Public Blockchain Breaks IT Security Standards

The thing that makes me nervous from an IT Security Administration perspective, is that I think a lot of the population has not been through the dot-com to dot-bomb era and seen the numerous security holes, flaws and issues.

For those who weren’t there we watched the web flourish, but there were issues early on with hacking, illegal and dangerous activities, illegal items being sold on eBay etc..  During that time, we had projects that were similar to the ICOs of today. So many companies who had no value, produced nothing and ultimately most of them literally crashed and failed, becoming worthless.

With all that’s been going on I am not sure where to start but let’s start with the public permissionless blockchain part and what irks me from the IT security standpoint.

In IT security and any security conscious business or administrator the first natural thing we want to do is to restrict access to as few people as possible, blocks ports, have ACLs etc.. We want to harden and secure the outer perimeter just as you would your house or place of business.  The last thing you want are open windows or doors, and you especially don’t want the public to be able access secure or sensitive areas.  The farther you can keep them away, the better.

The cardinal rules that I feel most public blockchain currencies break are the very basics and I will keep them in the realm of Bitcoin type currencies and Ethereum type Smart Contract/Decentralized App Currencies.

What’s wrong with Ethereum’s Decentralized Apps and Smart Contracts?

One of the first issues was the DAO hack where millions of ETH were lost.

Then there was the Parity issue which cost millions of dollars in lost and locked coins.

Charlie Lee, creator of Litecoin says the following about Ethereum (which I wholly agree with):

A typo in a wallet address could permanently delete funds, and attacks on insecure smart contracts are fairly frequent (litecoin creator Charlie Lee went so far as to call ethereum a “hackers’ paradise” in a conversation to CoinDesk last year).

An audit of Ethereum Smart Contracts also found thousands of vulnerable smart contracts

I think it is fairly clear Ethereum has a lot of vulnerabilities but lets step back from an IT security perspective.  Why on earth is Ethereum, a  new and untested currency and technology doing so many dangerous things at once?  The first step in my opinion is that currency’s should only be for currency to reduce the risk of a decentralized app or smart contract causing issues with other functionality.  So for example the DAO hack shouldn’t have been possible if Ethereum were just a currency.  The smart contract functionality should have been separate from the Ethereum chain.  The decentralized apps should also be completely separated.  On top of that why is it even possible to code such dangerous smart contracts completely vulnerable so hackers can just find a weakness and take all of the coins?

It comes down to a lack of common sense in IT development and security.  Instead of making things work, they marketed themselves as having endless features which have really been endless problems for everyone involved.  I personally almost never fire up my Ethereum Client, it is so slow and never seems to sync right.  How would apps run properly when the Ethereum network itself is so slow?

General Blockchain Issues Affecting Bitcoin Like Coins and most others

Now that we’ve discussed some unique issues that come with adding features on top of the same chain that handles currency transactions, let’s talk about Bitcoin like currencies and what most have in common due to them being so public.  First of all how do you secure anything when everyone has essentially full and equal access?  It breaks the basic client-server relationship where a trusted party or group runs the servers.  You wouldn’t trust your valuable data to random third parties, let alone the entire world would you?  But that is how almost all cryptocurrencies work and how they are peer to peer (sort of) and decentralized (sort of).

One vulnerability we’ve seen is the fraudulent creation of extra coins for example in the Verge mining hack, and also the Cryptonight hack that impacted Monero and Bytecoin.  Mining is supposed to secure the network by reducing the incentive to attack the network or broadcast false, fraudulent transactions.  But in practice we see that hasn’t been working at all.  Large organizations have essentially taken the decentralized and centralized them by running more full nodes and huge mining farms with more hashing power than the rest.  It is the equivalent of a cyber arms race and only those with the most resources and money will be the winners.  Clearly, this is an unintended consequence of what was supposed to make everyone equal partners and dissuade attacks.