Critical Security Bug: Authentication Bypass in SIWB

Developers
, ,
1

Dear all,

We have recently discovered an authentication bypass vulnerability in ic_siwb_provider canister that allows an attacker to take full control of any Internet Computer (IC) account principal created using the SIWB authentication protocol. Please refer to the GitHub Security Advisory for more details.

This is a critical security issue. All Identity Providers must immediately redeploy their SIWB instances using the latest patched build of ic_siwb_provider.

As this vulnerability has already been exploited in the wild, the DFINITY security team will publish a postmortem of the incident in a separate forum post.

We encourage the ICP community to report any new issues or vulnerabilities responsibly. For more information, please consult our Bug Bounty program for projects maintained by DFINITY.

If you have any questions, feel free to reply in this thread or contact us privately.

7 Likes
2

Gentle suggestion.

Might make sense for Dfinity to maintain an official one or bless a version that provides the same level of trust that this one has :slight_smile:

Since this is critical infrastructure for the ckBTC side of things

3 Likes
3

See also this broader discussion: Critical Vulnerability in Sign-In With Bitcoin (SIWB) used to Attack Odin.fun - Learnings and Discussion