翻訳待ち：Darkbloom (AI inference on idle Macs) – security audit with PRs submitted

AI サービスが一時的に利用できないため、復旧後に翻訳を補完します。

Instantly share code, notes, and snippets. mudiam/security-audit-2026-08-24.md Last active August 26, 2026 02:53 Show Gist options Download ZIP Star 0 (0) You must be signed in to star a gist Fork 0 (0) You must be signed in to fork a gist No results found Clone this repository at Save mudiam/1ffc898333ac3d5bdc5d7fac96d33360 to your computer and use it in GitHub Desktop. No results found Clone this repository at Save mudiam/1ffc898333ac3d5bdc5d7fac96d33360 to your computer and use it in GitHub Desktop. Download ZIP Darkbloom (darkbloom.dev) Community Security Audit Report — 2026-08-24 security-audit-2026-08-24.md Darkbloom Security Audit Report Target: https://www.darkbloom.dev Repositories: https://github.com/Layr-Labs/d-inference · https://github.com/darkbloomdev/darkbloom Date: 2026-08-24 Status: Research prototype, unaudited, public alpha Auditor: Independent community review (Claude Opus) GitHub Issues Filed: #705, #706, #707, #708 (closed — false positive), #709, #710 (closed — false positive), #711, #712 (closed — already fixed in PR #511), #713, #714, #715, #716 (closed — false positive, code deleted), #717, #736 Pull Requests Submitted: #737 (install-time RAM check), #738 (remove hardcoded MDM key), #739 (fix TLS verification + MicroMDM cert SAN) Last Updated: 2026-08-25 What Is Darkbloom? A decentralized AI inference network by Eigen Labs (the company behind EigenLayer, which raised $241M from a16z). Mac owners (Apple Silicon, 36GB+ RAM) install a provider agent that processes AI inference requests in the background and earn money per token processed. Developers pay for cheaper AI inference routed through the distributed Mac network. Scope Area Covered MDM .mobileconfig profile Yes Cryptographic paper (dginf-private-inference.pdf) Yes Launchd plist / persistence Yes Source code (coordinator + provider) Yes Binary / release supply chain Yes Network endpoints Yes Trust tier enforcement Yes Findings Summary CRITICAL — None found HIGH (5 findings) ID Finding File GitHub Issue H-1 E2E encryption claimed in paper but disabled in production provider/src/proxy.rs #706 H-2 Coordinator sees all prompts/responses in plaintext provider/src/proxy.rs #706 H-3 MDM API key hardcoded in Dockerfile coordinator/Dockerfile #707 H-4 Wallet private key stored as plaintext file on disk FALSE POSITIVE — Rust provider deleted in PR #178 provider/src/wallet.rs (deleted) #708 (closed) H-5 MinTrustLevel is global, not per-consumer coordinator/internal/api/consumer.go #705 MEDIUM (8 findings) ID Finding File GitHub Issue M-1 Binary SHA-256 hashes served by same CDN as binaries (circular trust) Install script #709 M-2 Stripe webhook verification bypassed when secret is empty FALSE POSITIVE — code already hard-fails coordinator/billing/stripe.go #710 (closed) M-3 curl-pipe-bash install enables fleet-wide RCE if CDN is compromised deploy/provider-fleet/update-fleet.sh #711 M-4 SCEP enrollment challenge is a public static string ("micromdm") scripts/enroll-with-acme.mobileconfig #705 M-5 Hypervisor memory isolation is novel and unaudited provider/src/hypervisor.rs #705 M-6 Single domain dependency (api.darkbloom.dev) for all operations Install script, provider/src/config.rs #705 M-7 Self-signed providers receive paid traffic with weaker guarantees coordinator/internal/registry/scheduler.go #705 M-8 Silent failure -- underpowered machines enrolled but earn nothing scripts/install.sh, provider-swift/Sources/darkbloom/EnrollCommand.swift, StartCommand+Preflight.swift #736 LOW (6 findings) ID Finding File GitHub Issue L-1 .mobileconfig in repo points to test server, not production ALREADY FIXED — file deleted in PR #511, profile now generated dynamically scripts/enroll-with-acme.mobileconfig (deleted) #712 (closed) L-2 SIP immutability theorem assumes no kernel CVEs papers/dginf-private-inference.tex #713 L-3 Hardcoded Team ID in entitlements plist scripts/entitlements.plist #714 L-4 TLS verification skipped for internal loopback connections — PR #739 submitted (pins MicroMDM self-signed cert + fixes missing SAN in cert generation) coordinator/Caddyfile, coordinator/deploy/start.sh #715 L-5 Wallet private key passed to external shasum — briefly visible in ps FALSE POSITIVE — historical code used stdin not argv; Rust provider deleted in PR #178 provider/src/wallet.rs (deleted) #716 (closed) L-6 No releases published on active repo; only on Layr-Labs fork GitHub releases #717 INFO — Positive Findings Finding Detail MDM AccessRights 1041 verified Genuinely read-only. No erase, lock, or app install capability confirmed by bitfield analysis. Unsupervised, user-removable MDM profile Correct design choice. No PayloadRemovalDisallowed key present. No launchd persistence Provider runs as a user-space process, not a root daemon. No RunAtLoad / KeepAlive. secure_zero() correct Uses write_volatile + SeqCst fence — prevents dead store elimination. Trust tier assignment is server-side Providers cannot spoof their own trust level. Coordinator assigns it based on verified attestation. Python import path isolation sys.path locked to signed app bundle; pycache purged before hash computation. Detailed Findings H-1 / H-2 — E2E Encryption Disabled; Coordinator Sees All Plaintext Severity: HIGH File: provider/src/proxy.rs The technical paper claims per-request NaCl Box (X25519 + XSalsa20-Poly1305) end-to-end encryption with forward secrecy. The production code explicitly disables this: // The provider receives plain JSON inference requests from the coordinator. // No decryption is needed on the provider side -- the coordinator runs in a // GCP Confidential VM and handles the trust boundary. The NodeKeyPair parameter comment: // Reserved for future coordinator-to-provider encryption // but is not used in the current plain JSON flow. Impact: The coordinator (GCP Confidential VM) reads every prompt and response in plaintext. Security relies entirely on the Confidential VM not being compromised. The paper's claim that "the operator of the Mac running your inference cannot read your prompt" is enforced by coordinator policy, not cryptography. Fix: Activate the existing NaCl Box flow. The infrastructure is already in the codebase. H-3 — MDM API Key Hardcoded in Dockerfile Severity: HIGH File: coordinator/Dockerfile ENV EIGENINFERENCE_MDM_API_KEY=eigeninference-micromdm-api The MicroMDM API key is baked into the public image as a default. The value is now permanently in git history and must be treated as compromised. Impact: Anyone with the MDM server URL (documented in the public .mobileconfig) and this key can interact with the MicroMDM API directly, potentially querying enrolled device information across the provider fleet. Fix: Remove default from Dockerfile. Store via GCP Secret Manager. Add startup check refusing to run with the default value in production. Rotate the key. H-4 — Wallet Private Key Stored as Plaintext Severity: HIGH File: provider/src/wallet.rs The earnings wallet private key is stored at ~/.darkbloom/wallet_key as a plaintext hex string (Unix permissions 0600). During address derivation, the key is passed as an argument to an external shasum subprocess, making it briefly visible in ps aux. Additionally, a timestamp-based randomness fallback produces cryptographically weak keys when /dev/urandom is unavailable. Fix: Use macOS Keychain (entitlement already present: SLDQ2GJ6TL.io.darkbloom.provider) or Secure Enclave wrapping. Replace external shasum with the sha2 Rust crate. Hard-fail if /dev/urandom is unavailable. H-5 — MinTrustLevel Is Global, Not Per-Consumer Severity: HIGH File: coordinator/internal/api/consumer.go The minimum provider trust level is a registry-wide setting. API consumers cannot specify a minimum trust tier per request. If Eigen Labs lowers the global floor, all consumers — including those with sensitive workloads — are affected without notice. Fix: Allow consumers to pass a X-Min-Trust-Level header in API requests to demand hardware-attested providers specifically. M-1 — Circular Binary Trust Severity: MEDIUM File: Install script The SHA-256 hashes used to verify downloaded binaries are fetched from the same server (api.darkbloom.dev) as the binaries themselves. A compromised CDN serves a malicious binary alongside a matching hash, passing verification. Fix: Publish hashes to GitHub Releases (independent trust root) or use Sigstore cosign. M-2 — Stripe Webhook Bypass Severity: MEDIUM File: coordinator/internal/billing/stripe.go if s.webhookSecret == "" { // Skip verification, process event directly return s.processEvent(payload) } If STRIPE_WEBHOOK_SECRET is unset in production, an attacker can POST forged Stripe events (e.g., checkout.session.completed) to credit arbitrary balances. Fix: Hard-fail at startup if webhookSecret is empty in non-dev environments. Return an error instead of silently processing unverified events. M-3 — curl-pipe-bash Fleet RCE Severity: MEDIUM Files: README, deploy/provider-fleet/update-fleet.sh # Provider install curl -fsSL https://api.darkbloom.dev/install.sh | bash # Fleet update (SSH into every provider machine) ssh "$HOST" "curl -fsSL $COORD_URL/install.sh | bash" A single compromise of api.darkbloom.dev gives an attacker simultaneous arbitrary code execution across the entire provider fleet. Fix: Sign install scripts with GPG/cosign and verify before execution. Distribute via Homebrew or signed .pkg. Replace fleet SSH pattern with pre-verified binary deployment. M-8 -- Silent Failure: Underpowered Machines Enrolled but Earn Nothing Severity: MEDIUM Files: scripts/install.sh, provider-swift/Sources/darkbloom/EnrollCommand.swift, provider-swift/Sources/darkbloom/StartCommand+Preflight.swift The install script, darkbloom enroll, and darkbloom start all allow machines with insufficient RAM to complete the full installation and enrollment flow -- including MDM device-attestation enrollment -- without any warning that the machine cannot actually serve inference. The machine appears "online" on the network but silently fails every inference request because the assigned model cannot fit in memory. The only way a user discovers this is by manually running darkbloom doctor: TRAFFIC READINESS (can this box actually serve?) [FAIL] model fits in RAM -- qwen3.6-35b-a3b-vl-mtp-mxfp8 needs ~30.3 GB but only 12.5 GB is usable -- it will show online but every request fails to load. -> fix: this box's RAM is too small for the models on this network; consider a machine with more unified memory. Code evidence: install.sh line 361 reads RAM with sysctl -n hw.memsize but only displays it -- no comparison against model requirements, despite the model catalog response containing min_ram_gb per model. StartCommand+Preflight.swift has a hard-fail gate at 8 GB: if hardware.memoryGb < 8 { printError("This Mac has \(hardware.memoryGb) GB RAM. At least 8 GB is needed to serve any model.") throw ExitCode.failure } This threshold is far below the actual minimum model requirement (~30.3 GB for the current default model). A 16 GB Mac passes this check but cannot serve any model on the network. EnrollCommand.swift performs zero hardware checks before enrolling the device in MDM, meaning underpowered machines go through the full device-attestation flow (Secure Enclave key generation, MDM profile installation, Apple CA certificate issuance) for nothing. The RAM-vs-model fitness check exists only in darkbloom doctor (via DoctorRunner.buildOperatorDiagnosis and ModelFitDiagnostic), which users must run manually and is not part of any install/start/enroll flow. Impact: Users with 16-24 GB Macs are misled into thinking they are participating in the network and earning money, when every inference request silently fails to load Users undergo MDM enrollment (device attestation, Secure Enclave identity, Apple CA certificates) on machines [truncated for AI cost control]