Re: Fun with Bitcoin, or how an exploit can hide in plain sight

[Aidan Thornton <makosoft () gmail com>]

On Wed, Feb 1, 2012 at 10:27 PM, Dan Kaminsky <dan () doxpara com> wrote:
> Welcome to why BitCoin is so impressive.  You've got this app.  It's wide
> open to the Internet, to the point where it opens up firewall rules if
> necessary.  It's running some home grown network protocol, that ostensibly
> ships little executable programs around.  It's written in C++, the
> non-memory safe language you shoot your foot off with.  If you break it, you
> get all the money.
>
> Given all those anticonstraints, you're *still* left mucking around with
> incredibly subtle design bugs, like my deanonymization through being the
> majority of the cloud, or Microsoft's Red Balloon attack in which they
> "hoard" transaction information that pays a large fee, or your (really cool)
> exploit against signature checking optimization.

Actually, I did also - completely accidentally! - find another bug a
couple of days after this one where you could send the Bitcoin client
a message which caused it to carry out an out-of-bounds array read and
crash. That wasn't quite so interesting though, mostly because it
never made it into an actual release and there wasn't any obvious way
to do anything more than crash the victim. Absurdly trivial to exploit
but not that impressive. (Ended up talking Gavin through fixing it on
Christmas Day, poor guy. He's been spending a fair bit of time working
on a protocol-specific fuzzer since then in case there are similar
bugs.)

> It's a fun bug you found, and I'm glad its fixed, but oh man is it hard to
> exploit, and at the point there's a 51% attacker, the entire system has
> already fallen apart (if for no other reason than the 51% attacker can
> censor and even reverse arbitrary transactions by creating the longer block
> chain, both by refusing to include transactions, and by assigning to himself
> the initial coins others might have thought they'd mined).

Yeah, pretty much. It blew a gaping hole in one of Bitcoin's claimed
security properties, one that its proponents brag about fairly often,
but that particular property isn't hugely important - especially given
that Bitcoin allows lightweight clients to skip signature verification
altogether and there are clients out there in the wild that do so.
Glad you liked it though!

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/