2. The views expressed in this presentation are Mere Apne.
Reference to any specific products, process ,or service do not
necessarily constitute or imply endorsement, recommendation, or
views of Min of Def or any Govt All images used are for
illustrative purposes only & Do not promote any specific
product
3. This PRESENTATION is not going to make anyone of you a
BITCOIN FORENSIC EXPERT INVESTIGATOR BUT may only LEND you few
TERMS OF REFERENCES to build upon and EXPLORE further
4. Presented by Anupam Tiwari
5. Paap se Dharti phati-phati-phati, Adharm se aasmaan,
Atyachaar se kaanpi Insaaniyat, Raj kar rahe Haivaan ... Jinki hogi
taqat apoorv, Jinka hoga nishana abhed, Joh karenge inka sarvanaash
... .woh kehlayenge Tridev
6. Name used by the unknown person who designed BITCOIN and
created its original reference implementation SATOSHI NAKAMOTO
,
7. AS OF 07TH OCT 2017 1 BITCOIN IS WORTH 4356 $ SO 1 BITCOIN
IS 2,85,079/- SOURCE :
https://blockchain.info/charts/n-transactions
9. ANONYMITY VS PSEUDONYMITY Mark TwainSamuel Clemens public
key addresses similar in function to an email address, are used to
send and receive Bitcoins and record transactions, as opposed to
personally identifying information.
10. CRYPTOCURRENCY IS AN ATTEMPT TO BRING BACK A DECENTRALISED
CURRENCY OF PEOPLE, ONE THAT IS NOT SUBJECT TO INFLATIONARY MOVES
BY A CENTRAL BANK
11. Bitcoin is starting to come into its own as a Digital
Currency, but the Blockchain Technology behind it could prove to be
much more SIGNIFICANT
12. More DETAILS a Forensic Investigator KNOWS about the TECH
ARCHITECTURE, the CLOSER he gets to CLOSE the CASE
13. BASICALLY CHUNKS OF INFO THAT CAN BE USED TO MATHEMATICAL
GUARANTEE ABOUT MESSAGES
14. Peer-to- Peer (P2P) network is created when two or more PCs
are connected & share resources without going through a
separate server computer
15. Distributed Ledger is a Consensus of Replicated, Shared
& Synchronized digital data geographically spread across
multiple sites & countries
16. Type of Distributed Ledger, comprised of Unchangeable,
Digitally Recorded Data in packages called BLOCKS TAMPER EVIDENT
LEDGER
17. MERKLE TREE
18. Linked list data structure, with each block containing a
hash of the previous block
19. Proof Of Work Is A Piece Of Data Which Is Difficult To
Produce But Easy For Others To Verify And Which Satisfies Certain
Requirements Bitcoin Uses The Hashcash Proof Of Work System. PROOF
OF WORK
20. Each block is formed by a proof-of- work algorithms,
through which consensus of this distributed system could be
obtained via the longest possible chain
21. https://anders.com/blockchain/blockchain.html
22. Thus blockchain provides the basis for the TRUSTLESS
DISTRIBUTED SYSTEM
23. A block is an aggregated set of data Data is collected and
processed to fit in a block through a process called MINING Each
block could be identified using a Cryptographic Hash
24. Mining is the process of writing pages (blocks) of Bitcoin
transactions into the The Bitcoin Blockchain, and getting rewarded
with newly created bitcoins
25. Block will contain a hash of the previous block, so that
blocks can form a chain from the first block ever (known as the
Genesis Block) to the formed block
26. FIRST BLOCK : GENESIS
27. Every 10 minutes, all Bitcoin transactions taking place are
bundled into a block These blocks linked through a timestamp
signing, form a chain (blockchain), which goes back to the first
block ever created (mined) The time stamping makes it impossible to
alter any part of it once the network confirms it
28. These rules are inbuilt in the Bitcoin core software, which
every node in the Bitcoin network runs Before a new block is added
to the blockchain, the Bitcoin network has to reach a consensus on
based on predetermined rules
29. Data in a blockchain is internally consistent and immutable
Each blocks hash is derived from the contents of the block Each
block refers to the previous blocks hash, not a sequential
number
30. THE LAST BITCOIN (PROBABLY 21 MILLIONTH COIN) WILL BE MINED
IN THE YEAR 2140
31. 206 , 1670 ... . SHA .
32. BITCOIN MINING
33. A reward system, in the form of a website or app, that
dispenses rewards in the form of a satoshi, for visitors to claim
in exchange for completing a captcha or task as described by the
website. SATOSHI : 1/100th of a Millionth BITCOIN
34. A user for CONDUCTING TRANSACTIONS utilizing BITCOIN, he or
she must first DOWNLOAD and setup a BITCOIN WALLET BITCOIN WALLET
can show the total BALANCE of all BITCOINS it CONTROLS and let A
USER PAY a specified AMOUNT
35. WALLET contains a USERS PRIVATE KEY, which ALLOWS FOR THE
SPENDING of the BITCOINS, which are located in the BLOCK CHAIN Once
wallet is INSTALLED & CONFIGURED, an ADDRESS is GENERATED which
is SIMILAR to an E-MAIL or PHYSICAL ADDRESS
36. WALLET is basically the Bitcoin Equivalent of a Bank
account. Allows to RECEIVE BITCOINS, them, and then SEND them to
others
37. Connected to the Internet or is online is said to be HOT
Cold Wallets & Hot Wallets Cold is considered most Secure &
suitable for Storing Large Amounts of bitcoins Hot is suitable for
Frequently Accessed funds COLD implies it is Offline or
Disconnected from the Internet
38. Designedto be downloaded & used on Laptops/PCs
DESKTOPWALLETS Armory, Multibit, Msigna and Hiveto mention a FEW
Easyto Access. Available for Different OS Windows, Mac OS and
Ubuntu.
39. MOBILEWALLETS
40. ONLINEWEBWALLETS
41. PHYSICALWALLETS Once they are generated, you print them out
on a piece of paper Paper Wallets can Securely hold your BITCOINS
in Cold Storage form for a long time Bitaddress.org or
Blockchain.info
42. BitcoinQt is the First ever built bitcoin CLIENT WALLET
BITCOINCLIENTS WALLETS Original bitcoin wallet used by the Pioneers
of the currency COMPUTERS installed with these wallets FORM PART OF
THE CORE NETWORK & have access to all transactions on the
blockchain
43. HARDWAREWALLETS
44. BITCOIN ARTIFACTS
45. They DONT EXIST ANYWHERE, even on a hard drive
46. When we say SOMEONE HAS BITCOINS & you look at a
PARTICULAR BITCOIN ADDRESS, there are NO DIGITAL BITCOINS held
AGAINST that ADDRESS BALANCE of any BITCOIN address ISNT HELD at
that ADDRESS; one MUST RECONSTRUCT it by looking at the
BLOCKCHAIN
47. Everyone on the NETWORK knows about a TRANSACTION and THE
HISTORY OF A TRANSACTION can be TRACED BACK to the point where the
BITCOINS were produced
48. Conduct a SEARCH based on BLOCK NUMBER, ADDRESS, BLOCK
HASH, TRANSACTION HASH or PUBLIC KEY
49. SOURCE : https://blockchain.info/ip-log
50. LOCK FILE DEBUG.LOG PEERS.DAT WALLET.DAT BITCOIN-QT FOLDER
STRUCTURE DB LOCK FILE EXTENSIVE LOGGING FILE PEER INFORMATION
STORAGE FOR KEYS,TXN,METADATA etc
51. BITCOIN-QT FOLDER STRUCTURE
52. BITCOIN-BLOCK FOLDER ANALYSIS
53. BITCOIN-QT FOLDER STRUCTURE Blocks This subdirectory
contains blockchain data and contains a blk.dat file and a
blocks/index subdirectory blk.dat stores actual Bitcoin blocks
dumped in raw format The blocks/index subdirectory is a database
that contains metadata about all known blocks
54. Chainstate subdirectory- it is a database with a compact
representation of all currently unspent transactions and some
metadata about where the transactions originated BITCOIN-QT FOLDER
STRUCTURE
56. 1.46 10^48 possible Bitcoin Addresses that gives every
person on Earth 2.0510^38 Different Addresses
57. Bitcoin Mixer is an Anonymous Service, that confuses the
trails of Bitcoin transactions.
58. PROJECT TITANIUM : Main thrust of the European Unions
Titanium Project is to Monitor blockchains, deanonymize wallet
addresses, surveil dark net markets, and block terrorists and money
launderers. TITANIUM, which stands for Tools for the Investigation
of Transactions in Underground Markets
59. Private key of the suspect, they can search for that
particular key on the Blockchain to Trace the purchases to other
potential Suspects. investigator has the Bitcoin
60. Detecting such attackers is CHALLENGING any day Attacking
Bitcoin via the Internet infrastructure using routing attacks As
Bitcoin connections are routed over the Internetin clear text and
without integrity checksany third-party can eavesdrop, drop,
modify, inject, or delay Bitcoin messages
61. BITCOIN FORENSIC ARTIFACT EXAMINATION Windows 7
Professional Multibit Bitcoin-Qt Bitminter Basic USB ASIC Bitcoin
Gateway laptop ML6720 120 GB WD hard drive (4) USB ASIC Mining
drives USB powered cooling fan 32 GB USB thumb drive
62. System Info Info about Logged users Registry Info Remnants
of Chats Web browsing Activities Recent Communications Info from
Cloud Services Decryption Keys for encrypted volumes mounted
COLLECTION OF BITCOIN ARTIFACTS
63. Utilizing the data from 344 transactions, Meiklejohn able
to identify the owners of more than a million Bitcoin addresses
Sarah Meiklejohn, a Bitcoin focused Computer Researcher Extensive
Research in Bitcoin Blockchain Found that by looking blockchain an
investigator can uncover who owns a Bitcoin addresses
64. 2015 In this paper we show that combining TOR and BITCOIN
creates an ATTACK VECTOR for the stealthy man-in-the-middle
attacks. A LOW- RESOURCE ATTACKER gain FULL CONTROL of information
flows between all users who chose to use Bitcoin over TOR. In
particular the attacker CAN LINK TOGETHER USERS TRANSACTIONS
regardless of pseudonyms used
65. Bitcoin transactions occur via a Network Connection, an
investigator should seize any Physical Object that can connect to
the Internet in addition to the hard drive COLLECTION OF BITCOIN
ARTIFACTS
68. Source : Alex Biryuk et al., Deanonymisation of Clients in
Bitcoin P2P Network Bitcoin network is composed of PEERS connected
to others PEERS over unencrypted TCP channels Each peer attempts to
maintain EIGHT outgoing connections to other peers These eight
peers are called ENTRY NODES
69. Transaction and Block messages are propagated in network by
being Relayed through these ENTRY NODES to other peers When X sends
a transaction advertising that he is transferring ownership of 1
BTC to Y, his computer sends an inv message to its immediate peers,
the entry nodes
70. The inv message lets the entry nodes know that there are
transactions or blocks Entry nodes relay the data farther
throughout the network by sending inv to their own peers Entry
nodes request full transaction by sending getdata response to Xs
computer
71. SMART CONTRACTS are computer protocols that facilitate,
verify, or enforce the negotiation or performance of a CONTRACT, or
that make a contractual clause unnecessary. Smart contracts often
EMULATE the logic of contractual clauses.
72. "A system condition in which system resources are free from
unauthorized access and from unauthorized or accidental change,
destruction, or loss."
73.
74. Number of blocks preceding particular block on a block
chain. Genesis block has a height of zero because zero block
preceded it.
75. How difficult it is to find a block relative to the
difficulty of finding the easiest possible block. The easiest
possible block has a proof-of- work difficulty of 1. Difficulty is
changed every 2016 blocks based on the time it took to discover
2016 previous blocks.