Uncontrolled Randomness in Blockchains: Covert Bulletin Board for Illicit Activity Nasser Alsalami Bingsheng Zhang* Lancaster University, UK Zhejiang University, China [email protected] [email protected] Abstract—Public blockchains can be abused to covertly store platforms that use randomized cryptographic primitives, such and disseminate potentially harmful digital content which poses as digital signatures and non-interactive zero-knowledge a serious regulatory issue. In this work, we show the severity of proofs. The main observation is that all randomized algo- the problem by demonstrating that blockchains can be exploited to surreptitiously distribute arbitrary content. More specifically, rithms need to consume random coins somewhere along all major blockchain systems use randomized cryptographic the execution, and these random coins are not audited or primitives, such as digital signatures and non-interactive zero- certified publicly. By intentionally manipulating the random knowledge proofs; we illustrate how the uncontrolled random- coin supplied to a randomized algorithm, an attacker is ness in such primitives can be maliciously manipulated to enable able to embed arbitrary information into the output of the covert communication and hidden persistent storage. To clarify the potential risk, we design, implement and evaluate our algorithm, where the output that contains steganographic data technique against the widely-used ECDSA signature scheme, is computationally indistinguishable from normal output. the CryptoNote’s ring signature scheme, and Monero’s ring Our attack can be used for covert channels, persistent stor- confidential transactions. Importantly, the significance of the demonstrated attacks stems from their undetectability, their age, and many other scenarios. For instance, the attacker(s) adverse effect on the future of decentralized blockchains, may try to subvert, or mis-implement cryptocurrency wallets and their serious repercussions on users’ privacy and crypto and re-distribute them to unsuspecting users. The subverted funds. Finally, we present a generic framework to immunize wallets can then surreptitiously leak the victim’s secret, such blockchains against these attacks. as the signing key, via standard transactions. Importantly, I. INTRODUCTION the transactions generated by the subverted wallets are computationally indistinguishable from normal transactions The blockchain technology has pioneered a new paradigm for any third-party observers. Note that the current focus to realize large-scale distributed ledgers. While the of research regarding blockchain subversion vulnerabilities blockchain technology is promising in a great number of is mainly on the trusted parameter setup process, such as application scenarios, it can also be abused to anonymously common reference string (CRS) generation [7] [8], while store and disseminate potentially harmful digital content. software/hardware subversion vulnerabilities in blockchain As shown in a recent study [1], 1:4% Bitcoin transactions cryptocurrency applications has not been extensively studied. contain non-financial data, some of which contain objection- able content. Though the absence of a central censor makes We would like to argue that wallet subversion is prac- blockchains appealing in some use cases, the increasing tical and plausible, and the public should be alert to such amount of illicit content posted to the blockchains poses risks. Cryptocurrencies have very complex cryptographic a serious regulatory issue [2]. Subsequently, several tech- primitives and structures that make them prone to unseen niques have been discussed to either filter unwanted content mis-implementations. Although many cryptocurrencies are before posting to the ledger [3] or remove content from the marketed as decentralized projects, studies have found that blockchain [4] [5]. the development of many blockchain applications is highly However, all of the proposed countermeasures are only centralized. For example, 30% of the source files in Bitcoin effective if the malicious content attached to the trans- are written by a single author, and 7% of the code is actions can be detected. The situation gets worse when written by the same author [9]. Similarly, 20% of the source the attackers hide data into normal transactions and use code in Ethereum is attributed to the same author [9]. This blockchain platforms for covert communications. Naively, high centralization may cause bias and introduce inten- one can encrypt the malicious content and attach its cipher- tional/unintentional flaws. Moreover, most end users lack text to a transaction, but it is noticeable to the public. In the ability and the means to check the conformity of an 2018, Partala [6] showed a proof-of-concept steganography executable wallet with its reference source code. It is uncom- technique that allows an adversary to covertly embed one mon for users to compile the source code of any application bit into a standard Bitcoin transaction’s recipient address by themselves; instead, they usually relay on downloading without being distinguished from an innocuous transaction readily prepared executable applications. The difficulty to and without burning the funds. examine the implementation of a cryptocurrency wallet is In this work, we further advance this line of research by even more pertinent to hardware wallets, such as the various demonstrating an effective steganographic method that offers Swiss-Army-Knife hardware wallets [10]. These hardware high throughput and can be launched against any blockchain wallets are typically manufactured in an outsourced loosely- controlled environment, and it is virtually impossible to audit *Corresponding author. the integrity of their implementation through the standard Cryptocurrencies’ Signatures functionality ‘correctness’ test by observing input/output # Cryptocurrency ECDSA EdDSA Ring Signature Note pairs in a black-box manner. 1 Bitcoin X Our contributions. The primary objective of this work is 2 Ethereum X 3 Ripple X X to draw attention to the potential threat of abusing uncon- 4 Bitcoin Cash X trolled randomness in blockchain cryptographic algorithms. 5 Litecoin X 6 Cardanos X To the best of our knowledge, this is the first work in 7 Stellar X literature that discusses such a widely spread vulnerability 8 Zcash X 9 IOTA Winternitz in the blockchain context. We summarize our contributions 10 Monero X as follows: 11 Dash X 12 NEM X A novel blockchain steganographic technique. We propose a 13 Ethereum Classic X new steganographic technique that affects most cryptocur- 14 Komodo X rencies. Our technique greatly increases the throughput 15 Verge X 16 Lisk X of the state-of-the-art blockchain steganographic attacks. 17 Dogecoin X We present our general attack against the widely-used 18 Decred X X 19 Nano X CryptoNote framework, and we implement and evaluate the 20 Wanchain X X attack on two real world cryptocurrencies – Monero and 21 Bytecoin X Bytecoin. 22 Siacoin X 23 Bitcoin Diamond X A covert broadcast communication system. We designed and 24 BitShares X 25 Waves implemented the world’s first practical covert broadcast com- X munication system by integrating our steganographic tech- TABLE I: Top 25 cryptocurrencies (currencies checked with nique with Boneh et al. broadcast encryption scheme [11]. either ECDSA or ring signature are effected by our attacks.) The prototype system is deployed on Bytecoin, and it can Countermeasures. We propose a stego-resistant blockchain be used to bypass any censorship mechanisms, as the mere framework to prevent steganographic attacks and mitigate existence of such a channel is unobservable. wallet subversion attacks. In short, in this framework, the Persistent storage. With the proposed steganographic tech- miners either re-randomize the transactions’ signatures or nique, anyone can use the blockchain as a cheap hidden replace them with non-interactive zero-knowledge proofs. persistent storage along with their daily transactions. For Subsequently, the possibly stego-generated signatures are instance, this can be used for uncensorable cyberlockers. At dropped. the time of submission, persistently storing 1GB of data on Bytecoin blockchain costs less than $3. II. PRELIMINARIES Wallet subversion attacks. For the first time, we point out Notations. Unless specified in the context, we use hashp : that there is a troubling risk of massive coin stealing among 0; 1 ∗ Zp and hashg : 0; 1 ∗ G as two collision all of the current cryptocurrency wallets by demonstrating resistantf g 7! hash functions thatf mapg an7! arbitrary length string efficient and effective subversion attacks within the realm to a group element in Zp and G, respectively. of Kleptography and Algorithm Substitution Attacks. This Brief description of CryptoNote. CryptoNote is a protocol attack possesses the following properties: proposed by Nicolas van Saberhagen [13], and it has been implemented in many emerging cryptocurrencies, such as Passive attack. After the victim user downloads and installs • Bytecoin [14], CryptoNoteCoin [15], Fantomcoin [16], etc. the subverted wallet, the attacker does not need to inter- Compared to Bitcoin-like cryptocurrencies, CryptoNote of- act directly with the victim’s wallet. The communication fers two main features: (i) stealth address via non-interactive channel between the subverted wallets and the attacker is key exchange and (ii) set anonymity via (linkable) ring through the posted blockchain transactions. signatures. Undetectability.