IDG Contributor Network: Why blockchain may be blockchain’s best cybersecurity option

One of the hallmark features of blockchain is that it is supposedly much more secure, adding remarkable levels of transparency that could help better identify and mitigate cyber threats. But, at a time when we’re approaching 2,000 blockchain projects in development worldwide, watching thousands of crypto miners do their thing each day and seeing billions of investment dollars pouring in each year, are we taking warnings about potential threats seriously? Has the greater community taken some aspects of blockchain’s security for granted? The hard truths reveal affirmatives to both questions.

There are multiple ways that enthusiasts can contribute to their favorite blockchain projects – whether that’s mining, staking or operating all types of nodes. Regardless of what they’re doing, these private deployments require an investment of time, money and effort to set up, so the last thing anyone wants is to fall victim to hackers. Unfortunately, people often don’t invest as much energy in securing their deployments as they do in getting their different features to work and scale, making the hacker threat very real.

Various attacks have already been seen on mining software, and there have been multiple high-profile thefts that were worth a lot of money. Tokens in staking wallets make very attractive targets. Malicious actors have successfully infected enterprise infrastructures with sneaky mining malware, called cryptojacking; and in 2016, Hong Kong-based exchange platform Bitfinex was hacked, resulting in more than $60 million (at the time) of crypto losses. The fact is that a victim may not even realize they’ve been hacked until it’s too late. Savvy hackers are careful to cover their tracks and siphon only a portion of tokens at a time.

Another emerging security challenge in the crypto community is the potential exposure of  sensitive metadata through common actions like checking balances, initiating transactions or just receiving block updates. This was recently called out by Ethereum Core Developer Peter Szilagyi. While metadata may seem harmless, it can lead to exposing the physical location of a blockchain deployment, which is something most would prefer to avoid. Why is it important to call out some of these threats?

The difficulty of securing blockchain projects with traditional security applications

Addressing these and other threats today can lead you down a rabbit hole. Some of the chatter on BitcoinTalk forums reveals useful advice – often learned the hard way – about using virtual private networks (VPNs) and firewalls to secure deployments. However, these discussions are often light on more specific details, especially on adequately configuring protective applications. As you dig deeper, you can get lost in threads upon threads detailing which ports need to be opened for each blockchain and which should be locked down. That’s all to say that solutions like traditional VPNs and firewalls to protect blockchain networks are possible solutions, but it’s difficult, messy and sometimes fragile. And it’s not just necessarily fragile in the sense of penetrable, but even more so in that one misstep or misconfiguration could open the door to vulnerabilities. What you’re left with is a security fig leaf: a false sense of safety actually covering for a gaping hole.

Then there is the centralized nature of network traffic management itself, as it is largely managed by a few centralized internet service providers (ISPs), which are vulnerable to threats like routing attacks. In fact, research previously suggested that just 13 ISPs host 30 percent of the Bitcoin network, while just three ISPs route 60 percent of the transaction traffic.