A Security Analysis of FirstCoin

Research output: Chapter in Book/Report/Conference proceedingConference contributionResearchpeer-review

Abstract

Supported by the current hype on Bitcoin, the number of available cryptocurrencies has steadily increased over the past years. Currently, relevant portals list more than 1.500 cryptocurrencies. Many of them slightly deviate from approved and tested technical concepts and realize security-related functionality in different ways. While the security of major cryptocurrencies has already been studied in more detail, security properties of less popular cryptocurrencies that deviate from approved technical concepts often remain unclear. This is a problem, as users run the risk of losing invested money in case the respective cryptocurrency is unable to provide sufficient security. In this paper, we underpin this statement by means of a detailed analysis of the cryptocurrency FirstCoin. We identify and discuss vulnerabilities of FirstCoin, which lead to a low network hash rate and allow for 51% attacks. We propose a double-spending attack that exploits these vulnerabilities and demonstrate the proposed attack's feasibility by running it in an isolated evaluation environment. This way, we show FirstCoin to be insecure and provide a real-world example that underpins the general problem of cryptocurrencies deviating from approved security concepts and relying on weak security designs.
LanguageEnglish
Title of host publicationICT Systems Security and Privacy Protection
EditorsLech Jan Janczewski, Miroslaw Kutylowski
Place of PublicationCham
PublisherSpringer International Publishing AG
Pages127-140
Number of pages14
ISBN (Print)978-3-319-99828-2
DOIs
StatusPublished - 2018
Event
33rd IFIP TC-11 SEC 2018 International Conference on Information Security and Privacy Protection
- Poznań, Poland
Duration: 18 Sep 201820 Sep 2018

Publication series

NameIFIP Advances in Information and Communication Technology
Volume529

Conference

Conference
33rd IFIP TC-11 SEC 2018 International Conference on Information Security and Privacy Protection
Abbreviated titleIFIP SEC 2018
CountryPoland
CityPoznań
Period18/09/1820/09/18

Fingerprint

Electronic money

Cite this

Marsalek, A., Kollmann, C., & Zefferer, T. (2018). A Security Analysis of FirstCoin. In L. J. Janczewski, & M. Kutylowski (Eds.), ICT Systems Security and Privacy Protection (pp. 127-140). (IFIP Advances in Information and Communication Technology; Vol. 529). Cham: Springer International Publishing AG . https://doi.org/10.1007/978-3-319-99828-2_10

A Security Analysis of FirstCoin. / Marsalek, Alexander; Kollmann, Christian; Zefferer, Thomas.

ICT Systems Security and Privacy Protection. ed. / Lech Jan Janczewski; Miroslaw Kutylowski. Cham : Springer International Publishing AG , 2018. p. 127-140 (IFIP Advances in Information and Communication Technology; Vol. 529).

Research output: Chapter in Book/Report/Conference proceedingConference contributionResearchpeer-review

Marsalek, A, Kollmann, C & Zefferer, T 2018, A Security Analysis of FirstCoin. in LJ Janczewski & M Kutylowski (eds), ICT Systems Security and Privacy Protection. IFIP Advances in Information and Communication Technology, vol. 529, Springer International Publishing AG , Cham, pp. 127-140, Poznań, Poland, 18/09/18. https://doi.org/10.1007/978-3-319-99828-2_10
Marsalek A, Kollmann C, Zefferer T. A Security Analysis of FirstCoin. In Janczewski LJ, Kutylowski M, editors, ICT Systems Security and Privacy Protection. Cham: Springer International Publishing AG . 2018. p. 127-140. (IFIP Advances in Information and Communication Technology). https://doi.org/10.1007/978-3-319-99828-2_10
Marsalek, Alexander ; Kollmann, Christian ; Zefferer, Thomas. / A Security Analysis of FirstCoin. ICT Systems Security and Privacy Protection. editor / Lech Jan Janczewski ; Miroslaw Kutylowski. Cham : Springer International Publishing AG , 2018. pp. 127-140 (IFIP Advances in Information and Communication Technology).
@inproceedings{ad31b0bc41c0484e8115c292f94a3558,
title = "A Security Analysis of FirstCoin",
abstract = "Supported by the current hype on Bitcoin, the number of available cryptocurrencies has steadily increased over the past years. Currently, relevant portals list more than 1.500 cryptocurrencies. Many of them slightly deviate from approved and tested technical concepts and realize security-related functionality in different ways. While the security of major cryptocurrencies has already been studied in more detail, security properties of less popular cryptocurrencies that deviate from approved technical concepts often remain unclear. This is a problem, as users run the risk of losing invested money in case the respective cryptocurrency is unable to provide sufficient security. In this paper, we underpin this statement by means of a detailed analysis of the cryptocurrency FirstCoin. We identify and discuss vulnerabilities of FirstCoin, which lead to a low network hash rate and allow for 51{\%} attacks. We propose a double-spending attack that exploits these vulnerabilities and demonstrate the proposed attack's feasibility by running it in an isolated evaluation environment. This way, we show FirstCoin to be insecure and provide a real-world example that underpins the general problem of cryptocurrencies deviating from approved security concepts and relying on weak security designs.",
author = "Alexander Marsalek and Christian Kollmann and Thomas Zefferer",
year = "2018",
doi = "10.1007/978-3-319-99828-2_10",
language = "English",
isbn = "978-3-319-99828-2",
series = "IFIP Advances in Information and Communication Technology",
publisher = "Springer International Publishing AG",
pages = "127--140",
editor = "Janczewski, {Lech Jan} and Miroslaw Kutylowski",
booktitle = "ICT Systems Security and Privacy Protection",
address = "Switzerland",

}

TY - GEN

T1 - A Security Analysis of FirstCoin

AU - Marsalek, Alexander

AU - Kollmann, Christian

AU - Zefferer, Thomas

PY - 2018

Y1 - 2018

N2 - Supported by the current hype on Bitcoin, the number of available cryptocurrencies has steadily increased over the past years. Currently, relevant portals list more than 1.500 cryptocurrencies. Many of them slightly deviate from approved and tested technical concepts and realize security-related functionality in different ways. While the security of major cryptocurrencies has already been studied in more detail, security properties of less popular cryptocurrencies that deviate from approved technical concepts often remain unclear. This is a problem, as users run the risk of losing invested money in case the respective cryptocurrency is unable to provide sufficient security. In this paper, we underpin this statement by means of a detailed analysis of the cryptocurrency FirstCoin. We identify and discuss vulnerabilities of FirstCoin, which lead to a low network hash rate and allow for 51% attacks. We propose a double-spending attack that exploits these vulnerabilities and demonstrate the proposed attack's feasibility by running it in an isolated evaluation environment. This way, we show FirstCoin to be insecure and provide a real-world example that underpins the general problem of cryptocurrencies deviating from approved security concepts and relying on weak security designs.

AB - Supported by the current hype on Bitcoin, the number of available cryptocurrencies has steadily increased over the past years. Currently, relevant portals list more than 1.500 cryptocurrencies. Many of them slightly deviate from approved and tested technical concepts and realize security-related functionality in different ways. While the security of major cryptocurrencies has already been studied in more detail, security properties of less popular cryptocurrencies that deviate from approved technical concepts often remain unclear. This is a problem, as users run the risk of losing invested money in case the respective cryptocurrency is unable to provide sufficient security. In this paper, we underpin this statement by means of a detailed analysis of the cryptocurrency FirstCoin. We identify and discuss vulnerabilities of FirstCoin, which lead to a low network hash rate and allow for 51% attacks. We propose a double-spending attack that exploits these vulnerabilities and demonstrate the proposed attack's feasibility by running it in an isolated evaluation environment. This way, we show FirstCoin to be insecure and provide a real-world example that underpins the general problem of cryptocurrencies deviating from approved security concepts and relying on weak security designs.

U2 - 10.1007/978-3-319-99828-2_10

DO - 10.1007/978-3-319-99828-2_10

M3 - Conference contribution

SN - 978-3-319-99828-2

T3 - IFIP Advances in Information and Communication Technology

SP - 127

EP - 140

BT - ICT Systems Security and Privacy Protection

A2 - Janczewski, Lech Jan

A2 - Kutylowski, Miroslaw

PB - Springer International Publishing AG

CY - Cham

ER -