Network adversaries, such as malicious transit autonomous systems (ASes), have been shown to be capable of partitioning the Bitcoin's peer-to-peer network via routing-level attacks; e.g., a network adversary exploits a BGP vulnerability and performs a prefix hijacking attack (viz. Apostolaki et al. [3]). Due to the nature of BGP operation, such a hijacking is globally observable and thus enables immediate detection of the attack and the identification of the perpetrator. In this paper, we present a stealthier attack, which we call the EREBUS attack, that partitions the Bitcoin network without any routing manipulations, which makes the attack undetectable to control-plane and even to data-plane detectors. The novel aspect of EREBUS is that it makes the adversary AS a natural man-in-the-middle network of all the peer connections of one or more targeted Bitcoin nodes by patiently influencing the targeted nodes' peering decision. We show that affecting the peering decision of a Bitcoin node, which is believed to be infeasible after a series of bug patches against the earlier Eclipse attack [29], is possible for the network adversary that can use abundant network address resources (e.g., spoofing millions of IP addresses in many other ASes) reliably for an extended period of time at a negligible cost. The EREBUS attack is readily available for large ASes, such as Tier-1 and large Tier-2 ASes, against the vast majority of 10K public Bitcoin nodes with only about 520 bit/s of attack traffic rate per targeted Bitcoin node and a modest (e.g., 5-6 weeks) attack execution period. The EREBUS attack can be mounted by nationstate adversaries who would be willing to execute sophisticated attack strategies patiently to compromise cryptocurrencies (e.g., control the consensus, take down a cryptocurrency, censor transactions). As the attack exploits the topological advantage of being a network adversary but not the specific vulnerabilities of Bitcoin core, no quick patches seem to be available. We discuss that some naive solutions (e.g., whitelisting, rate-limiting) are ineffective and third-party proxy solutions may worsen the Bitcoin's centralization problem. We provide some suggested modifications to the Bitcoin core and show that they effectively make the EREBUS attack significantly harder; yet, their nontrivial changes to the Bitcoin's network operation (e.g., peering dynamics, propagation delays) should be examined thoroughly before their wide deployment.

No abstract

Trust and reputation play a core role in underground cybercrime markets, where participants are anonymous and there is little legal recourse for dispute arbitration. These underground markets exist in tension between two opposing forces: the drive to hide incriminating information, and the trust and stability benefits that greater openness yields. Revealing information about transactions to mitigate scams also provides valuable data about the market. We analyse the first dataset, of which we are aware, about the transactions created and completed on a well-known and high-traffic underground marketplace, Hack Forums, along with the associated threads and posts made by its users over two recent years, from June 2018 to June 2020. We use statistical modelling approaches to analyse the economic and social characteristics of the market over three eras, especially its performance as an infrastructure for trust. In the Setup era, we observe the growth of users making only one transaction, as well as 'power-users' who make many transactions. In the Stable era, we observe a wide range of activities (including large-scale transfers of intermediate currencies such as Amazon Giftcards) which declines slowly from an initial peak. Finally, we analyse the effects of the Covid-19 pandemic, concluding that while we see a significant increase in transactions across all categories, this reflects a stimulus of the market, rather than a transformation. New users overcome the 'cold start' problem by engaging in low-level currency exchanges to prove their trustworthiness. We observe currency exchange accounts for most contracts, and Bitcoin and PayPal are the preferred payment methods by trading values and number of contracts involved. The market is becoming more centralised over time around influential users and threads, with significant changes observed during the Setup and Covid-19 eras. CCS CONCEPTS • Social and professional topics → Computer crime; • Mathematics of computing → Time series analysis; • Security and privacy → Social aspects of security and privacy.

No abstract

Online extremism is a growing and pernicious problem, and increasingly linked to real-world violence. We introduce a new resource to help research and understand it: ExtremeBB is a structured textual dataset containing nearly 44M posts made by more than 300K registered members on 12 different online extremist forums, enabling both qualitative and quantitative large-scale analyses of historical trends going back two decades. It enables us to trace the evolution of different strands of extremist ideology; to measure levels of toxicity while exploring and developing the tools to do so better; to track the relationships between online subcultures and external political movements such as MAGA (the importance of which was seen in the attack on the US Capitol in January 2021); and to explore links with misogyny and violence, including radicalisation and recruitment. To illustrate a few potential uses, we apply statistical and data-mining techniques to analyse the online extremist landscape in a variety of ways, from posting patterns through topic modelling to toxicity and the membership overlap across different communities. A picture emerges of communities working as support networks, with complex discussions over a wide variety of topics. The discussions of many topics show a level of disagreement which challenges the perception of homogeneity among these groups. These two features of mutual support and a wide range of attitudes lead us to suggest a more nuanced policy approach than simply shutting down these websites. Censorship might remove the support that lonely and troubled individuals are receiving, and fuel paranoid perceptions that the world is against them, though this must be balanced with other benefits of de-platforming. ExtremeBB can help develop a better understanding of these sub-cultures which may lead to more effective interventions; it also opens up the prospect of research to develop better tools to identify hate speech, and to monitor the effectiveness of any interventions that are undertaken.