other
Error
- Location
- clawrtc/data/miner.py:156
- Finding
- <![CDATA[Undisclosed Transmission of Hostname and MAC Addresses]]><![CDATA[ ## Vulnerability Details **File Location**: `clawrtc/data/miner.py:156-190`, `clawrtc/data/miner.py:223-250` **Vulnerability Type**: Undisclosed device-identifier collection and transmission **Risk Level**: High ### Vulnerable Code ```python def _get_hw_info(self): """Collect hardware info with auto-detection.""" family, arch = self._detect_arch() hw = { "platform": platform.system(), "machine": platform.machine(), "hostname": socket.gethostname(), "family": family, "arch": arch, } # Get CPU cpu = self._run_cmd("lscpu | grep 'Model name' | cut -d: -f2 | xargs") hw["cpu"] = cpu or "Unknown" # Get cores cores = self._run_cmd("nproc") hw["cores"] = int(cores) if cores else 6 # Get memory mem = self._run_cmd("free -g | grep Mem | awk '{print $2}'") hw["memory_gb"] = int(mem) if mem else 32 # Get MACs (ensures PoA signal uses real hardware data) macs = self._get_mac_addresses() hw["macs"] = macs hw["mac"] = macs[0] self.hw_info = hw return hw ``` ```python attestation = { "miner": self.wallet, "miner_id": f"claw-{self.hw_info['hostname']}", "nonce": nonce, "report": { "nonce": nonce, "commitment": hashlib.sha256( (nonce + self.wallet + json.dumps(entropy, sort_keys=True)).encode() ).hexdigest(), "derived": entropy, "entropy_score": entropy.get("variance_ns", 0.0) }, "device": { "family": self.hw_info["family"], "arch": self.hw_info["arch"], "model": self.hw_info.get("cpu", "Unknown"), "cpu": self.hw_info["cpu"], "cores": self.hw_info["cores"], "memory_gb": self.hw_info["memory_gb"] }, "signals": { "macs": self.hw_info.get("macs", [self.hw_info["mac"]]), "hostname": self.hw_info["hostname"] }, "fingerprint": self.fingerprint_data if self.fingerprint_data else None } resp = request ...[truncated 2065 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove raw hostname and MAC addresses from the network payload. - Use an ephemeral identifier or a locally generated random device identifier that is not derived from hardware addresses. - If stable proof is essential, transmit a keyed or salted commitment whose salt is not shared across unrelated services. - Minimize the payload to only the measurements required to validate an attestation. - Explicitly disclose every collected and transmitted field, its purpose, retention period, and destination before mining begins. - Add a payload-preview mode and a user-controlled option to disable stable identifiers. - Document deletion and retention policies for attestation records. ]]>