11 ms·

The Bitcoin Piñata

482 points by amirmc 12y ago

neals 12y ago
Can sombody explain this in a bit less technical terms?
- chrisrhoden 12y ago
  The challenge is to present a certificate that the pinata interprets as being signed by the CA at the bottom of the page. If you succeed in doing so, you will be given the information required to transfer all of the BTC out of the address listed on that page.
  - Tuna-Fish 12y ago
    Even less technical: A bunch of people write crypto software, and want to find out/demonstrate how secure it is. They do so by setting up a system that will transfer ~$2k worth of bitcoins to the first guy who breaks it.
    - amirmc 12y ago
      > "and want to find out/demonstrate how secure it is" As the page (and my post) emphatically state, this contest cannot prove anything about how secure it is. That distinction is really important.
      - logfromblammo 12y ago
        If you take as axiomatic that all security measures can be broken, then you can measure those security measures by the cost of breaking it. You could measure the amount of time it takes for someone to break this security and grab the cash, but that only provides you with one datum. To really show how secure it is, you would also need to provide a $1000 prize, a $500 prize, a $250 prize, a $125 prize, and so on, all with equally strong security. Then you start the clock. After the first prize is won, you put out the second prize and start the clock again. Even if the winners don't share their methods, you can determine how long it took to claim the biggest prize, and compare with the length of time it takes for subsequent lesser prizes. A reduction in the interval spells trouble for your security method, because the attackers found an easier way to get in. You can then determine the general level of effort required, when people finally stop taking the otherwise free money. If the $125 prize is claimed, and the $62.50 prize is not, you can assume that it costs between $62.50 and $125, plus a certain amount of time, to break your security. As long as whatever you put behind that security is worth less than that amount of time and money, it will probably be safe from random attackers. Unlike an in-home safe or a bank vault, you can't take calipers and measure the thickness of the walls, to calculate how long it would take to cut through. This contest doesn't prove anything, but it does suggest a guideline. If no one takes the $2000, then as long as the expected value of a random attack on you is not higher than that, you can feel safe using it. The problem is that it doesn't take much to rise above that amount. Late model car? Nice house? Taking an actual vacation? You're worth at least a spear-phishing attempt.
        amirmc 12y ago
        I appreciate what you're saying but even then, the data you infer this way (apart from the breach itself) is highly suspect. I don't think you really get a view for how much it costs to break and time is a poor proxy. It's really worth reading Schneier's comments on security contests. https://www.schneier.com/crypto-gram/archives/1998/1215.html#contests https://www.schneier.com/crypto-gram/archives/1998/1215.html...
        logfromblammo 12y ago
        It tests your defense against random attackers, in the same way that a fence keeps random people off your lawn. But it doesn't tell you anything about dedicated attackers, and those are the guys you really need to worry about. Anyone who really wants in can climb over the fence, or cut through it, or drive a tank over it. I'm not a fan of this type of bounty myself, but it might seem like a good idea if you have enough money for a contest prize but not anywhere near what would be needed for a professional audit. Even so, if your bounty is claimed, you still might want to know how much of the work for that first attack is reusable for all subsequent attacks, and that requires a second prize.
      - StavrosK 12y ago
        But it can demonstrate how insecure it is!
        amirmc 12y ago
        Exactly, so if there is a breach, then we've learned about something we need to secure better (win). If there's no breach — and provided people did try to break in — then we're only incrementally more confident in the stack (kind of a cautious win).
  - pqwy 12y ago
    Aaah, but you can try to do soooo much more! You can try to confuse the ASN.1 parser, or even the protocol level parser. You can try to defeat certificate validation logic. You can try to get handshake state-machine do an illegal transition. You can try to smash its memory and either read it or get your code into it. You can try to defeat its RNG. It doesn't let you do adaptive-plaintext attacks, but everything else is up for grabs. And you don't necessarily have to wait for it to politely send you the bitcoin key - it's somewhere in there, in memory!
    - wsxcde 12y ago
      I think you you guys have formally proven some of this correct? What did you use? Was a proof-assistant like Coq or a model checker or similar? And what properties have been proven correct (so we know what to avoid wasting time on :)?
      - pqwy 12y ago
        No, or at least not yet. :) You are probably thinking of these guys: http://www.mitls.org http://www.mitls.org. They have a killer TLS, but it drags the entire CLR in. We are these guys: http://openmirage.org/blog/introducing-ocaml-tls http://openmirage.org/blog/introducing-ocaml-tls.
        wsxcde 12y ago
        You are right, I was thinking of miTLS.
      - deleted 12y ago
        [deleted]
- avsm 12y ago
  Amir Chaudhry has explained the background to this in his blog post: http://amirchaudhry.com/bitcoin-pinata/ http://amirchaudhry.com/bitcoin-pinata/
- deleted 12y ago
  [deleted]
- kcsrk 12y ago
  Here is some context: http://amirchaudhry.com/bitcoin-pinata/ http://amirchaudhry.com/bitcoin-pinata/
- pjc50 12y ago
  It's a security bounty contest that requires no intervention by the organisers to hand out the bounty. Break in and take it.
  - taksintik 12y ago
    That's friggin awesome.
  - amirmc 12y ago
    > "Break in and take it." But please tell us if you do. We'd like to learn from this exercise and improve the stack.
    - mintplant 12y ago
      If you're not already, it'd be a good idea to log all traffic to/from the box so that you'll at least have something if no one owns up.
      - kzrdude 12y ago
        Ah, but it's so ironic if ipredator.se does that.
        hnarn 12y ago
        As far as I know, ipredator is not a service to prevent logging, they're a service to prevent unauthorized surveillance.
        tP5n 12y ago
        ...preventing surveillance by running a vpn service and claiming not to have any kind of traffic logs, so yeah ;)
amirmc 12y ago
There's some additional context at http://amirchaudhry.com/bitcoin-pinata/ http://amirchaudhry.com/bitcoin-pinata/
unwind 12y ago
This is a duplicate of https://news.ycombinator.com/item?id=9027701 https://news.ycombinator.com/item?id=9027701, not sure why the URL-matching didn't catch it.
econner 12y ago
FYI The bounty is about $2000.
- avsm 12y ago
  As Bruce Schneier pointed out [1], the price is definitely not meant to be a massive incentive -- any cryptographer worth their salt is going to be worth a hell of a lot more than our prize amount. But at the same time, we're really keen to make it easier to audit protocols in MirageOS, and hope that this Piñata "permitted breakin" is something that'll catch on. The worst case for us is that someone does break in and doesn't tell us how they did it. Let's hope the eventual winner wants to brag, and we get to improve our source code :-) [1] https://www.schneier.com/crypto-gram/archives/1998/1215.html#contests https://www.schneier.com/crypto-gram/archives/1998/1215.html...
  - runeks 12y ago
    > The worst case for us is that someone does break in and doesn't tell us how they did it. I do hope you're logging all incoming data to a backup server somewhere, so you can analyze it afterwards if this were to happen.
- Transisto 12y ago
  $2210 to be exact.
  - wwwhizz 12y ago
    Don't be exact, as it is so volatile. $2215 now, for instance.
marcell 12y ago
Suggestion: add an endpoint on the piñata that proves it has the private key. You can do this using Bitcoin's sign message method.
- hannesm 12y ago
  that wouldn't help - would it? any owner of the bitcoin secret can sign this message and include it then in the pinata... for online signing we'd first need to implement the bitcoin protocol... or am I getting something wrong?
  - williamcotton 12y ago
    Yup, you'd need to implement the Bitcoin protocol and load the private key and sign all the messages the echo endpoint receives.
    - icebraining 12y ago
      And even then, you couldn't prove the piñata wasn't only proxying the replies from some other server.
      - artursapek 12y ago
        The code is open source, so you could
        icebraining 12y ago
        Technically, you can't know if the code running in the piñata is the same as the one published on Github.
- deleted 12y ago
  [deleted]
- ikeboy 12y ago
  And then I just make it sign a message sending all the btc to my address, then broadcast that publicly. Very bad idea to sign everything that comes your way, kind of like `eval` on text input.
ctz 12y ago
As far as I can tell (I can't read O'Caml very well) the crypto library underpinning this makes the same mistake that all PKCS#1 signature verification functions have had at some point or another: they unpick the padding by hand[1], and then decode the ASN1 DigestInfo. The only sane way to do this is to generate the padding from scratch and check if the signature plaintext is the same (the added benefit is your ASN1 decoder is now not on a front-line security boundary). Is this exploitable in this bounty? No idea. At least, it's the right kind of vulnerability you need to forge a certificate. CVE-2014-1568 was this problem in NSS. [1]: https://github.com/mirleft/ocaml-nocrypto/blob/master/src/rsa.ml#L151 https://github.com/mirleft/ocaml-nocrypto/blob/master/src/rs...
- hannesm 12y ago
  This is about the DigestInfo -- which we generate and compare here: https://github.com/mirleft/ocaml-tls/blob/master/lib/handshake_common.ml#L186 https://github.com/mirleft/ocaml-tls/blob/master/lib/handsha... The unpad does RSA unpadding... or am I completely mistaken?
  - ctz 12y ago
    I was reading the X509 certificate verification code, rather than the TLS code: https://github.com/mirleft/ocaml-x509/blob/master/lib/certificate.ml#L157 https://github.com/mirleft/ocaml-x509/blob/master/lib/certif...
    - pqwy 12y ago
      Why do you think this creates malleability? PKCS1.5 stripping takes away the leading 0x00 0x01 0xff ... 0x00 -- if this prefix is not present, it fails. The rest goes through the RSA tranform, and is parsed as PKCS1 DigestInfo, an ASN.1 structure. All ASN parsing checks for presence of trailing bytes, on top and in CONSTRUCTED nodes. The presence of suffix-checking prevents malleability in my mind. Am I missing something?
      - ctz 12y ago
packetized 12y ago
Probably want to also go ahead and catch up on the TCP/IP stack; the pqwy/mirage-tcpip repo is some 232 commits behind mirage/mirage-tcpip, and is missing fixes for things like https://github.com/mirage/mirage-tcpip/issues/56 https://github.com/mirage/mirage-tcpip/issues/56
- hannesm 12y ago
  you're looking at the wrong branch... https://github.com/pqwy/mirage-tcpip/tree/pinata https://github.com/pqwy/mirage-tcpip/tree/pinata
- avsm 12y ago
  His master branch isn't uptodate, but the pinata branch that's deployed is tracking the head of mirage/mirage-tcpip. See the opam manifest here: https://raw.githubusercontent.com/mirleft/btc-pinata/master/opam-full.txt https://raw.githubusercontent.com/mirleft/btc-pinata/master/...
  - packetized 12y ago
    You're right - mea culpa.
MrRogers 12y ago
Where could I, a total beginner in crypto-stuff, learn more about this kind of thing? What would be the list of things I'd need to know how to do in order to "break in", and where could I learn how to do them?
- philk10 12y ago
  One possible starting point is here - http://cryptopals.com http://cryptopals.com
  - eterm 12y ago
    But oddly not http://www.cryptopals.com/ http://www.cryptopals.com/
    - Cederfjard 12y ago
      Not so odd, I don't always use nor redirect www either (well I do if it's for a client, but otherwise I usually can't be bothered). Edit: But I do get 404s when I click the "language-links" on the challenge pages, like http://cryptopals.com/sets/1/challenges/1/ruby http://cryptopals.com/sets/1/challenges/1/ruby. What are those anyways?
      - eterm 12y ago
        They are Solutions. The C++ one to the first exercise works: http://cryptopals.com/sets/1/challenges/1/cpp/ http://cryptopals.com/sets/1/challenges/1/cpp/
        omega_rythm 12y ago
        It's probably the only one that works, and it's just a hint (the conversion function is weird btw, it accepts hexadecimal symbols ranging from '0' to 'z'; it actually "decodes" any base from binary to triacontahexadecimal (36)).
      - scott_karana 12y ago
gradinafrica 12y ago
They seem to assume the reader has a certain level of competency with web traffic monitoring and client/server communicating tools. I suppose this is half the fun. Still, I'm trying to figure out what they mean by > "Before you ask: yes, Piñata will talk to itself and you can enjoy watching it do so." Also, what should I be using to connect using TLS/TCP?
- nothrabannosir 12y ago
  They offer a TLS client and server interface, so you can have your own host act as a proxy. Try this: $ mkfifo /tmp/tlspipe $ nc -l -p 40001 </tmp/tlspipe | tee /tmp/tlsconvo | nc ownme.ipredator.se 10000 > /tmp/tlspipe Then visit http://ownme.ipredator.se:10001 http://ownme.ipredator.se:10001 from that same host (curl or firefox or whatever). Now look at /tmp/tlspipe. Disclaimer: I'm completely unfamiliar with named pipes or tls, but I think this is what they mean. EDIT: This should also work: $ mkfifo /tmp/tlspipe $ nc ownme.ipredator.se 10002 </tmp/tlspipe | tee /tmp/tlsconvo2 | nc ownme.ipredator.se 10000 >/tmp/tlspipe EDIT2: Just realized that the above only captures one part of the convo. Try this: $ nc ownme.ipredator.se 10002 </tmp/tlspipe | tee /tmp/client-to-server | nc ownme.ipredator.se 10000 | tee /tmp/server-to-client >/tmp/tlspipe Now you have the full back and forth. E.g.: $ strings /tmp/server-to-client sYcdI* Cambridge1 BTC Pinata Team1 0 ocaml-tls@h3q.com0 150207183718Z 150329183718Z0$1 tls services0 ...
  - gradinafrica 12y ago
    `cat`ed tlsconvo2. That's some quality gibberish :D
  - atmosx 12y ago
    Maybe then run something like: $ cat /tmp/tlsconvo2|xxd|less But I'm not into crypto, even that I don't know what it means or if it's the way to go. I liked the initiative though :-)
  - pqwy 12y ago
    Hah, and I wondered how come we suddenly started getting MITM connections from several places. FWIW you can also do it with a single socat invocation, but I'll leave the exact command as an exercise for the reader.
joshu 12y ago
The other interesting bit is that if you really want to chip in you could send bitcoin TO that address to sweeten the pot.
- amirmc 12y ago
  I bet the authors never considered that as part of their threat models.
  - ikeboy 12y ago
    Wait aren't you one of the authors?
    - amirmc 12y ago
      I'm part of the Mirage team but when I say 'authors' I'm specifically referring to the people who wrote the Piñata code.
      - ikeboy 12y ago
        The site is down now. Any idea why? Too much traffic, or DDos, or other hack?
        pqwy 12y ago
        Syn flood...
        sillysaurus3 12y ago
        Just curious, how can you tell it's down specifically because of a syn flood?
        pqwy 12y ago
        Because I'm looking at GBs of SYNs scrolling down the terminal.
deleted 12y ago
[deleted]
- deleted 12y ago
  [deleted]
Apofis 12y ago
I'm more interested in the OS they hosted their site on. Mirage, developed in OCaml for the cloud. The part that really interested me: "If a sudden spike in traffic occurs, the web-servers can be configured to create and deploy copies of themselves to service the demand. This auto-scaling happens so quickly that an incoming connection can trigger the creation of new server and the new server can then handle that request before it times out (which is on the order of milliseconds)." http://openmirage.org/wiki/overview-of-mirage http://openmirage.org/wiki/overview-of-mirage
- amirmc 12y ago
  Yup, this is work in progress. The first part of this is Jitsu, which is a DNS server that can spin up Unikernels on an incoming request. https://github.com/MagnusS/jitsu https://github.com/MagnusS/jitsu
  - edwintorok 12y ago
    Are the DNS requests used only to scale up in anticipation of more traffic, or is a steady stream of DNS requests required to keep the instances running once they are started? I see that there is an expiration TTL, but what happens if there is a download in progress for longer than the VM expiration time? Also how well does this work with persistent HTTP connections (and TLS handshakes)? i.e. will the browser keep a persistent connection to the jitsu proxy and the actual requests might be served by different VMs?
    - amirmc 12y ago
      We're actually putting a paper together that uses Jitsu so you might find that answers most of your questions (the team is busy with eval at the moment). For the time-being, Jitsu [1] 'just' spawns a unikernel which serves requests, with no apparently latency for the requester. At some point, when the unikernel hasn't done anything for a while, it is culled (which is something of an implementation detail). In principle, we should be able to use this as part of a set of tools to create the hyper-elastic clouds mentioned upthread. [1] Just in Time Summoning of Unikernels
pqwy 12y ago
Update: DDoS, SYN flood. Stay tuned...
- pqwy 12y ago
  ... back.
ricket 12y ago
So the server always sends the same plaintext (the private key of the bitcoin wallet), encrypted presumably by the same cipher but each time with a different symmetric key of course (negotiated by the handshake). It seems (naively, I'm sure) like this is a weakness, like you could collect a bunch of the encrypted samples, and then use the fact that they are all from the same plaintext in order to figure out what the plaintext is. How many samples would it take before you could deduce the key?
- comex 12y ago
  In theory, a block cipher is broken if an attacker can even tell the difference between application of the cipher and of a random permutation, different for each possible key, more efficiently than brute force (i.e. trying every possible key). Since encrypting the same plaintext with a bunch of different random permutations would not help an attacker recover it, I believe an attack like you describe would not be possible without breaking AES.
  - un1xl0ser 12y ago
    A weak RNG may create an opportunity for successful cryptanalysis. This can especially be a problems on virtual hardware/platforms that don't have a mechanism for keeping a good random seed, and have predictable hardware events, et cetera.

The Bitcoin Piñata

482 points by amirmc 12y ago

neals 12y ago

Can sombody explain this in a bit less technical terms?

chrisrhoden 12y ago
The challenge is to present a certificate that the pinata interprets as being signed by the CA at the bottom of the page. If you succeed in doing so, you will be given the information required to transfer all of the BTC out of the address listed on that page.
- Tuna-Fish 12y ago
  Even less technical: A bunch of people write crypto software, and want to find out/demonstrate how secure it is. They do so by setting up a system that will transfer ~$2k worth of bitcoins to the first guy who breaks it.
  - amirmc 12y ago
    > "and want to find out/demonstrate how secure it is" As the page (and my post) emphatically state, this contest cannot prove anything about how secure it is. That distinction is really important.
    - logfromblammo 12y ago
      If you take as axiomatic that all security measures can be broken, then you can measure those security measures by the cost of breaking it. You could measure the amount of time it takes for someone to break this security and grab the cash, but that only provides you with one datum. To really show how secure it is, you would also need to provide a $1000 prize, a $500 prize, a $250 prize, a $125 prize, and so on, all with equally strong security. Then you start the clock. After the first prize is won, you put out the second prize and start the clock again. Even if the winners don't share their methods, you can determine how long it took to claim the biggest prize, and compare with the length of time it takes for subsequent lesser prizes. A reduction in the interval spells trouble for your security method, because the attackers found an easier way to get in. You can then determine the general level of effort required, when people finally stop taking the otherwise free money. If the $125 prize is claimed, and the $62.50 prize is not, you can assume that it costs between $62.50 and $125, plus a certain amount of time, to break your security. As long as whatever you put behind that security is worth less than that amount of time and money, it will probably be safe from random attackers. Unlike an in-home safe or a bank vault, you can't take calipers and measure the thickness of the walls, to calculate how long it would take to cut through. This contest doesn't prove anything, but it does suggest a guideline. If no one takes the $2000, then as long as the expected value of a random attack on you is not higher than that, you can feel safe using it. The problem is that it doesn't take much to rise above that amount. Late model car? Nice house? Taking an actual vacation? You're worth at least a spear-phishing attempt.
      - amirmc 12y ago
        I appreciate what you're saying but even then, the data you infer this way (apart from the breach itself) is highly suspect. I don't think you really get a view for how much it costs to break and time is a poor proxy. It's really worth reading Schneier's comments on security contests. https://www.schneier.com/crypto-gram/archives/1998/1215.html#contests https://www.schneier.com/crypto-gram/archives/1998/1215.html...
        logfromblammo 12y ago
        It tests your defense against random attackers, in the same way that a fence keeps random people off your lawn. But it doesn't tell you anything about dedicated attackers, and those are the guys you really need to worry about. Anyone who really wants in can climb over the fence, or cut through it, or drive a tank over it. I'm not a fan of this type of bounty myself, but it might seem like a good idea if you have enough money for a contest prize but not anywhere near what would be needed for a professional audit. Even so, if your bounty is claimed, you still might want to know how much of the work for that first attack is reusable for all subsequent attacks, and that requires a second prize.
    - StavrosK 12y ago
      But it can demonstrate how insecure it is!
      - amirmc 12y ago
        Exactly, so if there is a breach, then we've learned about something we need to secure better (win). If there's no breach — and provided people did try to break in — then we're only incrementally more confident in the stack (kind of a cautious win).
- pqwy 12y ago
  Aaah, but you can try to do soooo much more! You can try to confuse the ASN.1 parser, or even the protocol level parser. You can try to defeat certificate validation logic. You can try to get handshake state-machine do an illegal transition. You can try to smash its memory and either read it or get your code into it. You can try to defeat its RNG. It doesn't let you do adaptive-plaintext attacks, but everything else is up for grabs. And you don't necessarily have to wait for it to politely send you the bitcoin key - it's somewhere in there, in memory!
  - wsxcde 12y ago
    I think you you guys have formally proven some of this correct? What did you use? Was a proof-assistant like Coq or a model checker or similar? And what properties have been proven correct (so we know what to avoid wasting time on :)?
    - pqwy 12y ago
      No, or at least not yet. :) You are probably thinking of these guys: http://www.mitls.org http://www.mitls.org. They have a killer TLS, but it drags the entire CLR in. We are these guys: http://openmirage.org/blog/introducing-ocaml-tls http://openmirage.org/blog/introducing-ocaml-tls.
      - wsxcde 12y ago
        You are right, I was thinking of miTLS.
    - deleted 12y ago
      [deleted]
avsm 12y ago
Amir Chaudhry has explained the background to this in his blog post: http://amirchaudhry.com/bitcoin-pinata/ http://amirchaudhry.com/bitcoin-pinata/
deleted 12y ago
[deleted]
kcsrk 12y ago
Here is some context: http://amirchaudhry.com/bitcoin-pinata/ http://amirchaudhry.com/bitcoin-pinata/
pjc50 12y ago
It's a security bounty contest that requires no intervention by the organisers to hand out the bounty. Break in and take it.
- taksintik 12y ago
  That's friggin awesome.
- amirmc 12y ago
  > "Break in and take it." But please tell us if you do. We'd like to learn from this exercise and improve the stack.
  - mintplant 12y ago
    If you're not already, it'd be a good idea to log all traffic to/from the box so that you'll at least have something if no one owns up.
    - kzrdude 12y ago
      Ah, but it's so ironic if ipredator.se does that.
      - hnarn 12y ago
        As far as I know, ipredator is not a service to prevent logging, they're a service to prevent unauthorized surveillance.
        tP5n 12y ago
        ...preventing surveillance by running a vpn service and claiming not to have any kind of traffic logs, so yeah ;)

amirmc 12y ago

There's some additional context at http://amirchaudhry.com/bitcoin-pinata/ http://amirchaudhry.com/bitcoin-pinata/

unwind 12y ago

This is a duplicate of https://news.ycombinator.com/item?id=9027701 https://news.ycombinator.com/item?id=9027701, not sure why the URL-matching didn't catch it.

econner 12y ago

FYI The bounty is about $2000.

avsm 12y ago
As Bruce Schneier pointed out [1], the price is definitely not meant to be a massive incentive -- any cryptographer worth their salt is going to be worth a hell of a lot more than our prize amount. But at the same time, we're really keen to make it easier to audit protocols in MirageOS, and hope that this Piñata "permitted breakin" is something that'll catch on. The worst case for us is that someone does break in and doesn't tell us how they did it. Let's hope the eventual winner wants to brag, and we get to improve our source code :-) [1] https://www.schneier.com/crypto-gram/archives/1998/1215.html#contests https://www.schneier.com/crypto-gram/archives/1998/1215.html...
- runeks 12y ago
  > The worst case for us is that someone does break in and doesn't tell us how they did it. I do hope you're logging all incoming data to a backup server somewhere, so you can analyze it afterwards if this were to happen.
Transisto 12y ago
$2210 to be exact.
- wwwhizz 12y ago
  Don't be exact, as it is so volatile. $2215 now, for instance.

marcell 12y ago

Suggestion: add an endpoint on the piñata that proves it has the private key. You can do this using Bitcoin's sign message method.

hannesm 12y ago
that wouldn't help - would it? any owner of the bitcoin secret can sign this message and include it then in the pinata... for online signing we'd first need to implement the bitcoin protocol... or am I getting something wrong?
- williamcotton 12y ago
  Yup, you'd need to implement the Bitcoin protocol and load the private key and sign all the messages the echo endpoint receives.
  - icebraining 12y ago
    And even then, you couldn't prove the piñata wasn't only proxying the replies from some other server.
    - artursapek 12y ago
      The code is open source, so you could
      - icebraining 12y ago
        Technically, you can't know if the code running in the piñata is the same as the one published on Github.
deleted 12y ago
[deleted]
ikeboy 12y ago
And then I just make it sign a message sending all the btc to my address, then broadcast that publicly. Very bad idea to sign everything that comes your way, kind of like `eval` on text input.

ctz 12y ago

As far as I can tell (I can't read O'Caml very well) the crypto library underpinning this makes the same mistake that all PKCS#1 signature verification functions have had at some point or another: they unpick the padding by hand[1], and then decode the ASN1 DigestInfo. The only sane way to do this is to generate the padding from scratch and check if the signature plaintext is the same (the added benefit is your ASN1 decoder is now not on a front-line security boundary). Is this exploitable in this bounty? No idea. At least, it's the right kind of vulnerability you need to forge a certificate. CVE-2014-1568 was this problem in NSS. [1]: https://github.com/mirleft/ocaml-nocrypto/blob/master/src/rsa.ml#L151 https://github.com/mirleft/ocaml-nocrypto/blob/master/src/rs...

hannesm 12y ago
This is about the DigestInfo -- which we generate and compare here: https://github.com/mirleft/ocaml-tls/blob/master/lib/handshake_common.ml#L186 https://github.com/mirleft/ocaml-tls/blob/master/lib/handsha... The unpad does RSA unpadding... or am I completely mistaken?
- ctz 12y ago
  I was reading the X509 certificate verification code, rather than the TLS code: https://github.com/mirleft/ocaml-x509/blob/master/lib/certificate.ml#L157 https://github.com/mirleft/ocaml-x509/blob/master/lib/certif...
  - pqwy 12y ago
    Why do you think this creates malleability? PKCS1.5 stripping takes away the leading 0x00 0x01 0xff ... 0x00 -- if this prefix is not present, it fails. The rest goes through the RSA tranform, and is parsed as PKCS1 DigestInfo, an ASN.1 structure. All ASN parsing checks for presence of trailing bytes, on top and in CONSTRUCTED nodes. The presence of suffix-checking prevents malleability in my mind. Am I missing something?
    - ctz 12y ago

packetized 12y ago

Probably want to also go ahead and catch up on the TCP/IP stack; the pqwy/mirage-tcpip repo is some 232 commits behind mirage/mirage-tcpip, and is missing fixes for things like https://github.com/mirage/mirage-tcpip/issues/56 https://github.com/mirage/mirage-tcpip/issues/56

hannesm 12y ago
you're looking at the wrong branch... https://github.com/pqwy/mirage-tcpip/tree/pinata https://github.com/pqwy/mirage-tcpip/tree/pinata
avsm 12y ago
His master branch isn't uptodate, but the pinata branch that's deployed is tracking the head of mirage/mirage-tcpip. See the opam manifest here: https://raw.githubusercontent.com/mirleft/btc-pinata/master/opam-full.txt https://raw.githubusercontent.com/mirleft/btc-pinata/master/...
- packetized 12y ago
  You're right - mea culpa.

MrRogers 12y ago

Where could I, a total beginner in crypto-stuff, learn more about this kind of thing? What would be the list of things I'd need to know how to do in order to "break in", and where could I learn how to do them?

philk10 12y ago
One possible starting point is here - http://cryptopals.com http://cryptopals.com
- eterm 12y ago
  But oddly not http://www.cryptopals.com/ http://www.cryptopals.com/
  - Cederfjard 12y ago
    Not so odd, I don't always use nor redirect www either (well I do if it's for a client, but otherwise I usually can't be bothered). Edit: But I do get 404s when I click the "language-links" on the challenge pages, like http://cryptopals.com/sets/1/challenges/1/ruby http://cryptopals.com/sets/1/challenges/1/ruby. What are those anyways?
    - eterm 12y ago
      They are Solutions. The C++ one to the first exercise works: http://cryptopals.com/sets/1/challenges/1/cpp/ http://cryptopals.com/sets/1/challenges/1/cpp/
      - omega_rythm 12y ago
        It's probably the only one that works, and it's just a hint (the conversion function is weird btw, it accepts hexadecimal symbols ranging from '0' to 'z'; it actually "decodes" any base from binary to triacontahexadecimal (36)).
    - scott_karana 12y ago

gradinafrica 12y ago

They seem to assume the reader has a certain level of competency with web traffic monitoring and client/server communicating tools. I suppose this is half the fun. Still, I'm trying to figure out what they mean by > "Before you ask: yes, Piñata will talk to itself and you can enjoy watching it do so." Also, what should I be using to connect using TLS/TCP?

nothrabannosir 12y ago
They offer a TLS client and server interface, so you can have your own host act as a proxy. Try this: $ mkfifo /tmp/tlspipe $ nc -l -p 40001 </tmp/tlspipe | tee /tmp/tlsconvo | nc ownme.ipredator.se 10000 > /tmp/tlspipe Then visit http://ownme.ipredator.se:10001 http://ownme.ipredator.se:10001 from that same host (curl or firefox or whatever). Now look at /tmp/tlspipe. Disclaimer: I'm completely unfamiliar with named pipes or tls, but I think this is what they mean. EDIT: This should also work: $ mkfifo /tmp/tlspipe $ nc ownme.ipredator.se 10002 </tmp/tlspipe | tee /tmp/tlsconvo2 | nc ownme.ipredator.se 10000 >/tmp/tlspipe EDIT2: Just realized that the above only captures one part of the convo. Try this: $ nc ownme.ipredator.se 10002 </tmp/tlspipe | tee /tmp/client-to-server | nc ownme.ipredator.se 10000 | tee /tmp/server-to-client >/tmp/tlspipe Now you have the full back and forth. E.g.: $ strings /tmp/server-to-client sYcdI* Cambridge1 BTC Pinata Team1 0 ocaml-tls@h3q.com0 150207183718Z 150329183718Z0$1 tls services0 ...
- gradinafrica 12y ago
  `cat`ed tlsconvo2. That's some quality gibberish :D
- atmosx 12y ago
  Maybe then run something like: $ cat /tmp/tlsconvo2|xxd|less But I'm not into crypto, even that I don't know what it means or if it's the way to go. I liked the initiative though :-)
- pqwy 12y ago
  Hah, and I wondered how come we suddenly started getting MITM connections from several places. FWIW you can also do it with a single socat invocation, but I'll leave the exact command as an exercise for the reader.

joshu 12y ago

The other interesting bit is that if you really want to chip in you could send bitcoin TO that address to sweeten the pot.

amirmc 12y ago
I bet the authors never considered that as part of their threat models.
- ikeboy 12y ago
  Wait aren't you one of the authors?
  - amirmc 12y ago
    I'm part of the Mirage team but when I say 'authors' I'm specifically referring to the people who wrote the Piñata code.
    - ikeboy 12y ago
      The site is down now. Any idea why? Too much traffic, or DDos, or other hack?
      - pqwy 12y ago
        Syn flood...
        sillysaurus3 12y ago
        Just curious, how can you tell it's down specifically because of a syn flood?
        pqwy 12y ago
        Because I'm looking at GBs of SYNs scrolling down the terminal.

deleted 12y ago

[deleted]

deleted 12y ago
[deleted]

Apofis 12y ago

I'm more interested in the OS they hosted their site on. Mirage, developed in OCaml for the cloud. The part that really interested me: "If a sudden spike in traffic occurs, the web-servers can be configured to create and deploy copies of themselves to service the demand. This auto-scaling happens so quickly that an incoming connection can trigger the creation of new server and the new server can then handle that request before it times out (which is on the order of milliseconds)." http://openmirage.org/wiki/overview-of-mirage http://openmirage.org/wiki/overview-of-mirage

amirmc 12y ago
Yup, this is work in progress. The first part of this is Jitsu, which is a DNS server that can spin up Unikernels on an incoming request. https://github.com/MagnusS/jitsu https://github.com/MagnusS/jitsu
- edwintorok 12y ago
  Are the DNS requests used only to scale up in anticipation of more traffic, or is a steady stream of DNS requests required to keep the instances running once they are started? I see that there is an expiration TTL, but what happens if there is a download in progress for longer than the VM expiration time? Also how well does this work with persistent HTTP connections (and TLS handshakes)? i.e. will the browser keep a persistent connection to the jitsu proxy and the actual requests might be served by different VMs?
  - amirmc 12y ago
    We're actually putting a paper together that uses Jitsu so you might find that answers most of your questions (the team is busy with eval at the moment). For the time-being, Jitsu [1] 'just' spawns a unikernel which serves requests, with no apparently latency for the requester. At some point, when the unikernel hasn't done anything for a while, it is culled (which is something of an implementation detail). In principle, we should be able to use this as part of a set of tools to create the hyper-elastic clouds mentioned upthread. [1] Just in Time Summoning of Unikernels

pqwy 12y ago

Update: DDoS, SYN flood. Stay tuned...

pqwy 12y ago
... back.

ricket 12y ago

So the server always sends the same plaintext (the private key of the bitcoin wallet), encrypted presumably by the same cipher but each time with a different symmetric key of course (negotiated by the handshake). It seems (naively, I'm sure) like this is a weakness, like you could collect a bunch of the encrypted samples, and then use the fact that they are all from the same plaintext in order to figure out what the plaintext is. How many samples would it take before you could deduce the key?

comex 12y ago
In theory, a block cipher is broken if an attacker can even tell the difference between application of the cipher and of a random permutation, different for each possible key, more efficiently than brute force (i.e. trying every possible key). Since encrypting the same plaintext with a bunch of different random permutations would not help an attacker recover it, I believe an attack like you describe would not be possible without breaking AES.
- un1xl0ser 12y ago
  A weak RNG may create an opportunity for successful cryptanalysis. This can especially be a problems on virtual hardware/platforms that don't have a mechanism for keeping a good random seed, and have predictable hardware events, et cetera.