Addressing DDOS Risks at EOS Launch by eostribe

View this thread on: hive.blog | peakd.com | ecency.com

cryptocurrency · @eostribe · Apr 30 '18 (edited)

$87.33

Addressing DDOS Risks at EOS Launch

<html>
<center><img src="https://eostribe.io/images/ddos.jpg"></center><br>
<p>The upcoming <a href="https://medium.com/@thomas.cox_39839/magic-15-unlocking-the-eosio-blockchain-91ec54f7b48d">launch of EOS Blockchain on June 2nd</a> will be a fundamental historical event many have been waiting for. There is a lot of interest around promises of the first Blockchain running on distributed Proof-of-Stake protocol with a full fledged Governance model.</p>

<p>EOS promises to deliver what many Blockchains currently unable to do including but not limited to speed of transactions. Every success however also breeds enemies. There are stakeholders on countless other platforms and projects who stand to possibly lose should EOS prove successful and deliver on its promises. </p>

<p>Some will be tempted to compromise the launch of EOS Blockchain.</p>

<p>And hence it’s safest to assume there will be various attacks launched on June 2nd with a goal if not derail then significantly complicate the launch of EOS Blockchain.</p>

<p>Let us consider then our latest process for <a href="https://medium.com/eosio/bios-boot-eosio-blockchain-2b58b8a978a1">EOS bios boot sequence</a> from security standpoint.</p>

<p>We start with a first eosio node that generates and publishes genesis file for other 121 BP nodes. It starts, establishes bios contract where it adds 21 block producing keys and probably restrict connections to only those 121 BP nodes using peer-key settings.</p>

<img src="https://steemitimages.com/DQmbPGoQNaAjqxqQPmxJMsC4ytSyJSGigVE8JXPHRSVzbq6/image.png"><br><br>

<p>Once those 121 nodes connect to eosio node, sync up and establish network with each other - we are in relative safe distributed mode.</p>

<p>However that initial period after eosio node makes it IP address known and before other nodes connect to it - may potentially expose us to DDoS attack on boot node. </p>

<p>Consider the following scenario of coordinated DDoS attack:</p>

<img src="https://steemitimages.com/DQmcFMFQ1vwjjA7hjCkRLiKktzRLEGG6hy6xvpr1wZXY5UA/image.png"><br><br>

<p>As soon as IP address of bootstrap node is known to an attacker - it exposes is to potential attack by malicious party. This could significantly affect EOS bootstrap process.</p>
<p>Keeping this information secret may not be possible and filtering all invalid incoming requests can be done to a degree but may complicate joining of valid nodes.</p>

<h2>Possible Solution to DDoS Attack</h2>
<p>The <a href="https://steemit.com/cryptocurrency/@eostribe/bootstrapping-the-eos-blockchain">bootstrap process</a> is only vulnerable because we expose a single point of failure at certain period of bootstrap process. Thus a logical mediation would be to remove single point of failure.</p>

<p>We could change an order of EOS Bootstrap process by establishing a mesh network of BP nodes first. The network will be running idle without producing any blocks.</p>

<p>Then at certain time a eosio node will connect to the mesh network with enabled bios contract and kick block production across all 21 BP nodes instantly.</p>

<h3>Step 1: Creating a mesh network of BP nodes in advance of Go Live date:</h3><br>

<img src="https://steemitimages.com/DQmdG5toLtPrhpMWCVCZsgCKjWjhnXPmrtmYA3ASDCnQkLR/image.png"><br><br>

<p>Again network runs in stale mode and we give BP nodes extended period of time to join in the mesh network. Our experience running Testnets have shown that in geographically distributed environment it takes about 24hrs for 80-90% of nodes to join the network.</p>

<p>Notice that none of the BP nodes on the network knows to whom eosio node will be connecting.</p>

<p>The at a Go Live time eosio node will start and connect to one of the BP nodes directly without ever exposing eosio node to the public Internet. </p>

<p><strong>There are multiple secure scenarios of eosio connection available:</strong></p>
<ol>
<li>The eosio runs on subnet of one of the BP producer nodes and connects to it using Intranet.</li>
<li>The eosio runs separately and connects to one of the BP nodes using VPN connection.</li>
</ol>

<img src="https://steemitimages.com/DQmVTCT8dhx4DyWetLdWXffeCKAPhZyfN8nbndtkz3ec8sr/image.png"><br><br>

<p>After the network is <a href="https://steemit.com/cryptocurren<p>cy/@eostribe/bootstrapping-the-eos-blockchain">bootstrapped</a> and all 21 BP nodes start block production, eosio node may safely disconnect. It’s job is done without ever exposing it to outside attacks.</p>

<p>Another upside of current approach is the fact that mesh network can be created days before the Go Live date allowing all 21 BP nodes time to connect, work out any issues that arise and create stable network without the stress of time crunch for everyone.</p>

<strong>Authors of this article:</strong><br>
Eugene Luzgin (@eluzgin), <a href="https://eostribe.io">EOS Tribe</a><br>
Eric (@xebb), <a href="http://eosio.se/">EOS Sweden</a></p>

<h3><strong>Connect With Us</strong></h3>
<ul>
  <li><strong>Website</strong> <strong>-</strong> <strong><a href="https://eostribe.io/">https://eostribe.io</a></strong></li>
  <li><strong>Github</strong> <strong>-</strong> <strong><a href="https://github.com/eostribe" >https://github.com/eostribe</a></strong></li>
  <li><strong>Telegram</strong> <strong>-</strong> <strong><a href="http://t.me/EOSTribe" >http://t.me/EOSTribe</a></strong></li>
  <li><strong>Facebook</strong> <strong>-</strong> <strong><a href="https://www.facebook.com/groups/eostribe">https://www.facebook.com/groups/eostribe</a></strong></li>
  <li><strong>Twitter</strong> <strong>-</strong> <strong><a href="https://twitter.com/eostribe" >https://twitter.com/eostribe</a></strong></li>
  <li><strong>Medium</strong> <strong>-</strong> <strong><a href="https://medium.com/eostribe" >https://medium.com/eostribe</a></strong></li>
  <li><strong>Dischord</strong> <strong>-</strong> <strong><a href="https://discord.gg/Su7pDGt" >https://discord.gg/Su7pDGt</a></strong></li>
</ul>
<br>
<hr>
<br>
<center>
  <a href="https://eostribe.io/"><img src="https://eostribe.io/images/slogan.jpg" alt="EOS Tribe - The Bulding Blocks of a Decentralized Future"></a>
</center>

</html>

👍 wackou, fuzzyvest, ashe-oro, boatymcboatface, mariusfebruary, piem, chitty, mjhomb, eosphere, mod-tamichh, hackerzizon, patrickzhou, yuhjtman, hql2016, eluzgin, j30231, robrigo, perduta, n3r0, laurbana, coolisland, nehuen, anzirpasai, sf2, johnchamberlain, eostribe, eosdallas, h2309938543, waveout, saltblock, ndoy, a3t, cryptogrok, eosrio, ralf.weinand, gerswyn, girlnextdoor, cryptolions, mortyc137, superfazio, james212, writer232, platomaniac, zazelpop, laconic, fitofanka, seanxa, peterokwara

`author`	eostribe
`permlink`	addressing-ddos-risks-at-eos-launch
`category`	cryptocurrency
`json_metadata`	{"tags":["cryptocurrency","blockchain","eos","blockproducer","eosio"],"users":["eluzgin","xebb"],"image":["https://eostribe.io/images/ddos.jpg","https://steemitimages.com/DQmbPGoQNaAjqxqQPmxJMsC4ytSyJSGigVE8JXPHRSVzbq6/image.png","https://steemitimages.com/DQmcFMFQ1vwjjA7hjCkRLiKktzRLEGG6hy6xvpr1wZXY5UA/image.png","https://steemitimages.com/DQmdG5toLtPrhpMWCVCZsgCKjWjhnXPmrtmYA3ASDCnQkLR/image.png","https://steemitimages.com/DQmVTCT8dhx4DyWetLdWXffeCKAPhZyfN8nbndtkz3ec8sr/image.png","https://eostribe.io/images/slogan.jpg"],"links":["https://medium.com/@thomas.cox_39839/magic-15-unlocking-the-eosio-blockchain-91ec54f7b48d","https://medium.com/eosio/bios-boot-eosio-blockchain-2b58b8a978a1","https://steemit.com/cryptocurrency/@eostribe/bootstrapping-the-eos-blockchain","https://steemit.com/cryptocurren<p>cy/@eostribe/bootstrapping-the-eos-blockchain","https://eostribe.io","http://eosio.se/","https://eostribe.io/","https://github.com/eostribe","http://t.me/EOSTribe","https://www.facebook.com/groups/eostribe","https://twitter.com/eostribe","https://medium.com/eostribe","https://discord.gg/Su7pDGt"],"app":"steemit/0.1","format":"html"}
`created`	2018-04-30 08:24:03
`last_update`	2018-04-30 19:23:06
`depth`	0
`children`	7
`last_payout`	2018-05-07 08:24:03
`cashout_time`	1969-12-31 23:59:59
`total_payout_value`	75.959 HBD
`curator_payout_value`	11.366 HBD
`pending_payout_value`	0.000 HBD
`promoted`	0.000 HBD
`body_length`	6,172
`author_reputation`	2,660,491,410,996
`root_title`	"Addressing DDOS Risks at EOS Launch"
`beneficiaries`	`[]`
`max_accepted_payout`	1,000,000.000 HBD
`percent_hbd`	0
`post_id`	52,988,541
`net_rshares`	14,158,960,886,559
`author_curate_reward`	""

properties (23)vote details (48)

voter	rshares	pct
wackou	6,268,134,709,513	80%
fuzzyvest	3,526,118,451,756	30%
boatymcboatface	1,279,037,745,708	100%
chitty	321,733,245,419	100%
mod-tamichh	84,545,979,509	100%
ashe-oro	1,476,455,692,392	100%
robrigo	6,729,014,601	100%
johnchamberlain	837,130,048	100%
james212	444,121,962	100%
perduta	6,613,388,427	100%
mjhomb	156,671,184,672	100%
hql2016	10,796,182,457	100%
anzirpasai	1,061,826,651	100%
yuhjtman	13,505,200,318	100%
peterokwara	0	100%
nehuen	1,580,035,341	100%
eluzgin	10,785,468,264	100%
n3r0	5,827,285,883	100%
waveout	613,204,364	100%
ralf.weinand	605,040,090	100%
cryptogrok	611,243,358	100%
saltblock	613,122,478	100%
zazelpop	111,121,939	8%
piem	390,105,097,820	100%
girlnextdoor	599,018,491	100%
patrickzhou	14,956,719,204	100%
platomaniac	122,168,891	100%
j30231	7,583,357,953	100%
laconic	80,936,186	10%
mortyc137	545,855,775	100%
h2309938543	614,475,671	100%
eosphere	125,107,964,072	100%
hackerzizon	28,675,864,766	100%
mariusfebruary	402,215,601,496	100%
coolisland	3,862,326,999	100%
sf2	928,657,475	100%
cryptolions	596,383,820	100%
eosdallas	717,044,665	100%
gerswyn	599,546,360	100%
ndoy	612,538,365	100%
a3t	612,527,606	100%
seanxa	0	100%
eostribe	735,922,473	100%
laurbana	4,926,541,233	100%
eosrio	607,952,304	100%
writer232	194,038,240	100%
superfazio	529,951,544	100%
fitofanka	0	100%

@bodget · Apr 30 '18

I do like this idea of getting all our ducks in a row some days before, good job guys

properties (22)

`author`	bodget
`permlink`	re-eostribe-addressing-ddos-risks-at-eos-launch-20180430t172220482z
`category`	cryptocurrency
`json_metadata`	{"tags":["cryptocurrency"],"app":"steemit/0.1"}
`created`	2018-04-30 17:22:36
`last_update`	2018-04-30 17:22:36
`depth`	1
`children`	0
`last_payout`	2018-05-07 17:22:36
`cashout_time`	1969-12-31 23:59:59
`total_payout_value`	0.000 HBD
`curator_payout_value`	0.000 HBD
`pending_payout_value`	0.000 HBD
`promoted`	0.000 HBD
`body_length`	85
`author_reputation`	84,435,500,752
`root_title`	"Addressing DDOS Risks at EOS Launch"
`beneficiaries`	`[]`
`max_accepted_payout`	1,000,000.000 HBD
`percent_hbd`	10,000
`post_id`	53,074,470
`net_rshares`	0

@eosdallas · Apr 30 '18

Brilliant! Great job @xebb and @eluzgin

👍 a3t

`author`	eosdallas
`permlink`	re-eostribe-addressing-ddos-risks-at-eos-launch-20180430t082657881z
`category`	cryptocurrency
`json_metadata`	{"tags":["cryptocurrency"],"users":["xebb","eluzgin"],"app":"steemit/0.1"}
`created`	2018-04-30 08:26:57
`last_update`	2018-04-30 08:26:57
`depth`	1
`children`	0
`last_payout`	2018-05-07 08:26:57
`cashout_time`	1969-12-31 23:59:59
`total_payout_value`	0.000 HBD
`curator_payout_value`	0.000 HBD
`pending_payout_value`	0.000 HBD
`promoted`	0.000 HBD
`body_length`	39
`author_reputation`	355,857,786,056
`root_title`	"Addressing DDOS Risks at EOS Launch"
`beneficiaries`	`[]`
`max_accepted_payout`	1,000,000.000 HBD
`percent_hbd`	10,000
`post_id`	52,988,923
`net_rshares`	603,339,692
`author_curate_reward`	""

properties (23)vote details (1)

voter	weight	wgt%	rshares	pct	time
a3t	0 B		603,339,692	100%

@hackerzizon · May 4 '18

i love it

properties (22)

`author`	hackerzizon
`permlink`	re-eostribe-addressing-ddos-risks-at-eos-launch-20180504t104644733z
`category`	cryptocurrency
`json_metadata`	{"tags":["cryptocurrency"],"app":"steemit/0.1"}
`created`	2018-05-04 10:46:48
`last_update`	2018-05-04 10:46:48
`depth`	1
`children`	0
`last_payout`	2018-05-11 10:46:48
`cashout_time`	1969-12-31 23:59:59
`total_payout_value`	0.000 HBD
`curator_payout_value`	0.000 HBD
`pending_payout_value`	0.000 HBD
`promoted`	0.000 HBD
`body_length`	9
`author_reputation`	9,134,212,506,385
`root_title`	"Addressing DDOS Risks at EOS Launch"
`beneficiaries`	`[]`
`max_accepted_payout`	1,000,000.000 HBD
`percent_hbd`	10,000
`post_id`	53,814,496
`net_rshares`	0

@laurbana · May 1 '18

You never know anything is possible

properties (22)

`author`	laurbana
`permlink`	re-eostribe-addressing-ddos-risks-at-eos-launch-20180501t235630858z
`category`	cryptocurrency
`json_metadata`	{"tags":["cryptocurrency"],"app":"steemit/0.1"}
`created`	2018-05-01 23:56:39
`last_update`	2018-05-01 23:56:39
`depth`	1
`children`	0
`last_payout`	2018-05-08 23:56:39
`cashout_time`	1969-12-31 23:59:59
`total_payout_value`	0.000 HBD
`curator_payout_value`	0.000 HBD
`pending_payout_value`	0.000 HBD
`promoted`	0.000 HBD
`body_length`	35
`author_reputation`	6,929,399,067
`root_title`	"Addressing DDOS Risks at EOS Launch"
`beneficiaries`	`[]`
`max_accepted_payout`	1,000,000.000 HBD
`percent_hbd`	10,000
`post_id`	53,332,231
`net_rshares`	0

@mortyc137 · Apr 30 '18

but hey look at the positive, a good stress testing of the EOS network! After the attack I may be even more confident about throughput of EOS network.
/s

properties (22)

`author`	mortyc137
`permlink`	re-eostribe-addressing-ddos-risks-at-eos-launch-20180430t093303000z
`category`	cryptocurrency
`json_metadata`	{"tags":["cryptocurrency"],"app":"steemit/0.1"}
`created`	2018-04-30 09:33:03
`last_update`	2018-04-30 09:33:03
`depth`	1
`children`	0
`last_payout`	2018-05-07 09:33:03
`cashout_time`	1969-12-31 23:59:59
`total_payout_value`	0.000 HBD
`curator_payout_value`	0.000 HBD
`pending_payout_value`	0.000 HBD
`promoted`	0.000 HBD
`body_length`	153
`author_reputation`	6,624,186,935
`root_title`	"Addressing DDOS Risks at EOS Launch"
`beneficiaries`	`[]`
`max_accepted_payout`	1,000,000.000 HBD
`percent_hbd`	10,000
`post_id`	52,998,290
`net_rshares`	0

@thomasuk · May 1 '18

hmm, but how do we vote then for the BP's ?

properties (22)

`author`	thomasuk
`permlink`	re-eostribe-addressing-ddos-risks-at-eos-launch-20180501t144801601z
`category`	cryptocurrency
`json_metadata`	{"tags":["cryptocurrency"],"app":"steemit/0.1"}
`created`	2018-05-01 14:48:00
`last_update`	2018-05-01 14:48:00
`depth`	1
`children`	1
`last_payout`	2018-05-08 14:48:00
`cashout_time`	1969-12-31 23:59:59
`total_payout_value`	0.000 HBD
`curator_payout_value`	0.000 HBD
`pending_payout_value`	0.000 HBD
`promoted`	0.000 HBD
`body_length`	43
`author_reputation`	4,723,938,914
`root_title`	"Addressing DDOS Risks at EOS Launch"
`beneficiaries`	`[]`
`max_accepted_payout`	1,000,000.000 HBD
`percent_hbd`	10,000
`post_id`	53,252,374
`net_rshares`	0

@thomasuk · May 1 '18

Ok, Think I got it somehow - first BP's are established and then competing for votes to get over the 15% needed like @thomasbcox describes here: https://medium.com/@thomas.cox_39839/magic-15-unlocking-the-eosio-blockchain-91ec54f7b48d

properties (22)