How to Find Attackers and Improve Your Security Posture

Transcript

hey guys can you guys hear me okay awesome well today I get to talk about the lovely topic that jannis just kind of uh mentioned which is what do you do when your protocol gets hacked and suddenly all of your friends are gone usually the immediate question is is well how do you fix your protocol but the next question is is oh no we have no money we need to do something about that now this presentation is actually kind of fun and by the way this is some information about me while I talk because I only have 10 minutes but this presentation is kind of fun because this is also geared towards improving your security posture as well so all of the tidbits that I'm providing to you are also tidbits that you shouldn't just be thinking about your protocol but also

how you can maybe better secure yourself down the line so our goal today is to find who the bad guy is and on our agenda we only have three different items those are doing contract analysis funds tracing analysis and ENT or open source intelligence analysis we're basically playing detective so let's talk about contract analysis now I'm in a room full of Auditors right now I'm not going to be giving you guys the whole Spiel of what contract analysis is you guys know that better than me but there's a lot of interesting stuff you can do when looking at attackers who deploy smart contracts on chain particularly TR in terms of tracking funds so look at who's funding that deployer right where is the

attacker actually cashing out those things can tell you a lot about who this person person might be especially what times that they're transacting at another thing though that you know I know a lot of you think about from time to time as Auditors but we as security researchers look a lot into which is actually looking at forbite analysis right taking a look at those Forbes those functions that these attackers are using and seeing where are they being reused right same thing with storage slots and there's a lot more here and we don't have time for it unfortunately but instead I'm going to spend a lot of time on case studies today because I think within this bit of time it's the best way to use it so we know that earlier this year wiir hack wiir X was hacked for about $240 million and this was due

to a multi- exploit uh upgrade involving um a sorry involving a malicious contract upgrade right now we know the source of funds for the particular attacker who was doing that contract upgrade those originated from tornado cach classic but if we were to do four B analysis on this particular attacker and their their particular uh initial contract that they deployed we'd see here that they're using the specific forbite in that contract and lo and behold if we look one day prior these guys were deploying a contract from a separate address entirely right an address that had nothing to do with this

initial attack but using those exact four bites some of you guys might say oh Heidi well this looks like a very simplistic function like maybe this was reused copy pasted no there were a lot of other examples of how this stuff overlapped now interestingly enough that deployer address that deployed that contract on um July 9th so the one that we think might also be the attackers it actually sent funds to tornado cash that same day so hm interesting so maybe the funds came from this testing address and then was sent on to the actual deployer who deployed the malicious contract but we'll get back to that in just a second because we also want to talk about funds tracing analysis now investigations can

be hampered by a lot of different things that I would like to call anonymizers so to speak so that that can be mixers like in the case of tornado cach Bridges as well increasingly um as they become more and more complex centralized entities and services as well as new services that come on chain time and time again I have found that new attackers like to leverage new Services because it's difficult for investigators to actually Trace through them to figure out where the funds are flowing to it's an obvious one right but there are of course workarounds let's take that Wier X case again right in this case right we know the source of funds originated from tornado cash and if we were to do a very quick analysis using Dune analytics taking a look at all of the different

addresses that had both deposited deposited into that 0.1 eth contract and both withdrew around that same time period you'd find something interesting you'd find that this address here that was the address the one that deposited 0.6 eth into it that was the address that deployed that contract on July 9th the one that we thought was the testing contract and we can see then down the line couple hours later that address that actually conducted the actual hack on Wier X received then 05 eth and actually down the line another address of theirs receed 0.1 e as well so it's very easy to match up you know the uh deposits and withdrawals from tornado cach in this particular case but it's

fuzzy right we can't for 100% sure say that it is indeed the attacker or not but the four by analysis is at least a little bit more solid on that front so now let's talk about my favorite section which is the ENT analysis portion whoop not bad people don't realize how many Clues they leave offchain so my big you know takeaway for today should be find any web 3 to web two connection you yourselves have you don't even realize it right any profile picture you reuse and recycle maybe you want to have your profile picture recycled on your ens and on your Twitter but maybe you also don't when you're deploying a new contract for one of your projects right

nfts obviously are amazing but another thing that a lot of people don't think about is po apps poops really tell a lot about who you are so if you collect any of those just be worry of where you're saving those um um they're also useful obviously when you're looking into attackers as well um ens handles that's an obvious one but there's also a lot of other data crumbs left behind and now I'm gonna go go into a really fun case study if I can click next um that involves a defi protocol um that paid out a very small amount of test funds to a developer to use and this was back in February of this year this poor unfortunate defi protocol got

wrecked um last month due to a private key compromise the key suspect is dprk unfortunately okay we've kind of heard this story over and over again so what gives well there are a couple of things that went on with this Dev that were really suspicious so first off this Dev really liked to use profanity addresses I'm not hating on profanity here it was just an interesting Insight because it made me realize wait a second it was easy to find some of his other addresses he then sent some of those test plans that he had received from that D5 protocol to another address and that address connected to several others then when you looked at those several others you'd find that he had

created several different ens handles over the years some of which actually linked to Dow exploits that happened one of them for example was yam Finance back in 2020 so this dude's been around for a really long time and then the icing on the cake was that he he had sent some funds directly to an oact address um that was related to dprk and it was not an exchange address it was an address that had only ever received 20 transactions so this thing like it was dunzo like at this point it was clear that this poor protocol had at least one person working for them that was dprk which was pretty concerning so we've got some takeaways here though from today so first and

foremost attackers are early adopters so it makes sense to always keep learning you you too should also keep learning because I'm sure you'll find some good Alpha there too attackers are very fun to learn from there are numerous free tools online that exist some of which that I showcased today in the presentation because I wanted you know I I wanted to use stuff that everyone has access to and last but certainly not least um is you want to combine all of your research methods so in a lot of the case studies that I used a lot of a lot of the an analytics kind of overlapped right funds tracking ENT as well as contract analysis and with that uh thank you and uh yeah [Applause]