tineola: taking a bite out of enterprise blockchain › def con 26 › def con 26... · tineola:...

Tineola Taking A Bite Out of Enterprise BlockchainAttacking HyperLedger Fabric

Parsia Hakimian Stark RiedeselDefcon 26 ndash Aug 11 2018

copy 2018 Synopsys Inc 2

5 Courses

Our Team

Enterprise Blockchains

A Use Case

The Target ndash HyperLedger Fabric

Tineola

copy 2018 Synopsys Inc 3

HyperLedger Fabric ndash Core Research Group

Parsia HakimianSenior Consultant

Stark RiedeselSenior Consultant

Travis BiehnEmerging Tech Lead

Koen BuyensPrincipal Consultant

copy 2018 Synopsys Inc 4

Enterprise Blockchain Terroir

Enterprise Blockchain Enthusiasts

Tech Auto amp AeroFinancial Services AccountingHealthcareLogisticsOil

Enterprise PlatformsPublic Platforms

copy 2018 Synopsys Inc 5

Platform Desires Meet Reality

PromiseImmutabilityAuditabilityTune-able TrustProgrammable

ChallengeImmutabilityMutabilityPrivacyCorrectness and SpeedExecution EnvironmentPlatform Complexity

copy 2018 Synopsys Inc 6

On The Chopping Block

Enterprise Blockchain Enthusiasts

Tech Auto amp AeroFinancial Services AccountingHealthcareLogisticsOil

Enterprise PlatformsPublic Platforms

copy 2018 Synopsys Inc 7

Build Blockchain Insurance AppOur Enterprise Application Strawman

copy 2018 Synopsys Inc 8

Build Blockchain Insurance App

copy 2018 Synopsys Inc 9

Build Blockchain Insurance App

copy 2018 Synopsys Inc 10

Meet HyperLedger FabricAn Interesting New Machine

copy 2018 Synopsys Inc 11

Chaincode Fabricsrsquo Smart Contracts

copy 2018 Synopsys Inc 12

Security Model

copy 2018 Synopsys Inc 13

HyperLedger Machine

copy 2018 Synopsys Inc 14

HyperLedger Machine ndash Proposal

copy 2018 Synopsys Inc 15

HyperLedger Machine ndash Concrete Execution

copy 2018 Synopsys Inc 16

HyperLedger Machine ndash Endorsement

copy 2018 Synopsys Inc 17

HyperLedger Machine ndash State Transition

copy 2018 Synopsys Inc 18

HyperLedger Machine ndash New Global State

copy 2018 Synopsys Inc 19

HyperLedger Machine ndash Suspect

Non BFT

Optional BFTCaching

copy 2018 Synopsys Inc 20

TineolaldquoA Tool to Interface With HyperLedger Fabricrdquo

copy 2018 Synopsys Inc 21

Appetizers

copy 2018 Synopsys Inc 22

Enumeration

copy 2018 Synopsys Inc 23

Invoking Chaincode

copy 2018 Synopsys Inc 24

Fuzzing

copy 2018 Synopsys Inc 25

Simple Injection

copy 2018 Synopsys Inc 26

Entreacutee

copy 2018 Synopsys Inc 27

Pivoting

copy 2018 Synopsys Inc 28

Direct DB Manipulation ndash Hierarchy Abuse

copy 2018 Synopsys Inc 29

Pre-Commit Side Effects Problems

copy 2018 Synopsys Inc 30

Get Your Own Taste

Follow and PR httpsgithubcomtineolatineola

Stark Riedesel StarkRiedeselsynopsyscom httpsfindtheninja

Parsia Hakimian ParsiaHakimiansynopsyscom httpsparsiyanet

Travis Biehn TravisBiehnsynopsyscom

Koen Buyens KoenBuyenssynopsyscom httpskoenbuyensorg

Thank You