Breaking and Fixing Gridcoin
Total Page:16
File Type:pdf, Size:1020Kb
Breaking and Fixing Gridcoin Martin Grothe, Tobias Niemann, Juraj Somorovsky, Jörg Schwenk Horst Görtz Institute for IT Security, Ruhr University Bochum {firstname.lastname}@rub.de Abstract cryptocurrencies, so called altcoins. These altcoins at- Bitcoin has been hailed as a new payment mechanism, tempt to establish new user communities by advertising and is currently accepted by millions of users. One of different technology improvements or tweaks. Nowa- the major drawbacks of Bitcoin is the resource intensive days, about 700 Bitcoin based cryptocurrencies exist [4]. Proof-of-Work computation. Proof-of-Work is used to establish the blockchain, but this proof of work does not Wasteful computation. One of the main drawbacks of bring any benefits and arguably is a waste of energy. To Bitcoin (and other Bitcoin based cryptocurrencies) is the use these available resources in a more meaningful way, resource expensive Proof-of-Work computation. Proof- several alternative cryptocurrencies have been presented. of-Work is used to establish the blockchain, which con- One of them is Gridcoin, which rewards the users for tains blocks with Bitcoin transactions. In order to con- solving BOINC problems. Gridcoin currently possesses struct a new valid block, the so called miners collect Bit- a market capitalization of $ 23,423,115. coin transactions. They attempt to hash data from the In our work we conducted the first security analysis of previous block together the transactions and some ran- Gridcoin. We identified two critical security issues. The domness so that the resulting SHA-256 value lies below first issue allows an attacker to reveal all email addresses a specific boundary (i.e., the hash value starts with a spe- of the registered Gridcoin users. Even worse, the second cific number of zeros). The search for a valid block re- issue gives an attacker the ability to steal the work per- sults in many SHA-256 computations and thus requires a formed by a BOINC user, and thus effectively steal his huge amount of energy. High rewards for the block com- Gridcoins. These attacks have severe consequences and putations, however, motivate many users to participate in completely break the Gridcoin cryptocurrency. the mining process. Increasing the overall security on the We practically evaluated and confirmed both attacks, one hand, on the other a study from 2014 suggests that and responsibly disclosed them to the Gridcoin maintain- Bitcoin’s total electrical footprint is comparable with the ers. We developed backwards compatible design changes Irish national electrical energy consumption [19]. for the Gridcoin system, in order to protect users’ trust into this promising approach. Cryptocurrencies with meaningful computations. The energy spent for Bitcoin mining is arguably waste- Keywords: Gridcoin, Attack, BOINC, Proof-of- ful since it results in meaningless hash computations. Stake, Meaningful Cryptocurrency This fact has motivated many developers to establish new altcoins. Primecoin introduces a new Proof-of-Work 1 Introduction scheme based on computation of prime number chains – Cunningham chains [1]. Filecoin and Permacoin in- Since the launch of Bitcoin in 2009 [18, 10], the new troduce a concept based on proof-of-retrievability [5, 6], peer-to-peer electronic cash system grew to be one of which rewards users for providing data storage. This way the few widely accepted payment methods in both online it is possible to create a distributed file storage systems. and retail shopping. The release of the official Bitcoin Wustrow and VanderSloot showed that it is possible to Core client, developed by the Bitcoin inventor Satoshi create a cryptocurrency based on a malicious Proof-of- Nakamoto as open source software, allowed users to fork Work [31]. Their DDoSCoin concept rewards miners for the project and apply their own design changes. Hence contributing to a distributed Denial-of-Service (DoS) at- we could observe emergence of many new Bitcoin based tack. Nevertheless, these altcoins only attempt to solve specific problems and their concepts are not applicable Responsible disclosure. We responsibly disclosed our in general. security findings to the Gridcoin maintainers on the 16th of September 2016 together with our proposed coun- termeasures. They responded to us that they are going Gridcoin. Gridcoin is an altcoin, which is in active de- to fix the vulnerabilities. Unfortunately, our proposals velopment since 2013. It claims to provide a high sus- were not implemented correctly and further security is- tainability, as it has very low energy requirements in sues were introduced with the new releases of Gridcoin. comparison to Bitcoin. It rewards users for contribut- We contacted the maintainers again in order to help them ing computation power to scientific projects, published fix the issues, but they did not respond to our following on the BOINC project platform. Although Gridcoin is contact attempts. Thus, the current mandatory release not as widespread as Bitcoin, its draft is very appeal- 3.5.9.6 still contains several security vulnerabilities.1 ing as it attempts to eliminate Bitcoin’s core problems. It possesses a market capitalization of $ 23,423,115 [3] (11th of May 2017) and its users contributed approxi- 2 BOINC mately 5% of the total scientific BOINC work done be- fore October, 2016 [2]. This motivates for the analysis of this relatively new cryptocurrency. To solve general scientific meaningful problems, Grid- coin draws on the well known Berkeley Open Infras- tructure for Network Computing (BOINC). It is a soft- Security analysis of Gridcoin. In this paper we ana- ware platform for volunteer computing, initially released lyze the security of Gridcoin. We first give an overview in 2002 and developed by the University of California, of the Gridcoin core security functionalities and its con- Berkeley. It is an open source software licensed under nection to the BOINC network. In particular, Gridcoin the GNU Lesser General Public License. The platform uses the BOINC statistics servers to reward BOINC users enables professionals in need for computation power to for their computational contributions to solving mean- distribute their tasks to volunteers. Nowadays it is widely ingful problems. The first general issue arises when con- used by researchers with limited resources to solve sci- sidering the trust into the statistics server. If the attacker entific problems, for example, healing cancer, investi- is able to take control over this server, he is able to cre- gate global warming, finding extraterrestrial intelligence ate an arbitrary number of Gridcoins. However, it is not in radio signals and finding larger prime numbers. necessary to have such a powerful attacker with server When launching a BOINC project, its maintainer is administration rights to execute practical attacks on Grid- required to setup his own BOINC server. Project vol- coin. In this paper we demonstrate a critical vulnerability unteers may then create accounts (by submitting a user- in Gridcoin, which puts the currencies market capitaliza- name, a password and an email address) and work on tion at risk. Our attacker is able to steal Gridcoins from specific project tasks, called workunits. The volunteers legitimate Gridcoin users. We provide a proof of concept can process the project tasks and transfer their solutions exploit implementation, which makes it possible to gen- with a BOINC client. The BOINC client is controlled erate illegitimate Gridcoins. Our findings break the alt- via its RPC interface using either the GUI boincmgr or coin Gridcoin in the state of version 3.5.8.6 and thereby the CLI boinccmd. The client offers a broad variety of affect all Gridcoin users and exchanges. options to limit the shared resources, such as by timer or processing unit workload, and thereby gives the volun- teer a lot of control and the ability to run it seamlessly Contributions. This work makes the following contri- in the background. The BOINC project server usually butions: deploys executables for Windows, Mac OS X, Linux or • We give the first in depth description of the Gridcoin Android systems on x86, x86_64 or ARMv7. To mea- architecture and functionality. sure how much work a machine has done BOINC imple- • We analyze the security of Gridcoin and discuss the ments a computation credit system. This system enables trust issues of this cryptocurrency. user competition and team establishment. The statistics • We present two feasible attacks on Gridcoin. First, are retrievable from the BOINC project servers as XML our attacker can affect Gridcoin privacy and extract data. To streamline the process, BOINC Credit statis- all email addresses of registered users. Second, tics websites like boincstats.com2 gather statistics from our attacker can even steal computation power per- all BOINC project servers and process them for display formed by Gridcoin users, and thus steal their Grid- in HTML markup, including graphs and rankings [27]. coins. • We developed backwards compatible design 1For more details see: http://gridcoin-attacks.org changes against the presented attacks. 2http://boincstats.com/ 2.1 BOINC Architecture of CPU time on a reference machine with 1,000 mega floating point operation per seconds [21]. The served BOINC uses a client server architecture to achieve its statistic files contain the two credit measuring values To- rich feature set. The server component handles the client tal Credit and Recent Average Credit for each participant, requests for workunits and the problem solutions up- host and team. loaded by the clients. The solutions are validated and assimilated by the server component. All workunits are Total Credit: The value Total Credit is the total number created by the server component and each workunit rep- of Cobblestones generated [21]. resents a chunk of a scientific problem which is encapsu- lated in an application. This application consists of one Recent Average Credit (RAC): RAC is defined as the or multiple in-/output files, containing binary or ASCII average number of Cobblestones per day generated encoded parameters.