1 Introduction

As the popularity of the smartphones, laptops, tablets, etc. increases, the rate of using digitization and digital payments/e-payment also increases. Digital payment is provided by the bank providers to transfer the currency from one to another in an online gateway. As this technology emerges, the demand of securing the digital/e-payment also increases. There are number of bank providers which provide security of e-payment through user-id and password, OTP (One-Time Password), passphrases, etc. Blockchain is the decentralized way of data storage which mitigates single point of failure and plays a vital role in providing integrity to digital payments by enhancing those to smart wallets.

1.1 Our Contribution

Smart wallets will play a major role in digital payment/e-payment in future so the blockchain wallet security is needed for utilizing more advantages of the blockchain smart wallets. In this paper, we focus on the different attacks and usecases on the blockchain smart wallets, which will help the smart wallet developers to develop the secure smart wallets. We survey the existing and possible attacks and also provide some attack usecases also created which may be executable if particular precautions are not taken. We describe each attack with its mechanism, usecase, benefits and requirements of attacker for successful attack with the possible damage scenarios and consequences, comparison of attack cost and benefits, comparison of mitigation cost and damage cost, possible mitigation and security measures for each attack.

2 Malware and Trojans

Malware and trojans play vital role in offline wallet’s private key theft. Offline based wallets store their private key in user’s system (computer or laptop). To steal private key or seed file from the victim’s system, attacker use malwares and use trojans to remotely transfer cryptocurrencies from victim’s account to attacker’s account.

 

Mechanism: :
1.:

Attacker will detect flaws on user’s system (that is, a system with free anti-virus or without anti-virus system) for installing malware software on that particular system.

2.:

After installation of malware, attacker will hijack the system to find the location of the private key.

3.:

If private key is encrypted then attacker will try to find the seed in same system or he/she will destroy the private key in that system. On the other hand if private key is not encrypted then attacker will steal key for accessing user account and steal sensitive information.

Usecases: :

Cryptocurrencies stolen from Exodus wallet by using bots and malwares [7].

Requirements: :

Attacker needs a full fledged application/software developer to develop malwares. On the hand, attacker should have good knowledge on social engineering for the execution of successful attack.

Goal: :

The goal of the attacker is to steal the private key or seed file from victim’s computer.

Benefits: :

After stealing private key, attacker can gain access to victim’s wallet account and transfer cryptocurrency from victim to attacker account.

Attack Cost vs Benefits: :

Attacker may or may not require a team for execution of this attack and benefits will depend on how much cryptocurrencies victim is stored in his wallets.

Damage Scenario: :

All of victim’s cryptocurrency saving can get stolen.

Damage Consequence: :

Victim may suffer huge money loss which he/she invested in that cryptocurrency.

Mitigation: :

If user realize that his/her system contains some virus, then change passcode immediately and backup the private key.

Mitigation cost vs Damage cost: :

Mitigation requires immediate action otherwise it will be a successful attack. Damage depends on victim’s investment in that particular wallet.

Recommendations: :
1.:

Use paid or trusted anti-virus avoid free version.

2.:

Never store seed passphrase in any text files, writing seed phrase in paper will be better solution.

3.:

Avoid surfing insecure websites to avoid downloading any phishing bots or trojans and always clear cache and cookies for safe side.

3 Windows Clipboard Hijacking

Clipboard hijacking is the attack in which attacker takes control of the victim’s system clipboard and replaces its content with the malicious content which can be a link of malicious website. In terms of blockchain wallets, clipboard hijacking is used to steal the seed phrase of the wallet’s private key.

 

Mechanism: :
1.:

First, attacker will find the details of the victim who have smart-wallets installed their system.

2.:

Attacker will inject malicious software using social engineering or phishing bots to the victim’s system.

3.:

Malware or trojan will hijack clipboard and steals all the contents of the clipboard. If victim copied seed phrase then attacker will get seed phrase and execute next stage of attack.

Usecases: :
1.:

In Google Play, several android apps have found impersonating Metamask for stealing seed phrase from mobile clipboard storage [9].

2.:

Clipboard hijackers monitored 2.3 million addresses, as public addresses are long and difficult to remember wallet users copy-paste the public address to transfer cryptocurrency [20].

 

Requirements: :

Attacker should be application/software developer to develop malwares or trojans suitable for clipboard hijacking. Attacker should also have good knowledge on social engineering and phishing attack to increase the success rate of this attack.

Goal: :

Attacker wants the seed phrase of victim’s wallet private key which may be stored in clipboard database.

Benefits: :

Compromising seed phrase results in gaining complete access of the victim’s wallet to attacker or any malicious user. Benefits depends on victim’s investment.

Attack Cost vs Benefits: :

Attacker may or may not require a team for execution of attack, so a team of two will also make this attack successful and benefit will be very low as compared to web phishing and networks. This attack depends on particular user so benefits will vary on cryptocurrency investment by victim.

Damage Scenario, Consequence and Mitigation: :

Same as malware and trojan attack.

Recommendations: :
1.:

Avoid copy-pasting of the seed phrase in computers.

2.:

Never store seed phrase in computers, writing seed phrase in paper will be better option.

3.:

Use paid anti-virus and beware of insecure websites which contains phishing bots.

4 Web Phishing and Browser Hijacking

In web phishing attacker can alter the address bar of the website by placing a picture of legitimate URL over address using JavaScript commands. These attacks are executed due to flaws in web page scripts [24].

Cryptojacking is also similar to web phishing in which an attacker hijacks a user’s browser to mine cryptocurrencies in blockchain. In cryptojacking, attacker uses JavaScript code and malicious link to hijack other user browser [15].

 

Mechanism: :
1.:

Attacker need to detect the flaw in the website to execute attack against victim.

2.:

Attacker use their own scripts also known as cross-site scripting [10] to make the phishing website.

3.:

To execute the attack without sending any mails or links to victim, attacker can do network attacks(BGP hijacking [8]) for better results.

Usecase: :

Attacker can apparently send mails or links related to the respective professions of the victim about expiration of account or deactivation of cards. On the other hand attacker can use BGP hijacking to set their phishing site in the legitimate server [12]. Recently MyEtherWallet got attacked by DNS attack, BGP hijacking and phishing attack [24]. The attack was not identity based but same kind of attack can also get executed for identity for both user-id and password based and public-private key based DApps.

 

Requirements: :
1.:

Attacker need a team to find the vulnerabilities in different websites.

2.:

Attacker should have a very knowledge of designing websites and JavaScript.

Goal: :

The goal of the attacker is to steal the login credentials or to steal the private key from the decentralized application.

Benefits: :

With the compromised credentials and private keys attacker can steal sensitive data from the particular organization. Profit will be based on organization.

Attack Cost vs Benefits: :

For successful attack, attacker needs a team who have good knowledge on websites and networking whereas benefits will depend on the organization whose credentials got compromised. Hence, bigger the organization, bigger the benefits.

Damage Scenario and Consequence: :

Same as broad based and spear phishing attack.

Mitigation: :

If DApp is user-id and password based then for recovery contact organization immediately and if it is public-private key based then always keep a backup of your private key and contact organization. If private key is not backed up then user will not be able to access their account.

Mitigation cost vs Damage cost: :

If DApp is public-private key based and user took a backup of the private key then mitigation cost will be lower than userid-password based DApp. Damage depends on the respective organization and user.

Recommendations: :
1.:

Avoid using HTTP for website server.

2.:

For public-private key based DApp, keep good anti-virus in the system and also take a backup of private key every-time after each transactions.

3.:

Use two-factor authentication for both userid-password based and public-private key based DApps.

5 Trickbot Trojan

Trickbot is the banking trojan which targets windows machine to steal banking credentials via webinjects. Trickbot can also steal cryptocurrencies from blockchain wallets [14]. There are two techniques, static and dynamic injection, to trick the victim to giveaway their credentials.

Static injection is similar to phishing attack in which attacker replaces bank site legitimate login page with a fake one which looks exact same. Dynamic injection redirects the web browser to attacker’s server whenever user enters the targeted bank website URL [6].

 

Mechanism: :
1.:

For static injection, attacker can make a fake email and website and broadcast across users. Those emails may be located in spam messages.

2.:

For dynamic injection, attacker will detect flaws on network using wireshark or other networking tool to intercept victim’s hostname, port or proxy settings and exploit that flaw to execute the attack [25].

3.:

After exploitation, trojan captures the credential and then attacker will execute next stage of attack.

Usecases: :

Trickbot targets coinbase as one of its attack vectors. Once trojan gets infected in victim’s system, the malware injects a fake login page so that whenever victim visits that particular wallet site, the attacker will get the credentials of the victim [15].

Requirements: :
1.:

Attacker will require a team, who should have expertise in using networking tools, social engineering, website development and application development.

2.:

Attackers should make the malicious links of targeted bank in a legitimate way so victim will give away their credentials.

Goal: :

The goal of the attacker is to steal the credentials of the wallet account.

Benefits: :

As trickbot trojan is specifically designed for banking system, so a successful attack will give very huge benefits to the attackers and an approximate damage can range from $100 Million to $10 Billion (depending on the banks).

Attack Cost vs Benefits: :

Attacker need a team of full fledged network and application engineer for successful attack and benefits will be huge because if bank server gets compromised then attacker can steal the money or cryptocurrency from the targeted bank or wallet company.

Damage Scenario: :

Cryptocurrency theft from targeted wallet company.

Damage Consequence: :

Users and organization will suffer huge money loss and it may result in closure of that wallet company.

Mitigation: :

If user realizes that his/her contains the trojan then cash-in the cryptocurrency and report the wallet organization.

Mitigation cost vs Damage cost: :

Mitigation cost will increase if organization have to change their network architecture whereas successful attack gives huge profit to attackers.

Recommendations: :
1.:

Avoid using free anti-virus, always use trusted or paid anti-virus.

2.:

Wallet company should use HTTPS server.

3.:

Use trusted or secure browsers to avoid session hijacking.

6 JSON-RPC Bug

JSON-RPC is a protocol which allows data to be exchanged between clients and servers. Electrum and exodus use JSON-RPC protocol in their wallet [26]. JSON-RPC listens the localhost that can be exploited as CSRF (Cross Site Request Forgery) [23].

 

Mechanism: :
1.:

First victim has to login to a legitimate site where attacker will use JavaScript which makes GET request to the JSON server which returns sensitive information.

2.:

After that if victim goes to new browser and type website URL, it will get redirected to the malicious login page. On the other hand if JSON does not send response then attacker will use Array constructor (JavaScript allows to redefine Array constructor) to access the data in array and send it to malicious website [11].

Usecases: :

Electrum and Exodus are vulnerable to this attack as electrum is daemon running so attacker can use virtual host on the web server that can easily give access to victim’s wallet via Local RPC port [5].

Requirements: :

Attacker should have the good knowledge on client-server protocol, network ports and JavaScript. Attacker may need team of five members for successful execution of this attack.

Goal: :

The goal of the attacker is to steal login credentials from victim’s computer using Cross Site Request Forgery (CSRF).

Benefits: :

Successful attack depends on router which the organization is using. If attack gets successful then attacker can steal cryptocurrencies from all the customers of that organization.

Attack Cost vs Benefits: :

Attack will get waste if JSON-RPC API is authenticated, if it is not authenticated then it will result in success. Benefits will be huge but possibility of attack occurrence is very low unless you have insecure router or unauthenticated JSON-RPC API.

Damage Scenario: :

Customer credential theft and wallet theft.

Damage Consequence: :

Organization will suffer huge money loss as well as their customer’s money loss.

Mitigation: :

Make sure that JSON services should always return its response as non-array JSON object [11].

Recommendations: :
1.:

The token should require authentication on each request.

2.:

The token must reset on every authentication/authorization request to prevent CSRF or replay attacks and token should have a sufficient length to avoid hash collisions.

7 BGP Hijacking

BGP is a de-facto routing protocol and regulates how IP packets are forwarded to their destination. To intercept the network traffic of blockchain. Attackers either leverage or manipulate BGP routing. BGP hijacking typically requires the control of network operators, which could potentially be exploited to delay network messages. Attackers conduct BGP hijacking to intercept bitcoin miner’s connections to a mining pool server [13].

 

Mechanism: :
1.:

First, attackers will find the target in the small ISP which peered at different connected exchange points, which give them access to the number of ISPs.

2.:

After getting access the targeted ISP data centre was a fake DNS server which selectively responds queries for targeted Wallet organization. In addition, all other requests silently get discarded and for that particular amount of time attacker will hijack the wallet server and executes next stage of attack [17].

Usecases: :

In web phishing we discussed about BGP hijacking through which attackers stole more than $150k of ethers from MyEtherWallet using DNS spoofing and phishing attack. In terms of network attacks in blockchain, this attack happened recently [16].

Requirements: :

Attacker need a team who are full-fledged network engineer. They require in different expertise in networking such as network tracing, network scanning (wireshark) and DNS spoofing, etc. They may also require website developer to make phishing website to increase the success rate of this attack.

Goal: :

The goal of the attacker is to gain access to a small ISP which are connected to different exchange points and also it will give access to number of ISPs which are peered to connected exchange point.

Benefits: :

Attackers can hijack the organization server for a short amount of time, so that attackers can inject their phishing website to the server. Attacker requires multiple attacks to make this attack successful and earn huge profit.

Attack Cost vs Benefits: :

Attacker needs professional network engineer and website developer for successful and benefits will be high due to compromise of the wallet company server. If attack will not get successful then for attacker it will be a huge loss.

Damage Scenario: :

Organization server hijack, customer credential and wallet theft.

Damage Consequence: :

Users of that particular organization will suffer money loss and organization will suffer reputation loss.

Mitigation: :

It is difficult to prevent without acceptance of techniques like Route Origin Authorizations (ROAs) but they can be detected and resolve quickly using monitoring services [17].

Mitigation cost vs Damage cost: :

If detection of attack is monitored quickly then only BGP hijacking can be prevented otherwise in short amount of time attacker will steal cryptocurrencies from many users.

Recommendations: :
1.:

Announce only owned prefixes.

2.:

Limit maximum number of prefixes.

3.:

Filter and accept only prefixes with length /24 and less [21].

8 Crypto Dusting

Crypto Dusting is an attack on cryptocurrency wallets in which attacker distributes illegal funds from unknown source to legitimate cryptocurrency holders which in turn affects the wallet’s company reputation draws attention of law enforcement [2].

 

Mechanism: :
1.:

Attacker will collect illegal funds from either from corrupted employee or businessman.

2.:

After collecting funds, attacker will anonymously distribute the funds to innocent public address of wallet holders.

Usecases: :

Bitcoin users began to get BTC anonymously from BestMixer.io [3].

Requirements: :

Depending how attacker is collecting illegal funds (spear phishing, malwares or network attacks) requirements may vary.

Goal: :

The goal of the attacker either will harm the reputation of the particular wallet company or distribution of illegal funds to normal cryptocurrency holders.

Benefits: :

Crypto dusting is harmless to normal users but if attacker have any grudge towards wallet company, he/she can do this attack for attacker’s personal satisfaction.

 

Attack Cost vs Benefits: :

In terms of attacker’s point of view there is no benefit for attacker for executing this attack, so in this scenario, attack cost will be more than benefits depending on how illegal funds has been collected.

Attack Scenario: :

Micro-transaction on adding cryptocurrencies to multiple address.

Attack Consequence: :

Organization may suffer reputation loss because law of enforcement keeps an eye on some organization and this attack will give attention.

9 Distributed Denial of Service (DDoS) Attack

This attack will get executed when attacker will send excessive data to a node and make it so busy that it cannot process normal transactions. In terms of blockchain, spamming of transactions will also create a huge load on network which results in DDoS [1].

 

Mechanism: :
1.:

Attacker will do malicious attempt to jam normal traffic with excessive packets or data.

2.:

Overwhelming the target server with packet/data flood and use the compromised server.

Usecases: :

In 2018, IOTA users lost their funds by unknown attacker. The user used iotaseed.io for generating seed, maybe iotaseed.io server got compromised and attacker stole cryptocurrencies. In addition attacker executes DDoS attack so users were not able to recover their funds [4].

Requirements: :

Attacker needs to know the use of attack tools like Slowloris to execute the DDoS attack after compromise of that particular server.

Goal: :

The goal of the attacker is to slow down the network so that victim will not be able to recover its cryptocurrencies.

Benefits: :

Particularly DDoS attack will not give much benefits, attacker have to use DDoS attack in combination with other attacks for benefits.

Attack Cost vs Benefits: :

In terms of DDoS, much effort is not required from attacker and benefits will be very low if the solo attack is executed. In combination, benefits will increase.

Damage Scenario: :

Server will get down and delaying services to customers.

Damage Consequence: :

Due to delay services, organization reputation will affect.

Mitigation: :

Route traffic across multiple data centres and detect the fingerprint of the attack. After that drop malicious traffic at network edge and analyse attack pattern.

Mitigation cost vs Damage cost: :

Mitigation of DDoS is little bit complicated and lot of time to recover the network. If DDoS attack is not in combination with other attack then damage will be low.

Recommendations: :
1.:

Secure the network infrastructure and practice basic network security.

2.:

If network architecture is strong then one server can handle extra network traffic.

3.:

Cloud based service providers offers many advantages which may help to fight DDoS attack. If user see lack of performance, network slowdown, website shutdown then it results in DDoS attack and organization should act.

10 Man-in-the-Middle Attack

A MitM attack is executed on an organization or user that can result in credentials compromise if executed correctly. An attacker can intercept the network connection by session hijacking that compromises web sessions by stealing session tokens. In terms of blockchain, attacker can steal session tokens from decentralized applications (DApps) [22].

 

Mechanism: :
1.:

Attacker intercepts an insecure network connection that the user’s device unknowingly connects. For example, evil twin attack.

2.:

If data is encrypted then attacker will install malicious certificate by tricking the user for data decryption.

3.:

Then the attacker steals the session token to authenticate user’s account and execute data breach.

Usecases: :

Attackers alters the address secretly and user will send funds to the wrong address [19].

Requirements: :
1.:

Attackers needs the strong knowledge on networking and cryptography to intercept or eavesdrop the keys between users.

2.:

Attackers needs a team knowledgeable in wireshark for detecting weak or vulnerable networks.

Goal: :

The goal of the attacker is to intercept or eavesdrop keys in weak network to steal sensitive data from decentralized applications.

Benefits: :

Attacker can use the sensitive information from DApp data breach to blackmail normal user or employee from organization for money.

Attack Cost vs Benefits: :

Attacker needs a well experienced network engineer and good knowledgeable cryptographer for executing attack whereas benefits depend on the DApp and web security of that particular organization. If popular organization has low network properties in DApp then benefits will huge otherwise it will be low.

Damage Scenario: :

Leakage of sensitive communication between high profiles of that organization or financial information from DApp.

Damage Consequence: :

Organization will suffer financial loss and reputation loss which may result in shut down of particular organization.

Mitigation: :

If user realizes that someone is intercepting or eavesdropping their communication or stealing session key then drop the communication immediately and contact the organization or bank.

Mitigation cost vs Damage cost: :

In terms of communication eavesdropping of sensitive information, the damage rate will high because attacker already have that particular sensitive information. In terms of session key hijacking there is the chance of recovery if organization is contacted immediately after attack.

Recommendations: :
1.:

Use HTTPs server in DApp or website server.

2.:

Use end-to-end encryption for secure communication to avoid eavesdropping.

3.:

Use multi factor authentication to avoid compromise of login credentials.

11 Insider Attack

An insider may be an employee or people within the organization who have inside information of organization’s security and sensitive information. An insider is a malicious threat to a company or organization. As some of the hot wallets stores private key and seed files in the organization server, insider can steal the files from organization server and can take access of all the customer’s account.

 

Usecases: :

Insiders can steal private keys of the users stored in the server of an online wallets [18].

Requirements: :

Attacker needs to be an employee or associate in an organization to execute attack from inside.

Goal: :

The Goal of the attacker is to steal organization’s or customers sensitive information to use for its own benefits.

Benefits: :

By selling organization sensitive information to the rival company, insider will get huge amount of money from that information as well as insider can misuse customers information to gain more money.

 

Attack Cost vs Benefits: :

This attack contains big risk of getting caught as attacker is an associate there is more chance of getting caught due to less suspects. So attacker will try to most the information which will make the extreme profit for insider.

Damage Scenario: :

High sensitive information theft from organization and stealing of financial data of high level clients.

Damage Consequence: :

Organization and customers related to that organization suffers money loss and reputation loss, also results in shutting down of organization.

Recommendations: :
1.:

Avoid storing customer’s private key in organization server.

2.:

The organization should keep access control of their employees to avoid this attack.