New Web3 Security Paradigm: Detecting an Attacker and Not a Vulnerability

Transcript

thank you for waiting with us our next speaker is gal Sagi and is going to talk about attack and detecting an attacker and not vulnerabilities and and this uh hi everyone I see the crowd has decreased a bit but thank you I appreciate the staying staying late for me thank you thank you [Applause] um so I'm going to talk about how to detect hex and exploit by detecting the attacker as opposed to detecting vulnerability so um I think the the general assumption

and again this is a room that has I guess many audit companies as well but uh I think that we've come to realize that audit is super important like it's the first important step when we are protecting a project but it's just not enough it's just not enough and there are reasons why audit is not enough first in the last few weeks I've been talking with many many projects that are essentially delaying their launch date because they're waiting to get audit which is again in an industry that wants to maybe move a bit fast that's that's limiting I think there are some server use cases or attack vectors

that audit doesn't cover today like one of them is how can you verify that the bytecode that's actually deployed on chain is actually the one that was audited there was one simple one very famous hack called saddle Finance where the team used an exploitable library and they exploited on another project it was a Fork Library and they actually got notified about it they fixed the code but when they deployed they forgot to change the proxy pointer so their own chain so the audit was good right like they fixed the code but when they deployed they were still calling the exploitable code

there are other like private key tests there are other dependencies that are not necessarily but audited by you so we need we need something more than just an audit and I talked a bit about it in in the panel uh today earlier security when you look at any other industry security is usually a lured approach you don't just take one solution but you take a variety of solution and you need to think about it when you of course when you allocate budgets but you need to think about security as an holistic holistic thing that uses layers and different solutions it could be using more than one vendor

it could be using a bug Bounty it could use real-time monitoring system and the focus if if I take for example Cloud security for for an instance is the assumption is that there is uh you are going to get attacked you are going to get hacked and a lot of the focus and the budgets in Cloud security for example are around how do I eliminate the blast radios and how do I detect the attack as soon as possible in order to mitigate the risk and what we what we try to do is how do I get like how do I what is the equivalent of that thinking in web tree

and the thing that that we started thinking about was that if we take all the blockchains and all the bridges that are connecting them and we treat that as one big infrastructure and then all the the apps and the protocols that are deployed on top of this uh infrastructure can we find signals that will indicate to us that there is an attack going to come before there is a big impact uh on the on the protocol and we try to we try to investigate and understand if this is a correct assumption and I think that the results that that we found are were very promising because we found

there are tens of different signals that can essentially detect and attack before it happens and hopefully prevent it and one of these examples of these vectors and these vectors could be from on-chain data they could be from off-chain data but one of these examples that is um maybe less proprietary and more common today when you're talking with with monitoring companies is basically detecting a lot of their texts are happening when the attacker deploy a smart contract and that smart contract is actually the attack code and there is a gap today between the deployment of that contract and they actually trigger

of the attack and there are reasons by the way why there is this Gap I'll not get into it but when you when you try to classify and find the text like that you're essentially we're essentially using the the benefit of blockchains that are transparent like all the code is transparent all the interactions between the participants and the code is transparent but it's it's a very challenging uh thing to to do to find an attack because there is some contradiction about what we are essentially trying to do right

when you think about it we are essentially trying to find an attack before we actually understand what is the vulnerability that that attack is going to to do and what we are trying to do is we are trying to be as wide as possible on our detection right like we're trying to detect as many different attacks with all sorts of types and attackers and methods of attacks but on the other hand we are trying to be very narrow on the accuracy right like we want to uh decrease the false positive of saying there is an attack when there isn't one and one of the examples um the demonstrated for for uh the for

the case that I just mentioned about smart contract that are doing attacks is you could have thought about looking at the source of funding of a smart contract as an indication of how malicious that contract is and is this something that is going to deploy an attack and if you would have done that you would actually uh do something that is not optimal it's not optimal on two on two areas first you would actually overfit and it doesn't matter if it's a model or it's a rule-based system you'd overfit and give too much weight to this parameter right like and what will happen is that you'll

miss a lot of attacks that are not actually happening with this method because there are attacks the RX and XY just last week I think Arcadia Finance around half million dollars was stolen was a heck that wasn't funded by tornado cash so you're losing and you're not detecting as wide as you want and on the other hand you are essentially creating a lot of false positive to the system because and this is debatable or not if uh contracts that are funded by tornado cash are legitimate or not but not all of them are or maybe a lot of them are not actually doing an attacks right so if you want to connect

um these two automated processes you again there are a lot of cases that you don't really want to trigger that automated process so I think that's that's a demonstration of why why doing this finding as wide as possible and being as accurate as possible is not a very easy uh challenge and a diaper native we wanted to really understand if this and again this is just one example of a signal but there are a lot of other types of signals that are essentially indicating about an attack and we wanted to to test and see if this assumption is

correct by understanding if most of the attacks and exploits as it is today could be detected uh before before they trigger and I think the interesting thing that that we found and we ran historically like we ran all the transaction on ethereum uh since Genesis essentially through the system without actually knowing past uh information and we found out that around 98 of the hex and exploit that happened uh historically could have been detected at least several minutes before the first tech transaction so very promising results and of course if there are the the right prevention methods we could have applied them in

this case so I think I don't have enough time so thank you thank you foreign