DEF CON 29 - Hao Xing, Zekai Wu - How I use a JSON 0day to Steal Your Money on the Blockchain

Fastjson is a widely used open source JSON parser with 23'100 stars on GitHub. As a basic module of countless java web services, it serves hundreds of millions of users. We managed to find a way to bypass many security checks and mitigations by using the inheritance process of some basic classes, and achieve remote code execution successfully. We will disclose these high-risk and universal gadgets for the first time in this talk.

Now, we can control many important websites and affect millions of users. Let's make things more interesting. We found that this fastjson vulnerability affect a multi-billion-dollar blockchain. We designed multiple complex gadgets based on the features of the blockchain, and exquisitely achieved information leakage and pointer hijacking. Putting all these gadgets together, we achieved remote code execution on the blockchain nodes.

However, generally after remote code execution, we seem to have no better exploit method other than the 51% attack, which will lead to serious accounting confusion. After a detailed analysis of the architecture design of the public blockchain, we found a way from RCE to steal the public blockchain users' assets almost without any notification.

To the best of our knowledge, this is the first published attack case on the realization of covertly stealing user assets after RCE on the public blockchain nodes. We will propose a more covert post penetration exploit method for public blockchain nodes in this talk.

Blockchain is not bulletproof to security vulnerability. We will show you how to use classical web vulnerabilities attack the blockchain and how to steal real money from the decentralized cyber world.

REFERENCES:

[icurtispe]

Some close captions will help in the future.

[SourceCodeDeleted]

I think it is fine. I am a foreigner though.
There are words which don't make sense, but the presentation is understandable.

He did well . I liked this presentation. Now, let's talk about the presentation and stop focusing on his accent. )

[AreWeLearningYet]

Pretty rough listen but it's just a wallet exploit at the point of transaction with a brief mention of blockchains for no real reason other than to insinuate a more systemic vulnerability they never go into.

[endrefasong]

This is not parseable to me, sadly. Please supply captions, they are clearly reading so should be doable.

[Kevinsmithns]

Can someone explain what's going on? Possibly make another video using the same tools to show? Looks very interesting

[rhinofart]

I slowed the video to 0.75 and it was easier to understand what he was saying.