Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola:...

32
Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian, Stark Riedesel Defcon 26 Aug 11, 2018

Transcript of Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola:...

Page 1: Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian,

Tineola Taking A Bite Out of Enterprise BlockchainAttacking HyperLedger Fabric

Parsia Hakimian Stark RiedeselDefcon 26 ndash Aug 11 2018

copy 2018 Synopsys Inc 2

5 Courses

Our Team

Enterprise Blockchains

A Use Case

The Target ndash HyperLedger Fabric

Tineola

copy 2018 Synopsys Inc 3

HyperLedger Fabric ndash Core Research Group

Parsia HakimianSenior Consultant

Stark RiedeselSenior Consultant

Travis BiehnEmerging Tech Lead

Koen BuyensPrincipal Consultant

copy 2018 Synopsys Inc 4

Enterprise Blockchain Terroir

Enterprise Blockchain Enthusiasts

Tech Auto amp AeroFinancial Services AccountingHealthcareLogisticsOil

Enterprise PlatformsPublic Platforms

copy 2018 Synopsys Inc 5

Platform Desires Meet Reality

PromiseImmutabilityAuditabilityTune-able TrustProgrammable

ChallengeImmutabilityMutabilityPrivacyCorrectness and SpeedExecution EnvironmentPlatform Complexity

copy 2018 Synopsys Inc 6

On The Chopping Block

Enterprise Blockchain Enthusiasts

Tech Auto amp AeroFinancial Services AccountingHealthcareLogisticsOil

Enterprise PlatformsPublic Platforms

copy 2018 Synopsys Inc 7

Build Blockchain Insurance AppOur Enterprise Application Strawman

copy 2018 Synopsys Inc 8

Build Blockchain Insurance App

copy 2018 Synopsys Inc 9

Build Blockchain Insurance App

copy 2018 Synopsys Inc 10

Meet HyperLedger FabricAn Interesting New Machine

copy 2018 Synopsys Inc 11

Chaincode Fabricsrsquo Smart Contracts

copy 2018 Synopsys Inc 12

Security Model

copy 2018 Synopsys Inc 13

HyperLedger Machine

copy 2018 Synopsys Inc 14

HyperLedger Machine ndash Proposal

copy 2018 Synopsys Inc 15

HyperLedger Machine ndash Concrete Execution

copy 2018 Synopsys Inc 16

HyperLedger Machine ndash Endorsement

copy 2018 Synopsys Inc 17

HyperLedger Machine ndash State Transition

copy 2018 Synopsys Inc 18

HyperLedger Machine ndash New Global State

copy 2018 Synopsys Inc 19

HyperLedger Machine ndash Suspect

Non BFT

Optional BFTCaching

copy 2018 Synopsys Inc 20

TineolaldquoA Tool to Interface With HyperLedger Fabricrdquo

copy 2018 Synopsys Inc 21

Appetizers

copy 2018 Synopsys Inc 22

Enumeration

copy 2018 Synopsys Inc 23

Invoking Chaincode

copy 2018 Synopsys Inc 24

Fuzzing

copy 2018 Synopsys Inc 25

Simple Injection

copy 2018 Synopsys Inc 26

Entreacutee

copy 2018 Synopsys Inc 27

Pivoting

copy 2018 Synopsys Inc 28

Direct DB Manipulation ndash Hierarchy Abuse

copy 2018 Synopsys Inc 29

Pre-Commit Side Effects Problems

copy 2018 Synopsys Inc 30

Get Your Own Taste

Follow and PR httpsgithubcomtineolatineola

Stark Riedesel StarkRiedeselsynopsyscom httpsfindtheninja

Parsia Hakimian ParsiaHakimiansynopsyscom httpsparsiyanet

Travis Biehn TravisBiehnsynopsyscom

Koen Buyens KoenBuyenssynopsyscom httpskoenbuyensorg

Thank You

Page 2: Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian,

copy 2018 Synopsys Inc 2

5 Courses

Our Team

Enterprise Blockchains

A Use Case

The Target ndash HyperLedger Fabric

Tineola

copy 2018 Synopsys Inc 3

HyperLedger Fabric ndash Core Research Group

Parsia HakimianSenior Consultant

Stark RiedeselSenior Consultant

Travis BiehnEmerging Tech Lead

Koen BuyensPrincipal Consultant

copy 2018 Synopsys Inc 4

Enterprise Blockchain Terroir

Enterprise Blockchain Enthusiasts

Tech Auto amp AeroFinancial Services AccountingHealthcareLogisticsOil

Enterprise PlatformsPublic Platforms

copy 2018 Synopsys Inc 5

Platform Desires Meet Reality

PromiseImmutabilityAuditabilityTune-able TrustProgrammable

ChallengeImmutabilityMutabilityPrivacyCorrectness and SpeedExecution EnvironmentPlatform Complexity

copy 2018 Synopsys Inc 6

On The Chopping Block

Enterprise Blockchain Enthusiasts

Tech Auto amp AeroFinancial Services AccountingHealthcareLogisticsOil

Enterprise PlatformsPublic Platforms

copy 2018 Synopsys Inc 7

Build Blockchain Insurance AppOur Enterprise Application Strawman

copy 2018 Synopsys Inc 8

Build Blockchain Insurance App

copy 2018 Synopsys Inc 9

Build Blockchain Insurance App

copy 2018 Synopsys Inc 10

Meet HyperLedger FabricAn Interesting New Machine

copy 2018 Synopsys Inc 11

Chaincode Fabricsrsquo Smart Contracts

copy 2018 Synopsys Inc 12

Security Model

copy 2018 Synopsys Inc 13

HyperLedger Machine

copy 2018 Synopsys Inc 14

HyperLedger Machine ndash Proposal

copy 2018 Synopsys Inc 15

HyperLedger Machine ndash Concrete Execution

copy 2018 Synopsys Inc 16

HyperLedger Machine ndash Endorsement

copy 2018 Synopsys Inc 17

HyperLedger Machine ndash State Transition

copy 2018 Synopsys Inc 18

HyperLedger Machine ndash New Global State

copy 2018 Synopsys Inc 19

HyperLedger Machine ndash Suspect

Non BFT

Optional BFTCaching

copy 2018 Synopsys Inc 20

TineolaldquoA Tool to Interface With HyperLedger Fabricrdquo

copy 2018 Synopsys Inc 21

Appetizers

copy 2018 Synopsys Inc 22

Enumeration

copy 2018 Synopsys Inc 23

Invoking Chaincode

copy 2018 Synopsys Inc 24

Fuzzing

copy 2018 Synopsys Inc 25

Simple Injection

copy 2018 Synopsys Inc 26

Entreacutee

copy 2018 Synopsys Inc 27

Pivoting

copy 2018 Synopsys Inc 28

Direct DB Manipulation ndash Hierarchy Abuse

copy 2018 Synopsys Inc 29

Pre-Commit Side Effects Problems

copy 2018 Synopsys Inc 30

Get Your Own Taste

Follow and PR httpsgithubcomtineolatineola

Stark Riedesel StarkRiedeselsynopsyscom httpsfindtheninja

Parsia Hakimian ParsiaHakimiansynopsyscom httpsparsiyanet

Travis Biehn TravisBiehnsynopsyscom

Koen Buyens KoenBuyenssynopsyscom httpskoenbuyensorg

Thank You

Page 3: Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian,

copy 2018 Synopsys Inc 3

HyperLedger Fabric ndash Core Research Group

Parsia HakimianSenior Consultant

Stark RiedeselSenior Consultant

Travis BiehnEmerging Tech Lead

Koen BuyensPrincipal Consultant

copy 2018 Synopsys Inc 4

Enterprise Blockchain Terroir

Enterprise Blockchain Enthusiasts

Tech Auto amp AeroFinancial Services AccountingHealthcareLogisticsOil

Enterprise PlatformsPublic Platforms

copy 2018 Synopsys Inc 5

Platform Desires Meet Reality

PromiseImmutabilityAuditabilityTune-able TrustProgrammable

ChallengeImmutabilityMutabilityPrivacyCorrectness and SpeedExecution EnvironmentPlatform Complexity

copy 2018 Synopsys Inc 6

On The Chopping Block

Enterprise Blockchain Enthusiasts

Tech Auto amp AeroFinancial Services AccountingHealthcareLogisticsOil

Enterprise PlatformsPublic Platforms

copy 2018 Synopsys Inc 7

Build Blockchain Insurance AppOur Enterprise Application Strawman

copy 2018 Synopsys Inc 8

Build Blockchain Insurance App

copy 2018 Synopsys Inc 9

Build Blockchain Insurance App

copy 2018 Synopsys Inc 10

Meet HyperLedger FabricAn Interesting New Machine

copy 2018 Synopsys Inc 11

Chaincode Fabricsrsquo Smart Contracts

copy 2018 Synopsys Inc 12

Security Model

copy 2018 Synopsys Inc 13

HyperLedger Machine

copy 2018 Synopsys Inc 14

HyperLedger Machine ndash Proposal

copy 2018 Synopsys Inc 15

HyperLedger Machine ndash Concrete Execution

copy 2018 Synopsys Inc 16

HyperLedger Machine ndash Endorsement

copy 2018 Synopsys Inc 17

HyperLedger Machine ndash State Transition

copy 2018 Synopsys Inc 18

HyperLedger Machine ndash New Global State

copy 2018 Synopsys Inc 19

HyperLedger Machine ndash Suspect

Non BFT

Optional BFTCaching

copy 2018 Synopsys Inc 20

TineolaldquoA Tool to Interface With HyperLedger Fabricrdquo

copy 2018 Synopsys Inc 21

Appetizers

copy 2018 Synopsys Inc 22

Enumeration

copy 2018 Synopsys Inc 23

Invoking Chaincode

copy 2018 Synopsys Inc 24

Fuzzing

copy 2018 Synopsys Inc 25

Simple Injection

copy 2018 Synopsys Inc 26

Entreacutee

copy 2018 Synopsys Inc 27

Pivoting

copy 2018 Synopsys Inc 28

Direct DB Manipulation ndash Hierarchy Abuse

copy 2018 Synopsys Inc 29

Pre-Commit Side Effects Problems

copy 2018 Synopsys Inc 30

Get Your Own Taste

Follow and PR httpsgithubcomtineolatineola

Stark Riedesel StarkRiedeselsynopsyscom httpsfindtheninja

Parsia Hakimian ParsiaHakimiansynopsyscom httpsparsiyanet

Travis Biehn TravisBiehnsynopsyscom

Koen Buyens KoenBuyenssynopsyscom httpskoenbuyensorg

Thank You

Page 4: Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian,

copy 2018 Synopsys Inc 4

Enterprise Blockchain Terroir

Enterprise Blockchain Enthusiasts

Tech Auto amp AeroFinancial Services AccountingHealthcareLogisticsOil

Enterprise PlatformsPublic Platforms

copy 2018 Synopsys Inc 5

Platform Desires Meet Reality

PromiseImmutabilityAuditabilityTune-able TrustProgrammable

ChallengeImmutabilityMutabilityPrivacyCorrectness and SpeedExecution EnvironmentPlatform Complexity

copy 2018 Synopsys Inc 6

On The Chopping Block

Enterprise Blockchain Enthusiasts

Tech Auto amp AeroFinancial Services AccountingHealthcareLogisticsOil

Enterprise PlatformsPublic Platforms

copy 2018 Synopsys Inc 7

Build Blockchain Insurance AppOur Enterprise Application Strawman

copy 2018 Synopsys Inc 8

Build Blockchain Insurance App

copy 2018 Synopsys Inc 9

Build Blockchain Insurance App

copy 2018 Synopsys Inc 10

Meet HyperLedger FabricAn Interesting New Machine

copy 2018 Synopsys Inc 11

Chaincode Fabricsrsquo Smart Contracts

copy 2018 Synopsys Inc 12

Security Model

copy 2018 Synopsys Inc 13

HyperLedger Machine

copy 2018 Synopsys Inc 14

HyperLedger Machine ndash Proposal

copy 2018 Synopsys Inc 15

HyperLedger Machine ndash Concrete Execution

copy 2018 Synopsys Inc 16

HyperLedger Machine ndash Endorsement

copy 2018 Synopsys Inc 17

HyperLedger Machine ndash State Transition

copy 2018 Synopsys Inc 18

HyperLedger Machine ndash New Global State

copy 2018 Synopsys Inc 19

HyperLedger Machine ndash Suspect

Non BFT

Optional BFTCaching

copy 2018 Synopsys Inc 20

TineolaldquoA Tool to Interface With HyperLedger Fabricrdquo

copy 2018 Synopsys Inc 21

Appetizers

copy 2018 Synopsys Inc 22

Enumeration

copy 2018 Synopsys Inc 23

Invoking Chaincode

copy 2018 Synopsys Inc 24

Fuzzing

copy 2018 Synopsys Inc 25

Simple Injection

copy 2018 Synopsys Inc 26

Entreacutee

copy 2018 Synopsys Inc 27

Pivoting

copy 2018 Synopsys Inc 28

Direct DB Manipulation ndash Hierarchy Abuse

copy 2018 Synopsys Inc 29

Pre-Commit Side Effects Problems

copy 2018 Synopsys Inc 30

Get Your Own Taste

Follow and PR httpsgithubcomtineolatineola

Stark Riedesel StarkRiedeselsynopsyscom httpsfindtheninja

Parsia Hakimian ParsiaHakimiansynopsyscom httpsparsiyanet

Travis Biehn TravisBiehnsynopsyscom

Koen Buyens KoenBuyenssynopsyscom httpskoenbuyensorg

Thank You

Page 5: Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian,

copy 2018 Synopsys Inc 5

Platform Desires Meet Reality

PromiseImmutabilityAuditabilityTune-able TrustProgrammable

ChallengeImmutabilityMutabilityPrivacyCorrectness and SpeedExecution EnvironmentPlatform Complexity

copy 2018 Synopsys Inc 6

On The Chopping Block

Enterprise Blockchain Enthusiasts

Tech Auto amp AeroFinancial Services AccountingHealthcareLogisticsOil

Enterprise PlatformsPublic Platforms

copy 2018 Synopsys Inc 7

Build Blockchain Insurance AppOur Enterprise Application Strawman

copy 2018 Synopsys Inc 8

Build Blockchain Insurance App

copy 2018 Synopsys Inc 9

Build Blockchain Insurance App

copy 2018 Synopsys Inc 10

Meet HyperLedger FabricAn Interesting New Machine

copy 2018 Synopsys Inc 11

Chaincode Fabricsrsquo Smart Contracts

copy 2018 Synopsys Inc 12

Security Model

copy 2018 Synopsys Inc 13

HyperLedger Machine

copy 2018 Synopsys Inc 14

HyperLedger Machine ndash Proposal

copy 2018 Synopsys Inc 15

HyperLedger Machine ndash Concrete Execution

copy 2018 Synopsys Inc 16

HyperLedger Machine ndash Endorsement

copy 2018 Synopsys Inc 17

HyperLedger Machine ndash State Transition

copy 2018 Synopsys Inc 18

HyperLedger Machine ndash New Global State

copy 2018 Synopsys Inc 19

HyperLedger Machine ndash Suspect

Non BFT

Optional BFTCaching

copy 2018 Synopsys Inc 20

TineolaldquoA Tool to Interface With HyperLedger Fabricrdquo

copy 2018 Synopsys Inc 21

Appetizers

copy 2018 Synopsys Inc 22

Enumeration

copy 2018 Synopsys Inc 23

Invoking Chaincode

copy 2018 Synopsys Inc 24

Fuzzing

copy 2018 Synopsys Inc 25

Simple Injection

copy 2018 Synopsys Inc 26

Entreacutee

copy 2018 Synopsys Inc 27

Pivoting

copy 2018 Synopsys Inc 28

Direct DB Manipulation ndash Hierarchy Abuse

copy 2018 Synopsys Inc 29

Pre-Commit Side Effects Problems

copy 2018 Synopsys Inc 30

Get Your Own Taste

Follow and PR httpsgithubcomtineolatineola

Stark Riedesel StarkRiedeselsynopsyscom httpsfindtheninja

Parsia Hakimian ParsiaHakimiansynopsyscom httpsparsiyanet

Travis Biehn TravisBiehnsynopsyscom

Koen Buyens KoenBuyenssynopsyscom httpskoenbuyensorg

Thank You

Page 6: Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian,

copy 2018 Synopsys Inc 6

On The Chopping Block

Enterprise Blockchain Enthusiasts

Tech Auto amp AeroFinancial Services AccountingHealthcareLogisticsOil

Enterprise PlatformsPublic Platforms

copy 2018 Synopsys Inc 7

Build Blockchain Insurance AppOur Enterprise Application Strawman

copy 2018 Synopsys Inc 8

Build Blockchain Insurance App

copy 2018 Synopsys Inc 9

Build Blockchain Insurance App

copy 2018 Synopsys Inc 10

Meet HyperLedger FabricAn Interesting New Machine

copy 2018 Synopsys Inc 11

Chaincode Fabricsrsquo Smart Contracts

copy 2018 Synopsys Inc 12

Security Model

copy 2018 Synopsys Inc 13

HyperLedger Machine

copy 2018 Synopsys Inc 14

HyperLedger Machine ndash Proposal

copy 2018 Synopsys Inc 15

HyperLedger Machine ndash Concrete Execution

copy 2018 Synopsys Inc 16

HyperLedger Machine ndash Endorsement

copy 2018 Synopsys Inc 17

HyperLedger Machine ndash State Transition

copy 2018 Synopsys Inc 18

HyperLedger Machine ndash New Global State

copy 2018 Synopsys Inc 19

HyperLedger Machine ndash Suspect

Non BFT

Optional BFTCaching

copy 2018 Synopsys Inc 20

TineolaldquoA Tool to Interface With HyperLedger Fabricrdquo

copy 2018 Synopsys Inc 21

Appetizers

copy 2018 Synopsys Inc 22

Enumeration

copy 2018 Synopsys Inc 23

Invoking Chaincode

copy 2018 Synopsys Inc 24

Fuzzing

copy 2018 Synopsys Inc 25

Simple Injection

copy 2018 Synopsys Inc 26

Entreacutee

copy 2018 Synopsys Inc 27

Pivoting

copy 2018 Synopsys Inc 28

Direct DB Manipulation ndash Hierarchy Abuse

copy 2018 Synopsys Inc 29

Pre-Commit Side Effects Problems

copy 2018 Synopsys Inc 30

Get Your Own Taste

Follow and PR httpsgithubcomtineolatineola

Stark Riedesel StarkRiedeselsynopsyscom httpsfindtheninja

Parsia Hakimian ParsiaHakimiansynopsyscom httpsparsiyanet

Travis Biehn TravisBiehnsynopsyscom

Koen Buyens KoenBuyenssynopsyscom httpskoenbuyensorg

Thank You

Page 7: Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian,

copy 2018 Synopsys Inc 7

Build Blockchain Insurance AppOur Enterprise Application Strawman

copy 2018 Synopsys Inc 8

Build Blockchain Insurance App

copy 2018 Synopsys Inc 9

Build Blockchain Insurance App

copy 2018 Synopsys Inc 10

Meet HyperLedger FabricAn Interesting New Machine

copy 2018 Synopsys Inc 11

Chaincode Fabricsrsquo Smart Contracts

copy 2018 Synopsys Inc 12

Security Model

copy 2018 Synopsys Inc 13

HyperLedger Machine

copy 2018 Synopsys Inc 14

HyperLedger Machine ndash Proposal

copy 2018 Synopsys Inc 15

HyperLedger Machine ndash Concrete Execution

copy 2018 Synopsys Inc 16

HyperLedger Machine ndash Endorsement

copy 2018 Synopsys Inc 17

HyperLedger Machine ndash State Transition

copy 2018 Synopsys Inc 18

HyperLedger Machine ndash New Global State

copy 2018 Synopsys Inc 19

HyperLedger Machine ndash Suspect

Non BFT

Optional BFTCaching

copy 2018 Synopsys Inc 20

TineolaldquoA Tool to Interface With HyperLedger Fabricrdquo

copy 2018 Synopsys Inc 21

Appetizers

copy 2018 Synopsys Inc 22

Enumeration

copy 2018 Synopsys Inc 23

Invoking Chaincode

copy 2018 Synopsys Inc 24

Fuzzing

copy 2018 Synopsys Inc 25

Simple Injection

copy 2018 Synopsys Inc 26

Entreacutee

copy 2018 Synopsys Inc 27

Pivoting

copy 2018 Synopsys Inc 28

Direct DB Manipulation ndash Hierarchy Abuse

copy 2018 Synopsys Inc 29

Pre-Commit Side Effects Problems

copy 2018 Synopsys Inc 30

Get Your Own Taste

Follow and PR httpsgithubcomtineolatineola

Stark Riedesel StarkRiedeselsynopsyscom httpsfindtheninja

Parsia Hakimian ParsiaHakimiansynopsyscom httpsparsiyanet

Travis Biehn TravisBiehnsynopsyscom

Koen Buyens KoenBuyenssynopsyscom httpskoenbuyensorg

Thank You

Page 8: Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian,

copy 2018 Synopsys Inc 8

Build Blockchain Insurance App

copy 2018 Synopsys Inc 9

Build Blockchain Insurance App

copy 2018 Synopsys Inc 10

Meet HyperLedger FabricAn Interesting New Machine

copy 2018 Synopsys Inc 11

Chaincode Fabricsrsquo Smart Contracts

copy 2018 Synopsys Inc 12

Security Model

copy 2018 Synopsys Inc 13

HyperLedger Machine

copy 2018 Synopsys Inc 14

HyperLedger Machine ndash Proposal

copy 2018 Synopsys Inc 15

HyperLedger Machine ndash Concrete Execution

copy 2018 Synopsys Inc 16

HyperLedger Machine ndash Endorsement

copy 2018 Synopsys Inc 17

HyperLedger Machine ndash State Transition

copy 2018 Synopsys Inc 18

HyperLedger Machine ndash New Global State

copy 2018 Synopsys Inc 19

HyperLedger Machine ndash Suspect

Non BFT

Optional BFTCaching

copy 2018 Synopsys Inc 20

TineolaldquoA Tool to Interface With HyperLedger Fabricrdquo

copy 2018 Synopsys Inc 21

Appetizers

copy 2018 Synopsys Inc 22

Enumeration

copy 2018 Synopsys Inc 23

Invoking Chaincode

copy 2018 Synopsys Inc 24

Fuzzing

copy 2018 Synopsys Inc 25

Simple Injection

copy 2018 Synopsys Inc 26

Entreacutee

copy 2018 Synopsys Inc 27

Pivoting

copy 2018 Synopsys Inc 28

Direct DB Manipulation ndash Hierarchy Abuse

copy 2018 Synopsys Inc 29

Pre-Commit Side Effects Problems

copy 2018 Synopsys Inc 30

Get Your Own Taste

Follow and PR httpsgithubcomtineolatineola

Stark Riedesel StarkRiedeselsynopsyscom httpsfindtheninja

Parsia Hakimian ParsiaHakimiansynopsyscom httpsparsiyanet

Travis Biehn TravisBiehnsynopsyscom

Koen Buyens KoenBuyenssynopsyscom httpskoenbuyensorg

Thank You

Page 9: Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian,

copy 2018 Synopsys Inc 9

Build Blockchain Insurance App

copy 2018 Synopsys Inc 10

Meet HyperLedger FabricAn Interesting New Machine

copy 2018 Synopsys Inc 11

Chaincode Fabricsrsquo Smart Contracts

copy 2018 Synopsys Inc 12

Security Model

copy 2018 Synopsys Inc 13

HyperLedger Machine

copy 2018 Synopsys Inc 14

HyperLedger Machine ndash Proposal

copy 2018 Synopsys Inc 15

HyperLedger Machine ndash Concrete Execution

copy 2018 Synopsys Inc 16

HyperLedger Machine ndash Endorsement

copy 2018 Synopsys Inc 17

HyperLedger Machine ndash State Transition

copy 2018 Synopsys Inc 18

HyperLedger Machine ndash New Global State

copy 2018 Synopsys Inc 19

HyperLedger Machine ndash Suspect

Non BFT

Optional BFTCaching

copy 2018 Synopsys Inc 20

TineolaldquoA Tool to Interface With HyperLedger Fabricrdquo

copy 2018 Synopsys Inc 21

Appetizers

copy 2018 Synopsys Inc 22

Enumeration

copy 2018 Synopsys Inc 23

Invoking Chaincode

copy 2018 Synopsys Inc 24

Fuzzing

copy 2018 Synopsys Inc 25

Simple Injection

copy 2018 Synopsys Inc 26

Entreacutee

copy 2018 Synopsys Inc 27

Pivoting

copy 2018 Synopsys Inc 28

Direct DB Manipulation ndash Hierarchy Abuse

copy 2018 Synopsys Inc 29

Pre-Commit Side Effects Problems

copy 2018 Synopsys Inc 30

Get Your Own Taste

Follow and PR httpsgithubcomtineolatineola

Stark Riedesel StarkRiedeselsynopsyscom httpsfindtheninja

Parsia Hakimian ParsiaHakimiansynopsyscom httpsparsiyanet

Travis Biehn TravisBiehnsynopsyscom

Koen Buyens KoenBuyenssynopsyscom httpskoenbuyensorg

Thank You

Page 10: Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian,

copy 2018 Synopsys Inc 10

Meet HyperLedger FabricAn Interesting New Machine

copy 2018 Synopsys Inc 11

Chaincode Fabricsrsquo Smart Contracts

copy 2018 Synopsys Inc 12

Security Model

copy 2018 Synopsys Inc 13

HyperLedger Machine

copy 2018 Synopsys Inc 14

HyperLedger Machine ndash Proposal

copy 2018 Synopsys Inc 15

HyperLedger Machine ndash Concrete Execution

copy 2018 Synopsys Inc 16

HyperLedger Machine ndash Endorsement

copy 2018 Synopsys Inc 17

HyperLedger Machine ndash State Transition

copy 2018 Synopsys Inc 18

HyperLedger Machine ndash New Global State

copy 2018 Synopsys Inc 19

HyperLedger Machine ndash Suspect

Non BFT

Optional BFTCaching

copy 2018 Synopsys Inc 20

TineolaldquoA Tool to Interface With HyperLedger Fabricrdquo

copy 2018 Synopsys Inc 21

Appetizers

copy 2018 Synopsys Inc 22

Enumeration

copy 2018 Synopsys Inc 23

Invoking Chaincode

copy 2018 Synopsys Inc 24

Fuzzing

copy 2018 Synopsys Inc 25

Simple Injection

copy 2018 Synopsys Inc 26

Entreacutee

copy 2018 Synopsys Inc 27

Pivoting

copy 2018 Synopsys Inc 28

Direct DB Manipulation ndash Hierarchy Abuse

copy 2018 Synopsys Inc 29

Pre-Commit Side Effects Problems

copy 2018 Synopsys Inc 30

Get Your Own Taste

Follow and PR httpsgithubcomtineolatineola

Stark Riedesel StarkRiedeselsynopsyscom httpsfindtheninja

Parsia Hakimian ParsiaHakimiansynopsyscom httpsparsiyanet

Travis Biehn TravisBiehnsynopsyscom

Koen Buyens KoenBuyenssynopsyscom httpskoenbuyensorg

Thank You

Page 11: Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian,

copy 2018 Synopsys Inc 11

Chaincode Fabricsrsquo Smart Contracts

copy 2018 Synopsys Inc 12

Security Model

copy 2018 Synopsys Inc 13

HyperLedger Machine

copy 2018 Synopsys Inc 14

HyperLedger Machine ndash Proposal

copy 2018 Synopsys Inc 15

HyperLedger Machine ndash Concrete Execution

copy 2018 Synopsys Inc 16

HyperLedger Machine ndash Endorsement

copy 2018 Synopsys Inc 17

HyperLedger Machine ndash State Transition

copy 2018 Synopsys Inc 18

HyperLedger Machine ndash New Global State

copy 2018 Synopsys Inc 19

HyperLedger Machine ndash Suspect

Non BFT

Optional BFTCaching

copy 2018 Synopsys Inc 20

TineolaldquoA Tool to Interface With HyperLedger Fabricrdquo

copy 2018 Synopsys Inc 21

Appetizers

copy 2018 Synopsys Inc 22

Enumeration

copy 2018 Synopsys Inc 23

Invoking Chaincode

copy 2018 Synopsys Inc 24

Fuzzing

copy 2018 Synopsys Inc 25

Simple Injection

copy 2018 Synopsys Inc 26

Entreacutee

copy 2018 Synopsys Inc 27

Pivoting

copy 2018 Synopsys Inc 28

Direct DB Manipulation ndash Hierarchy Abuse

copy 2018 Synopsys Inc 29

Pre-Commit Side Effects Problems

copy 2018 Synopsys Inc 30

Get Your Own Taste

Follow and PR httpsgithubcomtineolatineola

Stark Riedesel StarkRiedeselsynopsyscom httpsfindtheninja

Parsia Hakimian ParsiaHakimiansynopsyscom httpsparsiyanet

Travis Biehn TravisBiehnsynopsyscom

Koen Buyens KoenBuyenssynopsyscom httpskoenbuyensorg

Thank You

Page 12: Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian,

copy 2018 Synopsys Inc 12

Security Model

copy 2018 Synopsys Inc 13

HyperLedger Machine

copy 2018 Synopsys Inc 14

HyperLedger Machine ndash Proposal

copy 2018 Synopsys Inc 15

HyperLedger Machine ndash Concrete Execution

copy 2018 Synopsys Inc 16

HyperLedger Machine ndash Endorsement

copy 2018 Synopsys Inc 17

HyperLedger Machine ndash State Transition

copy 2018 Synopsys Inc 18

HyperLedger Machine ndash New Global State

copy 2018 Synopsys Inc 19

HyperLedger Machine ndash Suspect

Non BFT

Optional BFTCaching

copy 2018 Synopsys Inc 20

TineolaldquoA Tool to Interface With HyperLedger Fabricrdquo

copy 2018 Synopsys Inc 21

Appetizers

copy 2018 Synopsys Inc 22

Enumeration

copy 2018 Synopsys Inc 23

Invoking Chaincode

copy 2018 Synopsys Inc 24

Fuzzing

copy 2018 Synopsys Inc 25

Simple Injection

copy 2018 Synopsys Inc 26

Entreacutee

copy 2018 Synopsys Inc 27

Pivoting

copy 2018 Synopsys Inc 28

Direct DB Manipulation ndash Hierarchy Abuse

copy 2018 Synopsys Inc 29

Pre-Commit Side Effects Problems

copy 2018 Synopsys Inc 30

Get Your Own Taste

Follow and PR httpsgithubcomtineolatineola

Stark Riedesel StarkRiedeselsynopsyscom httpsfindtheninja

Parsia Hakimian ParsiaHakimiansynopsyscom httpsparsiyanet

Travis Biehn TravisBiehnsynopsyscom

Koen Buyens KoenBuyenssynopsyscom httpskoenbuyensorg

Thank You

Page 13: Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian,

copy 2018 Synopsys Inc 13

HyperLedger Machine

copy 2018 Synopsys Inc 14

HyperLedger Machine ndash Proposal

copy 2018 Synopsys Inc 15

HyperLedger Machine ndash Concrete Execution

copy 2018 Synopsys Inc 16

HyperLedger Machine ndash Endorsement

copy 2018 Synopsys Inc 17

HyperLedger Machine ndash State Transition

copy 2018 Synopsys Inc 18

HyperLedger Machine ndash New Global State

copy 2018 Synopsys Inc 19

HyperLedger Machine ndash Suspect

Non BFT

Optional BFTCaching

copy 2018 Synopsys Inc 20

TineolaldquoA Tool to Interface With HyperLedger Fabricrdquo

copy 2018 Synopsys Inc 21

Appetizers

copy 2018 Synopsys Inc 22

Enumeration

copy 2018 Synopsys Inc 23

Invoking Chaincode

copy 2018 Synopsys Inc 24

Fuzzing

copy 2018 Synopsys Inc 25

Simple Injection

copy 2018 Synopsys Inc 26

Entreacutee

copy 2018 Synopsys Inc 27

Pivoting

copy 2018 Synopsys Inc 28

Direct DB Manipulation ndash Hierarchy Abuse

copy 2018 Synopsys Inc 29

Pre-Commit Side Effects Problems

copy 2018 Synopsys Inc 30

Get Your Own Taste

Follow and PR httpsgithubcomtineolatineola

Stark Riedesel StarkRiedeselsynopsyscom httpsfindtheninja

Parsia Hakimian ParsiaHakimiansynopsyscom httpsparsiyanet

Travis Biehn TravisBiehnsynopsyscom

Koen Buyens KoenBuyenssynopsyscom httpskoenbuyensorg

Thank You

Page 14: Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian,

copy 2018 Synopsys Inc 14

HyperLedger Machine ndash Proposal

copy 2018 Synopsys Inc 15

HyperLedger Machine ndash Concrete Execution

copy 2018 Synopsys Inc 16

HyperLedger Machine ndash Endorsement

copy 2018 Synopsys Inc 17

HyperLedger Machine ndash State Transition

copy 2018 Synopsys Inc 18

HyperLedger Machine ndash New Global State

copy 2018 Synopsys Inc 19

HyperLedger Machine ndash Suspect

Non BFT

Optional BFTCaching

copy 2018 Synopsys Inc 20

TineolaldquoA Tool to Interface With HyperLedger Fabricrdquo

copy 2018 Synopsys Inc 21

Appetizers

copy 2018 Synopsys Inc 22

Enumeration

copy 2018 Synopsys Inc 23

Invoking Chaincode

copy 2018 Synopsys Inc 24

Fuzzing

copy 2018 Synopsys Inc 25

Simple Injection

copy 2018 Synopsys Inc 26

Entreacutee

copy 2018 Synopsys Inc 27

Pivoting

copy 2018 Synopsys Inc 28

Direct DB Manipulation ndash Hierarchy Abuse

copy 2018 Synopsys Inc 29

Pre-Commit Side Effects Problems

copy 2018 Synopsys Inc 30

Get Your Own Taste

Follow and PR httpsgithubcomtineolatineola

Stark Riedesel StarkRiedeselsynopsyscom httpsfindtheninja

Parsia Hakimian ParsiaHakimiansynopsyscom httpsparsiyanet

Travis Biehn TravisBiehnsynopsyscom

Koen Buyens KoenBuyenssynopsyscom httpskoenbuyensorg

Thank You

Page 15: Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian,

copy 2018 Synopsys Inc 15

HyperLedger Machine ndash Concrete Execution

copy 2018 Synopsys Inc 16

HyperLedger Machine ndash Endorsement

copy 2018 Synopsys Inc 17

HyperLedger Machine ndash State Transition

copy 2018 Synopsys Inc 18

HyperLedger Machine ndash New Global State

copy 2018 Synopsys Inc 19

HyperLedger Machine ndash Suspect

Non BFT

Optional BFTCaching

copy 2018 Synopsys Inc 20

TineolaldquoA Tool to Interface With HyperLedger Fabricrdquo

copy 2018 Synopsys Inc 21

Appetizers

copy 2018 Synopsys Inc 22

Enumeration

copy 2018 Synopsys Inc 23

Invoking Chaincode

copy 2018 Synopsys Inc 24

Fuzzing

copy 2018 Synopsys Inc 25

Simple Injection

copy 2018 Synopsys Inc 26

Entreacutee

copy 2018 Synopsys Inc 27

Pivoting

copy 2018 Synopsys Inc 28

Direct DB Manipulation ndash Hierarchy Abuse

copy 2018 Synopsys Inc 29

Pre-Commit Side Effects Problems

copy 2018 Synopsys Inc 30

Get Your Own Taste

Follow and PR httpsgithubcomtineolatineola

Stark Riedesel StarkRiedeselsynopsyscom httpsfindtheninja

Parsia Hakimian ParsiaHakimiansynopsyscom httpsparsiyanet

Travis Biehn TravisBiehnsynopsyscom

Koen Buyens KoenBuyenssynopsyscom httpskoenbuyensorg

Thank You

Page 16: Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian,

copy 2018 Synopsys Inc 16

HyperLedger Machine ndash Endorsement

copy 2018 Synopsys Inc 17

HyperLedger Machine ndash State Transition

copy 2018 Synopsys Inc 18

HyperLedger Machine ndash New Global State

copy 2018 Synopsys Inc 19

HyperLedger Machine ndash Suspect

Non BFT

Optional BFTCaching

copy 2018 Synopsys Inc 20

TineolaldquoA Tool to Interface With HyperLedger Fabricrdquo

copy 2018 Synopsys Inc 21

Appetizers

copy 2018 Synopsys Inc 22

Enumeration

copy 2018 Synopsys Inc 23

Invoking Chaincode

copy 2018 Synopsys Inc 24

Fuzzing

copy 2018 Synopsys Inc 25

Simple Injection

copy 2018 Synopsys Inc 26

Entreacutee

copy 2018 Synopsys Inc 27

Pivoting

copy 2018 Synopsys Inc 28

Direct DB Manipulation ndash Hierarchy Abuse

copy 2018 Synopsys Inc 29

Pre-Commit Side Effects Problems

copy 2018 Synopsys Inc 30

Get Your Own Taste

Follow and PR httpsgithubcomtineolatineola

Stark Riedesel StarkRiedeselsynopsyscom httpsfindtheninja

Parsia Hakimian ParsiaHakimiansynopsyscom httpsparsiyanet

Travis Biehn TravisBiehnsynopsyscom

Koen Buyens KoenBuyenssynopsyscom httpskoenbuyensorg

Thank You

Page 17: Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian,

copy 2018 Synopsys Inc 17

HyperLedger Machine ndash State Transition

copy 2018 Synopsys Inc 18

HyperLedger Machine ndash New Global State

copy 2018 Synopsys Inc 19

HyperLedger Machine ndash Suspect

Non BFT

Optional BFTCaching

copy 2018 Synopsys Inc 20

TineolaldquoA Tool to Interface With HyperLedger Fabricrdquo

copy 2018 Synopsys Inc 21

Appetizers

copy 2018 Synopsys Inc 22

Enumeration

copy 2018 Synopsys Inc 23

Invoking Chaincode

copy 2018 Synopsys Inc 24

Fuzzing

copy 2018 Synopsys Inc 25

Simple Injection

copy 2018 Synopsys Inc 26

Entreacutee

copy 2018 Synopsys Inc 27

Pivoting

copy 2018 Synopsys Inc 28

Direct DB Manipulation ndash Hierarchy Abuse

copy 2018 Synopsys Inc 29

Pre-Commit Side Effects Problems

copy 2018 Synopsys Inc 30

Get Your Own Taste

Follow and PR httpsgithubcomtineolatineola

Stark Riedesel StarkRiedeselsynopsyscom httpsfindtheninja

Parsia Hakimian ParsiaHakimiansynopsyscom httpsparsiyanet

Travis Biehn TravisBiehnsynopsyscom

Koen Buyens KoenBuyenssynopsyscom httpskoenbuyensorg

Thank You

Page 18: Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian,

copy 2018 Synopsys Inc 18

HyperLedger Machine ndash New Global State

copy 2018 Synopsys Inc 19

HyperLedger Machine ndash Suspect

Non BFT

Optional BFTCaching

copy 2018 Synopsys Inc 20

TineolaldquoA Tool to Interface With HyperLedger Fabricrdquo

copy 2018 Synopsys Inc 21

Appetizers

copy 2018 Synopsys Inc 22

Enumeration

copy 2018 Synopsys Inc 23

Invoking Chaincode

copy 2018 Synopsys Inc 24

Fuzzing

copy 2018 Synopsys Inc 25

Simple Injection

copy 2018 Synopsys Inc 26

Entreacutee

copy 2018 Synopsys Inc 27

Pivoting

copy 2018 Synopsys Inc 28

Direct DB Manipulation ndash Hierarchy Abuse

copy 2018 Synopsys Inc 29

Pre-Commit Side Effects Problems

copy 2018 Synopsys Inc 30

Get Your Own Taste

Follow and PR httpsgithubcomtineolatineola

Stark Riedesel StarkRiedeselsynopsyscom httpsfindtheninja

Parsia Hakimian ParsiaHakimiansynopsyscom httpsparsiyanet

Travis Biehn TravisBiehnsynopsyscom

Koen Buyens KoenBuyenssynopsyscom httpskoenbuyensorg

Thank You

Page 19: Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian,

copy 2018 Synopsys Inc 19

HyperLedger Machine ndash Suspect

Non BFT

Optional BFTCaching

copy 2018 Synopsys Inc 20

TineolaldquoA Tool to Interface With HyperLedger Fabricrdquo

copy 2018 Synopsys Inc 21

Appetizers

copy 2018 Synopsys Inc 22

Enumeration

copy 2018 Synopsys Inc 23

Invoking Chaincode

copy 2018 Synopsys Inc 24

Fuzzing

copy 2018 Synopsys Inc 25

Simple Injection

copy 2018 Synopsys Inc 26

Entreacutee

copy 2018 Synopsys Inc 27

Pivoting

copy 2018 Synopsys Inc 28

Direct DB Manipulation ndash Hierarchy Abuse

copy 2018 Synopsys Inc 29

Pre-Commit Side Effects Problems

copy 2018 Synopsys Inc 30

Get Your Own Taste

Follow and PR httpsgithubcomtineolatineola

Stark Riedesel StarkRiedeselsynopsyscom httpsfindtheninja

Parsia Hakimian ParsiaHakimiansynopsyscom httpsparsiyanet

Travis Biehn TravisBiehnsynopsyscom

Koen Buyens KoenBuyenssynopsyscom httpskoenbuyensorg

Thank You

Page 20: Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian,

copy 2018 Synopsys Inc 20

TineolaldquoA Tool to Interface With HyperLedger Fabricrdquo

copy 2018 Synopsys Inc 21

Appetizers

copy 2018 Synopsys Inc 22

Enumeration

copy 2018 Synopsys Inc 23

Invoking Chaincode

copy 2018 Synopsys Inc 24

Fuzzing

copy 2018 Synopsys Inc 25

Simple Injection

copy 2018 Synopsys Inc 26

Entreacutee

copy 2018 Synopsys Inc 27

Pivoting

copy 2018 Synopsys Inc 28

Direct DB Manipulation ndash Hierarchy Abuse

copy 2018 Synopsys Inc 29

Pre-Commit Side Effects Problems

copy 2018 Synopsys Inc 30

Get Your Own Taste

Follow and PR httpsgithubcomtineolatineola

Stark Riedesel StarkRiedeselsynopsyscom httpsfindtheninja

Parsia Hakimian ParsiaHakimiansynopsyscom httpsparsiyanet

Travis Biehn TravisBiehnsynopsyscom

Koen Buyens KoenBuyenssynopsyscom httpskoenbuyensorg

Thank You

Page 21: Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian,

copy 2018 Synopsys Inc 21

Appetizers

copy 2018 Synopsys Inc 22

Enumeration

copy 2018 Synopsys Inc 23

Invoking Chaincode

copy 2018 Synopsys Inc 24

Fuzzing

copy 2018 Synopsys Inc 25

Simple Injection

copy 2018 Synopsys Inc 26

Entreacutee

copy 2018 Synopsys Inc 27

Pivoting

copy 2018 Synopsys Inc 28

Direct DB Manipulation ndash Hierarchy Abuse

copy 2018 Synopsys Inc 29

Pre-Commit Side Effects Problems

copy 2018 Synopsys Inc 30

Get Your Own Taste

Follow and PR httpsgithubcomtineolatineola

Stark Riedesel StarkRiedeselsynopsyscom httpsfindtheninja

Parsia Hakimian ParsiaHakimiansynopsyscom httpsparsiyanet

Travis Biehn TravisBiehnsynopsyscom

Koen Buyens KoenBuyenssynopsyscom httpskoenbuyensorg

Thank You

Page 22: Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian,

copy 2018 Synopsys Inc 22

Enumeration

copy 2018 Synopsys Inc 23

Invoking Chaincode

copy 2018 Synopsys Inc 24

Fuzzing

copy 2018 Synopsys Inc 25

Simple Injection

copy 2018 Synopsys Inc 26

Entreacutee

copy 2018 Synopsys Inc 27

Pivoting

copy 2018 Synopsys Inc 28

Direct DB Manipulation ndash Hierarchy Abuse

copy 2018 Synopsys Inc 29

Pre-Commit Side Effects Problems

copy 2018 Synopsys Inc 30

Get Your Own Taste

Follow and PR httpsgithubcomtineolatineola

Stark Riedesel StarkRiedeselsynopsyscom httpsfindtheninja

Parsia Hakimian ParsiaHakimiansynopsyscom httpsparsiyanet

Travis Biehn TravisBiehnsynopsyscom

Koen Buyens KoenBuyenssynopsyscom httpskoenbuyensorg

Thank You

Page 23: Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian,

copy 2018 Synopsys Inc 23

Invoking Chaincode

copy 2018 Synopsys Inc 24

Fuzzing

copy 2018 Synopsys Inc 25

Simple Injection

copy 2018 Synopsys Inc 26

Entreacutee

copy 2018 Synopsys Inc 27

Pivoting

copy 2018 Synopsys Inc 28

Direct DB Manipulation ndash Hierarchy Abuse

copy 2018 Synopsys Inc 29

Pre-Commit Side Effects Problems

copy 2018 Synopsys Inc 30

Get Your Own Taste

Follow and PR httpsgithubcomtineolatineola

Stark Riedesel StarkRiedeselsynopsyscom httpsfindtheninja

Parsia Hakimian ParsiaHakimiansynopsyscom httpsparsiyanet

Travis Biehn TravisBiehnsynopsyscom

Koen Buyens KoenBuyenssynopsyscom httpskoenbuyensorg

Thank You

Page 24: Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian,

copy 2018 Synopsys Inc 24

Fuzzing

copy 2018 Synopsys Inc 25

Simple Injection

copy 2018 Synopsys Inc 26

Entreacutee

copy 2018 Synopsys Inc 27

Pivoting

copy 2018 Synopsys Inc 28

Direct DB Manipulation ndash Hierarchy Abuse

copy 2018 Synopsys Inc 29

Pre-Commit Side Effects Problems

copy 2018 Synopsys Inc 30

Get Your Own Taste

Follow and PR httpsgithubcomtineolatineola

Stark Riedesel StarkRiedeselsynopsyscom httpsfindtheninja

Parsia Hakimian ParsiaHakimiansynopsyscom httpsparsiyanet

Travis Biehn TravisBiehnsynopsyscom

Koen Buyens KoenBuyenssynopsyscom httpskoenbuyensorg

Thank You

Page 25: Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian,

copy 2018 Synopsys Inc 25

Simple Injection

copy 2018 Synopsys Inc 26

Entreacutee

copy 2018 Synopsys Inc 27

Pivoting

copy 2018 Synopsys Inc 28

Direct DB Manipulation ndash Hierarchy Abuse

copy 2018 Synopsys Inc 29

Pre-Commit Side Effects Problems

copy 2018 Synopsys Inc 30

Get Your Own Taste

Follow and PR httpsgithubcomtineolatineola

Stark Riedesel StarkRiedeselsynopsyscom httpsfindtheninja

Parsia Hakimian ParsiaHakimiansynopsyscom httpsparsiyanet

Travis Biehn TravisBiehnsynopsyscom

Koen Buyens KoenBuyenssynopsyscom httpskoenbuyensorg

Thank You

Page 26: Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian,

copy 2018 Synopsys Inc 26

Entreacutee

copy 2018 Synopsys Inc 27

Pivoting

copy 2018 Synopsys Inc 28

Direct DB Manipulation ndash Hierarchy Abuse

copy 2018 Synopsys Inc 29

Pre-Commit Side Effects Problems

copy 2018 Synopsys Inc 30

Get Your Own Taste

Follow and PR httpsgithubcomtineolatineola

Stark Riedesel StarkRiedeselsynopsyscom httpsfindtheninja

Parsia Hakimian ParsiaHakimiansynopsyscom httpsparsiyanet

Travis Biehn TravisBiehnsynopsyscom

Koen Buyens KoenBuyenssynopsyscom httpskoenbuyensorg

Thank You

Page 27: Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian,

copy 2018 Synopsys Inc 27

Pivoting

copy 2018 Synopsys Inc 28

Direct DB Manipulation ndash Hierarchy Abuse

copy 2018 Synopsys Inc 29

Pre-Commit Side Effects Problems

copy 2018 Synopsys Inc 30

Get Your Own Taste

Follow and PR httpsgithubcomtineolatineola

Stark Riedesel StarkRiedeselsynopsyscom httpsfindtheninja

Parsia Hakimian ParsiaHakimiansynopsyscom httpsparsiyanet

Travis Biehn TravisBiehnsynopsyscom

Koen Buyens KoenBuyenssynopsyscom httpskoenbuyensorg

Thank You

Page 28: Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian,

copy 2018 Synopsys Inc 28

Direct DB Manipulation ndash Hierarchy Abuse

copy 2018 Synopsys Inc 29

Pre-Commit Side Effects Problems

copy 2018 Synopsys Inc 30

Get Your Own Taste

Follow and PR httpsgithubcomtineolatineola

Stark Riedesel StarkRiedeselsynopsyscom httpsfindtheninja

Parsia Hakimian ParsiaHakimiansynopsyscom httpsparsiyanet

Travis Biehn TravisBiehnsynopsyscom

Koen Buyens KoenBuyenssynopsyscom httpskoenbuyensorg

Thank You

Page 29: Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian,

copy 2018 Synopsys Inc 29

Pre-Commit Side Effects Problems

copy 2018 Synopsys Inc 30

Get Your Own Taste

Follow and PR httpsgithubcomtineolatineola

Stark Riedesel StarkRiedeselsynopsyscom httpsfindtheninja

Parsia Hakimian ParsiaHakimiansynopsyscom httpsparsiyanet

Travis Biehn TravisBiehnsynopsyscom

Koen Buyens KoenBuyenssynopsyscom httpskoenbuyensorg

Thank You

Page 30: Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian,

copy 2018 Synopsys Inc 30

Get Your Own Taste

Follow and PR httpsgithubcomtineolatineola

Stark Riedesel StarkRiedeselsynopsyscom httpsfindtheninja

Parsia Hakimian ParsiaHakimiansynopsyscom httpsparsiyanet

Travis Biehn TravisBiehnsynopsyscom

Koen Buyens KoenBuyenssynopsyscom httpskoenbuyensorg

Thank You

Page 31: Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian,

Thank You

Page 32: Tineola: Taking A Bite Out of Enterprise Blockchain › DEF CON 26 › DEF CON 26... · Tineola: Taking A Bite Out of Enterprise Blockchain Attacking HyperLedger Fabric Parsia Hakimian,