Partnered With:

Popular science | trade dust ductility attack, attack and attack the witch

Read this article in 11 Minutes

Understanding the various types of attacks allows us to better defend ourselves against them and keep our property safe.

The original title: "popular science | trade dust ductility attack, attack and attack the witch"

Source: Vernacular blockchain

Blockchain is a door to open a new world, it seems to let us see a transparent and fair world, but they do not know that this door is also facing a variety of attacks, specific some of the attacks, today let us talk about it.

01 交易延展性攻击

Transactional malleability attack, also known as transactional malleability attack. In real life, when we knock a piece of gold out of shape, its shape changes but its mass does not. That is to say, the appearance of gold changes but it is still accepted. This property is called "malleability".

In the Bitcoin system, there is a similar term, Transaction Malleability. The term is often translated as "trade malleability", also known as "trade malleability", and attacks that exploit trade malleability are called trade malleability attacks.

After bitcoin transaction A is issued, before being confirmed, the attacker modifies some transaction data to make the unique identification of A transaction --Trading hashIf transaction B is recorded in the Bitcoin ledger first, transaction A will be rejected because of the double payment problem and will be deemed illegal.

A real example is: the little black money from trading platform, then the deal is broadcast out, before has not been node authentication, the little black ductility attack, to attack the New Deal is confirmed first, and the New Deal will let him get money (like gold appearance changed approved).

But greedy little black but complain to the platform and have not received, before trading platform, a look to the little black transfer have been refused the deal, and therefore give collected a little black, black heart alacrity, greedy little black is not met, he continues to attack many times in the same attack way, thus lead to the platform of the loss of money.

Therefore, when a transaction cannot be confirmed, it needs to stop immediately. It should report an error message according to the transaction on the blockchain and check whether such transaction has been initiated within a short period of time, and then carry out manual processing.

02 粉尘攻击

"Dust" means a small amount of coins (for example, 1 Cong is "dust", which is only 0.00000001 Bitcoin). Normally, very few people trade that little because the transaction fee already exceeds the transaction amount.

It is because of the "dust" is very small so easily ignored by users, this phenomenon is the little black (fraudsters) noticed, so little black like address into the "dust", to the user's purse and received the "dust" user to light did not pay attention, the dust was received great white, but has yet to take out, So the "dust" matches the unspent coins baymax received in his wallet's address.UTXO) Mixed together.

The dust (blue) is mixed with the money that was originally received but not spent

But now the problem is not so big, just mixed together, the real problem is baymax using itUnexpended expenses", the dusts might be used when baymax, who is a fool, uses the money to transfer money to other addresses or make other transactions, and then the dusts quietly follow Baymax's transactions to other addresses.

Like fluorescent agent, these "dust" describe baymax's behavior in detail, which is then tracked by Hei. Hei uses these clues to guess Baymax's identity, and then threatens and extorts baymax. This is the dust attack.

How do you avoid this kind of attack?

Above mentioned is that the real problems to light with the mixed with "dust" did not spend the money, if you don't take this charge to light, "dust" will not run, the little black will not track, however, we cannot ask to light because the "dust" will never take the other did not spend the money of the pool.

So some wallets (like Electron Cash) can label the dust individually, alerting baymax users not to use it, effectively separating the dust from the rest of the pool's unspent currency so baymax can safely use the unspent currency. Thus effectively avoid dust attack.

03 女巫攻击

Witch attacks, also known as Sybil attacks, are named after the movie Sybli, about a woman with 16 personalities in psychotherapy. In blockchain, a witch attack is when a malicious node illegally assumes multiple identities.

This is a bit like the "hand in hand" game we played when we were young. When the new kid joins our game circle, he will hold the hand of the person next to him, and then he has a further understanding of the person next to him. In a blockchain, any network node can send a request to join, and the other nodes receiving the request will immediately respond with a message from their neighbor.

But some children in order to know more friends, every time change a mask, so that you can go to different positions to lead other children. Malicious nodes, like this spoof child, disguise themselves as multiple identities so that they can obtain a large number of blockchain network node information for further attack and destruction.

One way to deal with witch attacks isProof of work mechanismUsing computing power to prove that you are a node greatly increases the cost of the attack.

Another approach is identity authentication, which can be based on third-party reliable nodes. Choose the one with the brightest eyes to avoid being fooled by the kid's mask. Identity authentication can also be all-node authentication. This means that each child will have to check the identity of the prankster, which greatly reduces the chance that the prankster will successfully disguise multiple identities.

04 小结

Understanding the various types of attacks allows us to better defend ourselves against them and thus protect our property. This is the end of today's talk, there will be eclipse attack and DDoS (distributed denial of service attack) and other types of popular science introduction, welcome to follow. What other attacks in blockchain do you know or want to know about? Any idea how to defend against them? Feel free to share your thoughts in the comments section.