1. The Pentester’s View on Blockchain Projects
Pertsev Alexey
@_p4lex

2. Agenda DApp? How does it work? Examples of vulnerable contracts
The Pentester’s View on Blockchain Projects
Agenda
DApp? How does it work?
Examples of vulnerable contracts
Client-side vulnerabilities
Digital Security ICO case
Common attack vectors at ICO address changing
Latest security incidents overview

3. DApp and DAO Browser Ethereum HTTP Requests Gateway Smart Contact
The Pentester’s View on Blockchain Projects
DApp and DAO
Browser
Ethereum
HTTP Requests
Gateway
Smart Contact
address = “0xdeadbeef…”
Transaction
Transaction
ABI = [{“name”: “crowdsale”…}]
Geth
Parity
cpp-Ethereum
web3 object
Call results, events…

4. Smart Contract’s Vulns/Attacks/Features
The Pentester’s View on Blockchain Projects
Smart Contract’s Vulns/Attacks/Features
Blockchain specifics:
Front-running attack
Timestamp dependency
Generating randomness
Unpredictable state
Keeping secrets
Solidity specifics:
Evolution of money sending:
Reentrancy
Gasless send
DOS (due to exception disorders)
Self-destruction
Inheritance
EVM specifics:
Integer overflow (no exceptions)
ABI encoding/decoding (no args checks)
Short Address Attack
Type confusion
Uninitialized storage pointer
Logical (project specifics):
Name it yourself :)

5. Logical vulnerabilities
The Pentester’s View on Blockchain Projects
Logical vulnerabilities
Forgotten access modifiers
Misspelled identifications (variables, functions)
Huge variety of race conditions
Subject area specifics
etc…

6. Logical vulnerabilities – DSec ICO
The Pentester’s View on Blockchain Projects
Logical vulnerabilities – DSec ICO

7. Logical – commit-reveal
The Pentester’s View on Blockchain Projects
Logical – commit-reveal
Commision fee is up to a user,
never from smart contract.

8. Then attacker can withdraw ether from Coinbase and repeat!
The Pentester’s View on Blockchain Projects
Ethereum account balance manipulation (Coinbase)
1 ETH
+ 1 ETH
Wallet1
1 ETH
+ 1 ETH
Attacker Smart Contract
Coinbase
Wallet2
1 ETH
+ 1 ETH
Wallet3
4 ETH (Ethereum view)
1 ETH (Coinbase view)
Then attacker can withdraw ether from
Coinbase and repeat!
Broken Smart Contract
+ 1 ETH
Coinbase
$10k bounty
0 ETH (Ethereum and Coinbase* view)

9. Client-side vulnerabilities and vectors
The Pentester’s View on Blockchain Projects
Client-side vulnerabilities and vectors
Leaving blockchain aside, can I hack ICO without blockchain knowledge?
XSS
Phishing
Site defacement + clipboard manipulation
Social Engineering
etc…
And other vectors:
Weak passwords for Social Network accounts (twitter, slack, FB, etc.)
Hacking related infrastructure and pivoting

10. Blockchain-stored XSS
The Pentester’s View on Blockchain Projects
Blockchain-stored XSS
Protection: Don’t trust user data!
Always cast, validate, sanitize and escape
(order is meaning!)

11. Phishing kickico $50k Hack Tree steps to phishing: Mitigations:
The Pentester’s View on Blockchain Projects
Phishing
Tree steps to phishing:
Register a domain name similar to a victim’s one: kickico.com -> kickico.co
Copy a victim’s website and replace ICO smart contact address
Spam spam spam!
kickico
$50k Hack
Mitigations:
Be offensive! Monitor similar domains and inform users (URLCrazy)
Metamask EtherAddressLookup blacklist
Register phishing site at local DNS and resolve them to alert page (for team only)

12. Site defacement and Clipboard manipulation
The Pentester’s View on Blockchain Projects
Site defacement and Clipboard manipulation
Easy to understand:
Hack website -> full control information on it
Change ICO address to your own
CoinDash.io
$7 Million Hack
Or a more tricky one… Clipboard manipulation:

13. $500k HACK Weak passwords There is nothing new here, same old story.
The Pentester’s View on Blockchain Projects
Weak passwords
There is nothing new here, same old story.
$500k HACK
Protection? You already know:
2FA
Password managers
OAuth
etc.

14. Social Engineering + Phishing
The Pentester’s View on Blockchain Projects
Social Engineering + Phishing

15. Pivoting Numerous attack vectors! Attack surface: Interfaces (web)
The Pentester’s View on Blockchain Projects
Pivoting
Attack surface:
Interfaces (web)
Social network and accounts
Third-party Lib/Apps/Chats/API
Oracles (shapeshift and similar)
Mail/VPN/WEB/Mobile/… server
Totally ALL host you control (laptops too)
Numerous attack vectors!

16. Recommendations Smart Contract security: Infrastructure:
The Pentester’s View on Blockchain Projects
Recommendations
Smart Contract security:
Best practices
Code auditing
Bug Bounty (almost free for you!)
Infrastructure:
Best practices
Auditing / Security assessment / Penetration testing
Close/hide all optional services

17. Let’s talk Pertsev Alexey @_p4lex a.pertsev@dsec.ru
The Pentester’s View on Blockchain Projects
Let’s talk
Pertsev Alexey
@_p4lex