Knocking on Tangle's Doors: Security Analysis of IOTA Ports

Blockchains are currently deployed in a large number of different scenarios, such as cryptocurrencies, communications, factory automation, and vehicular networks. Both academia's and industry's interest in this technology is motivated by its distributed nature and its inherent security in managing information. However, traditional blockchains are limited in terms of the transaction rate they can approve. To overcome this limitation, IOTA proposed a novel blockchain based on a Directed Acyclic Graph (DAG) structure (the Tangle). It handles a larger number of transactions to target high-traffic scenarios such as Internet of Things (IoT). However, the security of the IOTA's blockchain depends on the design of its underlying communication protocols. In this paper, we analyze the security of the IOTA Tangle from a transport layer perspective. In particular, we show that well-known port-based attacks can jeopardize the integrity and availability of the IOTA services. We focus on the IOTA's TCP-based ports, and provide a discussion of all the possible attacks and their effects. We assess their validity via experimental evaluation showing their effect on the network operations. Results show that SYN flooding affects the gossip protocol by fully disrupting the service. We also find that 16% of the nodes are unable to create a neighbours list, leading to a disruption of the information exchange process. On the other side, we also show that some components are not affected by these attacks. To the best of our knowledge, we are the first to identify and validate these vulnerabilities in IOTA. Lastly, we discuss some possible countermeasures.