| 区块链资产窃取攻击与防御技术综述 |
| |
| 作者姓名： | 余北缘 任珊瑶 刘建伟 |
| |
| 作者单位： | 北京航空航天大学网络空间安全学院，北京 海淀 100191 |
| |
| 基金项目： | 国家自然科学基金(61972018);国家自然科学基金(61932014) |
| |
| 摘 要： | 自中本聪提出比特币以来，区块链技术得到了跨越式发展，特别是在数字资产转移及电子货币支付方面。以太坊引入智能合约代码，使其具备了同步及保存智能合约程序执行状态，自动执行交易条件并消除对中介机构需求，Web3.0 开发者可利用以太坊提供的通用可编程区块链平台构建更加强大的去中心化应用。公链系统具备的特点，如无须中央节点控制、通过智能合约保障交互数据公开透明、用户数据由用户个人控制等，使得它在区块链技术发展的过程中吸引了更多的用户关注。然而，随着区块链技术的普及和应用，越来越多的用户将自己的数字资产存储在区块链上。由于缺少权威机构的监管及治理，以太坊等公链系统正逐步成为黑客窃取数字资产的媒介。黑客利用区块链实施诈骗及钓鱼攻击，盗取用户所持有的数字资产来获取利益。帮助读者建立区块链资产安全的概念，从源头防范利用区块链实施的资产窃取攻击。通过整理总结黑客利用区块链环境实施的资产窃取攻击方案，抽象并归纳威胁模型的研究方法，有效研究了各类攻击的特征及实施场景。通过深入分析典型攻击方法，比较不同攻击的优缺点，回答了攻击能够成功实施的根本原因。在防御技术方面，针对性结合攻击案例及攻击实施场景介绍了钓鱼检测、代币授权检测、代币锁定、去中心化代币所属权仲裁、智能合约漏洞检测、资产隔离、供应链攻击检测、签名数据合法性检测等防御方案。对于每一类防御方案，给出其实施的基本流程及方案，明确了各防护方案能够在哪类攻击场景下为用户资产安全提供防护。
|
| 关 键 词： | 区块链 钓鱼攻击 诈骗攻击 智能合约安全 |
Overview of blockchain assets theft attacks and defense technology |
| |
| Authors: | Beiyuan YU Shanyao REN Jianwei LIU |
| |
| Affiliation: | School of Cyber Science and Technology, Beihang University, Beijing 100191, China |
| |
| Abstract: | Since Satoshi Nakamoto’s introduction of Bitcoin as a peer-to-peer electronic cash system, blockchain technology has been developing rapidly especially in the fields of digital assets transferring and electronic currency payments.Ethereum introduced smart contract code, giving it the ability to synchronize and preserve the execution status of smart contract programs, automatically execute transaction conditions and eliminate the need for intermediaries.Web3.0 developers can use Ethereum’s general-purpose programmable blockchain platform to build more powerful decentralized applications.Ethereum’s characteristics, such as central-less control, public and transparent interaction data guaranteed by smart contracts, and user-controlled data, have attracted more attentions.With the popularization and application of blockchain technology, more and more users are storing their digital assets on the blockchain.Due to the lack of regulatory and governance authority, public chain systems such as Ethereum are gradually becoming a medium for hackers to steal digital assets.Generally, fraud and phishing attacks are committed using blockchain to steal digital assets held by blockchain users.This article aims to help readers develop the concept of blockchain asset security and prevent asset theft attacks implemented using blockchain at the source.The characteristics and implementation scenarios of various attacks were effectively studied by summarizing the asset theft attack schemes that hackers use in the blockchain environment and abstracting research methods for threat models.Through an in-depth analysis of typical attack methods, the advantages and disadvantages of different attacks were compared, and the fundamental reasons why attackers can successfully implement attacks were analyzed.In terms of defense technology, defense schemes were introduced such as targeted phishing detection, token authorization detection, token locking, decentralized token ownership arbitration, smart contract vulnerability detection, asset isolation, supply chain attack detection, and signature data legitimacy detection, which combine attack cases and implementation scenarios.The primary process and plans for implementation of each type of defense plan were also given.And then it is clear which protective measures can protect user assets in different attack scenarios. |
| |
| Keywords: | blockchain phishing attack fraud attack smart contract security |
|
| 点击此处可从《》浏览原始摘要信息 |
|
点击此处可从《》下载全文 |
|
