Penetration Test Report (Nettitude): management report linux foundation iroha march 2018 v1

Customer Confidential Security Document
INTELLIGENT CYBER SECURITY & RISK MANAGEMENT
Penetration Test Management Report
Prepared for The Linux Foundation
Authored by Graham Shaw
12th April 2018
Version 1.0
Customer Confidential Security Document
Customer Confidential Security Document
INTELLIGENT CYBER SECURITY & RISK MANAGEMENT
Penetration Test Management Report
Nettitude provides a wealth of knowledge, expertise and
experience in regards to Data Security. We provide
comprehensive vulnerability assessment, penetration testing
and application assessment services. Our team of dedicated
security consultants deliver best in class testing capability as
well as strong remediation advice and guidance.
Customer Confidentia l Security Document 2
Customer Confidential Security Document
REPORT CONTENTS
1 Distribution List ...................................................................................................................... 4
Nettitude ................................................................................................................................... 4
The Linux Foundation ................................................................................................................ 4
Revision History ......................................................................................................................... 4
2 Executive Summary ................................................................................................................ 5
Background ............................................................................................................................... 5
High Level Assessment ............................................................................................................... 5
Nettitude were able to… ............................................................................................................. 5
Primary Security Concerns .......................................................................................................... 5
3 Risk and Analysis ................................................................................................................... 6
Risk Profile ................................................................................................................................ 6
How to understand the values below? ......................................................................................... 6
How do we calculate risk? .......................................................................................................... 6
Risk and Priority Key .................................................................................................................. 6
The Linux Foundation Risk Details .............................................................................................. 7
Overall Risk Status ..................................................................................................................... 7
4 System Analysis ..................................................................................................................... 9
5 Next Steps ............................................................................................................................10
Post Engagement Actions ..........................................................................................................10
Customer Confidential Security Document 3
Customer Confidential Security Document
1 DISTRIBUTION LIST
Nettitude
Name Title
Graham Shaw Security Consultant
Kristopher Vasilik Account Manager
The Linux Foundation
Name Title
David Huseby Security Maven, Hyperledger
Revision History
Version Issue Date Issued By Comments
0.1 4th April 2018 Graham Shaw Initial Draft
0.2 10th April 2018 Jose Lopes Quality Assurance
0.3 10th April 2018 Kristopher Vasilik Quality Assurance
1.0 12th April 2018 Graham Shaw Final
The contents of this report belong to The Linux Foundation. They have been provided by Nettitude based on the work detailed within this report and
were accurate at the time of testing. Nettitude presents no guarantee that the details in this report are a true reflection of the tested environment at
the present time.
Customer Confidential Security Document 4
Customer Confidential Security Document
2 EXECUTIVE SUMMARY
Background
The Linux Foundation engaged with Nettitude in February 2018 in order to assess the overall security
posture of their Hyperledger Iroha software product.
High Level Assessment
Based on The Linux Foundation’s risk profile, primary security concerns and the vulnerabilities
identified at the point of the engagement, Nettitude have tentatively found Iroha to:
REQUIRE IMMEDIATE ATTENTION
Nettitude were able to…
1
 Sign an object multiple times using the
Critical same keypair, in a manner that Iroha is
unable to distinguish from multiple signers.
High
2 0
Medium  Cause memory to leak in a manner that
would eventually result in denial of service.
Low
 Show how IP addresses could be made
1
permanently unusable by peers within an
Iroha network.
Primary Security Concerns
Nettitude worked with The Linux Foundation, prior to this engagement, to investigate and understand
the primary security concerns associated with the systems in scope.
These concerns are not exhaustive, but rather represent a method of helping to gauge the severity of
the overall risk presented by the systems in scope.
Concern Description Data Category Result
Access should not be allowed
unless the user has been Confidentiality
Access Control
authenticated and has Integrity
appropriate authorisation
Confidentiality
The API endpoints should not be
API Vulnerabilities Integrity
vulnerable to exploitation
Availability
Table 1 – The Linux Foundation Primary Security Concerns
Customer Confidential Security Document 5
Customer Confidential Security Document
3 RISK AND ANALYSIS
Risk Profile
Nettitude present the following high level risk profile for The Linux Foundation in order to help
contextualise the reasoning behind each findings severity and the overall system rating of ‘requires
immediate attention’. This is Nettitude’s own assessment, based on their knowledge and
understanding of The Linux Foundation, as an organisation.
How to understand the values below?
All risks should be run through your own internal risk register and methodology. The aim below is to
provide you with a benchmark and a stake in the ground. We have only had a glimpse of the data you
hold, and have based the impact on your business on industry equivalents. It’s very important that
you re-assess and understand these values according to your business and its risk appetite.
How do we calculate risk?
In brief, assets have values which if compromised will have an impact on your business (reputation,
ability to function, fines, etc). Weaknesses (or vulnerabilities) allow threats to access/disrupt these
assets. The location of the vulnerability will determine the likelihood of the weakness to be exploited.
Risk is a factor of the vulnerability, the impact and the likelihood. Threats need to be considered, but
these are outside the scope of this work (See ISO31000 for a detailed methodology).
Impact Vulnerability Likelihood RISK
Risk and Priority Key
The following key shows how the level of risk and priority will be represented within this report.
Critical
High
Medium
Low
Customer Confidential Security Document 6
Customer Confidential Security Document
The Linux Foundation Risk Details
The table below shows the values calculated for this environment.
Risk Factor Grade Reasoning
Hyperledger Iroha is intended for use in high-risk,
security-critical environments. In addition to
Impact managing valuable digital assets itself, if
compromised it could act as a gateway to other
high-value systems.
Blocks can be signed multiple times using the
same keypair, in a manner which Iroha is unable
to distinguish from multiple signers. If such blocks
can be propagated (which