Facts about blockchain and cybersecurity

With the development of the Internet, its user base, number of applications, and bandwidth are rapidly increasing. In recent years, smart devices have entered the world of the Internet as a new user carrier. They come in various forms, ranging from simple devices like refrigerators, air conditioners, or microwaves, to sophisticated ones like drones or autonomous vehicles. These smart devices are collectively referred to as Internet of Things (IoT) devices, used to control the functionality of applications and network operations. There are enough cases to prove that attackers are leveraging IoT devices to launch large-scale network attacks known as Distributed Denial of Service (DDoS) attacks. In this chapter, you will learn about DDoS attacks and how blockchain can help enterprises defend against such large-scale network attacks.

DDoS attacks have malicious intent, disrupting legitimate traffic to servers by sending a large number of requests from geographically dispersed systems, hindering normal user access. Now, let's first understand how Denial of Service (DoS) attacks work. During a DoS attack, the attacker bombards the target computer with a large number of requests, causing server resources to be exhausted, which leads to legitimate user requests failing. In a DoS attack, the attacker uses a single machine to exhaust the target server's resources. In contrast, DDoS attacks are more powerful because they can utilize up to millions of computers to overwhelm the target server.

An increasing number of enterprises are migrating their application services to the cloud, which has substantial infrastructure, to meet the real-time demands of their massive customer base. Enterprises can build their own large cloud server infrastructure or migrate to servers provided by cloud service providers. Today, attackers prefer to use DDoS attack methods to disrupt target services because they can generate GB or even TB of random data to bombard the target victim, and the target security teams find it difficult to identify and intercept each attack source, as they may number in the millions.

Moreover, attackers never legitimately control their attacking source machines; instead, they infect millions of computers worldwide with some carefully designed malware, gaining full access and then controlling them to launch large-scale DDoS attacks. This collection of infected computers is called a botnet, while an individual infected computer is referred to as a bot.

While it is difficult to pinpoint the first DDoS attack event in the world, the first notable DDoS attack occurred in 1999, targeting the University of Minnesota. It affected over 220 systems and caused the entire network infrastructure to be down for several days.

On Friday, October 21, 2016, the world witnessed the occurrence of the most sophisticated DDoS attack against Dyn (a managed DNS provider). Dyn confirmed that the Mirai botnet was the primary source of the malicious attack traffic. This attack opened a new focus on Internet security and threat landscapes.

To launch a DDoS attack, hackers can either build an entire botnet themselves or rent botnet resources from the dark web. Once the attackers are ready with their weapons, they only need to discover vulnerable sites, hosts, or entire networks.

A computer scientist from Lockheed-Martin coined the term "cyber kill chain," which outlines the entire stages of a cyber attack from reconnaissance to the final attack on the target. These stages include:

Reconnaissance: The attacker identifies target devices and begins searching for vulnerabilities.
Weaponization: The attacker uses remote toolkits and malware (viruses or worms) to act against the vulnerabilities.
Delivery: The attacker injects attack code into the victim's network through various methods such as phishing emails, secret downloads, USB devices, insider assistance, etc.
Exploitation: Malicious code is used to trigger attacks and take measures to exploit vulnerabilities in the target network.
Installation: Malware is automatically installed on the victim's computer.
Command and Control: The malware gives remote attackers control access to the victim's machine.

To understand each stage from a DDoS perspective, it is crucial to understand the botnet infrastructure and how it is built.

Building a Botnet

The distributed nature of DDoS attacks requires leveraging millions of infected computers worldwide. Today, attackers can rent or purchase readily available botnet resources from the dark web. There are tools like Jumper, Dirt, and Pandore that effectively lower or even eliminate the technical barriers for attackers to build these botnets.

The following diagram describes the entire lifecycle of a botnet:

Reconnaissance

The target systems under reconnaissance can be as large as an entire data center or as small as a single computer. In both cases, building a botnet requires identifying hosts with vulnerabilities that malware can exploit. Attackers look for information directly or indirectly related to their targets to illegally access those protected assets. They will attempt all possible methods to bypass existing security systems, including firewalls, intrusion prevention systems (IPS), web application firewalls, and endpoint protection systems.

Weaponization

By using numerous open-source software resources, attackers can effectively avoid technical barriers encountered during the construction of malicious code. If a programmer has malicious intent and develops code, new malware may be created that security systems initially find difficult to detect.

Here are some commonly used tools for conducting DDoS attacks:

Low Orbit Ion Cannon (LOIC): This is one of the favorite tools used by the hacker group Anonymous. It is a simple flooding tool that can generate large amounts of TCP, UDP, or HTTP traffic to congest the target server. It was originally developed to test server performance throughput. However, the Anonymous group uses this open-source tool to launch complex DDoS attacks. The tool was later enhanced with IRC functionality, allowing users to control connected systems via IRC.
High Orbit Ion Cannon (HOIC): After effectively using LOIC for several years,

Reconnaissance

Weaponization

Here are some commonly used tools for conducting DDoS attacks:

Low Orbit Ion Cannon (LOIC): This is one of the favorite tools used by the hacker group Anonymous. It is a simple flooding tool that can generate large amounts of TCP, UDP, or HTTP traffic to congest the target server. It was originally developed to test server performance throughput. However, the Anonymous group uses this open-source tool to launch complex DDoS attacks. The tool was later enhanced with IRC functionality, allowing users to control connected systems via IRC.

Once downloaded to the newly compromised victim system, the script automatically initiates a new attack process on this new bot node. The entire attack mechanism uses HTTP, FTP, and Remote Procedure Call (RPC) protocols. In this method, the attacker operates the victim's machine, and the compromised system connects to the attacker's central repository, subsequently downloading malicious code from the central repository. As shown in the diagram below:

Reverse Link Propagation: In this method, the attacker ports the toolkit to the newly infected host. This toolkit is carefully designed to accept file transfer requests from infected systems. Meanwhile, the reverse channel file copying process can be completed by a port listener using the Trivial File Transfer Protocol (TFTP). Unlike the central source propagation method, the attacker transmits both the exploit and attack code to the compromised host. As shown in the diagram below.
Automatic Propagation: In this mechanism, when the attacker compromises a system, their toolkit is copied to the infected host. This mechanism differs at the transmission method level, as the attack toolkit is initially implanted by the attacker on the infected host. In this method, the attacker first transmits the exploit attack, followed by their own code, rather than from any central repository. As shown in the diagram below:

Exploitation

Once the malware enters the network, it will initiate exploitation against various vulnerabilities (including unpatched software vulnerabilities, flawed software programming practices, or user negligence). Typically, there are numerous vulnerabilities present in the network, and their exploitability makes the vulnerabilities themselves more lethal.

Installation

In the installation phase, the malware anchors itself in the target system, allowing remote attackers access. During the installation process, the malware can be embedded in the user space or kernel space of the system. Malware installed in user space is easily detectable. However, malware in kernel space is rarely detected by security systems (including endpoint protection, endpoint detection, and response platforms).

Command and Control (C2)

After successfully installing the intrusion tools, the target host is completely controlled by the attacker's remote central system. The network of these compromised devices is called a botnet, which the attacker can manipulate at will. However, the botnet nodes remain dormant until activated by the attacker. There are even some encrypted communications between bot hosts on public peer networks.

Taking Action Against the Target

Once the C2 channel is established, the attacker can launch a DDoS attack against the target. At this stage, the attacker runs scripts to activate all bot hosts in the entire botnet. The attacker also configures the botnet to determine what type of attack traffic needs to be generated.

Blockchain is a decentralized network that allows independent parties to communicate without any third-party involvement. To protect the network from DDoS attacks, enterprise services can be distributed across multiple server nodes, providing high resilience and eliminating single points of failure. The two main advantages of using blockchain are as follows:

Blockchain technology can be used to deploy distributed ledgers to store blacklisted IPs.
Blockchain technology eliminates the risk of single points of failure.

The DDoS defense platform based on blockchain first requires preparing a testing environment using Node.js and Truffle on the Ethereum blockchain. We will use an existing blockchain project to protect the network from DDoS attacks. This project can be found at the link https://github.com/gladiusio/gladius-contracts.

We need to prepare the infrastructure for the Gladius project by following these steps:

First, we will install Node.js in the system environment, with the link https://nodejs.org/uk/download/package-manager/#arch-linux.
We need to install Truffle in the testing environment:
Execute the following command in the command line:
Now execute the following command in the command line to start the test network: