Table of Contents
If you have ever wondered what blockchain security is, how it is maintained or how it can be a threat, you’re in the right place.
Hi, I’m Sara from Metaschool. In this guide, I’ll dig deep into the constituents of blockchain, how they ensure safety and how some vulnerabilities lay exposed. I will also touch upon data tampering, hacking of blockchain nodes and measures to ensure a blockchain’s own security.
So, what is blockchain security?
The case of blockchain technology is an interesting one. It was fundamentally developed to bridge cutting-edge technology with top-notch security. The security provided by blockchain, thus, is one of its greatest assets and a unique selling point.
Blockchain security can be considered a full-fledged system for risk management for blockchain-based networks, decentralized applications, smart contracts, etc.
To ensure that blockchain-based products and networks are safe, blockchain security implements and recommends various cybersecurity frameworks, methodologies to test security, and best coding practices, respectively.
Additionally, there is immutability, blockchain’s tamper-resistant nature and a distributed consensus mechanism like proof-of-work and proof-of-stake (PoS) at play. Despite having this juggernaut of a system in place, blockchains might not be immune to cyberattacks.
The role blockchain infrastructure plays in security
Blockchain infrastructure is an underlying mechanism that enables, manages, and maintains the different functions of a blockchain (which is mainly about security). These include the software, hardware, nodes, and validators. The important and essential data in a blockchain has to be the transaction data. It is stored in blocks and these blocks are closely connected to each other via the hashing algorithm.
The security of a blockchain is greatly facilitated by its very infrastructure which works on a distributed ledger technology (DLT). The ledger technology essentially helps in driving trust and confidence. It also leverages core blockchain security concepts such as cryptography, decentralization, and consensus amongst nodes/validators which collectively work towards ensuring trust in transactions.
What threatens the security of a blockchain?
While blockchain technology has a proper infrastructure and a developed security mechanism (in most cases) in place, the system is not immune to threats and malevolent attacks just like any system, let alone a new one. These threats still exist and attackers work hard at finding several methods to get their jobs done.
Having said that, the four most popular types of blockchain hacking methods used are:
1. Sybil attack
In a Sybil attack, the hackers create multiple fake IDs on a blockchain network, and flood it entirely, forcing the network to shut down.
The word Sybil is inspired by a character named Sybil from a 1973 novel by Flora Schreiber. The character within the novel, Sybil, is medically diagnosed and mentally struggling with a multiple personality disorder. A Sybil attack is one of the common and popular attacks on a blockchain network.
What happens in a Sybil attack is that the attack totally undermines the authority of a network. When those fake identities flood a network, they gain control. This is against blockchain infrastructure which is based on network distribution. When such a thing comes up, the system shuts down. It is a classic example of blockchain hacking.
2. Phishing
Phishing is yet another common hacking practice within web2 and web3 spaces, one you’ve most likely heard of before. It is attempting to attain a user’s credentials in an illegal or fraudulent way such as impersonating a legitimate organization or individual.
Following the Russian invasion of Ukraine, the FBI has seen a massive increase in overall phishing attacks. As per the Federal Board of Investigation’s IC3 (Internet Crime Complaint Center) releases, some 800,944 complaints were registered and the most recurring and reported complaint was that of phishing.
Fraudsters and hackers send emails to legitimate wallet key owners and lure them into giving their private keys and other credentials. This results in losses for the blockchain and the users as well. As of April 2023, phishing attacks have grown by 40% and cybercriminals are at loose.
3. 51% attack
More common in the proof-of-work (PoW) consensus mechanism, in the 51% attack, a miner or a group of miners collectively hold more than 50% of the blockchain network’s mining power.
When mining, a vast amount of computational power is required. Large-scale blockchains like Bitcoin need it more than other blockchains.
Getting hold of more than half of that computational power is dangerous for the blockchain and users as well. It directly means controlling the ledger and risking the personal information of the users.
4. Routing attack
Routing attacks take advantage of the real-time transaction of data and other confidential within the blockchain while it is connected to the internet.
In routing attacks, apparently, everything looks fine. But things are different on the back end where hackers have already hacked into the system, intercepted the connection and taken confidential information and currencies.
Real and damaging cyberattacks in blockchain
Detailed below are some of the infamous and costly hacks in the blockchain space. While these would make you nervous and question the safety in the space, it’s important to remember that Rome wasn’t built in a day. Let’s take the exposed vulnerabilities as an example and learn from them so that they aren’t repeated.
1. Beanstalk Farms
In April 2022 an Ethereum-based stablecoin, known as Beanstalk Farms (BEAN) with a native governance token called STALK, fell prey to a costly hacking incident.
How the Beanstalk protocol works is that in order to transfer one’s assets, a user would need approval from a majority of STALK token holders.
The hacker exploited this very law of the stablecoin and took out a hefty but very short-term loan to get a certain position and have the majority with them. The hacker then proposed a transfer of funds from STALK and approved it (because they were in a majority position) and made a profit of $80 million.
2. Wintermute
Yet another example is that of Wintermute. Wintermute is a crypto market maker. Market makers are those individuals and companies who provide liquidity by actively buying and selling assets on an exchange.
It is said and believed that a brute-force attack (a hacking method that uses trial and error to gain confidential information) was used in September 2022 to steal personal and confidential information, which included the private keys of the users. The hacker rendered losses of over $160 million to Wintermute.
3. Ronin Network
This is one of the biggest hacks of 2022. The hackers, in this case, caused the Ronin Network to lose a whopping $625 million.
To expand a bit more, the Ronin Network is a side chain (side chains are used to increase the scalability and efficiency of parent networks or larger blockchains) that supports the famous game, Axie Infinity. The hacker in this side chain stole private keys, managed to generate fake withdrawals, and took out millions of dollars.
How can blockchains avoid hacking attempts and threats?
Mentioned below are some ways that blockchains can implement to minimize the risks of getting attacked or hacked.
1. Proper governance mechanism
Blockchain security is at times threatened because of the governance mechanism in place as can be seen in the case of Beanstalk Farms. Thus, having a comprehensive mechanism in place with proper monitoring and evaluation is important. This will help a blockchain filter out the bad actors, manage errors, and most importantly, protect the confidential data and respect the integrity of a blockchain.
When it comes to security, a robust decentralized governance model comes in handy. In such a model/framework, no one entity has control over the blockchain network. This is in complete contrast to a centralized governance system where only one entity dominates. With a decentralized governance system, it becomes onerous for hackers to attack the sanctity of a blockchain because they would have to put in double efforts and attack multiple nodes.
2. Consensus mechanism
What mechanism a blockchain follows is an equally important factor here. There are two popular consensus mechanisms – PoW and PoS. Blockchains that follow the PoS consensus mechanism such as Ethereum, Solana, Cardano, etc. tend to be way too less susceptible to attacks like the 51% attack in comparison to blockchains that use the PoW consensus mechanism.
3. Side chain security
Ronin Network, even though a side chain, was one of 2022’s biggest hacks. While side chains ensure the scalability and efficiency of the main chain, their own security is sometimes compromised. Experts suggest that side chains need to have constituents – like hash data, data in transit, cloud storage, etc. – similar to those of a main chain to further strengthen side chain security.
Side chains can also greatly benefit from bridging which is essentially a way of transferring assets from one blockchain to another. Bridging can help transfer coins and assets from the main chain to the side chain with less risks of getting attacked or hacked. For example, the Lightning Network is a sidechain bridge that allows users to transfer Bitcoin between the Bitcoin mainchain and the Lightning Network.
4. Regular security audits
Albeit not too popular, routing attacks do happen. In these attacks, as you know, all the work is done on the back end, and on the front end, everything looks fine. These attacks, thus, can be hugely avoided with regular security audits by a blockchain. Moreover, hackers and attackers can also be caught by closely reviewing codes on a blockchain.
When it comes to auditing side chain security, there is a company known as CertiK that offers security audits. Blockchain organizations can keep an eye out for such more resources that can help strengthen their security measures.
Additionally, there are bug bounty programs that are essentially a way to incentivize researchers and experts to report any security vulnerabilities within a blockchain network. The trade-off here is bounty in return for a bug-free and less-susceptible-to-attacks blockchain.
5. Proper handling of private keys
When private keys are not securely managed, they are attacked which leads to loss of capital, the blockchain’s reputation and overall standing. It also engenders distrust amongst the users of the blockchain. Effective and efficient strategies for protecting private keys and information can come in super handy.
A blockchain’s management can also use hardware or multi-signature wallets for stricter security measures and educate the users and the management alike.
6. Other best practices
Blockchain networks should also adopt other best security practices such patching software, using strong passwords that can not be easily deciphered, regularly training employees on new and up-to-date security measures and procedures. Training could also be a part of the employment contract.
Other measures such as encryption can also be undertaken. Strong encryption will make arduous for the attackers to steal important data which includes passwords and transaction records. Other methods include the implementation of firewalls and intrusion detection systems.
The conclusion…
Despite having cryptographic techniques, decentralization, and consensus mechanisms in place to avoid data-tampering and cybersecurity attacks, blockchains still face challenges such as Sybil attacks, phishing, 51% attack and routing attacks.
In order to avoid such attacks in the future and be trusted for adoption, blockchains must implement strict security measures and increase their overall monitoring, auditing and other aspects.