Ethereum Smart Contract Backdoored Using Malicious Constructor

[@TheMonKeyballzz]

Watching your channel long enough to understand some of it.

[@pa_ljubinko]

I understand right about nothing, but yeah very cool lol

[@GRBtutorials]

I do kind of understand it, but I have no idea of exactly what smart contracts are used for! And I've watched his other video and searched it on Google, but all I understood is that they're some kind of executable made with yet another programming language, which are somehow used to enforce contracts.

[@zoxomonocovo]

@@GRBtutorials You can use it for pretty much transferring anything you want. Like if you want your own version of a crowdfunding website deployed on the ethereum blockchain, then you can develop a smart contract that essentially handles the back-end of that web app. There are countless things you can make using smart contacts, like voting systems, ether transfer systems to handle more than one-to-one relationships and lottery systems. It's essentially good if you want a smart contract to store a whole bunch of ether accounts, and run some kind of operation , and eventually, end up transferring ether between one account to another. If we know the software beforehand and everyone can trust the integrity of it, then it will make for safer transactions, knowing that your ether is being transferred to the right accounts. Hope that kind of explains a bit into what you can do, I'm not really good at explaining things ahaha.

[@kinositajona]

This was a very well made video explaining the issue. I think some of the prerequisite information is missing though, but since I have that info this video was very easy to understand for me. However, to be honest, any contract that has assembly embedded into it should immediately raise red flags, so damage is minimized... and I would be much more interested into the different historical vulns that were found in plain old solidity contracts (Like smart contract re-entrance bugs etc.) and things like the parity multi-sig contract bug. It's cool to learn about certain CTFs, but I find learning about actual vulns that were abused in the wild on blockchains are great because no one can hide the history of the exploit, the stack trace is literally set in stone in the blockchain forever, you can see the money getting stolen, and how the EVM came to that conclusion. Whereas a company who was hacked will of course cover up any trace of them being in the wrong. A few blockchain based vulns I think you'd reeeeally like to look into (I can help if you have questions): 1. the blockchain.info bitcoin wallet bug that caused users to generate the same private keys as other users. (there are multiple instances of this happening, and each bug is different) 2. "The DAO" contract bug that caused the hard fork of ETH and ETC when ETC people said "we don't believe you should reimburse the investors" 3. Parity multi-sig bug. 4. Bitcoin "out-of-thin-air" bug where miners could generate as many bitcoins as they wanted. (CVE-2018-17144) (Great hackernoon article by Jimmy Song) I have started sharing your smart contract videos with my blockchain dev friends and they really like your style of explanation. Keep up the good work.

[@mntvl4419]

Yupp, exactly. Took the words out of my mouth. Couldn't have said it better myself....lol 😅🖥

[@junuhunuproductions]

Thx for the info man

[@jenusdy]

brain.exe has stopped working

[@PwnFunction]

I agree.

[@seditt5146]

if(Input_LSD == true) Brain.Reboot();

[@seditt5146]

@hextakatt I like being explicit in my code ;)

[@aidan3994]

Ah finally, I've been waiting for this one. Thanks.

[@_DeProgrammer]

this is my new favourite channel. glad I found you!

[@andreujuanc]

You should really do more evm explainers. I learn so much from these videos.

[@BlackHermit]

Another excellent video, Bolchoseth. Your explanations are extremely helpful.

[@小张同学-v6i]

thank you, now i understand not to make fun of my assembly language instructor in college

[@hamishmcallister2503]

I'm curious if there is anyone else watching this that honestly has very little idea what's going on? I find these videos really interesting and educational, but I know that a lot of it goes over my head because I simply don't know much when it comes to this sort of stuff. Can anyone else relate?

[@LiveOverflow]

I sometimes rewatch old videos of mine and also don't understand them anymore. This stuff is sometimes complicated and requires real focused study and concentration. So don't worry :) I'm sure you will remember some things and you develop an intuition that helps you in other areas.

[@nicoleaudi759]

I can definitely relate to that, most of these videos don't make sense to me either. I just try to pick apart what I do and don't know, and use what I don't as motivation to learn more

[@billigerfusel]

Don't worry. You're not the only one who doesn't know shit what is going on.

[@007order007]

I have decent technical knowledge but he lost me after 30 seconds in :(

[@martinsandoval8729]

Don't worry is not stupidity what you're experiencing, is lack of knowledge and practice, often mathematicians that go on vacations work double so they don't forget everything, being smart is a constant effort, and this fake belief that developers and programmers and "hackers" are coding all-knowing savant's is nothing but a fart in a flask, a really stupid thing to do. Study two hours a day in this subject , blockchain, bitcoin, smart contracts, P2P, hashing, descentralized systems, and in 3 months you will not feel like you're lost in the clouds. And remember that Nothing that worth something is easy.

[@sergejgolac6303]

Are you planning to continue your I:ONIK hub router thing research? I really liked that.

[@eeesmit]

Take a look on EthereumJ, it allow you look into contracts variables storage. Very cool! But for old contracts you need full sync!

[@strawbryminiwheats]

this is great

[@kbhasi]

Before watching this video, I thought Ethereum worked the same way as Bitcoin.

[@dekrain]

Well, Ethereum and Bitcoin are implementations of cryptocurrencies and have their own architecture of smart contracts.

[@dekrain]

And before RealWorld CTF vids I also didn't know about those smart contracts.

[@teggor]

Bitcoin is engeneered to mostly do only transactions of coins. Ethereum on the other hand is more like a distributed backend for Smart Contracts and therefore is designed on executing these contracts which can control and regulate all kind of transactions. Want to make a own token with your own distribution rules? Controlled by the Ethereum blockchain unchangable until eternity? That is what Ethereum can do.

[@gabrielleme00]

Hello, my long lost cousin

[@ЛюбовьАнтипенко-л3ц]

Awesome for understanding the difference between runtime and dependent code Except I don't understand where is the CREATE or CREATE2? The value returned by RETURN(start_offset, end_offeset) seems like an input for them

[@xdcountry]

So what measures should smart contracts in general, deploy or adhere to in order to push back at this attack technique/vector. Always amazing stuff dude-- I love it.

[@cryptovj552]

Hi how to check the tron smart contract has backdoor or not? Also please tell once the contract is deployed a developer can modify or add backdoor on the contract?

[@UPMotion]

Ah nice, another part

[@t2smoothy]

How long it took you to be this good or acquire this amount of knowledge and skill

[@ali-azizimayer-peters6686]

Amazing like every Video your channel is really a nice gift to mankind. One of the best and most informative chans in KZbin. Its nice how compact and compressed your Videos are... No bullshit, just pure Knowledge and Information. Did you also some ICS and SCADA-Stuff ? Have you already knowledge in this field ? Seems to be interesting and a important skill for the Future. And maybe a cool Topic to make a video-series from, even when much stuff goes deep into producer-specific hardware for example Siemens S7 or Beckhoff-Stuff maybe also total customized controlsystems. It was stuxnet, what me impressed so much on this. It is so fascinating, interesting and also a little bit scary ;) Greetings Hotwire

[@egrinant2]

I have RE knowledge and I have mixed feelings, by the way you explained the challenge seems easy to solve, but I know first hand that it's not. BTW that debugger is awesome.

[@DonnieDeponte]

Appreciate the detailed breakdown! Could you help me with something unrelated: I have a SafePal wallet with USDT, and I have the seed phrase. (alarm fetch churn bridge exercise tape speak race clerk couch crater letter). How should I go about transferring them to Binance?

[@lunafoxfire]

Wow this is surprisingly simple... Makes me wonder how this stuff ends up in code in the first place. You'd think somebody would look at that during a code review and go "HMMMMMMM"

[@2LZA3EEM]

Nice video 👌👌

[@betazero5363]

A video about Ghidra can be interesting !!

[@ommie7002]

can someone explain what is the 61 and 60 is for and how to calculate the c7? itried to recreate it but it keeps failing, since the length from the contract that i test, is not 12a, thank you

[@ommie7002]

i know 60 is the opcode of push1 it means pushing 1byte value hence the c7 61 is the opcode of push2 it means pushing 2byte value hence the 012a and c7 is is the total byte from our deployed evil contract to c0, that is : 5b, 61, 01, 2a, 60, c7, and f3 i still fail recreate it though, but hey, i learn something

[@jaany]

1:50 where did the e go? :o

[@larva5606]

All scriptkiddies need to watch this and then see if they still feel like “hackers”. 😆

[@harjitsingh7308]

I study cyber security (with a strong focus on cryptography) and some parts of this stumbled me. I guess because i focus more on the maths than programming. But this was an interesting video regardless and i understand 80% of what was done 😁 point is it doesn't matter if you're a scriptkiddie this was a difficult task that could throw anybody off

[@westernvibes1267]

Wow a cool hacker.

[@ahaquer153]

@DJ Pyhoma funniest shit I've read today sir

[@II-um4lo]

it's for ETH or ETH and ETC??

[@fahamjv9318]

This video uploaded 1 hour ago , but i see the Christmas icon for edit cookie extension . is that another video ?

[@LiveOverflow]

I have edited this video in december ;)

[@KadiNamamato]

Great, more videos about blockchain please:)

[@soneomeelse]

So basically, EVM runs a user provided hex string as opcode ? : /

[@houba1263]

Well i need to learn assembly asap ..

[@superjugy]

But why would you ever put assembly with a jump in your "good" constructor anyway?

[@LiveOverflow]

Because you want to backdoor your contract. You want that people think it’s good, so you can then abuse it as the author.

[@superjugy]

@@LiveOverflow I see, but would a third party able to abuse it? or just the author?

[@LiveOverflow]

The author is the one deploying it. So the author can add whatever hidden backdoor they want.

[@superjugy]

@@LiveOverflow I see. so as a user, how do you protect against malicious authors? or is it the responsibility of etherium blockchain to prevent this kind of backdoors? sounds to me that it is a technology issue in a way.

[@LiveOverflow]

"trust". You trust them or you review the code yourself. Maybe this is a good example why ethereum smart contracts are not easier to work with than regular legal contracts :P

[@RaceForMoney]

6 dizlikes from etherium smart contract team?

[@papefall468]

awesome men really awesome and its a fileless u give me idea imagine same bachdoor direct by dtmf (not for noobs) dont want to detaails bu t i think u really understand

[@srikarraoayilneni7074]

Oh God! These many days??

[@rajshah8143]

Any thoughts on doing an android app reverse engineering playlist/video??

[@itfitness5791]

Hast du schon mal darüber nachgedacht dein Wissen strukturiert in paar Udemy Kurse zu packen? Damit würde sich sicherlich mehr Income generieren lassen und man könnte sich viel strukturierter und Schritt für Schritt Wissen von dir aneignen. Und die 13 Euro die da meistens gezahlt werden pro Kurs sind mehr als fair und würde sich jeder leisten, der wirklich Interesse hat.

[@RoiEXLab]

And that children is why inline assembly or other kinds of direct memory access is evil 😈 Just give me my safe automatic memory managed language back D:

[@sayemprodhanananta144]

what is a copy protected QR code?

[@u0000-u2x]

I've been following Ethereum for a long time and still can't see it as a safe platform.. being a Turing complete scripting language on a blockchain is an amazing idea but the fact that you can't update your code means it needs to be bullet proof from the get-go... and we know that bullet-proof code does not exist (or at least takes an insane amount of time and validation/testing to be created). I know there are new programming paradigms for Ethereum codes that split code into different smart contracts but that, to my knowledge, still depends on at least part of that code being immutable and, therefore, bullet-proof. On top of that the Ethereum Foundation's 'move fast and break shit' attitude (in contrast with Bitcoin's slow and conservative approach) adds fuel to that fire... even if your code is safu, the new updates might break it and insert vulnerabilities into your smart contract. Until there is a way for a smart-contract platform to some how allow for distributed computing AND immediate code refactoring by the creator I don't see how it can really deliver it's potential without insanely high losses from hacks...

[@ncflg7667]

Why did u ask the creator if the solidity code was fake? Couldnt u just compile it yourself and compare the bytecodes?

[@LiveOverflow]

I did. And they were different. So I was confused. But this video explains how the code was not modified, yet different after it got deployed.

[@besozeshkan]

Hi, Iam a new subscriber, can you help me. I want to withdraw my tokens/coins from a smart contract. It say _tokens (uint256) what should i write there? I have around 90000 tokens not sure exact how much i have

[@abc321meins]

Quite interesting… What is a Smart Contract again?

[@justanormalperson]

cool

[@yawthecreator]

Bist du deutsch?

[@nudelchef]

Ist er.

[@PhilippBlum]

WTF? That is too simple. Btw: Why can you do assembler in ETH in the first place?

[@triularity]

Back door? Unleash the Mr. Potato Head comments! 😁

[@SamuelLing]

Just Monica

[@Sollace]

Wow. So who thought it was a good idea to let people write machine instructions directly into smart contracts? Probably the same people who thought intermingling data and executable code in the same memory with no protections thought that was a good way to deploy smart contracts. :/

[@janves]

Könntest du auch Mal deutsche Videos machen?

[@alphatier4919]

Die Zielgruppe wäre minimal...

[@LiveOverflow]

Oder du könntest im Englischunterricht besser aufpassen :P

[@_DSch]

@@LiveOverflow Aber das geht doch garnicht, wenn man mit seinem Sitznachbarn über das letzte LiveOverflow Video labern muss.

[@janves]

@@LiveOverflow Also ich verstehe ja schon das Meiste, aber eben nicht die Details. Lebst du in Deutschland?

[@janves]

@@LiveOverflow Okay, habe mir gerade nochmal das Video angesehen, du sprichst ja echt recht simples Englisch. Vielleicht würde ich den Inhalt besser verstehen, wenn ich mich mit der Materie auseinandersetzen würden. Im allgemeinen schaue ich schon oft englische Videos.

[@joemunapo]

Oh man, this is Rick and Morty stuff... Geez

[@TLCphoenix]

SOOOOOOOOOOOOOO SIMMMPPLLLEEEEE..........................................................................

[@MrDoboz]

I don't even know what a smart contract is lol

[@ptantikul]

so tricky

[@linuxkid3715]

Can i get a Heart? You are my Motivation :

[@bitmau5]

The lesson here kids... Buy bitcoin

[@michaelallen1803]

Hello and Welcome back to Episode 34 of ‘Why Is This In My Recommendation Feed?’

[@syahrulakbarr]

0x41414141 in myBrain()

[@RaceForMoney]

This is not comment

[@GRBtutorials]

False

[@Dev_UI]

test

[@creeper3490]

Last