Quote from: someguy123 on August 30, 2015, 04:27:50 PM

Quote from: lyco on August 30, 2015, 03:49:13 PM

Quote from: ndnhc on August 30, 2015, 03:41:49 PM

Quote from: lyco on August 30, 2015, 01:43:36 PM

troubleshooting target: fountain (for abuse potential)
exploit found: captcha bypass assuming 0 balance

with any of the three adblock extensions enabled, captcha is checked after simply clicking (no selecting images) so long as balance is 0 - this enables me to use autokey (autohotkey on windows) to continually through automated click-events, claim 500 satoshi and bet it at an absurd multiplier until i essentially steal 55k satoshi by recording a few mouse click events and retiring to the opium den until autokey alerts me that i've succeeded in ripping off your fountain.

http://i.imgur.com/NtI5OnC.png

(difficult to take a screen of something NOT happening, but all i have to do is click the human verification and it accepts as if i had completed a captcha, then allows me to claim)

note that once the balance is over 0 the captcha modal window does appear and does not award additional coin upon completion. it simply allows for an automation scheme if the user bets all 500 satoshi at 1% odds / 99x multiplier.

software tech specs: debian-ish linux running chromium/webkit-based browser using stock adblock plus extension out of chrome app store

ok!

- Lyco / user "harlequence" on magicaldice
- Joshua Ryan Nydel - nydel at ma dot sdf dot org for mail

That is with reCaptcha. That is completely not related to the site. Cool

Oh wow, this is necessary? Ok:

While aware that a third-party captcha service is being used, the site's design to award 500 satoshi to anyone with a balance of 0 presents a unique risk.

Since the third-party service is in fact very much related to the site, and the exploit cannot happen without the site's design in relation to the captcha service's problem, we are left with two options:

1) Do something to make sure nobody's using this exploit.
2) Tell Lyco that this is an issue "completely not related to this site" and make him write this, then do #1 anyway.

ok!

- Lyco / user "harlequence" on magicdice
- Joshua Ryan Nydel - nydel at ma dot sdf dot org for mail

This is because of Google linking you to your google account. Honestly you can't do much with that anyway. You can't withdraw those 500 satoshis, and if you can't get more until your balance hits 0, then it's not exactly helping you any more than an annoying full validation captcha would.

my preliminary model of a malciious person's autokey script is set to claim the fountain's 500 satoshi then bet it at 1% until it wins twice in a row.

this would total 0.04900500 BTC.

it can complete the first bet around 6 times per minute - though i estimate that rate could be near doubled on a dedicated machine - and a malicious person's otherwise-idle laptop(s) -- not a malicious person, but simply their otherwise-idle laptop -- could run it all day, every day, for as long as you guys are online.

with no offense meant whatsoever, i honestly cannot tell if you simply don't understand the severity of this exploit, or if rather you think that the exploit's ingenuity renders it too unlikely to pose a threat, or if you simply don't want to acknowledge my work in order to avoid paying bounty. regardless, i signed on to answer a distress call & take an opportunity to ethically utilize my expertise in the field, and i simply don't do half-ass jobs. you have a very serious exploit that involves an opportunity for a determined person to take money directly from your organization with no consequences, and i'm the one who noticed it, so it's my obligation to do this:

proposed methods of prevention

intended to stop the exploit before it has time to yield results:

method 01: put a time restriction on fountain queries.
detail: the most efficient implementation of this theory starts with a 15 second clock and doubles the countdown timer length every time a claim is made in less than double the current countdown time.
advantages: completely disable the exploit
disadvantages: threaded timer processes could stress resources or even allow for a special type of organized attack - the odds of this are close to negligible, and the consequences would simply be a slowdown in the site's performance or at theoretical worst a bandwidth overload.

method 02: periodically scan for 500 satoshi bets at odds percentages under 05.
detail: every 15 minutes, scan the bet database's appended entries for bets that meet these criteria: a) amount is less than 501 satoshi b) odds are equal to or below 5% - next the results matching criteria a & b count the userid column for repeats. any user appearing in the result list over 50 times (arrived at this figure assuming ~3 to 4 bets per minute) is flagged as using the exploit then dealt with accordingly (account disabled, either permanently or perhaps for 60 minutes in the case that the criteria leave any room for mistake).
advantages: organization is likely to successfully hide from the exploit indefinitely, and save on computer power usage as compared with that of method one
disadvantages: allows users to run the exploit at a slower speed with no consequences.

i would recommend the first method or a combination of the two over the second method by itself. ignoring the exploit is indeed a third option, but i think my obligation ends just before a blitzkrieg attempt at making sure it's understood how dangerous that is.

let me know if there's anything else/anything i can do to help further/help!.

ok!

- Lyco / user "harlequence" on magicaldice
- Joshua Ryan Nydel - nydel at ma dot sdf dot org for mail