WEBVTT 00:03.000 --> 00:09.560 Hello and welcome to the State of Blockchain Security here at the Blockchain Village at DEF CON 28. 00:09.560 --> 00:16.260 I'm excited to share with you just a really zoomed out view of the current state of our industry. 00:16.380 --> 00:21.120 We'll talk about a variety of blockchain security related events, major incidents. 00:21.120 --> 00:24.220 We'll gather some insights and make future predictions. 00:24.240 --> 00:31.060 And most importantly, we'll talk about a lot of opportunities how to build a stronger and more trustworthy financial system. 00:32.360 --> 00:35.400 In case we have not met, my name is Peter Kaczynski. 00:35.460 --> 00:44.960 I'm a blockchain security engineer at Coinbase, where I spend most of my time trying to break and secure a variety of standalone blockchain systems and smart contracts. 00:46.000 --> 00:52.560 On the side, I also publish a blockchain threat intelligence newsletter where I share the latest news. 00:52.720 --> 00:57.320 And partially, I will be recapping some of the major events that I cover in that newsletter. 00:57.880 --> 01:04.060 And in the past, I was also organizer of the Capture the Coin competition at DEF CON. 01:04.440 --> 01:09.300 In the past, I was working also as a malware reverse engineer at FireEye. 01:09.320 --> 01:14.500 If you're a malware reversal, you may have run into a few of my tools such as Flare VM and FakeNetNG. 01:15.400 --> 01:20.800 And I've also reversed a whole lot of APT malware that I care to remember. 01:22.200 --> 01:31.800 Zooming even back out, I was more on the offensive side as well for the Federal Reserve System, where I was working as a penetration tester, trying to break Finance 1.0. 01:32.420 --> 01:36.040 I guess everyone shares their story of how they got into crypto. 01:36.440 --> 01:44.120 The revealing moment for me was just basically my past growing up in the Soviet Union and observing what hyperinflation means in the first place. 01:44.680 --> 01:54.960 So it really, it really stroke a chord in me when I understood what the future offered by the cryptocurrencies. 01:55.600 --> 02:01.080 And I take it as a personal mission to make this field succeed by making it more secure. 02:01.340 --> 02:03.600 And I hope you join me on that mission as well. 02:04.520 --> 02:06.340 So what are we going to talk about? 02:06.500 --> 02:12.380 I would like to help inform, educate, and identify as many opportunities for you as possible. 02:12.380 --> 02:18.660 So if you feel like this is the field for you, you will know exactly where to plug in and what to pursue. 02:20.020 --> 02:25.800 Within this talk, we're going to talk about a variety of incidents, as I mentioned, from the newsletter. 02:26.620 --> 02:29.580 But the key point here is that it's less about me being right. 02:29.580 --> 02:39.080 I will offer some insight and opinions here, but I'm even more excited to start a discussion and learn from you during the Q&A session or offline if you care to reach out. 02:39.540 --> 02:42.780 I would be highly excited to hear your thoughts on it. 02:43.560 --> 02:47.700 In our presentation, we'll begin by defining the field in the ecosystem. 02:47.900 --> 02:49.860 So we'll talk, what is blockchain security? 02:49.860 --> 02:57.080 How is it different from any other security disciplines, let's say web application or IoT security? 02:57.080 --> 02:58.560 What makes it unique? 02:59.060 --> 03:06.720 We will also talk about the overall ecosystem that we're trying to protect and also think how it's getting attacked. 03:07.300 --> 03:14.200 Next, we're going to break down all of the variety of components within the blockchain security field. 03:14.200 --> 03:16.120 So we'll talk about exchange security. 03:16.120 --> 03:18.800 What were the major incidents this year so far? 03:18.800 --> 03:20.320 What can we learn from it? 03:20.320 --> 03:22.900 We're going to talk about the asset security. 03:22.900 --> 03:27.340 So we will discover a variety of protocol issues that are being exploited. 03:27.340 --> 03:30.660 We'll talk about software getting attacked, other weak points. 03:31.080 --> 03:33.160 And last but definitely not least is user security. 03:33.160 --> 03:40.460 We're going to deep dive into the main point of why we're this is for the users, for people to be able to transact securely. 03:42.320 --> 03:58.480 We will finish the presentation with thoughts about building this industry, how to make it more mature, what we can do to share the guidelines that people can just pick up and implement in their next projects, the tools that still need to be developed, 03:58.480 --> 04:00.860 as well as how we can build up our community. 04:02.440 --> 04:07.780 So let's begin first by defining what is blockchain security. 04:07.820 --> 04:09.860 I believe it's a brand new field. 04:09.860 --> 04:17.260 It's a new discipline of information security with a mission of securing and defending the cryptocurrency ecosystem. 04:18.380 --> 04:20.880 What is cryptocurrency ecosystem? 04:21.300 --> 04:24.320 We, again, I mentioned users are at the core of it. 04:24.320 --> 04:29.580 We have a variety of assets, both layer one and layer two. 04:29.580 --> 04:31.600 So smart contracts and all of that. 04:31.600 --> 04:36.740 So nodes, wallets, smart contracts are all within the scope of this field. 04:36.740 --> 04:49.340 Of course, exchanges, a variety of people choose to delegate and use centralized points of storage instead of holding all the keys themselves. 04:49.780 --> 05:01.430 And a variety of attacks and security implications that that brings, including what are the issues with cold hot storage, the incidents that are happening in this world and other issues. 05:03.430 --> 05:20.930 So some of the threats that we'll cover throughout this talk, we'll talk a lot about malware, just because of my background, we'll cover how it's affecting both the assets where they're getting backdoored, malware attacks against users themselves, the ransomware and the miners and all that good stuff, 05:20.930 --> 05:23.250 as well as how it affects exchanges. 05:23.570 --> 05:28.470 We'll go through fraud and scam schemes that are perpetrated against users. 05:28.470 --> 05:35.390 We'll talk about what are the losses, what can we do to defend ourselves against it, make users feel a little bit more comfortable and safer. 05:36.030 --> 05:37.710 We'll talk about network attacks. 05:37.710 --> 05:47.670 So we'll dive into nitty gritty technical details of attacks against a variety of different chains and lessons that we can learn from them. 05:48.150 --> 06:00.350 We'll talk about phishing attacks against exchanges and users, and definitely about bad actors, who are the people behind those threats, what can we learn, how we can better defend ourselves against them. 06:01.530 --> 06:05.250 So let's first dive into the exchange security. 06:06.790 --> 06:18.430 I mean, last year, if you've been paying attention in 2019, there were so many incidents when one exchange after another was falling down with millions and millions of dollars lost from the hot wallet theft. 06:18.490 --> 06:31.290 This year, what I'm observing is something different, is that we're seeing two incidents from BlockFi and CoinCheck, where the attackers chose not necessarily to go after the, you know, just grab the coins and run off. 06:31.290 --> 06:36.110 Instead, they were content with just getting to PII data. 06:36.110 --> 06:41.230 So we're talking about emails, addresses, other personally identifiable information from the customers. 06:41.650 --> 06:51.590 So the first incident that I'm going to cover is BlockFi, and they were good at publishing the incident reports fairly quickly. 06:51.590 --> 06:57.350 However, what they described as the reason, the root cause for the attack, is that one of their employees was SIM-ported. 06:57.350 --> 07:00.790 SIM-ported to access the internal portal. 07:00.970 --> 07:04.050 So this sounds like something preventable. 07:04.050 --> 07:18.110 I mean, if you're defending your internal portal with a phone, you're using 2FA, which is like some kind of SMS or a phone system, it really could have been improved. 07:18.110 --> 07:19.890 It's something that could have been avoided. 07:20.450 --> 07:28.770 Similarly, CoinCheck reported a loss of 200 customer PII data. 07:28.910 --> 07:32.850 And again, the root cause for it was the main registrar was hacked. 07:32.850 --> 07:42.450 It's something that could have been avoided by maybe picking someone more secure or trying to find a way how to secure your registration so it wouldn't be hijacked as easily. 07:43.290 --> 07:47.010 And of course, this year, we had good old hot wallet theft. 07:47.190 --> 07:52.370 So the year started alt-spit with really tiny financial loss. 07:52.370 --> 07:56.830 It was only 7 bitcoins stolen and 23 ETH. 07:57.230 --> 07:59.950 LulzSec took credit for this compromise. 08:00.290 --> 08:07.830 Unfortunately, the exchange shut down as a result, and so we don't really know as much information about what caused it, what was the underlying issue. 08:08.670 --> 08:13.390 But it just continues on the trend from last year that these things happen. 08:13.530 --> 08:16.250 And this happened early in the year, I believe back in January. 08:16.630 --> 08:22.870 A more recent incident was from the Kasha exchange, which reported a loss of 336 bitcoins. 08:22.990 --> 08:29.970 And again, the reasoning that they described was that their employee was using a personal laptop to conduct official business. 08:29.970 --> 08:37.810 So they were running OTC desk from their personal machine, which apparently got malware on it, and the attacker was able to get away with the keys. 08:37.910 --> 08:41.150 Again, something that could have been avoided. 08:42.570 --> 08:46.190 So some insights, some observations that we're seeing so far. 08:46.310 --> 08:48.150 Are exchanges getting more secure? 08:48.150 --> 08:49.190 I think so. 08:49.250 --> 08:52.030 We're observing a decrease in the number of incidents. 08:52.030 --> 08:58.270 Back in 2019, it was absolutely insane where we had multiple exchanges sometimes compromised within a single week. 08:58.270 --> 09:03.890 So far, we're seeing four exchanges with only two of them, resulting in a direct monetary loss. 09:04.190 --> 09:12.790 Speaking of damage, financial damage itself, the total amount of loss was in $175 million. 09:12.830 --> 09:20.890 Back last year, we're almost six months into the year and the total losses so far only $4 million. 09:20.890 --> 09:23.190 So the financial damage is going down. 09:23.710 --> 09:28.250 What's also very interesting to see is that folks are very open about the compromises. 09:28.250 --> 09:31.070 They release incident reports within 24 hours. 09:31.070 --> 09:36.110 They tell exactly who is affected, what was the issue. 09:36.350 --> 09:38.750 So that response is just really good to see. 09:39.890 --> 09:45.110 On the other hand, as I mentioned, the types of incidents that could have been really easily avoided. 09:45.330 --> 09:49.150 SIM swapping, that could have been locked down ahead of time. 09:49.510 --> 09:58.510 Letting people, employees run official work on unmanaged personal laptops is just a very risky thing to do. 10:00.410 --> 10:06.930 Another trend is the attackers going after more than just HawkWallet, not more than just the coins themselves. 10:07.050 --> 10:14.950 So I imagine that whatever PII they stole on Monday, come Monday, they will turn around and try to perform SIM swapping attacks. 10:14.950 --> 10:30.990 In fact, there was an article, I believe, where there was an interview with the attackers where they explicitly said that, well, you know what, we could, the best way for us to monetize is to actually just to start SIM swapping instead of trying to sell that data or using any other type of attack. 10:31.410 --> 10:34.510 So this is something we may see more in the future. 10:35.570 --> 10:41.790 Next, let's talk about the asset security, specifically security of the protocols. 10:41.790 --> 10:47.370 We're talking about the interaction between different chains and nodes and all of that. 10:47.830 --> 10:55.290 Well, the best example are the variety of 51% attacks, which have been always happening, continue happening. 10:55.690 --> 10:58.790 First, we'll cover two incidents with Bitcoin Gold. 10:58.790 --> 11:03.810 So the first incident was back in January 23rd and 24th. 11:03.810 --> 11:07.410 So there were in fact two 51% attacks back-to-back. 11:07.410 --> 11:16.050 It resulted in 29 block re-ORC, which is fairly sizable, and it definitely resulted in a double spin. 11:16.050 --> 11:17.250 So this is unfortunate. 11:17.250 --> 11:23.370 This is something that we observed happening for a while. 11:23.370 --> 11:37.130 Any coin which is relatively lower hash power and has a hash power available for sale that you can easily rent on something like NiceHash is getting a 51% attack. 11:37.370 --> 11:47.170 What's interesting is the second incident on July 10th is that the attacker apparently once again tried to rent out some hashing power on NiceHash. 11:47.290 --> 11:56.230 But in this case, the miner who rented out their capacity apparently figured out they're doing something bad and was able to notify Bitcoin Gold developers. 11:56.430 --> 12:09.710 So what they did in response to that was fascinating and potentially trend for the future is that they contacted miners in secret and distributed a modified piece of node software which had a checkpoint . 12:09.710 --> 12:16.310 That checkpoint essentially invalidated whatever new chain that the attacker was mining in secret. 12:16.470 --> 12:23.730 So what happened was once the attacker actually published the reorg chain, it was not accepted by the network. 12:23.730 --> 12:28.010 So they wasted all their money on NiceHash and all their efforts. 12:28.910 --> 12:35.530 Bitcoin Gold published their report about what happened, what they did to defend the network. 12:36.750 --> 12:41.690 This is concerning and this is interesting also in two ways. 12:41.690 --> 12:52.090 On one side, it's great that they were able to catch it, but this was only done because one of the NiceHash miners was vigilant enough to be able to notify them. 12:52.090 --> 12:54.350 So this could have been just as easily missed. 12:54.690 --> 13:10.370 Depending on how you view those networks introducing checkpoints into your protocol, secretly communicating with miners, it depends on your specific looks and on decentralization, that may be considered by some as something that we don't want to see. 13:10.370 --> 13:23.890 But it worked in this case and we'll in fact see later on when we talk about Vertcoin, it is once again something that repeated where developers of Node software are communicating with miners in order to help secure the network. 13:24.270 --> 13:28.990 Another interesting trend about this particular attack is that the reorg was massive. 13:28.990 --> 13:31.150 It was 1300 blocks reorg. 13:31.150 --> 13:37.290 So the attackers are willing to spend and invest significant funds into their attacks. 13:37.290 --> 13:57.530 In fact, the most recent incident, which is still ongoing, is starting August 1st, is a massive 3500 block reorg, the first of two, where an attacker apparently spent more than 200k on NiceHash to rent capacity in order to double spend and exchange. 13:57.850 --> 14:01.650 So in this, in the slide, I'm only listing the first incident. 14:01.650 --> 14:12.270 There was in fact yet another reorg attempt, successful reorg attack on the Ethereum Plastic Network with another massive 4000 block reorg. 14:13.350 --> 14:17.990 So some of the insights in this is that these types of attacks will continue. 14:17.990 --> 14:31.670 Any coin which has easily rentable GPU capacity that you can rent on NiceHash or something that you can repurpose from another coin, they will be attacked. 14:31.770 --> 14:34.530 They're under a risk of getting attacked. 14:36.310 --> 14:53.350 What's another interesting observation, what Bitcoin Gold did with working with miners and kind of trolling the attackers by not saying to everyone, like, hey, we know there's an attacker and they're about to release their secret chain anytime now. 14:53.350 --> 15:03.050 They actually waited for the attacker to waste their capacity and their funds until they found out, like, wow, okay, this was all wasted effort. 15:04.650 --> 15:11.010 So what I covered before were traditional 51% attacks against proof of work networks. 15:11.590 --> 15:22.970 What's interesting happening on the blockchain networks today are, is that there's a trend towards shifting into proof of stake consensus algorithms. 15:23.190 --> 15:36.790 So what I'll cover are two different coins, so Steemit incident and the Ethereum incident, and explain how they're potentially trend setting and something that we may see more in the future rather than just more and more 51% attacks. 15:37.190 --> 15:47.350 So on the Steemit side, I guess just to summarize the incident, Justin Sun from Tron purchased the Steemit coin. 15:47.430 --> 15:57.930 There was a disagreement over how to manage vast assets of frozen funds that were initially pre-mined since the beginning of Steemit. 15:58.330 --> 16:18.510 The way that this disagreement was addressed was not through negotiation and trying to find some kind of agreement, but in fact it was on the Tron side, they decided to attack the coin by taking over its delegated proof of staking algorithm. 16:18.550 --> 16:27.530 So if you're familiar with proof of stake algorithm, the more coins you have, you can take those coins, you can lock them up somehow to give you some voting power. 16:27.530 --> 16:36.230 So you can, this is what's called staking, in order to produce blocks or vote for whatever unchained action. 16:36.230 --> 16:40.150 So some coins use governance for that. 16:40.490 --> 16:48.650 In the delegated proof of stake systems, you don't vote for blocks yourself directly. 16:49.030 --> 16:56.050 Something, for example, in ETH 2.0, you need to lock up 32 ETH and you can vote on blocks and can validate blocks. 16:56.050 --> 17:06.890 With delegation, you in fact delegate a set of validators and you empower them and you entrust them to validate and produce blocks. 17:06.890 --> 17:10.270 So this is the system used in Steemit, EOS, and other coins. 17:10.790 --> 17:23.970 So what happened in this particular incident is that Tron colluded with a number of large exchanges which were holding vast amounts of Steemit coin in order to gain the controlling package of the asset. 17:24.110 --> 17:31.790 Once they got that, they were able to vote in a controlling set of validators, which allowed them to basically control the network. 17:31.790 --> 17:35.450 They were empowered to set what are the consensus rules. 17:35.990 --> 17:59.750 Once they gained that right, they were able to push an updated node software, which unfroze through basically a hard fork, unfroze those funds, which were from the initial pre-mine, which absolutely gave Tron a controlling package of the asset in the system where no one could really challenge them and they were able to hold on to their power indefinitely. 18:02.080 --> 18:15.520 Taking the ethics aside, there are arguments on both sides that, you know, why did this have to break down into a technical attack when something that could have been agreed upon just by dialogue? 18:15.520 --> 18:22.180 What's interesting about this, this is the first case of a proof-of-stake attack and we could see how it played out. 18:22.820 --> 18:26.220 The way that it played out was very quickly. 18:26.220 --> 18:46.080 Between the time that Tron was able to get the controlling package of Steemit coins, to pushing their own set of validators, to pushing a hard fork, to unfreeze funds, to taking those funds and, you know, multiplying how much voting power they have, it didn't take months or even weeks, 18:46.080 --> 18:47.120 it took hours. 18:47.120 --> 18:48.960 So it was a highly coordinated attack. 18:48.960 --> 18:52.940 It was executed very precisely and effectively. 18:54.360 --> 18:56.960 So this was a fascinating example. 18:58.380 --> 19:13.180 On the Ethereum side, we're, again, Ethereum is something that has massive hash power, so we're not going to see, highly unlikely we're going to see 51% attacks, but there's still a variety of things that people do, such as mempool manipulation. 19:13.360 --> 19:37.220 When there was a black swan event, when the price of Ethereum crashed and a bunch of MakerDAO auctions were starting to get liquidated, there was apparently a mempool attack where they tried to cause a high degree of congestion so that some individuals were able to create a number of liquidation bids for nothing, 19:37.220 --> 19:44.340 zero bid liquidations, and be able to win them because they essentially did not have any competition because the network was congested. 19:44.340 --> 19:46.420 This is a very interesting approach. 19:46.420 --> 20:00.260 We've seen mempool attacks before, but this is interesting how we are manipulating the underlying protocol, underlying Ethereum network, in order to attack higher level smart contracts and DeFi projects as well. 20:01.100 --> 20:09.840 So some network security insights from what we've seen is that Steemit, that opens up a new era of proof-of-stake attacks and governance attacks. 20:09.840 --> 20:20.220 Instead of being worried that someone will buy up a whole bunch of miners or mining capacity, hash power capacity on NiceHash, now the power is in the exchanges. 20:20.220 --> 20:27.060 So exchanges control the most coins, exchanges colluding together may decide to attack a chain. 20:27.240 --> 20:31.580 So this is something that we have to be on the lookout for now. 20:32.200 --> 20:42.840 Attackers are getting more creative as well, so mempool manipulation in order to attack a DeFi project is something interesting that we'll likely see as well. 20:45.030 --> 20:53.190 Let's switch gears a little bit and instead of talking about asset security on the protocol side, let's talk about the underlying software itself. 20:53.190 --> 21:02.590 In the end, it's all abstract, it all works in the cloud, but what's actually working, the actual logic and code that runs is a node software itself. 21:03.990 --> 21:12.810 Nodes are complex pieces of software and the inevitable that they will have bugs and vulnerabilities. 21:13.490 --> 21:22.330 So a few interesting incidents that I want to cover so far this year, two of them happen on the testnet, so I'll start from left to right. 21:22.350 --> 21:26.470 So the Solana network, there were no issues in the protocol itself. 21:26.470 --> 21:31.330 So the design, I believe it uses a BFT-like system. 21:32.210 --> 21:46.150 The issue was in the implementation, there was a flaw, there was a vulnerability in the way that it failed to, the node software failed to validate transactions, which essentially allowed somebody to print 500 million Solana coins. 21:48.190 --> 22:05.290 On the mainnet project, so the Tendermint, this is the underlying consensus library used by projects like Cosmos and others, a denial of service vulnerability was discovered, which essentially allowed someone to halt the entire network. 22:05.530 --> 22:15.850 And again, this was done not because of some flaw in the protocol, it was because of nodes failing to validate specially crafted blocks. 22:16.570 --> 22:19.490 The last example is the inflation bug. 22:19.490 --> 22:23.450 Those are particularly dangerous because they affect the entire ecosystem. 22:23.990 --> 22:29.210 Luckily, this one was discovered again on the testnet where 9 billion file coins were minted. 22:29.430 --> 22:33.450 This was patched and did not affect the mainnet. 22:33.890 --> 22:42.970 But you can see like the vulnerability, there are only three examples that I'm listing here, but the vulnerabilities in node software can have severe implications for the market. 22:43.990 --> 22:49.390 On the wallet side, again, any piece of software will have vulnerabilities. 22:49.750 --> 23:03.450 Monero wallet failed to validate specially crafted coinbase transactions to be specific, which resulted in it appearing as if you received more of Monero than was actually sent. 23:03.630 --> 23:09.950 This is something similar to, if you recall, there were a whole bunch of exchanges compromised with the ripple. 23:11.050 --> 23:19.950 There was a special flag which is basically telling you how much you are vouching to send as opposed to how much you actually are going to send. 23:20.070 --> 23:32.630 So there's a potential for exchanges or individual wallet owners to incorrectly credit whoever is sending them funds. 23:32.930 --> 23:38.570 Lightning network, it's still very much alpha system, so it continues to have vulnerabilities discovered and patched. 23:38.570 --> 23:46.050 There are a lot of papers getting published, so this is actually a good sign that people are looking into it and finding flaws early on. 23:46.490 --> 24:03.790 Now Argent wallet, that was an interesting bug that was responsibly disclosed by OpenZeppelin and effectively patched by the Argent folks, is that it allowed users to basically create a kind of recovery mechanism using specialized guardian nodes. 24:03.990 --> 24:11.290 And in rare occasions when such nodes were not properly defined, it allowed anyone to take over those wallets. 24:11.410 --> 24:15.850 Once again, this was patched, but an example of vulnerabilities in wallets. 24:17.490 --> 24:22.090 What's more interesting are not the vulnerabilities that are discovered and patched. 24:22.650 --> 24:24.270 This is normal. 24:24.290 --> 24:30.030 What's more interesting are intentional backdoors that are introduced in both wallets and node software. 24:30.450 --> 24:34.690 So the first incident I'm going to cover happened in the Trinity wallet. 24:36.410 --> 24:39.250 We've seen backdoored wallets for a while. 24:39.250 --> 24:44.130 Last year I talked a lot about the Electrum wallets getting backdoored. 24:44.170 --> 24:51.430 The way they attacked the Trinity wallet was not directly, after the main repository itself. 24:51.430 --> 24:56.010 Instead, they were going after the third-party dependency. 24:56.010 --> 25:01.670 So the third-party dependency on which Trinity wallet was relying to was patched to steal users' keys. 25:01.670 --> 25:08.990 That was included in the main repository, and any user downloading and using this was heading at this asset stolen. 25:09.710 --> 25:13.510 Ravencoin incident was even more vicious. 25:13.510 --> 25:24.230 On July 4th, an inflation bug was discovered, and an emergency patch was issued to a variety of nodes and distributed to miners. 25:25.350 --> 25:30.030 And this is something that initially maybe was just a vulnerability . 25:30.030 --> 25:36.810 Every once in a while you discover those things, until the point they realized that the bug was intentionally introduced. 25:36.810 --> 25:44.960 It was introduced back early in the year, in January, by an account which was a throwaway GitHub account. 25:45.360 --> 25:56.000 The patch appeared to be a very innocent-looking commit, which allowed you to be more verbose about the type of errors that you're getting. 25:56.000 --> 26:01.800 So it snuck by the core maintainer's eyes. 26:01.800 --> 26:03.640 They were not able to detect that. 26:03.880 --> 26:07.760 And for months now, they were slowly minting. 26:07.760 --> 26:11.500 There was a script running that was slowly minting RVN coins. 26:11.500 --> 26:18.460 So in total, 300 million RVN coins were minted over time, and unfortunately also sold on exchanges. 26:18.460 --> 26:25.120 So this was a successful inflation bug that was maliciously introduced and exploited. 26:26.100 --> 26:35.340 These are particularly scary, and I'm sure we'll see this again and again, because they attack the whole ecosystem rather than individual user or piece of software. 26:37.880 --> 26:42.880 So some insights on node and wallet software security. 26:43.860 --> 26:45.780 Vulnerabilities are still very rare. 26:45.780 --> 26:50.940 We only talked about four flaws here, and one was introduced intentionally. 26:51.080 --> 27:00.420 The question and challenge to you, do we really have enough eyes looking at nodes, looking for the vulnerabilities, and being able to patch them? 27:00.420 --> 27:09.360 There are bug bounties which are available, but I wonder if there are enough participants and enough folks which are really pushing the limits of how secure that software is. 27:09.940 --> 27:12.940 Ravencoin stealth commit and Trinity supply chain threats. 27:12.940 --> 27:15.040 This will likely happen again. 27:15.460 --> 27:16.940 Attackers are highly motivated. 27:16.940 --> 27:21.440 There's a direct financial profit in attacking these pieces of software. 27:21.780 --> 27:24.420 So this will likely repeat. 27:27.100 --> 27:34.980 So switching gears a little bit on the layer two issues, which is smart contracts, that's even more concerning. 27:35.020 --> 27:37.960 There were, I mean, I'm listing here 10 incidents. 27:37.960 --> 27:42.000 There was one more that happened in the last few days, which is not included here. 27:42.640 --> 27:53.660 As DeFi projects are getting more and more popular, this is complex software, which once again has a lot of different vulnerabilities which are constantly getting discovered. 27:53.860 --> 28:01.020 I'm not going to cover all of these, just it would take a whole hour on its own, but I'll focus on just three of these. 28:01.420 --> 28:03.700 So we'll start left to right. 28:03.700 --> 28:10.400 The first incident that basically opened the year was the VZX DeFi project back in February. 28:11.200 --> 28:16.420 And the way that it started out was there was a margin trading vulnerability that was exploited. 28:16.420 --> 28:18.880 1 million worth of ETH was stolen. 28:19.000 --> 28:26.760 What was interesting about this particular incident is that the attacker used flash loans in order to amplify the attack. 28:26.760 --> 28:39.240 Flash loans is basically a mechanism where you can borrow X amount of an asset and return it back to the initial point all within the same transaction. 28:39.240 --> 28:50.380 So you're paying non-existent or minimal fees for doing that and allows you to execute an attack in between since you have all these assets available to you in order to execute the attack. 28:50.380 --> 29:05.000 So this kind of defeats a kind of a paradigm that we had before where we think that if it costs so much money to attack something, that it makes it less likely that someone will actually execute the attack. 29:05.000 --> 29:14.320 But with flash loans, attackers have really minimal risk to basically the transaction reverting, then so be it, they don't lose anything. 29:14.320 --> 29:20.880 And they can return those funds and whatever they loaned and they don't really lose anything. 29:20.880 --> 29:23.000 But if they win, then they win big. 29:23.000 --> 29:25.980 So in this case, they won one million dollars worth of ETH. 29:27.200 --> 29:33.760 And we start seeing this flash loans approach happen again and again throughout the year from this point on. 29:34.280 --> 29:38.060 Another incident which is interesting to note is the balancer project. 29:38.120 --> 29:41.800 So again, 500k was drained from multi-token pools. 29:41.800 --> 29:53.780 This one is interesting because it wasn't the vulnerability in the balancer smart contract itself, it was in the way that one complex project was interacting with another complex project. 29:53.780 --> 30:04.280 In this case, the developers could not predict that you could use deflationary tokens which change the logic to the attacker's advantage. 30:04.980 --> 30:12.160 So when on its own, like in all their testing with traditional token systems, then it works as expected. 30:12.640 --> 30:20.880 So this is something that is well known in the traditional computer security practice and something that needs to be applied to DeFi projects as well. 30:20.960 --> 30:27.080 Another gotcha in this one is that the vulnerability was reported in a bug bounty report. 30:27.080 --> 30:29.220 So the good news is bug bounties work. 30:29.220 --> 30:33.420 I think a lot of the projects in the DeFi space do have bug bounties. 30:33.520 --> 30:43.880 It's just, it's very hard to triage those things, very hard to find the ones which are real examples of an attack and or which ones are not as good quality. 30:43.880 --> 30:49.480 So this is something to keep in mind when running your own bug bounties. 30:49.640 --> 31:06.500 The last example, and again this is something that example here repeated in other incidents, is a Bancor project where developers were notified that they had a vulnerability, so they learned there was an issue. 31:07.000 --> 31:22.720 And the way that they approached to protect their users is by attacking their own coin, their own smart contract, with the same ways that an attacker would, it's just that with the purpose of actually preserving users funds. 31:22.940 --> 31:42.140 But what was interesting here is that arbitrage bots, apparently they're a piece of software constantly monitoring the Ethereum network, seeing that if there's some large activity happening and it started automatically replaying it, trying to make arbitrage opportunities, 31:42.140 --> 31:53.700 exploit arbitrage opportunities there, picked up on developers trying to secure users funds and were automatically able to exploit the project in the same way that the developers were doing it. 31:53.700 --> 32:02.280 So it's fascinating to see those automated pieces of software that just piggyback off existing attacks. 32:04.120 --> 32:08.340 So some insights on the Layer 2 smart contract security. 32:08.500 --> 32:11.300 This is going to be the year of DeFi hacks. 32:11.560 --> 32:22.760 Both in the amount lost, the number of vulnerabilities discovered, unfortunately the number of incidents is on the rise. 32:23.360 --> 32:26.140 So it will likely continue seeing that this year. 32:27.740 --> 32:33.500 The bug bounty programs, they work and developers are catching bugs early, which is a good sign. 32:33.520 --> 32:38.320 And I'll explain to you why in a bit when we talk about tooling and guidelines. 32:39.800 --> 32:45.080 But the interesting trend is by Bancor is that we often have to hack ourselves to secure funds. 32:45.920 --> 33:02.780 Complex code will continue having bugs and complex interactions between different projects are also something that we need to think about as this is the whole point of DeFi is that you're creating links between vast smart contract projects out there. 33:04.990 --> 33:13.710 So I promised to talk about user security and we had a few major incidents that we're going to cover shortly from Twitter and so on. 33:14.850 --> 33:24.630 But this is sometimes not as exciting of a field to look at, but just as critical as any other discipline. 33:25.470 --> 33:34.830 So we're going to talk about cryptocurrency malware, variety of scam and fraud schemes, as well as just talk a little bit like who are the bad actors? 33:34.830 --> 33:35.890 Who is doing that? 33:35.890 --> 33:38.550 Who are the new players in this arena now? 33:39.650 --> 33:44.570 So first, let's talk about the crypto mining malware. 33:44.670 --> 33:57.090 And this is how I got into partially into cryptocurrencies is that essentially for a year, I was reversing nothing but ransomware and crypto mining samples. 33:57.670 --> 34:08.530 For on the crypto mining side, it was always the Monero folks, they are setting up their miners XM rig into anything that can possibly run XM rigs. 34:08.530 --> 34:12.050 If they can run it on toasters, they probably would run it on toasters. 34:12.330 --> 34:21.250 So far this year, it's not as bad as Russian scientists mining on nuclear stations. 34:21.330 --> 34:26.270 But still, five EU supercomputers were hacked in order to run Monero miners. 34:26.550 --> 34:43.710 We had multiple issues with Docker where attackers were scanning vulnerable API endpoints to take over existing Docker images or just publishing their own backdoored Docker images on the Docker hub, which would also mine Monero in the background. 34:43.990 --> 34:50.010 And of course, there's just never ending stream of Windows desktop malware. 34:50.010 --> 35:01.910 One example is Lucifer, which is just, it's an arsenal of, it was a whole exploit kit built into it, which can self propagate attack other Windows machines and spread on its own. 35:03.990 --> 35:09.850 So on the ransomware side, it seems like this is an ongoing threat. 35:09.850 --> 35:21.630 I'm not sure yet if the trend is going down yet, but so far we had UCSF, which was attacked for 100 Bitcoin or so, Travelex earlier this year, 285. 35:22.670 --> 35:28.370 Just a few days ago, we learned that Canon was attacked with ransomware by, I believe, the Maze crew. 35:28.750 --> 35:29.790 We don't know. 35:29.850 --> 35:35.170 They're known to ask for Bitcoin as a compensation, as a ransom. 35:35.170 --> 35:39.430 So we'll find out when the incident concludes. 35:39.430 --> 35:45.210 And of course, it seems like every city in Florida is getting ransomware on their machines. 35:45.210 --> 35:50.570 So an example of city Riviera had to pay 65 Bitcoins to get their systems back online. 35:52.490 --> 35:54.010 Yeah, so this sucks. 35:54.010 --> 35:54.930 This is unfortunate. 35:54.930 --> 36:02.430 This is a threat that we have to worry about, especially on systems like UCSF in the time of COVID. 36:02.430 --> 36:05.490 But this is something we'll continue seeing. 36:05.490 --> 36:13.570 Monero miners will hack anything available to them to install the crypto mining malware. 36:14.050 --> 36:21.030 Ransomware appears to be on the decline, but it's too early to say we're still only halfway through the year to establish a trend. 36:22.270 --> 36:23.930 Crypto giveaways. 36:24.630 --> 36:29.690 Well, I mean, we all talked about the Twitter hack, which was absolutely epic. 36:29.690 --> 36:36.930 I don't want to steal Victor's keynote presentation tomorrow, but he'll dive into more details. 36:36.930 --> 36:46.050 But just to summarize, 130 accounts were hijacked on Twitter from exchanges to celebrities to corporate accounts. 36:46.110 --> 36:54.950 The way they were hijacked is that the attackers were able to basically get access to the internal tools through social engineering of Twitter employees. 36:55.470 --> 36:56.970 And that's kind of fascinating. 36:56.970 --> 37:02.790 The best thing they could think of doing it was running a BTC giveaway scam. 37:02.990 --> 37:05.430 So on one side, this is really bad. 37:05.430 --> 37:08.050 On the other side, it could have been much worse. 37:08.850 --> 37:13.570 Elon Musk is getting no break from YouTube scammers. 37:13.570 --> 37:20.230 So anytime you see a SpaceX feed, there's likely going to be send BTC notes everywhere. 37:20.230 --> 37:21.850 So sorry, Elon. 37:23.990 --> 37:28.250 MLM scams are still continuing on as before. 37:28.250 --> 37:34.770 So we started with the BitConnect and moved on to $4 billion enterprise plus token. 37:34.770 --> 37:46.350 And now the latest and greatest is Chinese police just busted wall token scammers who managed to get $1 billion worth of crypto from 700,000 victims. 37:49.120 --> 38:04.280 What's more interesting is not just the existing scams or the ones that I covered before, but the trends of what are we going to see attackers experimenting with, which may become something more prevalent. 38:05.080 --> 38:07.840 So one example is the MakerDAO phishing attack. 38:07.840 --> 38:12.100 And that is the first example of a Web3 phishing scam. 38:12.100 --> 38:16.960 So you think that you are exchanging side to die. 38:19.980 --> 38:27.000 You are interacting with MetaMask or so you think you're putting in your keys and then bam, all your coin is stolen. 38:27.000 --> 38:33.180 So this is something that was reported early in the year and something potentially we'll see in the future. 38:34.060 --> 38:38.760 The Justin Sun deepfake scam, that was fascinating. 38:38.760 --> 38:50.900 Someone essentially recorded a video of Justin Sun doing some kind of investor scam, trying to get people to send money to this unknown entity. 38:51.500 --> 39:01.160 And they played that video on a Skype call complete with Justin cuffing and it looked very real and also very fake and strange at the same time. 39:01.160 --> 39:03.800 They faked his passport to show for some reason. 39:03.980 --> 39:08.520 If you want to search that on YouTube, it's a fascinating video to watch. 39:09.100 --> 39:16.860 It's still not something that was successful, but it's kind of fascinating that scammers are even exploring deepfakes for that purpose. 39:17.320 --> 39:20.860 The last example is the trust wallet scam. 39:20.860 --> 39:27.420 So we see just a barrage of backdoored fake wallet software everywhere. 39:27.740 --> 39:48.360 If you search on Google, if you search in the app stores, what's interesting about this case is not the wallet itself, it's how it was addressed, which is a security researcher was able to actually attack the infrastructure, a fairly broken infrastructure on the attacker side to start recovering the funds. 39:48.460 --> 39:54.960 And this is an interesting trend of basically folks taking things into their own hands to help users. 39:56.420 --> 39:58.760 So a quick note about the bad actors. 39:58.760 --> 40:06.680 So we already talked about the individual attackers, so the Twitter folks, three were already arrested, one in Florida, one in UK. 40:07.820 --> 40:10.640 So we'll call them lone wolf type attackers. 40:11.560 --> 40:21.120 Insider threats such as Kasha employee who got malware in their machine and unfortunately resulted in funds loss. 40:21.220 --> 40:23.120 Let's talk about APTs. 40:23.120 --> 40:34.680 So we're familiar with Lazarus Group, so that's a North Korean APT, and a whole variety of financial ransomware groups who basically attack anything with financial gain. 40:34.680 --> 40:45.280 What's interesting this year is the CryptoCore APT, which is our very own dedicated cryptocurrency exchange advanced persistent threat. 40:45.940 --> 41:00.320 So with a bull market maybe happening sometime in the future and the renewed interest, we're probably going to see more dedicated groups like this as this becomes highly profitable enterprise. 41:01.840 --> 41:03.520 So some insights. 41:05.020 --> 41:08.400 One is that users are taking things into their own hands. 41:08.660 --> 41:13.960 So we have Woz who's suing YouTube for being too slow at taking down the giveaway scams. 41:14.020 --> 41:22.840 We have Michael Turpin suing AT&T to basically compensate him for allowing the sim swap to happen in the first place. 41:22.840 --> 41:29.040 We have researchers like Harry Denley reverse hacking scammers to get users' funds back. 41:29.140 --> 41:53.320 While it does sound good on one hand that people are really pushing their fighting back against the scammers, I really wish the industry was more mature and we had enough tools on one side, but also user education and guidelines and other security controls available that not as many people would get compromised in the first place. 41:54.040 --> 41:57.120 MLM schemes are incredibly profitable. 41:57.120 --> 42:06.900 So this year out of all cryptocurrency scams, basically 99% of the take was the Wo token $1 billion scam. 42:07.020 --> 42:16.740 In the past, plus token with their $4 billion take, I think controlled a whole 1% of the total Bitcoin supply. 42:16.740 --> 42:20.320 So these things are incredibly profitable and will definitely continue. 42:21.280 --> 42:26.180 An interesting trend that exchanges are proactively blocking bad addresses to protect their users. 42:26.180 --> 42:30.220 So there's always debate of centralized storage versus decentralized storage. 42:30.280 --> 42:45.060 That's something that was interesting to observe this year is that exchanges like Coinbase, they were basically blacklisting the attacker addresses immediately to save their internal customers' funds. 42:45.200 --> 42:55.400 This is something that could be decentralized as well if you're looking for a project to be able to alert users of doing some kind of unsafe action. 42:55.400 --> 42:59.660 And I believe a few projects like MyCrypto are in fact doing that already. 43:01.000 --> 43:02.600 Scammers are getting more creative. 43:02.600 --> 43:09.640 So the Web3 phishing sites and the deepfake scams, this is fascinating to see. 43:09.640 --> 43:17.280 I'm not sure how profitable they are yet, but if they do become profitable at one point, we'll see a very rapid rise of them. 43:21.480 --> 43:33.280 So to summarize the state of blockchain security insights that we've seen so far, we talked about the exchange security, the number of hacks and financial damage is decreasing. 43:33.280 --> 43:34.520 That's great. 43:35.020 --> 43:38.820 On the other side, existing incidents could have been easily prevented. 43:39.240 --> 43:41.720 Attackers are going after more than just coins. 43:41.720 --> 43:42.680 They're going after PII. 43:42.680 --> 43:44.040 They're getting creative. 43:44.570 --> 43:52.800 On the asset side, low hash rate GPU mineable proof-of-work coins are getting 51% attack, will continue getting 51% attacked. 43:53.020 --> 43:58.680 There was a first example of a proof-of-stake attack, and it was very efficiently executed. 43:59.280 --> 44:02.380 We're not finding nearly enough node wallet vulnerabilities. 44:02.380 --> 44:08.480 I think there's an opportunity there for independent security researchers to really start looking at that. 44:09.180 --> 44:19.620 Nasty backdoors and supply chain attacks against nodes and wallets Again, if you can backdoor a node, you can attack the whole coin as the whole ecosystem. 44:19.620 --> 44:24.260 You don't have to go after individual people and you can take basically the whole asset down. 44:24.260 --> 44:27.500 So this is highly dangerous, highly critical to start looking at. 44:28.280 --> 44:36.260 D5 vulnerabilities are unfortunately on the rise and so are the attacks as the whole ecosystem is becoming more popular. 44:36.580 --> 44:42.000 On the user side, I don't see any new threats which are suddenly popped up. 44:42.080 --> 44:52.560 It's just a consistent threat from miners, ransomware, fake software, and scammers are still sticking to giveaway scams and MLM schemes. 44:52.580 --> 44:58.640 They're getting more creative here and there, but they, I mean, the giveaway scams unfortunately still work. 44:58.640 --> 45:07.540 So an opportunity here is to work on more user education to see if we can make users a little bit more secure. 45:08.720 --> 45:10.440 So we've seen what the issues are. 45:10.440 --> 45:11.720 We've seen what the problems are. 45:11.720 --> 45:26.120 Here and there, I dropped some ideas of what you can do to contribute to the field, make it more secure, but really we can look at it more holistically and think of the blockchain security as just a standalone industry that we can build up together. 45:26.120 --> 45:31.200 We can grow in terms of maturity, education, projects , and so on. 45:31.800 --> 45:39.120 So some things, some ideas that I'm going to cover of what we can do is we can talk about the guidelines and tools, how we can develop those. 45:39.120 --> 45:48.400 We can talk about growing the community and specifically you, what is it that you can do today to start applying and contributing to this field? 45:49.080 --> 45:56.220 So on the guidelines and tools side, there are a few amazing projects that are available. 45:56.220 --> 46:02.900 So on the consensus diligent folks there, they keep on publishing a variety of software to test smart contracts. 46:02.900 --> 46:15.640 They publish the SWC, smart contracts, weakness classification registry, where you have a listing of top vulnerabilities, give you a good understanding like what they are, how to prevent them. 46:15.860 --> 46:19.020 Trail of bits folks, they're publishing tools one after another. 46:19.020 --> 46:20.580 They have the slither echidna. 46:20.580 --> 46:29.240 They published a document basically summarizing findings from all of their smart contract security assessments. 46:29.240 --> 46:30.040 What are the trends? 46:30.040 --> 46:32.580 What are the top issues to look out for? 46:32.680 --> 46:36.660 Open zeppelin essentially defined the field of how to write secure smart contracts. 46:36.660 --> 46:46.160 I'm seeing a lot of the newer projects, they're just basically verbatim adopting open zeppelin, open zeppelin templates, and they're very secure as a result. 46:46.320 --> 46:52.360 Other projects like securing, they published the smart contract security verification standard. 46:52.520 --> 46:58.360 NCC group published an OWASP style list top 10 list back in 2018. 46:58.680 --> 47:03.180 But unfortunately, it wasn't really maintained for a while. 47:03.180 --> 47:07.740 So it would be interesting for them to give new life to this project. 47:07.740 --> 47:10.340 Another one is the cryptocurrency security standard. 47:10.340 --> 47:17.680 And this one is interesting because if you notice all the previous things that I mentioned, they have to do with smart contracts and Ethereum. 47:17.680 --> 47:29.240 This is the only standard and project out there, which attempts to talk more about how to securely generate keys, how to securely store keys in the cold storage. 47:29.380 --> 47:38.280 I would love to see this project growing and having a larger impact on the security of exchanges and nodes and wallets and so on. 47:40.820 --> 47:42.580 Guidelines and tools are important. 47:42.580 --> 47:53.860 If we are to grow this industry, we need to have large collections readily available for anyone who wants to contribute to this field to be able to quickly learn from the mistakes of the past. 47:53.860 --> 47:56.720 On the smart contract side, I think we're pretty solid. 47:56.760 --> 48:04.260 We have great tooling, we have methodology, we have a variety of companies and consultants who are available to test your smart contracts. 48:04.260 --> 48:15.040 So even though there are a lot of DeFi issues which are getting discovered, but there's enough tools and folks that are experts in this field that can address this trend very quickly. 48:15.360 --> 48:25.260 On the other hand, we're missing core guidelines, core methodology, and practically no tools to address standalone blockchains. 48:25.800 --> 48:38.840 If someone wants to build a new project, what is a good resource that they can read and learn about the failings of the past and how they can learn and correct whatever future designs that they're building? 48:39.920 --> 48:41.780 Node configuration operation. 48:42.140 --> 48:44.840 Nodes are at the core of any blockchain project. 48:44.840 --> 48:51.640 If nodes at some point start having more and more vulnerabilities discovered, then this breaks down everything that is built on top of them. 48:51.920 --> 49:12.540 Hot and cold storage security, key management, protocol design, wallet design, innovations in blockchain forensics, and also user security, how to educate users and give them simple guides on how to avoid scams, how to give them tools to quickly protect them against going to bad websites like Google browser style. 49:12.540 --> 49:15.080 Like this is dangerous, don't send to this address. 49:16.340 --> 49:27.860 One thing that I will be covering later in a separate talk on attacking and defending blockchain nodes is I'm trying to create an OWASP top 10 style listing of what you can do to secure your node infrastructure. 49:28.360 --> 49:42.160 But I invite all of you to pick out any one of those items in the list, or if you imagine that you have more things to contribute to this field, and start writing documentation, start writing tools. 49:42.160 --> 49:46.720 There's an entire field available that you can develop and work with. 49:47.920 --> 49:52.060 On the community side, well, here we are at the Blockchain Village. 49:52.080 --> 49:58.080 There are three other conferences which are also available that you can attend, hopefully virtually, throughout the year. 49:59.000 --> 50:01.600 But I wonder if there should be more. 50:01.600 --> 50:06.980 I imagine that as the community grows and this field grows, we're going to see more and more of these. 50:07.740 --> 50:09.660 We have our own competitions. 50:10.180 --> 50:17.720 So we have this year, I believe, Victor is hosting a blockchain investigation competition. 50:17.720 --> 50:20.540 Last year, we had the Capture the Coin and Chain Heist. 50:20.540 --> 50:25.580 There are some challenges which are ongoing, such as OpenZeppelin's excellent EtherNOT. 50:25.860 --> 50:27.420 So this is great. 50:28.020 --> 50:30.920 On the knowledge sharing side, we have a variety of resources. 50:30.920 --> 50:37.360 So you can go on Telegram, Reddit, Discord here for DEF CON, and you can talk about blockchain security. 50:37.660 --> 50:42.620 Some newsletters that are also working on distributing, disseminating knowledge. 50:42.620 --> 50:51.400 So the one that I'm running is Blockchain Threat Intelligence, where I try to cover every piece of news that is related to this field. 50:51.440 --> 50:54.100 Not just related to smart contracts, but just holistically. 50:54.100 --> 50:58.220 Exchange security, malware, user scams, and all of that. 50:59.180 --> 51:03.120 Consensus Diligence, they're running an excellent smart contract security newsletter. 51:03.120 --> 51:11.680 So if you want to raise focus on Ethereum and Layer 2 security, this is the resource to subscribe to immediately. 51:12.600 --> 51:15.080 We even have our own shitty movies. 51:15.080 --> 51:23.700 So we have Crypto, where we have an AML officer hunting down and investigating blockchains to bring down Russian mafia, and the Money Plane. 51:23.700 --> 51:25.760 I'm not sure exactly what's happening there. 51:25.760 --> 51:31.720 I think the plot is they're hacking crypto on a plane, which is a fortress and a casino. 51:31.940 --> 51:34.360 Point is, we have our movies, we have our media. 51:34.360 --> 51:35.640 We made it officially. 51:35.640 --> 51:36.640 This is great. 51:37.960 --> 51:40.000 So some community insights. 51:40.000 --> 51:48.940 We're still a very small, but growing community with unique competitions, gatherings, chat rooms, challenges, tools, projects, and so on. 51:48.940 --> 51:52.260 Our community should and will continue growing. 51:52.440 --> 51:57.200 What's exciting to see is blockchain security or BlockSec becoming a career option. 51:57.200 --> 52:03.440 Even today, you can look on the internet, you can find jobs to do smart contract security testing if you want to. 52:03.440 --> 52:08.880 You can do blockchain security engineering, so building projects, securing projects. 52:09.220 --> 52:14.360 Cryptocurrency forensic analysis is going to be even more in demand after the Twitter hack. 52:14.360 --> 52:19.520 More people will try to exercise this new skill set. 52:19.720 --> 52:22.440 So I'm hoping this will grow in the future. 52:23.800 --> 52:26.040 The point is, I want to invite you. 52:26.040 --> 52:28.540 I want to invite you to contribute to this field. 52:28.720 --> 52:35.400 So if you enjoy learning about the nitty gritty technical details, consensus negatives, smart contracts, great. 52:35.400 --> 52:37.220 Join BlockSec, contribute to this field. 52:37.220 --> 52:39.620 There's plenty of things to explore and do here. 52:39.720 --> 52:52.800 If you're a security professional, and you're just tired of finding yet another XSS or SQL injection bug, you want to find some cool new things which are just not fully explored yet, basically be able to define the field. 52:52.800 --> 52:54.040 Great, join BlockSec. 52:54.040 --> 52:57.500 There are plenty of bugs that need to be found and patched by you. 52:58.020 --> 53:07.240 Are you an investigator who is trying to hunt down the fraudsters, wants to understand how the hell do we track down fraud and bad guys on the blockchains? 53:07.240 --> 53:08.720 Great, join BlockSec. 53:08.720 --> 53:11.840 There are plenty of blockchain analytics companies out there. 53:12.460 --> 53:17.800 There's a growing body of investigators who are now capable of doing those tasks. 53:17.800 --> 53:18.460 Join them. 53:18.460 --> 53:20.260 This is very interesting. 53:20.680 --> 53:37.580 Finally, if you're a developer, and you're just looking for an exciting new project, and you really want to make an impact on the open financial system, making that system more secure, contributing it to be more trustworthy by the people using it, is a good way to help bring it about. 53:37.580 --> 53:42.580 So with that, join BlockSec, and thank you very much for your time.