BITCOIN TRANSACTION MALLEABILITY THEORY IN PRACTICE

Transcription

1 BITCOIN TRANSACTION MALLEABILITY THEORY IN PRACTICE Daniel Chechik Security Researcher Ben Hayak Security Researcher

2 What is Bitcoin Agenda Bitcoin Transac:ons Transac:on Malleability Vulnerability What Happened in MT.Gox Live Demo

3 WHAT IS BITCOIN?

4

5 Currently ~ $600

6

7

8

9 What is Bitcoin? Bitcoin is a payment system introduced as open- source sohware in 2009 by a developer known as Satoshi Nakamoto P2P network Trust is a result of data transparency Decentraliza:on No ins:tu:on is controlling your money/ coins. Anonymous Virtual currency.

10 What is a Block? Container of Transac:ons Chained to all other valid blocks and shared among all peers

11 The network data history Block Chain PreviousBlockHash Block Transac:ons Block Transac:ons Block Transac:ons PreviousBlockHash PreviousBlockHash

12 What is a Block? Bitcoin Blocks structure Field DescripJon Size Magic No Value Always 0xD9B4BEF9 4 bytes Blocksize Number of bytes following up to end of block 4 bytes Blockheader Consists of 6 items 80bytes Transac:on counter Posi:ve integer VI = VarInt 1-9 bytes Transac:ons The (non empty) list of <Transac:on counter>- many transac:ons transac:ons

13 What is a Block? Bitcoin Blocks structure Field DescripJon Size Magic No Value Always 0xD9B4BEF9 4 bytes Blocksize Number of bytes following up to end of block 4 bytes Blockheader Consists of 6 items 80bytes Transac:on counter Posi:ve integer VI = VarInt 1-9 bytes Transac:ons The (non empty) list of <Transac:on counter>- many transac:ons transac:ons

14 What is a Block? Bitcoin Blocks structure Field DescripJon Size Magic No Value Always 0xD9B4BEF9 4 bytes Blocksize Number of bytes following up to end of block 4 bytes Blockheader Consists of 6 items 80bytes Transac:on counter Posi:ve integer VI = VarInt 1-9 bytes Transac:ons The (non empty) list of <Transac:on counter>- many transac:ons transac:ons

15 Block Header Structure Field Purpose Updated when... Size (Bytes) Version Block version number You upgrade the sohware and it specifies a new version 4 hashprevblock 256- bit hash of the previous A new block comes in 32 hashmerkleroot Time 256- bit hash based on all of the transac:ons in the block Current :mestamp as seconds since T00:00 UTC A transac:on is accepted 32 Every few seconds 4 Bits Current target in compact format The difficulty is adjusted Nonce 32- bit number (starts at 0) A hash is tried increments) 4 4

16 What Is Mining?

17 What is Mining? Collect all Pending Transac:ons to memory Build a theore:c Block with the transac:ons Tx Tx Tx Memory Use compu:ng power to Solve your Blockhash Broadcast the block to the network Block Network

18 LET S SIMULATE MINING RIGHT NOW!

19 0x02000

20 AddiJonal Mining Goals Keep a steady network Record all coin data

21 What is Bitcoin - Summary Block container of transac:ons Block chain - record of all coin data from the beginning Block Solving a process used to keep the network steady and to generate blocks.

22 TRANSACTIONS

23 TransacJons 100 BTC Alice à Bob Broadcasted to network Confirmed (Block Solved) Collected by miners

24 TransacJons 100 MYC Alice à Bob Bob s Wallet

25 TransacJons 100 MYC Alice à Bob Broadcasted to network

26 TransacJons 100 MYC Alice à Bob Broadcasted to network Collected by miners

27 TransacJons 100 MYC Alice à Bob Broadcasted to network Confirmed (Block Solved) Collected by miners

28 TransacJons Jeff to Daniel Daniel to Ben

29 TransacJons Transac:ons are built from two main components Inputs Source of coins (Ref to Txout in block chain) Outputs Redeemer s Bitcoin address Amount

30 TransacJons Prove you have the coins (by including a reference) Include a Public Key of the recipient Sign the transac:on

31 TRANSACTION MALLEABILITY

32 P2P Lo[ery MessageID (sha256) Length From: Lo$ery Prize: You won a Car! Length To: Ben

33 P2P Lo[ery MessageID (sha256) Length From: Lo$ery Prize: You won a Car! Vaca:on Length To: Ben

34 P2P Lo[ery MessageID (sha256) Length From: Lo$ery Prize: You won a Car! Length To: Ben Signature (DER)

35 Standard TransacJon TxId (sha256*2) Length (1 Byte) ScriptSig Source of coins sender Amount Length ScriptPubkey

36 PushData Opcode TxId (sha256*2) PUSHDATA2 Length (2Bytes) ScriptSig Amount Length ScriptPubkey

37 Standard TransacJon TxId (sha256*2) 0x32 ScriptSig 40BTC 0x19 ScriptPubkey

38 Mutated TransacJon TxId (sha256*2) 0x4D 0x32 0x32 0x00 PUSHDATA2 ScriptSig 40BTC 0x19 ScriptPubkey 0x32 == 0x0032

39 Standard Vs Mutated TxId (sha256*2) TxId (sha256*2) Length (1 Byte) PUSHDATA2 Length 0x00 ScriptSig ScriptSig Amount Length Amount Length ScriptPubkey ScriptPubkey TxId = c6cfe6e4f129a34671d10c1bbe158eff05197d e331951b0ec2637c194e Mutated TxId = dc34efd49ed738bf4500db cb e9e185b78292bbc89

40 TransacJon Malleability Two different transac:ons Same amount of coins Same des:na:on and source Mutated wins and gets in a Block RACE!

41 Rejected TransacJons Invalid transac:on data Already spent out- point Iden:cal transac:ons Invalid signature

42 WHAT HAPPENED IN MT.GOX?

43 MT.Gox Announcement

44 30BTC - > A[acker s Wallet P2P Bitcoin Mt.Gox B A$acker s Wallet A$acker

45 30BTC - > A[acker s Wallet B P2P Bitcoin 0x30 ScriptSig Mt.Gox B BTC 0x19 ScriptPubkey A$acker s Wallet A$acker

46 30BTC - > A[acker s Wallet P2P Bitcoin Mt.Gox B A$acker s Wallet B x30 ScriptSig 30BTC 0x19 ScriptPubkey A$acker

47 30BTC - > A[acker s Wallet P2P Bitcoin Mt.Gox B A$acker s Wallet B C3a8.03f8 0x30 Mutated ScriptSig TransacJon 30BTC 0x19 Valid Signature ScriptPubkey A$acker

48 Mt.Gox 30BTC - > A[acker s Wallet B P2P Bitcoin 0x30 C3a8.03f8 Mutated TransacJon Valid Signature A$acker s Wallet A$acker

49 30BTC - > A[acker s Wallet P2P Bitcoin 30BTC - > A[acker s Wallet Mt.Gox B C3a8.03f8 A$acker s Wallet W A$acker

50 Unconfirmed Tx 30BTC - > A[acker s Wallet B P2P Bitcoin 0x30 ScriptSig 30BTC - > A[acker s Wallet Mt.Gox B BTC 0x19 ScriptPubkey C3a8.03f8 A$acker s Wallet W A$acker

51 30BTC - > A[acker s Wallet P2P Bitcoin 30BTC - > A[acker s Wallet Mt.Gox B Unconfirmed C3a8.03f8 A$acker s Wallet W Transac:on (B ) Failed?!? A$acker

52 30BTC - > A[acker s Wallet P2P Bitcoin 30BTC - > A[acker s Wallet Mt.Gox B Unconfirmed C3a8.03f8 A$acker s Wallet W Transac:on (B ) Failed?!? Generate Another TransacJon! A$acker

53 30BTC - > A[acker s Wallet P2P Bitcoin 30BTC - > A[acker s Wallet Mt.Gox B Unconfirmed C3a8.03f8 A$acker s Wallet W Transac:on (B ) Failed?!? Generate Another TransacJon! A$acker

54 30BTC - > A[acker s Wallet P2P Bitcoin 30BTC - > A[acker s Wallet Mt.Gox B Unconfirmed C3a8.03f8 A$acker s Wallet W Transac:on (B ) Failed?!? Generate Another TransacJon! A$acker

55 DEMO

56 MALLEABILITY FIX

57 TransacJon Malleability Fix

58 TransacJon Malleability Fix

59 Thank You! Daniel Chechik Ben Hayak - Ben.hayak@gmail.com BTC: 12qPtFhw9UPL8HvfSsSjvqxeFXp4hRiWym

60 References Github - h$ps://github.com/sipa/bitcoin/commit/87fe71e1fc810ee120a10063fdd26c d54 Spiderlabs h$p:// Bitcoin official document - h$ps://bitcoin.org/bitcoin.pdf Bitcoin Wiki - h$ps://en.bitcoin.it/wiki Bitcoin Transac:on Malleability Wiki - h$ps://en.bitcoin.it/wiki/transac:on_malleability Ken Shirriff - h$p:// transac:on- malleability.html