Apart from creating a billion-dollar worth of cryptocurrency ecosystem, Bitcoin revolutionized the whole domain of cryptocurrencies, and it largely influenced many other application areas (e.g., healthcare, supply-chain management, real estate) with its underlying technologies such as blockchain, consensus algorithms, and decentralized data management. Due to the reasons mentioned above, Bitcoin has attracted massive attention from the research community. Since its launch in 2009, the Bitcoin market capital has grown significantly, and it is now worth approximately 887 billion dollars. This huge and rapid growth is one of the key motivations for malicious entities to identify and exploit weaknesses to disrupt its normal functionality for financial reasons, and the same is also a reason for the researchers to discover and provide patches or solutions for the identified security- and privacy-related vulnerabilities in the system. Most of these security and privacy threats are on the critical underlying technologies of Bitcoin; thus, they are also valid for other Bitcoin-like cryptocurrencies. This chapter starts with an overview of the Bitcoin system by explaining the working methodology and interactions between its various building blocks. In the process, we conclude Bitcoin’s fundamental features and underlying structures and provide insights at the core of the Bitcoin protocol and its networking infrastructure. We also discuss the significant security and privacy threats to the Bitcoin system and the countermeasures proposed in the state of the art.

While user authentication happens before initiating or resuming a login session, de-authentication detects the absence of a previously-authenticated user to revoke her currently active login session. The absence of proper de-authentication can lead to well-known lunchtime attacks, where a nearby adversary takes over a carelessly departed user's running login session. The existing solutions for automatic de-authentication have distinct practical limitations, e.g., extraordinary deployment requirements or high initial cost of external equipment. In this paper, we propose 'DE-authentication using Ambient Light sensor' (DEAL), a novel, inexpensive, fast, and user-friendly de-authentication approach. DEAL utilizes the built-in ambient light sensor of a modern computer to determine if the user is leaving her work-desk. DEAL, by design, is resilient to natural shifts in lighting conditions and can be configured to handle abrupt changes in ambient illumination (e.g., due to toggling of room lights). We collected data samples from 4800 sessions with 120 volunteers in 4 typical workplace settings and conducted a series of experiments to evaluate the quality of our proposed approach thoroughly. Our results show that DEAL can de-authenticate a departing user within 4 seconds with a hit rate of 89.15% and a fall-out of 7.35%. Finally, bypassing DEAL to launch a lunchtime attack is practically infeasible as it requires the attacker to either take the user's position within a few seconds or manipulate the sensor readings sophisticatedly in real-time.

Initially designed to represent ownership of various assets, Non-Fungible Tokens (NFTs) have emerged as a new tool in the blockchain domain for investment and trading. The NFT markets are rapidly budding with significant growth in trading volumes over the last few years. While the NFT ecosystem is continuously evolving, users are exploring astute trading practices to gain financial profits. In this paper, we uncover shill looping, a novel NFT trade practice that NFT owners can exploit to artificially inflate the price of an NFT token. We investigate shill looping and its primary effects in a multi-billion dollar NFT collection called BAYC, showing that approximately 50% of these NFTs exhibit shill looping. Our empirical analysis shows that shill looping significantly boosts the average NFT values by over 45% in the best case. Our initial results highlight the severeness of the shill looping phenomenon and open a new research direction for further exnloration.

Learning useful representations from unstructured data is one of the core challenges, as well as a driving force, of modern data-driven approaches. Deep learning has demonstrated the broad advantages of learning and harnessing such representations.In this paper, we introduce a deep generative model representation learning approach for password guessing. We show that an abstract password representation naturally offers compelling and versatile properties that open new directions in the extensively studied, and yet presently active, password guessing field. These properties can establish novel password generation techniques that are neither feasible nor practical with the existing probabilistic and non-probabilistic approaches. Based on these properties, we introduce: (1) A general framework for conditional password guessing that can generate passwords with arbitrary biases; and (2) an Expectation Maximization-inspired framework that can dynamically adapt the estimated password distribution to match the distribution of the attacked password set.

In recent years, the usage model of the Internet has changed, pushing researchers towards the design of the Information-Centric Networking (ICN) paradigm as a possible replacement of the existing architecture. Even though both Academia and Industry have investigated the feasibility and effectiveness of ICN, achieving the complete replacement of the Internet Protocol (IP) is a challenging task: (i) the process involves multiple parties, such as Internet Service Providers (ISPs), that need to coordinate among each other; (ii) it requires an indefinite amount of time to update hardware and software of network components; and (iii) it is a high risk goal that might introduce unexpected complications. Thus, the process of replacing the current Internet will inevitably lead towards a period of coexistence between the old and the new architectures. Given the urgency of the problem, this transition phase will happen very soon and people should address it in a smooth way. Some research groups have already addressed the coexistence by designing their own architectures, but none of those is the final solution to move towards the future Internet considering the unaltered state of the networking. To design such architecture, the research community needs now a comprehensive overview of the existing solutions that have so far addressed the coexistence. The purpose of this paper is to reach this goal by providing the first comprehensive survey and classification of the coexistence architectures according to their features (i.e., deployment approach, deployment scenarios, addressed coexistence requirements and additional architecture or technology used) and evaluation parameters (i.e., challenges emerging during the deployment and the runtime behaviour of an architecture). We believe that this paper will finally fill the gap required for moving towards the design of the final coexistence architecture.