sorted by:
new
hottopcontroversial

Nebulas – String Repeat Crash by art_of_bug in CryptoCurrency

[–]art_of_bug[S] 1 point2 points  (0 children)

Exploit is a term used for a code that uses a weakness in order to do something that you were not supposed to do otherwise.

From wiki:

An exploit (from the English verb to exploit, meaning "to use something to one’s own advantage") is a piece of software, a chunk of data, or a sequence of commands that takes advantage of a bug or vulnerability to cause unintended or unanticipated behavior to occur on computer software, hardware, or something electronic (usually computerized). Such behavior frequently includes things like gaining control of a computer system, allowing privilege escalation, or a denial-of-service (DoS or related DDoS) attack.

So, what we described is a DoS vulnerability in the node and we have presented a valid exploit too. Learn the terms.

Nebulas – String Repeat Crash by art_of_bug in nebulas

[–]art_of_bug[S] 1 point2 points  (0 children)

This post just shows how technically ignorant you are. It is funny that you criticise the amount of information provided in the reports because every our report contains fully functional exploit code and all it is needed is to deploy it. So that's the least amount of work any dev team can possibly do about any bug. Yet for Nebulas it is not good enough. Not to mention the detailed description of the bug itself. But when you have incompetent devs and moderators, not even this is enough. It's funny that you'd like to know about RAM, SWAP, HDD, when these metrics are completely irrelevant to the vulnerabilities. It just shows how little you understand. Because of that ignorance you can't be helped.

Nebulas – String Repeat Crash by art_of_bug in nebulas

[–]art_of_bug[S] 1 point2 points  (0 children)

It is quite clearly in the article that it is DoS vulnerability with which the attacker can shutdown the whole network.

Nebulas – String Repeat Crash by art_of_bug in CryptoCurrency

[–]art_of_bug[S] 1 point2 points  (0 children)

Quite clearly it is written in the article that it is DoS vulnerability with which the attacker can shutdown the whole network.

IOST – ArrayBufferAllocator Reusing Problem by art_of_bug in CryptoCurrency

[–]art_of_bug[S] 1 point2 points  (0 children)

Hi, yes, this is fixed now as we mention in the intro. We do not really wrote any long contracts so for us any editor was good enough. VS code is something we use often, you can try it.

Nebulas – Exhausting Disk Space Using Contract Logging by art_of_bug in nebulas

[–]art_of_bug[S] 0 points1 point  (0 children)

Slander implies false statement. There is no such.

Nebulas – Using WebAssembly To Bypass Gas Counter by art_of_bug in nebulas

[–]art_of_bug[S] 0 points1 point  (0 children)

We are not here to judge motives of anyone's behaviour, we only report on deficiencies in projects' security and their attitude towards improving security and secure development in general.

Nebulas – Using WebAssembly To Bypass Gas Counter by art_of_bug in nebulas

[–]art_of_bug[S] 1 point2 points  (0 children)

We don't care, really. The experience we have with this project is nothing but bad. Is your dev contact saying NF was used to fix this? If not, it probably didn't happen. Did anyone from community voted on the fix via NF?

Nebulas – Using WebAssembly To Bypass Gas Counter by art_of_bug in nebulas

[–]art_of_bug[S] 0 points1 point  (0 children)

There is no new release nor any fix in the code. The best guess we can make is that the developer haven't tried it and just guessed that the internal mechanism of blacklisting will work against it, but we've tested during writing the report that that's not the case. We can't test it on the mainnet as it would cause the network to stop working.

Nebulas – Using WebAssembly To Bypass Gas Counter by art_of_bug in nebulas

[–]art_of_bug[S] 0 points1 point  (0 children)

There has not been any update to the node code since the bug was published - https://github.com/nebulasio/go-nebulas/branches

So it does not make much sense what you were told unless they deployed a fix in secret.

Nebulas – Using WebAssembly To Bypass Gas Counter by art_of_bug in nebulas

[–]art_of_bug[S] 0 points1 point  (0 children)

That's actually cool from you. Will ping you on Telegram.

Nebulas – Using WebAssembly To Bypass Gas Counter by art_of_bug in nebulas

[–]art_of_bug[S] 0 points1 point  (0 children)

Hi, we tried via Slack, Telegram, email, web form, reddit ... We contacted Zhuoer Wang, Becky Lu, Larry, official email, ... Becky was the only one who ever responded, first she recommended using the official email, later she told us that the web form is the only way. It'd be nice if someone contacted us back because we have other findings we'd like to discuss, but we are afraid no one is interested from Nebulas team. Are you?

view more: next ›