Security
Cryptocurrency Security (Blockchain security) is the degree of resistance to, or protection from harm. It applies to any vulnerable and valuable asset, such as a person, dwelling, community, nation, or organization. Security provides a form of protection where a separation is created between the assets and the threat. These separations are generically called controls, and sometimes include changes to the asset or the threat.
Contents
Crypto Currency Security Standard (CCSS)
CryptoCurrency Security Standard (CCSS) is a set of requirements for all information systems that make use of cryptocurrencies. By standardizing the techniques and methodologies used by systems around the globe, end-users will be able to easily make educated decisions about which products and services to use and with which companies they wish to align.
CCSS is designed to complement existing information security standards (i.e. ISO 27001:2013) by introducing guidance for security best practices with respect to cryptocurrencies such as Bitcoin. CCSS is not designed to substitute or replace these standards. As with any standard, knowledgeable and experienced security professionals and/or auditors are necessary when implementing any information system to ensure coverage of all classes of attack as well as the appropriate handling of all potential risks[1].
CCSS covers a list of 10 security aspects of an information system that stores, transacts with, or accepts cryptocurrencies. An information system is a collection of technologies (hardware and/or software), personnel, policies and procedures that work together to provide a secure environment. A security aspect is a discrete technique of securing one piece of an information system. The minimum value of all 10 aspects determines an information system’s overall score within three (3) levels of increasing security: Level I is the lowest and offers strong security measures, while Level III is the highest and offers the most comprehensive security.
These 10 aspects are organized into 2 domains that help structure the guidelines. A summary of the standard can be seen in the below example which depicts sample results after auditing a “Level I” system.
Cryptocurrency Security Tips
Cryptocurrency Wallet Security – Do Not Use Web Wallets
A web wallet is also called a hosted wallet because this is a type of Bitcoin wallet that is hosted by a third party. It’s like entrusting your Bitcoins to another company. Although they may be easier to use, not all of them are able to provide a higher level of security to all the Bitcoins you have given them to be stored.
Once you decide to make use of this wallet, you will need to sign up for an account and you can then start to deposit your Bitcoins to your account. Once you have Bitcoins on your account, you can start buying the things you want using it and you can even send and receive Bitcoins through the web wallet.
But then, these web wallets are a magnet for hackers and therefore, they should be avoided as much as possible. But if it is really necessary to use one, then do your research well and choose the company that can provide the highest level of Bitcoin security and safety. You can read reviews online from other Bitcoin users who have tried using the web wallet. Also, you can choose to transfer your Bitcoins from your exchange based wallets after every exchange transaction. You can store it on your own personal computer and should be kept encrypted[2].
Limit the Access to Corporate Bitcoin Wallets
You probably run a business and you have decided to use Bitcoins as your medium of currency. But be very careful with giving access to your Bitcoin wallets. This is very important in a corporate environment. Due to the anonymous nature of every Bitcoin transaction, it can be hard to trace if ever someone will attempt to steal your Bitcoins. If ever an employee would get access to your Bitcoin wallet, he or she can easily transfer the funds to another wallet without your knowledge. There is no way of tying the destination wallet to any individual employee.
For organizations that have several employees and staff and that some of the employees need access to the Bitcoin wallet in order to make certain transactions, it is recommended to make use of a wallet that come with multiple sub wallets. You should be able to assign one sub wallet for every employee who will need to have access to your Bitcoins and make sure that each sub wallet should be protected with encryptions. This is one of the most important Bitcoin security and safety tips to remember.
Separate your Bitcoins to Hot and Cold Wallets
Wallets that stay on machines which are connected to the World Wide Web are called hot wallets, since they are at high risk to network based attacks, as opposed to wallets that are offline in nature. If you are running any kind of Bitcoin online business, offline wallets will be a better tool. They are way safer and they are not that attractive to hackers. If you really need to make use of web based wallets, try to keep some of your Bitcoins on an offline wallet, or a cold wallet.
It would be ideal to keep the bulk of your Bitcoin funds on the offline wallet or the cold wallet. This can be stored on a safety deposit box if you prefer. Then you can keep just a small float of your Bitcoins on your online wallet or web wallet and this is what you are going to use for your day to day Bitcoin transactions. If in the event that you will receive huge amount of Bitcoins on your online wallet, move them as fast as you can to your offline wallet before the hackers could attack.
Store Private Keys Offline
Another important Bitcoin security and safety tip that any Bitcoin user should remember is to keep private keys offline. As you know, Bitcoin wallets would make use of public keys for sending and receiving Bitcoins. The public keys are also used for other functions such as checking your Bitcoin account balances. It is also the public keys that you will use to authorize payments from your Bitcoin wallets. Therefore, if anyone would be able to have access to your private keys, they can pretty much use your Bitcoins in whatever way they want without your knowledge.
In order to enhance the security of your Bitcoin wallet, remove its private keys and then store them somewhere, perhaps, in a separate computer that is not connected to the Internet. This way, you can be sure that it will not be compromised by hacker or malware attacks.
When making a payment of a transaction that is generated online, bring it to the offline computer with the use of a USB stick, and when it’s already on the offline computer, that’s when you enter the private key. After that, bring it back to your online computer and then complete the transaction there.
You may find this inconvenient but this is actually for your Bitcoin security and safety. Doing this will surely provide significant extra protection to your wallet. Remember, it is extremely important that you keep your wallet protected especially if your wallet contains a large amount of Bitcoins. Compromising a cold wallet is very difficult since it would require physical access.
Use a Dedicated Hardware
Make use of a dedicated hardware for doing your Bitcoin transactions. You can make use of a dedicated USB key in moving data from your online computer to your offline computer. This is to minimize its exposure to potential viruses. It would also help if you dedicate your offline computer exclusively for your offline wallet. This will also help to minimize its potential exposure to viruses and web hackers.
Use Linux on Online and Offline Computers
The best way to move data in between online and offline computers is to make use of a USB drive. This is also for your Bitcoin security and safety. Linux has the best record of resisting any USB based attacks so choose this as the USB drive for transferring Bitcoin related transactions from online to offline computers.
Keep a Highly Secure Offsite Backup
If your computer accidentally gets lost or stolen, or perhaps it got destroyed and your hard disk fails to function, then you will no longer be able to have access to your wallet and most especially the Bitcoins that are on the wallet. This is the reason why Bitcoin experts would recommend that you back up your Bitcoin wallet elsewhere. One of the most useful Bitcoin security and safety tip is to create multiple backups that are stored on different locations.
Depending on the type of wallet that you will use, you might be able to back up your wallet after every transaction or right after every 100 transactions in order to keep it updated with the latest private keys that have been created in order to have access to your Bitcoins.
Make Use of a Type 2 Deterministic Wallet
The biggest benefit of Type 2 Deterministic Wallet, which is a feature found on both Armory and Electrum open source wallets, is that it makes use of a seed in order to deterministically produce all of the future private keys for any of the Bitcoins that you have received. This means that you will only need to create one backup server.
The reason behind this is because the backup has the seed. So if ever you lose your wallet accidentally, you can simply create new wallet using that same seed and your lost wallet will immediately be recreated with all of the private keys as well as the Bitcoins that were inside it.
Make Use of Fragmented Backups
Although you might only need to create one backup for your seed ever, it is still recommended that you create multiple copies of such backup and then store them at various locations. If you are concerned on the physical security of your backup, then create fragmented backup. This will split the seed into six fragments and any four will need to recreate the seed. You can then store each fragment on various locations. Before a thief could get access to your wallet, he would need to first have access to the four of the six fragments which is somehow difficult for him. The Armory wallet is one of the web wallets that provide the option of fragmented backups.
Make Use of Hardware Wallet
A hardware wallet is also highly recommended if you are after the Bitcoin security and safety. This wallet effectively makes use of a USB key that comes with an on board computer running in its own special operating system, which is dedicated to operating a Bitcoin wallet.
A good example of this type of wallet is the Trezor. Its hardware is able to store the private keys of your Bitcoin wallets and will never divulge them. It works the same way as other laptop computer’s TPM or Trusted Platform Module, which holds encryption keys.
By merely inserting a hardware wallet to an online machine, all Bitcoin transactions can be signed with the use of private keys that are stored in the hardware. Even if the online computer gets infected with malware and other viruses, Bitcoins will still be able to securely send and receive funds without getting access to all of the important private keys.
Bitcoin Security Breaches and Issues
The Bitcoin protocol itself may be secure enough, but this does not extend to all the sites and services that deal in bitcoin. Here’s a quick rundown of some of the more notable instances of security-related issues over the past year or two.
Inputs.io
October 2013, online Bitcoin wallet service Inputs.io was hacked twice. A total of 4,100 Bitcoins, worth about $1.2 million at the time were stolen via a social engineering attack, gaining access to inputs.io’s systems hosted on Linode, a cloud-hosting provider.
By compromising a series of email accounts, beginning with an email account that the inputs.io founder had set up six years prior to the attack, the hacker managed to gain access to the site’s account on Linode and reset the site’s account password.
Mt. Gox
Mt. Gox, which used to be one of the leading Bitcoin exchange services, has filed for bankruptcy protection, having lost a staggering amount of bitcoins: $468 million worth!
Mt. Gox’s demise began in early February when it, alongside other Bitcoin exchange sites such as BTC-E, froze Bitcoin withdrawals citing heavy Distributed Denial of Service (DoS) attacks aimed at taking advantage of bitcoin’s transaction malleability. Simply put, transaction malleability means that it’s possible for valid transactions to be modified so that the transactions appear to not have gone through, when in reality it was succesful.
However, transaction malleability is not a new issue. Neither is it one that is impossible to solve, as Bitcoin developer Greg Maxwell has pointed out[3].
In fact, other Bitcoin exchanges such as Bitstamp and BTC-E are still operational, having resolved the issues on their side and resumed processing transactions within days after initially freezing transactions. Most damning of all, though, is the aforementioned lost bitcoins and poor security and accounting in Mt Gox, as detailed in a leaked series of slides. There might have been more going on behind the scenes than just issues with transaction malleability.
Silk Road 2.0
In February this year, $2.7 million worth of bitcoins were stolen from Silk Road 2.0‘s escrow account. This heist occured at roughly the same time as the aforementioned DoS attacks on bitcoin exchanges such as Mt. Gox, and exploited the same transaction malleability in the bitcoin protocol.
However, unlike the bitcoin exchanges, which shut themselves down as a precautionary measure, Silk Road 2.0 did not shut itself down and was attacked during a re-launch phase when all bitcoins were stored in hot storage. However, some users, such as those on Reddit’s DarkNetMarkets, believe that the hacking story was a cover-up – and that Silk Road 2.0 was a scam from the start.
The idea is that the new Dread Pirate Roberts set up the site expressly to steal users’ bitcoins, leveraging on the trust present in the Silk Road name. The illicit nature of the goods bought and sold on Silk Road 2.0 would help such an endeavour, since it would make victims think twice about seeking aid from law enforcement.
“Pony” Botnet
Over the course of 5 months (Sept 2013 – Jan 2014), criminals used a botnet known as Pony to infect a large number of computers, stealing up to $220,000 worth of bitcoins and other cryptocurrencies. Pony was the same botnet that was found to have stolen more than two million passwords and stored them on a server owned by the hackers[4].
Pony infected computers and stole bitcoin wallets stored locally on the infected machines., effectively showing the dangers of storing bitcoin wallets on Internet-connected devices.
51% Attack
This isn’t a security breach per se, but it is one of the bitcoin network’s most dangerous weaknesses. When an individual or a group of individuals owns more than 50% of the computing power within the bitcoin network, the network is opened up to the possibility of a 51% attack – the advantage in computing power can be used to fork the main transaction blockchain and commit fraud, including the double spending discussed earlier.
While this may seem far-fetched, the bitcoin network was nearly exposed to such an attack earlier this year. In January, panic spread when Ghash.io, a mining pool, began approaching that 50% limit. The situation was resolved without incident, due to miners leaving Ghash.io for smaller pools, as well as the pool’s own decision to stop accepting new miners[5].
While the reaction shows that the bitcoin network can self-regulate, having to rely on miners and pool owners doing the right thing is problematic, to say the least. The distribution of mining power has become less concentrated, but the possibility remains that a 51% attack can still happen.
See Also on BitcoinWiki
External links
- Bitcoin.org – Security Issue
- How to Keep Your Bitcoin Safe and Secure | WIRED
- Bitcoin Security – CCN
- Bitcoin Security Guide – Bitcoin Security 101
Twitter
Telegram
