Investigating Cryptocurrencies Investigating Cryptocurrencies Understanding, Extracting, and Analyzing Blockchain Evidence Nick Furneaux Investigating Cryptocurrencies: Understanding, Extracting, and Analyzing Blockchain Evidence Published by John Wiley & Sons, Inc. 10475 Crosspoint Boulevard Indianapolis, IN 46256 www.wiley.com Copyright © 2018 by John Wiley & Sons, Inc., Indianapolis, Indiana Published simultaneously in Canada ISBN: 978-1-119-48058-7 ISBN: 978-1-119-48057-0 (ebk) ISBN: 978-1-119-48056-3 (ebk) Manufactured in the United States of America 10 9 8 7 6 5 4 3 2 1 No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permis- sion of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at http://www.wiley .com/go/permissions. Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations or war- ranties with respect to the accuracy or completeness of the contents of this work and specifically disclaim all warranties, including without limitation warranties of fitness for a particular purpose. No warranty may be created or extended by sales or promotional materials. The advice and strategies contained herein may not be suitable for every situation. This work is sold with the understanding that the publisher is not engaged in rendering legal, accounting, or other professional services. If professional assistance is required, the services of a competent professional person should be sought. Neither the publisher nor the author shall be liable for damages arising herefrom. The fact that an organization or Web site is referred to in this work as a citation and/or a potential source of further information does not mean that the author or the publisher endorses the information the organization or website may provide or recommendations it may make. Further, readers should be aware that Internet websites listed in this work may have changed or disappeared between when this work was written and when it is read. For general information on our other products and services please contact our Customer Care Department within the United States at (877) 762-2974, outside the United States at (317) 572-3993 or fax (317) 572-4002. Wiley publishes in a variety of print and electronic formats and by print-on-demand. Some material included with standard print versions of this book may not be included in e-books or in print-on-demand. If this book refers to media such as a CD or DVD that is not included in the version you purchased, you may download this material at http://booksupport.wiley.com. For more information about Wiley products, visit www.wiley.com. Library of Congress Control Number: 2018939042 Trademarks: Wiley and the Wiley logo are trademarks or registered trademarks of John Wiley & Sons, Inc. and/or its affiliates, in the United States and other countries, and may not be used without written permission. All other trademarks are the property of their respective owners. John Wiley & Sons, Inc. is not associated with any product or vendor mentioned in this book. To Claire, Toby, and Loulé I love you Nick About the Author Nick has been playing and working with computers since his parents gave him a Sinclair ZX81 when he was 12. By the age of 14, Nick had designed a computer program to convince his teacher that he had gained access to his bank account. In the past 20 years, he has provided cyber security, forensics consultancy, and training to companies and law-enforcement institutions in the UK and across Europe, the United States, and Asia, and has lectured on the subject to numerous groups and organisations. Nick has been specifically involved in the development of data extraction and digital forensic analysis techniques that work on live, running computers, and has had the opportunity to work with some of the top security researchers in the world. He is currently working with government and corporate teams throughout Europe in various forms of data acquisition, teaching computer memory analysis and carrying out cryptocurrency investigations. Nick is the Managing Director of CSITech Ltd and Director of the online forensics training company CSILearn Ltd. Throughout his career, family has always come first. He enjoys spending time and travelling with his wife and son as well as caring for his daughter who suffers with a rare genetic condition (https://www.kleefstrasyndrome.org). In his limited spare time, he enjoys running and sport climbing. vii About the Technical Editor David S. Hoelzer (MSc) is the Director of Operations for Enclave Forensics, Inc., the Dean of Faculty for the SANS Technology Institute, and a Fellow with the SANS Institute. He is well known in the field of cyber security in general and more specifically in intrusion detection and network monitoring circles as an international speaker/teacher on information security topics, having devel- oped a number of both offensive and defensive tools and techniques. For the past few years, he has specialized in covert communications development and scalable back-end communications solutions coupled with threat hunting and counterintelligence. He has more than thirty years of experience in the information technology field, with more than twenty-five of those years engaged in information security, both defensively and offensively. He currently resides in New York. ix Credits Project Editor Executive Editor Kathryn Duggan Jim Minatel Technical Editor Project Coordinator, Cover David S Hoelzer Brent Savage Production Editor Proofreader Athiyappan Lalith Kumar Nancy Bell Copy Editor Indexer Kim Cofer Johnna VanHoose Dinse Production Manager Cover Designer Katie Wisor Wiley Manager of Content Enablement Cover Image and Operations ©allanswart/iStockphoto Pete Gaughan Marketing Manager Christie Hilbrich xi Acknowledgments Firstly, thank you to my Mum for not just teaching me to read as a child, but to learn to love reading and writing. One of the reasons I started writing this book in late 2017 was to take my mind off her finally going to sleep in the July after showing pancreatic cancer who was boss for four years. She would have been really happy that I eventually wrote a book, even if she didn’t understand a word of it! (Although she would have tried and told me it was the best book ever!) Secondly, my “brother from another mother,” Chris Hadnagy, who suggested I write this book and has stood tirelessly at my shoulder through the extraor- dinary challenges of the past few years. Next, thank you to the team at Wiley. Jim Minatel, I appreciate you giving me a chance—we need to go watch some racing sometime! And to Kathi Duggan, for your astonishing levels of patience dealing with my writing style and for your personal words of kindness over the past months. Finally, Dave Hoelzer, thank you for being technical editor. Although we have been friends for years, your direct edits such as “Wrong” and “I don’t know what you are talking about” were exactly what I needed and have made this book so much better. xiii Contents at a glance Foreword xxi Introduction xxiii Part I Understanding the Technology 1 Chapter 1 What Is a Cryptocurrency? 3 Chapter 2 The Hard Bit 15 Chapter 3 Understanding the Blockchain 39 Chapter 4 Transactions 67 Chapter 5 Mining 87 Chapter 6 Wallets 95 Chapter 7 Contracts and Tokens 109 Part II Carrying Out Investigations 117 Chapter 8 Detecting the Use of Cryptocurrencies 119 Chapter 9 Analysis of Recovered Addresses and Wallets 147 Chapter 10 Following the Money 175 Chapter 11 Visualization Systems 199 Chapter 12 Finding Your Suspect 217 Chapter 13 Sniffing Cryptocurrency Traffic 245 Chapter 14 Seizing Coins 255 Chapter 15 Putting It All Together 267 Index 275 xv Contents Foreword xxi Introduction xxiii Part I Understanding the Technology 1 Chapter 1 What Is a Cryptocurrency? 3 A New Concept? 3 Leading Currencies in the Field 8 Is Blockchain Technology Just for Cryptocurrencies? 9 Setting Yourself Up as a Bitcoin User 10 Summary 14 Chapter 2 The Hard Bit 15 Hashing 16 Public/Private Key Encryption 21 RSA Cryptography 23 Elliptic Curve Cryptography 28 Building a Simple Cryptocurrency in the Lab 32 Summary 36 Chapter 3 Understanding the Blockchain 39 The Structure of a Block 40 The Block Header 42 Deconstructing Raw Blocks from Hex 47 Applying This to the Downloaded Hex 51 Number of Transactions 55 Block Height 57 Forks 58 The Ethereum Block 61 Summary 65 xvii xviii Contents Chapter 4 Transactions 67 The Concept behind a Transaction 67 The Mechanics of a Transaction 69 Understanding the Mempool 76 Understanding the ScriptSig and ScriptPubKey 77 Interpreting Raw Transactions 79 Extracting JSON Data 81 Analyzing Address History 82 Creating Vanity Addresses 83 Interpreting Ethereum Transactions 85 Summary 86 Chapter 5 Mining 87 The Proof-of-Work Concept 89 The Proof-of-Stake Concept 90 Mining Pools 90 Mining Fraud 92 Summary 93 Chapter 6 Wallets 95 Wallet Types 96 Software Wallets 96 Hardware Wallets 97 Cold Wallets or Cold Storage 98 Why Is Recognizing