Ether Wars Exploits Counter Exploits and Honeypots

Transcript

and we should find the politician with the net I don't know can you search for honey pots [Music] you okay hi

so I'm Daniel Luca I'm from consensus diligence and today I wanted to present you a bit of exploits honey pots and counter exploits this talk is about type of types of exploits I try to find all types of honeypot that I could find on the main net things that are active right now you will find a way how to you will see how to find a vulnerable contracts on the main net this is with the symbolic execution you can do also exploit validation and you will find out

how to write bots that exploit arbitrary contracts this is not how to make money on the internet this is not to make money while you know working from home without actually working and you will not actually learn how to hack people I have a pretty big list of collaborators and influencers the first person is Bernard Mueller he's here in the audience this is actually a talk that we did together in DEFCON it's it's a version of that talk recycling in a way I have to also thank consensus diligence

I have to thank you he had some nice ideas with some exploits these are three people that created paper about honey pots on the etherium Network it was very helpful to me I also have to thank Gerhard he had a pretty good list of honey pots and I also have to thank the awesome etherion community for creating the things that exploit us and creating the the medium posts and everything where they explain out how things work so first what is a honeypot I found the definition online it doesn't really help me the interesting thing is

that in 1994 it started became really really popular I think that's when I think that's when it started to be used in InfoSec but I have a different definition for a honeypot I think it's a contract that seems to disburse funds to people who interact with it or exploit it but that doesn't actually happen your funds get locked there and only the owner can extract the funds so basically it's a trap that steals your ether and then the owner can take back the ether so I found three types of honeypot types

a one is code obfuscation this is very related to solidity or it exploits box of solidity or things isn't the code is not super clear the other one is VM quirks or EVM quirks and the third one is based on incomplete information I'm gonna go through all of them so this is honeypot currently exists in the wild code obfuscation if can anyone see what the problem is I'm gonna wait a few seconds sorry yeah variable shadowing I also forgot

this one here so yeah you can see the owner shadows the original owner so even if you send ether to it you don't actually change the the variable upstairs you change the air variable this one so only owner uses the the one on top so you never become the owner the original owner remains the owner but it seems that you can I have a different one this is was initially a gif this is a PDF so you cannot see the gif the problem with this one this is my super hard to see because the the bug is

not actually visible but if you look at the bottom side you can see a really big scrollbar so the code is hidden to the right so you have to scroll and you will see the code there so it doesn't actually let you get the ether out only the owner can get the ether out so there's the return somewhere there okay so this one is a different type when this one was with solidity with other versions of solidity when you initialize variables it tried to set the smallest type of you end for your variables so

when you initialize I 1 and I 2 they actually become you and AIDS so when it goes through the while there is a point when I 1 overflows and it breaks and it only disperses one way so you have to send at least one ether and you get one way back so you don't get a lot of ether back and only the owner can extract the rest of the ether this is another solidity bug it's related to empty strings what happens is that if you have an argument and is an empty

string it would be skipped so instead of sending so instead of transferring the ether to the target which is would be the message center it's actually because everything is slightly to the left it's actually sent to the owner but it looks like it's it's it's it's sent to you but that doesn't really happen this one is also one of the most popular bugs in solidity where you don't initialize structures properly and then you overwrite some contract storage variables so in this in this example you're trying to guess the number the number has to be lower than 10 but when

you actually set this up and when you write the game dot player equals message sender it's actually overrides the secret number and it will never be equal because it has to be less than 10 and also the message sender is a huge address so Coppa code obfuscation is actually sometimes hidden code or solidity bugs most of them have been fixed but when you write a honeypot you can choose whatever version of solidity you want so it's your choice in you can pick the box that you want to use in your code this is super different from when you do audits or when you write

code because you kind of always have to use the latest version of solidity because all the bugs are fixed but in this case you can use whatever and people choose to interact with your contract or not and if it looks interesting they will try to exploit it the other category is VM quirks so this is a an EVM problem it looks like if your message value is larger or equal than the balance of the contract it will send you the funds and it also hints in the address transfer that it has to send

you the balance plus the mass value but what actually happens is that when the ether and there's the contract the balance of the contract is already updated so if there was either already in there you will never send more than what already is so let's say for example it's a 10 ether in the contract you send one ether the check actually is is one greater than greater or equal than 11 because the update the balance of the contract is already updated so you will never get this but of course the owner has a way to extract all the ether out

so this is like always false conditions you have to know details about how the EVM works in order to understand the problems the third category is incomplete information so this is interesting because it uses other other vectors of attack in this case it's mostly ether scan so people post their code and then they do some kind of transactions and then it looks like you have you know what's going on there but not really so this is super super popular on etherium I call them riddles so they post a question and they post

also the hash of of their response or actually if you look at start they post the response in clear text and then they save the hash and if you look at the transactions you can see the response so you can just you could send the answer but they also have this backdoor the new and when they sent the new they sent the hash directly they don't send a clear string the problem is that that hash doesn't have a valid input so there's no string that you can hash to get to that result so nobody can find that one so you're either again gets trapped in

there so this is when they call start you can see everything you can see if you decode the high string you will see the string the riddles are not that bad I kind of like them can anyone guess what the answer is it stars yeah and also I don't think I have this it starts with a capital S at the end so they try to make it tricky like here's the thing that I did it's with it's a bit different so you see the answer and you think you're

the only one that sees that but you know not really and in order to do that you will see the transaction where they create the contract this is the second transaction with where they send some of the ether and also send the response but behind the scenes they create another contract that calls new and then when they call new they send a different hash that you will never be able to guess and that's not visible in ether scan it is visible in other other explorers for example you can see in this one and you

can see that they call new you can see the response hash it's not a string anymore it's a ketchup string in order to check what's actually happening there we have a tool it's called legions and you can query a contract address how many storage variables and you can see if you know how the layout of the contract is created you can check the value of the variables in there and you will see that that's not the right hash that you were expecting but you have it's it's important to validate before you send the ether so for example in this case you do query storage of

address and then you see that storage 1 is a big hash and then the cat check of stars is a different one so that's not the real answer in this case this is another tricky one I really like this one so in this case you can see the the code the source code on ether scan and you will see that when you call cash out it will send you all of the ether it will send you all forward all of the gas and then you can do it doesn't transfer log so there's an event emitted the tricky thing about this one is that when they

initialize the contract the transfer log is not actually it doesn't really point to contract log this one but they did add the source code here so it looks like oh they're just gonna emit an event what they actually do is they do something else they can send they can revert to the transaction so you can never get the ether back sometimes they also do delegate calls so they can override some variables and then they send you the instead of sending you the eater they send the ether to the owner so this is really tricky because it seems like you see the cold source code but not all of the source code is used it's a different contract log that is

used in real life this one was it is really subtle so if you if you send more than one either they will send you the whole balance back but the trick is there is a missing parentheses it just points to the method it's not actually called they need to add another parentheses so for example if you look at this one you will see in the line 14 there is another parentheses at the end this doesn't exist so it doesn't do anything so um I was wondering if you know of any other honeypot types I tried

to find others these are all of the types that I found on the mainland sorry Riaan turn see ya so one of them actually could be you could do interesting this one for example it's also under flow so it doesn't check a lot of things you need to construct it so it looks like it's vulnerable yeah your interest it could work I have a test for you so it can I have a baseball

bat and a baseball and in total they cost one dollar and ten cents and I know that the baseball bat costs one dollar more than the baseball can you tell me how much each costs that's one answer yeah who thinks I am the baseball is 10 cents and the baseball bat is one dollar okay so there's a huge number of people the thing is I told you the baseball is one dollar less than the baseball bat so the thing is this type of problem seems

really easy but there is a subtlety to it and if you make it really easy for people to solve they will think they have the answer they will not double check I also didn't give you the time to do it so that's fine and this was discovered by Daniel Kahneman he's um he received the Nobel Prize for economics but he actually does psychology there's another interesting test that he did he created some logic logic problems for people and he found out that he could change the test in a way that would

without changing the problems he would have different success rates for people so for example the the problems were written in a clear text people would see them clearly that was fine but 90% of them would do at least one mistake so he did another thing he changed the font of the text he made it a bit unreadable harder to read more difficult but at least 35% had won one problem one one mistake so that means when he made the font harder to read people would make less mistakes so he would force people to think more he calls it system 1 and

system 2 system 1 is like the first thing that comes to your mind and system 2 forces you to think more about what the problem is and what happens so an important thing about honeypot is that they have to seem they have to look really easy they have to be like oh yeah this is the answer or it's really easy to understand so but there's another subtle thing so there are few layers in honey pots that you have to understand and you think you uncovered the first layer but they're actually at least one okay so I have a tool Carl I created

actually based on Bernards idea it does mass continuous recon on the main that what does it that it scans all blocks it looks at all transactions and it checks all contracts that are deployed on the main net and it can find vulnerable contracts it uses method so you can just import the meta libraries and do symbolic execution and you can find contracts that disburse funds to you or more more easier than what you send to them or you can sub destruct contracts which is also interesting and also because it uses symbolic execution it does exploit generation so it tells you what transactions to run in order to

get to that state in order to self-destruct the contract for example and it also has a different way of valid the contract the the exploit by forking forking the main net and actually sending the transactions and seeing if that works so when I think about symbolic execution is I think about transforming the execution of the program into a mathematical equation and then what it does is that you try to solve that equation for some branch of the program that you want to happen so for example if you want to self-destruct

the contract it try to solve the the equation so you find the inputs the right inputs that will take you to that self-destruct execution its if you don't want to understand anything so it's it's not that easy you can just use the metal libraries so it's actually very easy to use the metal libraries you just load the metal disassembler you load the contract from actually the address so you just point it to the maintenance you can use in fewer URLs and then you start the method or analyzer and it just generates a report and that report is fairly easy to read you have a list of issues you have a list of transactions

so you can try to validate them after so it just looks like this and it tries to get to the self-destruct so if you visit this contract it will tell you what the X is to solve the equation but it also works for any kind of inputs except for hashing which is a different kind of problem and the output looks something like this so you can see the initial state the attacker and some guy and you find this transaction sequence this is actually one of the honey pots so its

function x2 with the transaction data is the function signature and it tells you how much value to send you might recognize the 0 XD 0 that's one and then also it tries to confirm the vulnerability in this case I did change the contract to make it vulnerable and it's sometimes kind of hard to validate the exploit you don't know exactly what happens behind the scenes so that's why what I'm using is ganache so you can fork the chain with ganache and send in transactions and see what happens and if

you have more ether it's actually vulnerable so when you fork the gene people usually some understand something like this so the contentions fork well the fight over something but what I actually do is that it's this kind of work we have the real chain on up top we have the contract that was deployed to block a hundred for example and then I do a fork with ganache and ganache just takes all of the state from what the main net on demand when it needs it and if then it sends the transactions in block 101 and in block one or two I can just check if I have more either so does

the exploit really work or not so um so the thing is you can just enable this with Carl so it does this automatically so it's very easy to we just need to have ganache installed Theo is a different tool that I have it's kind of it picks up where Carl left off Carl just does mass continuous scanning so it doesn't ever stop it produces some reports but we feel it drops you into a rebel console and you can run the exploit if you want you can send different transactions with it it's more like a exploitation framework I try to

think of it like Metasploit framework it's it's getting there is not there yet so the other type of honeypot that I was thinking of is the race condition honeypot so race completion honeypot is actually vulnerable you if you validate it with Karl you can actually see that it is valid but the problem is that it doesn't because it's race condition it it uses the memo so if you think of a minor the miners have lists of okay five ten minutes okay so the minor has the memo

and they just add transactions to the mempool because they want to add those transactions in the next block the thing is if you're a part of this network of miners you don't actually need to be a miner just need to run an ethereal client you will see transactions going everywhere so you will also see what the memo contains the interesting thing is with this contract if you look at claim ownership you see that there is a require up their message value is 0.1 ether so I didn't try to steal a lot I just tried to steal 0.1 ether and then it checks if if it was claimed before the player becomes the message center incense claimed true and then if you

call retrieve the message center has to be the player the one that was set up top and then it sends you all all of the ether in the contract there's a trick to this one if it was claimed before it doesn't do anything it just accepts the either so what happens with Theo this was a demo that I cannot show but that's fine what happens with Theo is that it will watch the memo as soon as it sees the transaction trying to call claim ownership it will send its own transaction but with a higher gas cost and because miners need to add the best transactions in the block like the most

profitable for them it will add my transaction on top so this is actually on the main net somebody try to exploit the contract and they send a transaction with a really really high gas price 261 way if you know so the nonce doesn't matter the position is the position in the block it's one but we count the stuff from zero so this is transaction zero so this one was sent by do it saw that there is transaction on in the memo it sent the transaction at the same time they were

included in the same block and it was before you can also see that the gas limit was sent was set at 32,000 in it used all of it the person that got honeypotted didn't use of transaction because the if didn't go there so it didn't set the storage variable it just the difference in the gas price is so this is the person who got ha repotted it doesn't enter the the condition sorry oh the difference in the gas price yes

so it's up 12 13 it's just one way more so the minimum amount of gas price that you can front on somebody it's just one way it doesn't even matter how much gas your transaction uses the miners will add your transaction on top so if you have miners start trying to it is it is yes miners have a lot of power at the moment and I they're not mmm I mean distill our thing it does it does happen and with flash

loans it's even more profitable right now you just monitor for the flash notes and you front around them you don't even know to kind of what happens there just change their address with yours maybe thank you for the idea so I wanted to see what happens if you send lots and lots of transactions so I created like a small contract or front round game they need to call the method call me and they provide the right index if you provide the right index it counts up your your successful call count it increases the index and it tells that it's true otherwise it increases the unsuccessful call count so this is me being connected

to a local local cat node and I'm just monitoring the transactions and I'm also sending the transactions but I'm sending them to any Fuhrer so it's a different node and this is the player the one that got hacked he got 40 transactions before the hacker and 971 of 78 after the hacker so they were front-run 907 78 times out of 1018 it should have been a thousand but there was some glitch in the code or didn't it didn't see the updated index it also depends on how far the blocks are apart so your your node

updates properly sometimes get glitches a bit so it's actually super good with one single node and I also tried what happens with two nodes what if I'm connected to two nodes I monitored the mem pull from two nodes it's not what I was expecting I had less less success rate it's because you have to talk over the network you don't get the replies so as fast enough you have to use parallelization and also my code wasn't too great and I finalized it on the way here but I think you can improve that if you have a local network and you have multiple nodes it's faster

to to talk to them and see more transactions but with one with only one node it's very good so yeah I just have some links to Karl if you want to use it this is the one that continuously monitors the the mem the main net and creates reports just JSON files with exploits this is theö it does front-running and it's also the exploitation framework and this is he Tommy it's a web 3 Python rebel console

so if you want to you can use the the web 3 in your browser for example but I do prefer to use it in the console and I do prefer Python most of the times and this is legion it's more of a user friendly web 3 console I don't need to have the web tier documentation with you all the time it has autocomplete it's it's more it's nicer I didn't write this one ok so do you have any questions hey great presentation Thanks

you didn't leave us enough time to come up with other honeypot types it kind of skipped over it once no and had one in five seconds but I have three more ICS I mean according to your definition it means you have to put something and you don't get anything back out right so many ICS have been honey putts in a way then there are scams send one eath to two metallic and you get ten back have you checked whether the contracts ever actually try to deceive you or are they just playing collecting the money and the third one wait because I have only one question I have to put it all in one the third one is isn't the whole avi theorem a honeypot cuz you invest lots

of research and creating a flasher or just an example lots of research flesh ons are complicated and then someone France our new front runs you so your investment in time that you take into putting together the the basically the the the the arbitrage trade is what you lose and someone else takes a profit by front-running you is that also a honeypot so i ciose no comments the the Vitalik one I don't know if so I didn't check those ones I'm I don't know if it's a contract at the end or if it's a person who just promises more ether to you I would add Ponzi schemes to that one there they're similar in a way they

do promise they do give you some back but you know it happens and the holy theorem being a honeypot or the flash loans if the front run you they don't take your money they take other people's money and then oh yeah I think yeah so I do agree with that I think front turning is important even even more after the bzx thing and flash loans and everything so you invest a lot of time if they find a way to stimulate your transaction and see that it is

profitable they can take your work away and money yeah yeah maybe when that less question yeah who are the people who fall for these honey pots I mean like it's a very specific person who knows enough to go scanning this blockchain finding contracts looking up contracts codes then thinking that they can exploit it but not smart enough to actually see like is there really like who are these people are they enough of them is this profitable it is profitable so I was one of them I fell for a honeypot then I said okay I have to do my honey pots if you look at the code

you think you're smart you think you're smarter than the other person and you just run send to send a transaction so others don't do it before you and they trick you and then you lose one either but there's a it's a lesson learned it was one of the riddles thanks for that Thanks you you