of the world of Competitive Coding and Machine Learning. Since the Internet is Changing, and Blockchains are the one who is the Lead Changer of this internet revolution. I guess, transformation would be the right word.
We have discussed about a lot of things, let’s put them together.
In this micro-blog
- Connecting the Dots
Connecting the Dots
So, we’ve talked about a lot of things in the series of the Blogs. However, I must say that I couldn’t cover everything I knew in detail, but here I’ll try to connect the dots for you.
Let me list the blogs with the topics they covered. (You are free to skip through the list, just come back if you want to grab a look at what has been already done.)
Blog I |— Part I (gave you people a picture about what I’ll be talking about. Described a few cases) |— Part II (big software failures in the history, #goto fail, #heartbleed, #spectre, #meltdown ) |— Part III (Talking abt the DAO attack, and what solution was designed to workout against such attacks)~
We talked about various sotware attacks, attacks on Blockchains, how terminologies(soundness, completeness) could mean so much, vulnerabilities, specs/invariants, bugs in few of the most trusted spaces. We also had 2 guest lectures in the series. Let me now end up with a complex case in case of Bitcoin.
The case leaves a possibility for an attacker to Partiotion the Bitcoin network into multiple parts, creating a possibility to fork bitcoin into 2 parallel chains. Let’s see how it works:
BGP Highjacking attack on Bitcoin
The Bitcoin network is highly centralised, even after known to be a decentralised network. And even if the Blockchain is completely encrypted the routing of messages is still very much open. The routes are easily deductible to the adversaries.
See Here : https://bitnodes.io/
To explain it more, the complete Bitcoin network is spread to multiple ISPs (Internet Service Providers), which are again built up of multiple network clusters, called as Autonomous Systems(ASes). To communicate some messages between these ASes uses a protocol called the Border Gateway Protocol(BGP). This complete complete procedure is termed as Internet Routing.
~13 ASes host about 30% of the entire network, while 50 ASes host the 50% of the Bitcoin Network
Any attacker with accesss to the routing infra, can Highjack the BTC network. As a result of attacking mentality they can partition the BTC network in several parts. Probably bringing a major network towards their side.
Now they can add as many blocks in their side, and broadcast the chain in the network. By the general rule of Bitcoin network, “the longest chain is considered to be the final chain”, the malicious one gets updated in the real etwork.
“hese attacks, commonly referred to as BGP hijacks, involve getting a router to falsely announce that it has a better route to some IP prefix.”
“50% of Bitcoin mining power is hosted in only 39 prefixes (i.e., in 0.007% of all Internet prefixes). This allows an attacker to isolate ~50% of the mining power by hijacking only these 39 prefixes. Much larger BGP hijacks (involving orders of magnitude more IP prefixes) are routinely seen in the Internet today.”
You see this is a big thing. The Internet Routing has a developing history of more than 35 years, and the BGPs are still considered to be unstable. It is said that, Bitcoin has already gone through hundreds of BGP routing attacks, and the attacks are still not deductible.
So turning back and seeing the dots to be connected, we find,
- a 100% secure system isn’t possible
- not a lot of people are aroung the security of these systems
- the higher institutes are still hustling to create an environment of secure information exchange
- developing techniques to check a system for its security is extremely difficult, and this is the place where actual computer science comes in
- the attack surfaces are open in Hardware devices as well,
- the Finance field is already being exploited for its vulnerabilities and application for the Blockchain tech
One thing to notice is that, even if the Blockchain tech fails, there will be a definite transformation in the internet we will be using tomorrow.
The security is everything. For a world running on Data, User’s privacy, access to the systems comes in first.
So, that should be a lot of motivation I guess. I don’t have any pre compiled list of the things, one can work on in the future, but BLOCKCHAIN + SECURITY, is surely the most citable area of work.
I’ll try to cover more in details sometime. And yeap, I never read the Blogs twice, so pardon for the errors.
Shoot your questions and error reporting here aman0902pandey@gmail.com.