Building and Breaking Block Chains Merlin Corey Pandoblox Engineer - - PowerPoint PPT Presentation

building and breaking block chains
SMART_READER_LITE
LIVE PREVIEW

Building and Breaking Block Chains Merlin Corey Pandoblox Engineer - - PowerPoint PPT Presentation

Building and Breaking Block Chains Merlin Corey Pandoblox Engineer Shellcon 2018 Who is that Merlin guy? Cryptography nerd Null Space Labs keyholder LayerOne Hardware Hacking Village Defcon Tamper Evident Village DC949


slide-1
SLIDE 1

Building and Breaking Block Chains

Merlin Corey

Pandoblox Engineer

Shellcon 2018

slide-2
SLIDE 2

Who is that Merlin guy?

  • Cryptography nerd
  • Null Space Labs keyholder
  • LayerOne Hardware Hacking Village
  • Defcon Tamper Evident Village
  • DC949 Alumni
  • Startup Wizard at Pandoblox
slide-3
SLIDE 3

Assumptions

  • Cryptographic fundamentals
  • Vague ideas of what a cryptocurrency is
  • Passing familiarity with Python or another

language

slide-4
SLIDE 4

Cryptographic Fundamentals

  • Hashing is most important concept
  • One-way function
  • Ideally

– Large space – Randomized value – No collisions

slide-5
SLIDE 5

Vague ideas of Cryptocurrency

  • Magical internet currency
  • The future of everything
  • Really slow database
  • Pyramid scheme?
slide-6
SLIDE 6

Basic programming

  • TrackA = Room(‘pufferfish’)
  • Merlin = Speaker()
  • For each Attendee in TrackA.attendees()

– Attendee.ListenTo(Merlin)

  • Print(‘Now you know Python’)
slide-7
SLIDE 7

Building Basic Blockchain: Prior Art

  • https://github.com/dvf/blockchain
  • https://github.com/zack-bitcoin/basiccoin
slide-8
SLIDE 8

Building Basic Blockchain: Challenge

  • How hard could it be?
slide-9
SLIDE 9

Building Basic Blockchain: Challenge

  • How hard could it be?

– Pretty hard, honestly

slide-10
SLIDE 10

Building Basic Blockchain: Challenge

  • How hard could it be?

– Pretty hard, honestly – But we’ll keep it as simple as possible

slide-11
SLIDE 11

Building Basic Blockchain: High level Components

  • Transaction
  • Block
  • Blockchain
  • Node
  • Network
slide-12
SLIDE 12

Building Basic Blockchain: High level Components

  • Transaction

– Inputs – Outputs – Coinbase

slide-13
SLIDE 13

Building Basic Blockchain: High level Components

  • Block

– Transactions

  • Merkle Root

– Proof – Parent block

slide-14
SLIDE 14

Building Basic Blockchain: High level Components

  • Blockchain

– Blocks connected by parent blocks – Block #0

  • Block #1 (Child of #0)

– Block #2 (Child of #1)

  • Block #3 (Child of #2)
  • Block #4 (Child of #3)
  • Block #5 (Child of #4)
  • Block #N (Child of #N-1)
slide-15
SLIDE 15

Building Basic Blockchain: High level Components

  • Node

– Miner – Wallet

slide-16
SLIDE 16

Building Basic Blockchain: High level Components

  • Network

– Nodes – Blocks – Protocol

slide-17
SLIDE 17

Build Basic Block Chain: Transaction Input

slide-18
SLIDE 18

Build Basic Block Chain: Transaction Output

slide-19
SLIDE 19

Build Basic Block Chain: Transaction

slide-20
SLIDE 20

Build Basic Block Chain: Special Transactions

slide-21
SLIDE 21

Building Basic Blockchain: Hashing

  • Exploring hashing with live code
slide-22
SLIDE 22

Build Basic Blockchain: Hashing

slide-23
SLIDE 23

Build Basic Blockchain: Merkle Tree

Data Blocks Hash 1

Hash 1-0 + Hash 1-1

hash( )

Hash

Hash 0-0 + Hash 0-1

hash( )

Hash 0 + Hash 1

hash( )

T

  • p Hash

Hash 0-0

hash(L1)

Hash 0-1

hash(L2)

Hash 1-0

hash(L3)

Hash 1-1

hash(L4)

L1 L2 L3 L4

slide-24
SLIDE 24

Build Basic Block Chain: Merkle Root

slide-25
SLIDE 25

Building Basic Blockchain: Block Helpers

slide-26
SLIDE 26

Building Basic Blockchain: Genesis Block

slide-27
SLIDE 27

Building Basic Blockchain: Blockchain

  • Exploring blockchain with live code
slide-28
SLIDE 28

Building Basic Blockchain: Virtual Machine

  • Transaction outputs are scripts
slide-29
SLIDE 29

Building Basic Blockchain: Virtual Machine

  • Transaction outputs are scripts
  • Breathe a sigh of relief
slide-30
SLIDE 30

Building Basic Blockchain: Virtual Machine

  • Transaction outputs are scripts
  • Breathe a sigh of relief

– We won’t be implementing all that today!

  • Listen to Merlin ramble on about it, anyway
slide-31
SLIDE 31

Breaking Basic Blockchain

  • What is controllable
  • How is a 51% attack executed?
slide-32
SLIDE 32

Breaking Production Blockchains: Smart Contracts

  • There are many attacks against smart contracts
slide-33
SLIDE 33

Breaking Production Blockchains: Smart Contracts

  • There are many attacks against smart contracts

– Underflow and Overflow are the most basic

slide-34
SLIDE 34

Breaking Production Blockchains: Smart Contracts

  • Understanding the DAO hack
slide-35
SLIDE 35

Breaking Production Blockchains: Smart Contracts

  • Understanding the DAO hack

– Recursive function calls are dangerous

slide-36
SLIDE 36

Breaking Production Blockchains: Smart Contracts

  • Understanding the DAO hack

– Recursive function calls are dangerous – Especially when you do work on either side of them

slide-37
SLIDE 37

Breaking Production Blockchains: Smart Contracts

  • Understanding the DAO hack
slide-38
SLIDE 38

Breaking Production Blockchains: Smart Contracts

  • ERC20 Short Address Attack

– Generate address with trailing zero – Send to address without trailing zero

slide-39
SLIDE 39

Protecting Production Blockchains: Nodes and Wallets

  • Private keys

– Passphrases – Cold storage

  • RTFM your configuration
  • Firewalls
  • Monitoring and Alerting
slide-40
SLIDE 40

Protecting Production Blockchains: Network

  • Economic feasibility of 51% attacks
  • Like any other software: patches
slide-41
SLIDE 41

Protecting Production Blockchains: Network

  • Economic feasibility of 51% attacks
  • Like any other software: patches

– Bitcoin DoS [patch]

  • Bitcoin Infinite Inflation?
  • Notice of Vulnerability
  • CVE-2018-17144
slide-42
SLIDE 42

Protecting Production Blockchains: Smart Contracts in Solidity

  • Avoid reentrancy issues
  • Be careful of overflows and underflows
  • Use a library

– Like SafeMath

  • Check lengths of addresss and other data
  • Use EthFiddle and test
slide-43
SLIDE 43

Protecting Production Blockchains: Smart Contracts in Solidity

  • Avoid reentrancy issues
  • Be careful of overflows and underflows
  • Use a library

– Like SafeMath

  • Check lengths of addresss and other data
  • Use EthFiddle and test

– Test

slide-44
SLIDE 44

Protecting Production Blockchains: Smart Contracts in Solidity

  • Avoid reentrancy issues
  • Be careful of overflows and underflows
  • Use a library

– Like SafeMath

  • Check lengths of addresss and other data
  • Use EthFiddle and test

– Test

  • Test!
slide-45
SLIDE 45

Questions and Contact

  • Any questions?

– If you’re still awake, that is

  • Want to talk to Merlin?

– Come check out NSL 4.0 starting late October! – Hang out on EFNet in #NSL – Hand him a drink at any conference!