The Imperative of Security in dApps: Protecting the Decentralized Ecosystem

Transcript

[Music] um hi everybody um thank you very much um my name is Steen aay I'm the technical lead for the da a the team attacking um I have about 10 years of experience in offensive and defensive security uh with a more focus on the offensive side of security um in the past I've engaged U governmental Paratus on Forensic engagement and also WR engagement with the police force uh in the spare time I write enjoying script to poke around the blockchain I also write a fictional content I share with my family and friends all right so um the primary objective of this talk is

to remind us of the importance of adopting proactive security approaches in we TR security as we are building in the space um so before we dive in I would like to tell you a little bit about uh our company um at aing with global cyber security company dedicated to helpy organization carry out um security audits So like um D app audits smart contract audits layer one audit and so on uh we pride ourself as um the security bodies um to our client um making sure that uh your security auditing process is actually seamless by becoming part of your project and ensuring that there's no master key that can break your lock so to keep our client safe and sound we offer range of

platform like the Akin do iio which is our main website where you can find the portfolio of all the services we render then the acing proof which is our B Bounty platform uh the c. live our security rating platform extractor our smart contract monitoring and incident response platform then the Akin herei which is our native token so let's dive in um so just like um web2 Technologies uh web Tre is not a standalone component as we know it um it has different layer with each um having their own advantages and disadvantages but uh most time when we talk about uh web three security uh we mainly focus on the smart contract security which is

actually part of the application layer but there's also other layer like the data layer application layer Network layer and so on so no layer in the blockchain is actually immune to security issues in other words um all layers can actually be hacked uh for example the infrastructure layer uh is the home to Virtual Machin um services uh messages and much more whether you're hosting it in on premise or in the cloud so this layer runs on operating system like your Linux and windows which is prone to zero days vulnerability plus we also have to watch out for denial service attack that can crash your system uh due to Resource overload there's also the application layer and this is where you interact your smart

contract um your API your wall your Bridges and so on and this is actually the easiest and the most common Target because um it is directly accessible to users an attacker and issues range from Smart contract vulnerability uh to fishing attack to access control issue so because web3 still relies heavily on web 2 uh so it also inherits uh web 2 security issues like the O top 10 for mobile uh web application API and so on so each of these layer have their own unique security challenges uh even with the numerous um Security benefits uh the blockchain is bringing to us because um human are in charge of all these layers and humans still remain the greatest

threat to security so no matter how secure the ecosystem is um it security is still dependent on the mindset of the architect so some people might have the idea that since blockchain is running uh since your application is running on the blockchain it's 100% safe right uh but we need to debunk this me so um okay all right so it's actually a common belief that uh blockchain is imperious to attack by Natures um yes blockchain does off security features like uh the decentralization but it is not immune uh to security vulnerabilities in fact the decentralized structure actually

introduced new uh challenges for example let's say a majority of node in your ecosystem is being compromised uh the entire system Integrity can also be at risk so there's also the concern about the flow C in the underlying code that's a smart contract or the protocol which can be exploited by attackers so another core promise of the blockchain is that um of its immutability which means that once data is recorded it cannot be altered uh but this feature can also be a downside insecurity I mean if there's a vulnerability in the smart contract an attacker can uh device exploits to uh exploit this vulnerability they could

cut away with millions of dollars so and the Damage cannot be undone and this is why um Toral auditing and secure code practices is actually crucial before you deploy uh to the main net another contrary belief is that um the blockchain is a wild way where we can do any how we like but um the blockchain is not actually a lawless Frontier in fact in Defi and some lending protocol they are robust Regulatory Compliance Mech that is been built into the technology uh users are subjected to know your customer an anti money laundry protocol when you're reg registering from some of this application so and this ensure that uh your transaction are transparent and audit table and it's also providing like

a comprehensive audit Trail for the application so now blockchain we already know that it holds a immense potentials it's also crucial for us to understand its limitation and also the vulnerability now that we have de B this meet um I think is fair we look at the current strength landscape in the web Tre ecosystem so uh in the web Tre the focal point for cyber crime right now uh and threat is magnified due to the inherent transparency and the interconnectedness of blockchain Technologies just like an attacker can look for security vulnerability is in application an external network asset in web three Define flaws in smart contract

and once a vulnerability is being identified in smart contract attacker can ctiv Millions right then uh there's also the issue of social social engineering attack uh is actually a concern across all cyber domain uh it's not just blockchain but in web 3 U the taxes have actually evolved because of the financial incentive uh behind uh smart contract and blockchain as a whole so attaka frequently use social media platform to manipulate uh the market sentiment or trick user into revealing their private keys right then um there's also the issue of um Insider threat in the decentralized environment just like the centralized environment when the

threat actor can be like a malicious Insider feeding external thread actor information about your system about your application in web three internal threats can be um it can R from the project founder to developers even governance token holders that have um influence over a project Direction so um these insiders can actually exploit their assets for personal gain affecting not only a single organization but the entire ecosystem linked via Smart contract and Shar protocol there's also the issue of denial service attack um which is also um relevant in web 2 but also in web 3 because uh denial of service attack um

can be directed to key infrastructure node that running for example public blockchain access point or decentralized Finance platform and this attack are him to disrupt Services uh manipulate Market position or erode trust in the platform stability then uh the whole concept of blockchain has to do with interconnected protocol and the integration of multiple protocols increase systemic risk so a vulnerability in one protocol can have like a KnockOn effect on another so especially in defi space whereby protocol are often uh considerably linked so um there's also the human error echoing the broader cyber security Trend and humans remain a significant

risk factor in the web3 space right uh according to several reports uh a substantial percentage of security breaches are due to user mistakes um such as uh mistakes in smart contracts misconfiguration infrastructure your wallet or failure to securely manage your private keys and so on right and this actually underscores the need for user education and the need for us for builders in the web tree space to build fullprof system design in decentralized application now if this gets you thinking how secure am I then um I think your head is in the right space um the Strategic approach will be to start raing your current security level right on a scale of 1 to 10 where is my

organization heart I tell you knowing that it's a one is absolutely fine but zero can be disastrous so you want to start by assessing your current security practices and against the industry best practices like maybe the CIS Benchmark and this is going to give you like a visuals uh of the Gap that is present in your estate so with this knowledge at hand you can then determine and plan actionable step to close them so one of the ways organization do assess their security uh posture is by carrying out security audit so and that is actually the traditional approach right it involve conducting security audits like uh maybe dap audit smart contract audit and so on uh which is going to actually look for

uh potential security issues in your application so this typically this strategy actually involve you uh either using your internal team or an external security company like hacking while um the usage of internal team is actually it can be effective sometimes but is crucial to engage an external auditor who offers a fresh perspective uh similar to how an attacker is going to view your organization is going to view and test your application because I mean um attaka have all the time in the whole world and they have U um several tools they can use to test your application that you might not have internally but um external Auditors also have so utilizing both uh automated and manual approach uh to look for security is

actually a way to go by conducting your security audit via external auditor so while this approach is actually great um but given the complex of uh the evolving threat in the web tree space it's actually essential for us to rethink our security approach right because there are new Improvement in the space every day and given the diverse of sophicated threat and smart contract vulnerabilities just in the early hour of today uh Vel call costant product smart contract get got hacked for I think about $10 million so there's always Rising several security issues like um there's also the issue of soci engineering attack and attacker come up with really great pretext to actually

exploit you us so as organization developers and security uh teams we need to adopt proactive approach to stay ahead of our security game and to beat an attacker you have to actually think like an attacker and you have to even think more than an attacker so there's a need for Innovative approach so to your amusement one of the Innovative approach we can actually adopt is the AUM breid approach and it encourages organization to actively simulate attack through red teaming exercise and purp team exercise to test not just your defenses but the effectiveness of your incident response strategy so this is similar to like carrying out a fire drill uh it's is not only about just testing your your

defenses right it's making sure that you're ready whenever a security breach actually occurs so it's making sure that the organization response is very Swift effective and well practiced then uh another thing is um every organization actually require a log management system that is going to like um give you real time insight into your organization it's going to give you like a comprehensive view of your organization right um the extractor is a Arin web tree scam uh that provide continuous smart contract monitoring correlated with user behavioral activities that is going to give your organization uh A View to dictate and respond to anomalies before they evolve into full-blown Brides so in assuming this um in adopting this assume

Bridge Approach you are not just cultivating the security centry culture but you're Shifting the organization mindset from when from if a bridge is actually going to happen to when uh the bridge actually happens so this is this is actually going to in turn Foster continuous Improvement in security practices and uh and your approach so yeah another approach is actually the zero trust approach um this approach is actually initially developed by Foresta and pivot on a single principle never trust always verify right the concept behind this um zero trust approach is that at every point you need multiple layers of security serious

authentication and also Access Control mechanism has to be implemented but before you can secure your data um the first thing you need to do is um you need to identify and classify your data right you need to know what your data is and where they are right in web Tre this uh might involve understanding what pieces of data actually um critical to your organization then you apply classification to them based on their importance and sensitivity then uh the next thing need to actually carry out um data mapping uh this might involve uh various te organization like your network Engineers or your application developer which can give you like a comprehensive view of how data flows in your network this is going to help you identify those

critical data points uh that can become vulnerable and then you can apply stringent access control on them then up next uh you need to design your network with uh strict policies right you can't be running a flat Network right so in web3 this might means that you're setting up um some private blockchain environment or specific nodes right with enhanced um security mechanism um zero trust approach is all about U multiple layers of security stringent access control that should only be granted based on explicit needs this means that you are setting up policies that is going to determine would can access what and under what under what condition um there's also the

continuous monitoring actually I canot overemphasize the importance of log Management in web tree because um you need something that is going to give you like real time surveillance uh to dictate and respond to anomalies as they occur in web Tre space um there are a lot of strategies actually uh this is an open invitation if you want to learn more about uh these strategies uh there are more specific speciic Advanced strategies that can be tored to your approach based on the kind of application you have internally and based on your environment kind of environment you're running so um next thing I'm going to be talking about uh uh metamask nap just briefly um this is just like an add-on

presentation based on the security research we carried out on metamask Snap so as the great philosopher in Spiderman Uncle Ben once said uh with great power comes great responsibility I say with new technology comes new risk so metamask are extension that enhance uh metamask Na are extension that enhance the metamask functionality so they allow you to carry out custom operation within the wallet through the isolated JavaScript environment so uh they allow you like enable interaction with different blockchain network uh expanding the metamask RPC API and this is achieved using the secure ecmascript which is the isolated JavaScript environment in your

browser so um the snap has um three layers of security um the first one is the isolated layer which make sure that your snap actually operat within a confined area within a virtual space and this prevents the snap from interfering with other snap because you can have more than one snap connected to your metam Marx wallet um then there's the lava mode uh which is actually another security uh feature that is designed to um to protect against um supply chain attack right and um for example uh in an instance where malicious code is been inserted into trusted component it controls what the code can actually do uh so that it won't be able to carry out unauthorized action to any network

request or unauthorized action to your private Keys then um the last layer is the secure Mark script uh which further tightens the security of your metamask snap then uh it has three uh main features uh the lock down with freezes uh jav script object to prevent tampering then the compartment we make sure that your metam mark is not functioning Beyond its own virtual space then there's also the endowment that provide control resources that is tailored to each uh snap's need so the security feature actually work hand in hand to provide a robust security framework for metamask snap and make sure that um the uh snap is actually reliable within your metam Marx wallet

so um there are different type of metamask snap um there's the appap snap which is integrated with metamask to provide AI protection against cryptos scam it also does some sort of um monitoring and alting then uh there's also the multix snap which is an add-on uh to metamask that help you import the Multiverse X wallet into your metamask so that you can use it to carry out transactions so um even though the metamask has their own unique uh security layers uh most times mistake happens in development and security audit is actually crucial and for you to even be able to integrate your snap to metam mask you have to carry out a security audit so and there's there has

been a lot of security concern that's been reported by prominent um audit companies like hacking and this is actually due to um mistakes actually made by developer during development so one of them is um this check Su on the Integrity on the mind uh so this is um the cryptography check is just like a digital F fingerprint for your file it help make sure that the file has not be tampered with so if an attacker change this fingerprint without being noticed they can had bad code into it and you would not even know that uh the code has been added so another issue is the uh snap execution timeout uh for example if um the snap takes too long to do their

job sometimes they can hug the computer network resources and might slow down your computer and might even cause like little Deni service in the browser then there's uh the issue of flaw in uh sandbox security uh sandbox is the safe space where your metamask snap is actually functioning so if there's a problem with this sandbox uh bad actor can actually break out of it and access critical functions which you don't definitely don't want to happen then um there's the issue of inconsistent user verification process that has to do with authentication and authorization flaws um if these authentication and authorization fla um processes are not done properly attacker can actually use them to gain access to your private keys

and maybe control other sensitive uh information so and a way to dictate uh this is just some of the issues um there are lots more and the way to detect them is actually by carrying out a security audit before or by making sure that the snap you're integrating into your metamask snap is actually audited uh before you you're using them then um another important thing we need to know about metal mnap is um it's everything about metam mnap is all about permission right so um as a user whenever you want to integrate any snap into your metam mark uh wallet you need to make sure that uh you check the kind of permission that has been given to that metam Mark snap right uh there are some permission

like Snap get viip 44 entropy and snap G VIP 32 entropy which can give um for example if there's a malicious that's using this permission and you integrate them to your metamask wallet uh they can give um the metamask uh snap ability to R retrieve your keyp and your private keys so and definitely it's going to lead to lot of funds um and another permission you need to look at is um the endowment transaction Insight right and um this is just giving this is going to give a malicious um snap insight into transaction before approval and this is going to like result in a front running attack so um this permission actually

actually um not be granted unless they absolutely necessary for the snap to function properly so to enhance security uh as developers you need to make sure that um the snap uh the permission you're giving to your snap via the snap. manifest.json file is actually needed and if they are not necessary there's no point using it and as users you need to make sure that you check this snaps permission to make sure that they absolutely required by the um extension um or else you're going to be introducing security vulnerabilities into your metamask wallet um so uh for more information about uh metamask snap um there's a link on the uh slide uh which has to do with our hacking uh snap

security research and also the link to metamask uh security guidelines and a Blog and I love so much about metamask nap uh by Bruno no and key all right so um no matter how minute or um tiny the technology is they come with their own security uh unique vulnerabilities and we need to remember that um security is not a one-time thing and we need to adopt proactive approach towards security and continuously monitor our asset to stay ahead of the attacker so having this in mind is going to increase our security appetite and forer continuous security within our organization so we need to stay vigilant and stay ready so for a comprehensive

audit uh if you're looking at introducing proactive approaches based on your organization or based on the assets you have online you can reach out to us via our website and Via our socials thank you for your attention all right um do we have any question okay yeah thank you uh I wonder if there is a tool for monitoring smart contracts can you suggest some yes um there's a tool um extractor extractor is a tool that gives you real time insight into your

smart contract uh maybe the critical functions and also respond to incident on the go so yeah there are others like um f and so on but um atak we have our own to which is the extractor all right thank you very much [Music] [Applause] [Music]