Hyperledger Foundation Events, 2 Jan 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Security Vulnerabilities in Chaincode - Tobias Kaiser, ChainSecurity

Description

Chaincode must meet high standards of quality and strict security specifications. Not satisfying these requirements impairs the whole system and can prevent reaching consensus among the peers in the network. Vulnerabilities, unintended behaviors, and system failures can violate such requirements and make entire systems running on top of Hyperledger Fabric unusable.
To address this problem, we identified nine security patterns for chaincode. Moreover, we implemented an automated static analyzer to identify and pinpoint these vulnerabilities. Our analyzer is publicly available at https://chaincode.chainsecurity.com/ and is free to use for non-commercial use. It is the first static analyzer implemented specifically for chaincode programs. In this talk, we discuss the vulnerability patterns and show how the static analyzer identifies them in Hyperledger Fabric chaincode.

----
Hyperledger – Open Source Blockchain Technologies

Hyperledger is an open source community focused on developing a suite of stable frameworks, tools and libraries for enterprise-grade blockchain deployments.
It serves as a neutral home for various distributed ledger frameworks including Hyperledger Besu, Fabric, Sawtooth, Indy, as well as tools like Hyperledger Avalon, Cactus and libraries like Hyperledger Aries, Ursa. Learn more about Hyperledger projects: https://www.hyperledger.org/use

Case Studies: https://www.hyperledger.org/learn/case-studies
Training & Certification: https://www.hyperledger.org/learn/training
Tutorials: https://www.hyperledger.org/use/tutorials
Webinars: https://www.hyperledger.org/learn/webinars
Events: https://www.hyperledger.org/events
Vendor Directory: https://www.hyperledger.org/use/vendor-directory

Subscribe to the Hyperledger Newsletter: https://www.hyperledger.org/newsletter

Follow-us on Twitter @Hyperledger

Learn about Hyperledger Membership: https://www.hyperledger.org/about/join

#Hyperledger #HyperledgerGlobalForum2018 #Blockchain

A

Hello, everybody, my name is Tobias Kaiser I'm gonna, present to you chain code scanner. What is this chain code scanner? It's a static analyzer which analyzed the chain code in goal implementing goal, and it analyzed its detect certain vulnerability patterns and the pointer to the location of the code that might be exploitable or might be the reason for a buck. What is the problem? So in the etherium world? It's quite common, the people look for vulnerabilities and they try to exploit it and alone.

A

In 2017, already, 300 million dollars have been safe and out of smart contracts. While it is not so prevalent in hyper lecture fabric, maybe because it's not emphasizing tokens or digital assets in general, it is still very desirable. A smart contract or the chain code actually implements the functionality that is intended.

A

We identified nine patterns. I will describe one in more detail later on.

A

To give you a little bit of an idea. What is actually working on, so five of these patterns are responsible for preventing consensus. Four of them are more about. Unexpected execution might lead to to bug buggy code. So what to see analyze? You do actually it as the input it takes, the source code implemented in go and which is a smart contract for high polish fabric chain code. He takes this input, it analyzes it compiles it and the output is going to be a report which will say on what line of the source code.

A

It might be vulnerable.

A

So one of such vulnerability is the read after write vulnerability. So I will walk you slowly through some chain code. I hope it is I'm not too fast.

A

So if there is some problem in understanding, don't hesitate to to ask a question so I'm we have to invoke function, that is in every single chain code and it's the entry point of the of the smart contract and in our example, we have a small Bank and Bank a handle accounts, and one of such a functionality might be that they I want to add some money to a certain account.

A

So what happens in this ad account function so, first with the ket States, we will retrieve the current amount of this account from the lecture and in the next step we will add the amount and write it back to the lecture. So this is a very simple functionality which hopefully, almost every bank implements so in the invoke function.

A

What we do we first retrieve the arguments that are sent by the client by the person that invoked the whole transaction and let's say we take the first argument given with the transaction- and we assume here that everything is going violent. It is actually an integer, so I left out a lot of boilerplate code such as serialization, deserialization, I. Think it's not so relevant. So what we want to do, we want to add certain amounts that is given with the transaction to my account.

A

After this there might be some other computation and in the end we wanna add. The second argument as well so in the end is going to be two amounts being added to my account.

A

So, let's have a scenario: let's say in the beginning: I have 100 Swiss francs in my account and if the transaction there's going to be 50 and 25 Swiss francs, that are going to be added to my account, so we have three possible end States. What do you think is going to happen if we execute this chain code.

A

The second one it's either the second one or the first one. So it would be desirable to be the third one actually because yeah and yen's I would feel cheated if I don't have to 175.

A

It could also be the second one too. So in the end, what happens? The problem is that whenever, during a transaction, some some value is written to the lecture, it will not take effect until after the transaction is finished, so everybody has to wait until the peers or the ordering service reach consensus and the peers have written the transaction or the the the output sets to to the lecture actually. So that means when I want to write to the same variable during the same transaction. Then this is actually not valid and it does not happen.

A

As expected. The chain code scanner was realized. Okay, there has been a read after write to the same variable of the lecture, and it will tell me on the second to last line of the invoke function. This will not, or this will not happen as desired.

A

What happens behind the scenes? So, as I said, as the input is the source code of the chain code, the analyzer takes the source code, it compels it to SSA form, it will compute a control flow graph. It will compute variable dependency, graph, performed point analysis and Cal graph analysis and with all this and vulnerability patterns the security patterns, it will generate a report in the end.

A

So we run this static analyzer on Sheng code on github, because this is the easiest source who actually get some some source code.

A

So you can see how many vulnerabilities each we found in total, so we scanned 411 repositories. Have you had some false positives? So this is always this awful problem is not a problem, but there's always the case in static analysis. It's either under approximation or an over approximation. So to be sounds to to to make sure that we found every instance we over approximate the code and therefore we have some false positives. So, as you see so, you have some more coarse-grained where we have more false positives relatively. You also have some more finer grains.

A

In our opinion, these findings definitely say that it is important to analyze your chain code. If it's in the end of a of the development process or also during the development process, it definitely helps you track down box and prevent bugs as well and yeah. If you wanna see a live demo, you have a working version on chain codes that chain security comm there. It's also it's a first of all.

A

It's a demo and second of all, it's free for non-commercial use and it can be used for every open source project that is on a get ripples gene. So if there are any questions I'm open to discuss now, yes, please so back then, when we developed this analyzer, it was only support. Eco thought it was back in last year in November, so we have not active plans to include our languages yet, but if you see that the market will go strictly to JavaScript or to Java, then yes of course, yes, please.

A

So the kind of issues so, as I said a lot of it is so a certain a certain group is because it would lead to preventing consensus so that the peers actually diverge in state and then they accidentally want to write different states to the lecture which doesn't happen. Another source would be non-deterministic behavior because in hyper logic, fabric, one of the problems or maybe also features- is it's possible to use general purpose programming languages and not all features of the general purpose.

A

Programming language makes sense in a blockchain setting and therefore some libraries, such as simply reading the time or random number generators will not lead to a common state than in the end, also others other stuff that is inherently implemented in goals such as travel, traversal of hash maps, which is always randomized, which is always non deterministic, is always a problem, and so, in the end, it's a it's.

A

A collection of unexpected behavior of the platform itself of the framework, such as, as we saw before, read after write, the other one is problems that come from the programming language at the third. One is just not bad Pratt. Just not good practice implantation of good practice, such as ignoring potential errors, which might lead to failure of the chain code.

A

Thank you very much for you. Two attention.