1. NXTInfrastructure Avatar NXTInfrastructure
  2. Untitled project
  3. Committee
  4. Issues

Attacks & Countermeasures

Issue #36 new
Come from Beyond created an issue

I propose to prepare a list of attacks that could be conducted on Nxt infrastructure and countermeasures that could be used against them. This "cheatsheet" would be very useful coz protection of p2p-network is kinda sacral knowledge and can't be handled by applying common sense.

The cheatsheet should include at least such the attacks: - DoS - Sybil - Poisoning - Eclipse - Tracking (it's related to deanonymization, so I'm not sure u could do much about this)

There r more types of attacks but these r the most important/dangerous ones.

Comments (19)

  4. marcus03

    We could create a bounty for a paper which should include:

    • An analysis/description of the NXT P2P network architecture and the communication within (due to the missing whitepaper).
    • A list of general attacks on P2P networks, their relevance for NXT and ways to identify these attacks in the NXT P2P network.
    • Possible countermeasures that could be taken, specific to NXT and the NXT network.
  5. marcus03

    I am proposing to offer a bounty of a variable amount of 10.000 to 20.000 NXT for a paper that I described above. A maximum of two papers will get the bounty, based on InfCom voting. The exact amount depends on the quality of the paper and is decided upon by InfCom.

    Please comment or vote.

  6. EvilDave

    (Edited my post to avoid confusion and not look like a complete idiot)

    Sounds good to me. Just to make it fair, and to give everyone a chance to provide some useful info, i'm good with the idea of awarding funds to 2 papers.

    If we get to 4 in favour, I'll post a bounty announcement on the InfCom and firehose threads.

    We should keep the bounty vague (like M said, 10-20k) and then vote on the exact amount when we have papers in front of us.

    Do we want to set a deadline for submission?

  7. marcus03

    I doubt that CfB will write a paper - I think it's more like he wants this paper... :-)

    A Deadline makes sense. 2 months?

  8. Come from Beyond reporter

    Marcus03 is right, I want this paper. My experience in such things is related to MMO-games, not to p2p-networks, so I can't write the paper.

  9. EvilDave

    Guys: I've been seeing in the last day or 2 a small amount of discussion about possible NXTwork attack vectors on BTT, now seems like a good moment to get a bounty announcement up....

    I know voting is not watertight on BitBucket, but so far I'm not seeing any InfCom input from anyone who's not Marcus03 (i'm in favor, btw, looks like an obvious good thing. ) Can I get some "Hell, yeahs" from the rest of the InfCom crew ?

    And any other attacks/information that should be included in the paper(s) ?

  12. EvilDave

    Yep, on the case. Waiting for some input from chanc3r, but I'll try to get it up in the course of tonight. The bounty, that is......

  13. Ian Ravenscroft

    Sorry ED just found Marcus link above - reference this in the bounty, that covers generically the kind of attacks we are concerned about. What about an additional bounty if they can provide sample SW to demonstrate the attack/exploit on test net?

    Remember we are looking for non-functional type attacks by node spoofing, traffic overload etc not functional flaws e.g. we are not trying to duplicate the bounties for bugs in nxt crypto itself - yes?

    Lets get it posted iff you haven't already.

  14. marcus03

    @chanc3r: Yes, we want to know which general attacks/countermeassures on p2p networks exist and what their relevance for the NXT network is. Like so:

    • An analysis/description of the NXT P2P network architecture and the communication within (due to the missing whitepaper).
    • A list of and description for general attacks on P2P networks, their relevance for NXT and ways to identify these attacks in the NXT P2P network.
    • A list of and description for attacks that are specific to the NXT network if there are any.
    • Possible countermeasures that could be taken, specific to NXT and the NXT network.
  15. EvilDave

    OK, going to assemble a draft bounty request from the above in the next few hours. I'm going to prioritise,it and get it up b4 the end of today.

  17. xcvsdxvsx .

    Its good to start addressing this question of attack vectors but perhaps a more efficient application of our scarce resources would be to set bounties for successful attacks.

  18. marcus03

    IMHO, these would be need to be white-hat attacks to qualify for a bounty. Also, we need monitoring first.

  20. Log in to comment
Assignee
–
Type
bug
Priority
major
Status
new
Component
Infrastructure
Votes
3
Watchers
5
Jira: the preferred issue tracker for Bitbucket. Join the team!