# Security Audit of a Blockchain-Based Industrial Application Platform
## 3 Attacker Goals, Resources, and Capabilities
### Entry Points  
This section provides a security-oriented overview of an Industry 4.0 architecture, from which attack levels and a number of entry points for an attacker are extracted. By highlighting the physical network environment, it is possible to directly see the different parts of the system architecture and their boundaries. Figure 1 shows the architecture of the BISS:4.0 platform, with yellow lightning bolts indicating endpoints that can be used as entry points for attacks. The focus is on examining the entry points located at the boundaries and edges of each part/system of the architecture rather than the issues within those parts/systems. In particular, the security of the blockchain framework itself is therefore not examined. An example of a detailed security analysis for a blockchain network can be seen in [21]. * _Engineering workstation:_ the workstation is used to develop and access the various applications. Therefore, a trust relationship must exist between each workstation (and the software used on it) and the rest of the system. Although it is not assumed that the developer is malicious, their computer or a library that they use can be compromised. Since it is very likely that a developer uses third-party libraries [22], the software dependency chain can become very complex and impossible to fully verify, creating a remote attack surface. * _Malicious devices:_ additional devices connected to the network are becoming more popular, greatly increasing the attack surface. The miniaturization of electronic com  
Figure 2: Diagram with attack possibilities (taken from the second column in Table 1). ponents makes it possible for hardware implants to be as small as the metal part of a USB flash drive [23]. In fact, there have been cases where such devices have been used undetected as entry points to break into critical facilities. * _Mobile application:_ since mobile apps can interact with other apps on the same device, there is a risk that other apps installed on the device may not be trusted. Even though sandboxing of individual apps within mobile operating systems is well advanced, some apps still require permissions that undermine this separation. Another problem is that, although mobile devices today use apps from a closed ecosystem (walled garden/app stores), this does not mean that there are no malicious apps on the device [24]: Malicious apps are often removed from app stores because they spy on the user or try to escape the sandbox. * _Legacy machine:_ legacy machines are prevalent in an industrial setting, so it is critical that these legacy machines be integrated into the blockchain framework. Due to the nature of these machines, they are often connected via means that do not have built-in security concepts (e.g., simple serial connections) [25]. These security weaknesses can provide easy attack surfaces. * _OPC UA server:_ newer machines often provide connectivity via an integrated OPC UA server. This object-oriented industrial machine-to-machine protocol is a standard for industrial automation. While it has optional security features (TLS), it can be used without encryption and authentication [26]. OPC UA provides internal security mechanisms similar to TLS. * _Sensor:_ sensors in the architecture are often connected to machines via a simple fieldbus and are unsecured. This can create multiple attack surfaces, such as for data spoofing [27]. * _Auxiliary DB:_ an auxiliary database is used to store information that is deemed too large or too frequent to be stored directly in the blockchain ledger. Potential attack surfaces are similar to ordinary NoSQL databases, e.g., data manipulation [28]. * _Condition monitoring:_ the platform uses condition monitoring to monitor the various machines. In addition, the collected sensor data can be used, for example, to train a machine learning model. This model is then used to make predictions about the maintenance condition of the different machines (predictive maintenance). Possible attack surfaces are the sensor data and the data transmission [29].