Bitcoin Forum
July 19, 2018, 04:30:19 PM *
News: Latest stable version of Bitcoin Core: 0.16.1  [Torrent]. (New!)
 
   Home   Help Search Donate Login Register  
Pages: [1]
  Print  
Author Topic: Alert Keys and Alert System Vulnerabilities Disclosure  (Read 159 times)
achow101
Moderator
Legendary
*
expert
Offline Offline

Activity: 1470
Merit: 1453


3F1Y9yquzvY6RWvKbw2n2zeo9V5mvBhADU


View Profile WWW
July 02, 2018, 11:15:02 PM
Merited by Foxpup (15), Wind_FURY (10), NeuroticFish (5), ETFbitcoin (2), DarkStar_ (2), qwk (1), RGBKey (1)
 #1

The bitcoin alert keys are disclosed in this post, followed by a description of the purpose of this information and its history. The bitcoin alert system has been completely retired. The network is not at risk and this warning may be safely ignored if you do not have an ancient node (running v0.12.x or older) using the deprecated bitcoin alert system or its public keys.

mainnet public key: 04fc9702847840aaf195de8442ebecedf5b095cdbb9bc716bda9110971b28a49e0ead8564ff0db2 2209e0374782c093bb899692d524e9d6a6956e7c5ecbcd68284

mainnet private key: 30820113020101042053cdc1e0cfac07f7e1c312768886f4635f6bceebec0887f63a9d37a26a92e 6b6a081a53081a2020101302c06072a8648ce3d0101022100ffffffffffffffffffffffffffffff fffffffffffffffffffffffffefffffc2f300604010004010704410479be667ef9dcbbac55a0629 5ce870b07029bfcdb2dce28d959f2815b16f81798483ada7726a3c4655da4fbfc0e1108a8fd17b4 48a68554199c47d08ffb10d4b8022100fffffffffffffffffffffffffffffffebaaedce6af48a03 bbfd25e8cd0364141020101a14403420004fc9702847840aaf195de8442ebecedf5b095cdbb9bc7 16bda9110971b28a49e0ead8564ff0db22209e0374782c093bb899692d524e9d6a6956e7c5ecbcd 68284

testnet public key: 04302390343f91cc401d56d68b123028bf52e5fca1939df127f63c6467cdf9c8e2c14b61104cf81 7d0b780da337893ecc4aaff1309e536162dabbdb45200ca2b0a

testnet private key: 308201130201010420474d447aa6f46b4f45f67f21180a5de2722fc807401c4c4d95fdae64b3d6c 294a081a53081a2020101302c06072a8648ce3d0101022100ffffffffffffffffffffffffffffff fffffffffffffffffffffffffefffffc2f300604010004010704410479be667ef9dcbbac55a0629 5ce870b07029bfcdb2dce28d959f2815b16f81798483ada7726a3c4655da4fbfc0e1108a8fd17b4 48a68554199c47d08ffb10d4b8022100fffffffffffffffffffffffffffffffebaaedce6af48a03 bbfd25e8cd0364141020101a14403420004302390343f91cc401d56d68b123028bf52e5fca1939d f127f63c6467cdf9c8e2c14b61104cf817d0b780da337893ecc4aaff1309e536162dabbdb45200c a2b0a

These are openssl-serialized private keys.

In 2016, a plan was proposed for the completion of the retirement of the bitcoin alert system which included the idea of revealing the alert system private keys. The proposal still contains good information regarding the purpose and intention of alert system retirement and motivation for the disclosure of the private keys. Additionally, an overview of the alert system retirement and its timeline is available on the web. This disclosure was recently discussed in an IRC meeting. A media site also recently discussed this topic.

One of the reasons for disclosure of the keys is to mitigate the effects of unknown dissemination and proliferation of the keys. By broadcasting the values to make them available to everyone, the value
of the keys is intended to be to be eliminated, since now everyone could feasibly sign messages, the value of the signed messages becomes zero.


Vulnerabilities in the Bitcoin Alert system


Background

The Alert System previously utilized by Bitcoin has several issues (some of which may be classified as vulnerabilities). These issues no longer exist in Bitcoin as of network protocol version 700013 which was released with Bitcoin Core 0.13.0. Many altcoins and Bitcoin client implementations were notified of the Alert System's removal and have since removed the alert system themselves or transitioned to using an Alert system that does not share an Alert Key with Bitcoin.

All of the issues described below allow an attacker in possession of the Alert Key to perform a Denial of Service attack on nodes that still support the Alert system. These issues involve the exhaustion of memory which causes node software to crash or be killed due to excessive memory usage.

Many of these issues were not known until the Alert System was removed as developers inspected the code for vulnerabilities prior to releasing the Alert Key. Due to these issues, the publication of the Alert Key was delayed and affected altcoins and software were notified.

As of this writing, less than 4% of Bitcoin nodes are vulnerable. Furthermore, the Bitcoin Core developers have created a "final alert" which is a maximum ID number alert which overrides all previous alerts and displays a fixed "URGENT: Alert key compromised, upgrade required" message on all vulnerable software. The Bitcoin Core developers believe that so few vulnerable nodes are present on the network, and risks to those nodes so minor, that it is safe to publish the Alert Key.

An Alert contains these fields:

Code:
int32_t nVersion;
int64_t nRelayUntil;      // when newer nodes stop relaying to newer nodes
int64_t nExpiration;
int32_t nID;
int32_t nCancel;
std::set<int32_t> setCancel;
int32_t nMinVer;            // lowest version inclusive
int32_t nMaxVer;            // highest version inclusive
std::set<std::string> setSubVer;  // empty matches all
int32_t nPriority;

Alerts are also identified by their SHA256 hash. The above fields can be freely modified to generate alerts with differing hashes.

Infinitely Sized Map (CVE-2016-10724)


The Alert System was designed to support multiple Alerts simultaneously. As such, Alerts were stored in memory in a map. However, there is no limit on how large this map can be, thus an attacker with the Alert Key can send a large number of Alerts to a node. Eventually, the map containing all of the Alerts will be so large that the node runs out of memory and crashes, thus causing a Denial of Service attack.

The infinitely sized map is the basis for which the Alert system can be used to cause Denial of Service attacks.

Infinitely Sized Alerts

Although the infinitely sized map is what causes the crash itself, an attacker can also send very large Alerts. Alerts themselves are not limited in size explicitly, they are only limited by the maximum network message size. This maximum network message size has varied between versions. At times in the past, it has been 32 MB. For Bitcoin Core 0.12.0 (the most recent version of Bitcoin Core with the alert system enabled by default), the maximum message size is 2 MB.

Although large Alerts do not directly cause a Denial of Service by themselves, combined with the infinitely sized map, large Alerts can more quickly cause a node to run out of memory.

* The `setCancel` field has no length limit (besides the maximum message size) and is a std::set of 32-bit integers. Given that it has no size constraints, an attacker can use this field to create a very large Alert by filling the set with many integers.
* The `setSubVer` field, like `setCancel`, has no length limit and is a std::set. However instead of integers it has std::strings. These strings do not have a length limit themselves and can thus be arbitrarily long to produce an Alert that is arbitrarily large.
* Bitcoin Core versions prior to 0.10.0 did not have a limit on the length of the `strComment`, `strStatusBar`, and `strReserved` fields. These strings can have an arbitrary length.

The Final Alert

To protect against attackers abusing the Alert key following its publication, the Bitcoin Core developers constructed a "final alert". This final alert is a maximum ID alert which overrides all previous alerts. All Bitcoin Core versions since and including Bitcoin Core 0.14.0 contain the final alert and will send it to any node which is vulnerable. However this protection is not enough to protect those nodes as a few issues were found with the final alert itself.

Final alerts are those which meet the following conditions:

Code:
nExpiration == maxInt &&
nCancel == (maxInt-1) &&
nMinVer == 0 &&
nMaxVer == maxInt &&
setSubVer.empty() &&
nPriority == maxInt &&
strStatusBar == "URGENT: Alert key compromised, upgrade required"

`maxInt` is the maximum signed integer as defined by `std::numeric_limits<int>::max()`.

Multiple Final Alerts

The definition for a final alert does not include a few fields. Because alerts are identified by their hashes, changing the ommitted fields allows an Alert to be classified as a final alert but still be an alert that is added to the infinitely sized map.

- Since `setCancel` is not required to be empty for an alert to be a final alert, the `setCancel` field can contain different integers to produce alerts that have different hashes and are thus different alerts. Combined with the infinitely sized map and the infinitely sized `setCancel` issues, many final alerts can be created which are large, fill the map, and cause a node to run out of memory.
- The `strComment` field, while having a maximum length of 65536 bytes, is not required to be a particular string in order for an alert to be a final alert. Thus multiple final alerts can be crafted which have different hashes by using different values for `strComment`
- The`strReserved` field, while having a maximum length of 256 bytes, is not required to be a particular string in order for an alert to be a final alert. Thus multiple final alerts can be crafted which have different hashes by using different values for `strReserved`.
- The `nVersion` field is also not required to be a particular value. Thus this can be used to construct final alerts with different hashes by having different values for `nVersion`.
- `nRelayUntil` field is also not required to be a particular value. Thus this can be used to construct final alerts with different hashes by having different values for `nRelayUntil`.

Final Alert Cancellation (CVE-2016-10725)
Although the final alert is supposed to be uncancellable, it unfortunately is cancellable due to the order of actions when processing an alert. Alerts are first processed by checking whether they cancel any existing alert. Then they are checked whether any of the remaining alerts cancels it. Because of this order, it is possible to create an alert which cancels a final alert before the node checks whether that alert is canceled by the final alert. Thus an attacker can cancel a final alert with another alert allowing a node to be vulnerable to all of the aforementioned attacks.

Protecting Against DoS Attacks from the Alert System

Fixing these issues is relatively easy. The first and most obvious solution is to simply remove the Alert system entirely. As nodes upgrade to versions without the Alert system, fewer nodes will be vulnerable to attack should the Alert keys become public. This is the option that Bitcoin has taken. However, because Bitcoin has retired the Alert system entirely, the Alert key will also be published to reduce the risk that the Alert Key is mistakenly depended upon in the future.

Should altcoins wish to continue using the Alert system but with a different Alert Key, a few very simple fixes will safeguard nodes from the aforementioned issues. Limiting the number of alerts, the size of `setCancel` and `setSubVer`, and only allowing one final alert altogether fix the above issues. This patch, on top of Bitcoin Core 0.11 (a vulnerable version), fixes the aforementioned issues. Altcoins that still use the Alert system are recommended to port this patch to their software. Outdated node software is still vulnerable.

This disclosure was authored primarily by Bryan Bishop (kanzure) and Andrew Chow (achow101). Special thanks to reviewers. Also, a interesting proposal was floated to not disclose the private keys in WIF format-- one is that this is not how the original values were received, and second (more importantly) to prevent users from importing the key into their wallet and reusing it in their wallet key circulation.

From https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2018-July/016189.html

1532017819
Hero Member
*
Offline Offline

Posts: 1532017819

View Profile Personal Message (Offline)

Ignore
1532017819
Reply with quote  #2

1532017819
Report to moderator
1532017819
Hero Member
*
Offline Offline

Posts: 1532017819

View Profile Personal Message (Offline)

Ignore
1532017819
Reply with quote  #2

1532017819
Report to moderator
1532017819
Hero Member
*
Offline Offline

Posts: 1532017819

View Profile Personal Message (Offline)

Ignore
1532017819
Reply with quote  #2

1532017819
Report to moderator
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1532017819
Hero Member
*
Offline Offline

Posts: 1532017819

View Profile Personal Message (Offline)

Ignore
1532017819
Reply with quote  #2

1532017819
Report to moderator
1532017819
Hero Member
*
Offline Offline

Posts: 1532017819

View Profile Personal Message (Offline)

Ignore
1532017819
Reply with quote  #2

1532017819
Report to moderator
1532017819
Hero Member
*
Offline Offline

Posts: 1532017819

View Profile Personal Message (Offline)

Ignore
1532017819
Reply with quote  #2

1532017819
Report to moderator
DooMAD
Legendary
*
Offline Offline

Activity: 1680
Merit: 1113



View Profile WWW
July 03, 2018, 11:12:56 AM
 #2

Quote from: the CoinDesk article you linked to
If you didn't know bitcoin had a warning system like this, that's because it was retired in 2016 due to security concerns and frequent confusion about its use.

"The alert system was a frequent source of misunderstanding about the security model and 'effective governance,'" well-known Bitcoin Core contributor Greg Maxwell wrote in a public email from September 2016.

No kidding.  It's a relief we can put this behind us.  Several years on and I'm still mildly traumatised from the levels of ignorance and fear-mongering on display in threads like this.  Some people just genuinely didn't "get it".  

Incidentally, was that thread the main catalyst for this decision?  Would be nice to know that something positive came out of that mess.

Interesting to see that a potential DDoS vulnerability was found, though.


The network is not at risk and this warning may be safely ignored if you do not have an ancient node (running v0.12.x or older) using the deprecated bitcoin alert system or its public keys.

I'm thinking the hardline fundamentalists running deliberately outdated "TRB" nodes might need to fix theirs?

btj
Jr. Member
*
Offline Offline

Activity: 56
Merit: 13


View Profile
July 03, 2018, 08:58:09 PM
 #3

Nice move.

But is there any study about a risk of Buffer Overflow Attack ? This will result in a big losses if some hackers manage to exploit it (Of course if exploitable, hence my question).

How the sendalert key disclosed ? is it owned by you before ? Are you satoshi nakamoto or he passed it to you when he is retired from the project ?

Why not fixing it ? Isn't it benifical for bitcoin core ? How you will manage to inform peoples about potential risk in the futur ?

Thank's.
achow101
Moderator
Legendary
*
expert
Offline Offline

Activity: 1470
Merit: 1453


3F1Y9yquzvY6RWvKbw2n2zeo9V5mvBhADU


View Profile WWW
July 03, 2018, 11:58:44 PM
 #4

But is there any study about a risk of Buffer Overflow Attack ? This will result in a big losses if some hackers manage to exploit it (Of course if exploitable, hence my question).
No buffer overflow attacks were found. All known attacks were described in this post. With the C++ standard library, it's actually kind of hard to get a buffer overflow.

How the sendalert key disclosed ? is it owned by you before ? Are you satoshi nakamoto or he passed it to you when he is retired from the project ?
The alert key was owned by numerous people; the full list is actually unknown because it is impossible to know whether someone passed the alert key to someone else and simply did not say so. The alert key was created by Satoshi and passed to others, including gmaxwell, sipa, kanzure, wumpus, theymos, etc. Kanzure (Bryan Bishop) who co-authored this text, had the alert key and he was the one to disclose it.

Why not fixing it ? Isn't it benifical for bitcoin core ? How you will manage to inform peoples about potential risk in the futur ?
Because we want to get rid of the alert system. It has already been removed from Bitcoin Core for several years. There are already sufficient media outlets and sites where people get their news about Bitcoin. If there is a network event in the future, people can easily get information about it from those places.

btj
Jr. Member
*
Offline Offline

Activity: 56
Merit: 13


View Profile
July 05, 2018, 03:00:43 PM
 #5

Why not fixing it ? Isn't it benifical for bitcoin core ? How you will manage to inform peoples about potential risk in the futur ?
Because we want to get rid of the alert system. It has already been removed from Bitcoin Core for several years. There are already sufficient media outlets and sites where people get their news about Bitcoin. If there is a network event in the future, people can easily get information about it from those places.

Thank you for your answer.

But it's not sufficient, sendalert system let all users to be informed about an event or critical issue at the same moment ... this system is really required for Bitcoin and it's not made for nothing in the firsts versions.

If we focus on online medias, you must notice that peoples not follow the same one, and time to publish news about an event differs from media to another, there even peoples that not follow news or read them ... there many peoples interested on Bitcoin, even those who don't speak English, and since almost all the news medias are in english, this exclude them aswell.

Since we are on a decentralized solution, and there a way for an improvement or create new similar alert system based on new algorythm or architecture, why not ? And to push things further, why not a decentralized self updating system ?

What is this ?
Update bitcoin core automatically when a new version is released, yes we all now this and it present a security measure, and it need trusting third party and it's not principle of Bitcoin.

A discussion already exist about this on (And purhapse other topics):
https://bitcointalk.org/index.php?topic=293824.0

But what if we follow the majority ? just like mining system (A 51% Update) ... blockchain detect the most used version of Bitcoin Core (Keeping all this decentralized) and update the other clients automatically in case of critical security alert. Or atleast notify the other clients instead of auto update them.

It's not subject here, but this will open a door for improvements.
achow101
Moderator
Legendary
*
expert
Offline Offline

Activity: 1470
Merit: 1453


3F1Y9yquzvY6RWvKbw2n2zeo9V5mvBhADU


View Profile WWW
July 05, 2018, 07:10:11 PM
Merited by Foxpup (5), theymos_away (5)
 #6

But it's not sufficient, sendalert system let all users to be informed about an event or critical issue at the same moment ... this system is really required for Bitcoin and it's not made for nothing in the firsts versions.

If we focus on online medias, you must notice that peoples not follow the same one, and time to publish news about an event differs from media to another, there even peoples that not follow news or read them ... there many peoples interested on Bitcoin, even those who don't speak English, and since almost all the news medias are in english, this exclude them aswell.
There are many Bitcoin media sites in non-english languages. There are also many forums in non-english languages. From previous events, we know that these things get reported on fairly quickly and the news spreads around fairly quickly. There isn't any need for the alert system.

The other reasons for removing the alert system were its centralization and insecurity. No one knew exactly who held the alert key. Anyone who did could send an alert and this poses a security risk. Furthermore, there was some talk previously about using the alert key for non-alert things and rather as a way for developers to force changes in a centralized manner. This is completely undesirable, and combined with the fact that we had no idea who had the alert key, it needed to be removed.

Since we are on a decentralized solution, and there a way for an improvement or create new similar alert system based on new algorythm or architecture, why not ?
Sure, that's something that has been discussed. But there is no urgent need for one, and we believe that existing news and media are sufficient for getting information out to everyone.

And to push things further, why not a decentralized self updating system ?
Automatic updates (and updates in general) are inherently centralized. You need to get the binaries from a centralized distribution source.

But what if we follow the majority ? just like mining system (A 51% Update)
That's not at all how mining works. It isn't just "follow the majority".

... blockchain detect the most used version of Bitcoin Core (Keeping all this decentralized) and update the other clients automatically in case of critical security alert. Or atleast notify the other clients instead of auto update them.
There is no way to detect reliably what version clients are running. It is easy to spoof the version you are using and it is impossible for a third party to verify that you are running that version. If an attacker compromises the distribution server, they can easily spin up fake nodes for their new compromised version and then people with the auto updater will then update to the compromised version. Any sort of auto updating feature has the same problem. Additionally, the Bitcoin Core developers do not want to force people to use specific versions; it is up to the node operators to update at their own convenience.

btj
Jr. Member
*
Offline Offline

Activity: 56
Merit: 13


View Profile
July 05, 2018, 09:11:26 PM
 #7

But it's not sufficient, sendalert system let all users to be informed about an event or critical issue at the same moment ... this system is really required for Bitcoin and it's not made for nothing in the firsts versions.

If we focus on online medias, you must notice that peoples not follow the same one, and time to publish news about an event differs from media to another, there even peoples that not follow news or read them ... there many peoples interested on Bitcoin, even those who don't speak English, and since almost all the news medias are in english, this exclude them aswell.
There are many Bitcoin media sites in non-english languages. There are also many forums in non-english languages. From previous events, we know that these things get reported on fairly quickly and the news spreads around fairly quickly. There isn't any need for the alert system.

The other reasons for removing the alert system were its centralization and insecurity. No one knew exactly who held the alert key. Anyone who did could send an alert and this poses a security risk. Furthermore, there was some talk previously about using the alert key for non-alert things and rather as a way for developers to force changes in a centralized manner. This is completely undesirable, and combined with the fact that we had no idea who had the alert key, it needed to be removed.

Since we are on a decentralized solution, and there a way for an improvement or create new similar alert system based on new algorythm or architecture, why not ?
Sure, that's something that has been discussed. But there is no urgent need for one, and we believe that existing news and media are sufficient for getting information out to everyone.

And to push things further, why not a decentralized self updating system ?
Automatic updates (and updates in general) are inherently centralized. You need to get the binaries from a centralized distribution source.

But what if we follow the majority ? just like mining system (A 51% Update)
That's not at all how mining works. It isn't just "follow the majority".

... blockchain detect the most used version of Bitcoin Core (Keeping all this decentralized) and update the other clients automatically in case of critical security alert. Or atleast notify the other clients instead of auto update them.
There is no way to detect reliably what version clients are running. It is easy to spoof the version you are using and it is impossible for a third party to verify that you are running that version. If an attacker compromises the distribution server, they can easily spin up fake nodes for their new compromised version and then people with the auto updater will then update to the compromised version. Any sort of auto updating feature has the same problem. Additionally, the Bitcoin Core developers do not want to force people to use specific versions; it is up to the node operators to update at their own convenience.

Instead of updating automatically Bitcoin Core, this one will make a notification directly (This prevent from forcing user to update it), of course some peoples will be able to spoof the version, but there will be a trick to solve this problem, like algo to crypt checksum of the bitcoin core with the version number in a way to enforce and apply an anti-spoofing system.

And this will help to get some stats about bitcoin (For public analytics), and this staying decentralized.

Make it on this way or with another idea, is something useful for bitcoin community, but like you said it's not an urgent matter, right now developer team must focus on the security (Main thing is protecting bitcoin users and ecosystem).

Good luck and thank you for your time.
Pages: [1]
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!