C. Smart Dubai Office
Dubai is investing in the Smart Dubai Office (SDO) and
adopts Blockchain technology to transform government from
a service provider to a service enabler at a city-wide scale. It
is funding Blockchain implementation at many levels.
• Government services are implemented with
Blockchain technology
• Empower startups and
businesses to create the
Blockchain industry
• Set up a pioneer example for the government services
built upon the Blockchain technology.
V.
S
ECURITY
R
ISKS AND
A
TTACKS WITH
B
LOCKCHAIN
As Blockchain is decentralized without engaging any third
party and needs to ensure trust in the trustless infrastructure,
security on Blockchain itself is worthy to conduct the
research. This section will focus
on security risk with the
Blockchain technology, and survey on real attacks and bugs
on Blockchain systems.
A. Securiy Risks on Blockchain
Top 10 Web Application Security
Risks listed by the
OWASP Top 10 is analyzed and assessed on Blockchain
technology [58], and its assessment results are summarized in
Table III. The OWASP Top 10 is a widely known document
about top critical security
risks in the web applications, and
Blockchain technology faces 9 out of top 10 risks as shown in
Table III. Thus, the security on Blockchain is one of key
components to the success
of Blockchain business
applications.
One research group surveyed and analyzed the
vulnerabilities on Blockchain systems from 2009 to May
2017, and listed nine categories of Blockchain security risks
at low level in Table IV [29].
T
ABLE
III.
T
OP
10
W
EB
A
PPLICATION
S
ECURITY
R
ISKS ON
B
LOCKCHAIN
T
ECHNOLOGY
[58]
Top 10 Web Application
Security Risks
Assess on Blockchain Technology
Analysis Examples
Injection
Poor input sanitization in Blockchain
technology.
Before the EOS mainnet launches, discovered vulnerability of
buffer-out-of-bounds write in EOS smart contract and potential to
run the malicious
smart contract
Broken Authentication
A large attack surface exists without proper
implementation of authentication
functionality
The cryptocurrency LISK is an example of allowing an attack on
authentication.
Sensitive Data Exposure
High potential to this vulnerability
Vulnerable to data mining efforts - mining the public data on
Blockchain for useful information; Quantum computing will break
the public key cryptography used to encrypt data on the Blockchain.
XML External Entities (XXE)
Not applicable
Broken Access Control
One major vulnerability for smart contracts
Two attacks on Parity multi-signature wallets
due to access control
vulnerabilities
Security Misconfiguration
Affect Blockchain security
Attackers exploited vulnerability to steal cryptocurrency when
Ethereum wallets were configured to receive external commands
from port 8545.
