CBSE Node and Network Security 2 — Questions and Answers
Question 1: Which attack vector allows a malicious node to return false transaction data to lightweight blockchain clients that rely on SPV (Simplified Payment Verification)?
- Sybil attack
- Eclipse attack (Correct answer)
- Finney attack
- Vector76 attack
Correct answer: Eclipse attack
An eclipse attack isolates an SPV client by surrounding it with attacker-controlled peers, enabling the attacker to feed false block headers or transaction confirmations.
Question 2: What is the primary purpose of a blockchain node's mempool (memory pool) from a security perspective?
- Permanently storing confirmed transactions
- Holding unconfirmed transactions pending inclusion in a block (Correct answer)
- Caching block headers for fast retrieval
- Storing private keys for hot wallets
Correct answer: Holding unconfirmed transactions pending inclusion in a block
The mempool temporarily holds unconfirmed transactions; attackers can exploit it via transaction pinning or fee manipulation to delay or block legitimate transactions.
Question 3: A blockchain node operator notices abnormally high CPU usage caused by peers repeatedly requesting the same large block. Which denial-of-service technique is being used?
- Replay attack
- Block withholding attack
- Bandwidth exhaustion via block re-request flooding (Correct answer)
- Timejacking
Correct answer: Bandwidth exhaustion via block re-request flooding
Flooding a node with repeated large-block requests wastes CPU and bandwidth resources, constituting a bandwidth exhaustion DoS against that node.
Question 4: Which TLS/SSL configuration weakness most directly endangers communications between blockchain node peers over an encrypted channel?
- Using TLS 1.3 with forward secrecy
- Allowing TLS 1.0 with RC4 cipher suites (Correct answer)
- Enforcing mutual certificate authentication
- Using ECDHE key exchange
Correct answer: Allowing TLS 1.0 with RC4 cipher suites
TLS 1.0 with RC4 is cryptographically broken; RC4 has known biases that allow plaintext recovery, compromising the confidentiality of peer communications.
Question 5: In Ethereum's devp2p protocol, what cryptographic mechanism is used during the initial handshake to establish a shared session key between two nodes?
- RSA-2048 key transport
- ECDH (Elliptic Curve Diffie-Hellman) with secp256k1 (Correct answer)
- Pre-shared key (PSK) exchange
- AES-256 ECB mode key wrapping
Correct answer: ECDH (Elliptic Curve Diffie-Hellman) with secp256k1
Ethereum's RLPx transport uses ECDH on secp256k1 during the auth handshake to derive a shared session key without transmitting the key directly.
Question 6: What security risk arises when a blockchain node exposes its JSON-RPC interface on 0.0.0.0 without authentication?
- Increased block propagation latency
- Unauthorized callers can drain wallets or manipulate node state (Correct answer)
- Faster transaction confirmation due to open access
- Automatic firewall rule creation
Correct answer: Unauthorized callers can drain wallets or manipulate node state
An unauthenticated RPC interface exposed to all interfaces allows any network host to call privileged methods such as eth_sendTransaction or personal_unlockAccount.
Question 7: Which network-layer defense is most effective at preventing IP-spoofing-based amplification attacks targeting blockchain gossip protocols?
- BCP 38 ingress filtering at the ISP or router level (Correct answer)
- Increasing block size limits
- Enabling verbose node logging
- Using proof-of-stake consensus
Correct answer: BCP 38 ingress filtering at the ISP or router level
BCP 38 (RFC 2827) ingress filtering drops packets with spoofed source IPs at the network perimeter, preventing spoofed-source amplification attacks.
CBSE Node and Network Security 2
Which attack vector allows a malicious node to return false transaction data to lightweight blockchain clients that rely on SPV (Simplified Payment Verification)?