DOCSLIB.ORG

A Survey on Ethereum Systems Security: Vulnerabilities, Attacks and Defenses Huashan Chen, Marcus Pendleton, Laurent Njilla, and Shouhuai Xu

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
A Survey on Ethereum Systems Security: Vulnerabilities, Attacks and Defenses Huashan Chen, Marcus Pendleton, Laurent Njilla, and Shouhuai Xu 1 A Survey on Ethereum Systems Security: Vulnerabilities, Attacks and Defenses Huashan Chen, Marcus Pendleton, Laurent Njilla, and Shouhuai Xu Abstract—The blockchain technology is believed by many to to represent autonomous programs, leading to a new paradigm be a game changer in many application domains, especially of Decentralized Applications (DApps) that run on top of financial applications. While the first generation of blockchain technology (i.e., Blockchain 1.0) is almost exclusively used for blockchains and consist of many interacting smart contracts. cryptocurrency purposes, the second generation (i.e., Blockchain The Ethereum system was launched in 2015 to support smart 2.0), as represented by Ethereum, is an open and decentralized contracts, while offering its inherent cryptocurrency known as platform enabling a new paradigm of computing — Decentralized Ether [5] and using an account-centered model (rather than Applications (DApps) running on top of blockchains. The rich the UTXO model mentioned above). Ethereum has become applications and semantics of DApps inevitably introduce many security vulnerabilities, which have no counterparts in pure the de facto standard platform for DApps. At the moment cryptocurrency systems like Bitcoin. Since Ethereum is a new, of writing, the market value of Ethereum is over US$31B yet complex, system, it is imperative to have a systematic and with approximately one million smart contracts executing on comprehensive understanding on its security from a holistic top of the Ethereum blockchain [6], [7]. The success of perspective, which is unavailable. To the best of our knowledge, Ethereum ushers in Blockchain 2.0, which goes much beyond the present survey, which can also be used as a tutorial, fills this void. In particular, we systematize three aspects of Ethereum the payment-centered Blockchain 1.0. systems security: vulnerabilities, attacks, and defenses. We draw While Ethereum facilitates semantically richer applications insights into, among other things, vulnerability root causes, attack than Bitcoin, it also enlarges the threat surface, as evidenced consequences, and defense capabilities, which shed light on future by the many high-profile attacks. One example is the DAO [8] research directions. attack in year 2016, in which case an attacker exploited the so- Index Terms—Blockchain, Ethereum, Security, Smart Con- called reentrancy vulnerability (which will be detailed later) tract, Vulnerabilities, Attacks, Defenses to steal approximately US$60M. In July 2017, a vulnerability in the Parity wallet contract caused the loss of US$31M [9]. In April 2018, the MyEtherWallet wallet fell victim to a I. INTRODUCTION BGP and DNS hijacking attack, enabling the hacker to steal The notion of blockchain was implicitly introduced in 2008 approximately US$17M [10]. These attacks highlight that our as the key underlying technique of the cryptocurrency known capabilities in securing the Ethereum system are limited. This as Bitcoin [1], which uses a transaction-centered model known should not be taken as a surprise because Ethereum is a as unspent transaction outputs (UTXO). In this model, a new programming paradigm with DApps running on top of blockchain is a distributed and public ledger, which records blockchains with many autonomous contracts. the payment transactions between parties over a peer-to-peer The motivation of the present survey is in three-fold of (P2P) network. Unlike traditional digital cash systems [2], in researchers, practitioners, and students. From the standpoint which there is a trusted third party (e.g., bank), there is no of a researcher who wants to investigate Ethereum security, trusted third party in a blockchain system in general and in there is a need for a source of systematized treatment on the Bitcoin in particular. Bitcoin is often referred to as Blockchain problems related to Ethereum security. Despite the fact that 1.0 because it only offers payment services. The innovation there have been some surveys, they did not offer a systematic arXiv:1908.04507v1 [cs.CR] 13 Aug 2019 of the Bitcoin system is its consensus protocol, which allows and comprehensive view on Ethereum vulnerabilities, attacks, mutually distrusting nodes in a P2P network to eventually and defenses as we do. While referring to the related prior reach a consensus on the outcome after executing payment work in Section I-B for details, we mention the following: transactions. Unlike traditional consensus protocols [3], the there is neither systematic understanding of the Ethereum participants are from an open network and are incentivized by vulnerabilities that have been discovered, nor systematic un- the payment of Bitcoins (or BTCs), which are “mined” through derstanding of their root causes; this may explain why there are a clever cryptographic hash function known as Proof-of-Work still a number of vulnerabilities that are completely open. From (PoW), an idea originally proposed as an anti-spam technique the standpoint of a practitioner, there is a need for a source of [4]. best practices and guiding principles. Industry has conducted Perhaps inspired by the success of Bitcoin as well as due diligence in summarizing many best practices [11], which the need to support semantically richer (than just payment) however may overwhelm practitioners. Therefore, it might be applications, the notion of smart contracts has been introduced more useful to have a small number of guiding principles that are easier to adopt in practice. From the standpoint of a student H. Chen and S. Xu are with the Department of Computer Science, who wants to learn about Ethereum security, there is a need University of Texas at San Antonio. M. Pendleton and L. Njilla are with the U.S. Air Force Research Laboratory, Rome, NY. Correspondence: for a succinct yet comprehensive and systematic source that [email protected] also offer references to materials of greater details. 2 A. Our contributions 1) Industry has come up with a significant set of best We provide a systematic and comprehensive survey on practices for guiding the development of smart contracts. Ethereum systems security. It is systematic in the sense that These best practices, if adequately executed, can indeed vulnerabilities, attacks, and defenses as well as the relation- avoid many vulnerabilities. ships between them are accommodated. It is comprehensive 2) Existing proactive defenses can defend against attacks in the sense that it covers both the Ethereum platform via that exploit many vulnerabilities; in contrast, existing a layered architecture and the environment in which the reactive defenses can only defend against attacks that Ethereum platform operates. In terms of vulnerabilities, we exploit a few vulnerabilities. enumerate 44 types of Ethereum vulnerabilities according to 3) There are large discrepancies between levels of effort the layers of the Ethereum architecture and the environment in and investment into different kinds of attacks (i.e., much which Ethereum operates. Perhaps more importantly, we ana- more investment into defending against high-profile at- lyze and systematize the root causes of those vulnerabilities. tacks than low-profile attacks). This allows us to provide insights into how to prevent some 4) Existing studies focus on defending against attacks that Ethereum vulnerabilities and how to cope with the inevitable attempt to exploit vulnerabilities in the DApp back-end vulnerabilities, including those that are largely open. Some of (i.e., smart contracts), but largely ignore the protection our findings and insights are highlighted as follows: of the DApp front-end (i.e., browser) and the interactions between the front-end and the back-end. 1) Ethereum smart contracts introduce new kinds of vul- nerabilities that do not have counterparts in traditional Although the present paper focuses on the Ethereum system, paradigm of applications. the aforementioned findings related to vulnerabilities, attacks 2) It is important to design more secure programming and defenses might be applicable to blockchain-based systems languages and supporting tools for programmers to write in general. Moreover, we discuss some fundamental research more secure smart contracts. problems that must be adequately tackled in order to secure 3) The vulnerabilities caused by the design and implemen- and defend Ethereum and blockchain-based systems, includ- tation of the Ethereum blockchain are harder to cope ing: with than vulnerabilities in the traditional paradigm. 1) There is a lack of deep understanding on the rigorously- 4) The vulnerabilities in the Ethereum environment are defined properties of blockchain-based systems. largely caused by human, usability, and networking 2) There is a lack of deep understanding on the rigorous factors. analysis methodologies that are necessary and sufficient 5) There are many vulnerabilities (e.g., outsourceable puz- for analyzing the desired properties of blockchain-based zle, 51% hashrate, and under-priced opcodes) that must systems. be tackled in order to adequately defend Ethereum or 3) There is a lack of deep understanding on the metrics that blockchain-based DApp systems in general. are necessary and sufficient for analyzing the security In terms of attacks, we systematize 26 attacks against and risk of blockchain-based systems. Ethereum according to the layers of the Ethereum architecture. In order to improve readability and ease the reference to the Perhaps more importantly, we relate these attacks to the large number of vulnerabilities,
Load more

Recommended publications
  • Examining the Lightning Network on a Protocol Level
    Examining the Lightning network on a protocol level Rene Pickhardt (Data Science Consultant) https://www.rene-pickhardt.de & https://twitter.com/renepickhardt München 19.7.2018 I've been told I should start any talk with something everybody in the audience should know A standard Bitcoin Transaction has 6 data fields ( The following is a brief summary of https://en.bitcoin.it/wiki/Transaction#Input ) ● Version number (4 Bytes) ● In-Counter (1-9 Bytes) ● List of inputs (depending on the Value of <In-Counter>) ● Out-Counter (1-9 Bytes) ● List of Outputs (depending on the Value of <Out-Counter>) ● Lock_time (4 Bytes) ( Bitcoin Transaction with 3 inputs and 2 outputs Data consists mainly of executable scripts! A chain of Bitcoin Transactions with 3 UTXO ● Outputs are references by the inputs ● The Script in the output defines how the transaction can be spent ● Owning Bitcoins means being able to spend the output of an unspent transaction ○ Provide an input script ○ Concatenate it with with some outputscript of an unspent transaction ○ The combined Script needs to evaluate to True Spending a Pay-to-PubkeyHash (standard TX) ● ScriptPubKey (aka the Output Script) ○ OP_DUP OP_HASH160 <pubKeyHash> OP_EQUALVERIFY OP_CHECKSIG ● ScriptSig: (aka the Input Script) ○ <sig> <pubKey> ● Explainations ○ OP_CODES are the instructions of the script language within Bitcoin ○ <data> is depicted like html tags with lesser than and greater than signs ○ The complete script is concatenated as Input || Output and then being executed on a Stack machine <sig> <pubKey>
    [Show full text]
  • Pdp11-40.Pdf
    processor handbook digital equipment corporation Copyright© 1972, by Digital Equipment Corporation DEC, PDP, UNIBUS are registered trademarks of Digital Equipment Corporation. ii TABLE OF CONTENTS CHAPTER 1 INTRODUCTION 1·1 1.1 GENERAL ............................................. 1·1 1.2 GENERAL CHARACTERISTICS . 1·2 1.2.1 The UNIBUS ..... 1·2 1.2.2 Central Processor 1·3 1.2.3 Memories ........... 1·5 1.2.4 Floating Point ... 1·5 1.2.5 Memory Management .............................. .. 1·5 1.3 PERIPHERALS/OPTIONS ......................................... 1·5 1.3.1 1/0 Devices .......... .................................. 1·6 1.3.2 Storage Devices ...................................... .. 1·6 1.3.3 Bus Options .............................................. 1·6 1.4 SOFTWARE ..... .... ........................................... ............. 1·6 1.4.1 Paper Tape Software .......................................... 1·7 1.4.2 Disk Operating System Software ........................ 1·7 1.4.3 Higher Level Languages ................................... .. 1·7 1.5 NUMBER SYSTEMS ..................................... 1-7 CHAPTER 2 SYSTEM ARCHITECTURE. 2-1 2.1 SYSTEM DEFINITION .............. 2·1 2.2 UNIBUS ......................................... 2-1 2.2.1 Bidirectional Lines ...... 2-1 2.2.2 Master-Slave Relation .. 2-2 2.2.3 Interlocked Communication 2-2 2.3 CENTRAL PROCESSOR .......... 2-2 2.3.1 General Registers ... 2-3 2.3.2 Processor Status Word ....... 2-4 2.3.3 Stack Limit Register 2-5 2.4 EXTENDED INSTRUCTION SET & FLOATING POINT .. 2-5 2.5 CORE MEMORY . .... 2-6 2.6 AUTOMATIC PRIORITY INTERRUPTS .... 2-7 2.6.1 Using the Interrupts . 2-9 2.6.2 Interrupt Procedure 2-9 2.6.3 Interrupt Servicing ............ .. 2-10 2.7 PROCESSOR TRAPS ............ 2-10 2.7.1 Power Failure ..............
    [Show full text]
  • Rev. Rul. 2019-24 ISSUES (1) Does a Taxpayer Have Gross Income Under
    26 CFR 1.61-1: Gross income. (Also §§ 61, 451, 1011.) Rev. Rul. 2019-24 ISSUES (1) Does a taxpayer have gross income under § 61 of the Internal Revenue Code (Code) as a result of a hard fork of a cryptocurrency the taxpayer owns if the taxpayer does not receive units of a new cryptocurrency? (2) Does a taxpayer have gross income under § 61 as a result of an airdrop of a new cryptocurrency following a hard fork if the taxpayer receives units of new cryptocurrency? BACKGROUND Virtual currency is a digital representation of value that functions as a medium of exchange, a unit of account, and a store of value other than a representation of the United States dollar or a foreign currency. Foreign currency is the coin and paper money of a country other than the United States that is designated as legal tender, circulates, and is customarily used and accepted as a medium of exchange in the country of issuance. See 31 C.F.R. § 1010.100(m). - 2 - Cryptocurrency is a type of virtual currency that utilizes cryptography to secure transactions that are digitally recorded on a distributed ledger, such as a blockchain. Units of cryptocurrency are generally referred to as coins or tokens. Distributed ledger technology uses independent digital systems to record, share, and synchronize transactions, the details of which are recorded in multiple places at the same time with no central data store or administration functionality. A hard fork is unique to distributed ledger technology and occurs when a cryptocurrency on a distributed ledger undergoes a protocol change resulting in a permanent diversion from the legacy or existing distributed ledger.
    [Show full text]
  • White Paper of Bitcoin Ultimatum Introduction
    White Paper of Bitcoin Ultimatum Introduction 1. Problematic of the Blockchain 4. Bitcoin Ultimatum Architecture industry 4.1. Network working principle 1.1. Transactions Anonymity 4.1.1. Main Transaction Types 1.2. Insufficient Development of Key Aspects of the 4.1.1.1. Public transactions Technology 4.1.1.2. Private transactions 1.3. Centralization 4.1.2. Masternode Network 1.4. Mining pools and commission manipulation 4.2. How to become a validator or masternode in 1.5. Decrease in Transaction Speeds BTCU 4.3. Network Scaling Principle 2. BTCU main solutions and concepts 4.4. Masternodes and Validators Ranking System 4.5. Smart Contracts 2.1. Consensus algorithm basis 4.6. Anonymization principle 2.2. Leasing and Staking 4.7. Staking and Leasing 2.3. Projects tokenization and DeFi 4.7.1. Staking 2.4. Transactions Privacy 4.7.2. Leasing 2.5. Atomic Swaps 4.7.2 Multileasing 4.8. BTCU Technical Specifications 3. Executive Summary 4.8.1. Project Stack 4.8.2. Private key generation algorithm 5. Bitcoin Ultimatum Economy 5.1. Initial Supply and Airdrop 5.2. Leasing Economy 5.3. Masternodes and Validators Commission 5.4. Transactions Fee 6. Project Roadmap 7. Legal Introduction The cryptocurrency market is inextricably tied to the blockchain – its fundamental and underlying technology. The modern market is brimming with an abundance of blockchain protocols, algorithms, and concepts, all of which have fostered the development of a wide variety of services and applications. The modern blockchain market offers users an alternative to both established financial systems and ecosystems/infrastructures of applications and services.
    [Show full text]
  • Embedded C Programming I (Ecprogrami)
    To our customers, Old Company Name in Catalogs and Other Documents On April 1st, 2010, NEC Electronics Corporation merged with Renesas Technology Corporation, and Renesas Electronics Corporation took over all the business of both companies. Therefore, although the old company name remains in this document, it is a valid Renesas Electronics document. We appreciate your understanding. Renesas Electronics website: http://www.renesas.com April 1st, 2010 Renesas Electronics Corporation Issued by: Renesas Electronics Corporation (http://www.renesas.com) Send any inquiries to http://www.renesas.com/inquiry. Notice 1. All information included in this document is current as of the date this document is issued. Such information, however, is subject to change without any prior notice. Before purchasing or using any Renesas Electronics products listed herein, please confirm the latest product information with a Renesas Electronics sales office. Also, please pay regular and careful attention to additional and different information to be disclosed by Renesas Electronics such as that disclosed through our website. 2. Renesas Electronics does not assume any liability for infringement of patents, copyrights, or other intellectual property rights of third parties by or arising from the use of Renesas Electronics products or technical information described in this document. No license, express, implied or otherwise, is granted hereby under any patents, copyrights or other intellectual property rights of Renesas Electronics or others. 3. You should not alter, modify, copy, or otherwise misappropriate any Renesas Electronics product, whether in whole or in part. 4. Descriptions of circuits, software and other related information in this document are provided only to illustrate the operation of semiconductor products and application examples.
    [Show full text]
  • Deviant Decentralized Exchange
    DDEEVVXX Deviant Decentralized Exchange A hybrid exchange leveraging Smartcoins on the Bitshares (BTS) blockchain. CONTENTS 03 What is the current landscape for trading crypto assets? 05 Centralized Exchanges 08 Decentralized Exchanges 11 Hybrid Exchanges 13 DEVX Platform 14 Platform Overview 16 DEVX Smart Coin 17 DEVX off-chain engine - The DEVX Transient Protocol (DEVTP) 19 Trading Process 25 What is the status of development / roadmap for these innovations? 26 DEVX Team 03 Crypto assets are here to stay. According to Apple co-founder Steve Wozniak, Bitcoin and WHAT IS THE blockchain will be the next major IT revolution, and will achieve full CURRENT potential in a decade. According to LANDSCAPE FOR Paypal co-founder Peter Thiel, Bitcoin is the next Digital Gold. TRADING CRYPTO Since Bitcoin’s release in 2009, 1,622 altcoin variants have been issued. ASSETS? 2018 has already broken all records with 345 Initial Coin Offerings, and over US$ 7.7 billion of capital raised. DEVX the next revolution 04 Growth in the number of crypto assets has also driven an increase in crypto asset trading, in order to satisfy the requirements of the increasingly numerous universe of holders, investors, arbitrageurs, market makers, speculators and hedgers. There are presently more than 500 crypto asset exchanges to bring together buyers and sellers, where crypto assets are traded for either different digital currencies, or for other assets such as conventional fiat money. These exchanges operate mostly outside Western countries, and range from fully-online platforms to bricks-and-mortar businesses. Currently, almost two thirds of all daily global crypto asset trading volume results from activity on just ten of these exchanges.
    [Show full text]
  • Operating Systems What Is an Operating System Real-Time
    Operating Systems Babak Kia Adjunct Professor Boston University College of Engineering Email: bkia -at- bu.edu ENG SC757 - Advanced Microprocessor Design What is an Operating System z Operating System handles • Memory Addressing & Management • Interrupt & Exception Handling • Process & Task Management • File System • Timing • Process Scheduling & Synchronization z Examples of Operating Systems • RTOS – Real-Time Operating System • Single-user, Single-task: example PalmOS • Single-user, Multi-task: MS Windows and MacOS • Multi-user, Multi-task: UNIX 2 Real-Time Operating Systems z Operating systems come in two flavors, real-time versus non real-time z The difference between the two is characterized by the consequences which result if functional correctness and timing parameters are not met in the case of real-time operating systems z Real-time operating systems themselves have two varieties, soft real-time systems and hard real- time systems z Examples of real-time systems: • Food processing • Engine Controls • Anti-lock breaking systems 3 1 Soft versus Hard Real-Time z In a soft real-time system, tasks are completed as fast as possible without having to be completed within a specified timeframe z In a hard real-time operating system however, not only must tasks be completed within the specified timeframe, but they must also be completed correctly 4 Foreground/Background Systems z The simplest forms of a non real-time operating systems are comprised of super-loops and are called foreground/background systems z Essentially this is an application
    [Show full text]
  • Blocksci: Design and Applications of a Blockchain Analysis Platform
    BlockSci: Design and applications of a blockchain analysis platform Harry Kalodner Steven Goldfeder Alishah Chator [email protected] [email protected] [email protected] Princeton University Princeton University Johns Hopkins University Malte Möser Arvind Narayanan [email protected] [email protected] Princeton University Princeton University ABSTRACT to partition eectively. In fact, we conjecture that the use of a tra- Analysis of blockchain data is useful for both scientic research ditional, distributed transactional database for blockchain analysis and commercial applications. We present BlockSci, an open-source has innite COST [5], in the sense that no level of parallelism can software platform for blockchain analysis. BlockSci is versatile in outperform an optimized single-threaded implementation. its support for dierent blockchains and analysis tasks. It incorpo- BlockSci comes with batteries included. First, it is not limited rates an in-memory, analytical (rather than transactional) database, to Bitcoin: a parsing step converts a variety of blockchains into making it several hundred times faster than existing tools. We a common, compact format. Currently supported blockchains in- describe BlockSci’s design and present four analyses that illustrate clude Bitcoin, Litecoin, Namecoin, and Zcash (Section 2.1). Smart its capabilities. contract platforms such as Ethereum are outside our scope. Second, This is a working paper that accompanies the rst public release BlockSci includes a library of useful analytic and visualization tools, of BlockSci, available at github.com/citp/BlockSci. We seek input such as identifying special transactions (e.g., CoinJoin) and linking from the community to further develop the software and explore addresses to each other based on well-known heuristics (Section other potential applications.
    [Show full text]
  • Accounting for and Auditing of Digital Assets Digital Assets Working Group
    Practice aid Accounting for and auditing of digital assets Digital Assets Working Group Accounting Subgroup Matthew Schell, Chair Kevin Jackson Mark Murray Crowe LLP PwC RSM US LLP Michael Bingham Jin Koo Amy Park US Government Accountability BDO USA LLP Deloitte & Touche LLP Office Corey McLaughlin Beth Paul Brian Fields Cohen & Company PwC KPMG LLP Lan Ming Aleks Zabreyko Rahul Gupta Ernst & Young LLP Connor Group Grant Thornton LLP Christopher Moore Crowe LLP Auditing Subgroup Amy Steele, Chair Angie Hipsher-Williams Shelby Murphy Deloitte & Touche LLP Crowe LLP Deloitte & Touche LLP Michael Bingham Michael Kornstein Christian Randall US Government Accountability Office Ernst & Young LLP Cohen & Company Jay Brodish Sara Krople Jay Schulman PwC Crowe LLP RSM US LLP Damon Busse Bryan Martin Robert Sledge Baker Tilly Virchow Krause, LLP BDO USA LLP KPMG LLP Mary Grace Davenport Dylan McDermott Jagruti Solanki PwC Coinbase Aprio Jeremy Goss Grant Thornton LLP AICPA Senior Committees Financial Reporting Executive Committee Angela Newell, Chair Mark Crowley Jeff Sisk Kelly Ardrey Jr. Sean Lager Dusty Stallings Michelle Avery Mark Northan Lynne Triplett Lee Campbell Bill Schneider Mike Winterscheidt Cathy Clarke Rachel Simons Aleks Zabreyko Assurance Services Executive Committee Jim Burton, Chair Mary Grace Davenport Brad Muniz Christine Anderson Chris Halterman Dyan Rohol Daniel Balla Elaine Howle Kimberly Ellison-Taylor Jennifer Burns Bryan Martin Miklos Vasarhelyi Auditing Standards Board Tracy Harding, Chair AICPA staff Diana Krupica,
    [Show full text]
  • Blockchain & Cryptocurrency Regulation
    Blockchain & Cryptocurrency Regulation Third Edition Contributing Editor: Josias N. Dewey Global Legal Insights Blockchain & Cryptocurrency Regulation 2021, Third Edition Contributing Editor: Josias N. Dewey Published by Global Legal Group GLOBAL LEGAL INSIGHTS – BLOCKCHAIN & CRYPTOCURRENCY REGULATION 2021, THIRD EDITION Contributing Editor Josias N. Dewey, Holland & Knight LLP Head of Production Suzie Levy Senior Editor Sam Friend Sub Editor Megan Hylton Consulting Group Publisher Rory Smith Chief Media Officer Fraser Allan We are extremely grateful for all contributions to this edition. Special thanks are reserved for Josias N. Dewey of Holland & Knight LLP for all of his assistance. Published by Global Legal Group Ltd. 59 Tanner Street, London SE1 3PL, United Kingdom Tel: +44 207 367 0720 / URL: www.glgroup.co.uk Copyright © 2020 Global Legal Group Ltd. All rights reserved No photocopying ISBN 978-1-83918-077-4 ISSN 2631-2999 This publication is for general information purposes only. It does not purport to provide comprehensive full legal or other advice. Global Legal Group Ltd. and the contributors accept no responsibility for losses that may arise from reliance upon information contained in this publication. This publication is intended to give an indication of legal issues upon which you may need advice. Full legal advice should be taken from a qualified professional when dealing with specific situations. The information contained herein is accurate as of the date of publication. Printed and bound by TJ International, Trecerus Industrial Estate, Padstow, Cornwall, PL28 8RW October 2020 PREFACE nother year has passed and virtual currency and other blockchain-based digital assets continue to attract the attention of policymakers across the globe.
    [Show full text]
  • Reentrant Code
    Reentrant Code a reentrant procedure can have several calls open to it at the same time in an interrupt environment, different ISRs may call the same routine in a multitasking or multiuser or multithreaded environment, a single copy of a subroutine may be shared by more than one task/user/thread Reentrant Task subroutine A Task B Reentrant Code Characteristics requirements: 1. any parameters or local variables must be on the stack frame 2. registers may be used for parameters and local variables but must be saved on or restored from the stack at beginning/end of the subroutine 3. guarantee that each call of the subroutine will create a separate stack frame to maintain data integrity 4. no self-modifying code Recursion recursive code must be reentrant recursive reentrant but reentrant recursive e.g. calculating 3! using recursion main move.w number,D0 pass the number jsr fact start recursive rtn move.w D0,result store the factorial stop #$2700 number dc.w 3 result ds.w 1 fact link A6,#-2 Stack structure move.w D0,-2(A6) subq.w #1,D0 bne push move.w -2(A6),D0 bra return push jsr fact mulu -2(A6),D0 return unlk A6 rts end main SP ->/////// A much more complex example: X: array [0..30] of words Y: longword Z, ALPHA, N: byte call order is S/R demo(X, Y, Z, ALPHA, N ) N is passed/returned by value, all others are passed by reference demo(X[w:31], Y[l], Z[b], ALPHA[b], N[b]) main CLR.W D2 zero entire word MOVE.B N,D2 N to low byte MOVE.W D2,-(SP) N on stack PEA ALPHA push arguments PEA Z in reverse order PEA Y PEA X JSR demo call
    [Show full text]
  • On the Security of Electroneum Cloud Mining
    This Selfie Does Not Exist: On the Security of Electroneum Cloud Mining Alexander Marsalek1, Edona Fasllija2 and Dominik Ziegler3 1Secure Information Technology Center Austria, Vienna, Austria 2Institute for Applied Information Processing and Communications (IAIK), Graz University of Technology, Graz, Austria 3Know-Center GmbH, Graz, Austria Keywords: Electroneum Cloud Mining, Cryptocurrency, Impersonation Attack, Image Manipulation. Abstract: The Electroneum cryptocurrency provides a novel mining experience called “cloud mining”, which enables iOS and Android users to regularly earn cryptocurrency tokens by simply interacting with the Electroneum app. Besides other security countermeasures against automated attacks, Electroneum requires the user to up- load selfies with a predefined gesture or a drawing of a symbol as a prerequisite for the activation of the mining process. In this paper, we show how a malicious user can circumvent all of these security features and thus create and maintain an arbitrary number of fake accounts. Our impersonation attack particularly focuses on creating non-existing selfies by relying on Generative Adversarial Network (GAN) techniques during account initialization. Furthermore, we employ reverse engineering to develop a bot that simulates the genuine Elec- troneum app and is capable of operating an arbitrary number of illegitimate accounts on one Android device, enabling the malicious user to obtain an unfairly large payout. 1 INTRODUCTION Rivet, 2019). Due to these effects, both Google and Apple prohibit cryptocurrency mining apps from their During 2017, the first and most popular cryptocurrency, application stores (Apple, 2019; Google, 2018), limiting Bitcoin, experienced an astonishing 13-fold increase in the accessibility of the average smartphone users to crypto mining. Despite this fact, several projects like value (Corcoran, 2017).
    [Show full text]