# Secure and Privacy-Aware Blockchain Design: Requirements, Challenges and Solutions
## 4 Attacks and Countermeasures
### Network Attacks and Countermeasures  
Network attacks leverage network design and properties to be successful. They can be categorized as active, where a malicious user alters or deletes information, and passive, where a malicious user listens to the data passing on the network. In the following, we detail the countermeasures that apply to the network attacks. Most of them rely on secure protocols such as TLS based on asymmetric cryptography (Public Key Infrastructure-PKI) or symmetric cryptography, whereas others are implemented at the network level, for example with network filtering, monitoring, or routing. We categorized **active attacks** as follows:  
* **IP spoofing attack:** In which an attacker uses (or spoofs) someone else's identity and communicates with this identity to get benefits from it [75]. * **Countermeasures:** Typically, it is possible to prevent such attacks by filtering network traffic in order to stop the delivery of spoofing packets. In [76], routing-based mechanisms are discussed to deal with IP spoofing attacks. These solutions are implemented by routers or end-hosts. * **Message modification attack:** A malicious user modifies the contents of a message being transmitted [75]. * **Countermeasures:** To deal with message modification attack, using a hash function is a typical solution [77]. * **Message forgery attack:** The goal of this attack is to create false information on the network. Sending a spam email by using the identity (e.g., name or email address) of another entity is an example of this attack [75]. * **Countermeasures:** Cryptographic mechanisms such as asymmetric key cryptography can be used to mitigate a message forgery attack. Sender and receiver have their own public and private key pair to encrypt and decrypt the message [78]. It ensures that the receiver receives the original message and proves the identity of the sender. * **(Distributed) Denial-of-Service (DoS) attack:** The adversary sends enough traffic so that the target is unable to process it and remains unavailable to legit users. Distributed denial-of-service (DDoS) is a distributed version of the DoS attack, where multiple nodes are orchestrated to attack the target simultaneously [6]. * **Countermeasures:** In [79], the authors discuss some prevention techniques against DDoS attack. It includes an intrusion prevention mechanism to disable unused network services which are not needed, install security patches to the host machine to prevent vulnerabilities in the system, use firewalls, and dynamically switch the IP address of the active server within a pool of other servers. * **Man-in-the-middle (MITM) attack:** An attacker intercepts communication and acts on behalf of one end to collect valuable data [80]. * **Countermeasures:** One proposed solution to avoid man-in-the-middle attacks is to monitor the network using an intrusion detection system. It observes the behavior of an attacker and gives an alert if an attacker tries to take control of network traffic [81]. * **Time delay attack:** The goal of this attack is to slow down the network traffic. An attacker tries to control the network traffic, which leads to the delay in the transmission of message [82]. Delay attack can be categorized in the following two attacks: BGP hijacking and Liveness attack. * **Countermeasures:** To prevent time delay attack, [PERSON] et al. [83], proposed a method to track and estimate the time delay during communication on the network. If the measured time delay is more than the allowed time delay, then the system issue an alarm signal to stable the system. It is a simple and inexpensive way to secure the system from time delay attacks. **Border gateway protocol hijacking (BGP) attack:** BGP is a routing protocol of the Internet. It helps to forward IP packets to their destination. The attacker conducts BGP hijacking to control the network traffic on the blockchain, which leads to delay of network messages [84]. * **Countermeasures:** [PERSON] et al.