Introduction to SEAL

Transcript

hello everyone welcome back um so next we are going to have someone that probably doesn't need an introduction it's Sam Sam is going to be talking about um an introduction to seal she was in the main frame check the

computer check check the computer the main frame computer I access the main frame acoin is more of a fiat currency but it can convert it can be converted into crypto quadria CX which is Canada's largest Bitcoin exchange you can access the main frame by remote I hacked into the main frame at the bank the main frame I can't find a Canadian server I've got to break into the main frame I sent an engineer to check the main frame it's like they dumped their entire main frame onto our facts and into our computer cross check fat bastard's profile with the main frame at Lang um I you know from the FTX finances perspective we had infrastructure but from the customer risk and finances perspective

month they're calling at the Roman half spell r o n i n system that would take some sort of super Mainframe computer so the market cap is 2.68 trillion dollar and now the mar oh oh it went to zero top fight 100x L cryptocurrencies could make you a million they've only up the main frame cou jeez in the main frame KN used to tap into red star's main frame Anita yeah you're going to run that against the main frame for me okay check the computer the main frame computer I access the main frame check the computer the main frame computer God

damn it you're in the main frame hello I'm excited to open session two of DSs on behalf of SE by talking to you about how to secure the future of crypto but first a quick introduction for those who don't know me yet I have been a research partner at Paradigm for over four years now and I found at SEO over two years ago I've also been a security researcher for my entire life so what exactly is Seal well seal stands for the security lines we're a nonprofit organization whose mission is to secure the future of crypto we do Lister various initiatives some what you might have heard of and some of which

you'll be hearing more about after me so how exactly do you secure the future of crypto well I think it's a three- step process one identify a problem that's affecting crypto security two come up with a solution to the problem and three implement it now you might think that the hardest step is to come up with the solution to the problem however I would argue that the hardest step is actually to implement it after all you might think of a solution that's blindingly obvious so obvious that all it needs is someone to do it but that's the hard part you need to convince other people that your solution is the right one you need to

convince them to work with you on the solution and then you possibly need to convince some rest of the community to adopt Your solution AIO we this process a lot of times while implementing various initiatives and so I wanted to go through one example with you to show you how we at se secure the feature of crypto and also to give you some ideas on how you might be able to work with us in the future if you have a solution in mind affecting a problem that you see let's talk about living in the wild west what I mean by that is crypto security back in 2018 back then security best practices weren't really as well defined and and projects were being launched every other day although these projects were not

quite as big as the projects we know and love today rather these were much smaller maybe one or two contracts there are also various small communities of security researchers working to try to further best practices the best they can for example he might have heard of the white hat Group which was responsible for rescuing the Dell or the eat security telegram Channel back then eat security was a small private Channel where you had to actually apply to get it now back then the way the security scene worked is that there were a few individuals in the community which acted as trusted points of contact this means that most of the time if you had a security question or a security incident you and end up reaching out one of these

people I found myself serving in this role so did a few others like Zack xbt now obviously in such a system it's very easy for these individuals to get very overwhelmed and obviously this is a problem additionally these Community spaces were growing larger and becoming more accessible which is really good for welcoming more people into the space but it's really bad for keeping confidential information in a close loop at some point we were actually really concerned is it possible that there were bad actors lurking the shadows in these group chats waiting for people to post something like hey does anyone have a contact at some protocol at which point

they would know that they have about 30 to 60 Minutes to find a bug in that protocol before the white hats could get there in time so we were also facing a second problem how do we quickly coordinate or announce sensitive information that we didn't want to make public right away I actually ended up writing a design doc about several issues this being one F back in 2022 uh although at the time I called it the rapid response Group which isn't quite as catchy you can see the framework Reserve though the thought process of the fact that there are so many people who are these individual nodes in the security ecosystem but while every individual node has a broad

network not every node has the same network and so if everyone was in the same group operating together then that Network could be much more complete and response times would be much lower however the reason this never got implemented is because there were some very obvious problems for example does everyone actually agree that this is a problem and does everyone actually agree with the solution and if people do well where is the activation energy to get people on board and how do we quickly build momentum so that progress doesn't stall then one day there was a perfect opportunity and by the perfect opportunity I'm referring to the Viper

zero day which caused Ry locks to be totally ineffective now there aren't many projects out there that use Viper today but one of the big ones is curve and because the Ry locks coming bypassed this meant that the curve pools could be drained and sure enough a few attackers drained multiple curve pools for over $50 million at the time as the incident unfolded the security Community created multiple War rooms to try to in triage the incident these groups all worked on root causing the incident at the exact same time and these groups were all trying to contact curve and D projects at the exact same time needless to say this entire situation was extremely disorganized and chaotic and although by the end we had

all Consolidated into one place the process had still left much to be desired in fact I was talking about this very situation after the incident with a white hat named P kacho when I realized that this was very similar to the rapid response group idea that I had come up with just a few months earlier and so I shared the idea with him and he agreed that it seemed like something thing that we should trust and so I gathered a group of 40 people that I trusted put them on a group chat and within the within a few hours we had the beginnings of what with later become c91 within a few days we were ready with the bot and we announced a project to the

world so what does product Market fit look like well today still 911 has handled over 12200 tickets and we resisted in numerous critical incidents including the attack on radiant Capital numerous Twitter account takeovers and too many malware INF fishing victims to count one incident I'm particularly proud of how we handled was the tapioka social engineering attack we created a war room and rot caused the issue within minutes and finally were able to recover over 700,000 us before the attacker was once able to take it we're also setting best practices for war rooms and creating dedicated hot lines to to communicate with large

projects and chains in the event of an emergency overall we're optimizing the in response process so that what happened with curve doesn't happen again it's worth noting that the reason this worked is because of the curve incident after all due to the curve incident everyone could see exactly what the problem was and everyone could agree that the solution had a chance of working the incident itself also served as Catalyst energizing people to put solution in place very quickly finally a very loud and pollet launch helped drastically improve the chances of this project working out but just catching lightning about a once isn't good

enough Our Hope with SE is that we can make this process repeatable we hope that thiro you can quickly gut check your solution with the community to see if others are interested in it we hope that se will also serve as activation energy for people to start working on your initiative knowing that It ultimately has a good chance of success finally we hope that seal itself can help promote the initiative to the rest of the ecosystem presenting it through a better lens than if it were just a solo project ultimately we hope that through seal we can take this three step process and make the hardest step not about implementing it but about coming up with a solution

instead thanks for listening if you want to learn more about seal feel free to visit our website or our Discord server or just message me directly