7 ms·

Disclosure of a Major Bug in CryptoNote Based Currencies

80 points by mike-cardwell 9y ago

vosper 9y ago
If the main website isn't working for you (wasn't for me), here's a link to Google's cache: https://webcache.googleusercontent.com/search?q=cache:https://getmonero.org/2017/05/17/disclosure-of-a-major-bug-in-cryptonote-based-currencies.html https://webcache.googleusercontent.com/search?q=cache:https:...
aeleos 9y ago
I find it really interesting that they snuck the patch in to a commit months ago. Are there any other examples of something like this happening where maintainers had to obscure changes to the software?
- ccrush 9y ago
  All closed source software
- firethief 9y ago
  I think that's standard practice for cryptocurrencies. I mean, what else would you do, announce it and make users race with exploiters to react?
  - runeks 9y ago
    He's not asking whether or not it's the wisest thing to do, but if there's precedent for this sort of thing (sneaking in fixes to fatal bugs in open source crypto-currencies). You seem to imply it has happened before; do you have any examples? It's inherently problematic because you need to somehow get your users to upgrade their software without knowledge of exactly why they need to do this. I know Bitcoin has had denial-of-service fixes sneaked in, but I'm not aware of anything of this nature. One thing's for sure: the commit logs of crypto-currencies will be scrutinized a lot more by black hats from now on.
    - firethief 9y ago
      I can't find any references to what I'd heard about bitcoin bug handling, but it was probably in reference to the DoS fixes. I haven't heard of any exploitable-for-profit bugs being handled the same way, but we wouldn't have, would we? So the question is whether a shut-down-everything DoS or a stolen money bug would be handled similarly, as a policy. I think if a stolen money bug were considered significantly worse than a shut-down-everything bug there would still be an alert system in place, since it could effectively reduce the former to the latter.
- indolering 9y ago
  This is a constant issue: what is the safest course of action? You start by patching your shit first, then push it upstream, and then slowly broaden the disclosure circle. Large software vendors (RedHat, IBM, etc) and infrastructure operators (Amazon, Cloudflare, etc) get advanced notice. Only then is it distributed to the public. This is the de-facto route for closed-source software, but Linus doesn't mark all security patches as such [0]. There are a lot of unpatched systems out there and Linus doesn't have the time to parse the exact ramifications of every security bug. That being said, it's pretty clear that we need to invest in more robust software development methods. [0]: http://yarchive.net/comp/linux/security_bugs.html http://yarchive.net/comp/linux/security_bugs.html
candl 9y ago
This is why absolute anonymous crypto-currencies will never catch on. Too much trust must be put into the hands of the developers. How do we know this vurnerability (and maybe others yet to be discovered) were not exploited for months? They didn't even share the methodology and tools they used to check the blockchain for this particular exploit. I can understand their assurance that everything is fine, because otherwise any coin on this list gets basically useless overnight, but that's not how it should be handled.
- StavrosK 9y ago
  > This is why absolute anonymous crypto-currencies will never catch on. What, because of vulnerabilities? How are anonymous cryptocurrencies any different from literally any other piece of software in this regard?
  - candl 9y ago
    Yes, because of the potential pitfalls of undiscovered vurnerabilities like the one in this post, where an attacker could have generated an unlimited supply of coins and remain undetectable. This is in contrast to Bitcoin and other coins whose transactions are public on the blockchain and can be openly analyzed. The other aspect is ethical. Did the people involved in discovery of this vurnerability took advantage of it and made themselves rich by exploiting other cryptonote based coins? Little risk, high reward which is tempting.
    - 45h34jh53k4j 9y ago
      its a signing bug. There have been incidents of 'accidental inflation' of fully-anonymous cryptocurrencies (as opposed to 'semi-anonymous' [sender/receiver anonymous] and pseudonymous bitcoin). Zerocoin had a 1/4 inflation from https://news.ycombinator.com/item?id=13672117 https://news.ycombinator.com/item?id=13672117 I wouldn't go so far as to say this is will prevent this technology from ever being secure. Its early days. Don't play with what you can't lose. The great monero team did notify other CryptoNote based currencies, it seems that the granddaddy Bytecoin didn't fix it before the notification period. There is no evidence that they exploited this. They even came up with a method for detecting if it had been exploited...
jstanley 9y ago
I find it interesting that the price of ByteCoin hasn't crashed yet. https://poloniex.com/exchange#btc_bcn https://poloniex.com/exchange#btc_bcn
- sna1l 9y ago
  Dropping pretty fast now. 20% in last 5-10 minutes it seems
  - jstanley 9y ago
    If you can truly create infinite amounts of ByteCoin, the price should quickly go to 0. I'm amazed it still hasn't.
    - deleted 9y ago
      [deleted]
    - mbgaxyz 9y ago
      Poloniex has a duty of care to its customers. Poloniex should suspend the trading of ByteCoin until it can be determined whether or not the bug has been exploited, as some reports indicate: https://www.reddit.com/r/Monero/comments/6buu5j/disclosure_of_a_major_bug_in_cryptonotebased/dhpt1ow/ https://www.reddit.com/r/Monero/comments/6buu5j/disclosure_o... It's surprising that an exchange like Poloniex would allow trading in potentially fradulent ByteCoins to continue. https://poloniex.com/exchange#btc_bcn https://poloniex.com/exchange#btc_bcn However, in Poloniex's defense, they could argue that the security disclosure just 24 hours ago has not given them enough time to respond, and that up until now they were only ever aware of a (fake) DoS bug impacting CryptoNote coins, rather than a critical vulnerability. https://getmonero.org/2017/05/17/disclosure-of-a-major-bug-in-cryptonote-based-currencies.html https://getmonero.org/2017/05/17/disclosure-of-a-major-bug-i... 2017-02-21: The patch is surreptitiously snuck into the Monero codebase in pull request #1744. It is kept secret to prevent it being used to attack other CryptoNote coins. 2017-02-22: A point release of Monero is rushed out so that exchanges and mining pools can update, under the guise of it preventing a RingCT DoS attack (such attack did not exist, but it seemed a fair explanation).
zenlikethat 9y ago
Nice work team and thanks for the responsible disclosure. Vulnerabilities are inevitable and it's how you handle them that counts.
runeks 9y ago
> The so-called "key image" as used in CryptoNote coins utilising elliptic curve ed25519 can be modified in a special way, allowing double-spends. This effectively allows someone to create an infinite amount of coins in a way that is impossible to detect without knowing about the exploit and explicitly writing code to check for it. Ouch. I guess we're now seeing the value in having a crypto-currency depend on as few (well-tested) cryptographic primitives as possible. It always strikes me as a bit overzealous when blockchain-based currencies add exotic cryptographic primitives to improve on the properties of Bitcoin a little bit, while at the same time risking complete destruction in case just the tiniest detail has gone unnoticed. I feel like crypto-money must rely on cryptographic primitives whose subversion would cause great harm elsewhere, too. If not, the financial incentive to expose flaws isn't present until it's already too late (the currency is very valuable). If this isn't the case, the crypto-currency becomes a somewhat meaningless research project, as the financial incentive to reveal weaknesses just isn't there.
- tptacek 9y ago
  Not sure it's reasonable to call ed25519 an "exotic crypto primitive". It's more modern than P-curve ECDSA, but "modernism" in curves is a trend towards user-proofing: the P-curves and DSA are themselves a thicket of thorny implementation pitfalls. There's no simple conservative path you can chart through this particular crypto use case that will make things easy. Public key cryptography is difficult and dangerous.
  - runeks 9y ago
    I'm honestly not sure if "cryptographic primitive" is the right terminology (I'm no cryptographer), but I was referring to the ring signature scheme that comprises CryptoNote[1]; not ed25519 itself. [1] https://bytecoin.org/cryptonote/ https://bytecoin.org/cryptonote/
    - tptacek 9y ago
      Oh, totally fair. Sorry, I shouldn't have well-actuallied you here.
runeks 9y ago
So, did the Monero developers sneak this fix into the April hardfork? I'm not saying this is wrong, but it's certainly not very transparent. In case of the Bitcoin overflow bug[1], a public announcement was made and everyone was asked to upgrade. [1] https://bitcointalk.org/index.php?topic=827.0 https://bitcointalk.org/index.php?topic=827.0
- _coldfire 9y ago
  You would assume that it was kept quiet to protect the other coins out there using cryptonote.

80 points by mike-cardwell 9y ago

If the main website isn't working for you (wasn't for me), here's a link to Google's cache: https://webcache.googleusercontent.com/search?q=cache:https://getmonero.org/2017/05/17/disclosure-of-a-major-bug-in-cryptonote-based-currencies.html https://webcache.googleusercontent.com/search?q=cache:https:...

aeleos 9y ago

I find it really interesting that they snuck the patch in to a commit months ago. Are there any other examples of something like this happening where maintainers had to obscure changes to the software?

ccrush 9y ago
All closed source software
firethief 9y ago
I think that's standard practice for cryptocurrencies. I mean, what else would you do, announce it and make users race with exploiters to react?
- runeks 9y ago
  He's not asking whether or not it's the wisest thing to do, but if there's precedent for this sort of thing (sneaking in fixes to fatal bugs in open source crypto-currencies). You seem to imply it has happened before; do you have any examples? It's inherently problematic because you need to somehow get your users to upgrade their software without knowledge of exactly why they need to do this. I know Bitcoin has had denial-of-service fixes sneaked in, but I'm not aware of anything of this nature. One thing's for sure: the commit logs of crypto-currencies will be scrutinized a lot more by black hats from now on.
  - firethief 9y ago
    I can't find any references to what I'd heard about bitcoin bug handling, but it was probably in reference to the DoS fixes. I haven't heard of any exploitable-for-profit bugs being handled the same way, but we wouldn't have, would we? So the question is whether a shut-down-everything DoS or a stolen money bug would be handled similarly, as a policy. I think if a stolen money bug were considered significantly worse than a shut-down-everything bug there would still be an alert system in place, since it could effectively reduce the former to the latter.
indolering 9y ago
This is a constant issue: what is the safest course of action? You start by patching your shit first, then push it upstream, and then slowly broaden the disclosure circle. Large software vendors (RedHat, IBM, etc) and infrastructure operators (Amazon, Cloudflare, etc) get advanced notice. Only then is it distributed to the public. This is the de-facto route for closed-source software, but Linus doesn't mark all security patches as such [0]. There are a lot of unpatched systems out there and Linus doesn't have the time to parse the exact ramifications of every security bug. That being said, it's pretty clear that we need to invest in more robust software development methods. [0]: http://yarchive.net/comp/linux/security_bugs.html http://yarchive.net/comp/linux/security_bugs.html

candl 9y ago

This is why absolute anonymous crypto-currencies will never catch on. Too much trust must be put into the hands of the developers. How do we know this vurnerability (and maybe others yet to be discovered) were not exploited for months? They didn't even share the methodology and tools they used to check the blockchain for this particular exploit. I can understand their assurance that everything is fine, because otherwise any coin on this list gets basically useless overnight, but that's not how it should be handled.

StavrosK 9y ago
> This is why absolute anonymous crypto-currencies will never catch on. What, because of vulnerabilities? How are anonymous cryptocurrencies any different from literally any other piece of software in this regard?
- candl 9y ago
  Yes, because of the potential pitfalls of undiscovered vurnerabilities like the one in this post, where an attacker could have generated an unlimited supply of coins and remain undetectable. This is in contrast to Bitcoin and other coins whose transactions are public on the blockchain and can be openly analyzed. The other aspect is ethical. Did the people involved in discovery of this vurnerability took advantage of it and made themselves rich by exploiting other cryptonote based coins? Little risk, high reward which is tempting.
  - 45h34jh53k4j 9y ago
    its a signing bug. There have been incidents of 'accidental inflation' of fully-anonymous cryptocurrencies (as opposed to 'semi-anonymous' [sender/receiver anonymous] and pseudonymous bitcoin). Zerocoin had a 1/4 inflation from https://news.ycombinator.com/item?id=13672117 https://news.ycombinator.com/item?id=13672117 I wouldn't go so far as to say this is will prevent this technology from ever being secure. Its early days. Don't play with what you can't lose. The great monero team did notify other CryptoNote based currencies, it seems that the granddaddy Bytecoin didn't fix it before the notification period. There is no evidence that they exploited this. They even came up with a method for detecting if it had been exploited...

jstanley 9y ago

I find it interesting that the price of ByteCoin hasn't crashed yet. https://poloniex.com/exchange#btc_bcn https://poloniex.com/exchange#btc_bcn

sna1l 9y ago
Dropping pretty fast now. 20% in last 5-10 minutes it seems
- jstanley 9y ago
  If you can truly create infinite amounts of ByteCoin, the price should quickly go to 0. I'm amazed it still hasn't.
  - deleted 9y ago
    [deleted]
  - mbgaxyz 9y ago
    Poloniex has a duty of care to its customers. Poloniex should suspend the trading of ByteCoin until it can be determined whether or not the bug has been exploited, as some reports indicate: https://www.reddit.com/r/Monero/comments/6buu5j/disclosure_of_a_major_bug_in_cryptonotebased/dhpt1ow/ https://www.reddit.com/r/Monero/comments/6buu5j/disclosure_o... It's surprising that an exchange like Poloniex would allow trading in potentially fradulent ByteCoins to continue. https://poloniex.com/exchange#btc_bcn https://poloniex.com/exchange#btc_bcn However, in Poloniex's defense, they could argue that the security disclosure just 24 hours ago has not given them enough time to respond, and that up until now they were only ever aware of a (fake) DoS bug impacting CryptoNote coins, rather than a critical vulnerability. https://getmonero.org/2017/05/17/disclosure-of-a-major-bug-in-cryptonote-based-currencies.html https://getmonero.org/2017/05/17/disclosure-of-a-major-bug-i... 2017-02-21: The patch is surreptitiously snuck into the Monero codebase in pull request #1744. It is kept secret to prevent it being used to attack other CryptoNote coins. 2017-02-22: A point release of Monero is rushed out so that exchanges and mining pools can update, under the guise of it preventing a RingCT DoS attack (such attack did not exist, but it seemed a fair explanation).

zenlikethat 9y ago

Nice work team and thanks for the responsible disclosure. Vulnerabilities are inevitable and it's how you handle them that counts.

runeks 9y ago

> The so-called "key image" as used in CryptoNote coins utilising elliptic curve ed25519 can be modified in a special way, allowing double-spends. This effectively allows someone to create an infinite amount of coins in a way that is impossible to detect without knowing about the exploit and explicitly writing code to check for it. Ouch. I guess we're now seeing the value in having a crypto-currency depend on as few (well-tested) cryptographic primitives as possible. It always strikes me as a bit overzealous when blockchain-based currencies add exotic cryptographic primitives to improve on the properties of Bitcoin a little bit, while at the same time risking complete destruction in case just the tiniest detail has gone unnoticed. I feel like crypto-money must rely on cryptographic primitives whose subversion would cause great harm elsewhere, too. If not, the financial incentive to expose flaws isn't present until it's already too late (the currency is very valuable). If this isn't the case, the crypto-currency becomes a somewhat meaningless research project, as the financial incentive to reveal weaknesses just isn't there.

tptacek 9y ago
Not sure it's reasonable to call ed25519 an "exotic crypto primitive". It's more modern than P-curve ECDSA, but "modernism" in curves is a trend towards user-proofing: the P-curves and DSA are themselves a thicket of thorny implementation pitfalls. There's no simple conservative path you can chart through this particular crypto use case that will make things easy. Public key cryptography is difficult and dangerous.
- runeks 9y ago
  I'm honestly not sure if "cryptographic primitive" is the right terminology (I'm no cryptographer), but I was referring to the ring signature scheme that comprises CryptoNote[1]; not ed25519 itself. [1] https://bytecoin.org/cryptonote/ https://bytecoin.org/cryptonote/
  - tptacek 9y ago
    Oh, totally fair. Sorry, I shouldn't have well-actuallied you here.

runeks 9y ago

So, did the Monero developers sneak this fix into the April hardfork? I'm not saying this is wrong, but it's certainly not very transparent. In case of the Bitcoin overflow bug[1], a public announcement was made and everyone was asked to upgrade. [1] https://bitcointalk.org/index.php?topic=827.0 https://bitcointalk.org/index.php?topic=827.0

_coldfire 9y ago
You would assume that it was kept quiet to protect the other coins out there using cryptonote.