Cryptocurrency isn’t private—but with know-how, it could be

There’s probably no such thing as perfect privacy and security online. Hackers regularly breach corporate firewalls to gain customers’ private information, and scammers constantly strive to trick us into divulging our passwords. But existing tools can provide a high level of privacy—if we use them correctly, says Mashael Al Sabah, a cybersecurity researcher at the Qatar Computing Research Institute in Doha.

The trick is understanding something about the weaknesses and limitations of technologies like blockchain or digital certificates, and not using them in ways that could play into the designs of fraudsters or malware-builders. Successful privacy is “a collaboration between the tool and the user,” Al Sabah says. It requires “using the right tool in the right way.” And testing new technology for privacy and security resilience requires what she calls a “security mindset.” Which, Al Sabah explains, is necessary when assessing new technology. “You think of the different attacks that happened before and that can happen in the future, and you try to identify the weaknesses, threats and the technology.”

There is an urgency to better understanding how technology works with allegedly anonymous technology. “People cannot be free without their privacy,” Al Sabah argues. “Freedom’s important for the development of society.” And while that may be all well and good for folks in Silicon Valley obsessed with the latest cryptocurrency, the ability to build funding structures for all is part of her focus. Al Sabah explains, “Aside from privacy, cryptocurrency can also help societies, specifically the ones with under-developed financial infrastructure.” Which is important because, “There are societies that have no financial infrastructure.”

Al Sabah made a splash in the media in 2018 by co-authoring a paper demonstrating that Bitcoin transactions are a lot less anonymous than most users assume. In the study, Al Sabah and her colleagues were able to trace purchases made on the black-market “dark web” site Silk Road back to users’ real identities simply by culling through the public Bitcoin blockchain and social media accounts for matching data. More recently, Al Sabah has also been studying phishing schemes and how to detect and avoid them.

“There’s more awareness now among users of the importance of their privacy,” Al Sabah says. And that needs to now evolve into teaching security best practices. “So, while we cannot stop new attacks, we can make them less effective and harder to achieve by adhering to best practices.”

Business Lab is hosted by Laurel Ruma, editorial director of Insights, the custom publishing division of MIT Technology Review. The show is a production of MIT Technology Review, with production help from Collective Next.

This podcast was produced in association with the Qatar Foundation.

Show notes and links

UNICEF Crypto Fund

“Google’s top security teams unilaterally shut down a counterterrorism operation,” MIT Technology Review, March 26, 2021

“Your Sloppy Bitcoin Drug Deals Will Haunt You For Years,” Wired, January 26, 2018

“Your early darknet drug buys are preserved forever in the blockchain, waiting to be connected to your real identity,” Boing Boing, January 26, 2018

“In the Middle East, Women Are Breaking Through the STEM Ceiling,” The New York Times, sponsored by the Qatar Foundation

Full transcript

Laurel Ruma: From MIT Technology Review, I’m Laurel Ruma and this is Business Lab: the show that helps business leaders make sense of new technologies coming out of the lab and into the marketplace. Our topic today is enhancing privacy and cybersecurity. Well, it’s an old saying by now, but it used to be that on the internet, nobody knows if you’re a dog, but that’s not quite true. Cybersecurity researchers have been able to track people through previously assumed anonymous transactions like Bitcoin, blockchain, and Tor.

Is it possible to build secure and anonymous payment and communication networks?

Two words for you: digital footprints, or is it paw prints?

My guest today is Dr. Mashael Al Sabah, who’s a senior scientist at Qatar Computing Research Institute. Dr. Al Sabah researches network security and privacy enhancing technologies, cryptocurrency, and blockchain technology. She was a computer science professor at Qatar University and her research on the topic has been published in Wired, Boing Boing, as well as academic journals. This episode of Business Lab is produced in association with Qatar Foundation. Welcome, Dr. Al Sabah.

Mashael Al Sabah: Thank you for having me.

Laurel: So, as a cybersecurity researcher, could you explain how you work? It seems that you kind of begin by identifying weaknesses, show how the vulnerabilities can be exploited and then propose defenses or countermeasures. Is that about right?

Mashael: Yeah, in general, there are multiple inspirational paths towards a certain research idea or topic. For example, you either hear about a new technology and then when you get curious about it, and as you discuss and learn about it with your colleagues, a security mindset starts to kick in and you start having questions about its security and privacy, and if it really delivers what it promises. And then this leads to experimentation to answer these questions and based on the insights and observations that we gained through experimentation, you either come up with a solution or you bring people’s attention to it. Another path is sometimes we conduct research based on problems by our stakeholders about the difficulties and real problems that they have. For example, some of our partners have huge amounts of data and as a national institute, it is our job and mandate to listen to their research problems and devise and even build in-house solutions to help them meet their requirements.

Laurel: You mentioned a security mindset. How do you define that?

Mashael: So, when you hear about a technology, you start asking questions. Does it meet the requirements it promises? Does it maintain the confidentiality of the data? Does it protect users’ privacy as it claims? And you think of the different attacks that happened before and that can happen in the future, and you try to identify the weaknesses and the threats and the technology.

Laurel: Your research has focused on parts of the internet that were built to protect users’ online privacy and anonymity like blockchain and Tor, which is the anonymous communications network, and how those protections may not be as strong as people think they are. What have you discovered?

Mashael: Successfully achieving privacy requires using the right tool in the right way, because it’s a collaboration between the tool and the user. If users are not using the tool properly, they will not get the privacy or security guarantees promised that they are seeking. For example, if you’re browsing to a page and your browser warns against expired certificates, but you connect anyway, then you’re at risk. In one of our research projects, we found that, although, for example, Tor, it does indeed provide strong privacy and anonymity guarantees, but using it together with Bitcoin can hinder users’ privacy, even though when Bitcoin was starting to get popular seven years ago or more, one of its selling points is that it provides strong privacy.

Laurel: Hmm. So, it’s interesting how a more secure network could be compromised because you then add on what seemingly was a secure network, when in fact combined, those two factors.

Mashael: Yeah, Tor, using Tor alone, it gives you the privacy guarantees, but then you use it with Bitcoin, you open some channels, compromised channels.

Laurel: Could you talk a bit more about your research on people using Bitcoin and their past transactions. For example, your colleague at QCRI said in a Wired article about this research, that quote, if you’re vulnerable now you’re vulnerable in the future. What does that mean? Why is Bitcoin particularly difficult to maintain privacy?

Mashael: So, at a high level, we were able to show that it’s possible to link users’ previous sensitive transactions to them. A lot of people think that they are completely anonymous when they use Bitcoin, and this gives them a false sense of security. In our research, what we did is that we crawled social media, like there’s popular forum for Bitcoin users called Bitcointalk.org, and we crawled Twitter as well for Bitcoin addresses that users attributed to themselves. In some forums, people share their Bitcoin addressees along with their profile information. So, now you have the public profile information, which includes usernames, emails, age, gender, city. This can be highly identifying. And you have all this information together with the Bitcoin address, and we found that there are hundreds of people that advertise their addresses online. We also crawled dark web pages for services that use Bitcoin as a payment channel. At the time of our experiments, we found that hundreds of services expose their Bitcoin receiving addresses.

Some of them are whistle blowing services like Wikileaks and they accept donations and supports. But many are also illicit services. They sell weapons and fake IDs and so on. Now, we have two databases, the users and their Bitcoin addresses and the services, and their Bitcoin addresses. How did we link them? We used the Bitcoin blockchain, which is transparent and available online. Anyone can download it and can analyze it. So, we downloaded it and the structure of the Bitcoin blockchain links addressees through the transactions. So if there’s a transaction that’s happened at any point in time in the past between any two addresses, you will be able to find a link between them. And indeed, from our two data sets, we found links between users and hidden services, including some illicit services, like the Pirate Bay and the Silk Road. The blockchain is a transparent ledger and it’s an append-only block. So historical data cannot be deleted and these links between users and services cannot be removed.

Laurel: So, we get what happens to everyone’s data now that you’ve made this link and you’ve made it clear that it’s available. Did any of these services take any kind of countermeasures to prevent that kind of not-anonymous information being broadcast.

Mashael: I think over the years, those services realize that Bitcoin is not as anonymous as they thought it was. So, they engage in different practices that can make it harder to track down or link users to them. For example, some of them use mixing services and some of them use a different address per transaction, as opposed to using just one address for their service. And that makes it harder to link. There are also other alternative cryptocurrencies that are, that have been researched. They have shown that they are, they provide stronger anonymity like Zcash, for example. So, there’s a more awareness now. That said, still a lot of the payments happen or take place through Bitcoin, including even ransomware.

Laurel: So, QCRI is one of the Qatar Foundation’s research institutes and the Qatar Foundation’s goals are to advance pioneering research in areas of national priority for Qatar and to support sustainable development and economic diversification goals that have the potential to benefit the entire world. So, from that perspective, why is it important to have access to secure and anonymous payment and communication systems? Why is this important to society?

Mashael: Such technologies are important because they provide people with freedom online, to browse and carry out transactions freely without feeling the feeling of being watched. Right now, when you are aware that you are being tracked and all your searches are cached, and your information is shared with advertisers, it can feel restrictive for users because personally, I feel likeit might make me censor myself and it can limit your options, the user’s options. However, when privacy tools protect you from trackers, users feel more liberated to search about personal issues, such as suspected diseases or such as their own sensitive private issues.

People cannot be free without their privacy. Freedom’s important for the development of society. Aside from privacy, cryptocurrency can also help societies with, specifically the ones with under-developed financial infrastructure. There are societies that have no financial infrastructure and people have no bank accounts. So, cryptocurrency can play a role in easing their hardships and improve their lives. I recently heard that UNICEF also has launched  CryptoFund to receive donations and cryptocurrencies because transferring through cryptocurrencies has a very low overhead in terms of transfer time cost.

Laurel: That’s actually quite interesting, especially when there is an emergency and UNICEF would need funds as quickly as possible. Not only would they save money by using an alternate banking transaction, but then they would also be able to use the money as quickly as possible.

Mashael: Exactly, yeah, the overhead was low, and the money transfer was fast. And it’s all trackable.

Laurel: Do you see cryptocurrencies being an alternative, actually coming through and playing a central role in the stage of banking like this, because people are seeing it as a more validated way to move money from one place to another?

Mashael: I don’t think it can completely replace traditional banking systems, but it can complement it. It can meet some requirements and it can help, as I said, the societies that do not have, or do have an underdeveloped financial infrastructure. So, I think it can complement existing systems.

Laurel: And I find it also interesting, as you mentioned, the privacy and how important privacy is for freedom. And commercially, we’ve found that we’re tracked pretty much everywhere we go on the internet by ads and cookies and other ways to kind of keep, keep in touch with what we are interested in and what we might buy next. And there was quite a bit of controversy, a number of years ago, of how trackers could tell whether a woman was pregnant by just the various sites she visited and would then start targeting her with specific ads. Do you see, other than for commercial purposes, more strict ways of, strict meaning improved privacy, for consumers of the internet as they go throughout the internet. Do you see privacy as being one of those things that consumers start to look for more and more?

Mashael: I think there’s definitely more, there’s more awareness now among users of the importance of their privacy. There’s more awareness.There has been leaks about governments tracking their citizens and other, and their data, and there’s information about several companies archiving and aggregating users’ data and so on. So, definitely people are more aware and for example, recently when WhatsApp decided to change their privacy policy, we noticed a backlash. Many people, many users moved to using different other apps, like Signal, with better privacy policies.

Laurel: What is the biggest challenge of keeping up with exploits? Whether they are through networking infrastructure or cryptocurrencies.

Mashael: So, attacks are carried out for political or economic reasons and as long as there is a gain or profits for the attacker, they will never stop. So, there will always be the zero-day attacks. The main challenge, I think, is to get people to adhere to the best practices. For example, many successful attacks and data leaks are based on default or easy passwords, or they could be based on failure to periodically patch their systems. So, while we cannot stop new attacks, we can make them less effective and harder to achieve by adhering to best practices.

Laurel: How are phishing attacks evolving? What methods are cyber attackers using to trick people into giving away private information or downloading malware?

Mashael: So, recent research has shown that phishing attacks show no sign of slowing down. Although the number of malwares are going down compared to previous years, phishing is going up. They use various, the phishers use various techniques. For example, one technique, a common technique, is called squatting, where attackers register domains, that resemble popular domains so they can appear more legit for users. For example, there’s PayPal.com. So, they register something similar to that, “PayPall/” with an extra L or with a typo in it, so it can appear more legit to users.

They also use social engineering tactics to be more effective. Phishers can often try to trigger the fast decision-making processes of our brains, and they achieve that by sending emails containing links to offers, or in general, urgent opportunities. For example, “Sign up for the covid vaccine, limited quantities,” something like that. So, they give users a sense of urgency. And then users visit the links and are encouraged to sign up by entering private information. Sometimes in these links, they end up downloading also malware, which makes the problem worse. In our research, we have also observed that the number of phishing domains obtaining TLS certificates has been increasing over the years. And again, they obtain digital certificates to appear more legit to users and because browsers may not connect to the domain or warn users of the domain isn’t using TLS.

Laurel: So, the bad actors are making themselves look more legit with these digital certificates. When in fact, all they’re doing is tricking the kind of automatic systems to be able to get past them, so they seem legitimate.

Mashael: Yeah, and now there are some browsers that have made it mandatory for domains to obtain certificates in order to connect to them. So, to reach a wider base of victims, it’s kind of mandatory now to obtain these certificates and it’s easy to get them because they’re free. There are certificate authorities that provide them in an automated way, free, like Let’s Encrypt, for example. So, it’s very easy for them to get certificates and look more legit.

Laurel: Why have phishing threats become a bigger problem during the covid-19 pandemic?

Mashael: When you have the pandemic, there is the fear element, which can trigger poor decisions and users want to know more about a developing story. So, in that case, they are more likely to let their guard down and visit pages that claim to present new sources of information. So, the whole situation can be more fruitful for attackers. And indeed, even early in the pandemic, around the end of March 2020, there were tens of thousands of coronavirus related spam attacks that were observed. And we observed hundreds of thousands of newly registered domains that were also related to the pandemic, that appeared to have been registered for malicious reasons.

Laurel: So, when you publish research about vulnerabilities, are you hoping that it’ll inspire people to take more countermeasures or are you thinking it’ll lead to redesign of systems entirely to make them more secure or are you hoping both will happen?

Mashael: So, when we publish research about vulnerabilities, actually both. There’s a consensus in the cyber security research community, that’s researching threats is very valuable because it brings attention to weaknesses that can possibly result in compromises or in privacy invasions if they were discovered by attackers first. That way, people can be more cautious and can take stronger countermeasures by educating themselves better. Also, with such research, when you bring the attention to a certain weakness or vulnerability, you can also start thinking of, or suggest, countermeasures and overall enhance the system.

Laurel: So, when you do find an exploit, what’s the process for alerting the interested parties? For example, recently in the news, Google exposed Western governments’ hacking operation. But there must be a standard protocol with such sensitive issues, especially when governments are involved.

Mashael: So, in QCRI we inform our partners and we write detailed reports. We have labs and we deploy in-house built systems and tools that can help them process, analyze and discover such events themselves as well.

Laurel: And that’s definitely particularly helpful and ties back to the Qatar Foundation’s goals of enriching society because cybersecurity requires massive amounts of collaborations from a number of parties, correct?

Mashael: Yeah, absolutely. I mean, it’s like I said before, it’s our mandate to serve the community and that’s why, since the beginning of  the establishment of our Institute, we worked hard on establishing relations with the different government agencies and different stakeholders in the country and we carefully identified the research directions that are needed for the country, to serve the country first and to serve society.

Laurel: What are you working on right now?

Mashael: So, right now I’m working on a couple of research projects. One of them is related to phishing. We have observed that, like I said before, that more and more phishing domains are obtaining digital certificates to appear more legit. And so, Google has the certificate transparency project where it’s basically servers that publish the new upcoming domains and their certificates. So, it’s a resource for us to identify upcoming new domains and understand if they can be possibly for malicious or phishing purposes.

So, we use available intelligence to identify if they’re phishing or not. It’s been a successful approach. We’re able to use machine learning and classify with a very high accuracy, more than 97%, that a domain is indeed, would be used for phishing sometimes even before they are available online, just from looking at its certificate and other infrastructure information.

I’m also working on identifying malware that uses anonymous communication. More and more malware use proxies or VPNs and Tor to evade detection, because it’s very hard, usually botnets or infected machines, they get their commands from a certain centralized machine. And if it’s deployed on a public IP, it would be easy for network administrators to identify it and block connections to it. That’s why botnet masters now deploy their command and control server as a Tor hidden service. So, it’s anonymous and it’s easy for the infected machines to connect to it and get the commands and get the communication but it’s hard for take down operations. So, we’re working on traffic analysis techniques in order to identify such connections and this is based on infections that we’ve found in logs of our stakeholders. So, it’s based on a real need and a requirement from our partners.

Laurel: It sounds like you’re using a number of new and different techniques, but as you mentioned in collaboration and partnership, which makes all the difference when you can really tackle a problem with a number of partners here. Do you have any suggestions of how people, consumers, can be more careful using the internet, or are there other new technologies that could help secure communications and financial transactions?

Mashael: So, I think in general, it’s the responsibility of users to ensure that their privacy is maintained with more education and awareness. When they share data, they have to be informed on how their data will be handled and understand the possible consequences of data loss or data aggregation and processing and sharing by the different companies online. People can continue to use the available technologies, as long as they understand the privacy and security guarantees and accept them.

Laurel: And that’s always the tough part.

Mashael: Yeah, that’s true.

Laurel: Well, this has been a fantastic conversation, Dr. Al Sabah, I thank you very much.

Mashael: Thank you for having me, Laurel.

Laurel: That was Dr. Mashael Al Sabah, a senior scientist at Qatar Computing Research Institute, who I spoke with from Cambridge, Massachusetts, home of MIT and MIT Technology Review overlooking the Charles River.

That’s it for this episode of Business Lab. I’m your host, Laurel Ruma. I’m the director of Insights, the custom publishing division of MIT Technology Review. We were founded in 1899 at the Massachusetts Institute of Technology and you can find us in print, on the web and at events each year around the world. For more information about us and the show, please check out our website at technologyreview.com.

The show is available wherever you get your podcasts. If you enjoyed this episode, we hope you’ll take a moment to rate and review us. Business Lab is a production of MIT Technology Review. This episode was produced by Collective Next. Thanks for listening.

This podcast episode was produced by Insights, the custom content arm of MIT Technology Review. It was not written by MIT Technology Review’s editorial staff.