sábado, 29 de agosto de 2020

Gridcoin - The Bad

In this post we will show why Gridcoin is insecure and probably will never achieve better security. Therefore, we are going to explain two critical implementation vulnerabilities and our experience with the core developer in the process of the responsible disclosure. 
    In our last blog post we described the Gridcoin architecture and the design vulnerability we found and fixed (the good). Now we come to the process of responsibly disclosing our findings and try to fix the two implementation vulnerabilities (the bad).

    Update (15.08.2017):
    After the talk at WOOT'17 serveral other developers of Gridcoin quickly reached out to us and told us that there was a change in responsibility internally in the Gridcoin-Dev team. Thus, we are going to wait for their response and then change this blog post accordingly. So stay tuned :)

    Update (16.08.2017):
    We are currently in touch with the whole dev team of Gridcoin and it seems that they are going to fix the vulnerabilities with the next release.


    TL;DR
    The whole Gridcoin currency is seriously insecure against attacks and should not be trusted anymore; unless some developers are in place, which have a profound background in protocol and application security.

    What is Gridcoin?

    Gridcoin is an altcoin, which is in active development since 2013. It claims to provide a high sustainability, as it has very low energy requirements in comparison to Bitcoin. It rewards users for contributing computation power to scientific projects, published on the BOINC project platform. Although Gridcoin is not as widespread as Bitcoin, its draft is very appealing as it attempts to  eliminate Bitcoin's core problems. It possesses a market capitalization of $13,530,738 as of August the 4th 2017 and its users contributed approximately 5% of the total scientific BOINC work done before October 2016.

    A detailed description of the Gridcoin architecture and technical terms used in this blog post are explained in our last blog post.

    The Issues

    Currently there are 2 implementation vulnerabilities in the source code, and we can mount the following attacks against Gridcoin:
    1. We can steal the block creation reward from many Gridcoin minters
    2. We can efficiently prevent many Gridcoin minters from claiming their block creation reward (DoS attack)
    So why do we not just open up an issue online explaining the problems?

    Because we already fixed a critical design issue in Gridcoin last year and tried to help them to fix the new issues. Unfortunately, they do not seem to have an interest in securing Gridcoin and thus leave us no other choice than fully disclosing the findings.

    In order to explain the vulnerabilities we will take a look at the current Gridcoin source code (version 3.5.9.8).

    WARNING: Due to the high number of source code lines in the source files, it can take a while until your browser shows the right line.

    Stealing the BOINC block reward

    The developer implemented our countermeasures in order to prevent our attack from the last blog post. Unfortunately, they did not look at their implementation from an attacker's perspective. Otherwise, they would have found out that they conduct not check, if the signature over the last block hash really is done over the last block hash. But we come to that in a minute. First lets take a look at the code flow:

    In the figure the called-by-graph can be seen for the function VerifyCPIDSignature.
    1. CheckBlock → DeserializeBoincBlock [Source]
      • Here we deserialize the BOINC data structure from the first transaction
    2. CheckBlock → IsCPIDValidv2 [Source]
      • Then we call a function to verify the CPID used in the block. Due to the massive changes over the last years, there are 3 possible verify functions. We are interested in the last one (VerifyCPIDSignature), for the reason that it is the current verification function.
    3. IsCPIDValidv2 → VerifyCPIDSignature [Source]
    4. VerifyCPIDSignature → CheckMessageSignature [Source, Source]
    In the last function the real signature verification is conducted [Source]. When we closely take a look at the function parameter, we see the message (std::string sMsg)  and the signature (std::string sSig) variables, which are checked. But where does this values come from?


    If we go backwards in the function call graph we see that in VerifyCPIDSignature the sMsg is the string sConcatMessage, which is a concatenation of the sCPID and the sBlockHash.
    We are interested where the sBlockHash value comes from, due to the fact that this one is the only changing value in the signature generation.
    When we go backwards, we see that the value originate from the deserialization of the BOINC structure (MiningCPID& mc) and is the variable mc.lastblockhash [Source, Source]. But wait a second, is this value ever checked whether it contains the real last block hash?

    No, it is not....

    So they just look if the stored values there end up in a valid signature.

    Thus, we just need to wait for one valid block from a researcher and copy the signature, the last block hash value, the CPID and adjust every other dynamic value, like the RAC. Consequently, we are able to claim the reward of other BOINC users. This simple bug allows us again to steal the reward of every Gridcoin researcher, like there was never a countermeasure.

    Lock out Gridcoin researcher
    The following vulnerability allows an attacker under specific circumstances to register a key pair for a CPID, even if the CPID was previously tied to another key pair. Thus, the attacker locks out a legit researcher and prevent him from claiming BOINC reward in his minted blocks.

    Reminder: A beacon is valid for 5 months, afterwards a new beacon must be sent with the same public key and CPID.

    Therefore, we need to take a look at the functions, which process the beacon information. Every time there is a block, which contains beacon information, it is processed the following way (click image for higher resolution):


    In the figure the called-by-graph can be seen for the function GetBeaconPublicKey.
    We now show the source code path:
    • ProcessBlock → CheckBlock [Source]
    • CheckBlock → LoadAdminMessages [Source]
    • LoadAdminMessages → MemorizeMessages [Source]
    • MemorizeMessages → GetBeaconPublicKey [Source]
    In the last function GetBeaconPublicKey there are different paths to process a beacon depending on the public key, the CPID, and the time since both were associated to each other.
    For the following explanation we assume that we have an existing association (bound) between a CPID A and a public key pubK_A for 4 months.
    1. First public key for a CPID received [Source]
      • The initial situation, when pubK_A was sent and bind to CPID  A (4 months ago)
    2. Existing public key for a CPID was sent [Source]
      • The case that pubK_A was resent for a CPID A, before the 5 months are passed by
    3. Other public key for a CPID was sent [Source]
      • The case, if a different public key pubK_B for the CPID A was sent via beacon.
    4. The existing public key for the CPID is expired
      • After 5 months a refresh for the association between A and pubK_A is required.
    When an incoming beacon is processed, a look up is made, if there already exists a public key for the CPID used in the beacon. If yes, it is compared to the public key used in the beacon (case 2 and 3).
    If no public key exists (case 1) the new public key is bound to the CPID.

    If a public key exists, but it was not refreshed directly 12.960.000 seconds (5 months [Source]) after the last beacon advertisement of the public key and CPID, it is handled as no public key would exist [Source].

    Thus, case 1 and 4 are treated identical, if the public key is expired, allowing an attacker to register his public key for an arbitrary CPID with expired public key. In practice this allows an attacker to lock out a Gridcoin user from the minting process of new blocks and further allows the attacker to claim reward for BOINC work he never did.

    There is a countermeasure, which allows a user to delete his last beacon (identified by the CPID) . Therefore, the user sends 1 GRC to a special address (SAuJGrxn724SVmpYNxb8gsi3tDgnFhTES9) from an GRC address associated to this CPID [Source]. We did not look into this mechanism in more detail, because it only can be used to remove our attack beacon, but does not prevent the attack.

    The responsible disclosure process

    As part of our work as researchers we all have had the pleasure to responsible disclose the findings to developer or companies.

    For the reasons that we wanted to give the developer some time to fix the design vulnerabilities, described in the last blog post, we did not issue a ticket at the Gridcoin Github project. Instead we contacted the developer at September the 14th 2016 via email and got a response one day later (2016/09/15). They proposed a variation of our countermeasure and dropped the signature in the advertising beacon, which would result in further security issues. We sent another email (2016/09/15) explained to them, why it is not wise to change our countermeasures and drop the signature in the advertising beacon.
    Unfortunately, we did not receive a response. We tried it again on October the 31th 2016. They again did not respond, but we saw in the source code that they made some promising changes. Due to some other projects we did not look into the code until May 2017. At this point we found the two implementation vulnerabilities. We contacted the developer twice via email (5th and 16th of May 2017) again, but never received a response. Thus, we decided to wait for the WOOT notification to pass by and then fully disclose the findings. We thus have no other choice then to say that:

    The whole Gridcoin cryptocurrency is seriously insecure against attacks and should not be trusted anymore; unless some developers are in place, which have a profound background in protocol and application security.

    Further Reading
    A more detailed description of the Gridcoin architecture, the old design issue and the fix will be presented at WOOT'17. Some days after the conference the paper will be available online.

    Related links


    1. Best Pentesting Tools 2018
    2. Pentest Tools
    3. Hack Tools
    4. Hack Tools
    5. Underground Hacker Sites
    6. Hacking Tools For Windows Free Download
    7. Hack Tools Pc
    8. Pentest Tools Linux
    9. Hacker Hardware Tools
    10. Hacking Tools Free Download
    11. Hacking Tools Name
    12. Hacker Tools Mac
    13. Hacker Techniques Tools And Incident Handling
    14. Hacking Tools Windows
    15. Pentest Tools Windows
    16. New Hack Tools
    17. World No 1 Hacker Software
    18. Hacker Tools 2019
    19. Growth Hacker Tools
    20. Hack Rom Tools
    21. Physical Pentest Tools
    22. Pentest Tools Port Scanner
    23. Best Hacking Tools 2020
    24. Hacker Techniques Tools And Incident Handling
    25. Hacking Tools And Software
    26. Hacker Tools Apk
    27. Hacking Tools 2019
    28. Hacker Tool Kit
    29. Hacker Tools Software
    30. Hacking Tools Name
    31. Hacking Tools Mac
    32. Hacker Tools
    33. New Hacker Tools
    34. Nsa Hack Tools Download
    35. Hacker Tools For Ios
    36. Hacking Tools Github
    37. Growth Hacker Tools
    38. Top Pentest Tools
    39. Hackers Toolbox
    40. Hacker Tools 2019
    41. How To Make Hacking Tools
    42. Hackrf Tools
    43. Hack Tools For Pc
    44. Hacking Tools Usb
    45. Pentest Automation Tools
    46. Hacker Tools For Windows
    47. Pentest Tools Website
    48. Hacking Tools Software
    49. Hacking Tools For Windows
    50. Hacking App
    51. Hacker
    52. Hacking Tools Kit
    53. Tools 4 Hack
    54. Pentest Tools For Mac
    55. Hack Tools For Mac
    56. Pentest Tools Windows
    57. Hacker Tools For Ios
    58. Physical Pentest Tools
    59. Hack Tools 2019
    60. Usb Pentest Tools
    61. Hacking Tools Mac
    62. Hack Tools For Windows
    63. Hacking Tools 2020
    64. New Hack Tools
    65. Hacking Tools Hardware
    66. Bluetooth Hacking Tools Kali
    67. Hacking Tools Windows 10
    68. Pentest Tools Framework
    69. Hacker Tools Github
    70. Hacking Tools For Kali Linux
    71. Hacker Tools 2019
    72. Blackhat Hacker Tools
    73. Hacking Tools Software
    74. Pentest Automation Tools
    75. Pentest Tools Subdomain
    76. Kik Hack Tools
    77. Bluetooth Hacking Tools Kali
    78. Termux Hacking Tools 2019
    79. Pentest Tools List
    80. Pentest Tools Framework
    81. Hacker Tools Hardware
    82. Tools 4 Hack
    83. Hacking Tools For Kali Linux
    84. Hack Tools
    85. Hack Apps
    86. Hack Tools
    87. Hacker Tools Software
    88. Hacking Tools Hardware
    89. Hack Tools For Mac
    90. How To Make Hacking Tools
    91. Pentest Tools Subdomain
    92. Hacker Tool Kit
    93. What Are Hacking Tools
    94. Pentest Tools
    95. Github Hacking Tools
    96. Growth Hacker Tools
    97. New Hack Tools
    98. How To Install Pentest Tools In Ubuntu
    99. Hacking Tools Online
    100. Pentest Tools Alternative
    101. Pentest Tools List
    102. Hack Tool Apk No Root
    103. Hacker Tools Apk
    104. Pentest Tools List
    105. Hacking Tools
    106. Hacker Tools For Windows
    107. Hacking Tools Free Download
    108. Hacker Tools Linux
    109. Hacker Tools List
    110. Growth Hacker Tools
    111. Hacker Tools Hardware
    112. Pentest Tools Framework
    113. Game Hacking
    114. Hacking Tools Kit
    115. Hacking Tools Pc

    No hay comentarios: