Security in blockchain

Blockchain is very promising technology but it’s not the be all and end all of security.

In a blockchain system you have a “distributed ledger” - this is a record of all the work done - each transaction done in the system. Transactions might be things like asset transfers, purchases, licenses or even just a request to turn a switch on or off. Each block records a transaction. It’s cryptographically signed, so you can see that it hasn’t been tampered with. Each block also points to the previous block in the ledger - this is where the “chain” comes in. So you can easily and securely trace a set of transactions.

This ledger is “distributed” in that everyone participating in the chain should have a copy of it, and should keep their copy synchronized with everyone else’s.

This sounds great - it’s way more secure than just keeping a spreadsheet of transactions which anyone can modify without you knowing. No one can falsify transactions and everyone can inspect them.

Keep in mind that there is no perfect security. There are a few avenues of attack on a blockchain.

First, a blockchain implementation will only be as secure as the software it’s built upon. If it uses encryption software with vulnerabilities, then it will inherit those vulnerabilities. If the encryption algorithms it uses become breakable with time then it will be possible to break the blockchain. We’ve seen both of these things happen over the decades in which encryption has been commonly in use.

Second, the blockchain implementation will be running on a computer or device which may have vulnerabilities. Perhaps you need to enter a passphrase or key in order to access your blocks on the chain (if the blockchain implements cryptocurrency then this might be accessing your wallet). Drop a key logger on the system and no matter how secure the blockchain implementation is, your blocks are now accessible to whoever reads what the key logger grabbed. To be very clear - this won’t magically let you manipulate other people’s blocks - but it will expose your own data. The recent CPU bugs SPECTRE and MELTDOWN might also allow an attacker to access your data.

Blockchain is a huge buzzword right now, but it’s important to remember that it’s a piece of a system that includes operating systems, networks, user interfaces, human beings, physical world transactions. There are many points of potential vulnerability outside the blockchain itself. And it’s relatively new technology - as it becomes more widespread I expect to see creative new attacks against it.