Authors:
Dominik Ziegler
1
;
Bernd Prünster
2
;
Marsalek Alexander
2
and
Christian Kollmann
3
Affiliations:
1
Know-Center GmbH, Graz and Austria
;
2
Institute for Applied Information Processing and Communications (IAIK), Graz University of Technology, Graz and Austria
;
3
A-Sit Plus GmbH, Vienna and Austria
Keyword(s):
Device Authorisation, Android, Cryptocurrency, Mining, REST, App Integrity, Smartphone, Electroneum, Remote Attestation, Key Attestation.
Related
Ontology
Subjects/Areas/Topics:
Information and Systems Security
;
Secure Software Development Methodologies
;
Security and Privacy in Mobile Systems
;
Security and Privacy in Web Services
;
Security in Information Systems
;
Software Security
Abstract:
Mobile mining of cryptocurrencies, without relying on CPU-heavy computations, is a novel attempt to foster adoption of a token. However, this approach leaves room for attacks. In this paper, we perform a thorough analysis of Electroneum, one of the first cryptocurrencies to introduce a mobile mining process. We show that mobile mining, without relying on a consensus algorithm (e.g. Proof-Of-Work), is not feasible on current generation Android smartphones. We further demonstrate that the security mechanisms employed by Electroneum can be circumvented and that mobile mining can be exploited successfully. Based on this analysis, we discuss several practical countermeasures, which can be applied on smartphones to enforce device authorisation and prevent abuse.