#HITB2018DXB: Building Security Beyond The Genesis Block

### Overview In this presentation at HITB2018DXB, the speaker examines cybersecurity within the blockchain sector through the lens of detection, response, and purple teaming. As an active detection and response investigator at Hunter [Hanna] Sept (an MWR company), the speaker argues that despite the academic hype around blockchain, real-world compromises in the space are technically very similar to conventional cyber attacks in other industries. The primary differences lie in the sector's low security maturity, immense financial incentives, and specific attacker objectives focused on rapid monetization.

### Key Topics - **History of Major Exchange Hacks**: An analysis of high-profile incidents including Mt. Gox (unencrypted wallet files in 2011 and internal transaction system manipulation in 2014), Bitstamp (phishing via email and internal Skype pivoting), Bitfinex (flawed multi-signature validation implementation with third-party BitGo), Gatecoin (the DAO smart contract recursive call flaw), Bithumb (social engineering targeting an employee to steal 30,000 customer records), Coincheck (lack of cold storage and missing multi-signature controls for NEM hot wallets), and Binance (exploitation of API trading bot keys). - **Attack Techniques and Delivery**: Common initial footholds rely on classic methods like phishing documents, clipboard stealers targeting pasted wallet addresses, social engineering, and compromised credentials/private keys. Rather than developing novel exploits against underlying cryptography, attackers repurpose existing tools because the sector's low defense maturity makes it a lucrative, low-risk target. - **Detection, Threat Hunting, and Response**: The investigation of crypto-mining incidents using endpoint telemetry (process arguments and PowerShell execution) to uncover stages of execution, enumeration, persistence, and external connections to centralized mining pools. It highlights how defenders can extract hard-coded wallet addresses and node configs from payloads to perform on-chain intelligence. - **Evaluating Blockchain Use Cases**: A critical assessment of whether a blockchain is truly needed (referencing a decision flow-chart paper by Wüst and Gervais). The speaker critiques marketing-driven implementations and examines the security trade-offs of private/permissioned ledgers (centralization vulnerabilities at validating master nodes) and the 'garbage in, garbage out' problem of bridging physical sensor data into an immutable ledger.

### Technical Details - **Exchange Transaction Mechanics**: Cryptocurrency exchanges maintain order books and execute high-speed customer transactions off-chain within standard relational databases. On-chain blockchain transactions only occur when users deposit or withdraw funds. Consequently, attackers focus on compromising exchange backend databases or administrator/user accounts to trigger on-chain withdrawal transactions. - **Forensic Visibility and Chain Analysis**: The transparency of public ledgers aids defensive investigations. Defenders can perform chain analysis to trace stolen funds across wallet hops until they reach an exchange or off-ramp. While ransomware operators previously accepted Bitcoin, increased tracing visibility has driven some towards privacy coins. - **Payload Dissection**: In the examined cryptominer case study, malicious commands fetched payloads over FTP, ran PowerShell commands to identify the host operating system, downloaded secondary architectures, and beaconed to mining pool endpoints, exposing hard-coded configuration credentials.

### Takeaways - Blockchain security failures are overwhelmingly traditional IT and application security failures: phishing, poor access management, unencrypted keys, software bugs, and social engineering. - Immutability is a double-edged sword: once malicious or erroneous transactions are validated on-chain, they cannot be reversed without extreme measures such as hard forks (e.g., Ethereum and Ethereum Classic after the DAO). - Organizations must critically question the necessity of a blockchain before adopting it, ensure security is integrated during development rather than treated as a marketing afterthought, and leverage endpoint detection combined with chain analysis for incident response.