Skip to content
This repository has been archived by the owner on Aug 2, 2022. It is now read-only.

(updateauth, urgent) M to N mapping among key pairs accounts #4030

Closed
jeaimetu opened this issue Jun 11, 2018 · 16 comments
Closed

(updateauth, urgent) M to N mapping among key pairs accounts #4030

jeaimetu opened this issue Jun 11, 2018 · 16 comments

Comments

@jeaimetu
Copy link

Hi, I am not sure what is the root cause of this(snapshot tool or any other issue?)

Pre-condition : one of account uses nano ledger which is connected to MEW.

expected result : he can login to scatter with his EOS pub/private key pair and account name which are exactly same, comparing to search result from eosauthority.com.

On his registration before genesis snapshot, he received EOS pub/private key pair. So what he want is using that pair as others did. Even he had key pairs, it did not work due to mixed mapping.(explained as follows) As far as I heard, he has no fault on process.

Actual result :
He could not login and logs are as follows.
image
I do not know why eosio account change permission with eosio - updateauth log. I think there are mapping issue among accounts and key pairs. I intentionally expose account because it is public. If this is issue, then please let me know. I will remove that account. But without account name, there is no way to check this detail

details :

please check followings. They are very strange.

1. EOSAuthority with MEW public key
image

EOS public key starts with EOS7.... and account is "guzdonzugmge"

2. eosFlare.io with account name
image

still fine. Next we can see very weird things.

3. eosFlare.io with EOS public key
image

no associated account???

  1. eosFlare.io with other address (founded from https://toolkit.genereos.io/tools, on searching, result varies)image

there are four accounts with A key pair. Only one is his account name.

According to 4, there are 1 to 4 mapping between key pairs and accounts,
Also according to 1, 4, for account name "guzdonzugmge", there are 2 to 1 mapping between key pairs and accounts.

Thus, there are m to n mapping between key pairs and accounts (n, m >= 0, integer)
@arhag
Copy link
Contributor

arhag commented Jun 11, 2018

The registered key of the guzdonzugmge was EOS7x8pKfDqWUx6Ud2vsYu3b6NaE2xk2eHn84Nx1ZzHmcSk29ZJhL.

Then in block 15185, there was a transaction which changed the account's owner key to EOS8MiJQ5jsPmAiDMUCEkaemxvq5QE5ppc7ZDfuNgsc9ZY8bfp96k:

$ ./cleos get transaction 7076995451f399c5604927dea37ba6116420237ce9a361fd975b9b6b0396b065
{
  "id": "7076995451f399c5604927dea37ba6116420237ce9a361fd975b9b6b0396b065",
  "trx": {
    "receipt": {
      "status": "executed",
      "cpu_usage_us": 603,
      "net_usage_words": 20,
      "trx": [
        1,{
          "signatures": [
            "SIG_K1_KZd2X8CpentC6YaoVfAC8tz1i9HQ8PYNekyy82JCXDxBWDgdx9neujUTjq5BmDELXMduSTiHTjBYVsfcpusbbBLqm8EMLX"
          ],
          "compression": "none",
          "packed_context_free_data": "",
          "packed_trx": "11221d5b273be27cd71700000000010000000000ea30550040cbdaa86c52d501a09864fa4f9abe660000000080ab26a743a09864fa4f9abe660000000080ab26a7000000000000000001000000010003c8e6e656c7317d77228a18c57e8131119fddc8aeb3930dea4633cbb3d686aae20100000000"
        }
      ]
    },
    "trx": {
      "expiration": "2018-06-10T13:05:21",
      "ref_block_num": 15143,
      "ref_block_prefix": 399998178,
      "max_net_usage_words": 0,
      "max_cpu_usage_ms": 0,
      "delay_sec": 0,
      "context_free_actions": [],
      "actions": [{
          "account": "eosio",
          "name": "updateauth",
          "authorization": [{
              "actor": "guzdonzugmge",
              "permission": "owner"
            }
          ],
          "data": {
            "account": "guzdonzugmge",
            "permission": "owner",
            "parent": "",
            "auth": {
              "threshold": 1,
              "keys": [{
                  "key": "EOS8MiJQ5jsPmAiDMUCEkaemxvq5QE5ppc7ZDfuNgsc9ZY8bfp96k",
                  "weight": 1
                }
              ],
              "accounts": [],
              "waits": []
            }
          },
          "hex_data": "a09864fa4f9abe660000000080ab26a7000000000000000001000000010003c8e6e656c7317d77228a18c57e8131119fddc8aeb3930dea4633cbb3d686aae201000000"
        }
      ],
      "transaction_extensions": [],
      "signatures": [
        "SIG_K1_KZd2X8CpentC6YaoVfAC8tz1i9HQ8PYNekyy82JCXDxBWDgdx9neujUTjq5BmDELXMduSTiHTjBYVsfcpusbbBLqm8EMLX"
      ],
      "context_free_data": []
    }
  },
  "block_time": "2018-06-10T13:04:41.500",
  "block_num": 15185,
  "last_irreversible_block": 252934,
  "traces": [{
      "receipt": {
        "receiver": "eosio",
        "act_digest": "ac872affc4c684fc0fef047b2443fec04a02ccf5ca36740c43966f57a721394d",
        "global_sequence": 2495175,
        "recv_sequence": 1163121,
        "auth_sequence": [[
            "guzdonzugmge",
            1
          ]
        ],
        "code_sequence": 4,
        "abi_sequence": 5
      },
      "act": {
        "account": "eosio",
        "name": "updateauth",
        "authorization": [{
            "actor": "guzdonzugmge",
            "permission": "owner"
          }
        ],
        "data": {
          "account": "guzdonzugmge",
          "permission": "owner",
          "parent": "",
          "auth": {
            "threshold": 1,
            "keys": [{
                "key": "EOS8MiJQ5jsPmAiDMUCEkaemxvq5QE5ppc7ZDfuNgsc9ZY8bfp96k",
                "weight": 1
              }
            ],
            "accounts": [],
            "waits": []
          }
        },
        "hex_data": "a09864fa4f9abe660000000080ab26a7000000000000000001000000010003c8e6e656c7317d77228a18c57e8131119fddc8aeb3930dea4633cbb3d686aae201000000"
      },
      "elapsed": 259,
      "cpu_usage": 0,
      "console": "",
      "total_cpu_usage": 0,
      "trx_id": "7076995451f399c5604927dea37ba6116420237ce9a361fd975b9b6b0396b065",
      "inline_traces": []
    }
  ]
}

Then, in block 20252, there was a transaction which changed the account's active key to EOS8MiJQ5jsPmAiDMUCEkaemxvq5QE5ppc7ZDfuNgsc9ZY8bfp96k also:

$ ./cleos get transaction 83fb88a4687b4b4b9920e922d2f50e2d58d133b5653419be903f05b238a53f81
{
  "id": "83fb88a4687b4b4b9920e922d2f50e2d58d133b5653419be903f05b238a53f81",
  "trx": {
    "receipt": {
      "status": "executed",
      "cpu_usage_us": 566,
      "net_usage_words": 20,
      "trx": [
        1,{
          "signatures": [
            "SIG_K1_K1TUS4DRh9BtfA4hU67D15vNyXdzUnwN1ETGGhZe9W5s7jzjUnJRsdHbLZTXPVn7MVVU5B5EVgp7HBkoCVBampyBS8CiMr"
          ],
          "compression": "none",
          "packed_context_free_data": "",
          "packed_trx": "01301d5b5f3b8fd544e900000000010000000000ea30550040cbdaa86c52d501a09864fa4f9abe6600000000a8ed323243a09864fa4f9abe6600000000a8ed32320000000080ab26a701000000010003c8e6e656c7317d77228a18c57e8131119fddc8aeb3930dea4633cbb3d686aae20100000000"
        }
      ]
    },
    "trx": {
      "expiration": "2018-06-10T14:04:49",
      "ref_block_num": 15199,
      "ref_block_prefix": 3913602447,
      "max_net_usage_words": 0,
      "max_cpu_usage_ms": 0,
      "delay_sec": 0,
      "context_free_actions": [],
      "actions": [{
          "account": "eosio",
          "name": "updateauth",
          "authorization": [{
              "actor": "guzdonzugmge",
              "permission": "active"
            }
          ],
          "data": {
            "account": "guzdonzugmge",
            "permission": "active",
            "parent": "owner",
            "auth": {
              "threshold": 1,
              "keys": [{
                  "key": "EOS8MiJQ5jsPmAiDMUCEkaemxvq5QE5ppc7ZDfuNgsc9ZY8bfp96k",
                  "weight": 1
                }
              ],
              "accounts": [],
              "waits": []
            }
          },
          "hex_data": "a09864fa4f9abe6600000000a8ed32320000000080ab26a701000000010003c8e6e656c7317d77228a18c57e8131119fddc8aeb3930dea4633cbb3d686aae201000000"
        }
      ],
      "transaction_extensions": [],
      "signatures": [
        "SIG_K1_K1TUS4DRh9BtfA4hU67D15vNyXdzUnwN1ETGGhZe9W5s7jzjUnJRsdHbLZTXPVn7MVVU5B5EVgp7HBkoCVBampyBS8CiMr"
      ],
      "context_free_data": []
    }
  },
  "block_time": "2018-06-10T13:46:55.000",
  "block_num": 20252,
  "last_irreversible_block": 253211,
  "traces": [{
      "receipt": {
        "receiver": "eosio",
        "act_digest": "0bdff89795681956c903a865050d6f4a428897fa54dc2fb32d9baa39b8fb3781",
        "global_sequence": 2510568,
        "recv_sequence": 1171343,
        "auth_sequence": [[
            "guzdonzugmge",
            2
          ]
        ],
        "code_sequence": 4,
        "abi_sequence": 5
      },
      "act": {
        "account": "eosio",
        "name": "updateauth",
        "authorization": [{
            "actor": "guzdonzugmge",
            "permission": "active"
          }
        ],
        "data": {
          "account": "guzdonzugmge",
          "permission": "active",
          "parent": "owner",
          "auth": {
            "threshold": 1,
            "keys": [{
                "key": "EOS8MiJQ5jsPmAiDMUCEkaemxvq5QE5ppc7ZDfuNgsc9ZY8bfp96k",
                "weight": 1
              }
            ],
            "accounts": [],
            "waits": []
          }
        },
        "hex_data": "a09864fa4f9abe6600000000a8ed32320000000080ab26a701000000010003c8e6e656c7317d77228a18c57e8131119fddc8aeb3930dea4633cbb3d686aae201000000"
      },
      "elapsed": 257,
      "cpu_usage": 0,
      "console": "",
      "total_cpu_usage": 0,
      "trx_id": "83fb88a4687b4b4b9920e922d2f50e2d58d133b5653419be903f05b238a53f81",
      "inline_traces": []
    }
  ]
}

If neither of these transactions were signed by the legitimate owner of guzdonzugmge, then that is evidence that the private key corresponding to their registered public key (EOS7x8pKfDqWUx6Ud2vsYu3b6NaE2xk2eHn84Nx1ZzHmcSk29ZJhL) was compromised.

Later on, in block 49312, the active key of the account was changed again, this time to EOS6g7Je7nEZANZFMUur9ib3gF2fKkiDeS5eKWrexgRiHPq1KAzis:

$ ./cleos get transaction 65a0c2468b27a05f4b94062732a4bb0b3c1e328785c35a98a5b156b94cb88913
{
  "id": "65a0c2468b27a05f4b94062732a4bb0b3c1e328785c35a98a5b156b94cb88913",
  "trx": {
    "receipt": {
      "status": "executed",
      "cpu_usage_us": 823,
      "net_usage_words": 20,
      "trx": [
        1,{
          "signatures": [
            "SIG_K1_Kh5QnUkzcsE9fqeXNxhNNrifuEhgKn6y1mC6D3sqLyqBHSBHwk1CEuPfVHtih4ajdPEEnxYTFvBKWwLU9TAuL3MV82UaPG"
          ],
          "compression": "none",
          "packed_context_free_data": "",
          "packed_trx": "ae641d5b9dc093cfadb700000000010000000000ea30550040cbdaa86c52d501a09864fa4f9abe6600000000a8ed323243a09864fa4f9abe6600000000a8ed32320000000080ab26a701000000010002eb48136799673de1aa9c7d3d849ef818a29dbe84ea3ee10f00e72f95655f89590100000000"
        }
      ]
    },
    "trx": {
      "expiration": "2018-06-10T17:49:34",
      "ref_block_num": 49309,
      "ref_block_prefix": 3081621395,
      "max_net_usage_words": 0,
      "max_cpu_usage_ms": 0,
      "delay_sec": 0,
      "context_free_actions": [],
      "actions": [{
          "account": "eosio",
          "name": "updateauth",
          "authorization": [{
              "actor": "guzdonzugmge",
              "permission": "active"
            }
          ],
          "data": {
            "account": "guzdonzugmge",
            "permission": "active",
            "parent": "owner",
            "auth": {
              "threshold": 1,
              "keys": [{
                  "key": "EOS6g7Je7nEZANZFMUur9ib3gF2fKkiDeS5eKWrexgRiHPq1KAzis",
                  "weight": 1
                }
              ],
              "accounts": [],
              "waits": []
            }
          },
          "hex_data": "a09864fa4f9abe6600000000a8ed32320000000080ab26a701000000010002eb48136799673de1aa9c7d3d849ef818a29dbe84ea3ee10f00e72f95655f895901000000"
        }
      ],
      "transaction_extensions": [],
      "signatures": [
        "SIG_K1_Kh5QnUkzcsE9fqeXNxhNNrifuEhgKn6y1mC6D3sqLyqBHSBHwk1CEuPfVHtih4ajdPEEnxYTFvBKWwLU9TAuL3MV82UaPG"
      ],
      "context_free_data": []
    }
  },
  "block_time": "2018-06-10T17:49:05.000",
  "block_num": 49312,
  "last_irreversible_block": 253556,
  "traces": [{
      "receipt": {
        "receiver": "eosio",
        "act_digest": "0ed75652ab863557cc47209b8df04c036abefb65a4856aa390fe1321142a7463",
        "global_sequence": 2563750,
        "recv_sequence": 1210849,
        "auth_sequence": [[
            "guzdonzugmge",
            3
          ]
        ],
        "code_sequence": 4,
        "abi_sequence": 5
      },
      "act": {
        "account": "eosio",
        "name": "updateauth",
        "authorization": [{
            "actor": "guzdonzugmge",
            "permission": "active"
          }
        ],
        "data": {
          "account": "guzdonzugmge",
          "permission": "active",
          "parent": "owner",
          "auth": {
            "threshold": 1,
            "keys": [{
                "key": "EOS6g7Je7nEZANZFMUur9ib3gF2fKkiDeS5eKWrexgRiHPq1KAzis",
                "weight": 1
              }
            ],
            "accounts": [],
            "waits": []
          }
        },
        "hex_data": "a09864fa4f9abe6600000000a8ed32320000000080ab26a701000000010002eb48136799673de1aa9c7d3d849ef818a29dbe84ea3ee10f00e72f95655f895901000000"
      },
      "elapsed": 251,
      "cpu_usage": 0,
      "console": "",
      "total_cpu_usage": 0,
      "trx_id": "65a0c2468b27a05f4b94062732a4bb0b3c1e328785c35a98a5b156b94cb88913",
      "inline_traces": []
    }
  ]
}

And in block 49575, the owner key of the account was also changed to EOS6g7Je7nEZANZFMUur9ib3gF2fKkiDeS5eKWrexgRiHPq1KAzis:

$ ./cleos get transaction df947a917b94cd048b80aa32890475f066ea6d29f0fecc089185cf60db3affe9
{
  "id": "df947a917b94cd048b80aa32890475f066ea6d29f0fecc089185cf60db3affe9",
  "trx": {
    "receipt": {
      "status": "executed",
      "cpu_usage_us": 677,
      "net_usage_words": 20,
      "trx": [
        1,{
          "signatures": [
            "SIG_K1_Ka8TQkHjP6KD5EZXANdCkZYjEVL9L3fcs2GisUwgwHxACmEwAAyS5ynP3h5yFpznKeMueLtujWCnBZxX54iZNMFu5yVn9o"
          ],
          "compression": "none",
          "packed_context_free_data": "",
          "packed_trx": "32651d5ba5c15045915e00000000010000000000ea30550040cbdaa86c52d501a09864fa4f9abe660000000080ab26a743a09864fa4f9abe660000000080ab26a7000000000000000001000000010002eb48136799673de1aa9c7d3d849ef818a29dbe84ea3ee10f00e72f95655f89590100000000"
        }
      ]
    },
    "trx": {
      "expiration": "2018-06-10T17:51:46",
      "ref_block_num": 49573,
      "ref_block_prefix": 1586578768,
      "max_net_usage_words": 0,
      "max_cpu_usage_ms": 0,
      "delay_sec": 0,
      "context_free_actions": [],
      "actions": [{
          "account": "eosio",
          "name": "updateauth",
          "authorization": [{
              "actor": "guzdonzugmge",
              "permission": "owner"
            }
          ],
          "data": {
            "account": "guzdonzugmge",
            "permission": "owner",
            "parent": "",
            "auth": {
              "threshold": 1,
              "keys": [{
                  "key": "EOS6g7Je7nEZANZFMUur9ib3gF2fKkiDeS5eKWrexgRiHPq1KAzis",
                  "weight": 1
                }
              ],
              "accounts": [],
              "waits": []
            }
          },
          "hex_data": "a09864fa4f9abe660000000080ab26a7000000000000000001000000010002eb48136799673de1aa9c7d3d849ef818a29dbe84ea3ee10f00e72f95655f895901000000"
        }
      ],
      "transaction_extensions": [],
      "signatures": [
        "SIG_K1_Ka8TQkHjP6KD5EZXANdCkZYjEVL9L3fcs2GisUwgwHxACmEwAAyS5ynP3h5yFpznKeMueLtujWCnBZxX54iZNMFu5yVn9o"
      ],
      "context_free_data": []
    }
  },
  "block_time": "2018-06-10T17:51:16.500",
  "block_num": 49575,
  "last_irreversible_block": 253756,
  "traces": [{
      "receipt": {
        "receiver": "eosio",
        "act_digest": "18f5b901b82b4fd05c93ba4c73fc9bbffa394a8255fb016cb384c99cfa9f359b",
        "global_sequence": 2564108,
        "recv_sequence": 1211141,
        "auth_sequence": [[
            "guzdonzugmge",
            4
          ]
        ],
        "code_sequence": 4,
        "abi_sequence": 5
      },
      "act": {
        "account": "eosio",
        "name": "updateauth",
        "authorization": [{
            "actor": "guzdonzugmge",
            "permission": "owner"
          }
        ],
        "data": {
          "account": "guzdonzugmge",
          "permission": "owner",
          "parent": "",
          "auth": {
            "threshold": 1,
            "keys": [{
                "key": "EOS6g7Je7nEZANZFMUur9ib3gF2fKkiDeS5eKWrexgRiHPq1KAzis",
                "weight": 1
              }
            ],
            "accounts": [],
            "waits": []
          }
        },
        "hex_data": "a09864fa4f9abe660000000080ab26a7000000000000000001000000010002eb48136799673de1aa9c7d3d849ef818a29dbe84ea3ee10f00e72f95655f895901000000"
      },
      "elapsed": 287,
      "cpu_usage": 0,
      "console": "",
      "total_cpu_usage": 0,
      "trx_id": "df947a917b94cd048b80aa32890475f066ea6d29f0fecc089185cf60db3affe9",
      "inline_traces": []
    }
  ]
}

Has the owner of the guzdonzugmge account input the private key corresponding to EOS7x8pKfDqWUx6Ud2vsYu3b6NaE2xk2eHn84Nx1ZzHmcSk29ZJhL in any wallets, tools, or websites? If so, which ones?

A similar pattern is followed with the other three accounts: g44tqnrzgyge, gyztkojrgige, and haytanjtgige. I sincerely hope all four of these accounts originally belonged to the same person and that all these permission updates were legitimate and intentional. Otherwise, it strongly suggests (although unfortunately does not and cannot prove) that a hacker compromised their registered keys.

@SoBaD08
Copy link

SoBaD08 commented Jun 12, 2018 •
edited
Loading

Hi, I am owner of ‘guzdonzugmge‘, as far as i remember i did not expose my private key until yesterday morning(10:00 am KST). I try to use it to vote through Scatter(checked extension ID)and things went wrong. Before that since my EOS was in the hard wallet, i’ve checked my balance through MEW with my ethereum address which also is in the Hard wallet. Please let me know if you have any other questions.

@SoBaD08
Copy link

SoBaD08 commented Jun 12, 2018

One thing i don’t really understand is that my private key still pairs with my public key on some tools providing correct balance.

@arhag
Copy link
Contributor

arhag commented Jun 12, 2018

@SoBaD08: And what tool did you use to generate your original EOS public/private key pairs?

@SoBaD08
Copy link

SoBaD08 commented Jun 12, 2018 •
edited
Loading

It wasn't a tool, i've got it from EOS.io through registration process where it provides EOS public key and private key which i registered using my ethereum address. I've just checked my transaction and the first one was done on Feb 13th, 2018. The last Crowdsale participation was on March 9th, 2018. After that I bought some from Bithum and send it to my hard wallet(Nano Ledger).

@arhag
Copy link
Contributor

arhag commented Jun 12, 2018

And have you verified that when you import your private key into a wallet that it does in fact map to your original public key of EOS7x8pKfDqWUx6Ud2vsYu3b6NaE2xk2eHn84Nx1ZzHmcSk29ZJhL and not some other public key?

If you got the public/private key pair from eos.io, registered it properly, kept the private key safe, and did not ever use it until after 2018-06-10T17:51:16 UTC, then I have run out of ideas to explain how this could have happened.

Perhaps arbitration will be able to help you. Try checking out the EOS 911 Telegram. I don't know if it will help, but it is worth a shot.

@SoBaD08
Copy link

SoBaD08 commented Jun 12, 2018

Yes, here I just did it again and attached an image.
image
I did report EOS 911 already.
And I thank you very much for your help and attention.

@jeaimetu
Copy link
Author

One thing is still not clear. Even someone knows private key, how he can use signed transaction or cleos console command? If he do that, that meant he could access BPs server.

@jeaimetu
Copy link
Author

And one more original question, using cleos, someone can map same eos public key to different accounts? Is there any checking replication procedure?

Then this can happen again and this can cause same problem even though he or she does not have bad intension. Am I wrong?

@danielleiszen
Copy link

danielleiszen commented Jun 12, 2018 •
edited
Loading

Hi, I may have the same problem. Can anyone check that for me, since I am not an expert using these tools? I did not expose my private key before 11th of June. I was trying to use Scatter to vote.

The original EOS account I saved: EOS8HE9yuMyHfuMF1fciMxjJPWjsZJAozFcZ7bugefLUrUuxm2KT1
The EOS public key that has the tokens on mainnet: EOS5XgTZxkeJEUYEBPJRggsRQagTc9UTjp6yjexdhzzdEkTXoXaXk.

Thank you.

@jeaimetu
Copy link
Author

Something different case. According to log, there is no malicious action. Did you check your public key om genesis snapshot csv file?

@danielleiszen
Copy link

Yes it contains the account shown on mainnet. The account I saved is nowhere.

@JohnnyZhao
Copy link

I think there is a possibility that when you was generating EOS keys from eos.io, there was some script injection happening then. Browser extensions can easily do thing like that. Could you share the extensions you installed in your browser that you used to generate the keys?

@NghiaSE
Copy link

NghiaSE commented Jun 12, 2018 •
edited
Loading

Did you download Scatter (a Chrome extension) from the CORRECT website?

It should direct you to go to Chrome Store like this?
https://chrome.google.com/webstore/detail/scatter/ammj....jkle

Where you can see people votes, comments & how many users are there.

It's best to use tools which are open source, reviewed, audited & confirmed from a few (or at least 5 Block Producers)

@SoBaD08
Copy link

SoBaD08 commented Jun 12, 2018

@JohnnyZhao and @NghiaSE If you are asking me, I used the scatter 2 days ago for the first time and I've check the ID to make sure it is proper extension.

@jeaimetu
Copy link
Author

This is done by smartcontract which freeze EOS account. Thanks for your considerations.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
7 participants
@JohnnyZhao @danielleiszen @arhag @NghiaSE @SoBaD08 @jeaimetu and others