分类Blockchain下的文章

admin001 发布于 11月18, 2018

条条大路通罗马:实现数字货币双花攻击的多种方法

Zhiniang Peng from Qihoo 360 Core SecurityYuki Chen of Qihoo 360 Vulcan Team[摘要]2008年,中本聪提出了一种完全通过点对点技术实现的电子现金系统(比特币)。该方案的核心价值在于其提出了基于工作量证明的解决方案,使现金系统在点对点环境下运行,并能够防止双花攻击。如今比特币已经诞生十年,无数种数字货币相应诞生,但人们对双花...

阅读全文 »

admin001 发布于 10月12, 2018

Not a fair game, Dice2win公平性分析

Zhiniang Peng from Qihoo 360 Core SecurityDice2win 目前是以太坊上一款异常火爆的区块链博彩游戏。号称“可证明公平的”Dice2win目前每日有近千以太(一百五十万人民币)的下注额,是总交易量仅次于etheroll的第二大以太坊博彩游戏。然而我们分析发现,dice2win中的所有游戏都存在公平性漏洞,庄家可以利用这些漏洞操纵游戏结果。Dice2win...

阅读全文 »

admin001 发布于 09月19, 2018

NEO dBFT共识机制分析与完善

Zhiniang Peng from Qihoo 360 Core Security在NEO采用dBFT机制实现共识节点之间的“拜占庭容错”,并在NEO白皮书中描述恶意共识节点小于1/3的时候,该共识机制能够保证系统的安全性和可用性。我们经过研究发现,目前NEO的dBFT机制仅能保证诚实的共识节点之间达成共识。但共识节点之间不存在分叉,并不意味着全网不会存在分叉。NEO目前对dBFT共识机制的实现...

阅读全文 »

admin001 发布于 08月17, 2018

NEO Smart Contract Platform Runtime_Serialize Calls DoS

Zhiniang Peng from Qihoo 360 Core Security

NEO is a non-profit, community-based blockchain project. It is a distributed network that uses blockchain technology and digital identity for asset digitization. It is also an intelligent management of digital assets using intelligent contracts to create “Smart Economy”. At present, NEO’s market capitalization ranks fifteenth in the world in coinmarket, being one of the remarkable blockchain projects. We found a Denial of Service vulnerability in the NEO smart contract platform which attacker could use to instantly crash the entire neo network.

阅读全文 »

admin001 发布于 08月16, 2018

NEO智能合约平台Runtime_Serialize调用拒绝服务漏洞

Zhiniang Peng from Qihoo 360 Core Security

NEO是一个非盈利的社区化的区块链项目。它是利用区块链技术和数字身份进行资产数字化,利用智能合约对数字资产进行自动化管理,实现“智能经济”的一种分布式网络。目前Neo市值在coinmarket上排名全球第十五,是备受关注的区块链项目之一。我们在neo智能合约平台中发现一处拒绝服务漏洞,攻击者可利用该漏洞在瞬间使得整个neo网络崩溃。

阅读全文 »

admin001 发布于 08月15, 2018

数字加密货币交易软件APT攻击简报

APT-C-26(Lazarus 音译”拉撒路”)是从2009年以来至今一直处于活跃的APT组织,据国外安全公司调查显示,该组织最早的攻击可能和2007年针对韩国政府网站大规模DDOS攻击的“Operation Flame”行动相关,同时可能是2014 年索尼影业遭黑客攻击事件,2016 年孟加拉国银行数据泄露事件和2017年席卷全球的“Wannacry”勒索病毒等著名攻击事件的幕后组织。2017年以来,该组织将攻击目标不断扩大,日趋以经济利益为目的,从针对全球的传统金融机构银行系统进行攻击,开始转向于针对全球加密货币组织和相关机构以及个人进行攻击。

阅读全文 »

admin001 发布于 08月15, 2018

Brief Analysis on APT Attack through Cryptocurrency Trading Software

APT-C-26 is an APT group that has been active since 2009. According to the research by an overseas security vendor, the group’s earliest attack may be associated with the “Operation Flame” which was a large-scale DDOS attack on Korean government’s website in 2007. Lazarus may also be the group behind the hacking incident of Sony Pictures in 2014, the data breach of the Bank of Bangladesh in 2016 and other infamous attacks such as the “Wannacry” ransomware that swept across the globe in 2017. Since 2017, the group has been expanding its targets of attack and increasingly aimed at economic interests. In earlier attacks, the group mainly targeted the banking system of traditional financial institutions. Now, it has begun to attack global cryptocurrency organizations and related individuals.

阅读全文 »