Colleagues, crypto time
warp attacks occur when miners collude to report incorrect timestamps that are farther
apart, messing with the rate at which blocks can be mined. Incorrect timestamps
are do occur and can be innocuous. Chain Analysis reports that timestamp errors have steadily
decline since 2018. However, specific manipulation by miners who bends the
rules with the goal of creating illegitimate tokens is cybercrime … pure and
simple. Bitcoin (along with Litecoin) are most susceptible to time warp
attacks. However, some argue that the same Blockchain bug which allows these
attacks have favorable unintended positive side effects … faster transaction speeds and attraction of
more users. By contrast, if the
difficulty of creating a new block is low, a cyber-criminal can mine many fast
coins, or in the case of a small chain, a criminal with 51% hash power could reduce the difficulty to one and mine a new fork from the original block.
The debate continues within the Bitcoin developer community. While consensus
will be hard to reach, the community needs to reach at least a majority vote or
risk a division, which split BTC into Bitcoin and Bitcoin Cash in 2017. Post a comment while visiting us today! Lawrence – Cyber
Security Defender (https://cybersecuritydefender.blogspot.com/)
Colleagues, the threat of 51% attacks loom
large in the global cryptosphere. However, findings suggest that the potential
for a 51% mining attack has an inverse correlation to the market cap of a given
cryptocurrency. Attacks by a group
of miners controlling more than 50% of
the network's mining hashrate or computing
power of the currency’s Blockchain. Two factors drive the propensity of a
cryptocurrency 51% attack. First, cryptos with smaller market caps typically
have fewer active miners. It is easier to gain control over 1000 miners of ZCoin, which ranks 100th
in market cap by CoinMarketCap at some $60m USD #1 ranked Bitcoin valued at roughly
$114t USD with perhaps 1,000,000 active miners worldwide. Second, the
availability of relatively low-cost mining pools enable cyber criminals the opportunity to “rent”
GPU power from multiple
pools simultaneously while subtly approaching the 51%+ threshold for
controlling hashrates. Pre-emptive measures include making code changes at the Blockchain protocol level, boycotting likely attackers, increasing the
number of confirmation requirements and unleashing a DDoS attacks on suspected hackers. Bottom line: There is no
fail-safe strategy become a victim of a 51% Attack, however, investing in Tier
1 cryptocurrencies (e.g. the CoinMarketCap’s top 10 cryptos) provides optimal security
and peace of mind. Post a comment while visiting us today! Lawrence – Cyber
Security Defender (https://cybersecuritydefender.blogspot.com/)
Colleagues, the US Fed’s Jim Cunha, Vice
President for Treasury and Financial Services, offered up a prediction that the
US government could adopt a Blockchain-based cryptocurrency within the next
five years. We have previously stated such a move could take place within three
years. Perhaps the reality of US Fed-backed cryptocurrency lies somewhere in
between. Cunha’s remarks at a recent conference in Boston (akin to an East
Coast version of South by Southwest) reveal some insight to the US Fed’s
thinking. The major reservation shared by Fed officials is security of a
central bank crypto and its underlying Blockchain. By contrast, the 30-year Fed
veteran recognizes that millennials in aggregate have concerns about the
old-school financial establishment – presumably government and private sectors
alike – which makes them much more open to a national cryptocurrency than their
gray haired “over 50” financial leaders of our current era. Share a comment while visiting us today! Lawrence – Cyber
Security Defender (https://cybersecuritydefender.blogspot.com/)
Colleagues, by now it should come as no
surprise that the US government has filed charges in absentia against seven
Russian nationals suspected of engineering a disinformation effort to influence
(read the
indictment). The defendants are alleged employees of
Russia’s infamous GRU Main
Intelligence Directorate. In addition, it is no surprise that the
defendants purportedly used Bitcoin and
other un-named cryptocurrencies to fund
their illicit tactics. Bottom line: The goal of this campaign was to influence
and undermine the credibility of US-based sports “anti-doping” entities
including the US
Anti-Doping Agency (USADA), which claims Russian illegally,
allows doping among its athletes to boost their performance and stature.
Cryptocurrencies, chief among them being Bitcoin, were the means used to fund
these illegal actions. Why use cryptocurrencies? Two reasons emerge. First, the
defendants are believed to have “mined” their own digital assets (akin to
printing their own money). Second, the lack of transparency when acquiring
computers and related infrastructure to implement their disinformation efforts
to move public opinion in their favor. Share a comment while visiting us today! Lawrence – Cyber
Security Defender (https://cybersecuritydefender.blogspot.com/)
Colleagues, a recent bug in Bitcoin’s
public code has led to the illicit printing of some 235
million Pigeoncoins.
Although Bitcoin has released a software
patch which altcoins, exchanges and mining pools can
install to mitigate this bug, the specter of crypto double-spend cyber-attacks
looms large. Double spending is a
problem unique to digital currencies because digital information can be
reproduced with relative ease. Bitcoin transactions take some time to verify
because the process involves intensive computational power and complex algorithms,
which can be measured in seconds or milliseconds. Two fundamental questions
emerge. First, just how many exchanges, pools and altcoins use BTC’s public
code? Given the size, complexity and global diversity of the crypto ecosystem this question is almost impossible to answer.
Second, how many of these crypto entities will expeditiously implement the
software patch before cyber criminals can perform double-spend transactions?
Sadly, this question is equally difficult to answer. When in doubt we once
again offer our baseline guidance: Stay with established (aka Tier 1) currencies,
exchanges and pools that typically have more comprehensive security measures in
place. Share a comment while visiting us today! Lawrence – Cyber
Security Defender (https://cybersecuritydefender.blogspot.com/)
Colleagues, as we have previously reported
cyber security attacks, specifically cryptojacking via
Internet browsers, has risen some 400% YoY from 2017 through H1 2018. Google
Chrome commands almost 67% market share according to data from Statista. Earlier
this year Google banned cryptocurrency-related ads from AdWords and
placed major restrictions on apps and extensions on Google
Play and the Chrome
Web Store. Therefore, it comes as welcomed news for
individual and corporate Chrome users that Google has taken the next step of
adding more stringent rules for developers of Chrome extensions. Chrome,
Firefox and Safari have been the primary targets of cyber criminals seeking to
perform crypto mining by way of installing malicious code (aka illegal extensions)
to mobile and desktop browsers alike. The Chrome Web Store’s Developer
Program Policies clearly states “Do not create an extension
that requires users to accept bundles of unrelated functionality”. Nevertheless, written policies are no better than
the vendor’s enforcement practices and penalties. We will report back in Q1
2019 on the initial impact these stricter policies have on mitigating the
cryptojacking tsunami impacting Chrome users … and hopefully stemming the tide
of illicit crypto mining. Share a comment while visiting us today! Lawrence Wilson – Cyber
Security Defender (https://cybersecuritydefender.blogspot.com/)
Colleagues, the fraudulent representation or
claim of a “security” or “commodity” in the US can be tired as a federal or a
state level crime. Nevertheless, fraud is fraud. So ruled a district
judge regarding the cryptocurrency My Big
Coin Pay scam. Co-defendants Mark Gillespie and Randall Crater are alleged to have use investments –
categorized as commodities - in My Big Coin Pay for personal use and gain.
Sovereign nations, their governments and court systems around the world are
struggling to regulate digital assets. One of the foremost dilemmas is whether
cryptocurrencies are securities or commodities. To outsiders the distinction
may appear meaningless, however, to government regulators and the exchanges
upon which these assets are traded the difference in critical. In the US, the
issue will ultimately depend upon the decisions of the judicial system along
with the US SEC and the Commodities Futures Trading Commission (CFTC). Although the issue of My Big Coin Pay
may be decided for now, the much larger issue will likely not be resolved at
the federal level for another 2-3 years. Share a comment while visiting us today! Lawrence – Cyber
Security Defender (https://cybersecuritydefender.blogspot.com/)
Colleagues, the promise of a 13-fold
appreciation in one month lies at the core of the US SEC’s lawsuit against PlexCoin
co-founders Sabrina Paradis-Royer
and Dominic Lacroix. The defendants are charged with an illicit PlexCoin ICO scheme. Although fraudulent ICOs are not a daily occurrence,
they are far too common. Moreover, they represent one more reason why the US SEC – and its
counterparts abroad – are reluctant to classify cryptocurrencies as legitimate
“securities” tradeable on leading stock exchanges. That is why even the most
prominent digital assets including Bitcoin, Ethereum, Ripple and the like are
confined to crypto only exchanges like BitFinex, Binance and Huobi. Bottom line: We predict that within 24-36
months the US SEC will define and implement a strict framework for regulating
cryptocurrencies and allowing only those assets, which meet the most stringent
requirements bona fide “securities” status. As we continuously stress crypto
investors must perform their due diligence and are urged to stay with proven
currencies traded on legitimate exchanges. Post a comment today! Lawrence – Cryptocurrency
Academy (https://cryptocurrencyacademy.blogspot.com/)
Colleagues, Zaif is a
small cryptocurrency exchange based in Japan. Although Zaif on ranks as the 45th
largest exchange based upon daily trading volume by CoinMarketCap, a
crypto theft worth $60m USD is
reason for concern. The exchange processed some $43B per day in
cryptocurrencies. The Japanese Financial Services Authority (FSA) is investing this cybercrime and
questioning why Tech Bureau – Zaif’s parent company – waited several days
to report this incident. Bottom line: Whether this was an “inside job” by a
disgruntled Tech Bureau employee or an external cyber-attack is unknown at this
time. What we do know is two-fold. First, Japan is an early adopter and
supporter of cryptocurrencies. Second, there has been a meteoric rise in the
number and value of cybercrimes specifically targeting crypto exchanges during
the past two years. Where possible, we highly recommend that crypto traders and
investors alike perform their due diligence and stay with top tier exchanges
such as BitForex, BitMEX, Binance, OKex and Huobi. Post a comment while visiting us today! Lawrence – Cyber
Security Defender (https://cybersecuritydefender.blogspot.com/)
