00:00:00.000-->00:00:05.005 >>Alright, so um, before we get started I just want a quick show of hands. So, how many of you 00:00:05.005-->00:00:07.441 out there [laughter], yeah there we go see so quick show of hands how many of you out there have 00:00:07.441-->00:00:12.446 done any kind of ethical or you know wink wink unethical hacking of financial applications? Any 00:00:18.018-->00:00:23.023 kind at all. Alright, okay good yeah. So yeah, I- I've been focused on these things for like 00:00:25.425-->00:00:32.232 13 years and um I've seen some really crazy stuff. Um so now out of you guys who've done that 00:00:32.232-->00:00:38.272 how many of you have thought that the code was so beautiful, so flawless [laughter] that it 00:00:38.272-->00:00:42.242 didn't need even the slightest bit of human intervention you know once it rolled out of the 00:00:42.242-->00:00:47.247 dones list right everyone right yeah sure yeah. So, now imagine for a moment that that financial 00:00:49.483-->00:00:56.156 code couldn't be changed, you know once you put it out there, it's just, it's out there. So if 00:00:56.156-->00:01:01.094 it has any huge gaping flaws or anything that's the way it's gonna stay for eternity ha. So, 00:01:03.196-->00:01:09.036 that's sort of what goes on in the world of smart contracts, okay. Uh, there's no updates, 00:01:09.036-->00:01:13.340 there's no patches, there's no revisions, there's ways to point to other programs but once you 00:01:13.340-->00:01:18.946 put it on the block chain by it's nature the block chain is this immutable thing right. So, 00:01:18.946-->00:01:23.717 if this codes expected to move money around forever on it's own, it probably needs a little 00:01:23.717-->00:01:27.888 more attention than the usual financial apps you might have looked at in the past, so that's 00:01:27.888-->00:01:33.593 why this is an important field. And uh, we're sorta getting in on the ground floor still here. 00:01:33.593-->00:01:38.832 Um, think about if you had gone to a web app hacking talk around the year 2000, you know, that's 00:01:38.832-->00:01:44.604 the idea here, this is very new to a lot of folks. So I'm gonna try and you know, ease everyone 00:01:44.604-->00:01:49.876 into it. So, I want everyone to be able to get something out of this talk, so no I'm not going 00:01:49.876-->00:01:54.047 to just explain how bitcoin works, that, that, that's silly but [laughs] I assume you guys 00:01:54.047-->00:01:57.918 know that. But, but, I'm just going to explain some of the quick differences and what makes 00:01:57.918-->00:02:03.590 ethereum, different, better, um and a lot more useable in terms of uh things like smart 00:02:03.590-->00:02:08.128 contracts. So everyone's aware of bitcoin, yeah we know that, so, sit osha met his goals 00:02:08.128-->00:02:13.433 right, he wanted to have the whole uh distributed ledger to avoid double spend, you know 00:02:13.433-->00:02:18.705 have have the computational proof of work to make this thing actually be of some value. And, 00:02:18.705-->00:02:23.076 and some ultraistic goals cause half the world doesn't have a bank or access to a bank so now 00:02:23.076-->00:02:27.247 thanks to bitcoin they do. But with ethereum we've got something different going on, 00:02:27.247-->00:02:31.284 you know, uh it takes the idea a little further. Creates this, this idea about turning a 00:02:31.284-->00:02:37.524 complete system. Uh, the ebn the few virtual machines runs over the entire globe, this one big 00:02:37.524-->00:02:44.331 mega computer that you can access and do things with. So, it can save state, um it can 00:02:44.331-->00:02:49.336 detect changes to info, it can remember them um it can intelligently handle 00:02:49.336-->00:02:55.275 interactions between users, uh control flow programming. Uh, so it can run smart contracts, 00:02:55.275-->00:02:58.645 which is why we're talking about it. You know, there are some companies building smart 00:02:58.645-->00:03:05.318 contract like features over the bitcoin, uh network, but it's not quite the same thing. So, 00:03:05.318-->00:03:09.022 what's a smart contract? You know real simply? So, it's a program right it consists of uh 00:03:09.022-->00:03:13.493 business, business logic, it runs on the black chain, uh it's semi-autonomous, you know you 00:03:13.493-->00:03:17.030 can think of it as this thing that just runs on it's own, which sometimes doesn't really 00:03:17.030-->00:03:22.469 bring comfort to anyone [laughs]. Um, so it can move out, we can enforce agreements, 00:03:22.469-->00:03:27.074 uh it can remove repetitive labor which everyone's all for, but again it cannot be patched, 00:03:27.074-->00:03:31.311 I can't stress this enough. But it is important to really take a look at this code before you put 00:03:31.311-->00:03:36.516 it live. An-And reality you're limited by creativity you know you can make escrow systems that 00:03:36.516-->00:03:41.288 hold money in place when it checks returns, uh you can create new tokens. Uh people 00:03:41.288-->00:03:45.392 think about tokens as like just extra coins, but, you've been using tokens all your lives, 00:03:45.392-->00:03:49.429 i-if you have frequent flyer miles, for example, that's kinda like a token, like unlimited set 00:03:49.429-->00:03:53.967 usage, so smart contracts lets you create ones that have purpose like that. Um, it can 00:03:53.967-->00:03:58.638 handle real estate records, uh you know if a country has an unstable government, a smart 00:03:58.638-->00:04:02.976 contract will prove you own something, uh, enforcing its another matter but you can at 00:04:02.976-->00:04:07.347 least prove intentionally [laughs]. Uh, it can do things like pay people when work is 00:04:07.347-->00:04:11.918 done, um trust funds, wills. You can even imagine something like airbnb or uber without the 00:04:11.918-->00:04:16.490 company behind it. You know you can have these smart contracts negotiating for people, uh so no 00:04:16.490-->00:04:22.395 one takes a cut when you take a drive or when you stay in someone's room, it's kind of a 00:04:22.395-->00:04:26.933 neat idea. So, why should we look at smart contract security? Well I could literally think of 00:04:26.933-->00:04:32.005 a billion reasons [laughs]. Uh, if everyone remembers the DAO which was a little over a year 00:04:32.005-->00:04:35.342 ago, uh basically, um it was an essential as the time as operation and organization. It 00:04:35.342-->00:04:40.347 was designed to operate like a venture capital fund letting you move money in and out. Um, a 00:04:43.049-->00:04:48.989 flow was found in May 2016, and no one really did anything about it and June 17, a hacker used 00:04:48.989-->00:04:53.593 the recursive law which were going to look at in detail. To make splits inside of splits, 00:04:53.593-->00:04:59.432 and keep syphoning money out and array-erase condition without checking the balance. So 3.6 00:04:59.432-->00:05:03.570 million ether was stolen but at the time they were reporting accurately that it was you know 00:05:03.570-->00:05:08.208 a decent amount of money. But, if you look at how ether has gone as high as 400, or 3 00:05:08.208-->00:05:12.612 something at times, uh you know it's pretty much if it happened today it would be close to a 00:05:12.612-->00:05:17.217 billion dollar hack. So, that would definitely make even bigger news than it did a year 00:05:17.217-->00:05:22.088 ago. Smart contract security is not going away, it's not a problem that's you know last 00:05:22.088-->00:05:26.860 summer [laughs]. It's something that's very much going to affect the future. And what's funny is 00:05:26.860-->00:05:30.197 I'll show you how you can prevent similar left like that with just switching two lines of 00:05:30.197-->00:05:35.202 code as as we'll get to. So uh more recently we had another smart contract attack, so 30 00:05:37.704-->00:05:44.211 million reasons are good to. Um, basically, parity was hit, and uh there was a multi sig wallet 00:05:44.211-->00:05:51.184 that allowed people to swipe 32 million dollars from a few ICO's. Um, it's another 00:05:51.184-->00:05:55.121 ridiculously simple flaw that we're gonna look at in this talk. But, the idea is there, 00:05:55.121-->00:05:59.125 you know people inves- put so much money into these things, and they have them be 00:05:59.125-->00:06:04.664 responsible for so many critical assets, that to code them poorly is just not acceptable in this 00:06:04.664-->00:06:11.538 day and age. So, um quick caveat, there's no zero days here, you know uh you can't 00:06:11.538-->00:06:15.909 always easily identify where the first time something was discovered, we're gonna be 00:06:15.909-->00:06:19.212 talking about like I said, imagine you go into web net hacking talk like around the 00:06:19.212-->00:06:23.516 year 2000, I'm going to try to introduce as much as I can in this time about what you should 00:06:23.516-->00:06:28.154 be looking for. Uh, there's no customer code that's going to be shared, I haven't shared 00:06:28.154-->00:06:31.825 customer code you know accidentally in 13 years, I'm not starting today. So, you're 00:06:31.825-->00:06:36.196 not gonna see anything from like real engagements, I'm gonna use like sanitized examples and 00:06:36.196-->00:06:41.468 things like that. Uh, but this about generating methodology, you know I-I want you guys to be 00:06:41.468-->00:06:45.639 able to go out there and try and get involved in this uh especially if you take a little 00:06:45.639-->00:06:50.343 time learning the solidity which we'll get to in a sec. And uh no, I don't think smart 00:06:50.343-->00:06:53.947 contracts are that smart, I don't think they're going to like take over the world or 00:06:53.947-->00:06:57.651 anything, so you know, there's always that fear like I-I'm sure it must've come up in the talk I 00:06:57.651-->00:07:02.589 just missed, ha. Um yeah, they're smart but not really that smart. No mega fears here. 00:07:07.627-->00:07:12.766 Okay, so solidity. Uh, this is the programming language, ominus ethereum like looking uh symbol 00:07:12.766-->00:07:18.338 there for solidity uh so it's the one that won out, okay um you don't need to program 00:07:18.338-->00:07:22.676 solidity to do smart contracts, but this is the one that everyone settled on. Uh it beat 00:07:22.676-->00:07:27.714 out serpin, uh which is a little bit like python, uh list black language, bluetongue, uh it's 00:07:27.714-->00:07:32.719 high level, human readable, it's kinda pretty in it's own way I guess. It has some syntax 00:07:32.719-->00:07:38.058 similarities to uh javascript and c so if you have any of that in your background you know, 00:07:38.058-->00:07:43.697 maybe you'll take to solidity quite well. Um and when you write this code, it compiles to 00:07:43.697-->00:07:49.536 uh ebm bycode. So, it's statically typed, uh it supports libraries, inheritance, complex 00:07:49.536-->00:07:54.474 user fine types. Uh, it's it's pretty fancy. Uh, honestly, I can't teach you how to code in 00:07:54.474-->00:07:58.912 solidity, in this 45 minute talk, that, that would be kinda crazy. Uh, so we're gonna focus 00:07:58.912-->00:08:03.016 on the general types of vulnerabilities you should be looking for, and uh maybe you 00:08:03.016-->00:08:07.320 can rewatch this video if you don't know solidity after you learn it, that's a possibility 00:08:07.320-->00:08:11.791 too. Um, so it's in high demand right now, uh I think it's worth taking the time to learn. 00:08:11.791-->00:08:15.161 There's a book coming out next week, Ethereum Programming, that actually looks pretty good to 00:08:15.161-->00:08:19.999 me, so, I think, I think some folks might find it useful. Uh, if you learn solidity, you'll be 00:08:19.999-->00:08:25.872 like the tenth person to do so, so congratulations to you [laughter] [laughs] yeah, we 00:08:25.872-->00:08:32.112 definitely need more. Um, so ethical hacking of solidity is is usually part of the dev 00:08:32.112-->00:08:37.951 process. Alright, think of it as a typical code review, um, so sol files, dot sol files of 00:08:37.951-->00:08:43.356 solidity, they get compiled and they run on test block chains, uh then on private or public 00:08:43.356-->00:08:48.728 ones depending um so the customer other environment could differ greatly. So, you're gonna 00:08:48.728-->00:08:52.365 have to definitely talk to the devs about what's going on if you're working with this. So, 00:08:52.365-->00:08:56.302 Matt Squeeze yesterday, uh I don't know if he's here but, he gave a great talk on his tool 00:08:56.302-->00:09:02.909 porosity, and uh that tools kind of interesting cause it lets you pull from the blockchain and get 00:09:02.909-->00:09:07.080 back solidity code. Uh, that's not what we're going to be looking at here, uh here we're 00:09:07.080-->00:09:11.051 going to be having the solidity files handed to us up front, just like you would have any 00:09:11.051-->00:09:15.021 other code review. So, that's the sort of approach we're taking here. So, the first step 00:09:15.021-->00:09:19.759 is definitely a look at the solidity files before they go down that process. Um, a good 00:09:19.759-->00:09:25.632 way to do that is to have an IDE, uh there's a lot of options available, um my favorites atom, 00:09:25.632-->00:09:30.403 you can actually get little plugins for that. And using it you can actually have 00:09:30.403-->00:09:36.209 highlighting and um it can even test compiling which is pretty cool using etheratom. Uh realmix 00:09:36.209-->00:09:41.114 ID, uh ID is kinda neat, it's browser based, let's you try and compile code and see if it 00:09:41.114-->00:09:46.119 errors out. So that's, that's useful too. Okay, and yeah emax can have plugins too, I don't 00:09:49.956-->00:09:54.961 want to start like a religious war, but it they do [laughter]. [laughs], alright, So, while 00:09:57.030-->00:10:02.535 you're still learning solidity, uh I find it useful to run a parser like solgraph, um, it's 00:10:02.535-->00:10:07.941 not a bad way to look at code even when you know solidity too. It takes a sol file and it 00:10:07.941-->00:10:12.979 outputs a dot graph, that actually let's you visualize the function, the flow, so it sorta 00:10:12.979-->00:10:17.183 like walks you through how the code works, just so you can get that big picture view before you 00:10:17.183-->00:10:21.621 even get started looking for the little nit picky things. Um, so there's another one called 00:10:21.621-->00:10:25.992 solidity parser coming that looks promising too. Uh, so these kinds of things are just 00:10:25.992-->00:10:30.129 aids, visual aids, cause, sometimes code just becomes you know mind numbing after a while. 00:10:30.129-->00:10:35.134 Um, so a real awesome tool that came out awhile ago was oyente and it got both better and like 00:10:39.739-->00:10:44.410 sort of worse, I-I'll explain that. Uh so it's a symbolic execution tool, um it's designed 00:10:44.410-->00:10:50.583 to analyze your smart contracts um, it follows the execution of contracts and what's cool is it 00:10:50.583-->00:10:54.554 can actually reach out and analyze contracts that are on the blockchain. You know, you 00:10:54.554-->00:10:59.058 don't have to just work with solidity files. Uh, no, it doesn't give you back a solidity 00:10:59.058-->00:11:03.496 document like um veracity would, but it actually could still step through the ones that are out on 00:11:03.496-->00:11:07.800 the blockchain. But uh in this case we'll be talking about pointing it to locally uh stored 00:11:07.800-->00:11:14.541 files. So, it detects three valid issues, and um one sort of invalid one. So call stack 00:11:14.541-->00:11:18.578 basically, the call stack attack which we'll talk about later, um it hasn't really been valid 00:11:18.578-->00:11:24.484 since eip 150. Um, but it also detects concurrency bug or transaction order dependence, um 00:11:24.484-->00:11:29.589 time dependency attacks and reentrancy which is the big DAO attack so that, that's an 00:11:29.589-->00:11:33.693 important one and it's pretty accurate, I mean it looks like it has less than 10 percent 00:11:33.693-->00:11:38.698 false positives based on other people's data and my testing too. Uh it's just a little 00:11:38.698-->00:11:42.902 tricky to set up so I'm warning you in advance. It complains about versions, it wants you to 00:11:42.902-->00:11:46.773 use old versions of things, and then you have to do all that crazy stuff, specially linux 00:11:46.773-->00:11:51.077 forcing of origin. But if, if you want my honest opinion, you can just use the latest version 00:11:51.077-->00:11:54.681 get a few error messages and most of the time it just works anyways, so don't worry about it 00:11:54.681-->00:11:59.686 [laughs], so just use the newest versions of everything. Um, so to that end, we're looking at 00:12:01.888-->00:12:05.391 hopefully getting a basic methodology in place. So, so whenever you start one of these, 00:12:05.391-->00:12:09.228 the best thing to do is to talk to the devs you know, uh, if you come from an app testing 00:12:09.228-->00:12:15.034 background, uh, like, like I do, you know, um, you'll find that kick off calls you know who 00:12:15.034-->00:12:18.504 really likes kickoff calls right there like the worst. And and most of the times it's people 00:12:18.504-->00:12:23.543 explaining something to you as if you haven't seen it 100 times before. Uh when it comes to uh, 00:12:23.543-->00:12:28.481 smart contracts, take the kickoff call, because sometimes there's a really unique or novel 00:12:28.481-->00:12:31.818 thing they're trying to do. Again, we're in the infancy here. So, you definitely want to 00:12:31.818-->00:12:36.656 talk to the devs in these type of uh hacks. Uh, they can share a lot of you, useful info uh, 00:12:36.656-->00:12:40.727 what does the contract do, you know, what environment is required for testing, these are 00:12:40.727-->00:12:43.997 all important things, especially if there's any kind of like private or permission blotching 00:12:43.997-->00:12:48.167 it has to talk to. Um, so think along the lines of threat modeling at first, you have to 00:12:48.167-->00:12:52.272 kind of understand the application a little bit. Um, then after that you're going to 00:12:52.272-->00:12:57.343 want to plug it into something like atom, remix ID, take a look at it with highlighting, really 00:12:57.343-->00:13:01.014 understand if, if everything's okay, compiling it, making sure it doesn't error out, maybe the 00:13:01.014-->00:13:05.284 wrong version, you know. Get that silly kind of housekeeping out of the way first. Uh, but 00:13:05.284-->00:13:08.321 then after that you're gonna wanna start to dissect the code flow, you're gonna want to read 00:13:08.321-->00:13:13.993 any comments under there, um use something like solgraph to understand it. You're gonna want 00:13:13.993-->00:13:19.532 to run oyente, and cross your fingers that it doesn't error out and it might, it often does. 00:13:19.532-->00:13:24.303 Um, and then you're gonna want to verify that the three that are real are there or not if you 00:13:24.303-->00:13:28.207 find them, but of course you're gonna want to look at in manually too. And then uh you're 00:13:28.207-->00:13:32.979 gonna want to check for the types of things that we're gonna talk about now, in the meat of 00:13:32.979-->00:13:38.051 the presentation hmm. Alright, so, because of how popular the DAO hack is, uh we're gonna, 00:13:38.051-->00:13:43.356 we're gonna start with this. Um, so I'm not gonna be dumping all the DAO code here because I-I 00:13:43.356-->00:13:47.160 don't even think these screens are big enough uh and you sure wouldn't be able to read it, so 00:13:47.160-->00:13:50.663 what I'm gonna do is show how reentrancy works with a really simplified sample that I coded 00:13:50.663-->00:13:56.135 here um and I call it reentrancy what an original name for a contract and I'm just gonna show 00:13:56.135-->00:14:02.341 the basic idea. So, solidity is read sequentially by the evn okay, so reentrancy can happen 00:14:02.341-->00:14:07.747 if the amount transferred on a contract depends on a balance or state that's updated after the 00:14:07.747-->00:14:13.186 transfers made. So, because it's done sequentially, where you do your accounting is very 00:14:13.186-->00:14:17.690 important. Where you tell the program what all the values are. So, in our vulnerable code 00:14:17.690-->00:14:23.429 snippet you can see the expendable tokens balance, it's set to zero at the very end, so, 00:14:23.429-->00:14:28.000 so the line I highlighted there with the little explosion. That's where the dangerous send 00:14:28.000-->00:14:33.005 or, or of money can go out and after that, it's set to zero. So, if you could somehow 00:14:35.108-->00:14:41.481 repeatedly invoke this function, oops, sorry about that, slipped there. Um, if you could somehow 00:14:41.481-->00:14:47.019 repeatedly invoke this function, you'll end up pulling the money out before it's set to zero, 00:14:47.019-->00:14:52.024 over and over and over and over again. And something like that is what happened in the DAO. So, 00:14:55.294-->00:15:00.233 let's see if we can't take some of this uh re out of entrancy, you know. If you were to 00:15:02.835-->00:15:08.841 instead, switch lines 7 and 8, so now the exploding line does the accounting first, then if 00:15:08.841-->00:15:14.046 any other contract or whatever was try, tried to pull from the if scape right there, the 00:15:14.046-->00:15:19.485 money's already zeroed out. You know, it's setup it's a one time thing, and it's not gonna go 00:15:19.485-->00:15:24.724 anywhere. This accounting move means token balances are taken care of early. So, even though 00:15:24.724-->00:15:29.729 this is tremendously simplified, uh the idea is that such a small little change can prevent a 00:15:31.964-->00:15:36.803 billion dollars from being stolen in a race condition. It's it's all comical right? You just 00:15:36.803-->00:15:41.941 don't see stuff like this in any other kind of programming. But it really is that simple. So, 00:15:41.941-->00:15:46.946 understanding that, we'll just jump out of here for a second, we'll do a quick, quick demo, 00:15:53.186-->00:15:58.191 see if the demo gods are smiling on us today, alright, okay. So, this is on extended display so 00:16:04.463-->00:16:09.468 it might be hard to control here but uh if you can see that. So, basically, uh, sorry about that, 00:16:13.873-->00:16:18.878 I can't see if it moved, okay, alright, so, we have a simple program like the one I just 00:16:38.464-->00:16:42.869 talked about where there is a reentrancy condition present. Okay, so if you can see it 00:16:42.869-->00:16:48.140 there, the balance is being zeroed out in the last line, if you can make that out. So, if I 00:16:48.140-->00:16:53.145 were to run oyente against this, I should be able to get it to flag the reentrancy file. So, 00:16:56.649-->00:17:01.587 I'll just do that real quick. I'll set it up and I'll execute it, alright, okay, so once we 00:17:10.563-->00:17:15.568 hit enter, it should run, did it? [laughs] awe come on man [laughs], alright hang on a sec. 00:17:33.319-->00:17:37.790 [laughter]. [laughs], I'm a bit of a comedian because of course it doesn't show the password. 00:17:37.790-->00:17:42.795 Alright, so, so, it's running, and it shows the uh, the true condition to the reentrancy 00:17:52.471-->00:17:57.109 button. So, it could run pretty simply uh because of this extended situation, I'm not 00:17:57.109-->00:18:00.880 gonna run the next part but, I was gonna show you how ironically a bit of code that 00:18:00.880-->00:18:04.650 the developers wrote now errors out in oyente which is kind of comical because it's their 00:18:04.650-->00:18:08.988 sample code. But this one actually successfully ran and showed you so you'd be able to 00:18:08.988-->00:18:13.993 go in and say why is it there and then you can make a tweak if need be. Alright, so I'll just 00:18:21.567-->00:18:26.572 get that out of the way. Okay and we're back, okay so after seeing that, you should be able 00:18:45.191-->00:18:49.428 to spot it pretty simply in a snippet of actual DAO code right? So if you look here, it 00:18:49.428-->00:18:53.366 should be pretty obvious, because they're doing the withdrawal function first, 00:18:53.366-->00:18:57.670 without doing all the accounting that follows afterwards, it's possible for a reentrance for a 00:18:57.670-->00:19:01.674 race condition to occur. And it's possible to keep hitting that red line over and over and 00:19:01.674-->00:19:05.911 over again and draining the balances down to zero. So, that's the basic idea of 00:19:05.911-->00:19:10.783 reentrancy, you just have to watch the careful ordering of the outpatient. So, what just 00:19:10.783-->00:19:17.023 happened last week with parity wallet, um is interesting cause Gavin Wood, the guy that wrote 00:19:17.023-->00:19:22.528 parity wallet is one of the four developers of solidity, so for him to make this kind of mistake 00:19:22.528-->00:19:27.867 was kind of embarrassing on an epic level ha, you know, ha so uh you know uh sorry about that 00:19:27.867-->00:19:32.104 Gavin, but it but it really was. So, the company basically tries to do browser based access to 00:19:32.104-->00:19:37.810 ethereum to try and bring it more into use- usability. Um, he wrote a multi sig wallet and it 00:19:37.810-->00:19:41.881 in theory multi sig sounds great, right? Multi signature, extra security, the only problem 00:19:41.881-->00:19:46.886 is solidity, there's something called uh visibilities. So functions have visibilities, uh, 00:19:46.886-->00:19:52.591 in the case of functions the visibilities could be public, internal, external, or private. 00:19:52.591-->00:19:56.896 The problem is if you don't declare them specifically, they're by default gonna be 00:19:56.896-->00:20:03.536 public. So, if they're public that means it could be called internally or externally, by 00:20:03.536-->00:20:10.443 anyone via message. So, that's not what you want ideally in code, um so you could see in 00:20:10.443-->00:20:17.349 pink how in the original version of the code, there was no declaration made. Uh, in green 00:20:17.349-->00:20:22.254 you can see how they were changed to internal, of course that happened after a whole lot 00:20:22.254-->00:20:27.259 of money was stolen. So. alright, so the attackers could send a message calling the uh, 00:20:35.301-->00:20:38.938 it might be a little hard to see this, but the attackers could send a message calling the 00:20:38.938-->00:20:43.008 public init wallet, and that function will override the original owner addresses with 00:20:43.008-->00:20:49.982 their own. Um, so the attacker is then able to wrap that function call and pass in his 00:20:49.982-->00:20:56.422 own, or her own eth address as the new owner. So, in that first step you say hey, this wallets 00:20:56.422-->00:21:01.360 mine, and then with just another simple request, um, you can use the execute function, and when 00:21:03.462-->00:21:07.199 that happens, your private key is used to sign an outgoing transfer for the balance of the 00:21:07.199-->00:21:12.271 account. Uh, if you do this, rinse and repeat for 3 major ICO's, you get 30 million 00:21:12.271-->00:21:18.377 dollars for your effort, not bad for a day's work, right? Not too bad at all ha. So, interestingly 00:21:18.377-->00:21:22.781 enough we used the term race condition before, uh, here this became a human race condition, 00:21:22.781-->00:21:27.920 because a group called the white hat hacker group, uh they noticed this too, and noticed it 00:21:27.920-->00:21:33.659 was going on, so they quickly went in and started stealing the money from um people who hadn't 00:21:33.659-->00:21:37.429 been attacked yet, from accounts and things that hadn't been attacked yet and they syphoned 00:21:37.429-->00:21:41.634 off if you add everything up about 200 million dollars and moved it to a wallet to protect 00:21:41.634-->00:21:47.406 it from this attack until it's code was patched. Uh, but only a few people have gotten the money 00:21:47.406-->00:21:53.112 back so far [laughter], soooo, you know, they, they promised by the 31st but uh the white hat 00:21:53.112-->00:21:58.751 hacker group if they don't come through, that, that name is just gonna suck [laughter]. You know 00:21:58.751-->00:22:03.689 they're gonna, they're gonna have to come up with a different one [laughs] so. So, another, 00:22:06.192-->00:22:10.629 another popular attack was uncheck send. Um, it, it was first discovered in kind of a 00:22:10.629-->00:22:15.100 goofy game, uh but it's still worth talking about, now, you'll find this kind of thing in 00:22:15.100-->00:22:19.805 ethereum a lot, uh in the early days of solidity, people would make these silly games, almost 00:22:19.805-->00:22:24.510 like ponzi schemes uh or, or a digital chain letter, in the blockchain if you will. You know 00:22:24.510-->00:22:28.647 that's what they went for. So, the idea was to uh claim a prize, so, you would submit 00:22:28.647-->00:22:33.719 let's say one ethe to a game like this, and that would make you King of the ether. Now, back 00:22:33.719-->00:22:37.957 then, one ethe was worth like nothing, now it would be like handing over 200 bucks but uh so 00:22:37.957-->00:22:42.928 you hand over this ethe and you're now king of the ether, so for someone to dispose you, 00:22:42.928-->00:22:48.601 they'd have to pay 1 point 5 ethe, the contract creator gets a little dig off of that, and 00:22:48.601-->00:22:53.205 then, you get the rest of the money, so you get paid, kind of like a chain letter to be bumped 00:22:53.205-->00:22:58.010 out of the process then the next person pays more, and the next person pays more. So, if it's 00:22:58.010-->00:23:03.148 all fair, it's a way to just keep throwing money for, I have no idea why, [laughs] but they, 00:23:03.148-->00:23:08.153 that's that's the way the game works. So, games like this, um you're sending using the keyword 00:23:10.589-->00:23:16.328 send, and it acts like a method that's uh defined for every address object, but send can 00:23:16.328-->00:23:21.900 fail, it's not foolproof. So ether stored in uh either externally on contracts, uh, uh 00:23:21.900-->00:23:27.473 accounts, controlled by human or in contract accounts, um and these are controlled by a 00:23:27.473-->00:23:31.143 contract, like that's why they're called contract accounts. Um, metropolis version 00:23:31.143-->00:23:36.715 of ethereum is gonna kind of abstract this, but anyway. So, in a contract account you can 00:23:36.715-->00:23:42.521 have a generalized error that um would cause it to fail. That's basically what happened. Uh, 00:23:42.521-->00:23:48.027 because anytime a contract like that was called, an error would occur, a new person would become 00:23:48.027-->00:23:54.566 monarch but the old person would not get their money. So, if you had been expecting to get 2.5 00:23:54.566-->00:23:59.071 ethe or whatever at that point, you got zip and now the new person was king and you were out 00:23:59.071-->00:24:04.343 2.5 ethe. So again, it's a goofy game, it's not really serious but this kind of ability for 00:24:04.343-->00:24:08.914 send to fail is dangerous if you're talking about you know millions of dollars or something 00:24:08.914-->00:24:14.853 like that. So, it's important to look for. So, rather than go into the whole long remediation 00:24:14.853-->00:24:18.023 code and the king of ether, I just whipped up something a little easier to hopefully to 00:24:18.023-->00:24:23.762 understand. Um, so over here you can see uh the top code snippet it's called king of losing cause 00:24:23.762-->00:24:28.901 ultimately like what's the point of this game right? Ha,but uh so if send fails,over here the 00:24:28.901-->00:24:34.440 winner doesn't get the money. Uh, the compensation sent will be set to true, again, it's the 00:24:34.440-->00:24:39.745 order that got you in solidity, the order of operations here. So, if there's a fail, it says 00:24:39.745-->00:24:43.615 that that person got paid, but they actually never did,that's why at the top there it says 00:24:43.615-->00:24:48.921 compensation sent is true. Now, again, it can fail if it's a contract that generates some 00:24:48.921-->00:24:53.425 kind of error, or some other kind of condition occurs. So to protect the price from being 00:24:53.425-->00:24:59.965 sent into the you know ether, um you can have it do a check, like on the bottom, um you can have 00:24:59.965-->00:25:05.504 it do an if check where, if it's not actually sent, there'll be some kind of thrown error. Now 00:25:05.504-->00:25:09.575 uh, uh a thing about throw as we'll see in a moment, it's being deprecated uh there's 00:25:09.575-->00:25:13.846 other forms of validation that I'll, I'll talk about in a moment, but uh throw is just 00:25:13.846-->00:25:18.851 easiest to show in a slide like this. Alright, so back to um what was going on with king of 00:25:22.454-->00:25:27.593 ether, those contracts were failing because they uh ran out of gas, you know. Uh, it, it, 00:25:27.593-->00:25:33.832 it's a funny thing about um gas, so miners are incentivised they're paid to run the ethereum 00:25:33.832-->00:25:39.338 virtual machine in gas, it it it's like a unit it's a small unit of ether um and it 00:25:39.338-->00:25:45.844 fluctuates of course. So, you get these little payments, but just like a block shaped Jeep, a 00:25:45.844-->00:25:51.483 block can only hold so much gas, and if you try to overfill it, well you know, you have an 00:25:51.483-->00:25:57.523 exploding station, or, or something like that. Um, to find out how much gas you can ever 00:25:57.523-->00:26:01.560 have inside of blackhat at any given time you can go to estats dot net, and it shows you a 00:26:01.560-->00:26:06.865 whole lot of pretty you know Hollywood hackery looking tables and things, uh but in there is 00:26:06.865-->00:26:10.369 also an important number. Currently, a little under 7 million, so that's how much gas 00:26:10.369-->00:26:14.740 can be in a block. So, if you disobey that, you're gonna have a problem. Something like an 00:26:14.740-->00:26:19.077 externally contrac, sent contract and fail and introduce errors like we said earlier. 00:26:19.077-->00:26:24.082 Alright, so auditing contracts uh requires looking for uh places where errors lead to 00:26:28.087-->00:26:34.193 unintended uh possibly costly outcomes. It's not so different from other types of uh hacking 00:26:34.193-->00:26:38.730 you know. So, you have to look for the order of operations like I've said, uh if something fails 00:26:38.730-->00:26:44.770 due to an error, nothing that comes after might run. Um, so this could be sort of like 00:26:44.770-->00:26:49.341 unintentional denial of service. There's a lot of problems in ethereum where something will 00:26:49.341-->00:26:52.945 error out and then everything that comes after is just ignored. Which could be pretty 00:26:52.945-->00:26:59.184 dangerous. So, in this case line 11 is trouble, um it's it's fru this is uh, an example taken 00:26:59.184-->00:27:04.790 from the solidity docs um an attacker could trap the contract into an unusable uh state by 00:27:04.790-->00:27:09.928 causing the richest to be the address of a contract that has a fallback function which fails, 00:27:09.928-->00:27:15.234 so uh I think Matt talked about fa fa fallback functions a bit yesterday to. Um, so it or even 00:27:15.234-->00:27:20.606 if it just consumes more than the amount of gas that that's needed, so that way, a transfer 00:27:20.606-->00:27:26.545 like that failing, will cause the rest to not work. So, to avoid this kind of problem, 00:27:26.545-->00:27:32.384 you're gonna actually set up withdraw functions. Uh, patterns in the application, that allow 00:27:32.384-->00:27:37.022 withdrawals to happen instead of forcing things to happen. So, if you're overthrown some wrenches 00:27:37.022-->00:27:41.193 for example, you'll still get it because no errors can happen. In this case the worst you can do 00:27:41.193-->00:27:45.464 is cause your own withdrawal to fail, which, I don't know why you'd want to do that uh but, 00:27:45.464-->00:27:49.902 but that's the safety of using withdrawal. Sometimes, this is also called push pull instead of 00:27:49.902-->00:27:54.039 withdraw and send, but the idea is the same, that you can intelligently withdraw from a 00:27:54.039-->00:28:00.145 contract. Now uh before we talk about the next vuln I just want to make a note about the 00:28:00.145-->00:28:05.584 blockchain. There's all sorts of crypto involved in the blockchain in general, but what 00:28:05.584-->00:28:11.156 you'll find is most of the data that's actually put on a public blockchain ethereum is, it's 00:28:11.156-->00:28:16.028 readable you know you can explore it, you can analyze it. Um, so, yeah, encryption 00:28:16.028-->00:28:21.166 protects wallets uh it protects things like that, it doesn't protect necessarily the data 00:28:21.166-->00:28:26.572 that's going up on a blockchain so games and other contracts that rely on any kind of like um 00:28:26.572-->00:28:31.276 secret knowledge or winning knowledge can sometimes be fooled. So, if, if you see that 00:28:31.276-->00:28:35.447 people are making guesses on a chain, you're gonna make on a game of chance, you obviously 00:28:35.447-->00:28:38.617 wouldn't make those guesses if you saw they never won right? You would kind of observe what 00:28:38.617-->00:28:43.255 other people did and then you would figure out and narrow your chances and make your own guess. 00:28:43.255-->00:28:47.826 So, that that's not really a great thing, um the new metropolis hard fork is going to 00:28:47.826-->00:28:52.397 try to do something about um having some kind of transactional privacy. Uh so 00:28:52.397-->00:28:57.402 i'll talk about that in a sec. Alright, so, we've seen examples of how the order is so 00:28:59.605-->00:29:04.376 important. Um so this was discovered by the guys that made the Doante tool um, transaction 00:29:04.376-->00:29:09.982 ordering dependence. So, the idea is that transactions can hit the blockchain in unexpected 00:29:09.982-->00:29:14.920 timing right you're not necessarily sure when they're gonna go somewhere. So, if you 00:29:14.920-->00:29:20.492 have like a simple puzzle like this, um on the left there you'll see that the contracts 00:29:20.492-->00:29:25.697 private storage is allocated, initialized in line 8. Um and then on the right you have the 00:29:25.697-->00:29:31.870 exec, executable code start and that's line 15 over there in the giant margin. So, transactions 00:29:31.870-->00:29:37.743 invoke puzzle will execute that part and it's anonymous by default. So, sender info, send 00:29:37.743-->00:29:42.981 ether data, it'll all be invoked and uh sent out. Now, the contract owner can update the 00:29:42.981-->00:29:49.154 reward variable, okay, that's kinda like dangerous, uh you can literally say how much the 00:29:49.154-->00:29:54.693 reward is gonna be in in 19 and then it loops back to 18, if you look I tried to makeup a little 00:29:54.693-->00:29:59.297 symbol. So, then after that you have that arrow going down which shows the actual pay out of the 00:29:59.297-->00:30:05.337 contract. Now what happens if a couple of blocks appear at the same time, to a miner and 00:30:05.337-->00:30:09.608 someone is able to influence that and say oh well someone's about to win all of a sudden the 00:30:09.608-->00:30:14.579 rewards gonna be 1 ether instead of 1-->000 ether. Uh, that, that's kind of a dangerous situation 00:30:14.579-->00:30:19.117 you have someone being very, very dishonest in that case. They can present this seemingly 00:30:19.117-->00:30:24.389 fair game and mess around with it. So, oyente is actually pretty good at discovering this 00:30:24.389-->00:30:29.394 kind of like forking possibility and detecting the transaction order dependence bug. Uh the 00:30:32.397-->00:30:36.635 other function I mentioned that they'd find, the other error uh call stack depth limit, this is 00:30:36.635-->00:30:42.007 no longer really a problem and most people don't know this, but um , the vip 150, it's now 00:30:42.007-->00:30:48.080 become exponentially difficult to exhaust gas uh in this kind of attack. So, what use to 00:30:48.080-->00:30:53.952 happen was you'd have let's say um because of the one thousand twenty four limit on call stack, 00:30:53.952-->00:30:58.356 someone can create a contract that brings it all the way up one thousand twenty three and 00:30:58.356-->00:31:02.094 then make a request which would be one thousand twenty four and cause an error. But because of 00:31:02.094-->00:31:06.798 the IP 150 changes, now what happens is it just becomes like I said exponentially more 00:31:06.798-->00:31:10.969 expensive to do an attack like this so in the real world, I don't anticipate call stack to 00:31:10.969-->00:31:15.273 really be a problem anymore. So, it's sort of just like a historical footnote, unless, 00:31:15.273-->00:31:22.247 something drastically changes. Um so we saw that there's a lot of ponzi games and things going 00:31:22.247-->00:31:27.552 on in ethereum for some reason. Uh and one of the reasons the-there so popular is you 00:31:27.552-->00:31:32.057 could publish the source code. Right? You can say to people hey look this game is fair, read it, 00:31:32.057-->00:31:36.428 read the source code, find something wrong with it. Uh, of course no one really does but 00:31:36.428-->00:31:41.032 [laughs] it's out there for anyone to analyze. So, it's possible to make a mistake, you 00:31:41.032-->00:31:45.570 know, if you use highlighting, it-it makes it easier sometimes to see when you are doing 00:31:45.570-->00:31:50.275 something wrong, but uh it's possible to make mistakes, mistakes can happen. But, it's 00:31:50.275-->00:31:55.547 also possible to trick people into the code they're reading at a quick glance is actually doing 00:31:55.547-->00:32:00.352 something different than what it does. So, in this case we have two separate variables, a payout 00:32:00.352-->00:32:04.456 cursor id with an underscore at the end, and you've got payout cursor id with no underscore at 00:32:04.456-->00:32:06.458 the end. Talk about something that's incredibly easy to miss if you're just scanning through, 00:32:06.458-->00:32:10.395 it's like oh yeah yeah you just talk about having cursor id. Um, so what happens is the first 00:32:10.395-->00:32:15.400 variable is getting incremented, but the line of code that actually draws the money out, is 00:32:21.573-->00:32:27.245 taking it from the other one, so the person who's involved in in a game like this, thinks that 00:32:27.245-->00:32:31.416 they're contributing to a fair game, when in reality their variable is ultimately being 00:32:31.416-->00:32:35.287 ignored and it's the other one that just looks kind of similar and you might miss is actually 00:32:35.287-->00:32:38.657 getting all the money. Now again, this could happen accidentally, but in, in 00:32:38.657-->00:32:42.828 reality, this is where the ethical and unethical hacking comes in right? This is where 00:32:42.828-->00:32:47.165 you'd have to notice something like this is going on and be the one to you know raise the hand. 00:32:52.337-->00:32:56.675 So, as I said before, throws being deprecated, uh but input validation is a theme that 00:32:56.675-->00:33:01.613 should never leave uh any kind of app testing behind. Uh, you always have to do proper input 00:33:01.613-->00:33:07.419 validation. So, now we've got these new um, we've got require, which is meant to be used for 00:33:07.419-->00:33:11.623 input validation, um it should be done at any user input. So if the user sends something that's 00:33:11.623-->00:33:15.694 not expected, it throws if a condition is false. So, that, that's a good thing you know 00:33:15.694-->00:33:19.931 you're getting what you expect. Uh, there's also assert which is neat because it can also check 00:33:19.931-->00:33:25.270 for internal errors, uh or if a contract as reached any kind of like invalid state. So, uh this 00:33:25.270-->00:33:30.308 is far more superior than just simple throw although I didn't want to make examples with these 00:33:30.308-->00:33:35.180 two cause that just gets too long so I used the deprecated throw, sorry, it's easier to 00:33:35.180-->00:33:38.416 show. But, this, this is the kind of thing to look for, everywhere that there could be 00:33:38.416-->00:33:42.487 validation of contract there should be. Again, to prevent any kind of like denial of service 00:33:42.487-->00:33:47.492 or anything like that that we talked about. So, a couple odds and ends here, um timestamp 00:33:49.828-->00:33:54.532 dependence um it's a little different than transaction order dependence, um the timestamp of 00:33:54.532-->00:33:59.838 a block can be manipulated , so watch out for any contracts that actually rely on a timestamp, uh 00:33:59.838-->00:34:04.242 it could be manipulated, it could be changed, it could be read within 900 seconds um to 00:34:04.242-->00:34:08.580 have uh a different one be valid. So, because of reva-reasons like that, you want 00:34:08.580-->00:34:12.851 to make sure that silly things like that aren't being done, cause it's too easy to trick 00:34:12.851-->00:34:18.356 something that relies heavily on time. Um, business logic flaws in solidity, I-I expect this to 00:34:18.356-->00:34:23.895 be the next like big thing. Uh, people are focused on those little line to line errors but 00:34:23.895-->00:34:28.266 sometimes you have to take a step back and say hey what is this thing supposed to do? And 00:34:28.266-->00:34:33.838 see that maybe it's not really doing what the developer thinks it's doing. So, so that becomes 00:34:33.838-->00:34:39.110 something worth looking at. Um, separating public and private, this is real interesting, and 00:34:39.110-->00:34:44.816 ethereum has taken off quite a bit in the last few months, um enterprise ethereum alliance 00:34:44.816-->00:34:49.220 forum. Uh, the idea there is a lot of companies are starting to have private permission block 00:34:49.220-->00:34:54.326 chains internally that are then communicating with the bigger public block chains, and how you 00:34:54.326-->00:35:00.398 handle that public-private hand off is huge and I think could be a potential attack vector. So, 00:35:00.398-->00:35:04.669 something that'll be worth looking at in the future. Um, I'm not sure if the JPC quorum 00:35:04.669-->00:35:09.240 guys are here but, but basically in quorum they handle this pretty well, they have 00:35:09.240-->00:35:13.244 transaction senders that can use something called private core, and you can basically say hey, 00:35:13.244-->00:35:18.516 this transactions private for these people, and then after that it uses a hash of encrypted 00:35:18.516-->00:35:23.588 data only, and then it points to the actual encrypted data, so that way um, no one actually 00:35:23.588-->00:35:27.759 get's access to po- to any information that they're not supposed to have even though 00:35:27.759-->00:35:33.098 it's all in the blockchain world right? So, it, it's a pretty ingenious way to handle it, so 00:35:33.098-->00:35:37.502 good on them. But, basically when you're going in and doing any kind of like test of 00:35:37.502-->00:35:41.706 something that's new, some new interaction, you've got to look at those boundaries, which again 00:35:41.706-->00:35:46.911 kinda goes back to the whole idea of um threat modeling. You know like, like how, how is data 00:35:46.911-->00:35:53.818 handled, how does it um move through? Uh, okay, so um, I think it's time for a lot more 00:35:53.818-->00:36:00.091 people to get involved, I'm lonely, no [laughs], a lot of people have to be looking at 00:36:00.091-->00:36:06.765 this stuff. So, I, I've been coming to Def Con since the Alexis Park days, you know, and 00:36:06.765-->00:36:11.736 I know there's a lot of talent out there, uh so it shouldn't take very long for uh some of 00:36:11.736-->00:36:16.608 you guys to get spun up and gals to uh, you know, join the fight here [laughs]. You know, you can 00:36:16.608-->00:36:21.312 get involved in making smart contracts more secure. Um, despite it's hiccups I still 00:36:21.312-->00:36:25.316 believe in ethereum. I-I think it's pretty incredible technology. Uh, they've never 00:36:25.316-->00:36:29.387 missed a dev milestone which I don't know if there's any other project in the history of IT 00:36:29.387-->00:36:33.858 that's never missed a dev milestone and, and somehow this young kid, metallic made that 00:36:33.858-->00:36:38.296 happen, so uh good on him for that. Um, so now we're entering what's called metropolis and 00:36:38.296-->00:36:43.234 yeah that's actually the, the 20 silent movie, um, you know [laughs] not not ethereum art 00:36:43.234-->00:36:49.107 but, uh it's gonna, it's gonna be even more touring complete if you will. Um it's gonna have a 00:36:49.107-->00:36:53.378 new revert and a new return data, it's gonna improve exception handling, so, that'll 00:36:53.378-->00:36:57.348 be cool for security. Um, some account abstractions coming, which will have to check 00:36:57.348-->00:37:01.653 wallets, um it might even help protect them against quantum computing attacks in the future. 00:37:01.653-->00:37:05.557 Which, uh is a whole other topic that uh if you want me to bore you to death, stop me in the 00:37:05.557-->00:37:10.528 hall and um, I'll talk about that [laughs]. It's also introducing zk snarks which is 00:37:10.528-->00:37:15.366 the cool crypto primitives. Um, even though they're again primitives for now, it should in 00:37:15.366-->00:37:20.572 theory allow um enhanced privacy and transactions going forward, so even though it's the public 00:37:20.572-->00:37:24.242 ethereum blockchain, you could be able to actually have some privacy for the first time in 00:37:24.242-->00:37:29.547 the transactions you make. So that's a pretty cool thing. Uh, and finally with what's coming 00:37:29.547-->00:37:35.053 there's swarm. I mean if, if you haven't heard about swarm, please go forth and google. Uh, 00:37:35.053-->00:37:40.458 it's quite possibly you know the next amazing thing that you've never heard of. Uh, if anyone's 00:37:40.458-->00:37:45.463 watched Silicon Valley uh this summer on HBO uh they did their whole 'trying to have a 00:37:45.463-->00:37:49.667 serverless internet' you know by taking up little bits of data on a phone uh storing and 00:37:49.667-->00:37:54.539 compressing it. Well, swarm is sort of like that, where it's gonna be using the EVN to have 00:37:54.539-->00:37:59.344 sharding and, and files located all around the world with um the address translation and 00:37:59.344-->00:38:02.914 everything so you could pull it back and get it. Uh, it's pretty amazing technology and once it's 00:38:02.914-->00:38:07.352 rolling full swing I mean it's gonna change a lot. So, definitely try and get involved 00:38:07.352-->00:38:12.357 and uh join me in this uh good new fight. And uh, if you guys want to keep in touch, uh please 00:38:14.492-->00:38:19.430 do reach out um, if, if you have questions, like some little bit of code you're working on, maybe 00:38:19.430-->00:38:24.002 I could take a quick look or something, uh or if you just wanna you know yell at me or 00:38:24.002-->00:38:29.007 whatever. Uh, so [laughs] definitely reach out and uh thanks for coming. [applause]