search

ethereum / staking-deposit-cli

Secure key generation for deposits
Creative Commons Zero v1.0 Universal
545 stars 347 forks source link

[ToB Audit] #6: Passwords are accessible via shell history (if passed in as arguments) #102

Open CarlBeek opened 4 years ago

CarlBeek commented 4 years ago

Description

The deposit CLI tool allows passwords to be supplied as command-line arguments, enabling password leakage through operating systems, such as terminal shell history and execution of ps or similar commands.

The tool allows specification of a password through command-line arguments:

$ python3 ./eth2deposit/deposit.py --password="mypassword"

However, while accessing the shell history in a terminal window, the password is leaked in plaintext:

516 python3 ./eth2deposit/deposit.py --password="mypassword"
517 bash history

Exploit Scenario

Alice uses the Deposit-CLI to generate secret keys on her machine with a command line argument --password='12345'. An attacker, Eve gains access to Alice’s machine and looks through previously run commands on the terminal and finds the password used to secure the BLS signing key. In combination with #98, Eve also has access to the sensitive keys stored in the files.

Recommendation

Short term, do not allow users to use the command line argument to specify passwords. Long term, minimize the usage of sensitive information and ensure secrets are not exposed via operating system logs.

reiven commented 4 years ago

pro tip: If you start any shell command with and space, it will not be saved in history