Swiss Re Ag · SIX:SREN
Swiss Re — Technical Presentation (January 2017)
25 slides from Swiss Re's technical presentation, January 2017
Slide 1: Blockchain and Nefarious Use
Blockchain and Nefarious Use A peek under the surface Mariusz Nowostawski Norwegian University of Science and Technology IDI NTNU SwissRE - January 2017
Slide 2: Introduction
NTNU → University IDI Introduction → Computer Science CCIS → Centre for Cyber and Information Security
Slide 3: NTNU.no
NTNU.no Norwegian University of Science and Technology ● Oldest and largest campus in Norway ● 49k students ● Spread over 4 campuses ● Largest Computer Science department ● Strong research in AI, Peer-to-Peer systems ● Strong programming focus curriculum
Slide 4: CCIS.no
CCIS.no Centre for Cyber and Information Security → Consortium of 26 academic and industrial partners Focus on: ● Security research ● Cyber defence ● Forensics (Testimon group) ● Critical infrastructure ● Malware and Dark Web
Slide 5: The Team
The Team I am part of Testimon Group Prof. Katrin Franke Prof. Slobodan Petrovic Assoc. Prof. Stefan Axelsson PhD: Dmytro Pyatkovsky MSc: multiple students
Slide 6: About me
About me ● Computer Scientist ● Coder ● Lecturer ● Entrepreneur Research Interests ● P2P systems, Mobile systems, Web technologies ● Decentralized Systems ● Autonomous Systems
Slide 7: Blockchain
Technology Enthusiasts Libertarians Blockchain Speculators/Investors Commercial Companies People Criminals → big and small
Slide 8: Nefarious Use
DarkWeb marketplaces Anonymous currencies Nefarious Use Malware Of Blockchain Technology Ransomware Other uses
Slide 9: Darkweb Marketplaces
Darkweb Marketplaces Market size: 300M USD/annum (2016), estimated 1B USD (2017) ● Drugs ● Fake IDs ● Counterfeit currency ● Compromised data, eg. payment cards, online account credentials ● Malware and Ransomware kits ● Weapons, real and cyber ● Explosives ● Chemical substances ● Guides for crimina
Slide 10: Darkweb Marketplaces
Darkweb Marketplaces It looks as of scammers are using it to collect premiums from naive users: ● Terrorists funding sites ● Murder orders, Murder for hire offers ● Terrorist attack orders There is some evidence suggesting that those darkweb sites are mostly fake.
Slide 11: Darkweb Marketplaces
Darkweb Marketplaces ● Need for anonymous, digital payment system Emergence of: ● Bitcoin natively is not anonymous ● ● Deanonymization industry ● Mixing services, ring signatures, and so on Note ○ Fake mixing services ○ Fake vanity address generators ● The need for anonymity and privacy strongly ○
Slide 12: Child Abuse
Static content offering Child Abuse Subscriptions [mostly not disclosed] Crowdfunding campaigns
Slide 13: Ransomware
2016 Ransomware The year of Frictionless payment system Ransomware enables innovative use cases
Slide 14: Ransomware
Ransomware Facts: RaaS ● Market size: estimated to reach 1B USD in Ransomware as a Service 2017 ● Often offered for free ● Almost all ransomware payment requests in ● Profits split between the software vendor Bitcoins (which is actually a good thing!) and the attacker ● Targets anything: ● 40% of SP
Slide 15: Extortion
Extortion ● AdultFriendFinder data leak, leads to massive number of extortion cases ○ Over 3.5 mln e-mail addresses and contact details leaked ● Scams, fake threats ● DDoS attack threats ● Kidnapping threats, and real kidnapping ● Hijacking threats, and real hijacking Note The picture from movies of
Slide 16: Malware
Malware The rise of Malware Huge growth for both, virtuous and nefarious purposes ● Best, and often the only way, to circumvent encryption and end-to-end security ● Wallet stealing trojans ● Clipboard malware (replaces real bank account, account hash, with attacker address) ● Mining botnets (for non
Slide 17: Other attack vectors
Other attack vectors ● Surge in attacks targeting crypto currencies companies and projects ● Many exchange failures: ○ Cryptsy, Shapeshift, Gatecoin, Bitfinex, Bitcurex, TheDAO ● The hype drives surge in scams, eg. high-yield investment programs ● Clever social engineering tricks for Bitcoin and vir
Slide 18: Upside
Is Ransomware a good thing? Upside What good does nefarious use do for Blockchain technology?
Slide 19: Upside
Upside Ransomware is a good thing, because: ● It will surge, and subsequently, it must die out! ● It leads to stronger and improved security ● Increases the awareness, and better protections being used Blockchain technology abuse leads to: ● Hardened systems, protocols, and improvement to the core t
Slide 20: Interesting recent developments
Interesting recent developments ZK-SNARKs and ZCash → huge improvement in efficiency: ● Validation: 40ms ● Tx creation: 90-160 seconds Signature aggregation BLS signatures IBE, Identity Based Encryption Secure multi-party computing
Slide 21: Some of our projects
Some of our projects ● Simulation and modelling of human and technical factors ● Autonomous, anonymous and decentralized institutions ● Scalability, off-chain transactions, Lightning Network attacks ● Fog of War: how to play strategy games without a trusted 3rd party
Slide 22: Conclusions
Conclusions Good vs. Evil
Slide 23: Conclusions
Conclusions ● Nefarious use will continue ● Systems will evolve and improve, because of it, and in spite of it ● All implications of new technical advancements need to be taken in socio-technical context Security, Anonymity and Autonomy ● Those areas will achieve a lot of attention, and will subsequ
Slide 24: Thank you
Thank you Assoc. Prof. Mariusz Nowostawski Twitter: @praeteritio NTNU, Norway Skype: nowostawski http://ccis.no http://ntnu.no/ansatte/mariuszn
Slide 25: Basic Copyright Notice & Disclaimer
Basic Copyright Notice & Disclaimer ©2017 This presentation is copyright protected. All rights reserved. You may download or print out a hard copy for your private or internal use. You are not permitted to create any modifications or derivatives of this presentation without the prior written permiss