Assessing Security of Cryptocurrencies with Attack-Defense Trees: Proof of Concept and Future Directions

Abstract

Cryptocurrencies such as Bitcoin have been one of the new major technologies of the last decade. In this paper, we assess the security of Bitcoin using attack-defense trees, an established formalism to evaluate the security of systems. In this paper, our main contributions are as follows: (1) We provide an extended attack-defense tree model for attacks on Bitcoin. (2) We demonstrate the general usability of existing analysis methods for attack-defense trees in this context. (3) We highlight further research directions necessary to extend attack-defense trees to a full-fledged overarching model for security assessment.

Appendices

A Eclipse Attacks

Eclipse Attacks are a form of attack studied in [21]. A malicious party monopolizes all incoming and outgoing connections of a single node, which isolates the node from the rest of the network. Since the Bitcoin blockchain is saved in a decentralised way on many different nodes and needs exchange to become a valid Bitcoin view, the attacker can now let the victim believe in other Bitcoin forks, which are not generally agreed on or even use the victim’s computing power for its own malicious behaviour. The authors of [21] estimate the likelihood of such an attack. Sybil Attack describes the process, in which an attacker creates fake identities who appear to be unique users to all other instances in the network, but in fact are controlled by a single malicious node with enough computing power. The malicious user can then influence democratic decisions within the network through additional voting power. This is not a problem for Bitcoin. However, these fake or sybil nodes may disconnect honest users from the network and thus, facilitate double spending attacks. Routing Attacks are another form of attacks performed on the network level. They are mainly based on an attacker intercepting with route advertisement on the network itself. Routing attacks also aim at isolating certain nodes from the network.

B Detailed Description of 51% Attacks

In this section, we give a detailed ADT for the 51% Attack, which refers to a scenario in which the attacker controls more than 50% of the network’s overall hashing rate. This power can be used to delay confirmation of specific transactions on purpose and to facilitate double spending. In Fig. 4, we depict one possible way to model a 51% attack. We use event (1) due as a replacement for several events corresponding to bribing the biggest mining pools. To bribe a miner, the bribe must be higher than the expected block reward and transaction reward within the time frame.

Additionally, miners group up in pools to combine their hash power and thereby reduce the volatility of their income in exchange for a small fee paid to the pool manager. This behavior counteracts the concept of decentralization Bitcoin is founded on and increases its vulnerability to attacks such as DoS attacks and 51% attacks (event (3) in Fig. 4). About 80% of all blocks are mined by Chinese miner pools¹³ and the biggest mining pool BTC.com accomplishes 15% of Bitcoin blocks¹⁴. This concentration of miners renders Bitcoin susceptible to Chinese regulation and energy policy. Power outages (event (4)) and the loss of the internet (event (5)) connection thus facilitate 51% attacks (if many miners are out of service, an attacker might suddenly possess more than 50% of the overall computing power across all active miners). Depending on the downtime, an attacker can more easily issue double-spending attacks by confirming his own malicious transactions. Since about 80% of the overall computing power is hold by Chinese miners, we have overestimated the increase in computing power by taking the computer power of the largest mining pools outside of China if all Chinese mining pools cannot contribute to the Bitcoin blockchain anymore. This is a clear overestimate since most of the mining pools have servers and contributors outside of China.

Chip Miners buy their chips based on two major criteria: the Hashrate and power consumption since the first determines how often miners might find a nonce while the other determines the money computing costs. Miners buy whatever is available on the market and based on the best performance regarding those two criteria. A possibility is that big chip companies, e.g. Asic, already are in possession of better chips than the chips they are currently selling. If companies held back inventions and use those for mining, they could control the network and issue a 51% attack (event (2)). However, companies are unlikely to conduct this procedure as they, likely, earn high revenues by selling their products.

We use two cost variables – one to accumulate the money an attacker needs to spend for a successful attack and one to accumulate the computing power he has acquired so far. Hence, we label basic events not only with costs, but also with a second cost resource corresponding to the percentage of computing power the attacker gains. Various defender’s and random events may also influence this variable – such as power outages or failures on the internet connection of large mining pools, which we discuss further down. Advances in quantum computing change the likelihood of 51% attacks since the Grover Algorithm [44] provides a quadratic speed-up in comparison to classical computers in inverting cryptographic hash functions by performing a faster search through unsorted lists. Hence, nonces can be found more efficiently.

Fig. 4.

A subtree depicting how to acquire more than 50% of the overall network computing power, where each vertex is labeled with its monetary cost as well as the fraction of computing power C acquired. We mark values that we cannot reliably estimate, with a question mark.