Tag: ARTICLE

I’m skeptical of ‘futurists’. Work closely enough with the development of technology solutions and you’ll know that the only certain thing about the future is that it’s constantly changing. For example, few ‘futurists’ predicted the Covid-19 outbreak that brought the world to a standstill in 2020. Many, however, had spent hours waxing on about how 5G technology was to change the trajectory of human evolution, telling tales of what would be possible with ultra-high speed, ultra-low latency connectivity. Me included. Of course, 5G will enable many of these promised use cases, and many others we haven’t even dreamed of yet,...

This article is the third in a four-part series exploring the differences between traditional IT security and blockchain security.  Check out the first two articles in the series exploring the differences for node operators and application developers. This article explores how user security differs between traditional IT and blockchain environments.  While identical products and services may be hosted in traditional IT and blockchain environments, the differences between these ecosystems can have significant security implications for their users. IT vs. Blockchain Security for Users Traditional IT and the blockchain operate under very different philosophies.  Many traditional IT systems are centralized and try to...

This article is the second in a four-part series discussing the differences between traditional IT security / cybersecurity and blockchain security.  Check out the first article in the series discussing the differences for node operators. This article focuses on the differences between application security (AppSec) for traditional applications and smart contracts.  While the first blockchains, like Bitcoin, were not designed to support smart contracts, their invention dramatically expanded the capabilities of blockchain platforms.  The ability to deploy code on top of the blockchain has been one of the main drivers of blockchain’s widespread adoption and success. Traditional Development vs. Smart Contract...

In today’s era of Big Data, machine learning (ML) systems are increasingly becoming the custodians of vast quantities of sensitive information. As ML algorithms learn from data, they inevitably come in contact with personal, financial, and even classified information. While these systems promise revolutionary advancements in various sectors, they also introduce unprecedented challenges in cybersecurity. One primary concern is handling and protecting this sensitive data throughout the ML workflow. Among the myriad of available solutions, data masking, and more specifically, Dynamic Data Masking (DDM), is emerging as a crucial tool for enhancing security protocols. The technique protects sensitive data and...

In the contemporary landscape of cybersecurity, Artificial Intelligence (AI) and Machine Learning (ML) have emerged as pivotal technologies for tasks ranging from anomaly detection to automated response systems. Central to the effectiveness of these machine learning models, particularly those employing supervised learning, is the quality and integrity of labeled data, which serves as the ground truth for training and evaluation. However, this dependency also introduces a vulnerability: label-flipping attacks. In these attacks, adversaries tamper with the labels of training data, subtly altering them to cause misclassification. The insidiousness of these attacks lies in their ability to create an illusion of high accuracy, as...

Recent events like the FTX meltdown have sparked interest and conversations about how the incident could have been prevented.  In the case of FTX, the primary problem was that the platform did not hold sufficient assets to cover its user deposits and liabilities. What are Merkle Trees and Proofs? Proof of Reserves and Proof of Liabilities can use Merkle trees to prove certain facts while keeping data anonymous.  To understand how these schemes work, it is useful to understand Merkle trees first. A Merkle tree is designed to securely summarize a set of data.  This means that, given the root value of...

Blockchain is a rapidly-evolving technology with a great deal of interest and investment. Decentralized Finance (DeFi), in particular, has a great deal of money invested in it as well as a growing number of high-profile and expensive hacks.  Beyond DeFi, many companies, both large and small, are investing heavily in blockchain technology. As blockchain increasingly underpins major systems, securing this technology becomes increasingly vital.  Financial systems built on the blockchain can suffer significant losses due to blockchain hacks.  The use of blockchain for supply chain tracking and audit logging relies on the blockchain being immutable. However, the widespread adoption of blockchain...

The most comprehensive ranked list of the biggest crypto hacks in history (Up until November 1, 2022. I suspect a larger one is just behind the corner) It wasn’t easy digging through the entire history of cybercrime involving cryptocurrencies, but I wanted to get to the bottom of which ones were the biggest in terms of total value of the stolen digital assets at the time of the incident. Two of the entries occurred while I was conducting my research; that’s how I know this will be the most accurate and up-to-date list of the top 12 hacking incidents in...

In the realm of machine learning (ML), Backdoor Attacks pose a concealed yet profound security risk that goes beyond traditional cybersecurity threats. Unlike overt attacks that exploit known system vulnerabilities, backdoor attacks in ML are insidious; they embed a clandestine trigger during the model’s training phase. This subterfuge enables an attacker to manipulate the model’s output when it encounters a pre-defined input, often remaining undetected by developers or users who deploy the ML model. The significance of this threat vector is magnified as machine learning systems become increasingly integral across various sectors like finance, healthcare, and autonomous driving. These attacks compromise the integrity of...

$566M worth of BNB was stolen from Binance’s cross-chain bridge BSC Token Hub, but how they responded to the hack will be the most memorable part. Decentralization is a hot button topic in web3, and Binance is (at the time of writing) the biggest crypto exchange by trading volume in the world. The recent hack of Binance’s native cross-chain bridge BSC Token Hub revealed to the world what many early adopters of blockchain technology already knew: The BNB Smart Chain (formerly Binance Smart Chain) is not very "decentralized". How did the BNB Smart Chain bridge get hacked, how did Binance stop it,...

Understanding how flash loans and governance work in DeFi to demystify the Beanstalk Farms Hack The only way to understand how the Beanstalk Farms decentralized credit-based stablecoin protocol exploit happened is to first understand flash loans, which are a little known financial tool unique to the DeFi (decentralized finance) space, as well as governance. A flash loan is, like it sounds, a very fast loan. It happens within a single blockchain transaction and no collateral is needed. Instead, the borrower needs to set up a series of trades using smart contracts that can all be executed at once, and they must...

Code reuse is considered best practice in software engineering.  Reusing high-quality, secure code can speed development processes and often results in higher-quality code than software developed entirely from scratch.  Additionally, the reuse of high-quality, audited libraries reduces security risks by decreasing the probability that new vulnerabilities will creep into the code base. In open source communities such as the blockchain and crypto community, code reuse is even more strongly encouraged.  Open-source code released with permissive licenses is intended to be reused in other projects. However, this can also create security risks.  Smart contracts and other software that reuses existing, open-source code...

One attacker and hundreds of copycats looted the Nomad bridge for over $190 million; few did the right thing. Decentralization is a hot-button topic in 2022. To some, it seems like the solution to a variety of issues plaguing the so-called web2 ecosystem, such as the monopolization of social media, the centralized control over the flow of information, and bad data privacy and data monetization practices. Proponents of distributed blockchain technology offer web3 as the decentralized solution to these problems, but web3 has some kinks to work out before it can replace the established infrastructure of web2. One of those kinks involves...

Proving knowledge of a secret is the basis of password-based authentication systems.  The assumption is that only you know your password.  If this is the case, entering your password into a system proves your identity and grants you access to your account. However, this approach doesn’t work as well on the blockchain, where everything stored on the digital ledger is publicly visible.  Any password or other secret included within a blockchain transaction would be revealed to all nodes and users of the blockchain.  This is where zero-knowledge proofs (ZKPs) come into play. What is a Zero-Knowledge Proof? A ZKP allows a prover...

The $611M Poly Network exploit is the largest crypto hack to date in terms of mark-to-market value and all the stolen funds were returned, but the identity of the hacker is still unknown. Dubbed “Mr. White Hat” by the Poly Network security team, the anonymous perpetrator of the biggest crypto hack to date gave all the stolen crypto assets back within 15 days of the incident. But how was the hack carried out? Why did they return the funds? And how did they manage to remain anonymous? We’ll explore these questions, but first.. What is the Poly Network? The Poly Network is a...