Today IBM announced that it’s X-Force Red security team will provide a new blockchain security testing service.
The service will aim to both pintpoint weakness and enhance security. Penetration testers will explore both the backend processes and the ledger itself including any public key infrastructure. Blockchain is comparatively new and hence offers different attack vectors compared to existing applications.
Blockchain security fears
IBM has to tread a fine line between promoting this new service and drawing attention to concerns over enterprise blockchain security. Hence the following paragraphs are Ledger Insights perspective, not IBM’s.
Some have expressed concerns in the past that because blockchain is network-based, cybercriminals will attempt to identify the weakest link or node in order to alter or steal data.
An off-cited example is the 2016 Bangladesh Bank (BB) SWIFT hack. Despite the perception to the contrary, the SWIFT payments messaging system itself was never hacked. The cybercriminals hacked the BB systems that had access to SWIFT and requested $1 billion of payments to the NY Fed. Only $81 million was sent to a Manila-based Rizal Commercial Banking Corp (RCBC) and was then laundered through casinos based in the Philippines. Just $15 million was recovered.
With blockchain the concern is that a criminal might alter or steal data. In terms of the ledger itself, most data is encrypted with multiple corporate keys. So if one key is compromised it will only enable a hacker to access the data of that company and any transactions in which it’s involved. That’s still a major concern because of loss of confidential data. More seriously it could for example trigger large payments from that company.
Bigger risk areas are smart contracts and the integration points between the ledger and other backend systems. If there’s a bug in the integration software that exposes data and that software is deployed throughout the network, then potentially a hacker could snoop on multiple different nodes. Assuming they can get to the nodes in the first place which will likely be behind firewalls.
A smart contract vulnerability could enable a malicious actor to trigger asset transfers or payments.
White hat versus black hat hackers
The IBM X-Force Red team is made up of white hat hackers who perform the system testing using the same methodologies exploited by criminals or black hat hackers.
The tests will cover identity and access, public key infrastructure, smart contract flaws and software supply chain attacks or dependencies. Most software today is like a lego building incorporating several libraries from third party developers. If a malicious actor compromises a library it can potentially open up a back door into the network.
The four areas outlined above covers a typical blockchain engagement. But there’s still so much more that could be tested, so many projects are likely to be broader.
IBM rightly points out that companies simply can’t afford to rush to go live without proper security testing.
