美国国家公共电台 NPR--Cryptocurrency tech is vulnerable to tampering, a DARPA analysis finds

Cryptocurrency tech is vulnerable to tampering¹, a DARPA analysis finds

Transcript²

Whether prices are up or down, for many investors³ in cryptocurrency, the real appeal is that there's nobody in charge.

As the crowd chanted at the recent Bitcoin 2022 conference in Miami, it's all about "Freedom!" By design, the system is meant to be from interference by banks, companies and governments.

But a new report finds that the decentralized system might not be working as well as many crypto enthusiasts⁵ assume.

The report was commissioned by the Defense⁶ Advanced Research Projects Agency, or DARPA, and the work was done by the software security research company Trail of Bits.

Trail of Bits CEO Dan Guido says blockchain — the public ledgers⁷ that keep track of cryptocurrencies, which are replicated⁸ on computers around the world — isn't the egalitarian tech its advocates claim.

"It's been taken for granted that the blockchain is immutable⁹ and decentralized, because the community says so," says Guido.

But in practice, he says, these networks have evolved in ways that concentrate power in the hands of certain people or companies, including the large pools of "miners" whose computers earn virtual currency by maintaining the blockchains.

Guido's team calls these potential situations "unintended centralities" — situations in which someone gains leverage¹⁰ over the decentralized system, creating opportunities for tampering with the record of who owns what.

Another example in the report of this kind of concentration is the fact that 60% of Bitcoin traffic is handled by just three internet service providers.

"Let's say somebody with great top-down control of the internet in their country starts to interfere⁴ with that network," Guido says. By slowing down or stopping legitimate¹¹ blockchain traffic, an attacker could become the "majority" voice in the consensus¹² of what's written to a blockchain at that moment.

"They can rewrite history. They can censor¹³ transactions. They can make it so that you can't spend your Bitcoin," says Guido. "It's definitely something people would want to do if they want to 'grief' the network."

The notion of this kind of attack isn't new, but what the Trail of Bits report does is compile research into different kinds of "unintended centralities" to better understand the technology's overall vulnerability.

Some of the findings are "eyebrow-raising," says Josh Baron¹⁴, project manager of the unit at DARPA that commissioned the report.

"For example, the idea that 21 percent of Bitcoin nodes are running an old version of the Bitcoin core client that's known to be vulnerable," Baron says, referring to the basic software running that blockchain. That means all those computer are open to the same kind of hack¹⁵ — a big first step for an attacker trying to dominate a blockchain network, sometimes called a "51 percent attack."

"You're already worried about 51 percent, and now I'm telling you that 21 percent are just out there for the taking, as it were. That's that's not great," Baron says.

So far, the risks outlined in the report don't seem to be a major concern for the cryptocurrency business. NPR approached some of the larger companies, such as Coinbase, for a response, but they declined.

Yan Pritzker, co-founder¹⁶ of a smaller Bitcoin services company called Swan, told NPR he sees the risks as "theoretical."

"If this kind of attack is possible, why hasn't it happened?" Pritzer asks. "I think the proof is in the pudding a little bit. In real-world conditions, these things don't happen."

Pritzker agrees with the report on this point: There is more centralization in some of the newer forms of cryptocurrency, especially those that rely on a system called "proof of stake," which uses less computing¹⁷ power. He's more confident in the resilience of Bitcoin, because its energy-intensive "proof of work" blockchain would take much more computing energy to corrupt¹⁸.

Pritzker also points out that this research was commissioned by a government agency.

"They're basically doing endgame research," he says of reports like this. "Their game is, 'how do we get better control of the currency,' and 'how do we build better systems for our control of the currency'."

Christian¹⁹ Catalini, founder of the MIT Cryptoeconomics Lab, sees the report as useful, but not too worrying.

"Some of the concerns I think are valid²⁰, but maybe the danger to the broader ecosystem²¹ is a little overstated," he says, noting that it's important to keep in mind that cryptocurrency systems aren't completely autonomous²². Loose associations of humans — volunteers and "core developers" — are working constantly to maintain and improve them.

"You could imagine some of the issues [in the report] being exploited, eventually — and I think it will happen potentially for some of these," Catalini says. "[But] the community can always coordinate²³, respond and, I think over time, will get better at developing the right solutions."

Because cryptocurrencies are decentralized, with no oversight²⁴ by governments or central banks, those solutions will require the attention and consensus of the participants in those networks.

At Trail of Bits, Dan Guido says he thinks cryptocurrencies and blockchain have a promise, but anybody investing in them should consider them to be still in the "prototype" stage.

"Everybody needs to know kind of what they're buying, what they're buying into — what they're going to trust," Guido says. "And there's a lot here that you should not trust. At least, not today."

1 tampering   

v.窜改( tamper的现在分词 )；篡改；（用不正当手段）影响；瞎摆弄

参考例句：

• Two policemen were accused of tampering with the evidence. 有两名警察被控篡改证据。 来自《简明英汉词典》
• As Harry London had forecast, Brookside's D-day caught many meter-tampering offenders. 正如哈里·伦敦预见到的那样，布鲁克赛德的D日行动抓住了不少非法改装仪表的人。 来自辞典例句

2 transcript   

n.抄本，誊本，副本，肄业证书

参考例句：

• A transcript of the tapes was presented as evidence in court.一份录音带的文字本作为证据被呈交法庭。
• They wouldn't let me have a transcript of the interview.他们拒绝给我一份采访的文字整理稿。

3 investors   

n.投资者，出资者( investor的名词复数 )

参考例句：

• a con man who bilked investors out of millions of dollars 诈取投资者几百万元的骗子
• a cash bonanza for investors 投资者的赚钱机会

4 interfere   

v.(in)干涉，干预；(with)妨碍，打扰

参考例句：

• If we interfere, it may do more harm than good.如果我们干预的话，可能弊多利少。
• When others interfere in the affair,it always makes troubles. 别人一卷入这一事件，棘手的事情就来了。

5 enthusiasts   

n.热心人，热衷者( enthusiast的名词复数 )

参考例句：

• A group of enthusiasts have undertaken the reconstruction of a steam locomotive. 一群火车迷已担负起重造蒸汽机车的任务。 来自《简明英汉词典》
• Now a group of enthusiasts are going to have the plane restored. 一群热心人计划修复这架飞机。 来自新概念英语第二册

6 defense   

n.防御，保卫；[pl.]防务工事；辩护，答辩

参考例句：

• The accused has the right to defense.被告人有权获得辩护。
• The war has impacted the area with military and defense workers.战争使那个地区挤满了军队和防御工程人员。

7 ledgers   

n.分类账( ledger的名词复数 )

参考例句：

• The ledgers and account books had all been destroyed. 分类账本和账簿都被销毁了。 来自《简明英汉词典》
• The ledgers had all been destroyed. 账簿都被销毁了。 来自辞典例句

8 replicated   

复制( replicate的过去式和过去分词 )； 重复； 再造； 再生

参考例句：

• Later outplant the seedlings in a replicated permanent test plantation. 以后苗木出圃栽植成重复的永久性试验林。
• The phage has replicated and the donor cells have lysed. 噬菌体已复制和给体细胞已发生裂解。

9 immutable   

adj.不可改变的，永恒的

参考例句：

• Nothing in the world is immutable.世界没有一成不变的东西。
• They free our minds from considering our world as fixed and immutable.它们改变着人们将世界看作是永恒不变的观点。

10 leverage   

n.力量，影响；杠杆作用，杠杆的力量

参考例句：

• We'll have to use leverage to move this huge rock.我们不得不借助杠杆之力来移动这块巨石。
• He failed in the project because he could gain no leverage. 因为他没有影响力，他的计划失败了。

11 legitimate   

adj.合法的，合理的，合乎逻辑的；v.使合法

参考例句：

• Sickness is a legitimate reason for asking for leave.生病是请假的一个正当的理由。
• That's a perfectly legitimate fear.怀有这种恐惧完全在情理之中。

12 consensus   

n.(意见等的)一致，一致同意，共识

参考例句：

• Can we reach a consensus on this issue?我们能在这个问题上取得一致意见吗？
• What is the consensus of opinion at the afternoon meeting?下午会议上一致的意见是什么？

13 censor   

n./vt.审查，审查员；删改

参考例句：

• The film has not been viewed by the censor.这部影片还未经审查人员审查。
• The play was banned by the censor.该剧本被查禁了。

14 baron   

n.男爵；(商业界等)巨头，大王

参考例句：

• Henry Ford was an automobile baron.亨利·福特是一位汽车业巨头。
• The baron lived in a strong castle.男爵住在一座坚固的城堡中。

15 hack   

n.劈，砍，出租马车；v.劈，砍，干咳

参考例句：

• He made a hack at the log.他朝圆木上砍了一下。
• Early settlers had to hack out a clearing in the forest where they could grow crops.早期移民不得不在森林里劈出空地种庄稼。

16 Founder   

n.创始者，缔造者

参考例句：

• He was extolled as the founder of their Florentine school.他被称颂为佛罗伦萨画派的鼻祖。
• According to the old tradition,Romulus was the founder of Rome.按照古老的传说，罗穆卢斯是古罗马的建国者。

17 computing   

n.计算

参考例句：

• to work in computing 从事信息处理
• Back in the dark ages of computing, in about 1980, they started a software company. 早在计算机尚未普及的时代（约1980年），他们就创办了软件公司。

18 corrupt   

v.贿赂，收买；adj.腐败的，贪污的

参考例句：

• The newspaper alleged the mayor's corrupt practices.那家报纸断言市长有舞弊行为。
• This judge is corrupt.这个法官贪污。

19 Christian   

adj.基督教徒的；n.基督教徒

参考例句：

• They always addressed each other by their Christian name.他们总是以教名互相称呼。
• His mother is a sincere Christian.他母亲是个虔诚的基督教徒。

20 valid   

adj.有确实根据的；有效的；正当的，合法的

参考例句：

• His claim to own the house is valid.他主张对此屋的所有权有效。
• Do you have valid reasons for your absence?你的缺席有正当理由吗？

21 ecosystem   

n.生态系统

参考例句：

• This destroyed the ecosystem of the island.这样破坏了岛上的生态系统。
• We all have an interest in maintaining the integrity of the ecosystem.维持生态系统的完整是我们共同的利益。

22 autonomous   

adj.自治的；独立的

参考例句：

• They proudly declared themselves part of a new autonomous province.他们自豪地宣布成为新自治省的一部分。
• This is a matter that comes within the jurisdiction of the autonomous region.这件事是属于自治区权限以内的事务。

23 coordinate   

adj.同等的，协调的；n.同等者；vt.协作，协调

参考例句：

• You must coordinate what you said with what you did.你必须使你的言行一致。
• Maybe we can coordinate the relation of them.或许我们可以调和他们之间的关系。

24 oversight   

n.勘漏，失察，疏忽

参考例句：

• I consider this a gross oversight on your part.我把这件事看作是你的一大疏忽。
• Your essay was not marked through an oversight on my part.由于我的疏忽你的文章没有打分。