Penetration Test Report (TrailOfBits): LedgerFilecoin

Ledger Filecoin App
Security Assessment
July 24, 2020
Prepared For:
Jonathan Victor | P​ rotocol Labs
jonathan@protocol.ai
Juan Leni | ​Zondax GmbH
juan.leni@zondax.ch
Jon Schwartz | ​Open Work Labs
jonathan@openworklabs.com
Prepared By:
Brad Larsen | ​Trail of Bits
brad.larsen@trailofbits.com
Evan Sultanik | ​Trail of Bits
evan.sultanik@trailofbits.com
Executive Summary
Project Dashboard
Engagement Goals
Coverage
Recommendations Summary
Short Term
Long Term
Findings Summary
1. Undefined behavior in b​ ase32 codec
​
2. Missing data validation in f​ ormatProtocol()
3. A malicious transaction can cause a read overrun
4. Possible supply-chain attack in Docker images used for testing
5. Multiple uses of undefined behavior in ​tinycbor
A. Vulnerability Classifications
B. Code Quality Recommendations
C. Fuzz Testing
D. Compiling the Code with Clang 10
© 2020 Trail of Bits Protocol Labs Ledger Filecoin App Assessment | 1
Executive Summary
From July 13 through July 24, 2020, Protocol Labs engaged Trail of Bits to review the
security of the Ledger Filecoin app. Trail of Bits conducted this assessment over the course
of two person-weeks with two engineers working from ​commit hash 3​ 28fb293 from the
​
Zondax/ledger-filecoin repository.
​
In the first week, we familiarized ourselves with the codebase, compiled all tests to run
both natively and in the Ledger emulator, and compiled the code with address and
undefined behavior instrumentation for fuzz testing (see ​Appendix D​). In week two, we
performed manual review and triaged the dynamic analysis findings.
Five issues were found, ranging from informational to low severity, with one finding of
undetermined severity. The low-severity issues were related to data validation and
undefined behavior resulting from a maliciously crafted transaction; at worst, they could
theoretically cause the device to crash. We were unable to find any attack vectors in this
engagement that would allow an attacker to compromise secrets or sign arbitrary
transactions. The undetermined-severity finding is related to apparent latent bugs in a
third-party library that was not written by the Ledger Filecoin team but is used by the app.
The code is written with clear forethought about the hardware limitations of the Ledger
device, and employs many security best practices such as read-only memory and stack
canaries. However, a​ ll​ Ledger app development is made precarious by t​ he device’s inherent
hardware constraints:​
● Severe memory restrictions.
● Stack depth limitations.
● Sensitivity to integer over- and underflow.
● Data truncation on the small screen.
● Etc.
We suggest that the Filecoin app integrate fuzz testing into its development lifecycle,
simplify its dependency management, and further vet all third-party libraries employed in
production. Other issues that do not have direct security implications are included in
Appendix B.​
© 2020 Trail of Bits Protocol Labs Ledger Filecoin App Assessment | 2
Project Dashboard
Application Summary
Name Ledger Filecoin app
Version commit hash ​328fb293
Type C and C++
Platforms Ledger Nano S and X
Engagement Summary
Dates July 13–July 24, 2020
Method Whitebox
Consultants Engaged 2
Level of Effort 2 person-weeks
Vulnerability Summary
Total High-Severity Issues 0
Total Medium-Severity Issues 0
Total Low-Severity Issues 3 ◼◼◼
Total Informational-Severity Issues 1 ◼
Total Undetermined-Severity Issues 1 ◼
Total 5
Category Breakdown
Configuration 1 ◼
Data Validation 2 ◼◼
Undefined Behavior 2 ◼◼
Total 5
© 2020 Trail of Bits Protocol Labs Ledger Filecoin App Assessment | 3
Engagement Goals
The engagement was scoped to provide a security assessment of the Filecoin app for
Ledger devices. The web wallet and signing libraries were out of scope and will be assessed
in a subsequent engagement.
Specifically, we sought to answer the following questions:
● Is it possible to retrieve a private key from a device?
● Could a maliciously crafted transaction appear as a legitimate one on the device,
tricking the user into signing it?
● Are the hardware constraints of the devices properly mitigated? Is there potential
for stack or memory exhaustion?
● Are there latent logical errors in the application?
● Does any of the code exhibit undefined behavior?
Coverage
Fuzz-tested the codebase. ​We wrote fuzzers using ​libFuzzer for six different APIs that
​
are involved with processing user-controllable data. See ​Appendix C.​
Tested for memory errors w​ ith​ ​a combination of the LLVM Address Sanitizer (ASan) and
manual analysis.
Tested for undefined behavior w​ ith​ ​a combination of the LLVM Undefined Behavior
Sanitizer (UBSan) and manual analysis.
UI state machine correctness. ​Manual review.
Cryptographic correctness. ​Manually checked for common cryptographic errors and
patterns.
© 2020 Trail of Bits Protocol Labs Ledger Filecoin App Assessment | 4
Recommendations Summary
This section aggregates all the recommendations made during the engagement. Short-term
recommendations address the immediate causes of issues. Long-term recommendations
pertain to the development process and long-term design goals.
Note: Some of these recommendations have already been implemented between the initial
delivery of this report and its final publication, but we have retained all of the original
recommendations in this section and listed specific remediations in the individual finding
summaries below.
Short Term
☐ Validate inputs to the ​base32 functions t​ o ensure undefined behavior cannot occur.
​
☐ Add a check to ​formatProtocol before calling d​ ecompressLEB128 to ensure the input
​ ​
buffer is large enough.​ This will require a single conditional, and will cohere with the
existing data validation patterns of the surrounding code. It will improve defense in depth,
and prevent this from becoming a real issue when future code changes are made.
☐ Fix the data validation issue that can cause a read overrun in ​base32 encoding. ​This
​
may simply require an additional check after the call to ​base32_encode to see if the output
​
buffer's full length was used.
☐ Document the testing Docker container. ​For the two images used to build, add an
overview and metadata on Docker Hub describing what the images do and where they
come from. Describe in the project's README how the Docker image could be built from
scratch or swapped out. Either employ Docker’s “content trust” digital signatures in the
container or pin against a hash of the expected container.
☐ On a regular basis: 1. Run your test suites with Address Sanitizer and Undefined
Behavior Sanitizers enabled, and 2. Run the fuzz testing targets we added during this
assessment.​ Seek clarification on these issues from the TinyCBOR developers, potentially
by opening GitHub issues on their project.
© 2020 Trail of Bits Protocol Labs Ledger Filecoin App Assessment | 5
Long Term
☐ Improve unit test coverage. T​ est the behavior of the ​base32 functions and consider
​
switching to a different b​ ase32 implementation.
​
☐ Regularly test the codebase and perform fuzz testing with Address Sanitizer. ​This
will detect many issues that would not otherwise be found through traditional unit testing.
Run fuzz testing routinely against APIs that deal with user-controllable data.
☐ Prefer safer alternatives to C-string functions, e.g., ​strnlen instead of ​strlen. This
​ ​
is particularly important when dealing with user-controllable binary data, such as Filecoin
transaction data.
☐​ ​Use automated builds to produce the images pushed to Docker Hub through
Docker's own mechanism or through ​GitHub Actions.​ ​Ensure that it is possible to
perform a build of the Ledger Filecoin app without network access and build the images
from scratch.
☐​ ​Consider a focused security assessment and/or security hardening engagement
for the ​tinycbor dependency. T​ here appear to be latent issues in the codebase that could
​
become problematic in the future.
© 2020 Trail of Bits Protocol Labs Ledger Filecoin App Assessm