VOLUME 56

   ISSUE 56

24 March  2016

Mike Hearn, a Zurich-based developer and long-time proponent of Bitcoin, surprised many this year when he published a blog calling Bitcoin a "failed" project. This has bought a lot of people wondering, is there any truth to this rumor. And what is Bitcoin.
In the last one day conference held by ISACA Sri Lanka Chapter, for the first time in our emerald island, the pros and cons of this new technology was spoken on.
Bitcoins is a crypto-currency, a system of digitally created and traded tokens to which value is assigned. (http://www.bbc.com/news/technology-35343561) Fundamentally this is an online currency where each Bitcoin is basically a computer file that is stored in a 'digital wallet'. Although most people refer to Bitcoin as a currency, it is worth noting that for regulatory reasons many countries - including the United States - have decided to define it as a commodity instead.
The online ledger book, which maintains the Debit and Credit of each transaction that uses bitcoin, is known as the Blockchain. Computers have to solve cryptographic problems in order to add blocks to the Blockchain - In return, those computers receive bitcoins in a process known as bitcoin "mining". Users have a "bitcoin address", to which bitcoins may be sent or from which they may be used. Addresses are stored online in wallets that function like bank accounts.

 

Copies of these ledgers are shared by all the computers that access them, meaning they are distributed across the network, because bitcoin is, at its core is a distributed database. Therefore fundamental to Bitcoin’s security is the ability for any single node to be able to audit everything which is going on by itself, using nothing more than the Blockchain, its own computational power, and a reasonably accurate clock.

Sir Mark Walport has argued that they could be used by government departments as a more secure way of managing data. Because the Blockchain act as permanent records of every time that data is added to them - and because private the Blockchain allow access to specific users only - they are thought to be highly resistant to malicious tampering.(http://www.bbc.com/news/technology-35344843)

The biggest issue most bitcoin users acknowledge is how quickly new transactions can be processed. The size of blocks being added to the Blockchain has been increasing steadily with the rise of Bitcoin. As a result, the rate at which transactions can be processed has been slowing. Indeed, some transactions face significant delays, hampering payments. Some fear the network will eventually become oversaturated and cease to be usable.

The reason for this is that this online ledger book has limit on number of transactions it can process. Currently, each block can be no more than 1MB. (http://www.bbc.com/news/technology-35343561) The supposed founder, Mr. Satoshi Nakamoto (who still remains an enigma), put a cap on the number of transactions that can be processed due to the inherent processing limitation that every standard computer has.

Now few of the core-programmers, of the bitcoin community, wants to remove this temporary ceiling. The reason they state is that it limits the number of transactions that can occur per minute. So they state that if they want Bitcoin to compete with the likes of VISA and MASTER, they feel the limiter should be removed.

The Bitcoin XT version developed by Mr. Hearn, and Bitcoin's chief scientist Gavin Andresen and others offers to increase the block size limit to 8MB

However bulks of the core-programmers do not want it removed. Bitcoin's history as a "decentralised" currency has led to much hesitation over decisions that might change its fundamental nature. Any proposal relating to Bitcoin is likely to encourage fierce debate and, in some cases, stagnation.

There are alternatives, however. Nic Cary, co-founder of Bitcoin start-up Blockchain, points to BitcoinClassic, which would increase the block size limit to 2MB. Mr Cary, says the need to update the block size limit is not as urgent as some say. "This is a matter of perspective," he told the BBC.

"The Bitcoin network has been updated safely dozens of times and will continue to be the most reliable, affordable, and efficient way to send value around the world."

Another school of thought on the reason for not wanting the removal of the limiter is they feel would eventually mean only few people with high processing mechanisms (such as server-farms) would be in control of the processing of bitcoin transactions (this is known as mining). So in return the idea that started the bitcoin, where it will not be controlled by a large corporate, would be doubtful. Thus resulting in few people running the show.
This resulted in the previous set of core-programmers wanting to open this debate to the public miners. Whereas the later set stated that this should have been discussed and settled internally not open to people who do not understand the computer-logic or the intricate understanding of what makes this online ledger a possibility. Because, they say that Bitcoin protocol development must be done with great care. For any widespread change which introduces even a slight incompatibility have a strong chance in resulting in there being two separate and incompatible currencies.

However, there are some who feel that Bitcoin's potential as a currency has already been exhausted.
"I'm sure there are smart people right now working out what the next generation [of Bitcoin] should look like but I have to say I'm not convinced that money or payments is the optimum [use] of the technology," Dave Birch, a director at consultancy firm Consult Hyperion, told the BBC.

So much so UK 's chief scientific adviser has urged the government to adopt the technology that powers crypto-currency Bitcoin to run various public service.
Sir Mark Walport has argued that they could be used by government departments as a more secure way of managing data. Because the Blockchain act as permanent records of every time that data is added to them - and because private the Blockchain allow access to specific users only - they are thought to be highly resistant to malicious tampering.(http://www.bbc.com/news/technology-35344843)
Part of the problem was the lack of consensus over what Bitcoin was and how it should be used, he added.

So what is the conclusion? I think I could not have stated it better than Chris Baraniuk ,a Technology reporter for BBC “ There is still huge interest in developing both the currency and technologies based on the Blockchain idea of recording data. It seems unlikely the currency will collapse overnight. But it certainly looks as though fundamental questions over how Bitcoin works are now coming to a head. Whether the community that uses and supports Bitcoin will be able to come to a consensus on these matters remains to be seen. Mr. Hearn has lost faith in the project, of that there is no doubt. But many others are refusing to throw in the towel just yet.”

But a salient view that cropped up in the ISACA Sri Lanka chapter one day conference, as to the why have countries an issue with welcoming the crypto-currency as a viable option for the mode of currency (such as the case in VISA, MasterCard or even PayPal) is the lack in a single body that acts as a regulator to this new technology. Even though there exist advantage that this form of digital currency has over normal currency, such as theft, hard to forge a transaction and less cost, the deregulatory aspect of this currency still keeps regulators at bay

KUMAR MANTHRI
Assistant Manager – IS Audit
SJMS Associates | Independent Correspondent Firm to Deloitte Touche Tohmatsu


For more information on the crypto-currency event that was organized by ISACA Sri Lanka Chapter please visit www.isaca.lk or the ISACA Sri Lanka Chapter Facebook page at www.facebook.com/isaca.srilanka.  www.facebook.com/isaca.srilanka.
 

References

Documents with malicious macros deliver fileless malware to financial-transaction systems

"...Spammed Word documents with malicious macros have become a popular method of infecting computers over the past few months. Attackers are now taking it one step further by using such documents to deliver fileless malware that gets loaded directly in the computer's memory.

Security researchers from Palo Alto Networks analyzed a recent attack campaign that pushed spam emails with malicious Word documents to business email addresses from the U.S., Canada and Europe....."

'...Android Marcher Trojan was first seen in 2013 scamming users for credit card information by prompting fake Google Play store payment page. In subsequent years, Marcher variants also started targeting banking applications by presenting fake login pages to steal user credentials.

Marcher has continued to stay active and was recently covered by phishlabs. In this blog, we will cover a new wave of Marcher Trojan that is active since past one month where the malware arrives as an adobe flash installer package. We have captured over 50 unique payloads from this campaign. Majority of these Marcher payloads are from pornographic sites serving fake adobe flash player for watching porn. The primary goal of this malware is still the same - display a fake Google Play store payment page and steal financial information from the user....'

CLOUD GIANT AMAZON WEB SERVICES TURNS 10

'....Amazon Web Services launched its first true cloud computing product, Simple Storage Services, 10 years ago today, turning the computing world on its head.

To the company’s early customers, “the cloud” was essentially a way to rent out storage on its data centers, hoping to find business from startups and established companies that found building out scalable data centers cost prohibitive......'

'....In a post-Valentine's Day attack the e-commerce site of 1-800-FLOWERS was accessed by an unauthorized person for more than a day during which time about 7,000 customers placing orders on the site may have had their personal and payment information compromised.

The online flower retailer said in a letter to the California Department of Justice that for a 33-hour period – stretching from the evening of Feb. 15 to early morning on Feb. 17 – an attacker collected the name, address, email address, payment card number along with its expiration date and CVV security code of all those placing or attempting to place orders on the site...'

'...nside the car's firmware update version 2.13.77, Mr. Hughes found a PNG image that depicted the logotype of a car model that Tesla doesn't yet sell, the P100D.

Currently, Tesla provides the P70D, the P85D, and P90D models, which come with 70KWh, 85kWh, and 90kWh batteries.

The logotype Mr. Hughes found inside the most recent firmware image means the company is preparing the car's source code for an upcoming model, one that features a 100kWh battery, and the image that Mr. Hughes found might be used in various sections of the vehicle's on-board digital display.....'