►
Description
Simon Dyson, Yorkshire & Humber Regional Cyber Crime Unit
Cryptocurrency and blockchain technologies are changing the way that value and data is transferred and stored. Bitcoin was the genesis that turned the wheel to the development of blockchain and is subsequently extensively written about. In this talk Simon explores the difficulties that investigators face with the new wave of privacy currencies, decentralised exchanges and smart contracts. As non-permissioned blockchains develop the new web technologies that can host persistent secure decentralised websites or content a new paradigm is born. Storage solutions, messaging applications and decentralised social media are all deployed or in development. Incident response is explored using examples of when blockchain goes bad. The talk gives a unique take by looking through the lens of those who are required to adapt to new technology and to serve the public.
https://hgf18.sched.com/event/G8sB/investigations-in-a-decentralised-landscape-when-blockchains-go-bad-simon-dyson-yorkshire-humber-regional-cyber-crime-unit
----
Hyperledger – Open Source Blockchain Technologies
Hyperledger is an open source community focused on developing a suite of stable frameworks, tools and libraries for enterprise-grade blockchain deployments.
It serves as a neutral home for various distributed ledger frameworks including Hyperledger Besu, Fabric, Sawtooth, Indy, as well as tools like Hyperledger Avalon, Cactus and libraries like Hyperledger Aries, Ursa. Learn more about Hyperledger projects: https://www.hyperledger.org/use
Case Studies: https://www.hyperledger.org/learn/case-studies
Training & Certification: https://www.hyperledger.org/learn/training
Tutorials: https://www.hyperledger.org/use/tutorials
Webinars: https://www.hyperledger.org/learn/webinars
Events: https://www.hyperledger.org/events
Vendor Directory: https://www.hyperledger.org/use/vendor-directory
Subscribe to the Hyperledger Newsletter: https://www.hyperledger.org/newsletter
Follow-us on Twitter @Hyperledger
Learn about Hyperledger Membership: https://www.hyperledger.org/about/join
#Hyperledger #HyperledgerGlobalForum2018 #Blockchain
A
Okay,
so
I'm
gonna
kick
off
now
so
now
with
really
sticklers
for
time.
So,
first
off,
thank
you
for
turning
up.
I
was
really
worried
that
it
would
be
an
empty
room
that
I've
come
to
clearly
I,
don't
work
for
any
companies
that
you
know
that
are
putting
putting
products
out.
So
I
really
appreciate
you
you
turning
up.
A
So
the
idea
for
this
talk
and
I
guess
really
is
and
brief
sort
of
set
some
things
up
quite
nicely
this
morning,
because
everybody's
building
things
and
we're
you
know,
there's
lots
of
layers
that
are
being
built
upon,
but
bad
things
can
happen.
We've
seen
some
of
those
things
in
my
sorry
production,
but
in
cryptocurrencies,
so
first
off
Before.
We
jump
in
then
an
introduction
to
myself,
basically
of
being
a
cyber
investigator
in
the
UK
for
our
regional
organized
crime
unit.
A
So
what
that
means
is
cyber
dependent
crime,
so
network
intrusion,
DDoS
attacks,
cryptocurrency
thefts,
that
kind
of
thing
so
additional
to
that.
My
role
in
the
police
I've
been
a
counterterrorism
investigator
and
most
of
my
career
be
sort
of
in
that
area
before
moving
into
cybercrime,
also
doing
digital
forensics.
So
it
kind
of
got
a
bit
of
background
across
all
those
and
then
specialized
a
little
being
cryptocurrency
as
I've
gone
long.
A
So
in
fact,
Sunday
was
my
last
day
as
a
police
officer
I'm
actually
moving
to
the
NHS
now
as
part
of
our
digital
team,
but
in
addition
to
sort
of
those
bits
and
pieces,
I've
done
research
around
cryptocurrency
and
I've
done
that
as
I've
done
a
master's
ad
in
Brunei
Pia.
So
I
don't
know.
If
I
live
your
ass
off
aware
of
professor
bill,
Buchanan
I'm
sure
you
are,
but
if
not
check
out
his
amazing
stuff.
A
So
a
couple
of
papers
of
stuff
worked
on
recently
that
have
been
released.
Journal
British,
blockchain
Association
have
just
put
that
one
out
in
their
new
release.
So
that's
on
their
online
portal
and
I've
also
done
and
the
theory
and
based
item
which
was
part
of
my
thesis.
So
why
turn
up
to
a
boxing
conference
to
start
talking
about
cryptocurrency?
Well,
I,
guess
it
gives
us
a
really
really
good
indication
of
what
might
happen
if
everything
was
put
out
in
production
and
stuck
on
to
the
edge
of
a
network.
A
So
it's
attracted
large
scale
high,
so
cover
a
few
of
those
as
we
go
along
I,
say:
battle-tested
learn
the
hard
way.
I
guess
it's
just
have
more
of
a
kicking
because
it's
been
on
the
fringes
of
the
internet
and
what
people
like
to
do
like
you
know
all
criminal
activity
and
you
know
see
in
nature-
is
they
they
go
for
the
weak
bits
and
start
trying
to
pick
people
off?
A
Well,
you
know:
we've
seen
it
sort
of
sitting
on
the
fringes
and
being
picked
off
so
we're
gonna
have
a
quick
talk
around
some
of
the
common
vectors
and
then
also
the
challenge
is
actually
that
it
gives
law
enforcement
and
there
were
a
lot
of
challenges.
You
know
that
this
whole
infrastructure
brings
because
traditional
crime
was
quite
easy.
You
know
there
was
a
real
place,
a
real
time
and
a
real
person
did
it
and
you
send
resources
there.
You
put
time
and
effort
in
and
you
pick
away
and
you'd
find
a
criminal.
A
Well
now
you
know
now
it's
harder.
You
know
please
just
catching
up
I
guess
with
cloud
technology
and
things
like
that,
because
you
start
looking
at
cross-border
trying
to
get
information
and
data
for
your
citizens
that
reside
in
one
area,
but
they
hold.
You
know
their
data
in
America,
for
example.
So
that's
difficult,
but
now
we're
obviously
spreading
that
even
further-
and
you
know
we
don't
even
have
borders-
and
you
know:
where
does
the
data
sit?
A
Now,
as
probably
most
of
us
know
in
here,
Bitcoin
wasn't
the
beginning,
but
for
for
for
our
purposes,
I
think
we're
probably
all
happy
that
Bitcoin
certainly
is
what
brought
technology
to
people's
attention
and
I
did
that
by
creating
trust
or
pseudo
trust,
as
maybe
we
should
now
call
it,
but
certainly
it
gave
the
ability
for
people
to
trade
have
have
an
interaction
without
knowing
that
other
party,
and
that
was
what's
really
important
about
you
know
about
how
Bitcoin
I
guess
took
on
so
much
popularity.
So
it's
an
exchange
mechanism.
A
We
call
it
pseudo
anonymous
again.
You
know
I'm
talking
to
a
group
of
people
that
you
know
quite
a
favor
with
that
and
it's
decentralized.
So
in
the
early
days
then
Bitcoin
have
not
got
the
metrics
on
here,
but
essentially
most
of
bitcoins
use
in
those
in
our
early
period
was
was
put
across
Silk
Road
and
it
was
quite
good
for
criminals
to
you
know
to
work
in
this
way,
because
what
they
could
do-
and
you
know
the
facility
was
made
by
Bitcoin-
to
have
that
trust.
A
Lisore,
you
know
be
able
to
trade
with
each
other,
but
in
addition
to
that,
they
were
able
to
then
put
it
all
in
infrastructure
in
this
website,
which
was
obviously
hosted
on
tour,
etcetera
and
in
the
on
the
dart
market,
where
they
would
create
these.
You
know
users
who
built
up
their
own
reputation.
So,
as
was
discussed
bye-bye
bridge
this
morning,
you
know
reputation
and
Trust.
You
know
the
link
together
and
what
we
thought
was
just
how
effective
that
was,
because
criminals
just
came
together
and
they
were
able
to
move
large
amounts
of
drugs.
A
Large
amounts
of
money
and
how
did
it
all
fall
down?
I'm
not
gonna,
go
into
it
here,
but
human
element.
You
know
when
we
still
come
back
to
that
and
all
law
enforcement
really
needs
to
come
back
to
that.
Where
you
know
the
systems
are
virtually
virtually
perfect
and
if
the
systems
use
properly
that
privacy
is,
you
know
relatively
held
together,
but
the
mistakes
are
always
made
by
humans
and
you
know
criminals.
You
know
they
become
blasé
with
what
they
can
get
away
with,
and
then
it
all
starts
to
fall
apart
right.
A
So
this
was
not
part
of
my
thesis
really
I
guess,
but
with
money
laundering
you
essentially
neat
or
one
of
the
poems
with
my
laundries
he's
getting
the
money
into
the
system.
You've
got
to
place
it
into
that
system
and
you've
got
to
move
it
around
and
then
you've
got
to
spit
out
the
other
side.
So
it
looks
like
there's
just
enough
money,
so
you
have
all
of
hers.
You
know
kind
of
you
know
laundromat
services,
and
you
know
that
that
kind
of
thing
so
I
mean
in
the
old
days.
A
You
know
you'd
be
putting
money
into
the
businesses
that
were
legitimate
and
and
you'd
start
to
sort
of
push
through
those
but
cryptocurrency.
You
know
kind
of
changes,
the
game
slightly.
So
you
know
you
can
directly
pay
straight
in
from
your
from
your
dark
web
sales
or
you
could
do
drug
sales
on
the
street,
get
it
into
the
system
and
there's
different
ways
of
getting
those
into
the
system,
but
then
ultimately,
then
trying
to
pull
it
out.
So
you
can
use
eighty.
A
So
you
have
things
like
open
Bazaar
now,
which
is
eBay
for
Bitcoin
hosted,
so
you've
got
a
decentralized
marketplace,
so
there's
no
centralized
place
for
people
to
go,
and
you
know
law
enforcement
or
anyone
else
to
you
know,
pull
out
that
information
of
those
users
and
then
you
use
in
the
cryptocurrency
on
top.
So
you
know,
as
things
evolve,
things
push
on
and
things
change.
You
know
you
know
quite
significantly
so
privacy,
some
of
you
I
guess,
will
be
aware
of
some
of
these
coins,
certainly
from
from
a
law
enforcement
point
of
view.
A
You
know
some
of
these.
Some
of
these
coins,
you
know,
do
make
it
difficult,
absolutely
and
essentially
some
of
these
kinds
of
cool
around,
because
privacy
is
an
issue
and
privacy
and
civilization
as
a
whole
is
going
through
this.
Now,
where
you
know,
we've
lost
trust
with
centralized
services
beaver.
You
know,
companies
that
hold
our
data
not
very
well,
and
then
it
gets
leaked
on
the
internet
every
other
day,
there's
400,000
new
records
or
millions
of
different
records.
A
They're
getting
put
out
there
so
there's
an
argument
that
privacy
is
absolutely
essential
and
the
argument,
you
know
really
just
stand
true,
because
you
know
we
can't
have
the
amount
of
data
getting
spat
out
onto
you
know
onto
the
Internet
at
the
rate
that's
going
on.
If
you
look
at
new
things,
you
know
sort
of
social
engineering.
A
Your
policy
see
some
of
these
attacks
around
now,
where
people
are
going
through
that
data,
picking
the
username,
picking
the
password
and
then
use
your
social
engineering
attacks
approaching
that
individual,
and
so
we
know
you
watched
pornography,
we're
gonna
start
leaking
your
details,
you
know,
and
it's
these
ecosystems
these
little.
You
know
criminal
ecosystems
that
just
fall
out
of
these
new.
You
know
new
bits
of
data
and
things
have
come
out
so
privacy.
A
Unfortunately,
you
know
we're
gonna
have
to
cope
with.
Is
law
enforcement
as
we
you
know,
as
we
move
forward,
certainly
Manero.
You
know
they're
using
ring
signatures
which
are
quite
complicated,
they're,
starting
to
hide
as
well
things
like
the
transaction
values
and
the
time
and
information.
So
you
can't
do
temporal
attacks
or
you
can't
do
the
you
know,
kind
of
attacks
that
you'll
have
seen
on
Bitcoin,
whether
you
know
detecting
nominal
amount,
second
cetera,
but
interestingly
things
like
yzi
cache
only
1%
of
their
traffic
or
their.
A
You
know
their
transactions
are
actually
done
using
the
you
know,
the
completely
private
transactions.
So
that's
interesting
in
itself
clearly
that
technology's
starting
to
move
its
way
through
all
the
infrastructure
that
we're
looking
out,
certainly
with
the
etherium.
You
know
we
know
they're,
bringing
that
in
you
know,
and
it
was
been
talked
about
this
morning
as
being
a
package.
That's
going
to
be
available
for
you
know
so
for
Hyper,
legio
cetera,
and
you
can
see
exactly
why
something
lies
on
cash.
You
know
and
the
ability
to
share
that
secret.
A
If
you
want
to
use
this
use,
use
deep,
onion,
etc,
so
it
doesn't
always
work
those
that
cash.
You
know
it's
had
a
number
of
papers,
kind
of
written
about
how
you
can
still
find
information
and
how
you
can
still
fall
out.
You
know
some
of
the
temporal
information,
etc.
Arounds
a
cash,
but
it's
you
know
it's
an
ever-changing
game.
Research
to
us
or
I
was
going
to
try
and
pick
apart.
You
know
these
protocols
etc.
And
similarly,
you
know
the
people,
though
design
and
we're
going
to
sort,
build
them
up
and
come
round.
A
A
You
know
they
use
Bitcoin,
initially
from
their
from
their
ill-gotten
gains.
That
then,
use
multiple
wallets
and
they've
pushed
them
into
into
Z
cash,
but
they've
done
it
using
shape-shift,
so
I'm
sure
many
of
you
use
shape-shift,
but
what
it
does
there
is.
It
basically
enables
them
to
change
one
currency
to
another,
but
there
is
also
the
ability
to
actually
see
what
those
transactions
are
I'm
using
there.
You
know
using
their
RP,
so
they've
pushed
information
in
using
shape-shift,
and
then
investigators
have
been
able
to
go
back
and
say:
yeah
yeah.
A
A
So
again,
you
know
they've
been
able
to
pull
that
data
out,
and
then
you
know
narrow
it
down
a
look
at
that
particular
transaction
itself,
and
that's
just
one
instance.
You
know
of
that
whole
picture.
That's
quite
a
sort
of
deep
running
investigation.
You
know,
and
if
you
look
at
that
into
detail,
certainly
in
the
indictment
she
you
know,
there's
pages
and
pages
of
information
which
is
really
interesting
from
you
know,
sort
of
a
researching
point
of
view
as
to
where
you
know
where
these
things
can
be
pulled
apart.
A
So
criminal,
smart
contracts,
the
the
ring
of
guy
DS,
was
a
paper
that
was
written
around
using
contracts
for
crime.
Now
they
kind
of
went
through.
You
know
the
different
scenarios
that
you
know
you
could
go
through
there.
So
there's
things
like
assassins
being
able
to
do
key
exchange
or
a
WikiLeaks
style
of
removal
of
information.
But,
ultimately
you
know
you
can
create
a
smart
contract
that
you
can
leak,
secrets,
etc,
and
do
that
in
a
way
that
is
relatively,
you
know,
trust
for
now.
A
I
think
you
know,
I've
not
seen
it
yet
and
I'm
quite
surprised
if
I'm
honest,
that
the
use
of
smart
contracts
haven't
been
used
for
command
and
control
or
for
DDoS
payment
and
facility,
because
it
just
suits
that
kind
of
crime
model.
I'm
sure
you
know
I'm
sure
that's
gonna
pop
up
at
some
point,
but
people
pay
money
in
IP
addresses
put
in
and
it
gets
taken
down.
A
So
you
know
I'm
sure
I'm
sure
that's
likely
to
appear
at
some
point
and
similarly
you
know
sharing
data,
exchanging
credit
card
details
or
images
and
then
even
sort
of
you
know
the
private
identifiable
information.
You
know
all
these
we've
seen
as
marketplaces
on
the
dark
web.
For
example,
you
can,
you
can
go
and
buy.
You
know
a
lot
of
this
stuff
that
we're
talking
about
things
like
the
malware
exploit
case.
So
you
know
it's
probably
at
some
point.
You
know
we'll
see
that
coming
into
coming
into
existence.
A
So
one
of
the
other
reports-
then
that's
pretty
good
for
for
viewing,
is
the
Internet
organized
crime
threat
assessment.
Now
it's
released
by
Europe
all
to
do
what
every
year,
it's
a
really
good
document.
You
know,
having
worked
with
Europe,
all
I
can
hand
on
heart
really
say
that
they're,
one
of
the
best
policing
organizations
across
the
world
and
I've
worked
quite
a
few,
certainly
the
big-name
ones.
But
what
what
Europe
all
do
do
is
that
bring
all
the
different
countries
together
and
they
actually
work
together,
not
just
on
paper.
A
You
know
they
actually
pull
resources
together,
joint
operations
together
in
intelligence,
etc,
but
they've
got
a
lot
of
resource
and
we
know
sort
of
well-funded
well-organized
and
they've
run.
Everyone
really
well,
but
their
report
that
they
bring
out
you
know,
is
a
good
indication
of
you
know:
kind
of
crime.
That's
happening
in
that
area.
So
one
of
the
key
findings
this
year
was
ransomware
I've,
run
a
number
of
sort
of
large-scale
ransomware
investigations
and
have
been
part
of
our
response.
A
When
I've
super
wanna
cry
came
in
hit
our
area
and
some
fare,
probably
the
headlines,
you
know,
don't
don't
do
it
justice
in
terms
of
smaller
businesses.
So
you
know
individual
small
businesses,
you
know,
builders,
one-man
bands,
etc.
You
know
they
get
their
machine
taken
down,
they
don't
do
backups.
You
know
all
the
backups
have
been
wives
by
the
by
the
attackers
among
a
kind
of
going
in
and
wiping
everything
and
it
can
genuinely
kind
of
destroy
businesses
and
livelihoods.
So
ransomware
is
particularly
nasty.
A
A
But
then
we
get
sort
of
new
kind
of
crime
areas
that
that
bubble
up,
because
you
know
now:
we've
got
cryptocurrency
but
critically
mining,
etc.
So
Cohen,
I've
sort
of
come
to
the
come
to
the
fray,
has
been
one
of
the
cryptocurrency
mining
programs
that
would
run
as
as
malware
or
run
in
your
browser,
but
in
the
background,
just
taking
you
resource
so
again,
this
is
kind
of
interesting
as
a
new
sort
of
area.
You
know.
A
So
again,
you
know:
there's
a
couple
of
papers
on
you
know
the
browser
based
things
and
I
think
they
looked
at
it
and
then
they
kind
of
found
that
there
was
was
about
nine
individuals
or
ten
individuals
that
were
certainly
making
all
the
money
from
from
the
crypto
browsing.
So
you
know,
if
you
want
to
go
and
do
it
yourself,
you
try
and
in
fact
a
small
number
of
people.
A
A
That
kind
of
thing-
and
you
see
that
within
botnets
you
know
we
see
activity
in
botnets
where
you
know
with
sweeps
across
and
there's
an
infection,
large
BOTS
back
and
then
you'll
get
another
one
that
comes
on
its
first
job
is
to
you
know,
kick
off
all
of
those
other
botnets.
So
you
know
it's
a
bit
of
a
bit
of
a
fight
for,
for
who
is
the
best
so
coming
back,
then
really
I,
guess
you
know,
attack
vectors,
I
say
operate
your
system
or
infrastructure
vulnerabilities.
A
A
You
know-
and
it's
fair
to
say
that
if
you've
got
a
number
of
nodes,
all
running
on
the
same
operating
system
and
there's
a
particular
vulnerability
that
there
is
potential,
you
know,
the
values
in
attack
factor
certainly
a
platform
that
that's
possible
to
you
know
to
get
in
and
disrupt
software
bugs
server
and
client
side.
You
know
so
there's
ways
of
leaking
information
either
from
you
know
from
appease.
A
You
know
that
kind
of
technology-
and
you
know
if
you
weren't
in
daps
or
if
you
run
in
certain
bits
of
software,
you
know
again,
you
know,
there's
another
interaction,
point
where
you
know
between
your
blockchain
network
and
your
client
software
that
there's
potentially
some
some
vectors
where,
if
those
can
get
exposed
smart
contract
books,
we've
seen
them
gonna
revisit
a
couple
of
them
shortly.
But
you
know
that's,
that's.
Definitely
you
know
sort
of
seen
in
the
wild
and
that's
something
that
people
need
to
be
pretty
strict
on
about
I.
A
Guess
really
it's
the
defense-in-depth
type
thing.
You
know
what
happens
if
your
smart
contract
goes
wrong.
What
are
you
backups?
You
know
what
what
other
methods
can
you
enforce
that
if
there
is
one
error
that
it
doesn't
affect
your
entire
entire
system?
You
know
and
I
get
that
I'm
talking
about
sort
of
number
permissionless
block
chains
here,
but
you
know
some
of
these
wills.
You
know
still
relate
from
permissioned
encryption
vulnerabilities.
You
know
if
there
was
a
method
or
an
encryption
bug
in
a
library
that
you're
running
you
know
that
can
be.
A
You
know
that
can
expose
a
number
of
your
smart
contracts
or
a
number
of
your
transaction.
That's
going
to
take
place
so
code
dependencies,
open
source
libraries.
You
know
again
we're
building.
On
top
of
you
know
layered
mashes
here,
so
we
are
dependent
on
them.
You
know,
we've
seen
recently
might
get
onto
them.
A
Sort
of
node
there
was
yes
what
one
of
the
libraries
that
was
running
you
know
was
installed
open
source
wise
on
some
numbers
of
different
things,
and
it
was
you
know.
Books
were
laid
bare
in
that
and
there's
still
hardware
book
so,
depending
on
what
you
block
chains
are
running
on.
You
know,
there's
still
potential
for
for
someone
to
do
some
mischief
if
they
were
clever
enough
to
be
able
to
run
something
into
into
the
system
or
our
physical
access
to
any
of
you
notes
yeah.
A
So
in
this
example,
is
basically
where
there's
an
ability
to
to
run
a
line
of
code
before
it
does
the
balance
of
the
day.
So
with
the
doubt
you
know
it
just
just
went
through
allowed
it
to
run
and
until
it
was
drained,
timestamp
dependence
I'd
not
particularly
see
this
out
in
the
wild,
so
I'm
not
sure
how
often
this
would
take
place,
but
where
code
has
been
used
with
that
timing
information.
A
So
there's
a
bit
more
a
theory
and
base
so
used
to
many
different
projects
here,
but
why
the
system
allows
for
the
time
to
be
taken
from
the
miners,
local
time,
clock
and
then
the
ability
I
guess
then,
for
you
know
for
the
for
the
changes
to
take
place.
It
shouldn't
really
be
used
on
a
you
know
on
a
time
basis
within
smart
contracts,
but
you
know
that's,
basically
how
it's
being
implemented
transaction
order
independence,
so
the
ability
really
so
have
a
look
at
what's
coming
up
in
the
future.
A
So
in
this
instance
there
was
a
paper
that
covered
some
of
the
guessing
games.
Really,
you
know
the
ability
to
guess
what
would
happen
where
the
person
guessed.
What
would
happen?
They'd
win
a
prize,
but
you
were
able
to
that
and
see
if
the
real
gas
had
been
guessed,
so
the
person
actually
owned
the
money
and
was
able
to
then
kind
of
drop.
The
value
of
the
of
the
prize
before
it
took
place
and
basically
all
they
did
is
they
could
see
what
was
coming.
You
know
the
transaction
was
placed
in
the
memory
pool.
A
It
was
put
there
it's
there
for
everyone
to
see
it's
not
being
point
to
his
block,
it's
not
being
assigned
its.
You
know
it's
not
being
validated
to
the
point
where
it's
being
added
to
the
chain,
but
you
know
it's
there,
so
what
you
can
do
or
what
people
have
done.
Certainly
with
you
know,
with
the
theory
top
up
the
gas
and
being
able
to
kind
of
nip
in
and
sort
that
out.
So
you
know
another
thing
where
it
probably
could
be
used
is
decentralized
exchanges.
A
You
know
the
working
on
the
same
mechanism
you'll,
you
know,
you'll
see
the
bids
being
put
onto
the
blockchain
and
you
can
see
that
go
in
so
effectively.
If
you
have
the
time
and
you
can
be
bothered,
etc,
you
know
you
could
you
could
start
pushing
and
doing
some
stuff
there?
So
so
again,
you
know
this
is
just
an
illustration,
I
guess
really
of
what
you
know
what
is
out.
A
There
doesn't
seem
too
bad
at
the
moment,
but
you
know
trust
me
if
someone
builds
something
where
there's
enough
money
to
gain
from
doing
that,
though
they'll
get
in
there
and
they'll
start
doing
it
mishandled
exceptions.
So
you
know
in
all
programming,
mishandles
exceptions
causes
all
kinds
of
problems
exposes.
Maybe
what
software
and
versions
were
all
run
in,
but
in
this
case
you
know
it
might
allow
an
advantage
on
the
system
to
occur,
or
it
might
be
able
to
create
a
DDoS
type
attacks
to
the
system.
You
know
and
Shanghai
attacks
etc.
A
The
theorem
there
is,
you
know,
it's
possible
possibility
to
kind
of
you
know
push
into
that,
and
you
know
cause
problems
with
the
system
there's
also
buffer
under
an
overflow
exploits.
So
all
kinds
of
problems
can
happen
from
that
depends
on
how
your
smart
contracts
being
built-
and
you
know
what
the
asakha
can
gain
from
you
know,
from
getting
stuck
in
there,
so
yeah
so
encryption,
bad
number,
random
number
generator.
A
A
You
know
a
house
of
cards,
really
it's
just
important
to
realize
that
you
know
any
one
of
these
things
can
drop
at
any
point
and
what
facts
will
have
them
on
that
system,
so
1.2
billion
in
cryptocurrency
was
stolen
since
2017
and
that's
only
in
May
2018.
So
it's
a
lot
more
to
add
to
that
now.
So
it's
a
pretty
good
business
for
criminals.
In
all
fairness,
there's
a
lot
of
money
that
they
have
they've
been
taken
out
of
that
system.
A
Have
they
been
doing
it
a
lot
of
social
engineering
for
anybody?
Certainly
that's
kind
of
being
around
the
etherium
space
or
you
know
any
of
those
forums,
fake
websites,
malva
ties
in
so
this
could
be
drive-by
downloads
or
you
know,
sort
of
items
and
maintained
in
your
banners.
Cut
and
paste
attacks
were
particularly
good.
Just
in
terms
of
it
just
shows
you
how
ingenuitive
people
sort
of
become
so
you
can't
be
bothered
to
type
out
your
20
by
theorem
address.
Clearly
you're
gonna
make
mistakes.
It's
quite
long,
it's
complicated,
so
you
cut
and
paste.
A
So
in
the
background,
malware
running
process
takes
over
your
clipboard.
You
paste
in
your
your
legitimate
address,
or
you
cut
your
legitimate
address.
You
paste
it
into
your
wallet,
you
press
go
and
it
sends
it
to
the
attackers.
You
know
which
I'm
sure
many
of
you
have
seen,
but
it
just
shows
you
just
how
you
know
how
how
people
would
change
their
attack
patterns
pretty
quickly,
because
that
was
definitely
not
a
thing
Reese.
You
know
until
we
until
then
social
media
account
takeover.
You
know
if
you
want
to
be
that
company.
A
The
best
way
to
pretend
to
be
that
company
is
to
just
go
and
hack
one
members
of
that
team
get
into
the
team
hack,
the
Twitter
account
and
then
go
I,
co,
starred
and
then
paste
your
wallet
address
and
lots.
You
know,
that's
that's
how
people
do
it?
That's
for
how
you
shouldn't
do
it
obviously
false
posts?
So
again,
forums
leaked
incorrect
addresses
I've
just
got
the
leak
address.
That's
on
it
now,
and
it's
amazing
just
how
much
money
is
made
from
some
of
these
pretty
basic
attacks,
so
mount
GOx
still
is
up.
A
Apparently
you
know
social
engineering
attack,
so
you
know
pretty
successful
on
that
on
that
that,
from
the
dow
we've
already
mentioned,
smart
contract
book
coin,
7
million
they're
lost
in
2017
hacked
a
hacked
website,
so
again
social
engineering
to
a
certain
extent,
but
you
know
a
genuine
half-caf
the
website,
so
so
cybercrime
and
a
little
bit
of
social
engineering,
because
they're
purporting
to
be
someone
else,
poverty,
2017,
multi
signature
book
so
allowed
for
an
unchecked
request.
Again,
a
smart
contract
function
book.
A
So
again
that
was
a
you
know.
That
was
a
bit
of
a
strange.
You
know
bit
of
a
strange
hack
to
their
system.
But
again
you
know
266
million.
Can't
really.
You
know
can't
really
sniff
for
that
and
what
what
this
shows
you
is.
You
know
if
you
look
at
all
that
money,
all
that
money's
in
the
system,
all
that
money
is
either
got
to
come
out
of
the
system
or
its.
You
know
it's
gonna
be
spread
around.
You
know
it's
gonna,
it's
gonna
buy
criminals,
and
this
is
our
organized
crime
works.
A
Is
they
pull
in
funds
from
a
funding
stream
and
it
funds?
Other
things,
so
you
know,
depending
on
who's,
committed
this.
If
they're,
you
know
purely
just
pure
cryptocurrency
criminals,
you
know,
then
you
know.
Perhaps
we
won't
see
that
going
into
the
you
know
into
the
other
criminal
areas,
but
you
know
certainly
organized
crime
from
you
know
from
numbers
of
states
that
we
could
mention.
You
know
that
go
straight
in
so
you
know
straight
into
drugs
straight
into
people
trafficking
you
know,
and
that
kind
of
that
kind
of
activity.
A
So
I
SEOs
went
mental,
luckily
they've
kind
of
settled
down
to
a
certain
extent,
although
I
believe
now
it's
all
about
security,
offering
so
good
luck
with
that.
Personally,
you
know
just
be
careful.
That's
all
I'm,
saying
78%
deemed
a
scam
by
the
research
that
had
taken
place
and
if
any
of
them
are
paid
out
or
made
the
money.
Certainly
you
know
these
last
couple
weeks.
A
You
know,
there's
not
a
lot
of
money
to
be
made
their
social
engineering,
phishing
database,
leaks
and
harvesting
and
targeting
so
if
the,
if
your
name
and
address
was
leaked
onto
the
Internet
in
one
of
the
many
many
leaks,
I
would
suggest
that
it
probably
has
been.
If
any
of
you
been
on
the
internet
for
longer
than
six
months,
you've
probably
got
accounts,
you
forgot
about
just
go
and
change
him
because
they'll
be
they'll,
be
compromised,
but
yeah.
A
You
know,
people
are
just
gonna
target
individuals
and
we're
seeing
that
you
know
an
individual
works
for
X
Y.
Is
that
right?
You
know.
That's
the
weakest
link,
people
in
the
weakest
link,
so
two-factor
authentication
and
all
that
kind
of
stuff,
and
then
we've
got
new
cryptocurrency
malware.
That's
gonna
come
it's
doing
key
login,
which
is
the
kind
of
thing
we'd
normally
see
with
malware,
credential,
stealing
standard.
It's
just
an
easy
stuff
access
bunch
of
stuff
and
wants
to
see
you
doing
your
stuff.
A
But
now
it's
got
a
couple
of
extra
add-ons
because
you
know
why
not
so
crypto
mining
just
comes
the
standard
just
haven't
run
in
the
background.
You
might
as
well
make
very
little
money
at
the
same
time,
but
also
crypto
wallets
demon.
So
that
is
going
straight
onto
your
system
and
saying:
has
this
person
got
wallet?
I
want
some
of,
and
it's
going
straight
in
there
and
trying
to
trying
to
trying
to
grab
the
grab
the
details.
So
you
know
it's
new
new
attack
vectors
directly
for
cryptocurrency
owners,
all
right
yeah.
A
A
Not
so
long
back,
you
know,
open
source
is
huge
and
massive
massive
supporter
of
open
source,
but
you
know,
as
a
community
probably
gonna
start
getting
looked
at
now
by
attackers
who
want
to
come
in
and
be
part
of
that
ecosystem,
because
if
they
can
create
a
little
bit
of
a
back
door
and
get
into
any
of
any
of
these
things,
I
mean.
Certainly
you
know,
github
itself
is
huge
and
you
know
and
massive
you
know
it
will
now
become
become
a
target.
I
would
suggest.
A
So
what
kind
of
issues
is
this
gonna
cause
for
law
enforcement?
Well,
you
know
blockchain
as
a
whole
and
brings
new
technologies
so
persistent
web
hosting.
So
things
like
aetherium
swarm.
You
know
interplanetary
file
system,
we're
gonna,
see
you
know,
storage
on
mass,
we're
gonna,
see
things
like
the
etherium
naming
system,
so
it
gives
it
a
name,
gives
access
and
ultimately
is
unstoppable.
A
You
know
unbreakable
unsensible,
you
know,
and
we've
already
discussed
about
privacy,
I
guess
a
little
bit
earlier
and
you
know
as
a
you
know,
I
understand
why
people
want
to
be
uncensored,
but
I
can
assure
you
having
worked
in
a
number
of
these
areas.
Some
of
this
material
you
know,
doesn't
want
to
be
accessed
by
everybody
and
you
know
I'm
not
sure
what
the
answers
gonna
be
for
that
you
know
I
guess
there
might
be,
including
you
know,
a
whitelist
I.
A
Don't
want
to
see
this
stuff,
you
know,
I,
don't
know
what
the
answer
is.
Gonna
be,
but
certainly
it's
gonna
make
life
difficult
floor
enforcement,
decentralized,
storage,
again
hosting
material,
etc,
and
then
we're
also
looking
at
messaging
application.
So
things
like
whisper
on
etherion,
decentralized,
socialized,
media
and
there's.
You
know,
there's
good
use
cases
for
these,
because
people
like
Facebook
have
been
sullen
selling
data
selling
people's
data
that
they
believe
their
own
themselves.
A
So
you
know
they're
gonna
solve
lots
of
problems,
but
it's
just
going
to
give
new
problems
to
you
know
to
law
enforcement
and
those
that
need
to
look
at.
You
know
look
at
that
material,
so
yeah
namecoin,
for
example,
than
etherium
diamond
system
named
corns
being
mentioned
by
fire
I
hosting
or
creating
a
name
essentially
and
access
to
you
know
some
of
their
exploit
kiss.
So
you
know
it's
not
in
the
land
of
may
believe.
A
You
know
this
stuff
is
kind
of
out
and
running
blockchain
storage,
so
bitcoin
cast
file
hosting
IP
affairs,
etherium
swarm
and
things
like
graphite,
you
know,
have
been
being
pushed
by
journalists
in
order.
You
know,
for
people
to
have
a
google
sweet
sort
of
decentralized
and
and
in
the
sky
and
again
you
know
these.
These
are
you
know
covering
really
good
use
cases,
but
that
might
cause
you
know,
law
enforcement
problems
and
or
even
just
people
that
are
protecting.
You
know,
networks
as
people
try
to
get
rid
of
company
secrets
and
things
out
of
systems.
A
You
know
we're
gonna
start
seeing
these
being
built
into
tools
because
you
know,
without
that
we
can't.
We
can't
really
see
what's
going
on
so
one
of
the
things
then,
for
around
the
theory
and
type
type
work
that
I've
done.
You
know
it's
just
create
a
number
of
difference
of
areas
that
need
to
be
looked
out.
You
know,
so
that's
the
edges
to
the
the
network's.
Essentially,
you
know
ATMs
retailers,
exchanges,
decentralized
exchanges
around
identity.
You
know
someone
by
looking
at
individuals
or
accounts
of
their
been
involved
in
criminality.
A
You
can
see
a
transaction
1
&
2,
but
actually
you
can
also
see
they've
taken
part
or
they've
done
a
bid
on
a
theory
of
name
service.
You
know
what
does
that
relate
to?
Is
that
a
new
kind
of
group
of
addresses
that
you
know
they're
going
to
be
used
in
another?
You
know
just
bad
transactions
etc
and
physical.
So
this
this
really
is
for
for
others.
You
know,
law
enforcement
kind
of
thing
is
that
we
should
be
thinking
about
looking
at
if
we're
where
it
seems
and
also
identity
signatures.
A
So
the
ability
for
us
to
have
a
look
at
smart
contracts
who
say
that
this
method
ID,
for
example,
is
talking
about
an
ER
C
20
exchange,
so
we
can
say
well,
actually
it
doesn't
stop
here.
Our
line
doesn't
stop
at
a
contract
when
we
think
nothing
else
has
gone
on
goes
to
the
contract,
and
then
we
see
that
actually
there's
an
exchange
between
two
of
the
parties
lower
down.
A
So
how
to
stop
the
unstoppable
I,
don't
know
I
just
thought
I
put
out
there
in
case
only
you
could
answer
that
the
at
the
end,
because
you
know
once
it's
up
and
running
I-
guess
I,
guess,
that's
it
so
reaching
consensus
or
upgrade
in
the
system.
I
guess
for
permissions.
You
know
this
is
gonna,
be
gonna,
be
quite
easy,
but
certainly
when
we
start
to
look
at
non
permission
systems.
A
A
What
gradable
contracts
now
I
know,
that's
something
that's
being
mentioned
in
the
in
the
theorem
area.
So
you
know
it
kind
of
goes
against
what
the
whole
point
of
the
smart
contract
was
in
the
first
place.
Code
is
law,
etc,
but
you
know
I
think
there's
probably
there's
probably
places
where
an
upgradeable
contract
is
acceptable
for
certain
things,
but
certainly
it's
a
strange
one
side
chains,
you
know
I,
know,
there's
a
lot
of
data
storage
and
there's.
A
There's
lots
of
kind
of
different
avenues
of
of
having
interactive
chains
and
I
can
certainly
I
can
certainly
see
that
you
know
personal
identifiable
information
may
be
stored
in
a
you,
know,
permission
chain
and
then
you'd
have
you
know
kind
of
shoots
out
to
a
to
an
on
permission.
If
you,
if
you
wanted
to
do
some
of
that
kind
of
some
of
that
kind
of
thing,
but
again
I
guess
these
are
areas,
then
you
know
they're
changing
quite
quickly
incident
response,
so
I
suppose
what
we
could
kind
of
say
is
you
know?
A
How
would
you
I'll
put
my
alarm
on
to
remind
me
that
I
should
stop
talking
shortly
incident
response?
If
you
had
an
insider
threat
from
your
organization?
How
would
you
know
you
know
you've
got
everything
on
the
block
tone
yeah.
But
how
do
you
know
there?
Isn't
somebody
interfering
with
that
system?
How
do
you
know
you
have
control
of
all
your
nodes?
A
When
we
go
in
there,
do
we
have
the
tools
for
us
to
be
able
to
do
what
we
need
to
do,
which
is
to
say
just
this
person
use
cryptocurrency.
What's
the
balance
on
their
system,
you
know:
can
we
work
out?
Who
they're
paying
money
to,
and
you
know
who
those
who
then
networks
are?
So
it's
that
kind
of
thing
really
I
guess
so
with
there
needs
to
be
a
lot
more
work
around
that
you
know
we
need
to
go
beyond
just
tracking
and
trace
on
the
blockchain.
You
know
the
blockchain
is
bigger
is
deeper.