Why World War III will be a CYBER War & how BlockChain can help Nations prepare their Cyber Defense in a Cyber-Physical World ???
By: Jagmohan Singh Sekhon
Tags: World War Iii, Blockchain, Cyberwar, Cybersecurity

Good uses for spying apps

We hear regularly from parents worried about what their kids are up to on their smartphones. While our first recommendation is always open lines of communication with kids, sometimes it pays to keep tabs on them directly. Employers also occasionally like to keep tabs on employees using company equipment. But is it legal?

Legally an individual or company is only allowed to install spying software on a phone, tablet, or computer they own. So, employers giving out company phones and parents giving a phone to your kids are covered. They just need to make it very clear to the users of the phone that they’re being watched and, for business purposes, written consent is also needed.

However, breaking into a password-protected phone is a no-no. And even if someone else owns your gadget, they aren’t allowed to break into your password-protected services like email or Facebook. Federal law prohibits unauthorized access to things like that.

Also, some spying software, such as FlexiSPY, has an option to listen in on real-time phone calls, which could break wiretapping laws. In some states, at least one person in the conversation needs to know that they’re being recorded. For some states, all parties need to know. And it can change if someone in one state calls someone from another state.

If you find someone is spying on you, go to the police. For gray areas where someone else owns the phone, you’ll probably need to get a lawyer involved.

OK, with that out of the way, let’s talk about spying apps and other tricks of the spying trade.

Spying apps on the market

As we said earlier, there are a number of spying apps on the market. Mspy is one of the most recognizable, but others you might see are FlexiSPY, WebWatcher and SpyToMobile.

They all record text messages and phone calls. Some include a keylogger to record whatever you type, snag GPS information, grab photos and even pull data from popular free messaging apps like WhatsApp, Skype and Viber. A snoop can see everything that’s going on with the phone via a web-based control panel.

There is some good news. In December 2014, the Department of Justice took the man behind one major app, StealthGenie, to court for creating and advertising spyware. He pleaded guilty and received a $500,000 fine, plus he had to hand over the source code for the product. So, you won’t be seeing that around.

On the other hand, the remaining ones have gotten a bit more sophisticated. So, snoopers don’t necessarily need full access to your gadget and a bit of time, plus the range of phones they can attack has gone up.

Gadgets at risk

Android

It’s simple to install a spying app on Android once you get past the lock screen, so make sure you have the lock screen turned on and no one knows the PIN, password or pattern.

You can make it a bit harder by blocking third-party apps from installing. Go to Settings>>Security and uncheck the Unknown Sources option. It won’t stop a really knowledgeable snoop, but it could stump less-savvy ones.

Apple

In the past, installing non-iTunes third-party apps on an Apple gadget meant jailbreaking it. Jailbreaking is a fancy term for getting full access to iOS so you can get around Apple’s safeguards.

The process is different for every version of iOS and takes some time and knowledge to pull off, so Apple gear was always relatively safe. However, some spy apps, notably Mspy, don’t need a jailbroken gadget anymore, as long as the snoop has your AppleID to log into iCloud.

If you have iCloud backup turned on, the person doesn’t even need your phone. Granted, a non-jailbroken gadget won’t give up as much information as a jailbroken one, but it’s still a lot.

So it’s a good idea to keep your AppleID a closely guarded secret. On the plus side, if someone does use this method, you just have to change your AppleID password to lock them out.

Still, there’s the chance that your snooper might try the old-fashioned method of jailbreaking. Again, if you keep your phone in sight and have your lock screen enabled with a solid PIN, it makes this nearly impossible.

Windows Phone/Mobile

No companies we could find have spy apps yet for Windows Phone 8 or Windows Mobile 10. There are some for older versions of Windows Mobile, but almost no one uses that anymore. As long as you keep an eye on your gadget and enable the lock screen, you should be fine.

Trojan smartphones

Getting a spying app onto a phone someone is using is tough — as long as they have a lock screen and other protections in place — but what if the app is on the phone from the beginning? There’s no way to defend against that.

So, if someone offers you a shiny new smartphone out of nowhere, definitely do some homework on where it came from before accepting.

This is important: If you think a spy app is already installed, do a factory reset of your phone — after you back up your information, of course. It’s inconvenient, but it will give you peace of mind.

91% Of Cyberattacks Start With A Phishing Email

Phishing remains the number one attack vector, according to a new study that analyzes why users fall for these lures.

The majority of cyberattacks begin with a user clicking on a phishing email. Ever wonder why users continue to fall for phishing emails?

A recent report found that 91% of cyberattacks start with a phish, the top reasons people are duped by phishing emails are curiosity (13.7%), fear (13.4%), and urgency (13.2%), followed by reward/recognition, social, entertainment, and opportunity.

Fear and urgency are a normal part of every day work for many users. Most employees are conscientious about losing their jobs due to poor performance and are often driven by deadlines, which leads them to be more susceptible to phishing.

The above study is based on more than 40 million simulation emails by about 1,000 participants around the world. The study took place over an 18-month span from January 2015 through July 2016.

Among the study’s top findings:

Susceptibility to phishing email drops almost 20% after a company runs just one failed simulation. So people do learn.

Reporting rates significantly outweigh susceptibility rates when simple reporting is deployed to more than 80% of a company’s population, even in the first year.

Active reporting of phishing email threats can reduce the standard time for detection of a breach to 1.2 hours on average — a significant improvement over the current industry average of 146 days. This was an important aspect of this report, the study also includes results from more than 300,000 users in organizations .

The study also found that users respond to Locky ransomware’s phishing lures (21.5%) more than any other malware variant. The others that followed Locky included order confirmation (17%), job application received (15.5%), and blank email (11.9%).

Locky’s phishing campaign has been effective for the following reasons: It is presented in a business context; it’s personalized to the recipient; there are no noticeable errors in grammar or spelling; and finally, it mimics many organizations’ existing invoice processes.

When analyzing the Locky data in vertical industries it was found that the response rates in the insurance industry were more than one in three (34.7%), while other high response rates occurred in the retail industry at 31.7%; energy, 27.8%; and healthcare at 24.9%.

We don’t really know why insurance was the leading vertical . It could be that there’s not enough training or insurance workers tend to interact with many external people so the chance for them to receive a phishing email increases.

What Are GPS Spoofing Apps Actually Doing?

There a lot of GPS Spoofing apps on the market, each looking a little different from the other, but almost all doing pretty much the same thing. In Android, there is only one way to spoof your device’s GPS (without rooting), and that’s to use Android’s built in Mock Location API located in Developer Options. In Android 6.0 and above you select the specific app you would like to use. In older versions, it’s just a simple check box that enables mock locations mode for any app on your device.

So once you select a mock location app, and start it up, what happens? What data is that mock location app mocking for you? In short, there are 5 variables that the mock location API asks for to mock your location: latitude, longitude, altitude, speed, and accuracy. Typically, most apps just change the latitude and longitude values to change your GPS location to some place in the world. But what about the other 3 values (altitude, speed, and accuracy)? Surprisingly, almost all GPS Spoofing apps set these values to some constant number, whether it’s 0, 1, or some random number, it’s a value that remains the same. Some apps do give the user the option to set these values via settings, but even then, the number never changes when the user is actively using the app and changing their location. The only exception to this, is GPS JoyStick, it is the only app in the Google Play store that actually mocks realistic, always updating data for all necessary GPS values.

G PS JoyStick is the only app in the Google Play store that actually mocks realistic, always updating data for all necessary GPS values.

Real GPS

When your real GPS reports values to your phone, it returns latitude and longitude to pinpoint your location, it returns your current altitude and speed if you’re moving, and it returns an accuracy (in meters) of how accurate it believes those values are. Even the best phones rarely return an accuracy of 1 meter and they definitely don’t return a constant, never changing speed or altitude value. Actually, all values fluctuate every second when you’re moving. And even when standing still, your latitude and longitude values don’t remain the same. This is because your GPS is constantly attempting to pinpoint your location and it changes slightly every time. Furthermore, when you move from one location to another, because your GPS is always fluctuating your actual location, you never travel in a straight line. If you were to imagine traveling from one end of a road to the other, the GPS would report a subtlezigzag from start to finish. Here’s what real GPS values look like when being reported through a typical GPS reader app:

Device GPS While Stationary:

Device GPS While Stationary

Device GPS While Moving:

Device GPS While Moving

Spoofing Apps

So if that’s what a real GPS looks like, what do spoofing apps look like? Sadly almost all GPS Spoofing apps show a constant reading when not moving and even when the app is simulating movement, only the latitude and longitude values update. If you are skeptical of your favorite spoofing app, download any GPS reading app and try it yourself. Here’s an example of what I mean:

Typical Spoofing App While Stationary:

Typical Spoofing App While Stationary

Typical Spoofing App While Moving:

Typical Spoofing App While Moving

Notice how the altitude, speed, and accuracy never change! And to make it more ironic, the speed value remains at 0 even when you are moving! And you can probably guess, if the spoofing app simulates any type of movement for you, whether it’s through a joystick or route option, it would report locations in a perfect straight line from the starting point to the end point, which is definitely not the way a real GPS works.

GPS JoyStick

So if that’s the case, then the majority of apps on the market fail to satisfy how real GPS reports values as mentioned above. Luckily for us, there is one app that actually emulates what a real GPS should report: GPS JoyStick

It is the only app in the Google Play store that actually mocks realistic, always updating data for all necessary GPS values. And all of those values are customizable via the Settings page. In almost all cases, the default values work perfectly for simulating real GPS values. To top it off, the slew of features it comes with make it pretty much the only GPS Spoofing app that you need for Pokemon GO. From favorites to routes for teleporting and auto egg hatching/walking, to the teleport dialog for sniping with Pokesniper/Pokezz or any latitude-longitude coordinates, there isn’t any app that comes close to having all the features you need to play Pokemon GO. It’s a free app and available now on the Google Play Store. And of course, here’s what GPS JoyStick looks like when mocking your location:

GPS JoyStick While Stationary:

GPS JoyStick While Stationary

GPS JoyStick While Moving:

GPS JoyStick While Moving

Look familiar? You may have noticed, there were slight fluctuations in latitude, longitude and accuracy while not moving. And when it was simulating movement, the speed and altitude also started changing. This is exactly how your device’s GPS works. As it stands, there are no apps out there that emulate a real GPS to this degree and detail. Do download and test this yourself if you are curious.

But Does It Matter?

Now this begs the question, does any of this matter? If all you need is latitude and longitude to change your location and it successfully works to trick whatever app you want to trick, then does it matter that the app is also reporting some random (never changing) numbers for altitude, speed and accuracy? The answer to that is, it depends. For some apps no, it doesn’t matter, but for some others, like Pokemon GO for instance, it probably does matter, a lot.

Pokemon GO took the world by storm, it was the first location based augmented reality game that truly appealed to the masses and gained popularity extremely quickly. Forcing players to physically walk to a specific location to catch virtual creatures is no easy task, but Pokemon GO did it. But with all games, there are always people who don’t have the ability, time or option to play as intended. For Pokemon GO, many players simply did not live near places required to truly enjoy the game. As a result, we saw a flood of GPS Spoofing apps hit the app stores to satisfy the needs of many trainers who just weren’t able to travel to places to capture Pokemon.

Niantic, the company that developed Pokemon GO, is no stranger to GPS Spoofing apps since they had to deal with them in their first location based game: Ingress. With that said, it may only be a matter of time before they start implementing similar techniques to catch spoofers in Pokemon GO. But there must be a reason they have held off on banning spoofers if they have the methods to detect them. My guess is, they don’t have a full proof method of detecting spoofers and instead rely on observing data and behaviors. In other words, if they see location data from a player that always returns the same altitude no matter there they are in the world, they can probably discern that they are spoofing. The same goes for speed and accuracy values. It could be that Niantic is waiting to capture enough data to catch spoofers with 100% accuracy as they probably don’t want to deal with banning legitimate paying players and dealing with the backlash that would follow.

So What Should We Do?

Obviously, the safest bet is to play as intended and avoid GPS Spoofing apps all together. However, as mentioned before, for many players that is simply not an option to truly enjoy the game and experience. In this case, the best alternative is to use an app that emulates GPS values like a real GPS would, such as GPS JoyStick, and to spoof in a way that would emulate how you would play the game in real life. In other words, you move in reasonable speeds, stick to the road/path and don’t teleport far distances unless the appropriate amount of time has passed (i.e. if your last logged in location in Pokemon GO was San Fransisco and you want to teleport to New York, then you should wait ~7 hours before teleporting and reopening the game). So try out GPS JoyStick today if you haven’t already, because it’s free, smart and might just be the safest option out there

Phishing , Spoofing , CyberTerrorism , CyberCrime … the list is huge .

CyberAttacks in Enterprise Space :

Corporate environment is highly vulnerable to cyber attacks. As per Vormetric’s 2015 Insider Threat Report, 93% of U.S. Organizations were Polled Vulnerable to Cyber Threats. Preventing a data breach is the highest or second highest priority for IT security spending for 54% of organizations.

The current global situation is that more and more data is being stored in various repositories all over the world and influx of third party service providers and contractors has increased the risk of cyberattacks. Although compliance standards are believed to be effective, these standards run the gamut from weak to very stringent.

The BlockChain Case for CyberSecurity

Blockchain is a promising platform with no single point of failure and would prove to be more resilient to cyberattacks. Blockchain and distributed ledger technology enables recording transactions in a trustworthy and efficient way. Blockchain technology solutions create transparent links that can be verified and tracked.

To invest in Blockchain is an intelligent choice as Blockchain services are incorruptible and tamperproof. This feature is attributed to the concept of “hashing”. Hashing is a type of data encryption which involves joining records in “blocks” and linking them extricably in the form of ‘chains’.Blockchain and distributed ledger technology enables data storage in a decentralized manner. It means instead of one vulnerable location the information is stored as an open source ledger.

How is Blockchain “hackproof”?

Its distributed node structure reduces probability of hacking. Blockchain is transparent and cannot be altered by an administrator or anyone else in or outside of the blockchain. There is also a public history of all transactions. Any attempt to alter the data will be immediately flagged and will require consensus amongst all participants/ nodes, making it very difficult for a hacker to achieve its aim.

Blockchain’s Cybersecurity Advantage : It goes beyond the traditional cybersecurity solutions.

Blocks Identity Theft

Each identity document validation is an expensive process involving PKI.

Public Key Infrastructure (PKI) is public key cryptography that secures information and details of communication. At the moment most PKI’s rely on trusted third parties which are centralized and vulnerable to cyberattacks. PKI’s can be easily hacked by hackers, user identities can be spoofed and access to encrypted communication is obtained. Blockchain provides a public and auditable PKI with no point of failure thereby minimizing the risk of identity theft.

Prevents Data Tampering

Blockchain preserves the integrity of data. Recent development in Blockchain technology solutions are an alternative approach to key based data authentication. Keyless Signature Structure or KSI stores hashes of original information and verifies copies of that data by comparison. Any manipulation is traced immediately as copies of original data exists on multiple nodes in the network. Blockchain technology solutions would help in verifying the integrity data shared across different organizations and create immutable audit trails for data.

Stops Distributed Denial-of-Service (DDoS) attacks.

Blockchain aims at improving security by removing a single vulnerable target that can compromise whole system’s integrity. A transparent and distributed DNS (Domain Name Server) rules out the possibility of manipulation of information.

Other features:

Transaction and communication infrastructure security Ensuring business security through transparency Auditing and security from malicious insiders Identifying compromised nodes or server failures.

Blockchain is a promising technology which is tamperproof and efficient. It is very aptly referred as Blockchange — because of the potential it has for transforming businesses around the world by going beyond the traditional cybersecurity approaches.

Navigating the online world safely has become a real concern over the last few years and, looking at how intense and sophisticated some of the recent hacker attacks around the world have been, it seems like things are bound to only get worse.

Even though hackers are getting better at hacking, the ways to combat them are also improving very fast. In fact, we already have a nearly impenetrable technology, known as blockchain, which can be used to protect our data from cyber attacks and improve cybersecurity across industries.

Preventing fraud and data theft

Blockchain technology provides one of the best tools we currently have to protect data from hackers, preventing potential fraud and decreasing the chance of data being stolen or compromised.

In order to destroy or corrupt a blockchain, a hacker would have to destroy the data stored on every user’s computer in the global network. This could be millions of computers, with each one storing a copy of some or all the data. Unless the hacker could simultaneously bring down an entire network (which is near impossible), undamaged computers, also known as “nodes”, would continue running to verify and keep record of all the data on the network. The impossibility of a task like taking down a whole chain increases along with the amount of users on a network. Bigger blockchain networks with more users have an infinitely lower risk of getting attacked by hackers because of the complexity required to penetrate such a network.

This complex structure provides blockchain technology with the ability to be the most secure form of storing and sharing information online that we’ve discovered so far. That’s why innovators have begun applying the technology in different sectors to prevent fraud and increase protection of data.

How cybersecurity uses blockchain technology to safeguard data

Cybersecurity has already become successful in using blockchain technology to keep important data safe by taking away the need to use keys for verification. Instead, they distribute every piece of data to nodes throughout the system. If someone tries to alter the data, the system analyses the whole mass of chains, compares them to the metadata packet and then excludes any that don’t match up.

This means that the only way to wipe the entire blockchain out is to destroy every single separate node. If just one node remains running with the correct data, the whole system can be restored, even if all of the other nodes are compromised.

System works in such a way that it’s always able to detect when a change has been made to the data and is constantly verifying the changes. This ensures that there is no discrete way to tamper with blocks in the chain and the data remains uncompromised .

Preventing distributed denial of service (DDoS) attacks

The principle behind DDoS attacks is simple but devastating. Hackers can use several techniques to instigate an attack, essentially sending myriads of junk requests to a website, increasing traffic until the site can no longer keep up with the requests. The attack goes on until the site gets overwhelmed with requests and crashes. DDoS attacks have been happening at an increased frequency recently, affecting bigger companies like Twitter, Spotify, SoundCloud, and more.

The current difficulty in preventing DDoS attacks comes from the existing Domain Name System (DNS). DNS is a partially decentralized one-to-one mapping of IP addresses to domain names and works much like a phone book for the Internet. This system is responsible for resolving human-readable domain names (like steelkiwi.com) into machine-readable IP addresses (made up of numbers).

The fact that it is only partially decentralized means that it is still vulnerable to hackers because they are able to target the centralized part of DNS (the one which stores the main bulk of data) and continue crashing one website after another.

Using blockchaines to prevent DDoS attacks

Implementing blockchain technology would fully decentralize DNS, distributing the contents to a large number of nodes and making it nearly impossible for hackers to attack. Domain editing rights would only be granted to those who need them (domain owners) and no other user could make changes, significantly reducing the risk of data being accessed or changed by unauthorized parties. By using blockchains to protect the data, a system can ensure that it’s invulnerable to hackers, unless every single node is simultaneously wiped clean.

Some companies are already implementing blockchain in this area to prevent DDoS attacks from occurring. For instance, Blockstack provides a fully decentralized option for DNS. The concept behind the company is to make the entire worldwide web decentralized by removing all third parties from managing web servers, ID systems, and databases.

If current DNS would operate on blockchain, users would still be able to register domain names, but only authorized owners would be able to make changes to their domains. Since the data would be stored on many different nodes and every other user on the network would have a copy of the entire data on the blockchain, it would be virtually impossible to hack or destroy it completely.

MaidSafe is a similar company based in the UK. Their goal is also to decentralize the web and create something like an alternative Internet where users are able to run apps, store data, and do everything else they normally do online, but in a more secure environment. When signing up for this service, users can choose how much of their personal storage space they want to dedicate to the network. The system then provides safecoin, a cryptocurrency, to compensate users for the value (space) they offer the network. Every file placed onto the MaidSafe network is encrypted, fragmented, and shared among users. The only person that can make the data readable again is its owner, ensuring that the data is not accessible by anyone other than the authorized owner.

Innovative uses for blockchain technology

As more people join the worldwide web and technology continues to develop, more data gets produced and more hackers will attempt to steal or corrupt that data. The technology behind blockchain is versatile and incredibly useful for the future of the Internet, allowing users to better secure their data.

Innovative uses for blockchain technology are already becoming a part of other fields beyond cryptocurrencies and can be especially useful to boost cybersecurity. By implementing rigorous encryption and data distribution protocols on a network, any business can ensure that their information will remain safely intact and out of the reach of hackers.

Hackers can shut down entire networks, tamper with data, lure unwary users into cybertraps, steal and spoof identities, and carry out other devious attacks by leveraging centralized repositories and single points of failure.

The blockchain’s alternative approach to storing and sharing information provides a way out of this security mess. The same technology that has enabled secure transactions with cryptocurrencies such as Bitcoin and Ethereum could now serve as a tool to prevent cyberattacks and security incidents.

Blockchains can increase security on three fronts: blocking identity theft, preventing data tampering, and stopping Denial of Service attacks.

1. Protecting identities

Public Key Infrastructure (PKI) is a popular form of public key cryptography that secures emails, messaging apps, websites, and other forms of communication. However because most implementations of PKI rely on centralized, trusted third party Certificate Authorities (CA) to issue, revoke, and store key pairs for every participant, hackers can compromise them to spoof user identities and crack encrypted communications.

For instance, controversy recently broke over the key renegotiation process of WhatsApp, which could possibly be exploited to push false keys and perform man-in-the-middle attacks on one of the most popular and secure messaging apps in the world. Publishing keys on a blockchain instead would eliminate the risk of false key propagation and enable applications to verify the identity of the people you are communicating with.

CertCoin is one of the first implementations of blockchain-based PKI. The project, developed at MIT, removes central authorities altogether and uses the blockchain as a distributed ledger of domains and their associated public keys. CertCoin provides a public and auditable PKI that also doesn’t have a single point of failure.

More recently, tech research company Pomcor published a blueprint for a blockchain-based PKI that doesn’t remove central authorities but uses blockchains to store hashes of issued and revoked certificates. This approach gives users a means to verify the authenticity of certificates with a decentralized and transparent source. It also has the side benefit of optimizing network access by performing key and signature verification on local copies of the blockchain.

Another interesting study of identification based on distributed ledgers is the IOTA, a project that applies Tangle (a blockless type of distributed ledger that is lightweight and scalable) to provide the backbone for millions of IoT devices to interact and identify each other in a peer-to-peer manner and without the need for a third-party authority.

“By referencing hashes that match identity attributes of an individual tied to the ledger one can start to reconstruct the entire identity management system. The fact that you can tie these attributes of person to a tamper-proof hash makes it impossible for someone to forge your identity,” says IOTA cofounder David Sønstebø.

2. Protecting data integrity

We sign documents and files with private keys so that recipients and users can verify the source of the data they’re handling. And then we go to great lengths to prove that those keys haven’t been tampered with, which is difficult when the key is meant to be secret in the first place.

The blockchain alternative to document signing replaces secrets with transparency, distributing evidence across many blockchain nodes and making it practically impossible to manipulate data without being caught. How do you prove that the San Antonio Spurs were the champions of the 2014 NBA Playoffs? You don’t need to because it’s general knowledge. The same applies to data on a blockchain distributed ledger.

Keyless Signature Structure (KSI), a blockchain project led by data security startup GuardTime, is one group that aims to replace key-based data authentication. KSI stores hashes of original data and files on the blockchain and verifies other copies by running hashing algorithms and comparing the results with what is stored on the blockchain. Any manipulation of the data will be quickly discovered because the original hash exists on millions of nodes.

As GuardTime CTO Matthew Johnson told me, the blockchain approach to data authentication offers “mathematical certainty over the provenance and integrity” of information. The U.S. Department of Defense’s DARPA agency is considering KSI as a potential fit to protect sensitive military data.

And on the health care front, blockchain company Gem is using blockchain to provide data transparency, change-auditing, and fine-grained access control of health records. This is especially important as healthcare providers handle reams of sensitive data and have been victims of huge data breaches. “Data controlling critical business processes, patient health, and clinical trials are all attack surfaces in healthcare industry,” said Gem VP of Engineering Siva Kannan. “Blockchain technology would help in verifying the integrity of patient data shared across different organizations, create immutable audit trails for data governing health care business processes, and maintain the integrity of data collected in clinical health trials.”

3. Protecting critical infrastructure

A massive October DDoS attack taught us all a painful lesson about how easy it has become for hackers to target critical services. By bringing down the single service that provided Domain Name Services (DNS) for major websites, the attackers were able to cut off access to Twitter, Netflix, PayPal, and other services for several hours, yet another manifestation of the failure of centralized infrastructures.

A blockchain approach to storing DNS entries could, according to Coin Center’s Peter Van Valkenburgh, improve security by removing the single target that hackers can attack to compromise the entire system.

Nebulis is a project that is exploring the concept of a distributed DNS system that will never fail under an excess of requests. Nebulis uses the Ethereum blockchain and the Interplanetary Filesystem (IPFS), a distributed alternative to HTTP, to register and resolve domain names. “The killer weakness of the current DNS system is its overreliance on caching,” Nebulis founder Philip Saunders told me. “Caching makes it possible to stage DDoS attacks against DNS servers and allows oppressive regimes to censor social networks and manipulate DNS registries.”

Blockchain will also remove the network fees associated with DNS reads and will only impose costs on updates and new entries. “This has great potential for lifting a great deal of pressure from the physical backbone of the Internet,” Saunders said. “It also means we can do away with many of the redundancies of the traditional DNS and come up with something much better.

A transparent, distributed DNS where domain records are under their owners’ control will also make it virtually impossible for any single entity, including governments, to manipulate entries at their whim.

New and unexpected cybersecurity threats will continue to emerge while old threats linger. Blockchains won’t be a silver bullet to fix everything that’s wrong with the Internet, but they will be a powerful tool experts and engineers can leverage to harden their systems against the multitude of threats that surround us, especially where centralized weaknesses and single points of failure are concerned.

Blockchain and Cyber Security

The cyberspace is the underlying infrastructure that holds the key to the modernity in technology.

However, its vulnerability to attacks complicates the essence of its existence, therefore it’s crucial for developers to put up concrete cyber security measures for safety and integrity of data [3].

“The fact that traditional systems work in a centralized manner render them readily prone to attacks since the attackers only target the central server.–Buntinx [3],

This is what’s called a single point of failure, or a “honey pot” problem.

A Blockchain inherently offers a distributed and decentralized network systems thereby eliminating these single points of failure.

They also offer encrypted authentication, digital signatures and public key encryption, distributed ledgers based on consensus, smart contracts, and fault tolerant transaction processing.

The integration of consensus mechanisms in the Blockchain network is a breakthrough in cyber security that actualized the ability to keep hackers out[3].

Blockchain Data Security

One of the driving factors that led to the invention of Blockchain technology is the need for confidentiality, integrity, and authentication for financial-related information.

The level CIA standards of information security are achieved in Blockchain technologies through the implementation of cryptography and encryption methods in the relay, processing, and storage of data.

Encryption may be defined as a cryptographic technique that entails the use of a complex mathematical algorithm to encrypt (close) and decrypt (open) data.

Homomorphic Encryption

The essence of Homomorphic encryption is to enable for computations on encrypted data before its actual decryption [4].

Currently, data privacy and transactions is upheld since computations may be done on the data but only those with the decryption key may access its contents [4].

Homomorphic encryption occurs in two main processes that are full and semi-complete arithmetic schemes.

Fully Homomorphic encryption schemes are said to be Turing-complete since they allow for both addition and subtraction operations on the ciphered messages. On the contrary, Semi homomorphic schemes like RSA only support one arithmetic operation on the ciphered text.

Zero Knowledge Proofs

An essential interaction for a Blockchain can be determined through Zero knowledge Proofs, cryptographic techniques that require two transacting parties, a prover, and a verifier, to prove some propositions about the transaction without having to be true without having to reveal all its information [4].

For a zero-knowledge proof to be considered valid, they must meet three conditions:

Strictness: the honest prover must follow the protocol by convincing the honest prover with the correct statement.

Accuracy: No false statement would be used by a cheating prover to convince and honest verifier except when the statement has some truth probability in it.

Zero-knowledge: when the main statement is true, all the cheating verifiers will only learn about this fact. It is achieved through simulating the process to each cheating verifier without access to the validator, given the statement to proof; it produces a mimic of the interaction between the honest prover and cheating verifier.

Using Blockchain for Security

A Blockchain is commonly known for its potentially resilient combination of safety features. Information Age [5] explains that a Blockchain as a holistic approach to the traditional endpoint protection with additional features for user privacy, communication and transaction security, business and system security through transparency, audit trail, and distributed encrypted nodes. Across blockchains protocols, safety and confidentiality are highly prioritized as central pillars for maintaining the growing digital age.

It can be said that where individuals, businesses, and governments are constantly locked in a battle against bugs, fraud, and malicious actors, blockchains propose an alternative.

The fact that the emerging blockchains can offer utmost data integrity, high-tech digital identity systems, and public/transparent audit trails reinforces the above statements. I would highly encourage enthusiasts to look into a little known, but emerging blockchain startup company called BackFeed who are working on these types of protocol innovations.

But Can the Blockchain be hacked?

Encryption protection

Most “blockchain” protocols are designed as a decentralized peer to peer networks that allow members to jointly store and run computational operations on the data without compromising the security and privacy[6].

Encryption has successfully been used as a data protection technique, but the vulnerability occurs when the user decrypts the data. The encrypted data can be kept in secure cloud files free from hackers by keeping the secret key safe. However, whenever the users need to access the data, they may have to unlock it and hence rendering it prone to hackers [6].

Consensus and distributed ledgers

The consensus is the protocol used to limit all transacting parties to adhere to the set consistency and the agreed distributed order of recording approved transactions thus creating an interconnected data store known as the distributed ledger [7]. Since a consensus must be reached, the common blockchain protocol rules are that a hacker must have at least 51 percent of the computational energy to break the consensus algorithm which may potentially be achieved using quantum computers.

Blockchain Risks

Cyberspace Crime

Hackers and attackers may employ Blockchain cryptographic algorithms and mechanisms to perform malicious activities without leaving any traces one, most notably is what’s called a sybil attack. Cryptosystems have also led to the rise of the dark web where illegal goods and services are traded beyond governmental authorization or consent. For instance, the anonymity feature in Bitcoins has sparked a global uproar in the financial technology scams and thefts.

Irreversibility

Information encrypted in cryptosystems may not be accessed if the real user forgets or loses the private or decrypting keys hence they may not recover their rightful data unless they have spare keys correctly backed up.

Conclusion

Blockchain Technology has evolved over the last few years, initially known as the underlying Bitcoin technology infrastructure for sending secure payments, or transfers of value, and has gained reputation, if not over-hyped potential, from this pioneering implementation. The Bitcoin Blockchain has clearly demonstrated the power of decentralized peer to peer applications regarding both security and privacy of data. Having passed the test of time, we can only appreciate its resilient security and adopt it to embrace and take advantage of this high-level technology.

Cybersecurity of blockchain and blockchain for cybersecurity

It seems that every banker, insurer, manufacturer, artist, lawyer and cybersecurity professional is shouting about blockchain from the highest peak and telling us how it will be used to secure everything against anything for all time, additionally removing those embarrassing blemishes from our skin and freshening our breath at the same time. Clearly some large portion of the blockchain-related content we see in the media is hyperbolic, at best, but it is an important technology nonetheless. Let’s take a look at some of the realities of what we can and cannot do with blockchain in relation to cybersecurity.

Cybersecurity of blockchain

Blockchain is a great tool for information integrity. In the world of information security, we often discuss issues in the context of the CIA triad: confidentiality, integrity, and availability. Blockchain provides no benefits in the confidentiality and availability areas compared to other technologies, nor do current implementations scale well or behave in a performant manner past a certain point.

Let’s look at the information security risks associated with the use of blockchain technology.

Integrity, the defining attribute of blockchain, could be at risk in case of “mutable” (editable) blockchains. Since blockchain has become a huge buzzword recently, we can see all manner of solutions attempting to incorporate blockchain or bolt it onto the side of an existing product in order to jump on the bandwagon even in cases where information integrity is not the main goal. A good illustration of this desire to incorporate the use of blockchains into additional environments is the advent of mutable blockchains[2] in which any information in a blockchain could be edited by a central administrator; this is an approach that goes entirely cross-purpose to the very fundamental integrity concept without providing benefits over other existing technologies. For the rest of the article we’ll be discussing the original blockchain implementation; immutable blockchains.

One, if not the primary area of concern is the lack of confidentiality. Blockchain is designed to be transparent. The focus on integrity in such a decentralized model requires all the consensus participants to share information. Anything recorded onto a blockchain can be arbitrarily read without any restrictions by all participants. If you need information recorded in a blockchain to be confidential, this could be accomplished through the use of encryption, by minimizing stored information, and through other similar approaches. However, these are bolt-on approaches, the same as would be applied to any other data store, and are not inherent to blockchain technology. Despite this common misconception, blockchain technology does not provide confidentiality and privacy, exactly the opposite is true. When we, techies and cybersecurity practitioners, talk about blockchain being “secure” we are only referring to the integrity aspect. Which creates confusion since secure in the popular vernacular also tends to mean confidential. If our use case focuses on the confidentiality of information, we will likely want to look to other technologies.

Potentially impacting the confidentiality and integrity are also issues in securing the private keys used by the participants, or weaknesses in the cryptographic algorithms used. Those could, and should, be addressed in the same ways and using the same technologies that are typically put in place to address such concerns. Blockchain doesn’t make any of this any easier or harder than other technologies.

A blockchain-specific integrity risk with a potential large scale impact is known as the 51% attack. This attack is often brought up when blockchain security is called into question. In this particular case, if an attacker would control 51% of the computing power of the whole network of participants, the potential would exist for the attacker to “outvote” all of the other participants and reach the “consensus” on its own and therefore impact the integrity of data. Worse yet, calling it the 51% attack is a bit of a misnomer. In reality, the percentage of computing power needed may be much lower, perhaps even as low as 40%[3]. In the case of the blockchain backing a cryptocurrency, such an attack could potentially enable the attacker to spend the same funds twice.

Several attacks have occurred over the last few years in which blockchain-based cryptocurrencies were compromised. Most recently, there have been large cryptocurrency losses from Hong Kong-based Bitfinex in August of 2016 ($65 million US) and Ethereum in June of 2016 ($150 million US). In the case of Bitfinex, the exact issue is still not publicly known, but is believed to be a public key storage issue. Ethereum’s issue was a code flaw that allowed funds to be withdrawn repeatedly without updating the wallet balance. In both cases, these flaws were not issues with the blockchain itself but, as many security problems ultimately boil down to, issues in implementation.

As the use of blockchain expands into other industries and more trust is put into blockchains for assuring contracts, recording ownership, ensuring the integrity of data, and a thousand other functions, we will begin to see an interesting set of new security issues emerge. We can clearly not make light of the cryptocurrency attacks that have occurred thus far, considering their scale, but they may only be the tip of the iceberg. Consider what might happen in the future when all of the funds, records, proof of ownership, articles of incorporation, and a slew of other documentation belonging to and about a corporation is stored in a blockchain, entirely proofed against alteration. We could very well wake in the morning to discover a similar implementation or loss of public key control had permanently and irrevocably transferred the assets and ownership of our company into the hands of an attacker. Even the most benign of these types of attacks could lead to serious reputational damage for an organization.

It is important to understand that while blockchain provides an excellent solution for information integrity, it is not unbreakable. We should also keep in mind that, while there are ongoing developments in blockchain privacy, there is at the moment nothing inherently secure, in terms of confidentiality, in the use of blockchain technology. Whatever our use case is and however we decide to implement the technology, we have to consider all the information security aspects and embed the appropriate security controls in our implementation. As has always been true in the information security field, there is no such thing as a silver bullet that will solve all of our problems.Blockchain for cybersecurity

BlockChain for Cybersecurity :

Given the newness of the technology, its current state of flux, and the potential for its misuse, where can we use blockchain in a reasonably safe manner? To come full circle back to the beginning of our discussion, we can benefit greatly from the technology when we use it for information integrity purposes, as it was originally designed and intended for use. One interesting use case is applying strong integrity assurance feature of the blockchain technology to strengthen cybersecurity of many other technologies.

For example, we can use blockchain to ensure the integrity of software downloads such as patches, firmware updates, downloads, installers, and so forth, in much the way that we make use of MD5 hashes today. While the hash that we compare our file download against might be compromised on a vendor website and altered without our knowledge, we can make a comparison against what is permanently recorded in the blockchain with a much higher level of confidence.

Particularly in the world of cyber-physical systems (CPS) (IoT, industrial controls, vehicles, robotics, etc), the use of blockchain technologies has great security potential. To learn more about CPS cybersecurity concerns check my other article: When hackers threaten your life — Introduction to cyber-physical systems security. In summary, the key difference between cybersecurity for cyber-physical systems and cybersecurity for traditional enterprise IT systems is that for cyber-physical systems the integrity of data is the key concern while the confidentiality in many cases is almost irrelevant. Blockchain technology is just what the doctor ordered to address the key cyber-physical systems security concern.

Given the recent massive DDoS attacks using compromised IoT devices, and the greatly increased level of interest in increasing the security of and around such devices, we could bring blockchain to bear here. We could potentially track the provenance of a given IoT device, or even the components that make up a particular device from a supply chain perspective, as well as the integrity of the embedded software. Individual components could be tracked as they move from suppliers to manufacturers, and ultimately to the customers at the end of the chain. This idea has the potential to become a part of the supply chain cyber and cyber-physical systems security efforts that are of great concern to nation states around the globe, particularly noticeable in the efforts being put forth by the US, China, Russia, India and others in recent years.

Consider the examples of Car Area Network (CAN) hacking that have repeatedly made international media over the last several years. Attackers have been able to compromise nearly all of the major systems in vehicles, taking over vital automotive functions such as acceleration, braking, and steering, many of which can have direct impacts on human safety. In many cases, this is possible because the integrity of the data flowing in and through such systems is almost never validated or assured. We could use blockchain technology to validate the components in use in the vehicle as well as the integrity of data generated by those components, and, potentially, reject spurious inputs entirely.

More generically, information integrity capabilities of blockchain can be used to verify the status of any cyber-physical infrastructure, provide complete provenance of every component of the infrastructure and assure complete chain of custody for all data generated and transmitted through that infrastructure. That level of empirical verifiability is an area where blockchain truly has the potential to shine and that could drive new approaches to cyber-physical systems security providing real-time awareness and detection of any misconfiguration, component failure or data tampering.

Conclusion

To sum up, blockchain is a disruptive technology with huge market potential and even the potential to change society.

More interestingly for the purpose of this article, it has the potential to change the way that cyber security and cyber-physical systems security efforts are conducted, and may spawn entire new industries or new segments of existing industries to safeguard inter nation CYBER STRIFE .

While the technology surrounding and built on blockchain is presently going through some very painful growth and learning experiences, the potential for good to come from the use of such solutions is very high.

As with any new technology, there is a safer set of core functions that blockchain does well, i.e, ensuring integrity.

As we move out into the newer and more fringe uses of this technology, we incur a high level of risk for operating in such areas, and open ourselves up to the potential for great reward as well.

Security is a balancing act, and blockchain is no exception to this maxim.

=========================================================

Introducing my new book “Limitless Organizations — — The Way” coming out in 2018. Amazon Kindle Edition will be available in January 2018. For more information and Print Edition check out www.LimitlessThink.com.

If you enjoy my articles , please feel free to nominate me as a LinkedIn Top Voice .

Learn More about Family Businesses and much more at https://64-corp.com/