Security Research
Showing results for 
Search instead for 
Do you mean 

Bitcoin and security (part 3 of 3)

John_Park on ‎07-17-2014 01:32 PM

Bitcoin and other cryptocurrencies are still in the early stages of gaining widespread acceptance. Among those who are at the forefront of embracing Bitcoin, cybercriminals are making their marks while the legal system is not ready for the challenge.


Cybercriminals usually do not care about attacking a technology until it is widespread and there exists a large enough pool of users using it. Bitcoin is a slightly different case, as it is a currency that criminals might potentially use in the commission of other crimes as well as an object of value unto itself. This means that Bitcoin is potentially both a target for crime and a mechanism for criminal activity. We have also seen crimes in which Bitcoin is a secondary aspect to more traditional criminal activity. In this post, we’ll examine all three situations.


First, let's look at how cybercriminals are targeting Bitcoin itself. We’ll examine variations on a type of malware that predates cryptocurrency, look at how bitcoin heists come to pass, and consider the (potential) dangers of allowing a small minority of Bitcoin participants to corner the market.



Bitcoin as target


As we’ve previously established, cryptocurrency is money, so it is probably inevitable that cryptocurrency-stealing malware exists. If you have a Bitcoin wallet on your computer, cybercriminals want to pickpocket that wallet. More precisely, since bitcoins are not actually stored inside the wallet, they want to steal the private key stored in that wallet. With that private key, they can steal bitcoins stored in that account, from anywhere in the world.


The actual attack mechanism is generally similar to that of online banking trojans. In the case of Bitcoin, a backdoor trojan uploads the wallet file to the criminals; if there is password protection on the wallet, a keylogger would be used to capture that password. In other words, it’s a typical impersonation attack.


However, Bitcoin stealing is more severe in its consequences due to the nature of the currency. In the case of an attack on a more traditional account, the bank can detect a fraudulent transaction and stop it before the money gets taken out of the account. Even if the money is gone, in most consumer cases, banks will refund the fraudulent online transaction and assume the loss as a business operating cost. However, with Bitcoin, once the money is gone, there is no bank to refund the charges, and no way to repudiate the transaction. It is gone for sure.


Since the block chain is transparent, a victimized user could track which account has stolen bitcoins from his account, but that is about where the chase ends. To complicate matters, the stolen funds can be sent to a mixing service, or even spent in a gambling service. (The latter poses an intriguing ethical question: If the bet is lost, the stolen money is gone. But if the bet is won, who is the rightful owner of the gambling rewards?)


Since the population using Bitcoin is still very small, and the user base tends to be rather security-conscious, Bitcoin-stealing malware is not a big problem yet. However, as Bitcoin adoption expands, there will be a need for better protections. You could print your own private key on a piece of paper and keep it off the computer entirely. This might be a safe method, but it’s a cumbersome option. There are hardware wallet options on the horizon; these may prove invulnerable to malware infections, but could lead to interesting questions about potential backdoors and one-off tainted chips – issues that have given security experts pause in the past when considering hardware-based “crypto chips.”


Malware-based attacks of the type described above are, frankly, small potatoes, stealing bitcoins from individual consumers. More recently, cybercriminals have been targeting Bitcoin exchanges with attacks similar to those seen in Advanced Persistent Threat (APT)-style efforts, as there are large numbers of Bitcoin transactions happening on those servers. Most notoriously, Mt.Gox and BitFloor have been hacked and subsequently declared bankruptcy. In both cases, it is still not entirely clear what really happened, other than a large number of bitcoins were transferred to another account. As these organizations are not certified and are not under strict government regulation as banks are, there are risks involving trusting these Bitcoin-related sites (as former Mt. Gox and BitFloor participants can now attest). There is no such thing as “too big to fail” in this world.


That said, size does matter in a specific type of threat that so far remains theoretical, though the prospect of it happening sent waves through the Bitcoin world earlier this year. The aggregation of hashing power could potentially lead to the condition now known as “the 51% attack.”


Generally speaking, Bitcoin transactions are by design not blockable. But this is not entirely true; theoretically, the funds can be frozen. If an entity were to control over 50% of the global hashing power, it would have the theoretical capability to freeze accounts by blocking specific Bitcoin addresses from sending or receiving funds. (It should be pointed out here that a 51% attack can’t steal bitcoins in any case; it’s not an attack on the currency’s integrity, since no one other than the holder of the private key of the wallet can release the bitcoin in it.)


Recently, GHash.IO grew into a mining pool with a simple majority of the total hashing power in the world. That development was somewhat worrisome to the Bitcoin community, and GHash.IO moved carefully to assure the Bitcoin world that its intentions were honorable. But even had they not been, this level of control is not the end of the world.


After all, what is a Bitcoin mining pool? As the name suggests, it is simply a group of miners working together, just as a group of friends might form a lottery pool. Mining pools are a rising phenomenon because it is becoming increasingly difficult to mine a block, yet the reward is getting large. If a block is mined from the pool, everyone in the pool shares the reward. GHash.IO is just a very, very big lottery pool.


It seems reasonable and innocent enough, but pools could become a problem since a mining pool is a business entity that is operating under a jurisdiction of a government. If that government forces the mining pool to cooperate with local law, the whole Bitcoin system could be under pressure from that local government. Next time it might not be just a pool such as GHash.IO, but a government or a coalition of governments, co-creating a bigger mining pool than that of GHash.IO. If the Bitcoin system does really become a central part of the global financial transaction, this could potentially be another battleground, since the US or a coalition of governments might be able to put enormous amounts of computing power toward the effort to dominate the hashing power and to block specific users’ accounts.


Before we close out this section, I should mention another form of Bitcoin manipulation. Since the volume of bitcoin exchange is not huge, if you have enough money, you could potentially move the market. While this attack is unpopular with many, when done properly, this is not illegal, just as the 51% attack is not illegal.



Bitcoin as co-conspirator


We’ve looked at ways in which Bitcoin can be targeted by criminals (or special interests) looking to gain control of its value. Next, we turn our attention to criminal activity in which Bitcoin is part of the problem.


As mentioned in part 2, mining is a legitimate way of making money in the Bitcoin system.  And as we’ve said already, where there is a way to make money, cybercriminals will always find a way to profit from it.


Bitcoin-mining malware uses a victim’s computer's processing power to do the hard work of crunching the numbers. As the cost of electricity is a large portion of the expense incurred in Bitcoin mining, this is a lucrative venture for cybercriminals – using a victim's hardware and electricity to mine and collecting the results. If cybercriminals could infect a large enough user base, however slow the mining process may be, they could make a decent profit. In a recently documented case, the malware was loaded into network-connected storage devices, piling up approximately $620,000 in Dogecoin (another cryptocurrency, one we’ll talk about a bit more in a minute) and causing substantial performance degradation in the affected machines. Another mining incident this spring involved a malicious wallpaper application found on Google Play.


It isn’t just professional cybercriminals that have fallen for the lure of easy money mined by other people’s machines. Many legitimate IT professionals have been caught abusing company property by running covert mining operations. An employee might claim that using underutilized hardware to mine Bitcoin causes no harm. However, as we noted earlier, the cost of electricity is a significant portion of Bitcoin mining, and electricity is not free to the company. Wear and tear on machines must also be taken into consideration, as well as the potential effect on the rest of the system. Management at a particular company could decide to use their underutilized server capacity to mine, of course; though it’s not a particularly efficient use of resources, it would be possible to treat mining as a potential profit center that makes use of underutilized assets. But there is a definite ethical line to consider. (Even if you are "testing" your workplace system to see whether it is possible to run the mining program, be sure to get proper approval from the management, and abide by company policies.)


For the most part, malware writers are generally not targeting Bitcoin, which has the largest share of the cryptocurrency market. Instead, they are targeting “altcoin” (alternate cryptocurrency) such as Litecoin and Dogecoin, which have far smaller shares of the market.  (Dogecoin is currently preferred target over Litecoin, as its release schedule favors early adopters.)




Figure 1: Screenshot of, taken on 2014.07.14



A quick look at the mechanics of “altcoin” (alternate cryptocurrency) gives a better picture as to why Litecoin-variants are favored targets for mining malware. The difference lies deep in the hardware – specifically, the difference between the circuitry used by Bitcoin mining rigs and that used by the likes of Litecoin and Dogecoin. (Figure 2)



Mining Hardware Comparison




                 Hashing Power (MHash/s)


Intel Core i7 3930k



AMD A10-5800K  



Nvidia Tesla S2070 



ATI 6990


 (up to 865, if overclocked and watercooled)


Klondike ($20)



AntMiner S1 ($299)



BTC Garden AM-V1($399) 



ARM Cortex-A9


Figure 2: Mining hardware comparison (



As the chart shows, ASIC (Application-Specific Integrated Circuit) technology has enabled SHA-256 hashing to be lightning-fast, leaving CPU/GPU-based miners in the dust. (I will look more deeply at the differences between CPU/GPU- and ASIC-based approaches to cryptocurrency in an upcoming HPSR Security Briefing.)


Some Bitcoin miners do not like ASIC mining, since it creates barriers to entry for regular Joes hoping to mine. Litecoin is designed specifically to deter ASIC mining; instead of the SHA-256-based mining approach used by Bitcoin, it uses scrypt-based mining, which is difficult to perform with ASIC chips due to the relatively large amount of memory required by the algorithm.


As noted above, Bitcoin mining operations can effectively use custom-built ASIC systems. This will be useful to remember shortly, when we discuss other potential Bitcoin-related crime. For now, we will simply note that such systems can be purchased, as shown in the following photos (Figures 3 and 4).



Figure 3: ASIC miner (photo credit: John Park)




Figure 4: Inside ASIC mining hardware – liquid cooled (photo credit: John Park)


The philosophical differences between CPU/GPU and ASIC approaches are the sort of thing usually debated by the serious fans. On the other hand, the orders-of-magnitude advantage of ASIC-based mining over CPU/GPU-based mining has created an interesting effect – namely, that Bitcoin-focused malware is exceedingly rare.



The hazards we’ve discussed so far are the most worrisome threats;  They’re all technical in nature and applicable to only a limited population: the Bitcoin system and its adopters. However, the threat that is of great interest to the world at large is non-technical in nature. Bitcoin’s use by criminals as an anonymous and untraceable currency garners headlines even beyond the tech world – and could easily draw the kind of governmental scrutiny that can fundamentally change a system.


Bitcoin can be used as a form of payment as long as both parties to a transaction agree to do so. Recently, major Internet retailers such as Expedia and Overstock have started to accept Bitcoin as a form of payment, which is encouraging.  Unfortunately, it is also a favored currency for “dark economy” venues such as the recently shuttered SilkRoad, since it provides superb privacy protection. Beyond such venues, some extortionists have taken to demanding that their victims pay in Bitcoin.


It is deeply unfortunate that Bitcoin is being used in illegal or socially unhealthy activities. However, the fault lies not in the currency but how we use the currency as a tool. Criminals – at least the successful ones – are rather discriminating in their choice of tools, and Bitcoin is a very capable currency indeed. In addition to its extremely high potential anonymity, Bitcoin is very hard to counterfeit, since there’s no human interaction involved with its transfer beyond that at the endpoints. Bitcoin is managed by no government and therefore cannot be frozen by government entities. Finally, criminals don’t trust other criminals not to be equally underhanded; as we know, Bitcoin transactions are not reversible, so a ransom paid in Bitcoin can never be repudiated.


As we see, Bitcoin can be both a target and a tool for cybercriminals. There are also crimes that involve Bitcoin in only a tangential way. The most interesting among these, which amounts to fraud, is ironically the sort of thing the current legal system is well-equipped to understand.



Bitcoin as bystander


Custom-built mining rigs, such as the unit shown in Figures 3 and 4 above, could be viewed as the goose that laid the golden eggs -- just connect to the electricity and the Internet, and they will make money. As these machines are in much demand, most of the sales are done as pre-sales (paid before manufacturing), which is also typical of chip manufacturing.


However, there have been delays (intentional or not) in manufacturing, which makes the device less attractive due to exponentially growing global hashing power. Also, hashing power and electricity consumption in the finished machines may be different from what is advertised. Several manufacturers (Butterfly Labs, CoinTerra, HashFast) have been hit with class-action lawsuits by disgruntled buyers. Potential purchasers of these ASIC mining machines should do a background check before deciding to spend a few thousand dollars and waiting for months for these machines to be shipped.





There are clearly a number of things that could go wrong with Bitcoin. The good news is that none of the issues I’ve listed are super-serious flaws, and for the foreseeable future, we can reasonably expect the Bitcoin system to keep rolling along. Even better, the technology -- especially the use of the block chain -- will spill over into other fields of study as time goes by. Increased attention will lead to increased sophistication and, likely, increased safety and utility.


Even though Bitcoin is built well with security baked in, security researchers should keep up with the technology and do their best to stay a step ahead of the cybercriminals. As ever, we should prepare for the worst situations possible – but in this case, with this breakthrough technology, it’s also possible to hope for the best. 

0 Kudos
About the Author


27 Feb - 2 March 2017
Barcelona | Fira Gran Via
Mobile World Congress 2017
Hewlett Packard Enterprise at Mobile World Congress 2017, Barcelona | Fira Gran Via Location: Hall 3, Booth 3E11
Read more
Each Month in 2017
Software Expert Days - 2017
Join us online to talk directly with our Software experts during online Expert Days. Find information here about past, current, and upcoming Expert Da...
Read more
View all