Team Mufasa, and our journey with blockchain (thus far)
By: Drew Gipson
Tags: Security, Blockchain, Finance, Cryptocurrency, Cybersecurity

Team Mufasa is Jose Parente, Diego Garcia, Drew Gipson, and Stuardo Reyes, and we are researching blockchain technologies. This is a vast field in itself, so we are focusing on coming up with a set of tools, techniques, and routine best practices for companies in the blockchain field that may not have adequate protections for securing their product and network. Through this, we hope to empower these companies to be able to provide better security to their end-users.

Blockchain?

Blockchain technologies are often envisaged as a panacea to the modern world’s host of privacy problems — while blockchains certainly display characteristics important in the mitigation of these threats, they are not inherently secure, and surely not as private as people believe them to be. First of all, decentralized does not mean discreet: with the exception of certain cryptocurrencies like Monero, blockchain ledgers are unencrypted, and every network user has the ability to view the content of any other user’s wallet and record of transactions. This means that if care is not taken to protect a user’s public key, their personal identity could be associated with their public key and eventually, their wallet.

Second, there are specific, exploitable weaknesses in protocol often used for blockchain transactions that could allow a user with high enough hash rates to spoof a transaction. In the case of a majority attack, an agent who is in charge of enough computing power to maintain control over at least 51% of the total hash power of the network is able to subvert the system, and make decisions about which transactions get approved. In the case of a cryptocurrency, this may allow an attacker to double-spend, which results in the creation of illegitimate, perfect-counterfeit tokens. In the past, it was too difficult to acquire the requisite amount of computing power, and the reward was heavily outweighed by the cost of attack. However, due to the advent of mining equipment rental services and the influx of countless alternative coins in recent years, the cost of performing such an attack has dropped considerably, to the point where it is a viable avenue of attack on some cryptocurrencies. These are just a couple of the most common vulnerabilities that exist within blockchain tech.

This is the first blockchain-centric project most of us have worked on, so this past week has been chock full of learning experiences for the team; we reached out to industry experts, built our own tool for aggregation of general blockchain-related security vulnerabilities, and did some research on potential contributions we can make to open-source blockchain security projects.

So, what have we actually been doing?

Over the course of the last week, we dove deep into the architecture of different blockchains and Ethereum smart-contracts. Moving forward, we plan to make contributions to the “Mythril” open-source project, which is a security analysis tool for Ethereum smart-contracts. This endeavor will prove to be a big learning experience, as we have not done much coding work with blockchain and smart-contract tools before.

We also spent a lot of time on our team programming project, which is a tool that pulls information about blockchain-related vulnerabilities reported on AlienVault’s Open Threat Exchange, parses through the info for specific user-requested categories, and displays those results in the command-line interface. The tool allows the user to alter the search so that the tool queries for tags besides ‘blockchain’, and we are currently in the process of adding support for SMTP (Simple Mail Transfer Protocol) so that the information can be retrieved and then sent to a user’s email address.

Our Open Threat Exchange tool in action.

Plan for the next week

For the remainder of this week, we plan to work more on our open-source contributions, and on creating more connections with professionals working in the industry who may have some helpful wisdom to share with us. We will continue to add more functionality to our Open Threat Exchange tool over the next couple days, and will start on a to-be-determined coding project midway through the week.

Thanks for reading, and check back soon to stay up to date with our team’s future ventures!