Hacking Blockchain

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

SESSION ID:SESSION ID:
#RSAC
Konstantinos Karagiannis
Hacking Blockchain
PDAC-T10F
Chief Technology Officer, Security Cons...

#RSAC
Another sea change upon us

#RSAC
It all started Halloween 2008…
3

#RSAC
Bitcoin
4
Satoshi’s altruistic goals
met
Strong investment—5
million dollar pizza
Widespread “positioning”
of cry...

#RSAC
Blockchain transaction and verification
5
Parties exchange data
Transaction verified or queued

#RSAC
Blockchain structure and validation
6
Each block identified by hash
Blocks must be validated to be added to chain

#RSAC
Blockchain mining and chain
7
Miners “solve puzzle” (proof of work)
Miners rewarded, block added to majority chain

#RSAC
Blockchain defense
8
Trying to submit an altered block would change hash
function of that block and all following b...

#RSAC
Some proposed blockchain applications
9
Digital assets
Identity (black box)
Verifiable data
Smart contracts

#RSAC
Attacks past and present

#RSAC
Quick caveat
11
Not allowed to discuss
vulnerabilities found during ethical
hacks of BT-client financial
applicat...

#RSAC
1 RETURN – responsible disclosure
12
First security vuln identified July, 2010
by ArtForz
Allows spending of other ...

#RSAC
Attacks against blockchain infrastructure
13
Mt. Gox first major bitcoin disaster
June 2011: $8 million stolen (admi...

#RSAC
Attacks against code
14
DAO smart contract flaw
known of since May 2016
June 17, hacker used
recursive flaw to mak...

#RSAC
Attacks against blockchain sites
15
2013, payments processor Inputs.io site
compromised—for $1 million (social
eng...

#RSAC
Attacks against hot wallets
16
Dec 7, hacker compromises VC Bo
Shen’s phone, gaining access to
$300,000 in Augur a...

#RSAC
Attacks against cold wallets
17
Bitfinex tried to remove risk
of “security exposures” by
adding an extra layer via...

#RSAC
Attacks against nodes
18
Major node attack thwarted Aug
2010—Bitcoin block 74638 flaw could
generate 184 Billion t...

#RSAC
Traditional risks to new applications
19
Digital assets
Ownership
Identity
Black box interactions at risk
Verifiable...

#RSAC
Coming attacks against
blockchain’s biggest flaw

#RSAC
Remember Satoshi’s words?
21
August 2015: NSA publicly warned against using ECC, the type
of encryption in blockcha...

#RSAC
Elliptic curve cryptography
22
Public key system, like RSA, El Gamal,
Rabin
Based on algebraic structure of ellipti...

#RSAC
ECC Bitcoin example
23
Bitcoin wallet addresses made of: Public key,
private key, and address
Public key derived fr...

#RSAC
Quantum threat looming
24
Quantum computers can crack ECC
Machines exploit quantum
“weirdness” of superposition to ...

#RSAC
World’s easiest explanation of superposition
25
Expected particle behavior or “pooling”

#RSAC
World’s easiest explanation of superposition
26
Wave pattern without observation of which
slit a particle goes thro...

#RSAC
World’s easiest explanation of superposition
27
Even one particle going through at a time
creates wave pattern

#RSAC
World’s easiest explanation of superposition
28
Use a detector on either slit, and pooling
appears: particle-wave d...

#RSAC
Maintaining superposition
29
Observing either slit destroyed the
superposition
Quantum computers need to maintain
...

#RSAC
With enough stable qubits…
30
A quantum computer can run Shor’s
algorithm (1994) and quickly crack any
public key ...

#RSAC
Bitcoin example within 3 years
31
Bitcoin transaction includes a signature
and a public key to verify owner
That pu...

#RSAC
Lamport signatures—a stopgap?
32
Public key consists of 320 hashes rather than an
elliptic curve point
Address is S...

#RSAC
Post-quantum crypto
33
Code based
Hash based
Lattice based
Multivariate quadratic equations
One time pad
liboqs, ope...

#RSAC
Apply these warnings!
34
As soon as possible, take a new look at any blockchain applications
you’re developing or u...

#RSAC
Apply these warnings!
35
Within the next three months prioritize testing the security of
blockchain applications by...

#RSAC
Apply these warnings!
36
Looking ahead, six months and on, what
can you do to ensure the future of
blockchain secu...

#RSAC
Questions? Please join me for a “focus
on” session (FON4-T11) today in
Moscone West 2024 from 3:45 to 4:15
@konsta...

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1063109 views
Storytelling For The Web: Integrate... by Chiara Aliotta 981811 views
Artificial Intelligence, Data and C... by OECD Directorate ... 923520 views
How to Leverage AI to Boost Employe... by SocialHRCamp 392340 views
2024 State of Marketing Report – by... by Marius Sescu 221896 views
Everything You Need To Know About C... by Expeed Software 237729 views

View on Slideshare

1 of 37 Ad

View on Slideshare

1 of 37 Ad