Survey on Analysis and Countermeasure for Hacking Attacks to Cryptocurrency Exchange

Survey on Analysis and Countermeasure for Hacking Attacks to Cryptocurrency Exchange

Sunghyuck Hong

Professor, Division of ICT, Information Security Major, Baekseok University

암호화폐 거래소 해킹 공격 분석 및 해결 방안 연구:

서베이

홍성혁

백석대학교 ICT학부, 정보보호전공, 교수

Abstract As the value of technical information increases, hacking attacks are trying to steal technical information through hacking. Recently, hacking of cryptocurrency exchanges is much easier to monetize than existing technical information, making it a major attack target for hackers. In the case of technical information, it is required to seize the technical information and sell it to the black market for cashing.In the case of cryptocurrency, most hacking attacks are concentrated on cryptocurrency exchanges because it is easy to cash out and not easy to track when successful hacking. Although technology cannot be hacked, cryptocurrency transactions traded on cryptocurrency exchanges are not recorded on the blockchain which is simply internal exchanges, so insiders may manipulate the quotes and leave gaps or leak out. Therefore, this research analyzes the recent hacking attacks of cryptocurrency exchanges and proposes solutions to secure cryptocurrency trading.

Key Words : Cryptocurrency, Exchange, Hacking, Blockchain, Token

요 약 기술정보의 가치가 높아짐에 따라 해킹을 통한 기술정보를 탈취하려는 해킹 공격이 늘어나고 있으며, 최근 암호화폐 거래소의 해킹은 기존의 기술정보보다 훨씬 현금화가 쉬워 해커들의 주요 공격 대상이 되고 있다. 기술정보의 경우는 기술정보를 탈취한 후 블랙마켓에 판매해야 현금화가 되지만 암호화폐의 경우 해킹 성공 시 바로 현금화가 용 이하고 추적이 쉽지 않아 대부분의 해킹 공격은 암호화폐 거래소에 집중되어 있고, 블록체인 기술은 해킹이 불가능하지 만, 암호화폐 거래소에서 트레이딩 되는 암호화폐 거래내역은 블록체인에 기록되지 않고 단순한 거래소 내부 거래이기 때문에 내부자가 시세를 조작하여 차액을 남기거나 외부로 유출되는 사례가 빈번히 발생하고 있다. 따라서, 최근에 발 생한 암호화폐 거래소의 해킹 공격을 분석하고 해결방안을 제시하여 안전한 암호화폐 거래를 할 수 있도록 제안한다.

주제어 : 암호화폐, 거래소, 해킹, 블록체인, 토큰

*This paper was supported by 2019 Baekseok University Fund.

*Corresponding Author : Sunghyuck Hong([email protected]) Received August 26, 2019

Accepted October 20, 2019

Revised October 2, 2019 Published October 28, 2019

1. Introduction

In 2008, Satoshi Nakamoto developed Bitcoin, a distributed processing system, as an alternative to the central processing method, and the blockchain emerged as the core technology of the 'Fourth Industrial Revolution'. Cryptography also plays a very important and important role in the system as a compensation system for block chains. Since then, the cryptographic market has attracted a great deal of interest from investors, researchers and policy makers in many countries[1].

As the interest in the cryptographic market grows, there have been many exchanges, and there are many cases where the cryptocurrency exchang has been hacked and damaged. Bitsum Exchange, which is a representative exchange among exchanges, has recently become a topic of hacking. It is hard to defend the exchange hacking attack realistically. That's why the vulnerability is obvious and we are sure that it is being exploited. The composition of this study is as follows. In Chapter 2, we will conclude the cryptography, exchange hacking method, Chapter 3, how to deal with exchange hacking, and final Chapter 4, concluding the conclusion.

2. How to Hack the Exchange 2.1 Cryptography

Convergence Name Market Capitalization Price

Bitcoin 177,492,021,133 9,921.52

Ethereum 19,835,264,164 184.65

XRP 11,316,228,774 0.263839

Bitcoin Cash 5,345,884,206 297.65

Unit Maket Capitalization&Price : USD Table 1. Major Coin (2019.8.22.)

Table 1 is type of cryptocurrency from coinmarket.com[2]. Cryptocurrency is a

compound word of 'crypto-' with the meaning of 'encryption' and 'currency' with the meaning of currency and money. It is transmitted securely through public key encryption in a distributed recorder (Distributed Ledger) It is a digital asset that can easily prove ownership by using. In general, cryptography operates on a blockchain or on a Distributed Ledger based on Directed Acyclic Graph (DAG)[3].

Unlike real money such as dollars ($) or won (₩), passwords are distributed and stored in peer-to-peer (P2P) networks around the world without a central bank issuing money. There are various kinds of money. The key technique for issuing and managing cryptography is block chaining. Block chaining is a synonym for block and chain, meaning that blocks containing transaction history data are connected like chains.

In other words, it is also called 'Distributed Ledger Technology'.

The concept of a blockchain comes from the problem of how to manage the ledger, which is the core of the transaction. Since all transaction details are based on data recorded in the ledger, it is important to manage the books securely.

Fig. 1. Basic structure of blockchain

While traditional financial institutions, public agencies, and corporations use a centralized system that puts the ledger on a central server, the blockchain is a peer-to-peer (P2P) And each node records and manages them jointly. Each

node identifies the authenticity of transaction details by sharing and collating transaction details[4].

As shown in Fig. 1, the block consists of a header part and a body part. In the body part, there is a transaction list of transactions. In the header part of the block, there are various summary information about the block such as the root value of the merge tree, the time stamp, and the difficulty. One of them is the hash value of the previous block Since the previous block value affects the current block value, it has the form of a chain[5]. The blockchain uses a pure P2P network of two P2P networks. Pure P2P is highly scalable to add new nodes, but it is difficult to design and operate the system, and each node must implement an algorithm that can discover and search other nodes on its own. The algorithm that is implemented at this time is the consensus algorithm.

The consensus algorithm is an algorithm for participants to agree on a single result when a time difference is received between the nodes in a P2P system such as a block chain. In the block chain, we examine the validity of the generated block and use it to reflect the entire block chain.

The idea is to keep the same data for specific values in the system when the system is distributed. There are competition and non-competitive methods for the types of agreement algorithms. Competition method is to maintain blockchain with one data through competition. Noncontact method is used to distinguish block chain, and digital signatures of digger are inserted in block. There are two types of competition algorithms: the Proof of Work (PoW) and the Proof of Stake (PoS).

2.2 Cryptographic Money Transfer Method Use METAMASK, Ethereum-Wallet, or Remix-Solidity IDE to show how to send money.

Fig. 2. 4.4998 ETH was mined in the Account 2

You need to have an ETH (cryptographic currency) mined to create an account for Account 1, Account 2, and to transfer from an Account 2 account to an Account 1 account. You will need to use the password to make a Smart Contract in the Test Faucet ETH is obtained using Ropsten Test Network as shown in Fig. 2, 1 ETH 5 times, and 4.4998 ETH is made by one attempt to verify that it works properly to create the paper.

Fig. 3. When transferring ETH, fee(=gas) occurs

As shown in Fig. 3, GAS occurs when ETH is transmitted from Account 2 to Account 1.

Fig. 4. Send 0.5 ETH

Account 2 to 4.4998 As shown in Fig. 4 of ETH, 0.5 ETH is transmitted to Account 1.

Fig. 5. Confirm Transactions remitted

As shown in Fig. 5, you can see the transaction that 0.5 ETH sent in Account 2.

Fig. 6. Send ETH using Remix-Solidity IDE

You can use the Remix-Solidity IDE to transfer the ETH, choosing the appropriate version, Enviroment, for the .sol file. Disable the Privacy mode of METAMASK and select TESTNET Account.

As shown in Fig. 6, transaction is executed through deploy, and GAS is accepted when transaction is performed, and ETH is consumed.

As long as clicking the Deploy button in Fig. 6, this smart contract deploy on main or test networks.

In the remix transactions script, print the URL to check the transaction details as shown in Fig.

7. Click on the output URL to check the Transaction details and click on the address of the account which you sent to see the transaction list as shown in Fig. 8.

Fig. 7. Transaction Details URL output

Fig. 8. Check a transaction detail

2.3 Cases of Hacking

2.3.1 Virtual currency exchange 'Bitsum' hacking ... 35 Billion Spills

BITSUM, the nation 's largest cryptographic exchange, announced on August 20 that it had been hacked by about 35 billion won in assets through an emergency notice.

Bitsum explained that Bitsum-owned hot-wallet , which kept the commission from the cryptographic transaction was hacked[6].

2.3.2 Virtual currency exchange 'Ubit' closure First bankruptcy caused by hacking

The virtual currency exchange Ubit announced the closing of business on the 19th. In the frenzy of domestic virtual currency trading, the exchange has remained the first case to declare bankruptcy.

According to Yubit, about 17% of the total assets were lost in the coin purse due to hacking at 4:35 am today, and the coins were stored in the cold wallet, so no additional losses were reported[7].

2.3.3 Cryptography has stolen a total of $ 1.1 billion over the past six months.

In the past six months, cryptographies have been stolen, reaching $ 1.1 billion. Those who operate on the Web continue to steal passwords from cryptographic exchanges, businesses and individuals, and cyber attack (Cryptojacking), which is implemented for that purpose, is also increasing[8].

2.4 How to Hack the Exchange

Fig. 9. Exchange Hacking Attempts Overview Plot

Hackers try to hack cryptocurrency exchanges in a variety of ways. Exchange hacking uses e-mailing methods, penetrating into the exchange using internal security vulnerabilities, or taking out or unauthorized user's wallet. The most popular method is hacking using malicious e-mail[9-11]. Fig. 9 is an overview of hacking using malicious e-mail which get attracted and leaded a malicious site to inject codes which can collect sensitive data from users. The schematic diagram of the hacking attempt in Fig. 2 is actually a hacking attempt in Korea. It was confirmed by the National Police Agency that it

was an attack aimed at smuggling bit coins by sending e-mails with malicious programs 10 times to impersonate financial institutions and national institutions to 25 people including 4 Bitcoin exchanges employees.

3. Exchange Hack Alternative Method

Hacking in Crytocurrency traders is trying to spoof the number of trading or up and down ratio. To get this attach, they use spam emails.

First, when a user has a link to a received e-mail in a corresponding manner, the user directly enters the address in the address window without clicking. This method can prevent URL spoofing[12]. Second, the developer and the administrator respond to the information about the user by creating one blockchain for the DB, not the DB server, storing the information and managing it with the private key. In this method, data is stored in a blockchain rather than stored in a DB server. Therefore, it is less likely to forge data, and decentralized system can increase service reliability and reliability if data is used[13-15].

4. Conclusion

Cryptography Exchange Hacking uses e-mail methods, using internal security vulnerabilities to penetrate the inside of the exchange, or taking out or unauthorized the user's purse. In response to this, users should not click on the link of the received e-mail when it is not reliable e-mail, and should respond to the hack by accumulating knowledge about hacking. Developers and administrators should try to develop a method to store information by using a blockchain instead of storing it in a DB server. To overcome this hacking attack, cryptocurrency traders must use blockchain based peer to peer trading which is only way to prevent from hacking.

REFERENCES

[1] C. J. Francés. (2018). The cryptocurrency market: A network analysis. ESIC Market Economics and Business Journal, 49(3), 569-606.

DOI:10.7200/esicm.161.0493.4

[2] R. Courtland. (2012). Virtual Currency Gets Real. IEEE Spectrum, 49(6), 52-53.

DOI:10.1109/mspec.2012.6204182.

[3] J. Chen & G. Ji. (2010). Multi-class LSTSVM classifier based on optimal directed acyclic graph. 2010 The 2nd International Conference on Computer and Automation Engineering (ICCAE).

DOI:10.1109/iccae.2010.5452037

[4] A. Rodriguez-Perez. (2017). Secret suffrage in remote electronic voting systems. 2017 Fourth International Conference on eDemocracy & eGovernment (ICEDEG), Quito, 277-278.

DOI: 10.1109/ICEDEG.2017.7962550

[5] G. G. Dagher, P. B. Marella, M. Milojkovic & J. Mohler.

(2018). BroncoVote: Secure Voting System using Ethereum’s Blockchain. Proceedings of the 4th International Conference on Information Systems Security and Privacy.

DOI:10.5220/0006609700960107

[6] P. C. Mullan. (2014.). Bitcoin Decentralized Virtual Currency, The Digital Currency Challenge: Shaping Online Payment Systems through US Financial Regulations. New York; Palgrave Pivot.

DOI:10.1057/9781137382559.0014

[7] N. Jain. (2019). A New World of Virtual Currency:

Cryptocurrency. 10th International Conference on Digital Strategies for Organizational Success.

DOI:10.2139/ssrn.3308559

[8] A. Ogunbadewa. (2014). The Virtues and Risks Inherent in the Bitcoin Virtual Currency. SSRN Electronic Journal.

DOI:10.2139/ssrn.2425114

[9] R. Sassower. (2013). Legality and Morality: Intellectual Property, Virtual Currency, and Corporate Responsibility. Digital Exposure, 51-65.

DOI : 10.1057/9781137312402_4

[10] A. Ogunbadewa. (2013). The Bitcoin Virtual Currency:

A Safe Haven for Money Launderers? SSRN Electronic Journal.

DOI:10.2139/ssrn.2402632

[11] V. I. Karpunin. (2018). Virtual Project For Virtual Economy: About Crypto Currency And Other Issues.

Vestnik of the Plekhanov Russian University of Economics, 3, 33-49.

DOI:10.21686/2413-2829-2018-3-33-49.

[12] J. Yang, Y. Chen, W. Trappe & J. Cheng. (2014).

Detection and Localizing Multiple Spoofing Attackers.

SpringerBriefs in Computer Science Pervasive Wireless

Environments: Detecting and Localizing User Spoofing, 23-41.

DOI:10.1007/978-3-319-07356-9_4

[13] G. Ballabio. (2017). Prime-Partitioned Block Chain: A Scalable and Efficient blockchain Implementation.

SSRN Electronic Journal.

DOI:10.2139/ssrn.2927669.

[14] J. G. Kim & S. K. Lee. (2019). Development of portal web service contents for nursing students’ career search. Journal of Digital Convergence, 17(7), 245-254.

DOI:10.1109/icphys.2018.8390792

[15] S. H. Hong. (2013). Countermeasure for Anti-financial hacking. Journal of Convergence for Information Technology, 3(1), 43-48.

홍 성 혁(Sunghyuck Hong) [종신회원]

․ 2007년 8월 : Texas Tech University, Computer Science (공 학박사)

․ 2012년 3월 ~ 현재 : 백석대학교 ICT 학부 정보보호 전공

부교수

․ 관심분야 : 블록체인, 사물인터넷 보안, 경량보안프로토콜

․ E-Mail : [email protected]