The One Click

Transcript

Thank you. >> Hello everyone and thank you for joining my talk. Uh today we're going to talk about many many different types of threats. Um if you're here is it means you care about security which is very good. Um they are our ecosystem is full of scammers but I'm pretty sure that all together we can get somewhere and make the ecosystem safer. Um my talk is named the one click because unfortunately no matter how good your security is, how much you spend uh to improve your security one single click can sometimes have catastrophic consequences.

So my name is Louie. I lead the operations at OBSE. I have a web two security background and I came around web3 security when I discovered uh Sherlock and other competitive platforms. I wasn't a big f a big fan of auditing smart contracts and in the meantime I was finding out that many web 3 companies were having poor web two security. That's why I knew I could bring my expertise and help the the ecosystem. Uh I went to my to my first defi security summit in 2023 and it's funny because um back then many people told me you should come to web3 security. So at OPSSE what do we do? We audit and train web3 organization and high net worth individuals for them to not get hacked.

We do not uh audit smart contracts. We focus on all the other attack surface in order to cover everything. So here's the bad news. Um nowadays 99% of the money stolen is due to uh poor operational security and I think this is where uh our focus should be and out of this we had unfortunate events this year um the safe what happened with by bit and we need to we need to know that there is everything that we don't know about every week every day individuals and organizations sometimes are getting hacked and they don't share their stories So why um operational security is very

important? As I said, most of the money stolen nowadays is due to poor operational security. Our focus and why are we doing this is because we need to protect digital assets and infrastructure. Um we also need to secure accounts, devices and people. people because nowadays social engineering is very trendy and hackers try to break into people rather than trying to break into systems or breaking pieces of code. It's very important to map and prevent all sort of attacks. You really need to anticipate and imagine what what can go wrong by taking into account everything.

We're going to talk later on in the slides about supply chain attacks, but also you need to consider u attack vectors such as what if you have an insider inside of your company. Um having proper procedures for sensitive operations is also very very important. U from financial operations to even offboarding people. This is very important. And you need to master your incident response plan. By mastering your incident response plan, you're already working on what am I going to do if a hack happened. You need to be ready and this is a very good way.

I I truly believe that we need to switch our mindset and it's a good way to improve our security and instead of thinking okay am I going to be targeted we all work in web three we are all a target we're going to be targeted by different ways of course but by thinking when will I have an incident you're already putting some time and effort and working on your on your security so yeah I hear this all the time security can be expensive uh you will have to pay for security audits, you'll have to pay for EDRs, certifications, uh you will need to do war games and even more. But do you really think security is expensive?

What about an incident? Think about what's the cost of an incident. And there is the cost that is uh financial. Of course, it's going to cost you u millions. But imagine about your reputation. How about all the users, everyone, all the clients that are trusting you? It's going to be very hard to get to to gain their trust again. So, we are trying our best. Uh we are using trying to to reach uh high security standards. We're using EDRs uh to do some dynamic analysis on our machines. We're using firewalls to try to block the excfiltration of data on our machine. We want to make sure uh our discan data is encrypted. If anyone

steals our laptop, they won't be able to access anything. Um please use 2FA with UB keys. They're amazing fishing resistant and also we use hardware wallet. But the issue is the weakest link of all these layers is the human factor. Uh the weakest link is between the chair and the screen. And why? Because we are all targeted by social engineering. Social engineering is the way to manipulate people in order to gain trust. And in our ecosystem, people want to build trust. And their final goal is for you to download malicious piece of software that will end up stealing your keys.

And so social engineering is not new. It always existed. It exists in many different forms. uh you can have fishing, smishing, uh spare fishing and most of the time all of them are combined in order to gain trust. As I said, one click can have catastrophic consequences. Um what is important to take into account is that too much security and complexity equals zero security. And sometimes you want to keep things simple and stupid. And that's why you want to use the keys principles. Keep it simple and stupid.

Actually, um, having a high sensitive password of accounts or private keys or seat phrases on a piece of paper is safer than have it some than having it somewhere somewhere digitally. So in the end, what is really our security? Our security is a mix of our stack, everything that we are trusting, all the pieces of software and our actions. Basically, our actions is where we click. I think we can improve our awareness um and our actions by reading out all the recent hacks that have happened, all the people that went through fake job interviews, etc.

Um and by doing that you are spending time on your security. You you're leveling up your awareness and you can also share it with your colleague and your friends so they don't so they don't fail for for the same. And now about your stack there is something that is very dangerous. It's supply chain attacks. So we are all trusting different pieces of softwares etc. um that are all using hundreds of dependencies and libraries and all of them can be single points of failure. This is where it is dangerous because these are maintained by developers and these developers are a part of the supply they maintain a part of the supply chain and if they're able to push

malicious code it's going to be uh it's going to affect hundreds of thousands of users. So in our industry, in our day-to-day operations, imagine uh about all the things that we are trusting. We trust our laptop, we trust our hardware wallets, no matter the brand, uh the browsers extensions, clients libraries, onchain libraries and and all of that, even the extensions um or other third parties services.

So supply chain attacks have happened already in Rep. Um, you might have heard about the most recent one. In September 2025, a dev was targeted by a fishing campaign. He had high privileges and was maintaining 18 packages on npm and he ended up being compromised and and the the hacker was able to push to push malicious code inside of 18 uh packages. Most of these non supply chain attacks um were containing some back doors where the final goal was to steal your token.

They were basically wallet drainers. Uh luckily they were easily and pretty pretty fast pretty yeah they were detected pretty fast. Um I think supply chain attack are really scary because we've seen other supply chain attacks not in our industry but where um the code didn't contain a wallet drainer and it was the goal was to spy on people and I think it's harder to detect. Okay. So can we prevent from supply chain attacks? In my opinion it's nearly impossible. uh we trust all the pieces of software that we are using and there is not a proper way to to prevent us from being targeted and from being

affected if we are a victim of a supply chain attack. In my opinion, this is a scenario that will that will happen again. Someone having high privileges u giving malicious code to end users and this is really the risk in in supply chain attacks. It could target many front ends that we are all using, all all the dabs that we're using. It can um affect libraries, dependencies, and and even more. Our goal, and I'm going to show some some tools that exist to prevent from that, even if it's nearly impossible to fully prevent from supply chain attack, our goal is to try to prevent the poison being spreaded.

So here are some tools that exist to prevent from supply chain attack mostly on libraries and packages. Uh you have iikido and chain guard. They do a mix of monitoring on the recent packages if they have been modified along the way if they have been modified since then their initial build. Um so Iikido chain guard I also saw some people from the community um making public and open source and mpm malware scanner which is very good and also uh vsdier if you're a dev or if you're a builder you want to know if your extensions are not malicious malicious extensions are also um really known to be targeted we we've all seen

the fake solidity one etc etc But I think the the key point of my presentation is that we have tools that will perhaps reduce um the likelihood of you being targeted by a supply chain attack. Either you are a dev or an end user. But I think the key is to have clean devices. Having clean devices uh is to use hardware wallets. If you do any type of sensitive operations inside of a company, please use a dedicated device that is semi-her hair hairgapped and really really hardened.

Anything that is a secret should stay secret and uncoded. I refer to passwords to private keys. Uh if you are using any SSH keys and PGP keys, make sure that they are on external devices like a UB key or that you have a passphrase on top of it. You want to make sure these keys if they are being stolen from you, extracted from your laptop that they are useless. That's the whole goal. So now that we know that it's very hard to prevent from supply chain attack, can we reduce the impact in case in case we're exposed?

I truly believe so. What we want to do is to make it harder to get hacked and limit the impact. So here we have two different types of things. You're going to need to pay for it. There are some there are some stuff that are not free. You will have to hire a security specialist. You need to do a security audit. You need other eyes to detect flows in your systems than from the people that are building it. You will need an incident response plan, pay for EDRs, UB keys, etc. But there are there are some stuff that are free. Uh knowing how to factory reset your machine. Why?

Because when you are being infected, it's a matter of time. You want to limit the impact and by having an incident response plan and and knowing how to react when you have an incident or when you think you are um infected is going to limit the impact for sure. Okay. So what are we protecting? Of course if you are a dev, a CEO, a signer on a multisig or an investor, your threat model is different. Your threat model is different but in the end we are protecting keys. Um the more you are protecting the higher your security budget should be but in our industry we are all protecting keys.

So what do you think uh happens when your device is compromised? Either it's from a supply chain attack or from any other attack. Basically, you're if the laptop is fully compromised, you're giving your laptop unlocked to someone that has bad intentions. This is literally what's happening. And in order to work on your threat model, you need to think about, okay, what is my worst case scenario? What happens if my laptop is compromised? Is it only going to affect me, my personal information, or is it going to affect the company? By by thinking that out loud in your mind, you're already working on your incident response plan

and for sure you will improve your security and and detect things that can be improved in your OBSC. We have been recently working on tools for the community as white hats. My goal, our goal is to see less people being drained, less companies being being hacked. This this is our goal. So here I'm I'm going to quickly go through three different tools uh that are free that are open source and feel free to uh to to help us along the way. We are looking for contributions. Um we really want to help the world community. The first one is a script that helps you to detect what is sensitive on your

machine. If you're being hacked, what's going to be stolen from you? And for sure you will find ways where you can improve uh your security. For example, if you're using SSH keys and they don't have a passphrase on top of it, they can be used against you. They can be used perhaps to login somewhere or to sign a commit on GitHub. Uh it really goes beyond uh the password that you will have store uh stored in your uh web browser which is of course not recommended. We also work for uh Mac OS, Linux and Windows on hard on hardening scripts.

Here what we want to do is to help people either technical and nontechnical people to harden their machine within one click. What's important in our regarding the security on devices? This will not replace an EDR but there are many things that you can do to improve the security of your device uh through the settings that are that are um through the security settings of the device. Um what is funny is many of these security settings are by default enabled but it happens that we check people devices and we find out they are not enabled anymore and people don't know why why it is disabled but it's very important to make sure that your devices are always secured.

So we have a script for Mac OS, we have a script for Windows, we have a script for Linux. I will invite you to check them out. Basically, we make sure that we enable all the important security settings on them to harden their configuration as much as possible. We also have um available factory reset guides and this uh I have created the factory reset guides because many many companies or many people were reaching out about hey I got hacked what should I do and along the process one thing that you should do is turn off internet and know how to do a factory reset on your machine. Of course, you need backups, but uh know how to do a factory reset on

your machine is should be a must. So, here is an optimal combination of all the practices that I' that I've shown you how you could combine our tools and and in order to harden your security. As I said, if the device is compromised, you're giving it unlocked to someone that has bad intentions. So you want to know what's dangerous on your machine and you need to feel comfortable in order to work on your threat model and say okay now I'm comfortable enough to give my laptop unlocked to someone. I know I've hardened my security. I know there is no keys on my laptop and this is a good way to improve your security. You need to know how to harden harden your machine

enable the firewalls and and all the other settings. uh please make a backup and test your incident response plan because if you're not testing your incident response plan basically you're not having it. Unfortunately, if it's too late, you already executed the malicious application, the malicious piece of code. Well, you're going to go through the process but in a different ways using different steps. You will need to turn off internet. If you use hot wallets, move your phones, but please do not use hot wallets. um make a backup on an external drive, revoke access of all your important accounts, uh Gmail, centralized exchanges and all of them.

Clean the compromised machine and then you can run the script and harden it again. Another initiative from OBSC again it's free, it's open source, it's for the community, it's for all of you. Um we have here a list of the most used applications in our ecosystem. Uh 2FA applications Twitter Signal Slack Telegram, etc. And here by going on them, you can improve your OBSC on this application. You will know if you can set 2FA on it, if you can set a UB key, if you can download backup codes, if you think um your laptop is compromised, how to revoke the session, revoke access. And I think this is very valuable because many times we've seen

in our ecosystem uh telegram account being compromised and it ended up having a snowball effect and people impersonating other people and yes it led of companies losing money. I want to finish by some good news. Uh I think safe what happened with bit had a positive impact on the industry. people started to realize that security shouldn't be only on smart contract. More and more sophisticated to sophisticated tools uh have been developed uh and I would say prevent from being hacked are able to monitor malicious transactions if they are uh if there are things that look suspicious

that are about to happen. Also AI and LLMs will never replace an auditors, but I think it they can bring a a great help um in our industry. We have an amazing community. If you make a post on Twitter said, "Hey, I need help. I just got drained." For sure people will help you. Well, be careful about who you're talking to, but for sure people will help you. And a big thanks to all the initiatives from SEIL from the certification. I see Mata here. Thank you. certifications, frameworks, seal 911, war games and all of that.

They are doing an incredible jobs. And last, the bad news, safe, the bid hack is up to now the biggest crypto haste that uh in our industry. Uh in my opinion, devices will keep being infected by malares. DPRK are fulltime against us. But not only there are other guys that are against us of course supply chain attacks are for me the the scary one the one we cannot prevent and still still it's like old but gold sim swapping and all these other things are are still happening.

Thank you for your time. Um, I'm happy to answer any questions if you have. [applause]