You got Hacked, now What?

Transcript

I was about to say you're also very [Music] hi hi everyone I'm galsagi CEO of hyper native hypernative is an on-chain security and risk prevention platform we help protocols chains Bridges and asset managers prevent all sorts of risks I'm going to present a little bit of an unpleasant talk but it will end with an optimistic vibe so don't worry so I'm going to talk about a typer native we usually detect text and exploit in protocols before they happened so in the

last around year that the system is operating we have seen a lot of X and exploit in protocols and usually we try to help them and even if they're not a customer we try to go to their Discord Channel and and try to tell them about it that experience basically uh taught us a lot of insights about how and what to do when you get hacked and I'm going to share that with you so I think the first the first advice is to not get hacked uh I think there are various tools and products and procedure today that you can deploy where a lot of

people are not deploying yet I think that we see that audit alone is is a very important first step in the protection of the security but it's not the only thing that you should do in if we look at every industry when it comes to security security is always alert approach like you don't use one one solution you use a combination of different solution together in order to to get protected and today there are various real-time Monitoring Solutions bug bounties post-incident prevention packages and things that can help you be safe so

think about it when you deploy your security budget essentially the next thing that I wanted to speak about is uh postmodern thinking so post-modern thinking is uh essentially a method that helped me personally a lot in project management in in a lot of other areas where the idea of postmortem is that you think uh something bad is going to happen like you're imagining that something bad has happened and then you go backward and think what you could have done to essentially prevent that bad thing from happening so one example when related to hex and exploit could be

okay my protocol got hacked uh I'm trying to wake up the hacker start draining my tvl and I'm trying to wake up like seven people that are part of a multi-sig in order to pause the protocol and I can't get them awake because they are in different time zones and so on so this thinking could lead video to create maybe an emergency pause or emergency processes even the hack itself is something that you should be planning for now it's not it's not a pleasant thing to think that your protocol or project is going to get hacked but if you do this thinking uh when when everything is calm and you know what are

the things that you need to do and who are the people that you want to invite to the war room and what are the actions that you might want to do it's it's a lot easier when when something bad does happened and this is something by the way that because we gained a lot of experience in if anyone needs our help again free of charge it's something that we do voluntarily we are happy to brainstorm and think and do this plan with you so after a hack happened I think the first thing and the most important thing is to remediate the problem so identify the root cause of the hack

a lot of times there are protocols that are multi-chain and then one one protocol one chain gets act but you might want to apply or pause the other protocols at the other chains you might want to understand uh what what went wrong A lot of times we saw we work with two projects that the hacker actually left some leftovers inside the contracts after the hack so they could regain a privileged access and these are things that even if you think you are fixing something then make sure that that you audit and look at the fix very well and that nothing has changed I think the next part is usually like creating a war room essentially creating

like a channel telegram group or a slack being able to invite all the relevant people that can help you with the tech so your team members people from your security team from your audit from a real-time vendor maybe from the security of the chain maybe some famous white head hackers that can help so be able to have all of these contacts ready uh and then you can invite them to the war room and of course be careful who you are inviting there because you don't want to invite people that you don't really know another aspect that I see some projects failing is after hack has happened how

do you communicate that to your community so I think getting hacked is a stressful thing you're not feeling the best after your project got hacked and a lot of funds are stolen but you need to end there are a lot of unclarity at this point right like you you don't really know a lot of things like a lot of unknowns at this point but your community are also stressed right like their money that they invested in you is is lost they they don't know what is happening they are not in the war room so they're not getting the updates it is important again not to disclose everything because you don't know who is in the community

right now a lot of times the hacker might stay or have some Connection in your Discord or social media channel but it's still very important to like set for example what I would suggest a set like times periodic times that you say okay in two hours I can update you on the status of what's going on and um and that will keep people more predictability in this unpredictable scenario the next thing that usually uh the project will do is trying to communicate with the attacker so uh the attacker attacker mindset and

it's important to to note uh is attackers are humans as well they are stressful after they've done especially if their first time and if they are unexperienced they get a huge rush of a journaling because they just stole a lot of money they are afraid the police is going to knock on the door so it's not like their their life is all roses and flowers uh so it's important to basically leverage that mindset and try to communicate with them as soon as possible and hopefully may be negotiate a deal communication with an attacker what I would suggest is usually to create a one-time email address or a Social

account and then send them an Unchained message saying to to come back to you um you will get some spam from people that are pretending to be the attacker so it is important to do uh to verification process where essentially you ask them to do something like send some amount of money back to to a wallet address that you decide so you can understand if they do come back to you who is who is the one and of course again this process needs to be limited in the exposure because again attackers are stressed you are counting on them to do mistakes at this point and you don't want to give them any confidence on

where you are in finding them or where you are in knowing who they are the next uh the next concept is to identify the attacker and this is something that you probably should leverage and experience security vendor that knows to do that but essentially attackers when they do an attack they leave breadcrumbs after the attack and these breadcrumbs could be from social media it could be from GitHub it could be from accessing your front end or chain or wallets that they use so attackers in the end in order to do the attack had to also communicate and do things with your off-chain sources

and um and they leave of course their identity by this communication and there are methods today to essentially gather that data uh from you know before the attack and maybe a bit after the attack understand anomalies and actually try to identify and find Clues to the hacker identity this is a process that someone that knows how to do it and verify normally is known to help you with that that will increase of course the chances of you recovering the funds so again I I suggest that that you consult with someone that knows how to do that regarding so I don't know uh if a lot of

people are familiar but there are companies that are essentially sending post selling post incident packages these are incident response packages that if something goes wrong they help you with everything that is after the hack they help you with communication with law enforcement agencies they help you to do all of these steps that I mentioned about understanding the attacker tracking the stolen funds one of them is try analysis and hypernative uh partner with that packages I I think it's important that you are familiar with these vendors and that you get like learn about their offering and

and what they provide foreign I think another another aspect that I see sometimes people missing that I think is important in the end your community is your project these are people that uh put their money in your projects and I think um I see a lot of times people that don't like communicate well about the incident don't give the right answers so be be mindful of how you communicate the situation and really understand that again they are as damaged uh maybe not as you but they are also damaged and

they also uh you you work to gain their trust in this process that you're doing the right things so I I want I want to end with some optimistic slide so this is this is a research that we have done at hypernative where the idea of the research was to find if there is something to do like there are a lot of hacks as you know like every week we hear about the new incident and we really wanted to figure out if there is a way to understand signals of an attack like finding an attacker in a

high accuracy manner minutes before the first tech transaction and I think that what we found which was very interesting that this is actually very doable if you look historically and we looked years before on ethereum at least and we found out that around 98 of the hexane exploit that happened in the last year could have been detected several minutes before the first tech transaction and what this means is if these projects had the capabilities and the preventive measures that could have been triggered these detections could be connected to them and the heck could have actually prevented so I think we should all

um you know be familiar with these Solutions and and explore them as well thank you [Applause] any questions hi uh um when you talk about leftovers from the attacker could you give some examples of what those are yes so so think so think about when an attacker write like do an attack on a protocol they need to investigate it so one example could be is that they clone the GitHub repo of of the project now think

about cloning a GitHub repo it has and again I'm giving an example and there are many other examples cloning a project usually from a development process is something that is very right like steady you can see like the developers they're cloning the project they are pushing so you'll see a set of ips right that are doing this action where you'll see a subset of ips and locations that are anomalous in this uh Behavior so the idea of of detecting an attacker is basically right like limiting with all the data that we have all the data points the IP and basically trying to find some clue IP of a user is essentially something that is mostly

good enough to try to locate the location and and hopefully with the law enforcement help get get the identity of that person so that's that's one example we are all the time thank you maybe after you yeah sure no problem no it's okay it's okay foreign