It is not possible to hack Cardano

What can hackers do in the traditional world

In the traditional server-client world there are two levels of centralization. It is the centralization of trust and centralized network architecture is used. These are two possible vectors of attack.

Social hacking is a method of how to penetrate a foreign computer system or a network by interacting with humans. A hacker attempts to manipulate outcomes of social behavior through orchestrated actions. The goal of social hacking is to gain access to restricted information without proper permission. It is not an easy task and requires focused preparation and research. Social hackers often impersonate an individual or group who is directly or indirectly known to the victims. It is also possible to pretend a position of authority. Social hackers are able to gain access to systems that are usually very well secured technologically and it is nearly impossible to break their protection. Centralized technology cannot be 100% secured due to the possibility to overcome the protection by social hacking.

We have seen an example of a social hack recently. Do you remember the hack of Twitter when personal accounts of business leaders, celebrities, and politicians were misused to promote scam? A group of young hackers started by collecting publicly available data about Twitter employees on the Internet. For example on the LinkedIn network. They were able to deduce who could have access to Twitter’s internal account management tools. Using the features that LinkedIn provides to companies looking for employees, they obtained, for example, their mobile phone numbers, home landline number, date of entry to Twitter, and other personal information. The attackers then called these people and hid their real identity by spoofing caller ID. They pretended to be Twitter employees. After gaining their trust, they manipulated them into logging in to the corporate VPN. However, they spoofed them with a different address and obtained their credentials from the spoofed login page. These attackers also entered the actual VPN login page. They were also able to bypass the two-factor verification. The rogue employees entered a one-time login code into the fake website. According to experts, the attackers were able to take advantage of a specific situation, where many employees worked from home due to the COVID-19 epidemic and therefore cannot verify some things, for example, by direct contact with colleagues. You probably know the result of the hack and it is not important for us now. We just wanted to demonstrate how vulnerable are centralized systems. It is possible to gain access to the global social network and do what you want. Hackers could do much more damage if they were smarter.

As you probably know, a digital device can be hacked without interacting with humans. Every device that is connected to the Internet can be compromised. When a computer is plugged on the Internet and has not installed a firewall then it will be probably hacked within a few minutes. It is the owners’ responsibility to protect their digital devices such as computers, smartphones, or tablets. Hackers can try to compromise even entire networks or global services since they depend on servers. Protecting a network is always a fight between administrators of the networks and hackers. Administrators try the best to secure the network and hackers attempt to breach the security. The smarter group will win. Every digital system contains plenty of vulnerabilities and it is the daily business of administrators to keep systems up-to-date and properly protected. When hackers gain full access to a computer then they can do literally everything. They can steal critical data like passwords and PINS, search through stored data, or just silently observe user activities and wait for a chance to steal money or cause bigger damage. When hackers gain access to servers that are used for a global service then they can steal the money of more users, retrieve their personal data, or even put the service out-of-order. Losing the trust of users is probably one of the most feared scenarios for big companies or banks.

Cardano does not have a single point of failure

A single point of failure is a part of a network that will cause stopping the entire network from working in the case of failure. A single point of failure is undesirable in any network that strives for high availability or reliability. Notice that single points of failure in a network can fail for plenty of reasons and a hack is just one of them. Nevertheless, in the article, we focus only on hacking.

Centralized networks are more vulnerable than decentralized ones since there are only a few single points of failure. Often, it is enough to compromise just one single point of failure, and hackers can succeed. Such a point of failure can be a person having administrator access to systems or it can be a single server. Systems are usually made robust by adding redundancy in all potential single points of failure. For example, there can be more servers in a network and only one actively serves the users. In the case of failure, another node immediately takes over the role of the active server and it will serve the users. When a hacker compromises the main active server, it usually is not able to easily compromise the other redundant servers. Thus, a higher effort of hackers is required to cause major damage like a long outage to a global network.

It can be said that decentralization effectively solves the issue with a single point of failure. Let’s firstly explain what could be the potential points of failure in blockchain technology. A blockchain network consists of many nodes that are responsible for making a mutual consensus about appending a new block. A usual PoW or PoS network works in a way that one randomly selected node proposes a block and the rest of the network will accept it or reject it. The role of the block proposer changes every round between a group of participants. The group usually consists of pool operators. To put it a bit simplified, the number of a single point of failure corresponds with the number of pool operators in a given network. We can generalize that the more decentralized a network is, the more is protected against outside attacks.

Let’s ask an important question. What damage can a hacker cause when he or she successfully penetrates into a Cardano node? The hacker can cause significant damage to the pool operator. The hacker can steal the operator’s coins that are used as the pledge. Cardano staking is safe for all delegators. Pool operators do not hold ADA coins of delegators. Delegators always keep ADA coins in their wallets and delegate them without a need to send them anywhere. It is a very powerful feature. Even if the hacker succeeds in the penetration into the pool operator’s node the consensus power will be still kept in hands of delegators.

The impact on the whole network is nearly negligible. There will be a few hundreds of pools that will be able to produce blocks. Even if the hacker switched off the node of the pool operator there are plenty of other nodes that will be able to produce blocks. Approximately 21,600 blocks can be created within the epoch that lasts 5 days. New blocks are appended to the Cardano blockchain approximately every 20 seconds. It means that from the point of view of users, less than 1% of new blocks will be confirmed later than usual. It means not within 20 seconds but very probably within a minute. Users will not probably even notice that. If hackers wanted to cause bigger damage to the whole network then they would need to attack the consensus. It would require to hack a significant number of pool nodes within a short period of time. In the ideal case, every node is operated by an independent operator. So every node is protected differently. Some nodes will be well secured and some of them less. Nevertheless, a probability that hackers could hack for example 200 nodes within an hour is very low. And even in this highly improbable case, the network will continue with appending blocks. Only a few nodes or even one is able to keep the network operating. Moreover, a pool operator of a hacked node can quite quickly set up and start the node again.

In the case of a major attack, the network would not be probably able to process all transactions in time but it is the only major damage that hackers can cause. Hackers are not able to steal coins of users or threaten the blockchain immutability. Hackers would need a majority of ADA coins to be able to threaten the immutability of the blockchain. They are not able to gain the needed amount of coins since pools will always have only a part of coins that are in circulation. Moreover, if pool operators are smart then hackers will not steal their coins. At the time of writing, the possibility to use a hardware wallet for the pledge is on the table. Smart pool operators will probably use the feature. Then attempting to hack a pool node will make no sense since hackers will not be able to steal ADA coins.

Do not forget that changes regarding the stake of pools are accepted by the network during a snapshot that takes place at the beginning of every epoch. It means that hackers are not able to use stolen ADA coins as a stake immediately after a successful hack. It is possible that delegators will act and delegate their stake to other pools if they find out that a given pool failed in block production or the operator announced the hack. It can strengthen the honest pool and protect the whole network.

Cardano is unstoppable

As you can see, Cardano is an unstoppable network. Notice that trust is distributed to many independent people. Social hacking or node hacking can always affect only a negligible part of the network. Moreover, it is easy to replace the hacked node. Cardano is a permissionless network. Thus everybody can start operating their own pool. Once there is a chance to succeed in establishing a new pool in the market somebody will probably take the opportunity.

Only a high level of decentralization can protect the network against the network outage. The IOG team will always strive to move up the level of decentralization. It is not the case for all blockchain projects in the crypto world. The first generation of PoW networks ended up with a few pools so it would be potentially much easier to succeed in the attack. Hackers could try to steal a block reward. IT professionals are able to protect their systems well. Thus, so far nobody was able to hack more pool nodes at the same time in order to cause damage to a PoW network. As we said, in the case of Cardano the probability of such a hack is significantly lower.

It is worth mentioning that when it is hard to hack a network it is also hard to stop it or force participants to act as an authority dictates. A decentralized network is also well protected against the attack from inside of the network. It means, for example, that a bigger pool operator, or a few of them, is not able to dictate rules to other operators. Cardano has an advantage that every single ADA coin in the hands of an independent actor basically decentralizes the network.

Conclusion

We discussed the hacker attacks from the point of the network. Do not forget, however, that for hackers it can be easier to hack your computer and steal cryptocurrencies from you. Hackers usually want to have a financial profit for their shady activities. Pool operators are more experienced and skilled in network security than users. If you wish to be well protected against hackers then buy a hardware wallet like Trezor or Ledger and never store seed in a digital form. This simple rule will well protect your wealth.

Source: It is not possible to hack Cardano