Developing Investigation Skills in DLT: Bitcoin

Transcription

1 Developing Investigation Skills in DLT: Bitcoin Emerging technology investigations Sukhvinder Hara

2 Providing Students with Skills to Investigate DLT Challenge for the audience 1. 1BsHJ7jErmkWqoSJNqPq72qMZzJ2wwKKNo 2. Coingenie 3. 7v6yjcmqem3jkjj2.onion Students were provided a scenario where they had to investigate an employee (PA) to a senior manager, suspected of selling corporate secrets. An investigation of the PA s computer revealed nothing of suspicion. However, a screwed up piece of paper with the above information was found. How would you start this investigation? Sukhvinder Hara s.hara@mdx.ac.uk 2

3 Ethereum Deflationary Mature Ripple Why Bitcoin? Stable Image Litcoin P2P Secure Factom Sukhvinder Hara 3

4 DLT as an Investigation Source Traditional forensic tools and approaches not ideal. A distributed dataset with every recorded transaction. A dataset that is immutable - therefore forensically sound. Investigation focus on live data rather than traditional investigation techniques. Understanding how pseudoanonymity can be increased and decreased by users actions (addresses re-use, buying and selling BTC, types of transactions - Vanity). Sukhvinder Hara s.hara@mdx.ac.uk 4

5 Infrastructure and Preparation for Teaching Peers Buying BTC Technical Legal Labs, Networks Sukhvinder Hara 5

6 7 Tutorials and Labs fit for purpose 1. Provides an overview of the entire system at a simplistic level. Enabling students to understand public key cryptography, P2P networks, hash functions. In the first lab students setup all the SPV wallets and web account Blockchain.info to send BTC to each other and become familiar with BTC units. 2. Storage and acquisition of bitcoins and the main methods are explained. The potential of crime is also introduced specifically money laundering through exchanges, and the weak point of anonymity when exchanging bitcoin to fiat. Here the lab looks at sending transactions from multiple addresses and looks at the issue of address re-use. Sukhvinder Hara s.hara@mdx.ac.uk 6

7 7 Tutorials and Labs fit for purpose 3. Network propagation of transactions is covered and introduces students to input and output addresses. This is useful for students to start understanding tracing source and destination of funds. In the lab concepts and resources are looked at. The chaining of transactions and how they can be traced with block explorers (blockchain analysis). 4. P2P network, and components that allow it to achieve consensus in the absence of a central authority. PoW algorithm, verification of new blocks and mining are presented. The lab explores the physical simulation of transactions being processed from broadcast to commitment through the use of Lego. Sukhvinder Hara s.hara@mdx.ac.uk 7

8 7 Tutorials and Labs fit for purpose 5. Here the data structure is looked at in detail and broken down with the use the byte tables describing various fields. The concept of forks, block height and block hash are studied in detail. In the lab students are provided with a block.dat file and each field is located with a Hex editor. 6. Crimes that involve the use of bitcoin are explored along with concept of the 51% attack. Well known cases are explored such as Mt Gox and Silk Road market place. It also introduces Coinjoin transactions and mixing that may limit traceability. Students explore the transactions that they conducted over the number of weeks to assess traceability and how this may have been reduced. Sukhvinder Hara s.hara@mdx.ac.uk 8

9 7 Tutorials and Labs fit for purpose 7. In the final tutorial blockchain analysis is looked at from an investigators mindset. It delves into how blockchain provides transparency and auditability. Academic work in this area is also explored. Students use Numisight and other explorers to perform the types of analysis they have learnt about in the proceeding lectures using their own transaction history. Sukhvinder Hara 9

10 Assessment Design and Development The assessment enabled students to explore all of the topics that had been looked at in the tutorials and apply these acquired skills to a developed hypothetical scenario. Creation of accounts Tor webpage BTC Address Forum entries: Coingenie Background work to set the scenario: 1BsHJ7jErmkWqoSJNqPq72qMZzJ2wwKKNo Coingenie 7v6yjcmqem3jkjj2.onion Sukhvinder Hara s.hara@mdx.ac.uk 10

11 Student Reports Sukhvinder Hara 11

12 Benefits for Students Being able to investigate a non standard dataset Develop transferrable skills for new emerging technologies (Drones, IoT) An edge in demonstrating different abilities for forensics So far we have had a positive response from students that have mentioned this experience at interviews. Sukhvinder Hara s.hara@mdx.ac.uk 12

13 Further Work / Collaboration Current work on detailing artefacts left by bitcoin on devices and computers is being collated. Communication data within the blockchain is being examined. Further information on the scenario presented today can be found on: Bitcoin Forensics: A Tutorial We are interested in collaborating with other institutions / professionals to develop this area further. Sukhvinder Hara s.hara@mdx.ac.uk 12