Understanding Blockchain Penetration Testing

Bitcoin worth half a billion $USD was stolen from the World’s largest Bitcoin exchange in 2014. Approximately $USD 60 million worth of ether was redirected to an anonymous account via the Ethereum based decentralized autonomous organization (DAO). In 2017, the World’s 2nd largest successful attack for Bitcoin took place at the Bitfinex, the amount was nearly $USD 72 million.

Blockchain technology has revolutionized the way we work and live. With its unmatched potential, it has given us complete control over our financial transactions, healthcare and numerous other activities which earlier required more privacy and transparency. Blockchain technology has definitely given a new layer of security and improved efficiency to the digital business ecosystem.

Understand the blockchain

The buzzword ‘blockchain’ has created a flux over the digital ecosystem from the past few years. To understand, it is not only about cryptocurrency in fact it is a timestamped chain of immutable records called blocks that are linked cryptographically.

Blockchain is an openly distributed ledger that records the transactions for any digital asset. These digital assets can be managed either by the smart contracts (eg: ERC tokens) or core cryptocurrency of the blockchain network (eg: Bitcoin or Ethereum).

The blockchain network starts with the configuration of the ‘genesis’ block. As the name suggests ‘genesis’ is the very first block of the blockchain whose previous block hash is 0x000. More blocks are then added to the chain according to the consensus and configurations, such as block time, block size, etc.

Blocks, including transactions within, get validated and added to the chain, which can’t be modified at a later change. Any modification in the chain results in the creation of a new transaction, which makes it traceable. This is the basic functionality of a blockchain network.

What is blockchain penetrate testing?

Penetration Testing works with a mindset of a potential hacker, by effectively exploiting the coding errors. In simpler words, the tester themselves acts as the hacker and tries to break into the network to detect and report security loopholes. The overall time taken by a penetration tester depends upon the network size and the complexity of its architecture. Smaller tests are a matter of moments while the longer ones may take up to weeks. Some of the challenges that require blockchain penetration testing as a solution are:

• Lack of testing tools
• Insufficient knowledge
• Non-competent strategies
• Irreversible transactions
• Performance and load tests

Effective blockchain testing helps the organizations to build and utilize the technology securely with the connected infrastructure. The testing process comprises of core testing strategies and services, such as cloud testing services, functional testing, API testing, integration testing, security testing, and performance testing. It also includes blockchain specific testing strategies such as block testing, smart contract testing and peer/node testing.

Functional testing – This testing evaluates the case scenarios and business scenarios. The components considered by the testers are:

Size of the block & chain – Transactions at the most basic level are made of data that is composed of the transaction information itself, which takes up space. Though debatable, currently each block contains 1MB of data. This size needs to be checked and tested on a regular basis. Also, there is no limit to the size of the chain and it keeps on increasing with time. The testers need to test the functionality and the performance of the chain to keep it under check.

Addition of blocks – After the authentication of every single transaction, the testers validate the blocks and adds it to the chain. As discussed earlier that the chain cannot be altered, thus the validation of the blocks before addition makes it an extremely crucial process.

Data transmission – Blockchain involves a peer-to-peer architecture, which makes it essential for testers to validate the encryption and decryption of data and make it flawless. The objective is to ensure minimal or no data loss.

API testing – API testing is all about keeping a check on the interaction of the application with the blockchain ecosystem. This is done in order to validate the requests and responses sent by the API and make sure they are formatted and executed properly

Integration testing – The need for integration testing rises due to the deployment of blockchain testing across different environments and parallel systems. The testing is done to ensure that different components talk to each other seamlessly. The testing teams test the API to ensure that these APIs can be used during the validation phase.

Performance testing – Performance testing in blockchain determines the potential bottlenecks and checks whether the application is ready to be pushed to production or not. Test automation for determining the performance is the key to check the overall scalability of the blockchain.

Security testing – The object is to ensure that the blockchain applications are completely secured to attacks such as viruses and malicious programs. The security testing of blockchain needs to be extremely thorough and responsive. An ongoing transaction cannot be stopped and thus the testing process should be effective enough to uncover all potential threats. Effective security testing also helps in improving the company process to revoke faulty goods before the consumer is at risk, this helps in achieving digital quality assurance.

Find below some of the features leveraged by the different industries across the digital ecosystem:

• Healthcare – Medical verification and maintenance of records, processing of claims
• Retail – Mitigating frauds, privacy of consumer’s data
• Communication – Network access and controls, protection of mobile wallets
• Media – Anti piracy, payment methods, digital transfers
• Finance – Cross channel payments, security of commercial transactions
• Ensuring Smart Contracts
• Robust digital assurance solutions

This is a self-executing contract containing the agreement terms between the involved parties, written in the code lines. These contracts containing the code and agreement terms are then distributed over the decentralized blockchain network. Smart contracts allow trusted transactions amongst the anonymous parties without the presence of a central legal system.

Tools for blockchain penetration testing

It is equally important for a tester to choose the most appropriate blockchain pentesting tool in order to mitigate the vulnerabilities and deliver the best quality results. We strongly recommend the below-mentioned tools for testing blockchain-based applications:

The Truffle Framework – Truffle is one of the most preferred development environment and a testing framework for blockchain testing. Truffle provides easy lifecycle management for smart contracts including support for library linkings, custom deployment, and complex blockchain-based apps. Truffle also offers automated contract testing where developers can write their own automated test codes using JS and Solidity. Some of its salient features are:

• Immediate rebuilding of assets during development
• Configurable build pipeline with complete support for custom build processes
• Scriptable deployment & migrations framework
• Direct contract communication with interactive console

Embark – Embark offers a simple declarative approach to define which Smart Contracts are to be deployed, along with their dependencies.

Ethereum Tester – Offers manageable API support for various blockchain testing requirements. It aims to improve the user and developer’s experience and help them to manage and execute chosen tools with ease.

Populus – Testing here is powered by the python testing framework and provides useful utilities for testing the smart contracts.