elective-stereophonic
elective-stereophonic
NXT security audit / attack simulations on TestNet singapore
Please login or register.

Login with username, password and session length
Advanced search  

News:

Latest Stable Nxt Client: Nxt 1.12.2

Pages: 1 [2] 3 4 5  All

Author Topic: NXT security audit / attack simulations on TestNet  (Read 19319 times)

lopalcar

  • Hero Member
  • *****
  • Karma: +99/-15
  • Offline Offline
  • Posts: 561
    • View Profile
Re: NXT security audit / attack simulations on TestNet
« Reply #20 on: February 08, 2015, 10:25:31 am »

great! got 206k now, should be more than enough - please don't send any more and give me some time
once I'm done I can return them if needed
thanks
How is it going? Any update? :)
Logged

phramz

  • Guest
Re: NXT security audit / attack simulations on TestNet
« Reply #21 on: February 08, 2015, 03:16:51 pm »

i set up a hallmarked node (node1.forgenxt.com) forging 24/7 on testnet account NXT-MHZJ-UB3C-ZYPP-34BD2

... i'm very curious about the outcome of this pentest  :)
Logged

cynicSOB

  • Jr. Member
  • **
  • Karma: +11/-3
  • Offline Offline
  • Posts: 21
    • View Profile
Re: NXT security audit / attack simulations on TestNet
« Reply #22 on: February 10, 2015, 08:51:02 pm »

updates:

- I found no advantage in splitting the stake in various accounts.
- NXT's POS using block generator signatures is robust, probably even better than PPC's stake modifiers. You should probably thank Cunicula for that: his discussions with cfb led to that design.
- It's still POS, so 20% of the staking weight, which is at best 10% of the total supply, is enough to double spend once every 30hs. Here, double-spend is calculated for 10 confirmations. For 4 confirmations (like some exchanges use) half of that much is more than enough
- I found a hole that allows me to (aprox) double my staking weight: I can make 1M NXT forge as often as 2M should. This would allow a 51% attack with 25% stake. This is still theory, I need to modify the client to generate the attack.

So, I can't attack testnet with only 200K.. that thing was an underestimation... but I could with 2M. And I found a serious security problem, so please organize a bounty and set the goals to claim it. Come on, let's gather some 200K real NXT (not just testnet) :) I'm sure once the devs understand this they'll agree and fix it.
Since I don't need to split the NXT in several accounts, if I wanted to try to double spend with 10% of the supply I could do it with leasing.
Leasing is a good idea: I think it's the reason why the total network staking weight is high for NXT compared to others.
Logged

davethetrousers

  • Sr. Member
  • ****
  • Karma: +38/-7
  • Offline Offline
  • Posts: 306
  • Tersonal Pext
    • View Profile
Re: NXT security audit / attack simulations on TestNet
« Reply #23 on: February 10, 2015, 09:26:04 pm »

Well, that would be interesting to find out. "Interesting" in a sort of negative way ;)

If I get you correctly, you claim the guaranteed ability to doublespend with 200M NXT or, in sort of a best- worst-case scenario, with as little as 40M, using also the alleged exploit. This is only correct if I got this passage right:
Quote
It's still POS, so 20% of the staking weight, which is at best 10% of the total supply

Is any form of staking power, including leased, enough for your attack vector, or does it need "real" stake? If it doesn't matter, it would be wise to allot you 200M of leased stake on testnet and see what happens. For this, we would just need the support of some "test whales".
« Last Edit: February 10, 2015, 09:28:39 pm by davethetrousers »
Logged
raspnxt.hopto.org | RPi & Linux stuff | NXT-2UKS-7VYN-Q73Y-EKE8Y

farl4bit

  • Hero Member
  • *****
  • Karma: +210/-45
  • Offline Offline
  • Posts: 3466
    • View Profile
    • Crypto Advies
Re: NXT security audit / attack simulations on TestNet
« Reply #24 on: February 10, 2015, 09:35:20 pm »

Thanks for the update! But can't you fix the security problem or tell the devs how?
Logged

bcdev

  • Hero Member
  • *****
  • Karma: +162/-22
  • Offline Offline
  • Posts: 666
    • View Profile
Re: NXT security audit / attack simulations on TestNet
« Reply #25 on: February 10, 2015, 09:36:13 pm »

You could use https://github.com/bcdev-/NXT-testnet-in-a-box . That way you could simulate the attack without asking testnet whales for founds.
Right now the code is outdated [1.4.6], but I can port changes to 1.4.13 if you need them.

Be careful though, I changed the function that calculates effective balance - you might want to revert it if it makes any difference to you.
Logged

lopalcar

  • Hero Member
  • *****
  • Karma: +99/-15
  • Offline Offline
  • Posts: 561
    • View Profile
Re: NXT security audit / attack simulations on TestNet
« Reply #26 on: February 10, 2015, 09:41:33 pm »

So you need 1M and turn it yourself into 2M "more merit" or should I send you 2 million testnxt? :)
Make me know where to send them "to the account I sent first time or to the account you sent them from there?", I have 1,8 or 1,9 million remaining, hope you return to me once you finished  ;)
Will you realease some info or superficial description about the serious security problem before the bounty?
Logged

gs02xzz

  • Hero Member
  • *****
  • Karma: +56/-12
  • Offline Offline
  • Posts: 1101
    • View Profile
Re: NXT security audit / attack simulations on TestNet
« Reply #27 on: February 10, 2015, 09:43:23 pm »

So, I can't attack testnet with only 200K.. that thing was an underestimation... but I could with 2M. And I found a serious security problem, so please organize a bounty and set the goals to claim it. Come on, let's gather some 200K real NXT (not just testnet) :) I'm sure once the devs understand this they'll agree and fix it.
Since I don't need to split the NXT in several accounts, if I wanted to try to double spend with 10% of the supply I could do it with leasing.
Leasing is a good idea: I think it's the reason why the total network staking weight is high for NXT compared to others.

I think you deserve more than 200K real NXT if you find and show the flaws.
Logged
Nxt Mission is to commercialize the crypto technology and build new commerce and society.

Wakasaki808

  • Sr. Member
  • ****
  • Karma: +14/-0
  • Offline Offline
  • Posts: 275
    • View Profile
Re: NXT security audit / attack simulations on TestNet
« Reply #28 on: February 10, 2015, 09:50:43 pm »

Interesting :)

Thanks for helping
Logged
NXT-98EP-BVRB-WU6B-386RA

allbits

  • Full Member
  • ***
  • Karma: +31/-3
  • Offline Offline
  • Posts: 221
    • View Profile
Re: NXT security audit / attack simulations on TestNet
« Reply #29 on: February 10, 2015, 09:59:57 pm »

Good news is he's asking for a bounty in nxt, not btc  ;D
Logged

EvilDave

  • Hero Member
  • *****
  • Karma: +341/-40
  • Offline Offline
  • Posts: 1789
    • View Profile
    • NXT Foundation
Re: NXT security audit / attack simulations on TestNet
« Reply #30 on: February 10, 2015, 10:09:39 pm »

Well, we don't actually know how much bounty CynicSOB would like......I'm not going to make any promises right now, but if Cynics work checks out, then a bounty in the 200 kNXT range seems reasonable.

As usual, we need to have some discussion about this.
Could a dev or two assess Cynics 'serious security problem' and the double spend/increase forging weight exploits?

I'll have a chat with the Community Funds Committee, as a bounty payment should come from community funds.

Good to hear this, btw:
Quote
- NXT's POS using block generator signatures is robust, probably even better than PPC's stake modifiers. You should probably thank Cunicula for that: his discussions with cfb led to that design.
Logged
Nulli Dei, nulli Reges, solum NXT
NXT Donations: NXT-BNZB-9V8M-XRPW-3S3WD
We will ride eternal, shiny and chrome!

EvilDave

  • Hero Member
  • *****
  • Karma: +341/-40
  • Offline Offline
  • Posts: 1789
    • View Profile
    • NXT Foundation
Re: NXT security audit / attack simulations on TestNet
« Reply #31 on: February 17, 2015, 11:41:30 pm »

Swift kick......anyone with proper technical skills had a chance to look at CynicSOB's work ?
Logged
Nulli Dei, nulli Reges, solum NXT
NXT Donations: NXT-BNZB-9V8M-XRPW-3S3WD
We will ride eternal, shiny and chrome!

Riker

  • Core Dev
  • Hero Member
  • *****
  • Karma: +440/-42
  • Offline Offline
  • Posts: 1796
    • View Profile
Re: NXT security audit / attack simulations on TestNet
« Reply #32 on: February 18, 2015, 09:38:02 am »

Swift kick......anyone with proper technical skills had a chance to look at CynicSOB's work ?

If I understand correctly, CynicSOB thinks he found an attack vector or some sort of security hole in the NXT protocol on Testnet.
Common sense is that he should post his findings here so we can review his findings.
Instead, he would like to receive 200K real NXT as compensation for revealing his findings. Are we willing to give him 200K for this ?
Logged
NXT Core Dev
Account: NXT-HBFW-X8TE-WXPW-DZFAG
Public Key: D8311651 Key fingerprint: 0560 443B 035C EE08 0EC0  D2DD 275E 94A7 D831 1651

valarmg

  • Hero Member
  • *****
  • Karma: +178/-57
  • Offline Offline
  • Posts: 1766
    • View Profile
Re: NXT security audit / attack simulations on TestNet
« Reply #33 on: February 18, 2015, 09:43:06 am »

Swift kick......anyone with proper technical skills had a chance to look at CynicSOB's work ?

If I understand correctly, CynicSOB thinks he found an attack vector or some sort of security hole in the NXT protocol on Testnet.
Common sense is that he should post his findings here so we can review his findings.
Instead, he would like to receive 200K real NXT as compensation for revealing his findings. Are we willing to give him 200K for this ?

He should reveal his findings privately to kushti, and afterwards discuss compensation.

I think 200K Nxt is too much if you compare with what devs are getting, who are working day in, day out on Nxt.
Logged
NXT-CSED-4PK5-AR4V-6UB5V

yassin54

  • Hero Member
  • *****
  • Karma: +240/-14
  • Offline Offline
  • Posts: 2503
  • I am Homer, Sorry my english is Bad!!
    • View Profile
Re: NXT security audit / attack simulations on TestNet
« Reply #34 on: February 18, 2015, 10:11:21 am »


He should reveal his findings privately to kushti, and afterwards discuss compensation.

i am agree 100%

Daedelus

  • Hero Member
  • *****
  • Karma: +230/-12
  • Offline Offline
  • Posts: 3280
    • View Profile
Re: NXT security audit / attack simulations on TestNet
« Reply #35 on: February 18, 2015, 01:37:56 pm »

Even cynicSOB says it's still only theory, let's wait for modified client tests to confirm.
Logged
NXT: NXT-4CS7-S4N5-PTH5-A8R2Q

jones

  • Hero Member
  • *****
  • Karma: +310/-8
  • Offline Offline
  • Posts: 1043
  • write code not war
    • View Profile
    • jNxt
Re: NXT security audit / attack simulations on TestNet
« Reply #36 on: February 18, 2015, 05:57:48 pm »

updates:

- I found no advantage in splitting the stake in various accounts.
- NXT's POS using block generator signatures is robust, probably even better than PPC's stake modifiers. You should probably thank Cunicula for that: his discussions with cfb led to that design.
- It's still POS, so 20% of the staking weight, which is at best 10% of the total supply, is enough to double spend once every 30hs. Here, double-spend is calculated for 10 confirmations. For 4 confirmations (like some exchanges use) half of that much is more than enough
- I found a hole that allows me to (aprox) double my staking weight: I can make 1M NXT forge as often as 2M should. This would allow a 51% attack with 25% stake. This is still theory, I need to modify the client to generate the attack.

So, I can't attack testnet with only 200K.. that thing was an underestimation... but I could with 2M. And I found a serious security problem, so please organize a bounty and set the goals to claim it. Come on, let's gather some 200K real NXT (not just testnet) :) I'm sure once the devs understand this they'll agree and fix it.
Since I don't need to split the NXT in several accounts, if I wanted to try to double spend with 10% of the supply I could do it with leasing.
Leasing is a good idea: I think it's the reason why the total network staking weight is high for NXT compared to others.

I'm skeptical, as always :)

I'm not sure how 20% staking weight can double-spend a transaction every thirty hours if the person waits the normal 10 confs. A finney attack would be regular, the evil forger wouldn't include the block when it forged, and the person that accepted after one confirm would be double spent on, when we wait more than one confirm, the security increases with all the different forgers that pile blocks on top, with 10 confirms, the chance of a person with 20% staking power forging 10 consecutive blocks would be (0.2)^10 would take over a million blocks to happen. (0.2)^4 is much less, but since the largest staker has about 10% right now (0.1)^4 is small enough to only happen twice so far in nxt's existence.

Doubling the staking power is interesting, I'll do some more thinking and try to figure this out for myself, my bounty is 0 though :)
Logged
-- Jones NXT-RJU8-JSNR-H9J4-2KWKY

jl777

  • Hero Member
  • *****
  • Karma: +718/-123
  • Offline Offline
  • Posts: 6170
    • View Profile
Re: NXT security audit / attack simulations on TestNet
« Reply #37 on: February 18, 2015, 07:46:14 pm »

updates:

- I found no advantage in splitting the stake in various accounts.
- NXT's POS using block generator signatures is robust, probably even better than PPC's stake modifiers. You should probably thank Cunicula for that: his discussions with cfb led to that design.
- It's still POS, so 20% of the staking weight, which is at best 10% of the total supply, is enough to double spend once every 30hs. Here, double-spend is calculated for 10 confirmations. For 4 confirmations (like some exchanges use) half of that much is more than enough
- I found a hole that allows me to (aprox) double my staking weight: I can make 1M NXT forge as often as 2M should. This would allow a 51% attack with 25% stake. This is still theory, I need to modify the client to generate the attack.

So, I can't attack testnet with only 200K.. that thing was an underestimation... but I could with 2M. And I found a serious security problem, so please organize a bounty and set the goals to claim it. Come on, let's gather some 200K real NXT (not just testnet) :) I'm sure once the devs understand this they'll agree and fix it.
Since I don't need to split the NXT in several accounts, if I wanted to try to double spend with 10% of the supply I could do it with leasing.
Leasing is a good idea: I think it's the reason why the total network staking weight is high for NXT compared to others.

I'm skeptical, as always :)

I'm not sure how 20% staking weight can double-spend a transaction every thirty hours if the person waits the normal 10 confs. A finney attack would be regular, the evil forger wouldn't include the block when it forged, and the person that accepted after one confirm would be double spent on, when we wait more than one confirm, the security increases with all the different forgers that pile blocks on top, with 10 confirms, the chance of a person with 20% staking power forging 10 consecutive blocks would be (0.2)^10 would take over a million blocks to happen. (0.2)^4 is much less, but since the largest staker has about 10% right now (0.1)^4 is small enough to only happen twice so far in nxt's existence.

Doubling the staking power is interesting, I'll do some more thinking and try to figure this out for myself, my bounty is 0 though :)
I have sent you the bounty!
Logged
There are over 1000 people in SuperNET slack! http://slackinvite.supernet.org/ automatically sends you an invite

I am just a simple C programmer

kushti

  • Sr. Member
  • ****
  • Karma: +184/-5
  • Offline Offline
  • Posts: 384
  • Nxt Core & Apps Dev
    • View Profile
Re: NXT security audit / attack simulations on TestNet
« Reply #38 on: February 18, 2015, 10:17:11 pm »

- It's still POS, so 20% of the staking weight, which is at best 10% of the total supply, is enough to double spend once every 30hs. Here, double-spend is calculated for 10 confirmations. For 4 confirmations (like some exchanges use) half of that much is more than enough
- I found a hole that allows me to (aprox) double my staking weight: I can make 1M NXT forge as often as 2M should. This would allow a 51% attack with 25% stake. This is still theory, I need to modify the client to generate the attack.

Wish I understand you  :) Why 30 hs? What's that about at all? Can you send me the code or detailed description in PM? Regarding "a hole", I would like to help you with a client modification, so please reveal details here as well.
Logged
for donations / messages: NXT-PKXM-WH25-UXXG-CJAVD (alias: kushti)

bitcoinpaul

  • Hero Member
  • *****
  • Karma: +590/-590
  • Offline Offline
  • Posts: 3097
  • Karmageddon
    • View Profile
Re: NXT security audit / attack simulations on TestNet
« Reply #39 on: February 18, 2015, 10:23:39 pm »

Logged
Like my Avatar? Reply now! NXT-M5JR-2L5Z-CFBP-8X7P3
Pages: 1 [2] 3 4 5  All
 

elective-stereophonic
elective-stereophonic
assembly
assembly