Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Attacker can DDOS a regular node with invalid item hashes #148

Open
7 tasks
gladcow opened this issue Sep 24, 2019 · 0 comments
Open
7 tasks

Attacker can DDOS a regular node with invalid item hashes #148

gladcow opened this issue Sep 24, 2019 · 0 comments
Assignees
Labels
enhancement New feature or request

Comments

@gladcow
Copy link

gladcow commented Sep 24, 2019

Bug Description
Attacker or buggy node can send a lot of incorrect item hashes before it is disconnected, and attacked node will request other peers this items in spite of the fact that the first peer was recognized as unsafe source of information and disconnected.

Porting from Bitshares or other Graphene forks
Corresponding PR:
- bitshares/bitshares-core#1007

Impacts
Describe which portion(s) of Peerplays may be impacted by this bug. Please tick at least one box.

  • API (the application programming interface)
  • Build (the build process or something prior to compiled code)
  • CLI (the command line wallet)
  • Deployment (the deployment process after building such as Docker, Gitlab, etc.)
  • [*] P2P (the peer-to-peer network for transaction/block propagation)
  • [*] Performance (system or user efficiency, etc.)
  • Protocol (the blockchain logic, consensus, validation, etc.)
  • [*] Security (the security of system or user data, etc.)
  • UX (the User Experience)
  • Other (please add below)

Steps To Reproduce
To reproduce this bug you need to create and start the node that emulate attacker logic. This attacker node should send a lot of blocks with invalid item hashes, attacked node should disconnect it but it should request this invalid items from other peers.

Expected Behavior
Attacked node should not request from its other peers invalid items received from disconnected attacker .

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants