Posts tagged p2p.

An unauthenticated peer can force a Casper node to run a full P-521 ECDSA signature verification during TLS-1.3 handshake — before any admission gate, allowlist, or per-peer cap — burning crypto-CPU via fresh-cert-per-connection churn.

A pre-auth HTTP/2 stream flood on the rusty-kaspa gRPC P2P endpoint causes inbound-peering exhaustion via eviction and admission denial.

Qtum's BIP-324 v2 transport runs a pre-authentication ellswift-ECDH on every inbound connection, allowing a single source IP to saturate a core and deny honest peers.

If you run Falco, an EDR, or a generic host agent on a validator and a network-DoS attack against the node went undetected, this explains why. A technique-by-technique analysis of five reproduced P2P-infrastructure attacks against the syscall detection surface. Zero are detectable as attributable rules, and the reasons are structural, not a matter of tuning.

A go-ethereum eth-protocol peer that sends a GetBlockHeaders request with amount (count) set to 0 triggers an integer underflow — count-1 wraps to UINT64_MAX — bypassing the maxHeadersServe cap and forcing the node to serve headers back to genesis, a publicly disclosed memory-exhaustion DoS (CVE-2024-32972, fixed in geth 1.13.15) that NullRabbit reproduced as a lab detection bundle.

A Bitcoin Core block containing a transaction that spends the same previous output twice reaches a validation path with no duplicate-input check: on 0.14.x this trips an internal assertion and crashes the node, and on 0.15.0-0.16.2 — when the duplicated output was created in an earlier block — it passes silently, letting the block's miner claim that output's value twice. Fixed in 0.16.3 / 0.17.0.

rust-libp2p's gossipsub implementation stores a peer-supplied PRUNE backoff duration and later adds a further duration to it during heartbeat processing using unchecked arithmetic; a single crafted PRUNE with a backoff value near u64::MAX overflows that addition and panics the process.

CometBFT completes the full SecretConnection STS handshake — an X25519 Diffie–Hellman exchange and an Ed25519 signature verification — for any connecting peer before checking whether that peer's node-ID is allowlisted, so an unauthenticated remote source can spend the node's asymmetric-crypto budget at will.

rippled's inbound TLS listeners on the peer port (51235) and the RPC-HTTPS port (5006) accept a partial TLS handshake with no deadline and no per-IP half-open cap, so a single source IP can pin server memory indefinitely and, at a default file-descriptor limit, crash the process.