1. DAO for penetration testers
A talk by Pertsev Alexey
But mom calls

2. #whoami Security researcher (for live)
Penetration tester (by profession)
Smart Contract developer/auditor (for you)

3. Agenda DAO? How does it work? Solidity in depth Tools
Client-side vulnerabilities
Usual attack vectors at ICO address changing
Most expensive attacks
Along all – Digital Security ICO writeup!

4. DApp and DAO Call results, events… address = “0xdeadbeef…”
HTTP Requests
ABI = [{“name”: “crowdsale”…}]
Transaction
Transaction
web3 object
Geth
Parity
cpp-Ethereum
Requests
Call results, events…

5. Smart Contract’s Vulns/Attacks/Features
Blockchain features:
Front-running attack
Timestamp dependency
Generating randomness
Unpredictable state
Solidity features:
Reentrancy
Call of unknown
Gasless send
Exception disorders
DOS
Type confusion
Uninitialized variable
Keeping secrets
EVM features:
Short Address Attack
Blockhash dependency
Integer overflow
Logical (contract features):
Do it yourself :)

6. Front-running attack
How do miners order transactions at block before mining? Answer: gasPrice and then nonce What can we do? Front-running attack! Case: Dsec ICO lottery In while case: Bancor exchange Mitigations: tx.gasprice
Pending
Block
Lottery robot TX: {gasPrice: N, input: X}
Player TX: {gasPrice: N+1, input: X}
Be aware! Miners can order transactions as they wish! (infura?)

7. Timestamp dependency
What is timestamp of block (for Solidity block.timestamp)?
According to a yellow paper:
Hs is timestamp of block H and must fulfil the relation: Hs > P(H)Hs
Along with Geth source code “says”:
Take into account: time to next block is about sec…
Miner can manipulate block.timestamp in several seconds at least!
Don’t use it for:
entropy source
determining of “winner”

8. Short Address Attack
function transfer(address _to, uint256 _value) { … } Attacker address: 0xc24c2841b87694e546a093ac0da6565c8fdd1800; value: 1 TX.input: 0xa9059cbb0000…000c24c2841b87694e546a093ac0da6565c8fdd …001
After attack: value *= 2(zero_bytes_count * 8)
Attacker address: 0xc24c2841b87694e546a093ac0da6565c8fdd1800; value: 1
TX.input: 0xa9059cbb0000…000c24c2841b87694e546a093ac0da6565c8fdd18000…001 00
func signature (4 bytes)
address _to (32 bytes)
amount _value(32bytes)
Protection?
Check msg.data.length = * args.count
Swap args?
The client side software is fully responsible for preventing this attack! just live with that :)

9. Blockhash dependency
block.blockhash(uint blockNumber) returns (bytes32): hash of the given block
- only works for 256 most recent blocks!
smartbillions lottery just got hacked
Don’t use blockhash of current block also!
Malicious miner can cheat here.
martin.swende.se/blog

10. Reentrancy, Call of unknown, Gasless send, Exception disorders
Is there another way to transfer money?
Send()
Transfer()
Sure?

11. Type confusion
bytes4(sha3(“obtainDamage(uint256)") != bytes4(sha3(“obtainDamage(uint8)")
Don’t trust an ABI contract!
Compile smartcontract and diff bytecode with bytecode at blockchain.

12. Uninitialized variable
Solidity memory types:
Storage – storage keyword
Memory – memory keyword
Calldata – … (args in external)
// rewrited!
// rewrited too!
To fix:
Use memory keyword and/or constant modifier (or modern view and pure)

13. And others tricks… Not relevant anymore:
// 10 and float yet not implemented
Not relevant anymore:
Stack overflow exception - EIP-150
ERC20 double spending – Zeppelin fix
// 0
// 2**
// access control only! Use encryption for secrets keeping.
// 20

14. Logical Forgotten access modifiers
Misspelled identifications (variables, functions)
Huge number of various race conditions
etc…

15. Logical – DSec ICO

16. Logical – Parity multySig
Fix initWallet function:

17. Logical – Parity multiSigV2
Logical – Parity multiSig
$300М HACK

18. Tools Symbolic (concolic) execution:
Oyente (has remix built-in version)
Manticore (EVM opcodes support)
Dry-analyzer (has online version)
Static analysis:
remix.ethereum.org (best IDE)
securify.ch (online!)
Solc compiler
Linters (Solint, Solcheck, etc)
Debug:
remix.ethereum.org
Radare2 in progress)
Testing:
Truffle develop framework
web3.(py|js|hs|j) - geth JSON RPC
Other smart contract as tester
Multitool:
Mythril
Porosity (Quorum DLC)

19. Client side vulnerabilities and Vectors
Blockchain aside, can I hack DAO without smart contract knowledge?
XSS
Fishing
Site defacement + clipboard manipulation
etc…
And other vectors:
Weak passwords for Social Network accounts (twitter, slack, FB, etc.)
Hack related infrastructure and do pivoting
Attack on an unlocked wallet (JSON RPC) – origin: *

20. Blockchain stored XSS
Protect: Don’t trust user data! Always cast, validate, sanitize and escape (order is vital!)

21. Fishing Three steps to fishing:
Register a domain name similar to that of a victim: icokoi.co -> icokoi.com
Copy a victim website and replace ICO smart contact address
Spam spam spam!
Mitigations:
Be offensive! Monitor similar domains and inform users (URLCrazy)
Metamask EtherAddressLookup blacklist
Register fishing sites at local DNS and resolve them to alert page (for a team only). 

22. Site defacement and Clipboard manipulation
Easy to understand:
Hack website -> full control information on it
Change ICO address to your own
Or more tricky… Clipboard manipulation:

23. Weak passwords $500k HACK There is nothing new… But again and again.
Protection? You already know:
2FA
Password managers
Mnemonics
etc.
$500k HACK

24. Attack to unlocked wallet
Default behaive:
Try send TX to RCP -> “authentication needed: password or unlock”
What developer do:
personal.account(eth.coinbase, 'notReallyStrongPass', 0)
--unlock “0” --password “path/pass”
But not work for browser IDE yet:
--rpccorsdomain “*”
Сonsequences:
Any website or program can silently send transaction as developer

25. Pivoting Attack surface: Smart Contract Interfaces (web)
Social network and accounts
Third-party Lib/Apps/Chats/API
Oracles (Shapeshift and similar)
Mail/VPN/WEB/Mobile/… server
ALL hosts you control (including laptops)
Numerous attack vectors!

26. Recommendations Smart Contract security: Best practices Code audit
Bug Bounty (it almost free for you!)
Infrastructure:
Best practices
Audit / Security assessment / Penetration testing
Close/hide all unimportant

27. Pertsev Alexey @p4lex (telegram) a.pertsev@dsec.ru
Let’s talk
DAO for penetration testers
Pertsev (telegram)