Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: Fun with Bitcoin, or how an exploit can hide in plain sight
From: Aidan Thornton <makosoft () gmail com>
Date: Thu, 2 Feb 2012 15:15:58 +0000

On Wed, Feb 1, 2012 at 10:27 PM, Dan Kaminsky <dan () doxpara com> wrote:

Welcome to why BitCoin is so impressive.  You've got this app.  It's wide
open to the Internet, to the point where it opens up firewall rules if
necessary.  It's running some home grown network protocol, that ostensibly
ships little executable programs around.  It's written in C++, the
non-memory safe language you shoot your foot off with.  If you break it, you
get all the money.

Given all those anticonstraints, you're *still* left mucking around with
incredibly subtle design bugs, like my deanonymization through being the
majority of the cloud, or Microsoft's Red Balloon attack in which they
"hoard" transaction information that pays a large fee, or your (really cool)
exploit against signature checking optimization.

Actually, I did also - completely accidentally! - find another bug a
couple of days after this one where you could send the Bitcoin client
a message which caused it to carry out an out-of-bounds array read and
crash. That wasn't quite so interesting though, mostly because it
never made it into an actual release and there wasn't any obvious way
to do anything more than crash the victim. Absurdly trivial to exploit
but not that impressive. (Ended up talking Gavin through fixing it on
Christmas Day, poor guy. He's been spending a fair bit of time working
on a protocol-specific fuzzer since then in case there are similar

It's a fun bug you found, and I'm glad its fixed, but oh man is it hard to
exploit, and at the point there's a 51% attacker, the entire system has
already fallen apart (if for no other reason than the 51% attacker can
censor and even reverse arbitrary transactions by creating the longer block
chain, both by refusing to include transactions, and by assigning to himself
the initial coins others might have thought they'd mined).

Yeah, pretty much. It blew a gaping hole in one of Bitcoin's claimed
security properties, one that its proponents brag about fairly often,
but that particular property isn't hugely important - especially given
that Bitcoin allows lightweight clients to skip signature verification
altogether and there are clients out there in the wild that do so.
Glad you liked it though!

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]