Many new blockchains are being created, but what about the security aspects? Blockchain is claimed to be ultra-secure, and not many people have doubted this statement. Blockchain developers can become quite creative in building new platforms, but, leaving room for errors, which is normal.

Can Blockchain Be Hacked?

Recent hacks have proven that blockchain is not impregnable.

• Nicehash hack, Dec 2017 – Cryptocurrency amounting to $64 million Bitcoin is said to be stolen from cryptocurrency mining marketplace NiceHash, emptying its entire bitcoin wallet.
• CoinDash ICO hack, July 2017 – CoinDash, a blockchain start-up, aimed at raising capital for cryptocurrency social trading by selling their digital tokens in exchange for Ethereum. On 17th July, the day of ICO sale, on 3 minutes after the start of the sale, CoinDash website was compromised. The address for sending investments was changed with a fake address and investments were funded to the attacker’s account. Around $7.4 million Ethereum was stolen during this hack.
• Krypton (KR) & Shift (SHF), Aug 2016 – Attackers targeted Ethereum-based Blockchains as the cryptocurrencies, Krypton (KR) and Shift, both Ethereum type coins using the version of 51% attack. The attackers could exploit the Blockchain with a two-step attack. Overpowering the network with 51% attack to ensure rollback on transactions and spending the coins twice; and employing DDoS nodes to enhance network power. The attack led to the loss of 21,465 KR, $3000 at the time.
• Steemit, July 2016 – The Blockchain-based blogging platform, was hacked. Vulnerability on the Web browser front end and not on the cryptocurrency itself led to this attack. Around 250 user accounts were compromised, resulting in the loss $85,000 worth of Steem Dollars and cryptocurrency Steem.
• The DAO, May 2016 – Blockchain based venture capital, The DAO – an Ethereum Project, hacked for $60 million.

While most of these occurred on the public blockchain, private blockchain can be vulnerable as well. With everyone, from startups to heavyweight MNCs boarding the blockchain express and new applications being rolled out by the minute, blockchain security will be increasingly tested.

Our Model For Securing Blockchain Technology

Secure Design: to eliminate security risks at inception and enhance ease of scalability. We assess the design and architecture of the blockchain ecosystem to eliminate possible loopholes from the initial design. Our review encompasses the operational models, network architecture, transaction flow, design and implementation models.

Technology Audit: to eliminate technology and process risks. We review the technology and processes in the blockchain system e.g. application platforms, distributed ledgers, consensus protocols, smart contracts, cryptography etc using our exclusive governance framework.

Compliance Audit: to ensure the security of data in transit and at rest. We check regulatory compliance of PII and other critical data, including a review of the genesis block, chain code, algorithms, membership service providers (MSP) etc.

Security Assessment: to avert compromise, manipulation, and tampering of the ecosystem. We will attempt to exploit any vulnerability or weakness discovered during the previous stages. The goal of this stage is to find issues relating to compromise or takeover of peers, tampering blocks, manipulate the consensus, which can disturb the ecosystem. Strategy based use cases will be designed for assessment and PoC will be captured.

API & VM Review: to ensure the nodes of the network are not compromised. This phase includes assessment of the services hosting the platform, SDKs, and APIs used by the applications to communicate with the blockchain ecosystem.

Do not leave your blockchain security and business reputation to chance. Talk to Aujas, the globally recognized cybersecurity specialists. We will work closely with your team to assess, enable and secure your blockchain lifecycle.

The Blockchain implementation

• Nodes
  • Vulnerability Assessment and Build Review
  • Redundancy Testing
  • Synchronisation Testing
  • Consensus Algorithm Testing
  • Private Keys (The Wallets)
    • Password Strength Review
    • Key Storage Review

• Shared Ledger (The Storage)
  • Information Disclosure Checks
  • Smart Contracts (The Functionality)
    • Secure Code Review

• The Application (The Usage)
  • API Testing
    • Web Application
      • OWASP Style Testing
    • Mobile Application
      • OWASP Style Testing

Theweborion Helps You Secure Your Blockchain Lifecycle

To make your blockchain security implementation seamless and speedy, we have created an exclusive Risk Management Framework. This guides you to adopt and implement blockchain security regulations and best practices.

• We provide solutions to manage the identities of people, business, and things.
• Our digital security team helps you to secure your business application’s integration with various merchants and aggregators.
• Apart from technical standards and activities like assessment-pen testing, we also focus on security governance.
• Our consulting team will help enable and secure Blockchain lifecycle and help facilitate secure online transactions and formalize digital relationships with transactions revolving around every possible sector.

Get In Touch

Want to know more about our penetration tests? We’re here to help or write us on help@theweborion.com