DeFi Security 101 2025 - Web3 Operational Security 101

Transcript

Yeah, it is. >> So the idea about today uh is to talk a bit about operational security. We have tons of things to talk about. So the idea is to start seeing some cases right of some hacks and then from each one of these hacks what we can learn from them right but if there's a topic you are most interested in you just let me know. You ask questions please let's make this dynamic so we go deeper. uh there right so first a very brief intro about who I am uh I do operational security research only focused on web 3 I founded OBSC where we do all these trainings and

audits for web3 organizations along with Louis and Bruno er security alliance you may know for sure I am in the optimism and polygon protocol councils too then we have Bruno you have So sure well my name is Bruno I'm joined OBSE in 2024 uh I'm leading the security research uh team and the Ont is doing uh open source intelligence uh research we have found that uh there is a lot of stuff on the internet uh that is helping thread actors to to carry on

with their with their attacks Uh well I'm working in blockchain industry and web 3 since 2020 2021. Okay. So as you may have known uh or you may have seen the if we see the attack vectors today 99% of money being stolen in blockchain is not smart contracts anymore. It's operational security. Right? That's private key leakage, SIM swaps, soldier engineering, domain hijacks, insider threat, malware, zero exploits, full of stuff.

The same things that we used to do 25 years ago just to open the floppy disc or something from someone else computer. Now it's being done to steal billions of dollars right? So from this 99% of money being stolen, 99% of these attacks start with social engineering. Right? What is social engineering? Is the art of uh making someone do something against their interest and in the interest of the attacker, right? Uh Bruce Ner says that amateurs hack systems, professionals hack people. This is I totally totally agree with this. Any organization, any organization, it

doesn't matter the systems that they have, how much software they have, policies and this and that. If you can soldier engineer someone or you can put someone inside an an organization, you're already inside. Kevin Mitnik who passed away used to say that soldier engineering bypasses all technologies including firewalls. So today we're going to see five five stories and something that we can learn from each one of them. Right. First one is called real fake B. Does any of you know this this kind of this type of scam?

No. Perfect. You love it. So let's say that you are in um we have Peter who is a fund manager and we have an anon investor that approaches Peter in a Discord server, right? and he proposes to do a 3 million OTC operation, right? So, let's say that Peter has 3 million X tokens and the anon investor wants to buy that for $3 million, right? But he says we don't want to do it through an exchange or through a decentralized exchange. No, I want to do it OTC. And for this operation, the anon investor proposes to have an escrow, right?

Proposes to have John as an escrow. John is someone who is very known in the ecosystem, right? Someone with reputation and happens to be friends with Peter, right? They are friends from real life. So Peter says, "Hey, what's the issue here? Nothing could happen if the escro is someone I trust. Everything is okay, right?" So they say, "Yeah, let's continue with this." In fact, what does what can Peter think? If I if I want, I could scam you, right? Because I know the the escrow. Perfect.

So the anon investor says okay guys share with me your telegrams because for security reasons we should continue this in telegram right. So Peter and John share their telegram account and here happens the magic. The scammer says the investor up to now says okay now I will create a a a telegram chat a telegram group but he creates two groups. In one group he will impersonate Peter, he will add John and he will add himself. And in the second group he will add Peter, he will impersonate John and he will add himself. Right? So in each group we have the scammer and one of the other

persons. Right? So what happens now? they start talking and whenever John uh Peter writes something there the scammer will copy it and we'll send it here from the uh impersonated uh Peter account and when John replies here the scammer will copy it in the chat with the uh impersonated John account right so Peter and John see that the other person is talking the way they usually talk right like if it were if it us. I know how Bruno writes, I know how Louis writes, I see everything and I see everything totally normal, right?

>> Yeah. And also, even if we were we were talking like on another channel at that moment like on WhatsApp, hey, you know what uh John said, we were talking about the same like the message are all equal in in both channels. Um so yeah so the the best for me the the the beautiful thing about uh this case is that there is no technology involved there is no code and technical stuff just a telegram channel and this kind of OTC operation is something really really common and as Pablo said like if I'm going going to do a OTC operation I would like to know the

escrow for me like it's it's all okay. Yeah. Yeah. The beauty of this is that up to this moment, nobody suspects anything. There's nothing to suspect. So what happens next? They keep on talking. Yep. >> Yeah. So the question Yeah. Yeah. Yeah. So the question is how does the impersonation work? Perfect. What they do basically is let's say that I want to I want to scam them. So I add Louis in Telegram and then in that channel and then Bruno tells me okay my my Telegram is Bruno Tossi. I create one that is

Bruno to Rossi with one more s. So it's just a fake username that is very similar and I add that user. So you're basically adding another user that seems to be that one. >> Yeah. The the thing is also that in in telegram you know you can hide your phone number uh and most people use it in that way you are hiding your phone number so you can check uh with the phone numbers uh you can also fake like the name. The only thing that you that you cannot like steal is the username. But you can uh use another like character very very similar that if you are not paying enough attention and when you are talking with hundred of people maybe at that day on telegram something

that can slip >> like raise your hand if when they add you to a telegram group you go to the detail of the telegram group to see if the people that are there are really your contacts. You don't do that. Nobody does that. So what happens? They keep on talking and this and this and that. And then John says, "Okay, the address where you have to transfer me the funds is this one." And then the only thing that the scammer does is in the second group, he shares another address, right? So if the funds are transferred there, totally wrecked right?

Luckily, well, not luckily, these guys had a process, right? They knew that if they were doing an operation higher than 20 uh K or with someone that they didn't know, they should share the address where they were going to transfer in a separate channel, right? In this case, WhatsApp. So, they went to WhatsApp, they say, "Hey, is this okay? This this is a real a real case. Is this okay?" And they say, "No, it's not okay." How? And and it took them like five minutes to realize what was what was happening. Right? So what can we learn about this policies and procedures like this thing of saying every time I'm going to make a transfer I'm going to share it in

another channel or in this and this and that are boring and 99% of times are you say they're useless right because you send it yeah it's okay it's okay it's okay it's okay it's like I always say whenever I get out of my home I I I get to the elevator and I say oh did I close the door and I go back and I check and it's always closed But 6 months ago I I went back and it was open. I said oh okay this time for the first time it was uh useful and here happens the same 99% of times having policies and this kind of procedures is useless but will protect you the day that there's the combination of you being relaxed for some reason. You being a bit tired and someone who is sophisticated targeting

you. Right. The other thing to learn from here is that switching communication channels is a red flag. If you're talking with someone in Discord and they say let's go to Telegram or you're in Telegram, let's go to Signal, whatever. When there's a switch in the communication channel, that's a red flag and you have to pay special attention. Then we must always verify who we are talking to, right? And in this case, we have to verify two things. Who is the other person, right? The the anon investor. I personally think that doing business with anon people or even hiring anonom people is crazy. It cannot be done anymore. Any company that is still hiring anon people that I mean the

founders don't know who they are hiring eventually they are going to get wrecked. Right? North Korea is in at least 15% of companies they have people inside in wealthy organizations or that number may be higher. So unknown people no not anymore and then also verifying that let's say Peter J verify John and John verifying Peter that's also very very important and how oh how can we do that uh it's not here one one thing that we always recommend to our clients whenever you add someone in telegram right there's two important things that you have to do you go to add contacts and you will see that first of

all you will have the option of share phone number by default select it right you should unselect that right the idea from telegram the only the reason why the crypto industry uses it I think that is because of that the fact that you can share your phone number but we have this idea that telegram is secure and telegram is not secure is 100x safer and more secure and more are more private than telegram but well the industry decided that everybody uses telegram so First of all, don't share your phone number. And second, whenever you add someone as a contact, let's say that they are part of my team, right? When I add them in Telegram, I put okay, Louie or Bruno, their surname, and then I for

each company where someone belongs, I choose an emoji. So I know that all the people from Maker Dao have this emoji at the at the end of their username. They have this emoji. The people from Centrifuge has this one, the one from Ethereum Foundation, etc. So whenever I'm talking with someone in a group and they are someone I know from Ethereum Foundation in the name I will see the name that I put and that emoji in the end. If I don't see the emoji it's not them right because what I'm seeing is the default username the default name that everyone sees. So the idea here is do not use those those default names. Another advice regarding uh regarding uh right telegram usage let's say um it

it wouldn't prevent anything on this case but I think that is one of the most important tips like using telegram um the best way to use it is uh using secret chats uh on telegram you can start like a regular chat and when you do it uh like in the regular Okay. Uh you're not using like end to end encryption with the other person. So all the message are being stored on the telegrams um on their ser their servers.

So yeah the best the the only way I think to use it securely is using secret chats with the end to end encryption. >> Yeah. And also remember that uh I don't know if you remember some years ago when I don't know if it was Crema or something in Russia but Russia said okay they blocked all platforms WhatsApp signal and this and this and that but Telegram they didn't block it right and if they didn't block it there was a reason right everything we write in telegram they can read it so um one more case well one more topic fishing now yep there's a question Perfect. Okay, that's a great topic. Uh

the question is how do how do we manage thing of hir hiring anonymous people and how you how you verify them. One thing is to say okay I have people in my team who are anons anons for the rest of the internet but I know them personally. I think that that's totally fine. I think that founders should know should meet people in person. It's not just uh okay to say no, I had a call and it's okay. Why not? Because in the beginning we used to see DPRK. DPRK is North Korea, right? Um just saying, "Okay, yeah, I am John. I live in Canada and this and that." And they were going into calls and this and

that. And if you had a good process, you could you you were able to detect them sometimes, right? But what they are doing now is far more sophisticated and it's very complicated. What they do is the next they pay someone a US citizen, right? There are many US citizens who are pay being paid. They put laptop laptop farms at their homes. So they have 25 computers connected to the internet with remote access that are used from North Korea. And then when you have dailies, when you have weeklies, whatever, this US guy connects to the calls and has a script and reads. So you may think that you are hiring a guy from Kentucky and you know him. You talk with him and everything, but that's fake. And that guy doesn't

know that he's working for North Korea. He thinks that he's working for some guy from the Philippines who cannot get a job in the US because he's from the Philippines and he's just helping him, right? So that's why I think that we should meet everyone in person. I personally don't hire anyone that I don't I don't meet in person. I know that for companies that are very very big that's an issue. In that case there should be a very deep background check in research and to check that the person is really legit. Anyways, aside from that, any thread model should include the fact that anyone in a company can go wrong, right? Or that can be compromised

and then with the accesses that they have, they can do whatever they can do, right? Um yeah but this is something that right now is we are starting to see it in the industry like we have been talking with clients and big companies and they are starting with this policy that they don't hire more people that they don't know like uh personally yeah most if you check most organizations that thought that it was very funny to have anon teams then in the end if you go and research or most of them had DPRK guys in their teams. Um it's estimated that between 35 and 50% 50 half% of job applications that web three

organizations receive are DPRK. Half of them and their number one reason why they are not detected is that they work a lot. They work very well and they never complain. Never. So that's why they are not detected usually. No, it's crazy. Okay, now a bit about fishing. What you usually see with fishing is that some companies give you these campaigns that they send you fishing emails and you have to detect them and they are very easy to detect, right? So that they give you in the practice but in reality fishing is far more advanced, right? So let's see some examples or the kind of fishing that we are

interested in. Uh this was during consensus in 2024. Uh there was an event from Etherfi. You sign up for the event in Eventbrite like with hundreds of events that we now have for example in in Luma for this conference and 30 minutes before the event you get an email from the official Ether account in Eventbrite and everything with your name blah blah blah blah saying that you have to mint your NFT pass to access the event. This could be totally legit. You click on the link, you mean the NFT pass, your wallet is drained, right? But this is coming from the real the real source.

A very similar case, Treasor. They had the the newsletter hacked the system that they were using and you receive an email from no reply at treasor.io IO signed by Traor, mailed by Traor, everything perfect, but it's coming with a fishing link with malware. Or the Ethereum Foundation, they had their blog compromised, too. So, you receive an email from the official blog with fishing or Vitalik's Twitter being hacked, but is his account, right?

um or you receive a a letter a physical letter from Ledger in your home with a new device. Right? So what I think that is interesting from these cases is that the attack can and will come from a trusted source. It's not that oh it was they changed the letter or it was a different domain or this and that. No, we are going to receive fishing from the real sources. Right? One one case that we saw that is super scary but it's going to happen a lot is they were targeting a founder that was really sophisticated. So instead of going to the founder, you can go to the let's say that yeah the crown jewel >> a service provider or to a client and

>> exactly let's say that the crown jewel is getting private keys from a founders's device right so you say okay we could go through his family or this that but no they said no we are going to go through uh his lawyers right so they hacked the lawyers from this um founder in the inbox they saw that they were prepared ing an agreement for I don't know a change in the cap table of the company or something. So the founder was expecting to receive a draft from the lawyers next week. They waited next week and then on Wednesday that this was the day that the founder was expecting expecting this draft. They sent from the lawyer's email account that email with

that piece of information with the doc that was infected. So the founder was receiving something from someone you trust, a document that you are expecting the day that you're expecting it. There's no reason to suspect from that, right? He was infected, he's gone. Um so we think that this is very very important. We have we need to have um like uh let's say policies or procedures to verify everything and anything that we receive that it's a bit uh out of the ordinary we have to recheck always in fact well no I'm I'm going to leave that for the

>> yeah and also I think that is important for companies to train their people on security like all the departments All all the teams uh should be trained in security. If you if you saw um most social engineer attacks or like the the people in companies that are are mostly often social engineer are like custom supports >> and also new people working in custom support. Why? Because as a customer support you you want to help someone that is asking for your help or that needs something like it's part of your job. And also when you are a new employee, you want to perform well and you want to do it fast and when someone

ask for help and try to to like you have to do everything fast and it make maybe skip one of the procedures like mostly often new employees uh fall fall in that. >> Yeah. Um okay now one more this is about Google. This is not maybe so web three but it's very very connected right uh what's the the big problem with Google that we use Gmail for our emails we store our passwords in Google Chrome so those passwords are

synchronized where with our Gmail account we use Google authenticator which stores our codes in the cloud where in in our Gmail account and if we use our android for example pass keys are stored where in your Gmail account um so what's and what's our issue with this we use the same email address for everything right the the email address is used for our Coinbase account our password manager and some random event we signed up in a conference so what happens with this you are doing you are working and someday maybe you have a fake job interview or you download some library or you clone some repo or you

download some extension whatever there are the thousand ways your computer is infected right all of us all of us including myself everyone here eventually our computer will be infected remember this at some moment it will happen that malware will install an info stealer right an info stealer let's see if I have it here is a piece of of software that will first download our malware and then will steal information from your device, right? What kind of information? Your browser login, right?

All your passwords in Chrome, they copy them. Your browser cookies, right? So, if they steal your Gmail cookie, you have Gmail open, they steal the cookie, they open the session in another device, it doesn't matter how many you have and anything, they steal your session. They will get your VPN credentials. they will get all your private keys from hot wallets etc. And these infoers also update themselves all the all the time. Right? So let's get back to this. With this with a simple click that you did, your computer is infected. They steal your Google account. And when they steal your Google account, they have your emails, your passwords, your 2FAS, and your pass

keys. You lose all of your accounts. And there's no way that you will get that Google account back unless you know someone who has a very interesting position let's say at Google and obviously all all of the accounts that you have lost there are for sure many of them you're not going to get them back right so what can we learn from this we cannot put all the eggs in the same basket basically right so the idea is Gmail here we have Gmail is for emails and that's it. Google password is not recommended. It's not a good idea to sort passwords in the in the browser in any browser, right? It's the first thing

that an info stealer uh steals from a device very easily and very fast. So for passwords, password managers and that's it. Then Google authenticator is not recommended. Google authenticator, AI, Microsoft authenticator, any app for 2FA where you see numbers and you enter them, they are not safe. Why not? Because we are going to see it in the next case. I don't want to I don't want to um I don't want to get into that uh yet, but we'll get into that. So, Gmail for emails, password manager for passwords, for authentication, for

two-factor authentication, we will see. But the recommended thing is to use UB keys and then pass keys. We will talk about pass keys if we have more time to the problem with pass keys is that h pass keys were designed to be stored in the secure enclave of devices, right, of your computer, your iPhone, your Android. But it happens the same that happens with all technologies. We have very good technologies but we use them like So for example, we have a ledger with a secure incl and this and this and that and then we put the seed phrase in a password manager, right? Um so the only way to store pass keys safe is inside UIs. If you are storing pass

keys in your iCloud account, your Gmail account or a password manager, that's not safe. And that I would not even consider it a pass key. Yeah, I I would like to add something here. Uh so what is important is to to to understand that there are several layers of security that can be applied and that can prevent some some of this case. Let's see that you fall uh into the social engineering uh part and you finish download the the info stealer. Uh first thing that is going to alert you if is if you have an antivirus. If you are using like a good antivirus that might alert you and you can prevent it

on time even if you the antivirus uh didn't detect it. Uh the using like um a second factor authentication that is not fishable also will prevent the attack. And the other thing that for me is one of the most important pieces uh of technology that you can use on security is firewalls. So even if the info stealer gets all this information when they try to steal it and send it to the attacker, it's going the the info stealer will will try and to connect to the attacker's computer to send the information. So if you are using a good firewall and properly with the proper

configuration also the firewall is going to prevent uh for the information to not be like exfiltrated. >> Yeah. Exactly. Yeah. There's a there's a myth nowadays that if you use a Mac there's no virus and no not no malware. And that's exactly that. It's a myth, right? In fact, Windows security is better than MacBook than Mac OS security. The issue that we have is that usually Windows users are more basic users, right? And they download anything and it's that's the reason why we see more infection cases with Windows. But in the in the crypto industry that everyone uses Mac, lots of people are

infected. They have no idea and they are using Macs. So using an antivirus is not something from the 90s. No, you should use at least an antivirus like malware bites is $20 per year or I will spend a bit more and use an edr like crowd strike or sentinel one. You can buy a license for crowd strike for yourself h and that will protect you far more. And also if you are interested in Apple security uh we are giving a talk on Friday uh 10:00 a.m. also. So yeah, we hope to see you there here.

>> Yeah. And one thing related to that that many times they ask us uh the difference between an antivirus and an EDR because from the last 10 big hacks that we have seen in crypto, nine of them started with someone being infected. And I I believe that from that from those nine, seven at least could have been stopped by an EDR, an antivirus and an EDR. The difference is the antivirus detects stuff because it looks for signatures in files, right? But an antivirus, if you're a bit sophisticated, you know how to bypass it, right? On the other side, an EDR looks for patterns, right? So it says, okay, there's this process that is

trying to read memory from this other program or this and that and they detect stuff like this. So they are able to detect new stuff. If you're being super targeted, someone will prepare a malware exactly for you. So because they will say okay Pito uses a Mac and he has Chrome and we know that he has this extension and he uses this this exact thing. So they will prepare something that is exactly prepared for my case. >> So maybe an antivirus will not detect it. >> Yeah. Because it cannot be find any database where that the antivirus uses to to check it.

>> Yeah. Exactly. Okay. One more fishing case or why we should stop using 2FA totp apps. So you received this kind of email. This was this happened like I think that one year and a half ago and they hijacked lots of Twitter accounts. I remember it was crazy. So you you receive an email that obviously is not coming from Twitter, right? But maybe you are in your phone and you don't you don't check the from and something that we are seeing now is that lots of fishing don't go to the spam and fishing folder from Gmail. They are in your inbox. They are not detected anymore.

So they say that they notice a login into your account from North Korea. This is very funny. H and that you can secure your account clicking here. So you click there, they take you to this platform uh where you can change the username here. I changed it for this example. So it shows my account. It asks for the password. I enter any password. It says that first it's wrong. Uh then I put it again and you log in and what does it happen after that? They ask you for your 2FA code, right? So if you have Google authenticator, AI or whatever app that we have, we enter the 2FA code and what's happening there?

that code is being proxied to the real website and now the attacker has logged in into your account. Right? So what's the problem with these apps with Google authenticator and all of them? Those codes that they are generated are fishable, right? If you enter them into a fishing website, you're So also that is uh also funny is uh these fakes login uh using the fake websites usually prompt you first with the wrong password even if the password is okay because um the attacker has two chances if if you put you if you really put your password wrong he miss it. So it's always prompt prompting you the first time that your

password was wrong. So they have like two chances to get your password and to compare it and be sure that that that is your your definite password. There's a question >> what should you use instead of the >> perfect now we are going there. >> So well they show you this panel and blah blah blah while you are doing a stuff they are inside your account. So what you should do so how does this work? As we have said you basically you enter your username and password that can be either there can be two possibilities some there there's an operator on the other side that receives your password and in another window they enter it they receive your traffic code and they enter it manually and sometimes it's done automatically but let's say

that everything that you put into the fishing website it's proxy to the Twitter website and then when Twitter requires the MFA they require it to you they go back and they log in right so what should we do to avoid this UBIS UIGs. All of you, all of you should have UBGIS. UBGis are like between 60 and $80,000 dollars, not thousands, between 60 and 80 um dollars. And the interesting thing about UB keys, if they are properly configured, right, because if you use them by default, they are not as secure as they should be. Louie is crazy for UB keys. He's researching he we we research

we research a lot into this and we uh and the conclusion we go to is the next if you configure your UB keys with something called 5.2 to that is basically to have a pass key inside your UB key. That's the only way to do secure to FA. Why? Because when I when I want to use my UV key in let's say binance.com, if I configure it like this, when I when I create my when I set up my my UI key in Binance or in Coinbase or in Gmail or whatever, each time I set it up, I will have a new pair of private and public keys, right? Each one will have a different one and when I want to log into let's say coinbase.com

coinbase.com will have to send the code and the UB key will verify if the if the platform requiring the the signature is the real platform or not right so basically UB keys detect that if I go into efficient website and I connect my UB key with 502 it will not work that's the only way to do secure to FA all the other ways SMS obviously we all No, it's a nogo. Email 2FA, it's a nogo. Also, this FFA apps also it's a no-go. The only thing is this. And the other thing from Google authenticator that is very dangerous is as as we saw, Google authenticator now backs up backups your codes in the cloud. So, if they hack your Google account, they have all your

codes and they are not encrypted. So, having two FA codes in the cloud, it's a problem, right? I you I used to use AI for example because they have them in the cloud. They haven't encrypted and everything you want but they are in the cloud right and our in our threat model we believe that nearly everything is compromised for real right maybe the only way that you can prevent it is just having the Google authenticator in a dedicated device that is not connected to the internet that you have it like I gap and you only use it to to store the Google authenticator app and that's it.

>> Yeah, exactly. The the like the only way to use Google authenticator as he's saying is that you have a separate backup phone. You have Google authenticator there. You disable the cloud sync and then what what's the issue? If you lose that phone, you lose everything. So every two days you need to go to that phone with another phone and do the manual synchronization between uh both Google authenticators. You have an option that is export codes. So you do the the synchronization like offline, but it's it's too much. >> Yeah. It's easier to spend the $80 and use the UI keys.

>> Yeah. >> And if you think that UI keys are expensive, expensive is to have a security incident. >> Yep. >> Perfect. >> Yeah. Actually, >> yeah, we repeat the question. >> Yeah. So I think the question was about is there any backup solutions for the UB keys? So UBI keys have pros and cons. The pros are they offer an amazing user experience is faster to touch your UB key than going to your phone checking the 2FA code and entering them. And they are fishing resistant. However, they cannot be backed up. So you need to have at least two UB keys. I highly recommend you to get three. I'm speaking loud

enough. Okay. And the main thing is you need to have three UB keys in three different places. So you have a backup if you lose the first one, if you lose the second one, if you lose the third one. And in most of your online accounts, you need to download something called recovery codes or backup codes. These codes, if you lose all of the UB keys, is the only way for you to log into your Gmail account, for example. If not, you will have to go through support and it can take many days. So you need to have multiple UB keys and have the backup or recovery codes somewhere where you can easily call someone from your family and say, "Give me the codes. I need to access my account.

Wait, no, no questions. More questions. You you you're satisfied? Yeah. >> So, just to to make sure I understood, then for each account you do 2FA with whenever you set up the 2FA, you save the recovery codes. That's a backup. And then you also have it within the UB key. If you use the UB key, you have one more or two more. Or if not, you have the recovery code from whenever you set up the 2FA for that. Uh, >> exactly. So the recovery code is tied to the account. The UBI keys are something different. Let's imagine I create a new Gmail account. Right now I have three UB keys. I register all of them. And once I'm done, I download the backup codes. I print them twice and put them in two

different locations. And in case I lose all my UB keys, which I hope will never happen, I can call someone from my family. They know at in this book page 44, they are my backup codes and I can recover access to my account. And these uh backup codes, are they stored in the cloud for these or it just something you have and then they can check it by hashing or something like that? Um good question. I think backup codes you can only download them once you um enable and upload to 2FA factor for 2FA verification. I don't think they are encrypted. I just know that they are one time generated and you can only use them once. That's how they work. Yeah. But that's why they should be really stored

securely because if anyone finds them it will bypass to FA basically. >> Okay. >> What one thing related to that first is um first of all recovery codes must never be stored in password managers. Right? There are many people that things that we cannot store in password managers. First 2FA, you know that one password or or Apple passwords now allow you to generate 2FA inside the password manager. That's a very stupid idea that that one password had. Why do you want to have passwords and 2FA in the same place? So 2FA is never recovery and backup codes in your password manager also. No. And then obviously please private keys and seed phrases. No, but I

know that at least 30% of you have done it in some moment. Everyone has done that. Um and then going back to the question about recovery. Ah yeah and uh and those backup codes what we recommend is to also have them as Louis was saying in paper right paper we used to make fun perhaps when our fathers or or someone say oh yeah we have our book with the password written and we say ah that's not safe and in fact for some things it's a safest thing to do >> and also I think that he asked how many yeah you should you should have like yeah we recommend at least >> we recommend at least uh three having three UIs. The idea is that you can have

like uh one that you carry on always with you, another one uh as a backup, but if you travel, you take it with you and the third one in a safety place. Uh and you having three UI keys allows you like if you lose one of them, you can buy another one. And >> and I think just to add something about the UB keys and recovery codes, you need to use the keys principles. Keep it simple, stupid. I used to have many encrypted pen drives uh with a different password to store backup codes for example and I ended up losing the password. So I think you need to find the right balance between having a high level of confidentiality but also

availability. I don't wish that happens to anyone but if you travel to a conference or somewhere and everything gets stolen from you. I think it's complicated to call your grandma and say put the pen drive here is the encrypted password etc. And I think uh it's old but gold having it on a piece of paper somewhere safe and different copies is good enough to have a high uh availability. >> Yeah. And also one more thing that Louis said that is very important. For example, I have a UI key now connected to the computer. Right. This is the This is the nano. I don't know if you see there. It's very small. I always have it there. And what would one would say, okay, and if they steal your computer from you, they steal a UB key. Well, we have them configured with a pin. If you

don't have the pin, you put the pin three times in a row wrong, it's erased, right? And the second thing related to this thing of availability because whenever security in security is important to have two things confidentiality but availability as Louis was saying if his password is very complicated and you have different passwords and you lose access to that that's a security issue right so other thing that we we that is part of our setup for our clients is to have backup devices you should at least have two computers and two phones so I have a copy of my phone with all the email accounts, all my Telegram account, my password manager, everything that is

important. That phone is updated. It's turned off with battery, stored in a safe place. If they steal my phone from me in the street and locked, which what which happened to me in March, I know exactly what I have to do. I go I have to call someone and get this phone and turn it off and put this pin and close the sessions and do etc. So the backup phone is something very important for all of you guys. And if you can have a backup computer, right, that's even better, right? Best thing that can happen to you is that you do it and then you said, "Oh, this guy gave me this idea and I never needed it." Right? It's if you never need it, that's the best thing to happen. But if you ever had have an incident, having that backup

device is the best thing to to do. Okay. And here we have some examples of these are just part of my UI keys. I have like 25 I think I have now. Um the ones that we recommend are that one, the very very small one called Nano because you keep it plugged into your computer. It's USBC. Uh and then this one that is the UK 5C NFC.

And if you want this one is with fingerprint. I don't think it's so necessary to have the fingerprint with the other one. You just put a pin and that's it. Okay. And this is how we UB keys users look at people who use Google authenticators. Disgusting. [snorts] Um so to make a summary of what we saw here, eventually we are all going to be fished. It's going to happen to us. Remember it's going to happen. We will be relaxed. we will be a bit tired doing lots of stuff and we receive a very sophisticated email targeted for us. We are going to click it. We are going to put our login. It's going to happen. So, uh UBS is the only thing that will

protect you from that kind of of attack. >> I want to add something here. Going beyond fishing, I think we need to to switch our mindset and perhaps start thinking okay not um am I going to be hacked but when am I going to be hacked? I I think it's a good way to have a good threat model. You should consider uh what happens if I'm going to be hacked. Is it going to impact my personal stuff? Is it going to impact the company I work for? And I I think having clean devices is the key. And having an incident response plan is the key. Also, Pablo mentioned having multiple devices. Uh it's for sure to not lose any data. But if you think you're being compromised or if you think your laptop is being stolen, you need to be able to revoke

all the sensitive sessions that are open on that second device. And I say this and it's very important because if you download a piece of malicious code, the worst thing that can happen is having your device fully compromised. And it's pretty much the same as giving your laptop unlocked to the person that is next to you. So you need to be ready for that. Ready to have an incident response. What are the most sensitive accounts? You need to be able to close fast. So yeah. Okay. Uh let's go to another one. Uh this is a beautiful incident. Uh is using uh the slack is social engineer slack. So yeah first uh the first is start on um is this is Twitter

DMs. Yeah. Um well they are uh impersonating uh someone uh working at Parfi Capital and yeah they get in touch with you they say let's connect I will uh send you a a slack channel uh to to start uh chatting there first thing that you can uh that you can spot uh and this is something uh like really really important on on on Twitter Um sometimes you are going to see uh Twitter profiles that have like thousand of followers but the followers are not anyone that you follow and that is

something really strange like in our industry like almost everyone knows everyone that has been in the industry like for a few years knows each other and on Twitter I'm pretty sure that with if you follow if you see my account we are we have at least I don't know five or 10 users in common because we follow and we tend to follow each other a lot. So that's something that happens not followed by anyone you're following.

If you see this it's either because the person is totally relevant or is an scammer. So in any case it's a red flag >> and combined with the blue tag. >> Yeah. And connected to that having the the the there are there there are two reasons to verify your true account. First of all is if you're an scammer and second if you want to have more reach, right? But all scammers verify their account. So having seeing this, it doesn't mean anything. Well, it means that they for sure are scammers. And in this case, as Bruno was saying, if you went and checked the profile from this guy, you would see that he was being followed by all these verified accounts from Parafi Capital. So, you would say it's legit,

but not everything is fake. >> Yeah, that that's another thing. The the issue that they all of these accounts have the ad sign and like they work at Far Parafi Capital in their profile. That doesn't mean anything like the all of these were uh fake Twitter profiles. >> What's the question? Sorry. >> Yeah. Yeah. You can buy the >> Yeah. How easily you can buy Twitter accounts. Yeah. Yeah. Yeah. And Twitter Twitter fake accounts and bots and all of that is getting far worse. It's not getting better. Yeah. I think that it may be part of the fact that the same is happening with Google and Meta. Lots of

their revenues are coming from scams and they are making money on this. Google is making money on on scams. Meta is making money on scams. X is making money on scams. >> Yeah. So yeah like like as we as we said at the beginning um changing uh you have to pay a lot of attention when you are changing uh from social accounts or for channel of communication then they are going to tell you to move to a Slack group and send you the Slack link to add to add to the channel. The thing is that the real uh URL to join a Slack channel is the one at the bottom like

join.slack.com. They have they send you send the victim another another uh URL that was not working and that prompt a server error. And here is where where the scam gets like trickier and a bit more complicated because um when the victim tells the the scammer, hey, I'm getting this this issue. Uh they they tell they tell them uh yeah, it's an error that is happening right now. Check in this uh Reddit uh post how to fix it. and you go or even if you if you search for the server error on Google, the first uh result

that you get in Google was um a Reddit uh post telling about this error. And well, there is a whole uh Reddit post with the explanation of the error. And at the bottom, you're going to see that you have to download a driver to fix the issue with the Slack. And of course if you clone that GitHub repo and you install that uh driver you get wrecked. Yeah. So as we were saying what can we learn from this? There are thousands of ways to infect a computer. Our computers will be infected in some moment. Devs will receive fake job fake job

offerings. Uh startup founders will receive fake VCs. Investments. BDS will be invited to to fake podcasts. The amount of stuff that could happen is a lot. In fact, there was a case now in token 2049. There was a woman who approached lots of people, took photographs, made the contacts, and then one month later, all of these people were contacted by this woman. They went into Zoom calls and they were infected. We h we are not clear yet if that woman's telegram was hacked and they were then act contacting people from there or if she was part of this holy scam. Uh and as we were saying

Mac malware for Mac exists, right? So uh you should uh use an EDR and also remember there was a case like uh one month and a half ago where there was an infected game in Steam, right? I don't play but I understand that the Steam is a pretty big platform, right? And you were downloading something something from there and it had an stealer inside. So if you're into crypto first having parated software if you have parated software in your device you're simply stupid and second uh you should you should download the minimum stuff. Do not download things that you don't need.

The less you have the less apps you have the better. >> Yeah. And if if you like playing like having a dedicated device to do your work or crypto and then another one to play and do all the stuff is like really intelligent. Yeah. And here comes the most important thing from the presentation that we that I want you to to remember and to listen especially founders if we have here the buy bit hack where they got [clears throat] $1.5 billion dollar right started with this is a supposition right but started with a dev from safe being infected right so a guy a dev from safe was infected because they he

downloaded something we believe that it was through a job interview because that was not disclosed. But my my understanding is that after reading all the detail then his computer Yeah. uh was infected. They stole the cookies from Amazon web services they were able to deploy malicious code into Amazon and then by didn't check what they were signing like 99% of people do and it happened. Right? So what's important thing from here and pay attention here let's say that Bruno works with me right that he works with with me and he's in a series of job interviews and they infect him right

and they get $5,000 from his metam mask right what will he do okay I lost 5k I format my device and that's it but he will not come to me and tell me because what will he say hey pabito I was infected yesterday oh yeah how did it happen to to you. Oh, I was doing a series of interview to work to go to work to open sep right so he will feel ashamed and he will not tell me but perhaps they did not only get 5k from him but they also stole credentials from the company and now they are inside the in of the company right so what it's very very important regarding this is first of all if you're a dev or you work at some company and they offer you a job have a separate computer a separate

laptop to go into them and then know that going into interviews to work with another company when you're working at a company, it's totally fine. If this happens to you, you you must go and report it very very fast and don't feel ashamed about that. Right? Uh in fact, what I tell everybody is again it's okay to have interviews. It's okay to be infected. Someone will be infected. But the important thing is to report it. Personally for me if I know that someone is infected from from my company or some of my clients company and they do not report it I will personally make sure that that person does never ever again work in our industry right that's very very um important and to close this last

thing is uh let me go to the conclusions we will not get into this but I want to get to the conclusions from everything we We saw there are some things that I believe and no and most people do not uh agree with. Eventually we are all going to be fished. Eventually we are all going to be soldier engineered. Eventually we are all going to download malware. And if we think that everything is an scam until proven otherwise by default everything is an scam, right? That makes our way of thinking far better and it will be far more difficult to infect us and know that threat actors are closer

than we think. They work at web3 organizations right they do we have found many people that work they they have their daily job at D5 protocols at foundations etc. They go to conferences. They may be in this room and they are friendly people, right? So be ultra ultra careful. And last thing, if you're not having some false positives every now and then, you are not paranoid enough. A false positive is okay, they call me from Visa and they say, "Oh, I don't know if this is Visa."

So you hang up and you call again and yeah, it was Visa, right? So if you're not having some of those every now and then, you need to be more paranoid. Okay, thank you very much guys. [applause] Thanks the fantastic uh object team. Uh there will be around if you have questions but we have to go to the next speaker. So this morning,