Threat Management and Defense

As blockchain is a relatively recent technology, it is an active research and practice area [16]. There are some inherent conceptual problems for which different solutions are being developed, according to the consensus algorithm and the network features. In this section, we describe some limitations, grouped by attack risk, that can affect the overall efficient functioning of blockchain technology.

TABLE 6.2

Blockchain-Based Financial and Nonfinancial Applications

Fifty-One Percent Majority Attack: Theoretically, the consensus mechanism of blockchain has 51 percent vulnerability, which can be exploited by attackers to compromise at least 51 percent of the nodes of a network of blockchain. Exploiting this vulnerability may be possible by joining some nodes of the network to aggregate a hash power that is equal to or more than 51 percent of the blockchain’s total hash power, therefore dominating the competition. This vulnerability may be exploited by a malicious attacker to carry out the following attempts: a. Run a double-spending attack, which means spending the same credit twice, in the Bitcoin case.

b. Change transactions’ order inside blocks.

c. Destroy the network by preventing fair mining competition, by dominating block generation for themselves.

However, in a PoW, while a majority attack is theoretically possible, it is practically infeasible.

• 2. Selfish Mining Attack: This is another fundamental problem regarding block- chain network security. Selfish miners can generate a private fork of the chain, and after that, make it public, as an attempt to gather more rewards, indifferent to the honest miners or fair competition. Qianlan Bai et al. [77] establish a novel Markov chain model to characterize all the state transitions of public and private chains. The proposed chain allows profitable delay increases with the decrease of the hashrate of selfish miners, forcing mining pools to be more cautious about performing selfish mining.
• 3. Race Attack: This attack is another way around double-spending, requiring the victim to accept unconfirmed transactions as payment [78]. An attacker could leverage a race attack by supplying an unconfirmed transaction to the recipient as payment, while the attacker broadcasts a conflicting transaction to the network. The attacker creates an illusion for the recipient, by showing the transaction in the recipient node before network confirmation. The network notices the double-spending and cancels the recipient transaction. So, as a countermeasure, it is recommended to wait for a minimum of six posterior confirmed transactions, to check that the participant did not receive falsified tokens.
• 4. Sybil Attack: The term Sybil comes from the name of Sybil Dorsett, a psychiatric patient with dissociative identity disorder, also knowrn as multiple personality disorder. Theoretically, a Sybil attack is a security breach on online systems, where one person or node tries to take over the network by claiming multiple identities, accounts, or computers, behaving similarly to a person with multiple social media accounts. In the world of decentralized systems, attackers might control multiple nodes on the blockchain network. Attackers can then refuse to transmit or receive blocks, effectively blocking honest users/miners from a network. Even though a Sybil attack is still theoretical, researchers have made many attempts over the last decade to achieve full trust between strangers. In "TrustChain: A Sybil-Resistant, Scalable Blockchain,” [79], the authors nearly created a blockchain that enables the broadcasting of trusted transactions among anonymous users without central control, by building trust between individuals. They offered scalability, transparency, and Sybil-resistance by replacing PoW with a mechanism to establish the validity and integrity of transactions.
• 5. Balance Attack: This attack is active against blockchain systems that use a PoW consensus algorithm to enable double-spending in Ethereum and Bitcoin blockchains. Attackers could leverage a delayed communication with balanced mining power in the blockchain network between multiple subgroups of nodes. In "The Balance Attack against Proof-of-Work Blockchains” [80], the authors provide a theoretical study based on the configurations and other related statistics that are similar to the blockchain infrastructure utilized by the R3 consortium.