Measures to prevent bitcoin security risks

One of the characteristics of blockchain projects (especially public chains) is open source. Through open source code, to improve the credibility of the project, so that more people can participate. But the open source code also makes it easier for attackers to attack blockchain system. In the past two years, there have been a number of hacker attacks. Recently, the anonymous currency verge (xvg) was attacked again. The attacker locked a vulnerability in the xvg code, which allowed malicious miners to add false timestamps on the block, and then quickly dig out new blocks. In a few hours, the attacker obtained nearly $1.75 million worth of digital currency. Although the subsequent attack was successfully stopped, no one can guarantee whether the attacker will attack again in the future

of course, blockchain developers can also take some measures

one is to use professional code audit services,

the other is to understand the security coding specifications and take preventive measures

the security of cryptographic algorithm

with the development of quantum computer, it will bring a major security threat to the current cryptosystem. Blockchain mainly relies on elliptic curve public key encryption algorithm to generate digital signature for secure transactions. Currently, the most commonly used ECDSA, RSA, DSA, etc. can not withstand quantum attacks in theory, and there will be greater risks. More and more researchers begin to pay attention to cryptographic algorithms that can resist quantum attacks

of course, in addition to changing the algorithm, there is another way to improve the security:

refer to bitcoin's treatment of public key address to rece the potential risk of public key disclosure. As users, especially bitcoin users, the balance after each transaction is stored in a new address to ensure that the public key of the address where bitcoin funds are stored is not leaked

security of consensus mechanism

the current consensus mechanisms include proof of work (POW), proof of stake (POS), delegated proof of stake (dpos), practical Byzantine fault tolerance (pbft), etc

POW faces 51% attack. Because POW depends on computing power, when the attacker has the advantage of computing power, the probability of finding a new block will be greater than that of other nodes. At this time, the attacker has the ability to cancel the existing transaction. It should be noted that even in this case, the attacker can only modify his own transaction, but not the transaction of other users (the attacker does not have the private key of other users)

in POS, attackers can attack successfully only when they hold more than 51% token, which is more difficult than 51% computing power in pow

in pbft, when the malicious nodes are less than 1 / 3 of the total nodes, the system is secure. Generally speaking, any consensus mechanism has its own conditions. As an attacker, we also need to consider that once the attack is successful, the value of the system will return to zero. At this time, the attacker does not get any other valuable return except destruction

for the designers of blockchain projects, they should understand the advantages and disadvantages of each consensus mechanism, so as to select an appropriate consensus mechanism or design a new consensus mechanism according to the needs of the scene

security of smart contract

smart contract has the advantages of low operation cost and low risk of human intervention, but if there are problems in the design of smart contract, it may bring greater losses. In June 2016, the Dao, the most popular funding project of Ethereum, was attacked. The hacker obtained more than 3.5 million Ethereum coins, which later led to the bifurcation of Ethereum into Eth and etc

there are two aspects of the proposed measures:

one is to audit the security of smart contract, and the other is to follow the principle of smart contract security development

the security development principles of smart contract are: to be prepared for possible errors, to ensure that the code can correctly handle the bugs and vulnerabilities; Release smart contracts carefully, do well in function test and security test, and fully consider the boundary; Keep smart contracts simple; Pay attention to the threat intelligence of blockchain and check and update in time; Be clear about the characteristics of blockchain, such as calling external contracts carefully

security of digital wallet

there are three main security risks in digital wallet: first, design defects. At the end of 2014, a user lost hundreds of digital assets e to a serious random number problem (repeated r value). Second, the digital wallet contains malicious code. Third, the loss of assets caused by the loss or damage of computers and mobile phones

there are four main countermeasures:

one is to ensure the randomness of the private key

Security of bitcoin wallet

to prevent private key leakage

and keystores can be stored online, such as cloud disk, or in their own U disk (hardware wallet takes advantage of this), which is relatively safer than online storage. Even if hackers steal your keystores, they can't steal the assets without the password of the keystores, so the password of the keystores is particularly important at this time

the main loss prevention strategy is multiple backup, multiple backup. For example, when backing up a wallet, not only the keystore, but also the mnemonic words and private key should be backed up. This is a multiple backup

At present, the wanna series of blackmail viruses have been controlled to a certain extent, but the virus is constantly fighting against the upgrade. The effective prevention of this wanna blackmail virus can be avoided through the following actions

one is to temporarily close the port. Windows users can use firewall to filter personal computers, and temporarily turn off 3389 remote login on ports 135, 137 and 445 (if they don't want to turn off 3389 remote login, at least turn off the smart card login function), and pay attention to update security procts for defense, so as to minimize the risk of computer attack

The second is to update the released security patches of windows in time. When the ms17-010 vulnerability was first exposed in March, Microsoft had provided security updates for win7, win10 and other systems; After the outbreak of this incident, Microsoft also quickly released a special patch for Windows XP and other systems that had not provided official support before

The third is to use "blackmail virus immune tool" to repair. Users download the offline version of Tencent computer manager "blackmail virus immunity tool" through other computers, and the files to a safe and non-toxic U disk; Then turn on the designated computer when WiFi is turned off, the network cable is unplugged and the network is disconnected, and back up important files as soon as possible; Then use the offline version of "blackmail virus immunity tool" to fix the vulnerability with one click through USB flash disk; Network can be normal use of the computer

Fourthly, using the "file recovery tool" to recover. Users who have been infected with the virus can use the computer manager - file recovery tool for file recovery, with a certain probability of recovering your documents

in addition, enterprise network administrators can use the "Administrator Assistant" to detect the security of computer equipment. Tencent's anti-virus laboratory security team, after tackling key technical problems, launched a computer housekeeper "Administrator Assistant" diagnostic tool for vulnerable enterprise customers on the evening of the 14th. The enterprise network administrator only needs to download the diagnostic tool and input the IP or device name of the target computer to diagnose whether the target computer is infected with blackmail virus; Under the guidance of the diagnosis report, the health equipment that has not been patched can be patched and defense can be arranged in time

note: in the near future, Windows users should try to avoid visiting high-risk web pages. At the same time, if they are unfortunately poisoned, they should not pay ransom. They can contact the security manufacturer to help recover valuable data, or they can completely eliminate the virus by formatting the hard disk

The contract transaction of digital currency is not safe. There are still many loopholes in the digital currency trading platform, for example, the most common ones are as follows:

1. Denial of service attack

denial of service attack is the most important attack against the digital currency trading platform at present. Through the denial of service attack, the attacker makes the trading platform unable to access normally, while the user cannot accurately distinguish the attack degree, It often leads to panic asset transfer, which brings some loss