Free Blockchain Security Training Blockchain Network-Level Attacks Questions and Answers — Questions and Answers
Question 1: An attacker targets a specific mining node by gaining control of its router. They ensure all of the node's outgoing peer connections are exclusively established with malicious nodes controlled by the attacker. The victim's node continues to operate but only sees a fraudulent version of the blockchain. What type of network-level attack is this?
- BGP Hijacking
- Eclipse Attack (Correct answer)
- Sybil Attack
- DDoS Attack
Correct answer: Eclipse Attack
An Eclipse attack isolates a specific node from the legitimate network by controlling all of its peer connections. This allows the attacker to filter the node's view of the blockchain, potentially leading to double-spending or selfish mining attacks against that specific victim.
Question 2: Which of the following best describes how a BGP (Border Gateway Protocol) hijacking attack can be used to disrupt a blockchain network?
- By creating a large number of pseudonymous nodes to outvote honest participants.
- By altering the transaction ID of a broadcasted transaction before it is mined.
- By maliciously re-routing internet traffic intended for major nodes or mining pools to a location controlled by the attacker. (Correct answer)
- By manipulating a node's internal clock to make it reject valid blocks from the network.
Correct answer: By maliciously re-routing internet traffic intended for major nodes or mining pools to a location controlled by the attacker.
BGP hijacking is a routing attack where an attacker falsely advertises ownership of IP prefixes they do not control. This can redirect internet traffic, allowing the attacker to intercept or blackhole data intended for key blockchain participants like large mining pools, effectively partitioning them from the network.
Question 3: A network attacker successfully manipulates the Network Time Protocol (NTP) responses received by a blockchain node, causing its system clock to be significantly skewed. The node begins rejecting new, valid blocks because their timestamps appear to be too far in the future according to its incorrect local time. This attack is known as:
- A Finney Attack
- Timestamp Grinding
- A Long-Range Attack
- Timejacking (Correct answer)
Correct answer: Timejacking
Timejacking involves manipulating a node's perception of time, typically by attacking its time source (like NTP). By skewing the node's clock, an attacker can cause it to reject valid blocks or accept invalid ones by exploiting the timestamp rules within a blockchain's protocol.
Question 4: A large, public blockchain network experiences a sudden degradation in performance. Investigation reveals that a significant number of publicly accessible full nodes are being flooded with an overwhelming volume of garbage P2P messages and transaction requests, consuming their bandwidth and CPU. This prevents them from relaying valid transactions and blocks. What is the most likely network-level attack occurring?
- Distributed Denial-of-Service (DDoS) Attack (Correct answer)
- Selfish Mining
- Eclipse Attack
- Transaction Malleability
Correct answer: Distributed Denial-of-Service (DDoS) Attack
A Distributed Denial-of-Service (DDoS) attack aims to make a network resource unavailable. In this scenario, attackers are overwhelming the blockchain nodes with junk traffic, consuming their resources (CPU, bandwidth) and preventing them from performing their essential functions of validating and propagating legitimate network data.
Question 5: Which of the following accurately describes a transaction malleability attack at the network level?
- An attacker intercepts a transaction and resubmits it with a higher fee to get it mined first.
- An attacker modifies the digital signature of a valid, unconfirmed transaction in a way that changes the transaction ID (TXID) but not the fundamental validity of the transfer. (Correct answer)
- An attacker floods a node with invalid transactions, causing it to waste computational resources.
- An attacker isolates a node from the network and feeds it a false version of the blockchain.
Correct answer: An attacker modifies the digital signature of a valid, unconfirmed transaction in a way that changes the transaction ID (TXID) but not the fundamental validity of the transfer.
Transaction malleability exploits the fact that in some protocols, a transaction's signature can be altered without invalidating it. This alteration, however, changes the transaction's unique ID (TXID). An attacker can use this to cause confusion, for example, making it appear as though a payment was never confirmed by referencing the original TXID.
Question 6: A sophisticated actor physically disrupts the primary undersea fiber optic cables connecting two continents. For several hours, blockchain nodes in Region A can only communicate with other nodes in Region A, and nodes in Region B can only communicate with other nodes in Region B. What is the most direct consequence of this network partitioning attack?
- All transactions will fail globally until the connection is restored.
- The network will fork into two separate, valid chains that will need to be reconciled when connectivity is restored. (Correct answer)
- The total network hashrate will be permanently reduced by 50%.
- A single mining pool will immediately gain control of the entire network.
Correct answer: The network will fork into two separate, valid chains that will need to be reconciled when connectivity is restored.
A network partition splits the blockchain network into two or more isolated segments. Each segment will continue to operate independently, mining blocks and adding them to its local version of the chain. This results in a temporary blockchain fork. When connectivity is restored, the network protocol must resolve the fork, typically by discarding the blocks on the shorter or less-work chain.
Free Blockchain Security Training Blockchain Network-Level Attacks Questions and Answers
An attacker targets a specific mining node by gaining control of its router.
They ensure all of the node's outgoing peer connections are exclusively established with malicious nodes controlled by the attacker.
The victim's node continues to operate but only sees a fraudulent version of the blockchain.
What type of network-level attack is this?