Evil Chaincode: APT Attacks Based on Smart Contract

In this paper, we discuss methods of stealing data via advanced persistent threat (APT) attacks on blockchains. Blockchain technology is generally used for storing data and digital coins and counts more than 562 organizations among its users. Smart contracts, as a key part of blockchain technology, are used for blockchain programmability. APT attacks are usually launched by government-backed hackers to steal data. APT attacks build hidden Command and Control (C&C) channels to steal resources remotely. Smart contracts represent a vulnerability of blockchain technology to APT attacks because of their sandbox-style open execution environment. Therefore, we performed several attack experiments to test methods of abusing smart contracts, including the remote execution of commands, and the stealing of large amounts of data. These experiments demonstrated that APT attacks could be successfully executed on a blockchain platform. In the large-scale data-stealing experiments, we found that the transmission rate for a maximum target data size of 100 MB can reach 27.771 MB/s, faster than the average rate of approximately 100 kB/s of a three-layer network proxy. We also investigated APT attacks based on public APT events, which use hidden techniques to steal data as critical APT attack actions. We propose several attack algorithms that can be applied for APT attacks.