On August 15, Michael Terpin filed a $224 million lawsuit against AT&T. His 69-page complaint claims the telecom giant had failed to protect his phone number—even after escalating his account to a “higher security level” with “special protection”—resulting in a combined $24 million hack of his cryptocurrencies.
This number might dwarf compared to the infamous Mt. Gox hack, where over $460 million was stolen, or the DAO hack ($50 million), or the more recent hacks of Conrail ($37.2 million) and Bithumb ($31 million). But the scary part is the ease with which these hacks are carried out.
In fact, instead of breaking into smart contracts or hacking into exchanges and stealing private keys, now kids between 19 and 22 years old can steal millions at an expense of 99 cents, with relatively no effort.Has blockchain failed to deliver a secure digital currency and has turned into a haven for cybercriminals?
The idea behind bitcoin was to create a peer-to-peer system that allowed two parties that did not now and did not trust each other transact financially without allowing for double-spending or hacking the system. For that, it created an immutable ledger that can only break to a “51% attack”—an attack which requires enormous computing power of malicious nodes to overrun the honest ones.
While this system has failed smaller networks, it has been battle-proven with bitcoin, which has not suffered from such blows to date. But no matter how secure a system we design, it will always have one point of failure: humans.
The Heathrow Airport was fined for £120,000 ($155,000) when an employee lost a USB Drive containing 2.5 GB of sensitive files. No matter how secret those files were kept; without proper training and procedures in place, the system can still fail miserably.
Security is a process, not an end state. And our primary enemy is “convenience.” Even the U.S. President is no exception. That’s why we reuse the same passwords on disparate websites or totally abandon them with two-factor authentication. In fact, the AT&T case had nothing to do with blockchain vulnerabilities; the victims had fallen for SIM swapping.
SIM swapping is a technique used by hackers to trick (or even bribe) a telecom operator to redirect the phone number of the victim to the hacker’s SIM card. The hackers impersonate their target by providing fake IDs and claiming they have lost their phone and need their old number redirected to their “new” SIM card.
From there, they can penetrate the target’s email and social media accounts, and extract valuable information about any other account that is insecurely stored there.
For SIM swapping, the hacker only needs to know their target’s phone number, then pull off some social engineering to trick the operator. In an SS7 attack, even social engineering is not necessary, as hackers can use the attack to eavesdrop on SMS messages and steal any PIN codes that are sent to the victim’s phone during a login attempt.
The only way to protect yourself against these measures, for now, is not to use cellphones for authentication—or keep one just for logins and never share its number with anyone.
What makes this particularly important for cryptocurrencies is its nature. When hackers steal private data or even healthcare data, they still need to sell those accounts or start exploiting them before they can turn their gains into money—and in some cases, the victims can block those accounts or otherwise minimize the damage.
But with crypto’s, they have immediate access to cash.In some cases, the hackers even ignored the funds they could have accessed in traditional banks. According to REACT Lieutenant John Rose, the attackers “are predominantly interested in targeting cryptocurrencies for the ease with which these funds can be laundered through online exchanges, and because the transactions can’t be reversed.”
It is interesting to notice the pattern here: hackers attack central locations for gains and hide in the decentralized network for anonymity. In a way, blockchain is accomplishing exactly what it was supposed to do: removing single points of failure and create a network where anyone can trade freely.
As we hear the calls for regulating blockchain, it is also important to remember the primary reason behind bitcoin’s birth: the failure of large central banks, which caused the depression of 2008.
Eventually, it comes down to who do we trust? The central bodies, which are supposed to be the good guys but have sometimes shown they can turn evil, or the masses where hackers and fraudsters can also blend in?
For blockchain supporters, the answer is clear: we cannot hope that the people in power always do the right thing, but we can give the masses more power to take corrective action. In other words, should we opt for a dictatorship and hope we will get a “good” dictator or do we believe democracy always prevails?It comes down to how we use technology. Blockchain has answers in itself.
When the Ghash.io pool got close to controlling 51% of bitcoin mining power in 2014, the community reacted by leaving the pool—so much that the owners had to publicly announce that they “will take all necessary precautions to prevent reaching 51% of all hashing power, in order to maintain stability of the bitcoin network.
”To protect against smart contract hacks, an Israeli cybersecurity startup called Safeblocks has created a decentralized web firewall that protects smart contracts from unauthorized transactions and malicious attacks in real time.
The platform task is to monitor the smart contracts and examine the transaction requests as they come, approving or disapproving them based on the security exceptions the users have set. This way, users can put a limit on the number of transactions per day, capping withdrawals amount of even setting a designated address for withdrawal.
The fundamental idea is that instead of relying on code audits, we have to measure the system in real-time and take action accordingly. This view is much closer to the “security is a process” principle. Only this time, blockchain is a part of this process.
Assessing the breaches mentioned previously, it is clear that blockchain could not have prevented the SIM swapping or SS7 attacks—but it does present a system which is immune to surveillance: dark routing. This technique, as implemented by Mainframe, enables full data privacy, surveillance resistance and censorship resistance.
It works by only partially disclosing the target destination, making the message go out to a number of nodes such that the target recipient cannot be singled out. However, only the target recipient can actually decrypt the message.
Substratum has used this technique to penetrate China’s Great Firewall. The platform splits transmitted data into several parts and forwards them via nodes, using artificial intelligence to find the fastest routes. Combined with encryption, this creates a secure and uncensorable connection without using VPNs or Tor.
“Our plan is to implement a term we call masquerading. We encrypt and wrap data into transactions that look similar to other patterns of web traffic,” explains Justin Tabb, the CEO of Substratum. “As we move further we will have more and more masqueraders in the hopes of never being identifiable.
”Putting this system on the blockchain actually plays a crucial role. Eventually, VPN hosts are limited and costly. Tor is free of charge but the only incentive for anyone to use it would be anonymity. Blockchain, on the other hand, flips the entire equation. Here, the nodes can actually earn income by sharing their network.
For instance, Substratum implements a model where you pay for content based on “clicks.” This decentralized version of the web empowers the nodes instead of the centralized players and has the potential to bring net neutrality back.Hackers circumvent these techniques, or even worse, use them in their own favor?
Of course. Just as they can do with many other systems—even centralized ones. The most important takeaway is that security is a process. Blockchain is not good or evil. It can be used for both.
But it is a step in the right direction.I'm a developer and freelance tech blogger interested in cyber-security, AI and blockchain, and try to separate signal from noise in the industry.
This number might dwarf compared to the infamous Mt. Gox hack, where over $460 million was stolen, or the DAO hack ($50 million), or the more recent hacks of Conrail ($37.2 million) and Bithumb ($31 million). But the scary part is the ease with which these hacks are carried out.
In fact, instead of breaking into smart contracts or hacking into exchanges and stealing private keys, now kids between 19 and 22 years old can steal millions at an expense of 99 cents, with relatively no effort.Has blockchain failed to deliver a secure digital currency and has turned into a haven for cybercriminals?
Fundamentals of security
The idea behind bitcoin was to create a peer-to-peer system that allowed two parties that did not now and did not trust each other transact financially without allowing for double-spending or hacking the system. For that, it created an immutable ledger that can only break to a “51% attack”—an attack which requires enormous computing power of malicious nodes to overrun the honest ones.
While this system has failed smaller networks, it has been battle-proven with bitcoin, which has not suffered from such blows to date. But no matter how secure a system we design, it will always have one point of failure: humans.
The Heathrow Airport was fined for £120,000 ($155,000) when an employee lost a USB Drive containing 2.5 GB of sensitive files. No matter how secret those files were kept; without proper training and procedures in place, the system can still fail miserably.
Security is a process, not an end state. And our primary enemy is “convenience.” Even the U.S. President is no exception. That’s why we reuse the same passwords on disparate websites or totally abandon them with two-factor authentication. In fact, the AT&T case had nothing to do with blockchain vulnerabilities; the victims had fallen for SIM swapping.
SIM swapping is a technique used by hackers to trick (or even bribe) a telecom operator to redirect the phone number of the victim to the hacker’s SIM card. The hackers impersonate their target by providing fake IDs and claiming they have lost their phone and need their old number redirected to their “new” SIM card.
From there, they can penetrate the target’s email and social media accounts, and extract valuable information about any other account that is insecurely stored there.
For SIM swapping, the hacker only needs to know their target’s phone number, then pull off some social engineering to trick the operator. In an SS7 attack, even social engineering is not necessary, as hackers can use the attack to eavesdrop on SMS messages and steal any PIN codes that are sent to the victim’s phone during a login attempt.
The only way to protect yourself against these measures, for now, is not to use cellphones for authentication—or keep one just for logins and never share its number with anyone.
It gets worse
What makes this particularly important for cryptocurrencies is its nature. When hackers steal private data or even healthcare data, they still need to sell those accounts or start exploiting them before they can turn their gains into money—and in some cases, the victims can block those accounts or otherwise minimize the damage.
But with crypto’s, they have immediate access to cash.In some cases, the hackers even ignored the funds they could have accessed in traditional banks. According to REACT Lieutenant John Rose, the attackers “are predominantly interested in targeting cryptocurrencies for the ease with which these funds can be laundered through online exchanges, and because the transactions can’t be reversed.”
Who do you trust?
It is interesting to notice the pattern here: hackers attack central locations for gains and hide in the decentralized network for anonymity. In a way, blockchain is accomplishing exactly what it was supposed to do: removing single points of failure and create a network where anyone can trade freely.
As we hear the calls for regulating blockchain, it is also important to remember the primary reason behind bitcoin’s birth: the failure of large central banks, which caused the depression of 2008.
Eventually, it comes down to who do we trust? The central bodies, which are supposed to be the good guys but have sometimes shown they can turn evil, or the masses where hackers and fraudsters can also blend in?
For blockchain supporters, the answer is clear: we cannot hope that the people in power always do the right thing, but we can give the masses more power to take corrective action. In other words, should we opt for a dictatorship and hope we will get a “good” dictator or do we believe democracy always prevails?It comes down to how we use technology. Blockchain has answers in itself.
“White hat” blockchain
When the Ghash.io pool got close to controlling 51% of bitcoin mining power in 2014, the community reacted by leaving the pool—so much that the owners had to publicly announce that they “will take all necessary precautions to prevent reaching 51% of all hashing power, in order to maintain stability of the bitcoin network.
”To protect against smart contract hacks, an Israeli cybersecurity startup called Safeblocks has created a decentralized web firewall that protects smart contracts from unauthorized transactions and malicious attacks in real time.
The platform task is to monitor the smart contracts and examine the transaction requests as they come, approving or disapproving them based on the security exceptions the users have set. This way, users can put a limit on the number of transactions per day, capping withdrawals amount of even setting a designated address for withdrawal.
The fundamental idea is that instead of relying on code audits, we have to measure the system in real-time and take action accordingly. This view is much closer to the “security is a process” principle. Only this time, blockchain is a part of this process.
Assessing the breaches mentioned previously, it is clear that blockchain could not have prevented the SIM swapping or SS7 attacks—but it does present a system which is immune to surveillance: dark routing. This technique, as implemented by Mainframe, enables full data privacy, surveillance resistance and censorship resistance.
It works by only partially disclosing the target destination, making the message go out to a number of nodes such that the target recipient cannot be singled out. However, only the target recipient can actually decrypt the message.
Substratum has used this technique to penetrate China’s Great Firewall. The platform splits transmitted data into several parts and forwards them via nodes, using artificial intelligence to find the fastest routes. Combined with encryption, this creates a secure and uncensorable connection without using VPNs or Tor.
“Our plan is to implement a term we call masquerading. We encrypt and wrap data into transactions that look similar to other patterns of web traffic,” explains Justin Tabb, the CEO of Substratum. “As we move further we will have more and more masqueraders in the hopes of never being identifiable.
”Putting this system on the blockchain actually plays a crucial role. Eventually, VPN hosts are limited and costly. Tor is free of charge but the only incentive for anyone to use it would be anonymity. Blockchain, on the other hand, flips the entire equation. Here, the nodes can actually earn income by sharing their network.
For instance, Substratum implements a model where you pay for content based on “clicks.” This decentralized version of the web empowers the nodes instead of the centralized players and has the potential to bring net neutrality back.Hackers circumvent these techniques, or even worse, use them in their own favor?
Of course. Just as they can do with many other systems—even centralized ones. The most important takeaway is that security is a process. Blockchain is not good or evil. It can be used for both.
But it is a step in the right direction.I'm a developer and freelance tech blogger interested in cyber-security, AI and blockchain, and try to separate signal from noise in the industry.