Penetration Test Report (TrailOfBits): ETH2DepositCLI

ETH2 Deposit CLI
Security Assessment
September 4 , 2 020
Prepared For:
Carl Beekhuizen | Ethereum Foundation
carl.beekhuizen@ethereum.org
Hsiao-Wei Wang | Ethereum Foundation
hww@ethereum.org
Prepared By:
Gustavo Grieco | T rail of Bits
gustavo.grieco@trailofbits.com
Natalie Chin | T rail of Bits
natalie.chin@trailofbits.com
Michael Colburn | T rail of Bits
michael.colburn@trailofbits.com
Jim Miller | Trail of Bits
james.miller@trailofbits.com
Executive Summary
Project Dashboard
Code Maturity Evaluation
Engagement Goals
Coverage
Recommendations Summary
Short term
Long term
Findings Summary
1. Generated mnemonic could be leaked
2. Deposit stores a world-readable file with sensitive information
3. Deposit does not provide entropy validation on passwords
4. Saving large J SON integers could result in interoperability issues
5. Use of a ssert will be removed when the bytecode is optimized
6. Passwords are accessible via shell history
7. PyInstaller binaries should be distributed with signatures
8. Certain encodings can make passwords impossible to input
9. Naming of the resulting J SON files can be misleading
10. Python Crypto wrappings allow unsafe parameters
A. Vulnerability Classifications
B. Code Maturity Classifications
C. Code Quality Recommendations
Specification
Deposit
© 2020 Trail of Bits Deposit CLI Assessment | 1
Executive Summary
From August 24 through September 4, 2020, Ethereum Foundation engaged Trail of Bits to
review the security of the ETH2 deposit tool. Trail of Bits conducted this assessment over
the course of four person-weeks with three engineers working from commit e c608ab from
the e thereum/eth2.0-deposit-cli repository.
Week one: W e gained an understanding of the codebase, reviewed the code against the
most common Python-related flaws, and looked at how the code performs key generation
according to EIPs 2333, 2334, and 2335.
Final week: A s we concluded our manual review, we focused on the correct use of
cryptographic primitives and verification of best practices for compiling and releasing the
deposit binary.
Our review resulted in 10 findings ranging from high to informational severity.
Of interest are some issues related to handling sensitive information, which may result in
the loss of funds: They allow leakage of mnemonic phrases (T OB-EF-DEP-001) , passwords
(T OB-EF-DEP-006) , and encrypted keys (T OB-EF-DEP-002) . Additionally, two high-severity
issues are related to the compilation (T OB-EF-DEP-005) and distribution (T OB-EF-DEP-001)
of the deposit tool. Finally, we make several code quality recommendations in A ppendix C.
Overall, the code follows a high-quality software development standard and best practices.
It has suitable architecture and is properly documented. The interactions between
components are well-defined. The functions are small, with a clear purpose.
We recommend addressing the findings presented and making sure that security best
practices are followed during the binary releases, using signatures that can be
independently verified by the final users.
© 2020 Trail of Bits Deposit CLI Assessment | 2
Project Dashboard
Application Summary
Name Deposit CLI
Version eth2.0-deposit-cli commit: e c608ab
Type Python
Platforms Linux, macOS, Windows
Engagement Summary
Dates August 24–September 4, 2020
Method Whitebox
Consultants Engaged 2
Level of Effort 4 person-weeks
Vulnerability Summary
◼◼
Total High-Severity Issues 2
◼◼
Total Medium-Severity Issues 2
◼◼◼◼◼
Total Low-Severity Issues 5
◼
Total Informational-Severity Issues 1
Total 10
Category Breakdown
◼◼
Access Controls 2
◼
Cryptography 1
◼◼
Data Exposure 2
◼◼◼◼
Data Validation 4
◼
Undefined Behavior 1
Total 10
© 2020 Trail of Bits Deposit CLI Assessment | 3
Code Maturity Evaluation
In the table below, we review the maturity of the codebase and the likelihood of future
issues. In each area of control, we rate the maturity from strong to weak, or missing, and
give a brief explanation of our reasoning.
Category Name Description
Function Strong. Functions and classes were organized and scoped
Composition appropriately.
Data Validation Moderate. Although some data validation is performed, there are
no checks for usage of weak passwords (T OB-EF-DEP-003) .
Additionally, we found instances in which the tool can crash,
especially related to unexpected encoding of passwords
(T OB-EF-DEP-008) .
Cryptography Strong. T he use of cryptographic primitives is correct and follows
security best practices.
Key Management Moderate. We report a few concerns about passwords and
accessing the secret keys protected by them (T OB-EF-DEP-002,
TOB-EF-DEP-003, T OP-EF-DEP-006) . Otherwise, we found no issues
related to key generation.
Specification Strong. Several EIPs describing the functionality of the tool were
available. The codebase included a fair amount of comments
explaining the purpose of each function.
Testing & Moderate. While the tests already integrated a number of static
Verification tools such as linters, the use of b andit revealed one high-severity
issue (T OB-EF-DEP-005) .
© 2020 Trail of Bits Deposit CLI Assessment | 4
Engagement Goals
The engagement was scoped to provide a security assessment of the ETH2 deposit tool.
Specifically, we sought to answer the following questions:
● Does the deposit tool comply with the E IP 2333, E IP 2334, E IP 2335, and B IP39
standards?
● Can the private keys or password be leaked?
● Can the private keys be generated incorrectly?
● Can the mnemonic phrase be generated incorrectly?
● Can the J SON files be generated incorrectly?
● Are the cryptographic primitives used safely and correctly?
● Are any of the cryptographic primitives vulnerable to known cryptographic attacks?
● Does the tool install properly and behave identically across different operating
systems?
Coverage
ETH2 deposit tool: T he ETH2 deposit tool is used to generate and encrypt private keys for
the validators. Trail of Bits reviewed deposit tool source code using manual review and
static analysis tools. We focused our efforts on password handling, key generation, and
storage. We looked for leaks of private information and insecure usage of cryptographic
primitives. We also reviewed how the E IP 2333, E IP 2334, and E IP 2335 are implemented
in the tool to make sure they follow all the specifications.
Binary compilation and distribution: The ETH2 deposit tool is compiled using PyInstaller
and released in GitHub. We reviewed how the deposit tool is compiled and released to
make sure it follows security best practices.
© 2020 Trail of Bits Deposit CLI Assessment | 5
Recommendations Summary
This section aggregates all the recommendations made during the engagement. Short-term
recommendations address the immediate causes of issues. Long-term recommendations
pertain to the development process and long-term design goals.
Short term
 Properly clear the terminal buffer after the tool is no longer used. This will minimize
the risk of users exposing sensitive information onscreen. The proper fix depends on the
operating system and should be implemented carefully. In addition, either clear the
clipboard after the tool has finished or block the user from copying the data altogether.
TOB-EF-DEP-001
 Minimize the permissions when saving sensitive files. T his will mitigate the risk in
case an attacker accesses the system used for key generation. T OB-EF-DEP-002
 Add a validation check on passwords to ensure minimum length. T his will mitigate
the risk of an attacker brute-forcing the encrypted keys. T OB-EF-DEP-003
 Use strings instead of J SON numeric values to implement the amount field. This will
prevent any ambiguity when parsing the numeric fields of the deposit J SON files.
TOB-EF-DEP-004
 Replace the use of assertion for proper input validation and do not include
assertions with side effects. T his will enable the tool to run correctly even if the bytecode
is optimized. T OB-EF-DEP-005
 Do not allow users to use the command line argument to specify passwords. T his