Penetration Test Report (Nettitude): technical report linux foundation iroha march 2018 v1

Customer Confidential Security Document
INTELLIGENT CYBER SECURITY & RISK MANAGEMENT
Penetration Test Technical Report
Prepared for The Linux Foundation
Authored by Graham Shaw
12th April 2018
Version 1.0
Customer Confidentia l Security Document 1
Customer Confidential Security Document
INTELLIGENT CYBER SECURITY & RISK MANAGEMENT
Penetration Test Technical Report
Nettitude provides a wealth of knowledge, expertise and
experience in regards to Data Security. We provide
comprehensive vulnerability assessment, penetration testing
and application assessment services. Our team of dedicated
security consultants deliver best in class testing capability as
well as strong remediation advice and guidance.
Customer Confidentia l Security Document 2
Customer Confidential Security Document
REPORT CONTENTS
1 Distribution List ...................................................................................................................... 4
1.1 Nettitude ........................................................................................................................ 4
1.2 The Linux Foundation ..................................................................................................... 4
1.3 Revision History .............................................................................................................. 4
2 Engagement Particulars .......................................................................................................... 5
2.1 Background .................................................................................................................... 5
2.2 Rules of Engagement ...................................................................................................... 5
2.3 Scope ............................................................................................................................ 5
2.4 Testing Window Observations / Constraints ...................................................................... 5
3 Findings ................................................................................................................................ 7
3.1 Software Security Assessment ......................................................................................... 7
4 Analysis: Software Security Assessment .................................................................................. 8
4.1 Critical: Blocks can be signed more than once by the same peer........................................ 8
4.2 Medium: Transactions can be signed more than once by the same signatory .....................10
4.3 Low: IP addresses can be made permanently unusable using the add peer command ........11
4.4 Low: Potential denial of service attack due to memory leak ..............................................12
Customer Confidential Security Document 3
Customer Confidential Security Document
1 DISTRIBUTION LIST
1.1 Nettitude
Name Title
Graham Shaw Security Consultant
Kristopher Vasilik Account Manager
1.2 The Linux Foundation
Name Title
David Huseby Security Maven, Hyperledger
1.3 Revision History
Version Issue Date Issue By Comments
0.1 4th April 2018 Graham Shaw Initial Draft
0.2 10th April 2018 Jose Lopes Quality Assurance
0.3 10th April 2018 Kristopher Vasilik Quality Assurance
1.0 12th April 2018 Graham Shaw Final
The contents of this report belong to The Linux Foundation. They have been provided by Nettitude based on the work detailed within this report and
were accurate at the time of testing. Nettitude presents no guarantee that the details in this report are a true reflection of the tested environment at
the present time.
Customer Confidential Security Document 4
Customer Confidential Security Document
2 ENGAGEMENT PARTICULARS
2.1 Background
This report serves as technical documentation for the recent software security assessment performed
for The Linux Foundation by Nettitude. For a high-level assessment of the tested software, please refer
to the associated management report:
 MANAGEMENT_REPORT_Security_Assessment_The_Linux_Foundation_March_2018_v1.0.pdf
2.2 Rules of Engagement
The penetration test was performed in line with the following rules of engagement:
 Nettitude’s white box testing methodology was used.
 Social engineering was not permitted.
 The software was installed on equipment under the control of Nettitude for testing. Testing of
systems belonging to The Linux Foundation was not permitted.
 The testing and reporting was performed during the period 28 February to 29 March 2018 (5
days for penetration testing, 2.5 days for fuzzing, 6 days for code review, 3 days for reporting).
 Any results held in this report relate to the status of the ‘develop’ branch of the repository during
the period of the assessment.
2.3 Scope
Nettitude were tasked with performing a penetration test with the following scope:
Repository Description
https://github.com/hyperledger/iroha Core repository for Iroha
2.4 Testing Window Observations / Constraints
The client was offered three options for the required level of thoroughness for this assessment. The
level chosen was described as "medium assurance" representing a balance between thoroughness and
affordability. For code review this entailed:
 Identifying and excluding from consideration ancillary files such as test harnesses and mock
implementations.
 Enumerating the endpoints which comprise the outward-facing boundary of the attack surface.
 Mapping these endpoints to the functions which implement them.
 Tracing the flow of untrusted data through these functions, and (to the extent time permitted)
through other functions directly or indirectly invoked by them.
Customer Confidential Security Document 5
Customer Confidential Security Document
(This does not mean that the review was limited to code that was closely associated with the endpoint
handlers. The criterion was the extent to which they process untrusted data, regardless of how deep
within the system they were located.)
In addition to the above, semi-automatic scanning of the whole codebase (excluding ancillary files) was
performed to look for security issues capable of being found in this way. Examples include injection into
format strings and random number generation.
Fuzzing was scoped for the REST API which Iroha had at the time. It was discovered early into the
assessment that this had been replaced with a gRPC API which is significantly more difficult to test
(mainly due to lack of off-the-shelf tooling). For this reason, and due to other delays in the early stages
(see below), Nettitude was unable to make more than a token attempt at fuzzing.
Code review was the most productive assessment method applied, resulting in the discovery of what
appears to be a subtle but very serious vulnerability which could not plausibly have been found either
by fuzzing or by penetration testing. Nevertheless, productivity would have been improved greatly if
more detailed and more accurate documentation had been provided, both within the source code and
at an architectural level.
A significant amount of time was lost due to unclear or outdated instructions, including in particular
obsolete documentation and code published in what ought to be authoritative locations (including the
main Iroha repository itself).
Customer Confidential Security Document 6
Customer Confidential Security Document
3 FINDINGS
3.1 Software Security Assessment
Description Severity Ease of Exploitation Recommendation Reference
Blocks can be signed more than once by the same Store signatures in map
Critical Moderate 4.1
peer not set
Transactions can be signed more than once by the Store signatures in map
Medium Moderate 4.2
same signatory not set
IP addresses can be made permanently unusable Provide method for IP
Low Complex 4.3
using the add peer command addresses to be reused
Potential denial of service attack due to memory
Low Trivial Use a shared_ptr 4.4
leak
Customer Confidentia l Security Document 7
Customer Confidential Se