1 00:00:03,000 --> 00:00:09,560 Hello and welcome to the State of Blockchain Security here at the Blockchain Village at DEF CON 28. 2 00:00:09,560 --> 00:00:16,260 I'm excited to share with you just a really zoomed out view of the current state of our industry. 3 00:00:16,380 --> 00:00:21,120 We'll talk about a variety of blockchain security related events, major incidents. 4 00:00:21,120 --> 00:00:24,220 We'll gather some insights and make future predictions. 5 00:00:24,240 --> 00:00:31,060 And most importantly, we'll talk about a lot of opportunities how to build a stronger and more trustworthy financial system. 6 00:00:32,360 --> 00:00:35,400 In case we have not met, my name is Peter Kaczynski. 7 00:00:35,460 --> 00:00:44,960 I'm a blockchain security engineer at Coinbase, where I spend most of my time trying to break and secure a variety of standalone blockchain systems and smart contracts. 8 00:00:46,000 --> 00:00:52,560 On the side, I also publish a blockchain threat intelligence newsletter where I share the latest news. 9 00:00:52,720 --> 00:00:57,320 And partially, I will be recapping some of the major events that I cover in that newsletter. 10 00:00:57,880 --> 00:01:04,060 And in the past, I was also organizer of the Capture the Coin competition at DEF CON. 11 00:01:04,440 --> 00:01:09,300 In the past, I was working also as a malware reverse engineer at FireEye. 12 00:01:09,320 --> 00:01:14,500 If you're a malware reversal, you may have run into a few of my tools such as Flare VM and FakeNetNG. 13 00:01:15,400 --> 00:01:20,800 And I've also reversed a whole lot of APT malware that I care to remember. 14 00:01:22,200 --> 00:01:31,800 Zooming even back out, I was more on the offensive side as well for the Federal Reserve System, where I was working as a penetration tester, trying to break Finance 1.0. 15 00:01:32,420 --> 00:01:36,040 I guess everyone shares their story of how they got into crypto. 16 00:01:36,440 --> 00:01:44,120 The revealing moment for me was just basically my past growing up in the Soviet Union and observing what hyperinflation means in the first place. 17 00:01:44,680 --> 00:01:54,960 So it really, it really stroke a chord in me when I understood what the future offered by the cryptocurrencies. 18 00:01:55,600 --> 00:02:01,080 And I take it as a personal mission to make this field succeed by making it more secure. 19 00:02:01,340 --> 00:02:03,600 And I hope you join me on that mission as well. 20 00:02:04,520 --> 00:02:06,340 So what are we going to talk about? 21 00:02:06,500 --> 00:02:12,380 I would like to help inform, educate, and identify as many opportunities for you as possible. 22 00:02:12,380 --> 00:02:18,660 So if you feel like this is the field for you, you will know exactly where to plug in and what to pursue. 23 00:02:20,020 --> 00:02:25,800 Within this talk, we're going to talk about a variety of incidents, as I mentioned, from the newsletter. 24 00:02:26,620 --> 00:02:29,580 But the key point here is that it's less about me being right. 25 00:02:29,580 --> 00:02:39,080 I will offer some insight and opinions here, but I'm even more excited to start a discussion and learn from you during the Q&A session or offline if you care to reach out. 26 00:02:39,540 --> 00:02:42,780 I would be highly excited to hear your thoughts on it. 27 00:02:43,560 --> 00:02:47,700 In our presentation, we'll begin by defining the field in the ecosystem. 28 00:02:47,900 --> 00:02:49,860 So we'll talk, what is blockchain security? 29 00:02:49,860 --> 00:02:57,080 How is it different from any other security disciplines, let's say web application or IoT security? 30 00:02:57,080 --> 00:02:58,560 What makes it unique? 31 00:02:59,060 --> 00:03:06,720 We will also talk about the overall ecosystem that we're trying to protect and also think how it's getting attacked. 32 00:03:07,300 --> 00:03:14,200 Next, we're going to break down all of the variety of components within the blockchain security field. 33 00:03:14,200 --> 00:03:16,120 So we'll talk about exchange security. 34 00:03:16,120 --> 00:03:18,800 What were the major incidents this year so far? 35 00:03:18,800 --> 00:03:20,320 What can we learn from it? 36 00:03:20,320 --> 00:03:22,900 We're going to talk about the asset security. 37 00:03:22,900 --> 00:03:27,340 So we will discover a variety of protocol issues that are being exploited. 38 00:03:27,340 --> 00:03:30,660 We'll talk about software getting attacked, other weak points. 39 00:03:31,080 --> 00:03:33,160 And last but definitely not least is user security. 40 00:03:33,160 --> 00:03:40,460 We're going to deep dive into the main point of why we're this is for the users, for people to be able to transact securely. 41 00:03:42,320 --> 00:03:58,480 We will finish the presentation with thoughts about building this industry, how to make it more mature, what we can do to share the guidelines that people can just pick up and implement in their next projects, the tools that still need to be developed, 42 00:03:58,480 --> 00:04:00,860 as well as how we can build up our community. 43 00:04:02,440 --> 00:04:07,780 So let's begin first by defining what is blockchain security. 44 00:04:07,820 --> 00:04:09,860 I believe it's a brand new field. 45 00:04:09,860 --> 00:04:17,260 It's a new discipline of information security with a mission of securing and defending the cryptocurrency ecosystem. 46 00:04:18,380 --> 00:04:20,880 What is cryptocurrency ecosystem? 47 00:04:21,300 --> 00:04:24,320 We, again, I mentioned users are at the core of it. 48 00:04:24,320 --> 00:04:29,580 We have a variety of assets, both layer one and layer two. 49 00:04:29,580 --> 00:04:31,600 So smart contracts and all of that. 50 00:04:31,600 --> 00:04:36,740 So nodes, wallets, smart contracts are all within the scope of this field. 51 00:04:36,740 --> 00:04:49,340 Of course, exchanges, a variety of people choose to delegate and use centralized points of storage instead of holding all the keys themselves. 52 00:04:49,780 --> 00:05:01,430 And a variety of attacks and security implications that that brings, including what are the issues with cold hot storage, the incidents that are happening in this world and other issues. 53 00:05:03,430 --> 00:05:20,930 So some of the threats that we'll cover throughout this talk, we'll talk a lot about malware, just because of my background, we'll cover how it's affecting both the assets where they're getting backdoored, malware attacks against users themselves, the ransomware and the miners and all that good stuff, 54 00:05:20,930 --> 00:05:23,250 as well as how it affects exchanges. 55 00:05:23,570 --> 00:05:28,470 We'll go through fraud and scam schemes that are perpetrated against users. 56 00:05:28,470 --> 00:05:35,390 We'll talk about what are the losses, what can we do to defend ourselves against it, make users feel a little bit more comfortable and safer. 57 00:05:36,030 --> 00:05:37,710 We'll talk about network attacks. 58 00:05:37,710 --> 00:05:47,670 So we'll dive into nitty gritty technical details of attacks against a variety of different chains and lessons that we can learn from them. 59 00:05:48,150 --> 00:06:00,350 We'll talk about phishing attacks against exchanges and users, and definitely about bad actors, who are the people behind those threats, what can we learn, how we can better defend ourselves against them. 60 00:06:01,530 --> 00:06:05,250 So let's first dive into the exchange security. 61 00:06:06,790 --> 00:06:18,430 I mean, last year, if you've been paying attention in 2019, there were so many incidents when one exchange after another was falling down with millions and millions of dollars lost from the hot wallet theft. 62 00:06:18,490 --> 00:06:31,290 This year, what I'm observing is something different, is that we're seeing two incidents from BlockFi and CoinCheck, where the attackers chose not necessarily to go after the, you know, just grab the coins and run off. 63 00:06:31,290 --> 00:06:36,110 Instead, they were content with just getting to PII data. 64 00:06:36,110 --> 00:06:41,230 So we're talking about emails, addresses, other personally identifiable information from the customers. 65 00:06:41,650 --> 00:06:51,590 So the first incident that I'm going to cover is BlockFi, and they were good at publishing the incident reports fairly quickly. 66 00:06:51,590 --> 00:06:57,350 However, what they described as the reason, the root cause for the attack, is that one of their employees was SIM-ported. 67 00:06:57,350 --> 00:07:00,790 SIM-ported to access the internal portal. 68 00:07:00,970 --> 00:07:04,050 So this sounds like something preventable. 69 00:07:04,050 --> 00:07:18,110 I mean, if you're defending your internal portal with a phone, you're using 2FA, which is like some kind of SMS or a phone system, it really could have been improved. 70 00:07:18,110 --> 00:07:19,890 It's something that could have been avoided. 71 00:07:20,450 --> 00:07:28,770 Similarly, CoinCheck reported a loss of 200 customer PII data. 72 00:07:28,910 --> 00:07:32,850 And again, the root cause for it was the main registrar was hacked. 73 00:07:32,850 --> 00:07:42,450 It's something that could have been avoided by maybe picking someone more secure or trying to find a way how to secure your registration so it wouldn't be hijacked as easily. 74 00:07:43,290 --> 00:07:47,010 And of course, this year, we had good old hot wallet theft. 75 00:07:47,190 --> 00:07:52,370 So the year started alt-spit with really tiny financial loss. 76 00:07:52,370 --> 00:07:56,830 It was only 7 bitcoins stolen and 23 ETH. 77 00:07:57,230 --> 00:07:59,950 LulzSec took credit for this compromise. 78 00:08:00,290 --> 00:08:07,830 Unfortunately, the exchange shut down as a result, and so we don't really know as much information about what caused it, what was the underlying issue. 79 00:08:08,670 --> 00:08:13,390 But it just continues on the trend from last year that these things happen. 80 00:08:13,530 --> 00:08:16,250 And this happened early in the year, I believe back in January. 81 00:08:16,630 --> 00:08:22,870 A more recent incident was from the Kasha exchange, which reported a loss of 336 bitcoins. 82 00:08:22,990 --> 00:08:29,970 And again, the reasoning that they described was that their employee was using a personal laptop to conduct official business. 83 00:08:29,970 --> 00:08:37,810 So they were running OTC desk from their personal machine, which apparently got malware on it, and the attacker was able to get away with the keys. 84 00:08:37,910 --> 00:08:41,150 Again, something that could have been avoided. 85 00:08:42,570 --> 00:08:46,190 So some insights, some observations that we're seeing so far. 86 00:08:46,310 --> 00:08:48,150 Are exchanges getting more secure? 87 00:08:48,150 --> 00:08:49,190 I think so. 88 00:08:49,250 --> 00:08:52,030 We're observing a decrease in the number of incidents. 89 00:08:52,030 --> 00:08:58,270 Back in 2019, it was absolutely insane where we had multiple exchanges sometimes compromised within a single week. 90 00:08:58,270 --> 00:09:03,890 So far, we're seeing four exchanges with only two of them, resulting in a direct monetary loss. 91 00:09:04,190 --> 00:09:12,790 Speaking of damage, financial damage itself, the total amount of loss was in $175 million. 92 00:09:12,830 --> 00:09:20,890 Back last year, we're almost six months into the year and the total losses so far only $4 million. 93 00:09:20,890 --> 00:09:23,190 So the financial damage is going down. 94 00:09:23,710 --> 00:09:28,250 What's also very interesting to see is that folks are very open about the compromises. 95 00:09:28,250 --> 00:09:31,070 They release incident reports within 24 hours. 96 00:09:31,070 --> 00:09:36,110 They tell exactly who is affected, what was the issue. 97 00:09:36,350 --> 00:09:38,750 So that response is just really good to see. 98 00:09:39,890 --> 00:09:45,110 On the other hand, as I mentioned, the types of incidents that could have been really easily avoided. 99 00:09:45,330 --> 00:09:49,150 SIM swapping, that could have been locked down ahead of time. 100 00:09:49,510 --> 00:09:58,510 Letting people, employees run official work on unmanaged personal laptops is just a very risky thing to do. 101 00:10:00,410 --> 00:10:06,930 Another trend is the attackers going after more than just HawkWallet, not more than just the coins themselves. 102 00:10:07,050 --> 00:10:14,950 So I imagine that whatever PII they stole on Monday, come Monday, they will turn around and try to perform SIM swapping attacks. 103 00:10:14,950 --> 00:10:30,990 In fact, there was an article, I believe, where there was an interview with the attackers where they explicitly said that, well, you know what, we could, the best way for us to monetize is to actually just to start SIM swapping instead of trying to sell that data or using any other type of attack. 104 00:10:31,410 --> 00:10:34,510 So this is something we may see more in the future. 105 00:10:35,570 --> 00:10:41,790 Next, let's talk about the asset security, specifically security of the protocols. 106 00:10:41,790 --> 00:10:47,370 We're talking about the interaction between different chains and nodes and all of that. 107 00:10:47,830 --> 00:10:55,290 Well, the best example are the variety of 51% attacks, which have been always happening, continue happening. 108 00:10:55,690 --> 00:10:58,790 First, we'll cover two incidents with Bitcoin Gold. 109 00:10:58,790 --> 00:11:03,810 So the first incident was back in January 23rd and 24th. 110 00:11:03,810 --> 00:11:07,410 So there were in fact two 51% attacks back-to-back. 111 00:11:07,410 --> 00:11:16,050 It resulted in 29 block re-ORC, which is fairly sizable, and it definitely resulted in a double spin. 112 00:11:16,050 --> 00:11:17,250 So this is unfortunate. 113 00:11:17,250 --> 00:11:23,370 This is something that we observed happening for a while. 114 00:11:23,370 --> 00:11:37,130 Any coin which is relatively lower hash power and has a hash power available for sale that you can easily rent on something like NiceHash is getting a 51% attack. 115 00:11:37,370 --> 00:11:47,170 What's interesting is the second incident on July 10th is that the attacker apparently once again tried to rent out some hashing power on NiceHash. 116 00:11:47,290 --> 00:11:56,230 But in this case, the miner who rented out their capacity apparently figured out they're doing something bad and was able to notify Bitcoin Gold developers. 117 00:11:56,430 --> 00:12:09,710 So what they did in response to that was fascinating and potentially trend for the future is that they contacted miners in secret and distributed a modified piece of node software which had a checkpoint . 118 00:12:09,710 --> 00:12:16,310 That checkpoint essentially invalidated whatever new chain that the attacker was mining in secret. 119 00:12:16,470 --> 00:12:23,730 So what happened was once the attacker actually published the reorg chain, it was not accepted by the network. 120 00:12:23,730 --> 00:12:28,010 So they wasted all their money on NiceHash and all their efforts. 121 00:12:28,910 --> 00:12:35,530 Bitcoin Gold published their report about what happened, what they did to defend the network. 122 00:12:36,750 --> 00:12:41,690 This is concerning and this is interesting also in two ways. 123 00:12:41,690 --> 00:12:52,090 On one side, it's great that they were able to catch it, but this was only done because one of the NiceHash miners was vigilant enough to be able to notify them. 124 00:12:52,090 --> 00:12:54,350 So this could have been just as easily missed. 125 00:12:54,690 --> 00:13:10,370 Depending on how you view those networks introducing checkpoints into your protocol, secretly communicating with miners, it depends on your specific looks and on decentralization, that may be considered by some as something that we don't want to see. 126 00:13:10,370 --> 00:13:23,890 But it worked in this case and we'll in fact see later on when we talk about Vertcoin, it is once again something that repeated where developers of Node software are communicating with miners in order to help secure the network. 127 00:13:24,270 --> 00:13:28,990 Another interesting trend about this particular attack is that the reorg was massive. 128 00:13:28,990 --> 00:13:31,150 It was 1300 blocks reorg. 129 00:13:31,150 --> 00:13:37,290 So the attackers are willing to spend and invest significant funds into their attacks. 130 00:13:37,290 --> 00:13:57,530 In fact, the most recent incident, which is still ongoing, is starting August 1st, is a massive 3500 block reorg, the first of two, where an attacker apparently spent more than 200k on NiceHash to rent capacity in order to double spend and exchange. 131 00:13:57,850 --> 00:14:01,650 So in this, in the slide, I'm only listing the first incident. 132 00:14:01,650 --> 00:14:12,270 There was in fact yet another reorg attempt, successful reorg attack on the Ethereum Plastic Network with another massive 4000 block reorg. 133 00:14:13,350 --> 00:14:17,990 So some of the insights in this is that these types of attacks will continue. 134 00:14:17,990 --> 00:14:31,670 Any coin which has easily rentable GPU capacity that you can rent on NiceHash or something that you can repurpose from another coin, they will be attacked. 135 00:14:31,770 --> 00:14:34,530 They're under a risk of getting attacked. 136 00:14:36,310 --> 00:14:53,350 What's another interesting observation, what Bitcoin Gold did with working with miners and kind of trolling the attackers by not saying to everyone, like, hey, we know there's an attacker and they're about to release their secret chain anytime now. 137 00:14:53,350 --> 00:15:03,050 They actually waited for the attacker to waste their capacity and their funds until they found out, like, wow, okay, this was all wasted effort. 138 00:15:04,650 --> 00:15:11,010 So what I covered before were traditional 51% attacks against proof of work networks. 139 00:15:11,590 --> 00:15:22,970 What's interesting happening on the blockchain networks today are, is that there's a trend towards shifting into proof of stake consensus algorithms. 140 00:15:23,190 --> 00:15:36,790 So what I'll cover are two different coins, so Steemit incident and the Ethereum incident, and explain how they're potentially trend setting and something that we may see more in the future rather than just more and more 51% attacks. 141 00:15:37,190 --> 00:15:47,350 So on the Steemit side, I guess just to summarize the incident, Justin Sun from Tron purchased the Steemit coin. 142 00:15:47,430 --> 00:15:57,930 There was a disagreement over how to manage vast assets of frozen funds that were initially pre-mined since the beginning of Steemit. 143 00:15:58,330 --> 00:16:18,510 The way that this disagreement was addressed was not through negotiation and trying to find some kind of agreement, but in fact it was on the Tron side, they decided to attack the coin by taking over its delegated proof of staking algorithm. 144 00:16:18,550 --> 00:16:27,530 So if you're familiar with proof of stake algorithm, the more coins you have, you can take those coins, you can lock them up somehow to give you some voting power. 145 00:16:27,530 --> 00:16:36,230 So you can, this is what's called staking, in order to produce blocks or vote for whatever unchained action. 146 00:16:36,230 --> 00:16:40,150 So some coins use governance for that. 147 00:16:40,490 --> 00:16:48,650 In the delegated proof of stake systems, you don't vote for blocks yourself directly. 148 00:16:49,030 --> 00:16:56,050 Something, for example, in ETH 2.0, you need to lock up 32 ETH and you can vote on blocks and can validate blocks. 149 00:16:56,050 --> 00:17:06,890 With delegation, you in fact delegate a set of validators and you empower them and you entrust them to validate and produce blocks. 150 00:17:06,890 --> 00:17:10,270 So this is the system used in Steemit, EOS, and other coins. 151 00:17:10,790 --> 00:17:23,970 So what happened in this particular incident is that Tron colluded with a number of large exchanges which were holding vast amounts of Steemit coin in order to gain the controlling package of the asset. 152 00:17:24,110 --> 00:17:31,790 Once they got that, they were able to vote in a controlling set of validators, which allowed them to basically control the network. 153 00:17:31,790 --> 00:17:35,450 They were empowered to set what are the consensus rules. 154 00:17:35,990 --> 00:17:59,750 Once they gained that right, they were able to push an updated node software, which unfroze through basically a hard fork, unfroze those funds, which were from the initial pre-mine, which absolutely gave Tron a controlling package of the asset in the system where no one could really challenge them and they were able to hold on to their power indefinitely. 155 00:18:02,080 --> 00:18:15,520 Taking the ethics aside, there are arguments on both sides that, you know, why did this have to break down into a technical attack when something that could have been agreed upon just by dialogue? 156 00:18:15,520 --> 00:18:22,180 What's interesting about this, this is the first case of a proof-of-stake attack and we could see how it played out. 157 00:18:22,820 --> 00:18:26,220 The way that it played out was very quickly. 158 00:18:26,220 --> 00:18:46,080 Between the time that Tron was able to get the controlling package of Steemit coins, to pushing their own set of validators, to pushing a hard fork, to unfreeze funds, to taking those funds and, you know, multiplying how much voting power they have, it didn't take months or even weeks, 159 00:18:46,080 --> 00:18:47,120 it took hours. 160 00:18:47,120 --> 00:18:48,960 So it was a highly coordinated attack. 161 00:18:48,960 --> 00:18:52,940 It was executed very precisely and effectively. 162 00:18:54,360 --> 00:18:56,960 So this was a fascinating example. 163 00:18:58,380 --> 00:19:13,180 On the Ethereum side, we're, again, Ethereum is something that has massive hash power, so we're not going to see, highly unlikely we're going to see 51% attacks, but there's still a variety of things that people do, such as mempool manipulation. 164 00:19:13,360 --> 00:19:37,220 When there was a black swan event, when the price of Ethereum crashed and a bunch of MakerDAO auctions were starting to get liquidated, there was apparently a mempool attack where they tried to cause a high degree of congestion so that some individuals were able to create a number of liquidation bids for nothing, 165 00:19:37,220 --> 00:19:44,340 zero bid liquidations, and be able to win them because they essentially did not have any competition because the network was congested. 166 00:19:44,340 --> 00:19:46,420 This is a very interesting approach. 167 00:19:46,420 --> 00:20:00,260 We've seen mempool attacks before, but this is interesting how we are manipulating the underlying protocol, underlying Ethereum network, in order to attack higher level smart contracts and DeFi projects as well. 168 00:20:01,100 --> 00:20:09,840 So some network security insights from what we've seen is that Steemit, that opens up a new era of proof-of-stake attacks and governance attacks. 169 00:20:09,840 --> 00:20:20,220 Instead of being worried that someone will buy up a whole bunch of miners or mining capacity, hash power capacity on NiceHash, now the power is in the exchanges. 170 00:20:20,220 --> 00:20:27,060 So exchanges control the most coins, exchanges colluding together may decide to attack a chain. 171 00:20:27,240 --> 00:20:31,580 So this is something that we have to be on the lookout for now. 172 00:20:32,200 --> 00:20:42,840 Attackers are getting more creative as well, so mempool manipulation in order to attack a DeFi project is something interesting that we'll likely see as well. 173 00:20:45,030 --> 00:20:53,190 Let's switch gears a little bit and instead of talking about asset security on the protocol side, let's talk about the underlying software itself. 174 00:20:53,190 --> 00:21:02,590 In the end, it's all abstract, it all works in the cloud, but what's actually working, the actual logic and code that runs is a node software itself. 175 00:21:03,990 --> 00:21:12,810 Nodes are complex pieces of software and the inevitable that they will have bugs and vulnerabilities. 176 00:21:13,490 --> 00:21:22,330 So a few interesting incidents that I want to cover so far this year, two of them happen on the testnet, so I'll start from left to right. 177 00:21:22,350 --> 00:21:26,470 So the Solana network, there were no issues in the protocol itself. 178 00:21:26,470 --> 00:21:31,330 So the design, I believe it uses a BFT-like system. 179 00:21:32,210 --> 00:21:46,150 The issue was in the implementation, there was a flaw, there was a vulnerability in the way that it failed to, the node software failed to validate transactions, which essentially allowed somebody to print 500 million Solana coins. 180 00:21:48,190 --> 00:22:05,290 On the mainnet project, so the Tendermint, this is the underlying consensus library used by projects like Cosmos and others, a denial of service vulnerability was discovered, which essentially allowed someone to halt the entire network. 181 00:22:05,530 --> 00:22:15,850 And again, this was done not because of some flaw in the protocol, it was because of nodes failing to validate specially crafted blocks. 182 00:22:16,570 --> 00:22:19,490 The last example is the inflation bug. 183 00:22:19,490 --> 00:22:23,450 Those are particularly dangerous because they affect the entire ecosystem. 184 00:22:23,990 --> 00:22:29,210 Luckily, this one was discovered again on the testnet where 9 billion file coins were minted. 185 00:22:29,430 --> 00:22:33,450 This was patched and did not affect the mainnet. 186 00:22:33,890 --> 00:22:42,970 But you can see like the vulnerability, there are only three examples that I'm listing here, but the vulnerabilities in node software can have severe implications for the market. 187 00:22:43,990 --> 00:22:49,390 On the wallet side, again, any piece of software will have vulnerabilities. 188 00:22:49,750 --> 00:23:03,450 Monero wallet failed to validate specially crafted coinbase transactions to be specific, which resulted in it appearing as if you received more of Monero than was actually sent. 189 00:23:03,630 --> 00:23:09,950 This is something similar to, if you recall, there were a whole bunch of exchanges compromised with the ripple. 190 00:23:11,050 --> 00:23:19,950 There was a special flag which is basically telling you how much you are vouching to send as opposed to how much you actually are going to send. 191 00:23:20,070 --> 00:23:32,630 So there's a potential for exchanges or individual wallet owners to incorrectly credit whoever is sending them funds. 192 00:23:32,930 --> 00:23:38,570 Lightning network, it's still very much alpha system, so it continues to have vulnerabilities discovered and patched. 193 00:23:38,570 --> 00:23:46,050 There are a lot of papers getting published, so this is actually a good sign that people are looking into it and finding flaws early on. 194 00:23:46,490 --> 00:24:03,790 Now Argent wallet, that was an interesting bug that was responsibly disclosed by OpenZeppelin and effectively patched by the Argent folks, is that it allowed users to basically create a kind of recovery mechanism using specialized guardian nodes. 195 00:24:03,990 --> 00:24:11,290 And in rare occasions when such nodes were not properly defined, it allowed anyone to take over those wallets. 196 00:24:11,410 --> 00:24:15,850 Once again, this was patched, but an example of vulnerabilities in wallets. 197 00:24:17,490 --> 00:24:22,090 What's more interesting are not the vulnerabilities that are discovered and patched. 198 00:24:22,650 --> 00:24:24,270 This is normal. 199 00:24:24,290 --> 00:24:30,030 What's more interesting are intentional backdoors that are introduced in both wallets and node software. 200 00:24:30,450 --> 00:24:34,690 So the first incident I'm going to cover happened in the Trinity wallet. 201 00:24:36,410 --> 00:24:39,250 We've seen backdoored wallets for a while. 202 00:24:39,250 --> 00:24:44,130 Last year I talked a lot about the Electrum wallets getting backdoored. 203 00:24:44,170 --> 00:24:51,430 The way they attacked the Trinity wallet was not directly, after the main repository itself. 204 00:24:51,430 --> 00:24:56,010 Instead, they were going after the third-party dependency. 205 00:24:56,010 --> 00:25:01,670 So the third-party dependency on which Trinity wallet was relying to was patched to steal users' keys. 206 00:25:01,670 --> 00:25:08,990 That was included in the main repository, and any user downloading and using this was heading at this asset stolen. 207 00:25:09,710 --> 00:25:13,510 Ravencoin incident was even more vicious. 208 00:25:13,510 --> 00:25:24,230 On July 4th, an inflation bug was discovered, and an emergency patch was issued to a variety of nodes and distributed to miners. 209 00:25:25,350 --> 00:25:30,030 And this is something that initially maybe was just a vulnerability . 210 00:25:30,030 --> 00:25:36,810 Every once in a while you discover those things, until the point they realized that the bug was intentionally introduced. 211 00:25:36,810 --> 00:25:44,960 It was introduced back early in the year, in January, by an account which was a throwaway GitHub account. 212 00:25:45,360 --> 00:25:56,000 The patch appeared to be a very innocent-looking commit, which allowed you to be more verbose about the type of errors that you're getting. 213 00:25:56,000 --> 00:26:01,800 So it snuck by the core maintainer's eyes. 214 00:26:01,800 --> 00:26:03,640 They were not able to detect that. 215 00:26:03,880 --> 00:26:07,760 And for months now, they were slowly minting. 216 00:26:07,760 --> 00:26:11,500 There was a script running that was slowly minting RVN coins. 217 00:26:11,500 --> 00:26:18,460 So in total, 300 million RVN coins were minted over time, and unfortunately also sold on exchanges. 218 00:26:18,460 --> 00:26:25,120 So this was a successful inflation bug that was maliciously introduced and exploited. 219 00:26:26,100 --> 00:26:35,340 These are particularly scary, and I'm sure we'll see this again and again, because they attack the whole ecosystem rather than individual user or piece of software. 220 00:26:37,880 --> 00:26:42,880 So some insights on node and wallet software security. 221 00:26:43,860 --> 00:26:45,780 Vulnerabilities are still very rare. 222 00:26:45,780 --> 00:26:50,940 We only talked about four flaws here, and one was introduced intentionally. 223 00:26:51,080 --> 00:27:00,420 The question and challenge to you, do we really have enough eyes looking at nodes, looking for the vulnerabilities, and being able to patch them? 224 00:27:00,420 --> 00:27:09,360 There are bug bounties which are available, but I wonder if there are enough participants and enough folks which are really pushing the limits of how secure that software is. 225 00:27:09,940 --> 00:27:12,940 Ravencoin stealth commit and Trinity supply chain threats. 226 00:27:12,940 --> 00:27:15,040 This will likely happen again. 227 00:27:15,460 --> 00:27:16,940 Attackers are highly motivated. 228 00:27:16,940 --> 00:27:21,440 There's a direct financial profit in attacking these pieces of software. 229 00:27:21,780 --> 00:27:24,420 So this will likely repeat. 230 00:27:27,100 --> 00:27:34,980 So switching gears a little bit on the layer two issues, which is smart contracts, that's even more concerning. 231 00:27:35,020 --> 00:27:37,960 There were, I mean, I'm listing here 10 incidents. 232 00:27:37,960 --> 00:27:42,000 There was one more that happened in the last few days, which is not included here. 233 00:27:42,640 --> 00:27:53,660 As DeFi projects are getting more and more popular, this is complex software, which once again has a lot of different vulnerabilities which are constantly getting discovered. 234 00:27:53,860 --> 00:28:01,020 I'm not going to cover all of these, just it would take a whole hour on its own, but I'll focus on just three of these. 235 00:28:01,420 --> 00:28:03,700 So we'll start left to right. 236 00:28:03,700 --> 00:28:10,400 The first incident that basically opened the year was the VZX DeFi project back in February. 237 00:28:11,200 --> 00:28:16,420 And the way that it started out was there was a margin trading vulnerability that was exploited. 238 00:28:16,420 --> 00:28:18,880 1 million worth of ETH was stolen. 239 00:28:19,000 --> 00:28:26,760 What was interesting about this particular incident is that the attacker used flash loans in order to amplify the attack. 240 00:28:26,760 --> 00:28:39,240 Flash loans is basically a mechanism where you can borrow X amount of an asset and return it back to the initial point all within the same transaction. 241 00:28:39,240 --> 00:28:50,380 So you're paying non-existent or minimal fees for doing that and allows you to execute an attack in between since you have all these assets available to you in order to execute the attack. 242 00:28:50,380 --> 00:29:05,000 So this kind of defeats a kind of a paradigm that we had before where we think that if it costs so much money to attack something, that it makes it less likely that someone will actually execute the attack. 243 00:29:05,000 --> 00:29:14,320 But with flash loans, attackers have really minimal risk to basically the transaction reverting, then so be it, they don't lose anything. 244 00:29:14,320 --> 00:29:20,880 And they can return those funds and whatever they loaned and they don't really lose anything. 245 00:29:20,880 --> 00:29:23,000 But if they win, then they win big. 246 00:29:23,000 --> 00:29:25,980 So in this case, they won one million dollars worth of ETH. 247 00:29:27,200 --> 00:29:33,760 And we start seeing this flash loans approach happen again and again throughout the year from this point on. 248 00:29:34,280 --> 00:29:38,060 Another incident which is interesting to note is the balancer project. 249 00:29:38,120 --> 00:29:41,800 So again, 500k was drained from multi-token pools. 250 00:29:41,800 --> 00:29:53,780 This one is interesting because it wasn't the vulnerability in the balancer smart contract itself, it was in the way that one complex project was interacting with another complex project. 251 00:29:53,780 --> 00:30:04,280 In this case, the developers could not predict that you could use deflationary tokens which change the logic to the attacker's advantage. 252 00:30:04,980 --> 00:30:12,160 So when on its own, like in all their testing with traditional token systems, then it works as expected. 253 00:30:12,640 --> 00:30:20,880 So this is something that is well known in the traditional computer security practice and something that needs to be applied to DeFi projects as well. 254 00:30:20,960 --> 00:30:27,080 Another gotcha in this one is that the vulnerability was reported in a bug bounty report. 255 00:30:27,080 --> 00:30:29,220 So the good news is bug bounties work. 256 00:30:29,220 --> 00:30:33,420 I think a lot of the projects in the DeFi space do have bug bounties. 257 00:30:33,520 --> 00:30:43,880 It's just, it's very hard to triage those things, very hard to find the ones which are real examples of an attack and or which ones are not as good quality. 258 00:30:43,880 --> 00:30:49,480 So this is something to keep in mind when running your own bug bounties. 259 00:30:49,640 --> 00:31:06,500 The last example, and again this is something that example here repeated in other incidents, is a Bancor project where developers were notified that they had a vulnerability, so they learned there was an issue. 260 00:31:07,000 --> 00:31:22,720 And the way that they approached to protect their users is by attacking their own coin, their own smart contract, with the same ways that an attacker would, it's just that with the purpose of actually preserving users funds. 261 00:31:22,940 --> 00:31:42,140 But what was interesting here is that arbitrage bots, apparently they're a piece of software constantly monitoring the Ethereum network, seeing that if there's some large activity happening and it started automatically replaying it, trying to make arbitrage opportunities, 262 00:31:42,140 --> 00:31:53,700 exploit arbitrage opportunities there, picked up on developers trying to secure users funds and were automatically able to exploit the project in the same way that the developers were doing it. 263 00:31:53,700 --> 00:32:02,280 So it's fascinating to see those automated pieces of software that just piggyback off existing attacks. 264 00:32:04,120 --> 00:32:08,340 So some insights on the Layer 2 smart contract security. 265 00:32:08,500 --> 00:32:11,300 This is going to be the year of DeFi hacks. 266 00:32:11,560 --> 00:32:22,760 Both in the amount lost, the number of vulnerabilities discovered, unfortunately the number of incidents is on the rise. 267 00:32:23,360 --> 00:32:26,140 So it will likely continue seeing that this year. 268 00:32:27,740 --> 00:32:33,500 The bug bounty programs, they work and developers are catching bugs early, which is a good sign. 269 00:32:33,520 --> 00:32:38,320 And I'll explain to you why in a bit when we talk about tooling and guidelines. 270 00:32:39,800 --> 00:32:45,080 But the interesting trend is by Bancor is that we often have to hack ourselves to secure funds. 271 00:32:45,920 --> 00:33:02,780 Complex code will continue having bugs and complex interactions between different projects are also something that we need to think about as this is the whole point of DeFi is that you're creating links between vast smart contract projects out there. 272 00:33:04,990 --> 00:33:13,710 So I promised to talk about user security and we had a few major incidents that we're going to cover shortly from Twitter and so on. 273 00:33:14,850 --> 00:33:24,630 But this is sometimes not as exciting of a field to look at, but just as critical as any other discipline. 274 00:33:25,470 --> 00:33:34,830 So we're going to talk about cryptocurrency malware, variety of scam and fraud schemes, as well as just talk a little bit like who are the bad actors? 275 00:33:34,830 --> 00:33:35,890 Who is doing that? 276 00:33:35,890 --> 00:33:38,550 Who are the new players in this arena now? 277 00:33:39,650 --> 00:33:44,570 So first, let's talk about the crypto mining malware. 278 00:33:44,670 --> 00:33:57,090 And this is how I got into partially into cryptocurrencies is that essentially for a year, I was reversing nothing but ransomware and crypto mining samples. 279 00:33:57,670 --> 00:34:08,530 For on the crypto mining side, it was always the Monero folks, they are setting up their miners XM rig into anything that can possibly run XM rigs. 280 00:34:08,530 --> 00:34:12,050 If they can run it on toasters, they probably would run it on toasters. 281 00:34:12,330 --> 00:34:21,250 So far this year, it's not as bad as Russian scientists mining on nuclear stations. 282 00:34:21,330 --> 00:34:26,270 But still, five EU supercomputers were hacked in order to run Monero miners. 283 00:34:26,550 --> 00:34:43,710 We had multiple issues with Docker where attackers were scanning vulnerable API endpoints to take over existing Docker images or just publishing their own backdoored Docker images on the Docker hub, which would also mine Monero in the background. 284 00:34:43,990 --> 00:34:50,010 And of course, there's just never ending stream of Windows desktop malware. 285 00:34:50,010 --> 00:35:01,910 One example is Lucifer, which is just, it's an arsenal of, it was a whole exploit kit built into it, which can self propagate attack other Windows machines and spread on its own. 286 00:35:03,990 --> 00:35:09,850 So on the ransomware side, it seems like this is an ongoing threat. 287 00:35:09,850 --> 00:35:21,630 I'm not sure yet if the trend is going down yet, but so far we had UCSF, which was attacked for 100 Bitcoin or so, Travelex earlier this year, 285. 288 00:35:22,670 --> 00:35:28,370 Just a few days ago, we learned that Canon was attacked with ransomware by, I believe, the Maze crew. 289 00:35:28,750 --> 00:35:29,790 We don't know. 290 00:35:29,850 --> 00:35:35,170 They're known to ask for Bitcoin as a compensation, as a ransom. 291 00:35:35,170 --> 00:35:39,430 So we'll find out when the incident concludes. 292 00:35:39,430 --> 00:35:45,210 And of course, it seems like every city in Florida is getting ransomware on their machines. 293 00:35:45,210 --> 00:35:50,570 So an example of city Riviera had to pay 65 Bitcoins to get their systems back online. 294 00:35:52,490 --> 00:35:54,010 Yeah, so this sucks. 295 00:35:54,010 --> 00:35:54,930 This is unfortunate. 296 00:35:54,930 --> 00:36:02,430 This is a threat that we have to worry about, especially on systems like UCSF in the time of COVID. 297 00:36:02,430 --> 00:36:05,490 But this is something we'll continue seeing. 298 00:36:05,490 --> 00:36:13,570 Monero miners will hack anything available to them to install the crypto mining malware. 299 00:36:14,050 --> 00:36:21,030 Ransomware appears to be on the decline, but it's too early to say we're still only halfway through the year to establish a trend. 300 00:36:22,270 --> 00:36:23,930 Crypto giveaways. 301 00:36:24,630 --> 00:36:29,690 Well, I mean, we all talked about the Twitter hack, which was absolutely epic. 302 00:36:29,690 --> 00:36:36,930 I don't want to steal Victor's keynote presentation tomorrow, but he'll dive into more details. 303 00:36:36,930 --> 00:36:46,050 But just to summarize, 130 accounts were hijacked on Twitter from exchanges to celebrities to corporate accounts. 304 00:36:46,110 --> 00:36:54,950 The way they were hijacked is that the attackers were able to basically get access to the internal tools through social engineering of Twitter employees. 305 00:36:55,470 --> 00:36:56,970 And that's kind of fascinating. 306 00:36:56,970 --> 00:37:02,790 The best thing they could think of doing it was running a BTC giveaway scam. 307 00:37:02,990 --> 00:37:05,430 So on one side, this is really bad. 308 00:37:05,430 --> 00:37:08,050 On the other side, it could have been much worse. 309 00:37:08,850 --> 00:37:13,570 Elon Musk is getting no break from YouTube scammers. 310 00:37:13,570 --> 00:37:20,230 So anytime you see a SpaceX feed, there's likely going to be send BTC notes everywhere. 311 00:37:20,230 --> 00:37:21,850 So sorry, Elon. 312 00:37:23,990 --> 00:37:28,250 MLM scams are still continuing on as before. 313 00:37:28,250 --> 00:37:34,770 So we started with the BitConnect and moved on to $4 billion enterprise plus token. 314 00:37:34,770 --> 00:37:46,350 And now the latest and greatest is Chinese police just busted wall token scammers who managed to get $1 billion worth of crypto from 700,000 victims. 315 00:37:49,120 --> 00:38:04,280 What's more interesting is not just the existing scams or the ones that I covered before, but the trends of what are we going to see attackers experimenting with, which may become something more prevalent. 316 00:38:05,080 --> 00:38:07,840 So one example is the MakerDAO phishing attack. 317 00:38:07,840 --> 00:38:12,100 And that is the first example of a Web3 phishing scam. 318 00:38:12,100 --> 00:38:16,960 So you think that you are exchanging side to die. 319 00:38:19,980 --> 00:38:27,000 You are interacting with MetaMask or so you think you're putting in your keys and then bam, all your coin is stolen. 320 00:38:27,000 --> 00:38:33,180 So this is something that was reported early in the year and something potentially we'll see in the future. 321 00:38:34,060 --> 00:38:38,760 The Justin Sun deepfake scam, that was fascinating. 322 00:38:38,760 --> 00:38:50,900 Someone essentially recorded a video of Justin Sun doing some kind of investor scam, trying to get people to send money to this unknown entity. 323 00:38:51,500 --> 00:39:01,160 And they played that video on a Skype call complete with Justin cuffing and it looked very real and also very fake and strange at the same time. 324 00:39:01,160 --> 00:39:03,800 They faked his passport to show for some reason. 325 00:39:03,980 --> 00:39:08,520 If you want to search that on YouTube, it's a fascinating video to watch. 326 00:39:09,100 --> 00:39:16,860 It's still not something that was successful, but it's kind of fascinating that scammers are even exploring deepfakes for that purpose. 327 00:39:17,320 --> 00:39:20,860 The last example is the trust wallet scam. 328 00:39:20,860 --> 00:39:27,420 So we see just a barrage of backdoored fake wallet software everywhere. 329 00:39:27,740 --> 00:39:48,360 If you search on Google, if you search in the app stores, what's interesting about this case is not the wallet itself, it's how it was addressed, which is a security researcher was able to actually attack the infrastructure, a fairly broken infrastructure on the attacker side to start recovering the funds. 330 00:39:48,460 --> 00:39:54,960 And this is an interesting trend of basically folks taking things into their own hands to help users. 331 00:39:56,420 --> 00:39:58,760 So a quick note about the bad actors. 332 00:39:58,760 --> 00:40:06,680 So we already talked about the individual attackers, so the Twitter folks, three were already arrested, one in Florida, one in UK. 333 00:40:07,820 --> 00:40:10,640 So we'll call them lone wolf type attackers. 334 00:40:11,560 --> 00:40:21,120 Insider threats such as Kasha employee who got malware in their machine and unfortunately resulted in funds loss. 335 00:40:21,220 --> 00:40:23,120 Let's talk about APTs. 336 00:40:23,120 --> 00:40:34,680 So we're familiar with Lazarus Group, so that's a North Korean APT, and a whole variety of financial ransomware groups who basically attack anything with financial gain. 337 00:40:34,680 --> 00:40:45,280 What's interesting this year is the CryptoCore APT, which is our very own dedicated cryptocurrency exchange advanced persistent threat. 338 00:40:45,940 --> 00:41:00,320 So with a bull market maybe happening sometime in the future and the renewed interest, we're probably going to see more dedicated groups like this as this becomes highly profitable enterprise. 339 00:41:01,840 --> 00:41:03,520 So some insights. 340 00:41:05,020 --> 00:41:08,400 One is that users are taking things into their own hands. 341 00:41:08,660 --> 00:41:13,960 So we have Woz who's suing YouTube for being too slow at taking down the giveaway scams. 342 00:41:14,020 --> 00:41:22,840 We have Michael Turpin suing AT&T to basically compensate him for allowing the sim swap to happen in the first place. 343 00:41:22,840 --> 00:41:29,040 We have researchers like Harry Denley reverse hacking scammers to get users' funds back. 344 00:41:29,140 --> 00:41:53,320 While it does sound good on one hand that people are really pushing their fighting back against the scammers, I really wish the industry was more mature and we had enough tools on one side, but also user education and guidelines and other security controls available that not as many people would get compromised in the first place. 345 00:41:54,040 --> 00:41:57,120 MLM schemes are incredibly profitable. 346 00:41:57,120 --> 00:42:06,900 So this year out of all cryptocurrency scams, basically 99% of the take was the Wo token $1 billion scam. 347 00:42:07,020 --> 00:42:16,740 In the past, plus token with their $4 billion take, I think controlled a whole 1% of the total Bitcoin supply. 348 00:42:16,740 --> 00:42:20,320 So these things are incredibly profitable and will definitely continue. 349 00:42:21,280 --> 00:42:26,180 An interesting trend that exchanges are proactively blocking bad addresses to protect their users. 350 00:42:26,180 --> 00:42:30,220 So there's always debate of centralized storage versus decentralized storage. 351 00:42:30,280 --> 00:42:45,060 That's something that was interesting to observe this year is that exchanges like Coinbase, they were basically blacklisting the attacker addresses immediately to save their internal customers' funds. 352 00:42:45,200 --> 00:42:55,400 This is something that could be decentralized as well if you're looking for a project to be able to alert users of doing some kind of unsafe action. 353 00:42:55,400 --> 00:42:59,660 And I believe a few projects like MyCrypto are in fact doing that already. 354 00:43:01,000 --> 00:43:02,600 Scammers are getting more creative. 355 00:43:02,600 --> 00:43:09,640 So the Web3 phishing sites and the deepfake scams, this is fascinating to see. 356 00:43:09,640 --> 00:43:17,280 I'm not sure how profitable they are yet, but if they do become profitable at one point, we'll see a very rapid rise of them. 357 00:43:21,480 --> 00:43:33,280 So to summarize the state of blockchain security insights that we've seen so far, we talked about the exchange security, the number of hacks and financial damage is decreasing. 358 00:43:33,280 --> 00:43:34,520 That's great. 359 00:43:35,020 --> 00:43:38,820 On the other side, existing incidents could have been easily prevented. 360 00:43:39,240 --> 00:43:41,720 Attackers are going after more than just coins. 361 00:43:41,720 --> 00:43:42,680 They're going after PII. 362 00:43:42,680 --> 00:43:44,040 They're getting creative. 363 00:43:44,570 --> 00:43:52,800 On the asset side, low hash rate GPU mineable proof-of-work coins are getting 51% attack, will continue getting 51% attacked. 364 00:43:53,020 --> 00:43:58,680 There was a first example of a proof-of-stake attack, and it was very efficiently executed. 365 00:43:59,280 --> 00:44:02,380 We're not finding nearly enough node wallet vulnerabilities. 366 00:44:02,380 --> 00:44:08,480 I think there's an opportunity there for independent security researchers to really start looking at that. 367 00:44:09,180 --> 00:44:19,620 Nasty backdoors and supply chain attacks against nodes and wallets Again, if you can backdoor a node, you can attack the whole coin as the whole ecosystem. 368 00:44:19,620 --> 00:44:24,260 You don't have to go after individual people and you can take basically the whole asset down. 369 00:44:24,260 --> 00:44:27,500 So this is highly dangerous, highly critical to start looking at. 370 00:44:28,280 --> 00:44:36,260 D5 vulnerabilities are unfortunately on the rise and so are the attacks as the whole ecosystem is becoming more popular. 371 00:44:36,580 --> 00:44:42,000 On the user side, I don't see any new threats which are suddenly popped up. 372 00:44:42,080 --> 00:44:52,560 It's just a consistent threat from miners, ransomware, fake software, and scammers are still sticking to giveaway scams and MLM schemes. 373 00:44:52,580 --> 00:44:58,640 They're getting more creative here and there, but they, I mean, the giveaway scams unfortunately still work. 374 00:44:58,640 --> 00:45:07,540 So an opportunity here is to work on more user education to see if we can make users a little bit more secure. 375 00:45:08,720 --> 00:45:10,440 So we've seen what the issues are. 376 00:45:10,440 --> 00:45:11,720 We've seen what the problems are. 377 00:45:11,720 --> 00:45:26,120 Here and there, I dropped some ideas of what you can do to contribute to the field, make it more secure, but really we can look at it more holistically and think of the blockchain security as just a standalone industry that we can build up together. 378 00:45:26,120 --> 00:45:31,200 We can grow in terms of maturity, education, projects , and so on. 379 00:45:31,800 --> 00:45:39,120 So some things, some ideas that I'm going to cover of what we can do is we can talk about the guidelines and tools, how we can develop those. 380 00:45:39,120 --> 00:45:48,400 We can talk about growing the community and specifically you, what is it that you can do today to start applying and contributing to this field? 381 00:45:49,080 --> 00:45:56,220 So on the guidelines and tools side, there are a few amazing projects that are available. 382 00:45:56,220 --> 00:46:02,900 So on the consensus diligent folks there, they keep on publishing a variety of software to test smart contracts. 383 00:46:02,900 --> 00:46:15,640 They publish the SWC, smart contracts, weakness classification registry, where you have a listing of top vulnerabilities, give you a good understanding like what they are, how to prevent them. 384 00:46:15,860 --> 00:46:19,020 Trail of bits folks, they're publishing tools one after another. 385 00:46:19,020 --> 00:46:20,580 They have the slither echidna. 386 00:46:20,580 --> 00:46:29,240 They published a document basically summarizing findings from all of their smart contract security assessments. 387 00:46:29,240 --> 00:46:30,040 What are the trends? 388 00:46:30,040 --> 00:46:32,580 What are the top issues to look out for? 389 00:46:32,680 --> 00:46:36,660 Open zeppelin essentially defined the field of how to write secure smart contracts. 390 00:46:36,660 --> 00:46:46,160 I'm seeing a lot of the newer projects, they're just basically verbatim adopting open zeppelin, open zeppelin templates, and they're very secure as a result. 391 00:46:46,320 --> 00:46:52,360 Other projects like securing, they published the smart contract security verification standard. 392 00:46:52,520 --> 00:46:58,360 NCC group published an OWASP style list top 10 list back in 2018. 393 00:46:58,680 --> 00:47:03,180 But unfortunately, it wasn't really maintained for a while. 394 00:47:03,180 --> 00:47:07,740 So it would be interesting for them to give new life to this project. 395 00:47:07,740 --> 00:47:10,340 Another one is the cryptocurrency security standard. 396 00:47:10,340 --> 00:47:17,680 And this one is interesting because if you notice all the previous things that I mentioned, they have to do with smart contracts and Ethereum. 397 00:47:17,680 --> 00:47:29,240 This is the only standard and project out there, which attempts to talk more about how to securely generate keys, how to securely store keys in the cold storage. 398 00:47:29,380 --> 00:47:38,280 I would love to see this project growing and having a larger impact on the security of exchanges and nodes and wallets and so on. 399 00:47:40,820 --> 00:47:42,580 Guidelines and tools are important. 400 00:47:42,580 --> 00:47:53,860 If we are to grow this industry, we need to have large collections readily available for anyone who wants to contribute to this field to be able to quickly learn from the mistakes of the past. 401 00:47:53,860 --> 00:47:56,720 On the smart contract side, I think we're pretty solid. 402 00:47:56,760 --> 00:48:04,260 We have great tooling, we have methodology, we have a variety of companies and consultants who are available to test your smart contracts. 403 00:48:04,260 --> 00:48:15,040 So even though there are a lot of DeFi issues which are getting discovered, but there's enough tools and folks that are experts in this field that can address this trend very quickly. 404 00:48:15,360 --> 00:48:25,260 On the other hand, we're missing core guidelines, core methodology, and practically no tools to address standalone blockchains. 405 00:48:25,800 --> 00:48:38,840 If someone wants to build a new project, what is a good resource that they can read and learn about the failings of the past and how they can learn and correct whatever future designs that they're building? 406 00:48:39,920 --> 00:48:41,780 Node configuration operation. 407 00:48:42,140 --> 00:48:44,840 Nodes are at the core of any blockchain project. 408 00:48:44,840 --> 00:48:51,640 If nodes at some point start having more and more vulnerabilities discovered, then this breaks down everything that is built on top of them. 409 00:48:51,920 --> 00:49:12,540 Hot and cold storage security, key management, protocol design, wallet design, innovations in blockchain forensics, and also user security, how to educate users and give them simple guides on how to avoid scams, how to give them tools to quickly protect them against going to bad websites like Google browser style. 410 00:49:12,540 --> 00:49:15,080 Like this is dangerous, don't send to this address. 411 00:49:16,340 --> 00:49:27,860 One thing that I will be covering later in a separate talk on attacking and defending blockchain nodes is I'm trying to create an OWASP top 10 style listing of what you can do to secure your node infrastructure. 412 00:49:28,360 --> 00:49:42,160 But I invite all of you to pick out any one of those items in the list, or if you imagine that you have more things to contribute to this field, and start writing documentation, start writing tools. 413 00:49:42,160 --> 00:49:46,720 There's an entire field available that you can develop and work with. 414 00:49:47,920 --> 00:49:52,060 On the community side, well, here we are at the Blockchain Village. 415 00:49:52,080 --> 00:49:58,080 There are three other conferences which are also available that you can attend, hopefully virtually, throughout the year. 416 00:49:59,000 --> 00:50:01,600 But I wonder if there should be more. 417 00:50:01,600 --> 00:50:06,980 I imagine that as the community grows and this field grows, we're going to see more and more of these. 418 00:50:07,740 --> 00:50:09,660 We have our own competitions. 419 00:50:10,180 --> 00:50:17,720 So we have this year, I believe, Victor is hosting a blockchain investigation competition. 420 00:50:17,720 --> 00:50:20,540 Last year, we had the Capture the Coin and Chain Heist. 421 00:50:20,540 --> 00:50:25,580 There are some challenges which are ongoing, such as OpenZeppelin's excellent EtherNOT. 422 00:50:25,860 --> 00:50:27,420 So this is great. 423 00:50:28,020 --> 00:50:30,920 On the knowledge sharing side, we have a variety of resources. 424 00:50:30,920 --> 00:50:37,360 So you can go on Telegram, Reddit, Discord here for DEF CON, and you can talk about blockchain security. 425 00:50:37,660 --> 00:50:42,620 Some newsletters that are also working on distributing, disseminating knowledge. 426 00:50:42,620 --> 00:50:51,400 So the one that I'm running is Blockchain Threat Intelligence, where I try to cover every piece of news that is related to this field. 427 00:50:51,440 --> 00:50:54,100 Not just related to smart contracts, but just holistically. 428 00:50:54,100 --> 00:50:58,220 Exchange security, malware, user scams, and all of that. 429 00:50:59,180 --> 00:51:03,120 Consensus Diligence, they're running an excellent smart contract security newsletter. 430 00:51:03,120 --> 00:51:11,680 So if you want to raise focus on Ethereum and Layer 2 security, this is the resource to subscribe to immediately. 431 00:51:12,600 --> 00:51:15,080 We even have our own shitty movies. 432 00:51:15,080 --> 00:51:23,700 So we have Crypto, where we have an AML officer hunting down and investigating blockchains to bring down Russian mafia, and the Money Plane. 433 00:51:23,700 --> 00:51:25,760 I'm not sure exactly what's happening there. 434 00:51:25,760 --> 00:51:31,720 I think the plot is they're hacking crypto on a plane, which is a fortress and a casino. 435 00:51:31,940 --> 00:51:34,360 Point is, we have our movies, we have our media. 436 00:51:34,360 --> 00:51:35,640 We made it officially. 437 00:51:35,640 --> 00:51:36,640 This is great. 438 00:51:37,960 --> 00:51:40,000 So some community insights. 439 00:51:40,000 --> 00:51:48,940 We're still a very small, but growing community with unique competitions, gatherings, chat rooms, challenges, tools, projects, and so on. 440 00:51:48,940 --> 00:51:52,260 Our community should and will continue growing. 441 00:51:52,440 --> 00:51:57,200 What's exciting to see is blockchain security or BlockSec becoming a career option. 442 00:51:57,200 --> 00:52:03,440 Even today, you can look on the internet, you can find jobs to do smart contract security testing if you want to. 443 00:52:03,440 --> 00:52:08,880 You can do blockchain security engineering, so building projects, securing projects. 444 00:52:09,220 --> 00:52:14,360 Cryptocurrency forensic analysis is going to be even more in demand after the Twitter hack. 445 00:52:14,360 --> 00:52:19,520 More people will try to exercise this new skill set. 446 00:52:19,720 --> 00:52:22,440 So I'm hoping this will grow in the future. 447 00:52:23,800 --> 00:52:26,040 The point is, I want to invite you. 448 00:52:26,040 --> 00:52:28,540 I want to invite you to contribute to this field. 449 00:52:28,720 --> 00:52:35,400 So if you enjoy learning about the nitty gritty technical details, consensus negatives, smart contracts, great. 450 00:52:35,400 --> 00:52:37,220 Join BlockSec, contribute to this field. 451 00:52:37,220 --> 00:52:39,620 There's plenty of things to explore and do here. 452 00:52:39,720 --> 00:52:52,800 If you're a security professional, and you're just tired of finding yet another XSS or SQL injection bug, you want to find some cool new things which are just not fully explored yet, basically be able to define the field. 453 00:52:52,800 --> 00:52:54,040 Great, join BlockSec. 454 00:52:54,040 --> 00:52:57,500 There are plenty of bugs that need to be found and patched by you. 455 00:52:58,020 --> 00:53:07,240 Are you an investigator who is trying to hunt down the fraudsters, wants to understand how the hell do we track down fraud and bad guys on the blockchains? 456 00:53:07,240 --> 00:53:08,720 Great, join BlockSec. 457 00:53:08,720 --> 00:53:11,840 There are plenty of blockchain analytics companies out there. 458 00:53:12,460 --> 00:53:17,800 There's a growing body of investigators who are now capable of doing those tasks. 459 00:53:17,800 --> 00:53:18,460 Join them. 460 00:53:18,460 --> 00:53:20,260 This is very interesting. 461 00:53:20,680 --> 00:53:37,580 Finally, if you're a developer, and you're just looking for an exciting new project, and you really want to make an impact on the open financial system, making that system more secure, contributing it to be more trustworthy by the people using it, is a good way to help bring it about. 462 00:53:37,580 --> 00:53:42,580 So with that, join BlockSec, and thank you very much for your time.