Racing crypto exchanges, or how I manipulated the balances

1. Racing crypto
exchanges, or how I
manipulated the
balances
Vahagn (@vah_13) Vardanian,
Старший специалист
Группа исследований безопасности банковских систем
Positive Technologies

2. phdays.com #PHDays
The first bounty
Open Redirect
Duplicate
0.5 BTC ~ 100$

3. phdays.com #PHDays
Stories of hacked exchanges
GateHub
Bitrue
Bitpoint
VinDAX
Upbit
Altsbit
Bithumb
DragonEx
CoinBene
Coinbin
Cryptopia
Cryptopia
QuadrigaCX
…

4. phdays.com #PHDays
How?

5. phdays.com #PHDays
The ways to hack
1) Insider
2) Vulnerability at 3th party app
3) Smart contracts
4) Custom code

6. phdays.com #PHDays
The ways to hack
1) Insider
2) Vulnerability at 3th party app
3) Smart contracts
4) Custom code

7. phdays.com #PHDays
What should I look for?
XSS?
SQL inj?
SSTI?
???

8. phdays.com #PHDays
What should I look for?
XSS?
SQL inj?
SSTI?
???
Logic bugs

9. phdays.com #PHDays
Race condition
https://bo0om.ru/race-condition-ru [RU]
https://lab.wallarm.com/race-condition-in-web-applications/ [EN]

10. phdays.com #PHDays
Scope and Tools
- TOP 100* crypto exchanges
- Burp turbo intruder
- 100$ in LTC and DOGE (lol)

11. phdays.com #PHDays
New product/service

12. phdays.com #PHDays
Binance transfer

13. phdays.com #PHDays
Binance internal transfer

14. phdays.com #PHDays
4 Common logic bugs

15. phdays.com #PHDays
SnapEx
Sum: 100 USD
CRYPTO EXCHANGE
Buy 100 BTC at 1 USD = 1 BTC
ORDER BOOK buy/sell

16. phdays.com #PHDays
SnapEx
Sum: 100 USD
CRYPTO EXCHANGE
ORDER BOOK buy/sell
Buy 100 BTC at 1 USD = 1 BTC
Buy 100 BTC at 1 USD = 1 BTC

17. phdays.com #PHDays
SnapEx

18. phdays.com #PHDays
Exchange #2
Sum: 100 USD
Promocode_#1 100 USD
Promo codes
CRYPTO EXCHANGE

19. phdays.com #PHDays
Exchange #2
Sum: 100 USD
Promocode_#1 100 USD
Promo codes
CRYPTO EXCHANGE

20. phdays.com #PHDays
Exchange #2
Sum: 100 USD
Promocode_#1 50 USD
Promo codes
CRYPTO EXCHANGE
Promocode_#2 50 USD

21. phdays.com #PHDays
Exchange #2

22. phdays.com #PHDays
Exchange #3
Sum: 2 ETH
CRYPTO EXCHANGE

23. phdays.com #PHDays
Exchange #3

24. phdays.com #PHDays
Exchange #4
Sum: 2 ETH
CRYPTO EXCHANGE

25. phdays.com #PHDays
Exchange #4
Sum: 2 ETH
CRYPTO EXCHANGE

26. phdays.com #PHDays
Exchange #4

27. phdays.com #PHDays
Exchange #4

28. phdays.com #PHDays
Conclusion
~25% of exchanges* has a race condition
~80% possible to steal the amount or manipulate balance

29. Спасибо за внимание!
phdays.com