Hello and welcome to the State of Blockchain Security here at the Blockchain Village at
DEF CON 28. I'm excited to share with you just a really zoomed out view of the current state
of our industry. We'll talk about a variety of blockchain security related events, major
incidents. We'll gather some insights and make future predictions. And most importantly, we'll
talk about a lot of opportunities how to build a stronger and more trustworthy financial system.
In case we have not met, my name is Peter Kaczynski. I'm a blockchain security engineer
at Coinbase, where I spend most of my time trying to break and secure a variety of standalone
blockchain systems and smart contracts. On the side, I also publish a blockchain
threat intelligence newsletter where I share the latest news. And partially, I will be recapping
some of the major events that I cover in that newsletter. And in the past, I was also organizer
of the Capture the Coin competition at DEF CON. In the past, I was working also as a malware
reverse engineer at FireEye. If you're a malware reversal, you may have run into a few of my tools
such as Flare VM and FakeNetNG. And I've also reversed a whole lot of APT malware that I care
to remember. Zooming even back out, I was more on the offensive side as well for the Federal
Reserve System, where I was working as a penetration tester, trying to break Finance 1.0.
I guess everyone shares their story of how they got into crypto. The revealing moment for me was
just basically my past growing up in the Soviet Union and observing what hyperinflation means
in the first place. So it really, it really stroke a chord in me when I understood what the future
offered by the cryptocurrencies. And I take it as a personal mission to make this field succeed
by making it more secure. And I hope you join me on that mission as well.
So what are we going to talk about? I would like to help inform, educate, and identify as many
opportunities for you as possible. So if you feel like this is the field for you, you will know
exactly where to plug in and what to pursue. Within this talk, we're going to talk about a
variety of incidents, as I mentioned, from the newsletter. But the key point here is that it's
less about me being right. I will offer some insight and opinions here, but I'm even more
excited to start a discussion and learn from you during the Q&A session or offline if you care to
reach out. I would be highly excited to hear your thoughts on it. In our presentation, we'll begin
by defining the field in the ecosystem. So we'll talk, what is blockchain security? How is it
different from any other security disciplines, let's say web application or IoT security? What
makes it unique? We will also talk about the overall ecosystem that we're trying to protect
and also think how it's getting attacked. Next, we're going to break down all of the variety of
components within the blockchain security field. So we'll talk about exchange security.
What were the major incidents this year so far? What can we learn from it? We're going to talk
about the asset security. So we will discover a variety of protocol issues that are being
exploited. We'll talk about software getting attacked, other weak points. And last but
definitely not least is user security. We're going to deep dive into the main point of why we're
this is for the users, for people to be able to transact securely.
We will finish the presentation with thoughts about building this industry, how to make it
more mature, what we can do to share the guidelines that people can just pick up and
implement in their next projects, the tools that still need to be developed,
as well as how we can build up our community.
So let's begin first by defining what is blockchain security. I believe it's a brand
new field. It's a new discipline of information security with a mission of securing and defending
the cryptocurrency ecosystem. What is cryptocurrency ecosystem? We, again, I mentioned users are at the
core of it. We have a variety of assets, both layer one and layer two. So smart contracts and
all of that. So nodes, wallets, smart contracts are all within the scope of this field. Of course,
exchanges, a variety of people choose to delegate and use centralized points of
storage instead of holding all the keys themselves. And a variety of attacks and
security implications that that brings, including what are the issues with cold hot storage,
the incidents that are happening in this world and other issues.
So some of the threats that we'll cover throughout this talk, we'll talk a lot about malware,
just because of my background, we'll cover how it's affecting both the assets where
they're getting backdoored, malware attacks against users themselves, the ransomware and
the miners and all that good stuff, as well as how it affects exchanges. We'll go through fraud
and scam schemes that are perpetrated against users. We'll talk about what are the losses,
what can we do to defend ourselves against it, make users feel a little bit more comfortable
and safer. We'll talk about network attacks. So we'll dive into nitty gritty technical details
of attacks against a variety of different chains and lessons that we can learn from them.
We'll talk about phishing attacks against exchanges and users, and definitely about
bad actors, who are the people behind those threats, what can we learn, how we can better
defend ourselves against them. So let's first dive into the exchange security.
I mean, last year, if you've been paying attention in 2019, there were so many incidents
when one exchange after another was falling down with millions and millions of dollars lost
from the hot wallet theft. This year, what I'm observing is something different, is that we're
seeing two incidents from BlockFi and CoinCheck, where the attackers chose not necessarily to go
after the, you know, just grab the coins and run off. Instead, they were content with just getting
to PII data. So we're talking about emails, addresses, other personally identifiable
information from the customers. So the first incident that I'm going to cover is BlockFi,
and they were good at publishing the incident reports fairly quickly. However, what
they described as the reason, the root cause for the attack, is that one of their employees was
SIM-ported. SIM-ported to access the internal portal. So this sounds like something preventable.
I mean, if you're defending your internal portal with a phone,
you're using 2FA, which is like some kind of SMS or a phone system, it really could have
been improved. It's something that could have been avoided. Similarly, CoinCheck reported a
loss of 200 customer PII data. And again, the root cause for it
was the main registrar was hacked. It's something that could have been avoided by maybe picking
someone more secure or trying to find a way how to secure your registration so it wouldn't be
hijacked as easily. And of course, this year, we had good old hot wallet theft. So the year
started alt-spit with really tiny financial loss. It was only 7 bitcoins stolen and 23 ETH.
LulzSec took credit for this compromise. Unfortunately, the exchange shut down as a result,
and so we don't really know as much information about what caused it, what was the underlying
issue. But it just continues on the trend from last year that these things happen. And this
happened early in the year, I believe back in January. A more recent incident was from the
Kasha exchange, which reported a loss of 336 bitcoins. And again, the reasoning that they
described was that their employee was using a personal laptop to conduct official business.
So they were running OTC desk from their personal machine, which apparently got malware on it,
and the attacker was able to get away with the keys. Again, something that could have been
avoided. So some insights, some observations that we're seeing so far. Are exchanges getting
more secure? I think so. We're observing a decrease in the number of incidents. Back in
2019, it was absolutely insane where we had multiple exchanges sometimes compromised within
a single week. So far, we're seeing four exchanges with only two of them, resulting in a direct
monetary loss. Speaking of damage, financial damage itself, the total amount of loss was in
$175 million. Back last year, we're almost six months into the year and the total losses so
far only $4 million. So the financial damage is going down. What's also very interesting to see
is that folks are very open about the compromises. They release incident reports within 24 hours.
They tell exactly who is affected, what was the issue. So that response is just really good to see.
On the other hand, as I mentioned, the types of incidents that could have been really easily
avoided. SIM swapping, that could have been locked down ahead of time. Letting people,
employees run official work on unmanaged personal laptops is just a very risky thing to do.
Another trend is the attackers going after more than just HawkWallet, not more than just
the coins themselves. So I imagine that whatever PII they stole on Monday, come Monday, they will
turn around and try to perform SIM swapping attacks. In fact, there was an article, I believe,
where there was an interview with the attackers where they explicitly said that, well, you know
what, we could, the best way for us to monetize is to actually just to start SIM swapping instead
of trying to sell that data or using any other type of attack. So this is something we may see
more in the future. Next, let's talk about the asset security, specifically security of the
protocols. We're talking about the interaction between different chains and nodes and all of
that. Well, the best example are the variety of 51% attacks, which have been always happening,
continue happening. First, we'll cover two incidents with Bitcoin Gold. So the first
incident was back in January 23rd and 24th. So there were in fact two 51% attacks back-to-back.
It resulted in 29 block re-ORC, which is fairly sizable, and it definitely resulted in a double
spin. So this is unfortunate. This is something that we observed happening for a while. Any
coin which is relatively lower hash power and has a hash power available for sale that you can
easily rent on something like NiceHash is getting a 51% attack. What's interesting is the second
incident on July 10th is that the attacker apparently once again tried to rent out some
hashing power on NiceHash. But in this case, the miner who rented out their capacity apparently
figured out they're doing something bad and was able to notify Bitcoin Gold developers. So what
they did in response to that was fascinating and potentially trend for the future is that they
contacted miners in secret and distributed a modified piece of node software which had a
checkpoint. That checkpoint essentially invalidated whatever new chain that the attacker was mining
in secret. So what happened was once the attacker actually published the reorg
chain, it was not accepted by the network. So they wasted all their money on NiceHash and all
their efforts. Bitcoin Gold published their report about what happened, what they did to defend the
network. This is concerning and this is interesting also in two ways. On one side,
it's great that they were able to catch it, but this was only done because one of the NiceHash
miners was vigilant enough to be able to notify them. So this could have been just as easily
missed. Depending on how you view those networks introducing checkpoints into your protocol,
secretly communicating with miners, it depends on your specific looks and on decentralization,
that may be considered by some as something that we don't want to see. But it worked in this case
and we'll in fact see later on when we talk about Vertcoin, it is once again something that repeated
where developers of Node software are communicating with miners in order to help secure the network.
Another interesting trend about this particular attack is that the reorg was massive. It was
1300 blocks reorg. So the attackers are willing to spend and invest significant funds into their
attacks. In fact, the most recent incident, which is still ongoing, is starting August 1st,
is a massive 3500 block reorg, the first of two, where an attacker apparently spent more than 200k
on NiceHash to rent capacity in order to double spend and exchange. So in this, in the slide,
I'm only listing the first incident. There was in fact yet another reorg attempt, successful reorg
attack on the Ethereum Plastic Network with another massive 4000 block reorg.
So some of the insights in this is that these types of attacks will continue. Any coin which
has easily rentable GPU capacity that you can rent on NiceHash or something that you can
repurpose from another coin, they will be attacked. They're under a risk of getting attacked.
What's another interesting observation, what Bitcoin Gold did with working with miners and
kind of trolling the attackers by not saying to everyone, like, hey, we know there's an attacker
and they're about to release their secret chain anytime now. They actually waited for the attacker
to waste their capacity and their funds until they found out, like, wow, okay, this was all
wasted effort. So what I covered before were traditional 51% attacks against proof of work
networks. What's interesting happening on the blockchain networks today are, is that there's
a trend towards shifting into proof of stake consensus algorithms. So what I'll cover are
two different coins, so Steemit incident and the Ethereum incident, and explain how they're
potentially trend setting and something that we may see more in the future rather than just more
and more 51% attacks. So on the Steemit side, I guess just to summarize the incident, Justin Sun
from Tron purchased the Steemit coin. There was a disagreement over how to manage vast assets of
frozen funds that were initially pre-mined since the beginning of Steemit. The way that this
disagreement was addressed was not through negotiation and trying to find some kind of
agreement, but in fact it was on the Tron side, they decided to attack the coin by taking over
its delegated proof of staking algorithm. So if you're familiar with proof of stake algorithm,
the more coins you have, you can take those coins, you can lock them up somehow to give you some
voting power. So you can, this is what's called staking, in order to produce blocks or vote for
whatever unchained action. So some coins use governance for that. In the delegated proof
of stake systems, you don't vote for blocks yourself directly. Something, for example,
in ETH 2.0, you need to lock up 32 ETH and you can vote on blocks and can validate blocks.
With delegation, you in fact delegate a set of validators and you empower them and you entrust
them to validate and produce blocks. So this is the system used in Steemit, EOS, and other coins.
So what happened in this particular incident is that Tron colluded with a number of large
exchanges which were holding vast amounts of Steemit coin in order to gain the controlling
package of the asset. Once they got that, they were able to vote in a controlling set of
validators, which allowed them to basically control the network. They were empowered to
set what are the consensus rules. Once they gained that right, they were able to push an
updated node software, which unfroze through basically a hard fork, unfroze those funds,
which were from the initial pre-mine, which absolutely gave Tron a controlling package of
the asset in the system where no one could really challenge them and they were able to hold on to
their power indefinitely. Taking the ethics aside, there are arguments on both sides that, you know,
why did this have to break down into a technical attack when something that could have been agreed
upon just by dialogue? What's interesting about this, this is the first case of a proof-of-stake
attack and we could see how it played out. The way that it played out was very quickly.
Between the time that Tron was able to get the controlling package of Steemit coins, to
pushing their own set of validators, to pushing a hard fork, to unfreeze funds, to taking those
funds and, you know, multiplying how much voting power they have, it didn't take months or even
weeks, it took hours. So it was a highly coordinated attack. It was executed very precisely and
effectively. So this was a fascinating example. On the Ethereum side, we're, again, Ethereum is
something that has massive hash power, so we're not going to see, highly unlikely we're going to
see 51% attacks, but there's still a variety of things that people do, such as mempool manipulation.
When there was a black swan event, when the price of Ethereum crashed and a bunch of
MakerDAO auctions were starting to get liquidated, there was apparently a mempool attack where they
tried to cause a high degree of congestion so that some individuals were able to create a number of
liquidation bids for nothing, zero bid liquidations, and be able to win them because
they essentially did not have any competition because the network was congested. This is
a very interesting approach. We've seen mempool attacks before, but this is interesting how we are
manipulating the underlying protocol, underlying Ethereum network, in order to attack
higher level smart contracts and DeFi projects as well.
So some network security insights from what we've seen is that Steemit, that opens up a new era of
proof-of-stake attacks and governance attacks. Instead of being worried that someone will
buy up a whole bunch of miners or mining capacity, hash power capacity on NiceHash, now the power is
in the exchanges. So exchanges control the most coins, exchanges colluding together may decide to
attack a chain. So this is something that we have to be on the lookout for now. Attackers are getting
more creative as well, so mempool manipulation in order to attack a DeFi project is something
interesting that we'll likely see as well. Let's switch gears a little bit and instead of
talking about asset security on the protocol side, let's talk about the underlying software itself.
In the end, it's all abstract, it all works in the cloud, but what's actually working,
the actual logic and code that runs is a node software itself. Nodes are complex
pieces of software and the inevitable that they will have bugs and vulnerabilities. So a few
interesting incidents that I want to cover so far this year, two of them happen on the testnet,
so I'll start from left to right. So the Solana network, there were no issues in the protocol
itself. So the design, I believe it uses a BFT-like system. The issue was in the implementation,
there was a flaw, there was a vulnerability in the way that it failed to, the node software
failed to validate transactions, which essentially allowed somebody to print 500 million Solana coins.
On the mainnet project, so the Tendermint, this is the underlying consensus library used
by projects like Cosmos and others, a denial of service vulnerability was discovered, which
essentially allowed someone to halt the entire network. And again, this was done not because
of some flaw in the protocol, it was because of nodes failing to validate specially crafted
blocks. The last example is the inflation bug. Those are particularly dangerous because they
affect the entire ecosystem. Luckily, this one was discovered again on the testnet where 9 billion
file coins were minted. This was patched and did not affect the mainnet. But you can see like the
vulnerability, there are only three examples that I'm listing here, but the vulnerabilities in node
software can have severe implications for the market. On the wallet side, again, any piece of
software will have vulnerabilities. Monero wallet failed to validate specially crafted coinbase
transactions to be specific, which resulted in it appearing as if you received more of Monero than
was actually sent. This is something similar to, if you recall, there were a whole bunch of
exchanges compromised with the ripple. There was a special flag which is basically telling you
how much you are vouching to send as opposed to how much you actually are going to send. So there's
a potential for exchanges or individual wallet owners to incorrectly credit whoever is sending
them funds. Lightning network, it's still very much alpha system, so it continues to have
vulnerabilities discovered and patched. There are a lot of papers getting published,
so this is actually a good sign that people are looking into it and finding flaws early on.
Now Argent wallet, that was an interesting bug that was responsibly disclosed by OpenZeppelin
and effectively patched by the Argent folks, is that it allowed users to basically
create a kind of recovery mechanism using specialized guardian nodes. And in rare occasions
when such nodes were not properly defined, it allowed anyone to take over those wallets.
Once again, this was patched, but an example of vulnerabilities in wallets.
What's more interesting are not the vulnerabilities that are discovered and patched.
This is normal. What's more interesting are intentional backdoors that are introduced in
both wallets and node software. So the first incident I'm going to cover happened in the
Trinity wallet. We've seen backdoored wallets for a while. Last year I talked a lot about
the Electrum wallets getting backdoored. The way they attacked the Trinity wallet was not directly,
after the main repository itself. Instead, they were going after the third-party dependency.
So the third-party dependency on which Trinity wallet was relying to was patched to steal
users' keys. That was included in the main repository, and any user downloading and
using this was heading at this asset stolen. Ravencoin incident was even more vicious.
On July 4th, an inflation bug was discovered, and an emergency patch was issued to a variety
of nodes and distributed to miners. And this is something that initially maybe was just a
vulnerability. Every once in a while you discover those things, until the point they realized that
the bug was intentionally introduced. It was introduced back early in the year, in January,
by an account which was a throwaway GitHub account. The patch appeared to be a very
innocent-looking commit, which allowed you to be more verbose about the type of errors
that you're getting. So it snuck by the core maintainer's eyes. They were not able to detect
that. And for months now, they were slowly minting. There was a script running that was slowly minting
RVN coins. So in total, 300 million RVN coins were minted over time, and unfortunately also
sold on exchanges. So this was a successful inflation bug that was maliciously introduced
and exploited. These are particularly scary, and I'm sure we'll see this again and again,
because they attack the whole ecosystem rather than individual user or piece of software.
So some insights on node and wallet software security. Vulnerabilities are still very rare.
We only talked about four flaws here, and one was introduced intentionally. The question and
challenge to you, do we really have enough eyes looking at nodes, looking for the vulnerabilities,
and being able to patch them? There are bug bounties which are available, but I wonder if
there are enough participants and enough folks which are really pushing the limits of how secure
that software is. Ravencoin stealth commit and Trinity supply chain threats. This will likely
happen again. Attackers are highly motivated. There's a direct financial profit in attacking
these pieces of software. So this will likely repeat. So switching gears a little bit on the
layer two issues, which is smart contracts, that's even more concerning. There were, I mean,
I'm listing here 10 incidents. There was one more that happened in the last few days, which is not
included here. As DeFi projects are getting more and more popular, this is complex software,
which once again has a lot of different vulnerabilities which are constantly getting
discovered. I'm not going to cover all of these, just it would take a whole hour on its own,
but I'll focus on just three of these. So we'll start left to right. The first incident that
basically opened the year was the VZX DeFi project back in February. And the way that it started out
was there was a margin trading vulnerability that was exploited. 1 million worth of ETH was stolen.
What was interesting about this particular incident is that the attacker used flash loans
in order to amplify the attack. Flash loans is basically a mechanism where you can borrow
X amount of an asset and return it back to the initial point all within the same transaction.
So you're paying non-existent or minimal fees for doing that and allows you to execute an attack
in between since you have all these assets available to you in order to execute the attack.
So this kind of defeats a kind of a paradigm that we had before where we think that if it costs so
much money to attack something, that it makes it less likely that someone will actually execute
the attack. But with flash loans, attackers have really minimal risk to basically the transaction
reverting, then so be it, they don't lose anything. And they can return those funds and whatever they
loaned and they don't really lose anything. But if they win, then they win big. So in this case,
they won one million dollars worth of ETH. And we start seeing this flash loans approach happen
again and again throughout the year from this point on. Another incident which is interesting
to note is the balancer project. So again, 500k was drained from multi-token pools. This one is
interesting because it wasn't the vulnerability in the balancer smart contract itself, it was in
the way that one complex project was interacting with another complex project. In this case, the
developers could not predict that you could use deflationary tokens which change the logic to
the attacker's advantage. So when on its own, like in all their testing with traditional token
systems, then it works as expected. So this is something that is well known in the traditional
computer security practice and something that needs to be applied to DeFi projects as well.
Another gotcha in this one is that the vulnerability was reported in a bug bounty report.
So the good news is bug bounties work. I think a lot of the projects in the DeFi space do have
bug bounties. It's just, it's very hard to triage those things, very hard to find the ones which are
real examples of an attack and or which ones are not as good quality. So this is something
to keep in mind when running your own bug bounties. The last example, and again this is something that
example here repeated in other incidents, is a Bancor project where developers were notified
that they had a vulnerability, so they learned there was an issue. And the way that they
approached to protect their users is by attacking their own coin, their own smart contract,
with the same ways that an attacker would, it's just that with the purpose of actually
preserving users funds. But what was interesting here is that arbitrage bots, apparently
they're a piece of software constantly monitoring the Ethereum network, seeing that
if there's some large activity happening and it started automatically replaying it, trying to
make arbitrage opportunities, exploit arbitrage opportunities there,
picked up on developers trying to secure users funds and were automatically able to exploit
the project in the same way that the developers were doing it. So it's fascinating to see those
automated pieces of software that just piggyback off existing attacks.
So some insights on the Layer 2 smart contract security. This is going to be the year of DeFi
hacks. Both in the amount lost, the number of vulnerabilities discovered, unfortunately
the number of incidents is on the rise. So it will likely continue seeing that this year.
The bug bounty programs, they work and developers are catching bugs early, which is a good sign.
And I'll explain to you why in a bit when we talk about tooling and guidelines.
But the interesting trend is by Bancor is that we often have to hack ourselves to secure funds.
Complex code will continue having bugs and complex interactions between different projects
are also something that we need to think about as this is the whole point of DeFi is that you're
creating links between vast smart contract projects out there.
So I promised to talk about user security and we had a few major incidents that we're going to cover
shortly from Twitter and so on. But this is sometimes not as exciting of a field to look at,
but just as critical as any other discipline. So we're going to talk about cryptocurrency malware,
variety of scam and fraud schemes, as well as just talk a little bit like who are the
bad actors? Who is doing that? Who are the new players in this arena now?
So first, let's talk about the crypto mining malware. And this is how I got into partially
into cryptocurrencies is that essentially for a year, I was reversing nothing but ransomware
and crypto mining samples. For on the crypto mining side, it was always the Monero folks,
they are setting up their miners XM rig into anything that can possibly run XM rigs.
If they can run it on toasters, they probably would run it on toasters. So far this year,
it's not as bad as Russian scientists mining on nuclear stations. But still,
five EU supercomputers were hacked in order to run Monero miners. We had multiple issues with
Docker where attackers were scanning vulnerable API endpoints to take over existing Docker images
or just publishing their own backdoored Docker images on the Docker hub, which would also
mine Monero in the background. And of course, there's just never ending stream of
Windows desktop malware. One example is Lucifer, which is just, it's an arsenal of,
it was a whole exploit kit built into it,
which can self propagate attack other Windows machines and spread on its own.
So on the ransomware side, it seems like this is an ongoing threat. I'm not sure yet if the
trend is going down yet, but so far we had UCSF, which was attacked for 100 Bitcoin or so,
Travelex earlier this year, 285. Just a few days ago, we learned that Canon was attacked
with ransomware by, I believe, the Maze crew. We don't know. They're known to ask for Bitcoin
as a compensation, as a ransom. So we'll find out when the incident concludes. And of course,
it seems like every city in Florida is getting ransomware on their machines. So an example of
city Riviera had to pay 65 Bitcoins to get their systems back online. Yeah, so this sucks. This is
unfortunate. This is a threat that we have to worry about, especially on systems like UCSF
in the time of COVID. But this is something we'll continue seeing. Monero miners will
hack anything available to them to install the crypto mining malware. Ransomware appears to be
on the decline, but it's too early to say we're still only halfway through the year to establish
a trend. Crypto giveaways. Well, I mean, we all talked about the Twitter hack, which was
absolutely epic. I don't want to steal Victor's keynote presentation tomorrow, but he'll dive into
more details. But just to summarize, 130 accounts were hijacked on Twitter from exchanges to
celebrities to corporate accounts. The way they were hijacked is that the attackers were able to
basically get access to the internal tools through social engineering of Twitter employees.
And that's kind of fascinating. The best thing they could think of doing it
was running a BTC giveaway scam. So on one side, this is really bad. On the other side,
it could have been much worse. Elon Musk is getting no break from YouTube scammers. So
anytime you see a SpaceX feed, there's likely going to be send BTC notes everywhere. So sorry,
Elon. MLM scams are still continuing on as before. So we started with the BitConnect and moved on to
$4 billion enterprise plus token. And now the latest and greatest is Chinese police just busted
wall token scammers who managed to get $1 billion worth of crypto from 700,000 victims.
What's more interesting is not just the existing scams or the ones that I covered before, but the
trends of what are we going to see attackers experimenting with, which may become something
more prevalent. So one example is the MakerDAO phishing attack. And that is the first example
of a Web3 phishing scam. So you think that you are exchanging side to die.
You are interacting with MetaMask or so you think you're putting in your keys and then bam,
all your coin is stolen. So this is something that was reported early in the year and something
potentially we'll see in the future. The Justin Sun deepfake scam, that was fascinating. Someone
essentially recorded a video of Justin Sun doing some kind of investor scam, trying to get people
to send money to this unknown entity. And they played that video on a Skype call complete with
Justin cuffing and it looked very real and also very fake and strange at the same time. They
faked his passport to show for some reason. If you want to search that on YouTube, it's a
fascinating video to watch. It's still not something that was successful, but
it's kind of fascinating that scammers are even exploring deepfakes for that purpose.
The last example is the trust wallet scam. So we see just a barrage of backdoored fake wallet
software everywhere. If you search on Google, if you search in the app stores, what's
interesting about this case is not the wallet itself, it's how it was addressed, which is a
security researcher was able to actually attack the infrastructure, a fairly broken infrastructure
on the attacker side to start recovering the funds. And this is an interesting trend of
basically folks taking things into their own hands to help users.
So a quick note about the bad actors. So we already talked about the individual attackers,
so the Twitter folks, three were already arrested, one in Florida, one in UK.
So we'll call them lone wolf type attackers.
Insider threats such as Kasha employee who got malware in their machine and unfortunately
resulted in funds loss. Let's talk about APTs. So we're familiar with Lazarus Group,
so that's a North Korean APT, and a whole variety of financial ransomware groups who
basically attack anything with financial gain. What's interesting this year is the CryptoCore
APT, which is our very own dedicated cryptocurrency exchange advanced persistent threat.
So with a bull market maybe happening sometime in the future and the renewed interest,
we're probably going to see more dedicated groups like this as this becomes highly profitable
enterprise. So some insights. One is that users are taking things into their own hands.
So we have Woz who's suing YouTube for being too slow at taking down the giveaway scams.
We have Michael Turpin suing AT&T to basically compensate him for allowing the sim swap to happen
in the first place. We have researchers like Harry Denley reverse hacking scammers to get
users' funds back. While it does sound good on one hand that people are really pushing their
fighting back against the scammers, I really wish the industry was more mature and we had enough
tools on one side, but also user education and guidelines and other security controls available
that not as many people would get compromised in the first place.
MLM schemes are incredibly profitable. So this year out of all cryptocurrency scams,
basically 99% of the take was the Wo token $1 billion scam. In the past,
plus token with their $4 billion take, I think controlled a whole 1% of the total Bitcoin supply.
So these things are incredibly profitable and will definitely continue.
An interesting trend that exchanges are proactively blocking bad addresses to protect
their users. So there's always debate of centralized storage versus decentralized storage.
That's something that was interesting to observe this year is that exchanges like Coinbase,
they were basically blacklisting the attacker addresses immediately to save their internal
customers' funds. This is something that could be decentralized as well if you're looking for a
project to be able to alert users of doing some kind of unsafe action. And I believe a few
projects like MyCrypto are in fact doing that already. Scammers are getting more creative. So
the Web3 phishing sites and the deepfake scams, this is fascinating to see. I'm not sure how
profitable they are yet, but if they do become profitable at one point, we'll see a very rapid
rise of them. So to summarize the state of blockchain security insights that we've seen so
far, we talked about the exchange security, the number of hacks and financial damage is decreasing.
That's great. On the other side, existing incidents could have been easily prevented.
Attackers are going after more than just coins. They're going after PII. They're getting creative.
On the asset side, low hash rate GPU mineable proof-of-work coins are getting 51% attack,
will continue getting 51% attacked. There was a first example of a proof-of-stake attack,
and it was very efficiently executed. We're not finding nearly enough node wallet vulnerabilities.
I think there's an opportunity there for independent security researchers to really
start looking at that. Nasty backdoors and supply chain attacks against nodes and wallets
Again, if you can backdoor a node, you can attack the whole coin as the whole ecosystem.
You don't have to go after individual people and you can take basically the whole asset down.
So this is highly dangerous, highly critical to start looking at. D5 vulnerabilities are
unfortunately on the rise and so are the attacks as the whole ecosystem is becoming more popular.
On the user side, I don't see any new threats which are suddenly popped up. It's just a
consistent threat from miners, ransomware, fake software, and scammers are still sticking to
giveaway scams and MLM schemes. They're getting more creative here and there, but
they, I mean, the giveaway scams unfortunately still work. So an opportunity here is to work
on more user education to see if we can make users a little bit more secure.
So we've seen what the issues are. We've seen what the problems are. Here and there,
I dropped some ideas of what you can do to contribute to the field, make it more secure,
but really we can look at it more holistically and think of the blockchain security as just a
standalone industry that we can build up together. We can grow in terms of maturity, education,
projects, and so on. So some things, some ideas that I'm going to cover of what we can do is we
can talk about the guidelines and tools, how we can develop those. We can talk about growing the
community and specifically you, what is it that you can do today to start applying and contributing
to this field? So on the guidelines and tools side, there are a few amazing projects that are
available. So on the consensus diligent folks there, they keep on publishing a variety of
software to test smart contracts. They publish the SWC, smart contracts, weakness classification
registry, where you have a listing of top vulnerabilities, give you a good understanding
like what they are, how to prevent them. Trail of bits folks, they're publishing tools one after
another. They have the slither echidna. They published a document basically summarizing
findings from all of their smart contract security assessments. What are the trends? What are the top
issues to look out for? Open zeppelin essentially defined the field of how to write secure smart
contracts. I'm seeing a lot of the newer projects, they're just basically verbatim
adopting open zeppelin, open zeppelin templates, and they're very secure as a result.
Other projects like securing, they published the smart contract security verification standard.
NCC group published an OWASP style list top 10 list back in 2018. But unfortunately,
it wasn't really maintained for a while. So it would be interesting for them to
give new life to this project. Another one is the cryptocurrency security standard.
And this one is interesting because if you notice all the previous things that I mentioned,
they have to do with smart contracts and Ethereum. This is the only standard and project out there,
which attempts to talk more about how to securely generate keys, how to securely store
keys in the cold storage. I would love to see this project growing and having a larger impact
on the security of exchanges and nodes and wallets and so on.
Guidelines and tools are important. If we are to grow this industry, we need to have
large collections readily available for anyone who wants to contribute to this field
to be able to quickly learn from the mistakes of the past. On the smart contract side,
I think we're pretty solid. We have great tooling, we have methodology,
we have a variety of companies and consultants who are available to test your smart contracts.
So even though there are a lot of DeFi issues which are getting discovered,
but there's enough tools and folks that are experts in this field that can address this
trend very quickly. On the other hand, we're missing core guidelines, core methodology,
and practically no tools to address standalone blockchains. If someone wants to build a new
project, what is a good resource that they can read and learn about the failings of the past
and how they can learn and correct whatever future designs that they're building?
Node configuration operation. Nodes are at the core of any blockchain project. If nodes at some
point start having more and more vulnerabilities discovered, then this breaks down everything that
is built on top of them. Hot and cold storage security, key management, protocol design,
wallet design, innovations in blockchain forensics, and also user security, how to educate users and
give them simple guides on how to avoid scams, how to give them tools to quickly protect them
against going to bad websites like Google browser style. Like this is dangerous, don't send to this
address. One thing that I will be covering later in a separate talk on attacking and defending
blockchain nodes is I'm trying to create an OWASP top 10 style listing of what you can do to secure
your node infrastructure. But I invite all of you to pick out any one of those items in the list,
or if you imagine that you have more things to contribute to this field, and start writing
documentation, start writing tools. There's an entire field available that you can develop and
work with. On the community side, well, here we are at the Blockchain Village. There are three other
conferences which are also available that you can attend, hopefully virtually, throughout the year.
But I wonder if there should be more. I imagine that as the community grows and this field grows,
we're going to see more and more of these. We have our own competitions. So we have this year,
I believe, Victor is hosting a blockchain investigation competition. Last year, we had the
Capture the Coin and Chain Heist. There are some challenges which are ongoing, such as OpenZeppelin's
excellent EtherNOT. So this is great. On the knowledge sharing side, we have a variety of
resources. So you can go on Telegram, Reddit, Discord here for DEF CON, and you can talk about
blockchain security. Some newsletters that are also working on distributing, disseminating
knowledge. So the one that I'm running is Blockchain Threat Intelligence, where I try to
cover every piece of news that is related to this field. Not just related to smart contracts,
but just holistically. Exchange security, malware, user scams, and all of that. Consensus Diligence,
they're running an excellent smart contract security newsletter. So if you want to raise
focus on Ethereum and Layer 2 security, this is the resource to subscribe to immediately.
We even have our own shitty movies. So we have Crypto, where we have an AML officer
hunting down and investigating blockchains to bring down Russian mafia, and the Money Plane.
I'm not sure exactly what's happening there. I think the plot is they're hacking crypto on a
plane, which is a fortress and a casino. Point is, we have our movies, we have our media. We
made it officially. This is great. So some community insights. We're still a very small,
but growing community with unique competitions, gatherings, chat rooms, challenges, tools,
projects, and so on. Our community should and will continue growing. What's exciting to see is
blockchain security or BlockSec becoming a career option. Even today, you can look on the internet,
you can find jobs to do smart contract security testing if you want to. You can do blockchain
security engineering, so building projects, securing projects. Cryptocurrency forensic
analysis is going to be even more in demand after the Twitter hack. More people will try to
exercise this new skill set. So I'm hoping this will grow in the future.
The point is, I want to invite you. I want to invite you to contribute to this field.
So if you enjoy learning about the nitty gritty technical details, consensus negatives, smart
contracts, great. Join BlockSec, contribute to this field. There's plenty of things to explore
and do here. If you're a security professional, and you're just tired of finding yet another XSS
or SQL injection bug, you want to find some cool new things which are just not fully explored yet,
basically be able to define the field. Great, join BlockSec. There are plenty of bugs that
need to be found and patched by you. Are you an investigator who is trying to hunt down the
fraudsters, wants to understand how the hell do we track down fraud and bad guys on the blockchains?
Great, join BlockSec. There are plenty of blockchain analytics companies out there.
There's a growing body of investigators who are now capable of doing those tasks.
Join them. This is very interesting. Finally, if you're a developer, and you're just looking for
an exciting new project, and you really want to make an impact on the open financial system,
making that system more secure, contributing it to be more trustworthy by the people using it,
is a good way to help bring it about. So with that, join BlockSec, and thank you very much for your time.