Facebook to man barricades against Libra hackers

Each major bank in the US, and Australia, spends hundreds of millions of dollars every year on cyber security, and the cost of defending systems has been soaring in recent years as criminals get more sophisticated.

“Trust will be very important [for Facebook]", said Tom Leighton, the CEO of Akamai Technologies, who was visiting Australia this week to talk about the future of security in banks. "There are powerful adversaries looking to exploit vulnerabilities, and the risks are increasing as the adversaries are becoming more capable.” All of Amercia's top 25 banks, and several in Australia, use Akamai to defend their systems.

Christopher Ott, a cyber security partner at law firm Davis Wright Tremaine in Washington, DC, said Libra could face 'denial of service' (DDOS) attacks against its public-facing blockchain "nodes", as criminals try to bring down the network.

Complementary security

"They are going to have to build up several complementary security infrastructures," he said. "It will require constant security investment and development. After all, the threats will continue to adapt and change."

US legislators are expected to quiz Facebook executives on cyber security when the company appears before the Senate Banking Committee in mid-July. "Regulators should see this as a wake-up call to get serious about the privacy and national security concerns, cyber security risks, and trading risks that are posed by cryptocurrencies," Maxine Waters, chair of the US House Financial Services Committee, said on Tuesday.

In the technical material released this week, Facebook said the architecture of the blockchain was more secure than existing networks. The "strong and distributed infrastructure will increase resiliency and ensure validator nodes are not subject to common influence or attack," it said. (Validator nodes are copies of the transaction ledger held by each member of the network.)

Facebook recognises the danger of a "double spending attack", where a malicious actor can trick somebody that they were paid. But it said the distributed system should limit the risk, because the "consensus mechanism", which governs how records are updated, requires more than one-third of the nodes to be compromised before a malicious party can change records.

"This will make it extraordinarily difficult for an attacker to compromise 33 separately run nodes that would be required to launch an attack against the system," said Facebook, which expects the network to have 100 members when it is launched in the first half of next year.

Nevertheless, it said the Libra Association was working on response plans for potential attacks, including "the exceptionally unlikely scenario that one-third of the validator nodes behave maliciously" and change the system's protocols (an event known as a "fork").

"This strategy would involve temporarily halting the processing of transactions from the Libra Reserve, determining the extent of the damage from the attack, and publishing a recommendation as to how software updates should be applied to resolve the fork," Facebook said.

"The association will also prepare strategies for other scenarios, such as the discovery of software vulnerabilities."

The cost of protecting the system could be met from the income earned from investing the reserves that back Libra.

DDOS risk

Separately to attackers trying to overtake the blockchain to steal Libra, the system could face 'denial of service' (DDOS) attacks, where malicious actors attempt to disrupt it by bringing it offline. This could be done by saturating its bandwidth, known as volume-based attacks; targeting servers and firewalls, known as protocol attacks; or trying to crash the web server with massive requests, known as application layer attacks.

Facebook said it was planning to attach a small fee to transactions to protect it from DDOS attacks.

Mr Ott said Facebook would need to invest in securing the network and its digital wallet. "It will need to build robust features into its Calibra wallet, build security features into the interactions amongst the coalition nodes, and build in policies, principles and procedures for others to build upon the Libra blockchain algorithm," he said.

Rolling Calibra out to bricks and mortar stores, and offering it on Messenger and WhatsApp, will present additional security risks, he said.

"They will need to explore the risks of deploying wallet functionality at brick and mortar point of sale locations, and as the Facebook wallet is deployed amongst various existing Facebook platforms, they will have to ensure that there are no critical weaknesses as the platforms interact."

Exchanges that will facilitate the transfer of fiat currencies into Libra also present a vulnerability. While the bitcoin blockchain has shown itself to be highly secure after a decade of operation, some exchanges that move fiat money in and out of bitcoin and store bitcoin have been the subject of cyber attacks, including the infamous Mt Gox breach, where hundreds and thousands of bitcoins were stolen in 2014, leading to the exchange's collapse.

Software vulnerability

Another vulnerability is the software. While the hardware will be distributed, it is likely the same software will be run across the system - a security risk recognised by Facebook. It says risks will be reduced using the "Rust" programming language, an 'Edwards-curve Digital Signature Algorithm' for its public-key cryptography, and "noise" to prevent the nodes impersonating each other.

Mr Ott said blockchain technology should be an improvement on SWIFT, after banks were compromised when the APT 38 group used malware to exploit the changeability of SWIFT records held by thse banks. After the end user was targeted by hackers, they were allowed to access to user passwords through which they could access SWIFT’s messaging system to facilitate unauthorised transactions.

The Libra network "cannot be hacked in this way," he said. "The records are public and unchangeable. Therefore, under the Libra system, both the public and the involved vendors should be able to immediately notice and halt the activities."

Kevin Weil, the vice-president of product for Calibra, told The Australian Financial Review Facebook was taking security and privacy very seriously.

"If you lose your phone or password, or even if your Facebook account gets compromised, it has to be the case that your money inside Calibra stays safe, so we are implementing things like multi-factor authentication and other technologies to make sure that is true,” he said.