• Markets
  • Crypto
  • Web3
  • Culture
  • Opinion
  • Politics
Subscribe
  • Login
  • Register
No Result
View All Result
  • Markets
  • Crypto
  • Web3
  • Culture
  • Opinion
  • Politics
No Result
View All Result
No Result
View All Result

Remote Code Execution Vulnerability Found in EOS, Now Sort of Fixed

29/05/2018 09:25
1 comment

A security team based in China where EOS has gained some attention published details today of a remote code execution vulnerability in EOS which has sort of been fixed at the time of writing. The security team, 360, says:

“This vulnerability could be leveraged to achieve remote code execution in the nodeos process, by uploading malicious contracts to the victim node and letting the node parse the malicious contract. In a real attack, the attacker may publishes a malicious contract to the EOS main network.

The malicious contract is first parsed by the EOS super node, then the vulnerability was triggered and the attacker controls the EOS super node which parsed the contract.

The attacker can steal the private key of super nodes or control content of new blocks. What’s more, attackers can pack the malicious contract into a new block and publish it. As a result, all the full nodes in the entire network will be controlled by the attacker.”

The vulnerability concerns asserts, which tend to trip inexperienced developers because asserts work in debug mode, but not in a release build of a live network.

The EOS developers overlooked that fact, with the assert checking a certain parameter, but of course once it is live the assert would no longer work. So thus allowing one to remotely execute malicious code and take over the 21 super nodes and/or the entire network.

Dan Larimer, lead developer of EOS, has acknowledged this vulnerability with new code quickly pushed out. He says:

“If any of these asserts trigger in release it shouldn’t pass, but should throw. Allowing the code to continue running in release is a potential security vulnerability and will likely result in crashes elsewhere.”

The fix is basically renaming the assert so that it becomes a function which works in a live setting, rather than in just a debug mode, however some concerns have been raised that in a 32 bits process there might be an overflow bug which bypasses the check.

It is unclear whether the launch of EOS this weekend will now be delayed or otherwise. Bugs, of course, may sometimes occur, but this sort of bug appears to be far too basic to have made its way to the code and be urgently fixed just days before launch.

It suggests, if we may say, incompetence, because it is unlikely an experienced developer would have allowed this bug to go through.

An auditor worth his/her weight certainly would have not, suggesting this code has not been audited. The bug therefore might not be the last.

Smart contracts, of course, are very hard to code because one missing comma is enough to lose perhaps millions. Coding a Turing complete blockchain that executes such smart contracts is even harder.

But again this sort of assert bug isn’t a new class or something that even experts would have missed, it is rather an oversight or perhaps whoever coded it and/or peer reviewed it (if there was any) might have not even been aware that asserts work fine in debug mode but not in a release build.

So suggesting either incompetence or complete lack of care because this sort of bug should have not required an external team to find.

It is the same sort of bug that was found in Bitcoin Unlimited, but that was a grassroots client with ordinary individuals standing up to code it, thus they readily acknowledged at the time they didn’t quite have significant experience in bitcoin protocol coding.

You’d think Dan Larimer’s years of working in this space would have given him sufficient knowledge to mind the asserts, but then this might have not been coded by him or it may well explain why none of his projects have amounted to much so far.

Copyrights Trustnodes.com

 

Related Posts

Office of Foreign Assets Control at US Treasury

The Law Comes to ETH, Where Boundaries?

Miner's multisig code for EthereumPoW network fees, Aug 2022

EthereumPoW Will Send Network Fees to a Multisig

Ethereum Merge Trends on Google

DAO Raises Millions to Save Congo Forest

Load More
  • Trending
  • Comments
  • Latest
Proof of Work/Stake

Proof of Stake vs Proof of Work

Ethereum, the burning, Aug 2022

EthereumPoW to Remove EIP1559

Ethereum Merge searches, Aug 2022

Ethereum Merge Trends on Google

Miner's multisig code for EthereumPoW network fees, Aug 2022

EthereumPoW Will Send Network Fees to a Multisig

Office of Foreign Assets Control at US Treasury

The Law Comes to ETH, Where Boundaries?

Miner's multisig code for EthereumPoW network fees, Aug 2022

EthereumPoW Will Send Network Fees to a Multisig

Ethereum Merge searches, Aug 2022

Ethereum Merge Trends on Google

Virunga National Park

DAO Raises Millions to Save Congo Forest

Comments

Latest News

  • The Law Comes to ETH, Where Boundaries?
  • EthereumPoW Will Send Network Fees to a Multisig
  • Ethereum Merge Trends on Google

About Trustnodes

Terms of Service

Privacy Policy

Our Ethics and Values

Trustnodes Newsletter

Trustnodes © 2017-2022. All Rights Fully Reserved. For any Enquiries contact@trustnodes.com RSS Feed

No Result
View All Result
  • Login
  • Sign Up
  • Cart
  • Markets
  • Crypto
  • Web3
  • Culture
  • Opinion
  • Politics

Trustnodes © 2017-2022. All Rights Fully Reserved. For any Enquiries contact@trustnodes.com RSS Feed

Welcome Back!

Login to your account below

Authenticate with MetaMask Loading...

Forgotten Password? Sign Up

Create New Account!

Fill the forms below to register

*By registering into our website, you agree to the Terms & Conditions and Privacy Policy.
All fields are required. Log In

Retrieve your password

Please enter your username or email address to reset your password.

Log In
This website uses cookies. By continuing to use this website you are giving consent to cookies being used. Visit our Privacy and Cookie Policy.
Are you sure want to unlock this post?
Unlock left : 0
Are you sure want to cancel subscription?