DDoS in Blockchain
DoS attacks are designed to exploit the vulnerabilities in the system. For example, by sending more traffic than the network card can handle or overwhelming an application with more requests than it can process. With respect to computer networks or during an ethical hacking activity, a denial of service could in the form of:
- Overloading the ports with requests
- Web servers hijacking
- Denying any sort of authentication
- Denying any sort of service that is available on the internet
The following topics of DDoS in blockchain will be discussed here:
- What is DDoS in Blockchain?
- Performing DDoS Attacks
- Blockchain DDoS Attacks in Real World
- Impact of Blockchain DDoS Attack
- Protecting Against Blockchain DDoS Attack
Let’s start discussing each of these topics in detail.
What is DDoS in Blockchain?
The blockchain network because of its distributed nature, has protection to ensure that transactions can continue even after some nodes go offline for a while. Any node can go down because of a DDoS attack or any other event without taking over the network as a whole. However, this does not indicate that blockchain networks are completely resistant to DDoS attacks.
Not all blockchain networks are equal, and for any particular blockchain network, its robustness highly depends upon the number of nodes, diversity, and hash rate. It is not possible to mention each and every technique through which a blockchain network can be targeted for a DDoS attack.
Performing DDoS Attacks
There are two ways to perform DDoS attacks:
1. DDoS attacks via transaction flooding
- One of the major DDoS attacks in Blockchain is transaction flooding. With spam and false transactions flooding in blockchain, an attacker can compromise the availability for permitted (original) users and undesirable have other impacts on the network.
- Blockchains do have a predefined fixed capacity. This is because they create new blocks at regular intervals with also certain max size. Any transaction which is not added in the current block will be stored in Mempool for later to be added in the next block.
- If any malicious attacker sends multiple transactions to the blockchain network, he can fill the complete block with false or spam transactions causing permitted transactions to stay in Mempool for a long time. Hence if the legitimate transactions will not be included in blocks, they will not be added to the ledger resulting that Blockchain will be unable to perform its job.
2. DDoS attacks via smart contract
An attacker can also target a DDoS attack on a smart contract in multiple possible ways that include:
- If an attacker sends a computationally intensive transaction to a smart contract that actually prevents other transactions from being included in the current block.
- Another attack is to create a parasitic contract that drains all the gas automatically, rendering the service unusable for other participants. For example, if “address.call.value” (and not send() in Solidity) is used to send funds to another contract/address, then maliciously all gas can be drained.
- For example, let’s say one wants to send dividends to participants. The 3rd person down the line, put in this attack, draining all the gas, thus not allowing any other people to receive any dividends.
A malicious vulnerability In the NEO blockchain allowed attackers to invoke the contract that created a Denial-of-Service attack by crashing every node that was trying to execute that contract.
Blockchain DDoS Attacks in Real World
- On the 14th of September 2021, the Solana blockchain was down for some hours. The actual reason for this downfall was a DDoS attack with 400,000 TPS. That results in the Solana network agreeing to perform a rolling back of the network where almost 80 percent of validators were agree on that state of the network.
- On the 14th of September 2021, Arbitrum also experienced a DDoS attack. Here the Sequencer was overloaded with transactions, hence Arbitrum was also down for approximately 45 mins.
Impact of Blockchain DDoS Attack
The DDoS attacks can damage brand reputation and revenue. Given that IT services downtime costs companies anywhere from $300,000 to over $1,000,000 per hour, one can imagine the financial hit from DDoS attacks. Along with blockchain, the introduction of 5G technology has also accelerated the spread of the Internet of Things (IoT) around the world. Hence, creating a huge pool of “under-protected” new recruits for botnet armies used to launch DDoS attacks on massive scales. There are a variety of other impacts of DDoS attacks on blockchain:
- Node crashes: Each node on the blockchain has software running for processing the transactions received on the network. This means that the nodes must have all the resources to support the needs of the software running and if the node runs out of memory or CPU, it may crash or fail to bring it to the offline state until a restart is performed.
- Software failure: The blockchain node has software running to process the transactions. The software has a limit to the number of transactions it can store in the memory pool, thus causing issues if the transaction floods exceed those limits.
- Network congestion: In a blockchain network, each node that receives transactions sends a copy of it to its neighbor, thus each node receives multiple copies of the same transaction. In a transaction flooding attack large transaction volumes are already created, and the peer-to-peer network amplifies it, thus resulting in a consumption of more network bandwidth.
- Bloated ledger: Transaction flooding DDoS attack has a permanent impact on the blockchain network in the form of the ledger being overloaded with span transactions as each node stores a copy of all the transactions to look for double-spending.
Protecting against Blockchain DDoS attack
DDoS attacks are considered a “weapon of mass destruction” on the Internet. DDoS attacks are more difficult to defend against, and currently, there are no precautions that any single organization can apply to be secure 100 percent. Here are some of the techniques that can be used in blockchain technology;
- The primary way to protect against blockchain DDoS is to ensure that all the nodes have enough processing power, sufficient storage, and network bandwidth.
- Add failsafe into the code of the smart contract.
The rule of thumb is, that the more decentralized a blockchain network is, the more secure it will be against a DDOS attack. However, it is still a big debate that currently most of the blockchains are fully decentralized or not.
This was all about learning and the impact of DoS/DDoS attacks. We have also covered DoS/DDoS attacks in Web3 Blockchain technology. DDoS attacks can impact the availability of any network that lives on the internet. When availability compromises then the users face difficulties in completing their tasks that also make a heavy loss for IT organizations in Web 2 as well as Web 3.
Please Login to comment...