Operational Security in Web3: a review of major OpSec incidents

Transcript

Hello everyone and welcome to the April edition of the D5 security summit webinar. In case you haven't heard, this year's D5 security summit will be held in Buenosirus in November. U more info about the venue and the exact dates uh will come later. So please follow us on Twitter uh on on Telegram to know all the details. This webinar will talk about operational security, a very hot topic from this year. You've all heard about the buy hack. One and a half billion dollars were stolen. So, we'll talk about what is operational security and um probably convince you why you're not doing enough

to protect yourself. So, we have a host of experts on the topic and I'll pass on uh the torch to Isaac. Isaac is the founder of shield free and an initiative um lead in security alliance in seal. Yes, thank you. Yes, thank you. Uh very excited to be here moderating today this great panel we have with uh with Peter Kashinsky uh blog thread and Pablo and Louie from from OBSC. Um, we'll be hearing a couple presentations first about um, OBSAC and some case studies as well as some very practical things that you can do uh, probably even on while we're while you're listening to the live stream of how to like locking down some some

various things um, or changing some of your some of your behaviors um, while you're following along. And so we'll have a couple presentations first. Um, first we'll have Peter uh, and then Pablo uh, Pablo and Louie and then we'll have a b panel discussion afterwards. We'll we'll have a chance for some uh, Q&A. Uh so I will f pass first to again Peter Kashaginsky who's the uh founder of blockthreat um they work on threat intelligence and they also help companies develop their uh comprehensive security programs. So uh go right ahead Peter. Thanks Isaac. Um everyone can see the screen that I'm sharing. All right. Well in this case thanks for the intro and let's dive right in. Um, so diving into the OBSSE

portion of web 3, kind of a hot topic, becoming even more hot. If you watched my uh D5 security summit presentation last year with private keys and uh I guess operational security side becoming accounting for the majority of losses in our ecosystem. So let's let's do a bit of a deep dive on that on security practices, a few case studies and so on. So, uh, as as, uh, Isaac mentioned, block thread, uh, newsletter and just kind of like Viso is kind of what I'm focusing on these days. Um, worked a variety of companies, looked at malware from nation state actors from the Indian, Federal

Reserve system, Coinbase, Spear, and so on. So, I hope to kind of like combine all that experience in the few slides that I have a chance to share with you today. So first first thing we should do is probably talk about definitions. So if you're not coming from a traditional security background, you know, all these words are flying around OBSSEAC and ABSAC and SEC Ops, it can all get confusing. What are we actually talking about? So just to make sure we're all on the same page. Um let's let's define what is OBSC.

Um there are various like iterations on the definition but roughly uh OBSC concerns itself with procedures and policies to protect that we implement to protect sensitive assets from leaks unauthorized access vulnerabilities and so on. So think of like uh creating a procedure of how you're doing your key signing or how you manage your multi-IG or cold storage to make sure that uh bad actors cannot get to your precious assets. Um one one key that I want you to pay attention to is that OBSC is for the most part is proactive.

This is something that you do hopefully before there's an incident. um that is in a contrast to the other like very similar term which is secops and the way that I define it is more related to incident response so real time monitoring detection capabilities how you respond to incidents um and think of the difference between opsec versus secops where opsec is much broader kind of thing you concern yourself with you know I'll I'll show a diagram like all the different subcategories but the entire security program versus secops is more related to like how do you respond to incidents to minimize losses. So opsseack is more proactive you do it before the incident

and sec ops is how quickly you can respond to live realtime incidents. So that's much more reactive and of course like just just to throw it in there because that's the majority of things that we're focusing on within D5 security is appsc. So that's the practice of designing and building and maintaining cold uh all the you know bug bounties and code audits and uh all those things competitive bug bounties that we have now this this is also proactive and this is where we concern ourselves the most. So if you think in terms of like the overall pie chart like the majority of resources that we put into the ASA industry is probably abs still because we that's what we hear about hey we we keep on

hearing these smart contract hacks. Uh but as I pointed out in DeFi security summit last year, this pie chart needs to follow what the actual threats are and where the losses sit. So we're doing much better focusing on secops now. So we have all these awesome uh monitoring companies that are looking after us and can create alerts and respond. But even more so we need to dial back and talk about OPSACE. Hopefully uh what Pablo and I will talk about today will you know will serve as a as a as a beginning of that program. So speaking of OBSC pillars like what what does it concern yourself with? Uh it a variety of things as I said OBSC is very broad topic. So key management will show up quite a few

times. Uh access controls to your infrastructure how you manage your application security. Uh personnel security, endpoint security, how do you lock down your machines? Uh code management, how do you push your code? Is that safe? Is that are you like doing something uh that a single developer can wreck your whole protocol? Supply chain communication security. Pablo has quite a few things to talk about like how to make sure that you know we're all on Zoom call. How do you make sure that your Zoom call does not end with your private key private keys being stolen?

Then a small overlaps with the with secops. It also talks about some IR procedures. Basically some things that you can build and create kind of like kill switches um that can save you in case of a real incident. So the best way to talk about what is obsc is just to look at a few case studies. So that's what we're going to do. And when we look at those case studies, we'll point out what are what are the techniques used, what are the failings, and what can we build to make sure that something like that will never happen again. So on the radiant incident that happened in October 2024, that's the first one we should discuss. And that's kind of a beginning of a of a trend of

messing with uh multi-IG uh signer signatures. Uh so in case you're not familiar, $58 million stolen in October 2024. The initial vector was a fake security researcher uh sent in a security report from a different hack like, "Hey, can you take a look at this security report? You may find this interesting." That security report was actually a piece of malware which was executed on developer machines and the rest is history. devel all the all of the multi-IG uh members were eventually compromised where and they were whenever they were submitting transactions and s whatever they got from their view of the safe wallet uh UX was actually

backdoored. So by the time they got to their hardware wallets they were signing something completely different. What's really uh one thing I want to point out is the initial vector is particularly nasty because we already know that we should be wary about u you know other people randomly reaching out to us on Telegram and other social media. But the reason why this one was nasty was because this person was acting like a security researcher. In fact, the one persona that was revealed involved in the radiant hack, uh Nick L. Franklin, they uh the thread actors, the North Korean thread actors behind this persona have been developing this persona for a full year, publishing research, publishing uh advice on how to

secure yourself. And then after they built up this persona, they started sending out uh kind of like these fake malware laced security reports to other projects. So, thank God 1 inch folks caught it. Uh but just to point out like these just how dedicated are the folks that we're dealing with and this attack was attributed to Lazarus. So that's your your North Korea of course and the particular subgroup was Applejuice/dangerous password. They all kind of like you know they some some provide malware so malware was from Applejuice team and then the initial infection vector was probably from dangerous password. So they kind of like work together on uh some of these attacks. But the key lesson from here is

that attackers found a way how to deal with hardware wallets and multi-igs by making developers sign things they did not expect to. And then we have the wizer of course and that's your $235 million stolen. Uh that one is a little bit messy because uh neither Limino nei or wizer really admit whose fault it is. So liinal in case you're not familiar is kind of like a front end for the safe wallet. So you m it helps manage the um uh multi-stig interface. It's kind of like you go into safe but it's much more uh suited for custody and exchanges and so on. Um the likely injection vector was probably

similar. So uh most likely it's again the no one published the full postmortem on either side. Uh most likely front end was compromised. Uh malicious transactions were injected for signers on the wizeric side who signed it and then they were compromised. This one was attributed to uh another uh subcategory of Lazarus which is called trader trader which are particularly uh brutal folks responsible for some of the worst hacks in the ecosystem. Uh but again this is we're we're starting to see a trend uh North Korean attackers target large protocols with multiple signatures and then they are trying to substitute transactions that you sign in your

hardware wallets with something else. And then of course that gets us to the most recent hack which is which happened in February and that's the bid/safe compromise. That one scared the hell out of me because the initial attack vector will sound familiar. Third party uh multi-stick manager safe safe wallet in this case was compromised. The initial injection vector was a fake trading app. So that's something very very frequently that I post about on in the newsletter. Um the develop compromised developer had full AWS access. Boom. Substitute a safe front end. In this case, attackers decided just to target by bit. But you can imagine that every single person

who's using safe wallet could have been targeted as well. So they just chose the largest fish so to say before uh their attack was discovered. And again this was attributed to Lazarus trader trader. So very quickly uh there's a common thread here like what are the gaps that are similar across all of these hacks and you can see like they they kind of like build on top of each other. You can see like hey like they're experimenting a little bit and now they're substituting transactions and then they finally hit the big one. They they got the actual safe wallet and they got the biggest user of the safe wallet. So the gaps are access control authentication. So the the safe developer that was compromised they had

full AWS access to upload arbitrary things to the um to the front end. So just one developer was sufficient to compromise the whole thing. uh code management there was no verification of what you're deploying so you could deploy directly there's no like code review or something like that personnel like again I mentioned that the injection vector the social engineering injection vector was a trading app so maybe insufficient education about fishing attack vectors endpoint security you know nothing triggered an early alarm that a developer endpoint was compromised um and then and then uh on uh on the exchange side or D5 protocol side that

were compromised again like there's a oh there's you can't there there was a trust assumption into third parties like well safe wallet would never be compromised I should totally trust whatever it's telling me to sign I should do it so that was obviously that uh assumption key management so there was missing ins insufficient TX verification process so you know every time we have to sign something our hardware keys there's this blob of text and until recently that PC Dachio started building tools to for you to perform this verification. People are just like whatever it sounds sounds looks right. I'll I'll just run this. Uh key management controls like having some kind of time locks or guardians that could at the last moment stop this thing and at last IR procedures were missing

as well on monitoring and kill switch capabilities. Uh so controls you know lessons learned from this what controls we could build from that there there are a lot so I'll try to go fast through the most critical ones out there and one endpoint security I keep saying like you can build the most complex EDR solutions and monitor everything just buy your developers or key signers dedicated laptops make them really shitty laptops so they don't have any incentive or desire to use them for anything else like downloading trading apps or doing some kind of job interviews. That's a dedicated machine just for key signing and that will solve

a lot of your problems from the fishing vector. Um on the key management side, make sure that you have proper transaction simulation and verification procedures. You're getting this blob from an un supposedly trusted but as we learned could be compromised front end. You have to have some kind of process to simulate what is the effect of what you're about to sign on your hardware keys. Um and at lastly key management. So make sure that even if all this fails and you're just about and you already signed a transaction which is about to drain your whole protocol, you have some kind of lastditch effort like a time lock or a guardian that can still catch this like well you just signed the transfer of our entire thing or you

you're upgrading our bolt to something else. a time lock may be able to s save you there. Um on the exchange side and also on the safe and liinal side IR procedures for onchain monitoring and actually practicing incident response uh to make sure that you know how to react quickly. Oftentimes I see like for for these projects there was the initial upgrade and then the drain and the drain and the drain. I wonder if they just caught this early enough they could minimize some of the losses. uh code management and access control. There's no way that you should allow a single developer, which may be a North Korean IT worker or someone else to single-handedly push production code to

some place where you can hurt um uh or or result in the theft of your assets. So, there needs to be reduction and monitoring of all your cloud admins. Um all of the code that is being pushed needs to be verified in one way or another. So just really lock things down. So in terms of the other big control is notice that I specifically chose the sequence of these events like you know the radiant and the uh and wizer happened last year and now we got the big one. If only if only maybe it's a failing on on the security side of of DeFi ecosystem. Maybe we're not reaching security teams well enough. But please

read uh the block threat newsletter. Please follow direct news with deep detailed analysis of these compromises and extract those lessons. Look at what are the recent hacks, what are the trends that are happening and see does this does this apply to my project? I'm seeing that attackers are substituting uh hardware wallet transactions. Am I relying on am I somehow vulnerable to that as well? And if you are maybe you need to change some things. Um so in terms of future uh just really quickly the the one thing that that I've seen recently is someone at White Hat published a vulnerability in a in a blockchain explorer. So uh that's

that's one thing that is concerning to me like we're imagine how many victims there would be if a blockchain explorer is compromised. What kind of verification we need to prepare for supply chain attacks targeting whole chain. So that was the supply chain attack against the Coinbase base chain. Uh we have a once in a generation chance right now like you know the the traditional financial system is falling apart. Uh there's a chance to show users that DeFi is safe. DeFi is a good solid alternative. So let's not it up. Let's increase trust and and make it better.

So that's that's all I have for the presentation. If there are any questions or maybe we can jump into Pablo's side. Yeah, thank you very much. And I have some questions that I'll uh that I that I took note of that I'll bring up on our on our panel section in a moment. Um but for the for now I think we we're ready to move on with with to Pablo and Louie um from OPSAC specializing in operational security um audits for protocols and uh and companies and anybody that does uh onchain uh operations. Um so yep take it away Pablo and Louie. Hey guys, thank you very much.

you're see my screen. Okay, perfect. Thank you. So, you're going to talk continue talking a bit about uh operational security in web3 as Peter was uh started talking. I think that the most important thing to to understand is that I believe that 99% of attacks we have been seeing lately, they all all start with social engineering, the most the most important ones, right? And the thing with social engineering is that even if you are the most sophisticated person or the most advanced programmer or whatever, you can be a victim. We can be a we can be

victims. even security researchers now security researchers are being are being targeted um well for the person that doesn't know what is social engineering how I like defining it is uh a technique that allows you that allows an attacker um to make the victim do an action that is against their own interest and in the interest of the attacker right and as Bruce Nayer says am hack people hacks systems, professional hack people and also Kevin Midnik used to say social engineering can bypass any technology right including fireworks. So today I want to talk about some uh some cases

and some things that we can learn from them. Um the first one that I chose is the one uh about parafy capital. You will see that it's very common to see lots of cases where VCs, journalists or recruiters, even startups or devs are being uh impersonated, right? A VC is being impersonated to hack a founder. A recruiter is being impersonated to hack a dev. A journalist is being impersonated to hack some person that is perhaps an influencer intrigutor. A dev is impersonated to hack someone doing from human resources or an startup is

being impersonated to hack um a VC. Right now we're going to see first the paraffy capital case and what we can learn from it. So uh this influencer this guys defyart gets um contacted by someone named Colin uh calling uh medal he says okay this is a verified account right but as we can see here this is something very important not followed by anyone that you're following if you see in Twitter that an account is not being followed by anyone that you're following and is verified the most common thing is that that account is a scam. But well, this guy said, "Okay, let's check the

credentials for this guy." And he said, "Okay, verified followers." And he was being followed by all the other members from Paraf Capital with verified accounts, right? What's the issue with this? All of them. They were all fake, right? being verified in Twitter is a sign of being is more of a sign being it's more a sign of being an a scammer than uh from being like a real legit person. So they tell him that they want to do some partnership to to work with layer 3 coin 98 and poly market. He checks that these companies were really invested by this BC because Parafi

capital really exists. They start talking in Instagram and in Telegram they say, "Hey, we would like to invite you to an Slack channel." Right? So they send him a link to an Slack. He goes he gets to the Slack and he says this server error, right? The first thing that we have to see here is that uh well, first of all, as we saw, this person should have verified who he was talking to. And they believe that the only way to verify if you're talking with someone who is legit is to ask for the corporate email, for the company email, send them an email, and they have to reply back, right? But well, he didn't do that. He

was sent an Slack uh invite. He clicked on it. He sees this error error. What we have to learn from here is that real Slack invites uh start by join join.slack.com and this one started with app.slack.com. So we said, "Hey, I'm seeing this error when I want to get to your Slack channel." And they tell him, "Oh yeah, this happened to a guy last week. Please check this Reddit post where they explain how to fix this." So he's sent to this Reddit post that had many up votes, many comments. It seemed to be legit with five steps like test your network connection, do this, do that, do that. And in uh step number four, check to make sure

that your drivers are up to date. Often this error occurs because of blah blah blah. And it gives them a link to the flyi driver. This guy's go this guy goes to the fly driver website checks for updates. They tell him that he has a pending update for that driver. H he's taken to GitHub. He downloads a driver. He installs it. And you will imagine imagine what happened. His laptop was completely infected. Private key is gone. Book is gone. Extens uh sessions gone. Passwords gone. Important files gone. Everything gone.

Right. One more case I want to see. Uh uh one more thing that I want to add to this. We have to be really really careful. What I really like about this case is that there was there were many steps before being affected, right? First being contacted in Twitter, then you talk in Telegram. Through Telegram they send you to Slack. From the error in Slack you are taken to Reddit. from Reddit you are taken to a a website from a driver and from the website from the driver you're get you're taken to GitHub. So there are so many steps that the person starts like not seeing the direct connection between what they are doing and the

person they are that they are talking that they were talking to in the first step right um and the other thing is that we should be really careful because I'm I'm sure that we will see an evolution of this uh of these cases where imagine that instead of showing you server error I would have shown you I imagine I was a threat doctor server error E5314. So you search for that error in Google and you get to the ready post that I have optimized to be in the in the first result of Google. You get there, you get infected the same, right?

So we have to be very very careful first of all to to checking who we are talking to and second thing never ever ever downloading anything. Right. Well, one more case that is in some way similar to this one. elusive comment. Um, for sure many of you have heard about this one. Uh, I got to know about this one some months ago when I received an email inviting me uh to a podcast from Orion Capital, right? And I said, "Our Capital, okay, this is strange." I started checking on them and what did I find that they had a seemingly legit website. They had a seemingly legit

Twitter account with 44K followers but not followed by anyone that you're following. If you have 44K followers and you are not being followed by anyone that I am following that I follow more than 2K security researchers, you you are totally in a scam. But let's see all the infrastructure that they created. They had Audium Capital website and Twitter. Audion Capital LinkedIn profile. They created audio news website about about crypto news. They then created the onchain podcast with a Twitter profile with a website and with a um YouTube channel. What's the idea about of the all of this that you see so

much stuff with a nice design website this and that user trusting right? Uh the problem is when we trust someone or something. These guys as Peter was saying will invest all the time in the world that they need. They can invest one week, two weeks, three months, one year, whatever they need to gain your trust and when they get your trust there uh is when the the hack will happen. How did the the hack happen in this in this case? uh they sent you a calendar link, real calendar link for you to to coordinate the call. When you went to

the call, it was a Zoom call, a legit Zoom call. And in the middle of the call, they tell you, "Hey, uh share us your screen so you can show us some something related to your work, whatever." You share your screen like I am doing right now. And they say, "Oh, we cannot see what you are sharing with us. There's some error. We are behind the firewall in China." Whatever. and they say okay we are going to request to see your screen and they send you this right Zoom is requesting remote control of your screen perhaps anyone here would say hey but here they are telling you that you are going to give a remote control of your screen why would you do this right why would you give remote control of

your device this is kind of obvious but these guys think about everything right so they may tell you hey the podcast is about to start in two minutes or we need to see this right now or whatever. They will they will use any technique or excuse that they need in order for you to feel that you're late, that you're doing something wrong or this is kind of urgent and you just say, "Hey, I approve." When you approve this, what we all think is that okay, these guys know how control of your screen and that they open your command line and they put some comment or whatever. But no, it seems that there is a vulnerability in Zoom that allows to um uh run uh remote code

uh when you give this kind of of permissions. So they basically infect your device and you have no idea about this. And as we saw in the other cases again, private keys gone, password, sessions everything. Yeah, I want to add something probably on this one. Um, unfortunately, we met many, many people that fell for this one. What was surprising is, as you can see on the right, none of them that initiated the calls were sharing their their camera. So, it's a first red flag, but also we're going to see more and more advanced scenarios. We've ever seen people having face like mask using AI.

So, they were potentially spoofing someone identity. So you need to be extremely careful and in this case I remember they were asking the person to share their screen and at the this exact moment they were them requesting to have a remote access on your machines. So you think you're doing something but they were uh displaying the popup. So you have just one second. You think you're sharing your screen. So you click on the blue button of course and then you're trapped. And this was very sophisticated because the malware that you ended up downloading on your machine from this this scenario. It was installing a key logger where everything

you were typing down from your keyboard from your laptop were stolen. We had someone that lost access to his password manager where he had seat phrases, he had recovery backup codes and everything. Imagine today if you're using a password manager, your master password is compromised. You need to have incident response plants. You need to have backup codes, cold accounts, etc. Pablo will tell you more about this. Hey, thank you Louis. Yeah, something important about this. I will see some some what what are some of the things that we can learn from these two first cases, right? first of all is always

verify who we are talking to and be extremely paranoid about this, right? Um even if someone that I know like Peter or Isac send me an email from a new address or someone that I met in an event uh sends me a telegram or whatever, I always always verify, right? Even if I am not suspecting anything, right? The idea is not that we verify who we are talking to if if it seems that is sus if I suspect in some way. No, I should always do it, right?

Always. And remember that the best way to do this is to ask for a company email, send them an email and having them reply to you. Then second thing uh as Peter was already saying I think that compar compartmentmentalization is key and this applies to lots of stuff but especially I think that we should use or dedicated devices as Peter was saying for important stuff like signing or verifying transactions or doing deployments or at least having virtual machines right so if I am going to have only one computer for some reason and I cannot have a dedicated device. I could have a virtual machine, right? It has

not the it doesn't have the same level of security as having a second device, but it's a bit better. So, inside the virtual machine, you can do stuff like having installed the Telegram, Twitter, Discord, and this kind of of stuff. So if someday I download something, I infect I I I share something, I click on some link or whatever, the damage will be contained inside the virtual machine. It's very rare for a malware to be able to uh get out of the virtual machine. It could happen, but it's it's very very rare.

Then most people that work in security and developers don't like this. But given our experience in what we see with Louie daily uh and what we see is that they are infecting everyone it doesn't it doesn't matter how how sophisticated you are. I think that using a firewall uh and or using an EDR is very important. Why most importantly the firewall we are we are used to to saying okay a firewall protects me from inbound attacks right so if someone wants to attack my laptop the firewall will stop it I think that the firewall is key for these cases in the other way

right out so if someday for some reason I install some malware right and that malware wants to exfiltrate or so let's say they uh take my uh my cookies or sessions, my passwords, my private keys, whatever to a command and control server, they won't be able to do it because the firewall will stop it, right? So the firewall will be something that will protect you in in the event that you get um infected. And the other thing regarding calls and all of this stuff is they will many times tell you that the app that you are using Zoom, Google Meet, Teams

whatever is not working because they are in China or whatever and they tell you hey let's use this other tool never do that. If you're comfortable using Zoom use Zoom if you're comfort comfortable using Google Meets use Google Meets. If someone wants to meet with you and they cannot use either Google Meets or Zoom, don't meet with that person. It's simple as that. Don't use any other tools that are not um uh let's say popular as these ones. And I personally recommend to use Google Meet that doesn't ask you to install anything right?

This is uh I mean we try not to recommend we sometimes recommend a specific software but here everyone has to choose uh what they want to use but Lulu for example is a is a firewall developed by Object Objective C that is a nonprofit foundation that develops security software for Mac opensource security software for Mac. So perhaps if you use a Mac and you don't have a firewall aside from the one that comes from Mac that for just for you to know by default the the Mac the Mac OS firewall is disabled. Lulu I think that it's a it's a nice option.

Um okay one more case I have time yeah a bit. So, uh, Twitter fishing or also known as why we should stop using TOTP apps, right? That's normal to FA. So, I will go kind of fast with this one, but a big um Twitter account from a protocol receives a notification from Twitter saying that someone had connected to to their account. This was obviously fishing as you can see here. account uh twitter.com uh account twitter.com instead of twitter.com but perhaps you're on mobile it's late or whatever this arrived in your inbox you don't realize it's a fishing you click on secure your account

your ex account now you you are taken to this website this website you could change the username here and it will automatically uh take the the photograph from this account into the fishing website so I did it with mine as an example it will ask you for your password. You put your password. It says that it's wrong to put it again. You put it again. It asks you for your 2FA code. Right? And when you put your 2FA code uh as I am putting in this example and you put confirm what you are do what they are doing is that in there are two options in the back you have an operator right that is in real time trying to login in Twitter and when you put your

2FA code they are also putting it in the real Twitter website or this is just done automatically with a proxy but the thing is that you are taken to this fake uh screen as I'm seeing here and On the other side, you have someone that has gained complete access to your account. Okay. So, what is important about this case? Given the cases that we are seeing daily, we think that 2FA must change completely, right? First of all, SMS is obviously not an option. We are not going to talk about that. But we already know what SIM swap is. This is kind of obvious. But what is not can so obvious is thatp apps like Google authenticatory

Microsoft authenticator IS whatever all those codes are fishable right so if you use those apps but someday for some reason you enter them in a fishing website your account will be compromised right and it doesn't matter how sophisticated we are every one of us all the persons that are here connected today and watching this eventually we are all going to fall fail inefficient website and we are going to put our credentials believe me it's just a matter of time and how sophisticated they are they are and how targeted they are then what should we use UB keys right UB keys are good we think that they are the only option for doing 2FA

but they must be configured properly right keys have many ways they have they can be configured uh but basically There are only two ways that uh that are secure and that those codes cannot be fished, right? Those are uh the Fed2 mode, right? Uh and Fido U2F, right? When you use this uh either one of these options for each website when you uh that you want to to login, you create a pair of uh public and private keys, right? H and so these codes cannot be fished, right? So we really encourage

everyone that in important accounts you remove SMS, you remove 2FA apps, you only put UI keys, three of them, right? You have many models, you should always have at least two, one as primary and the other one as a backup because they can they cannot be um backed up. So you need to have two configured at least um and to configure them properly with FO2. If your UB key is not asking you for a pin every time you use it, it's not properly configured, right?

Um, one last thing and we go for the for the for the panel and questions regarding this. Pass keys now that you're talking about 2FA pass keys are 10x better than passwords because they cannot be fished. They cannot be shared. They cannot be repeated. They cannot be stolen from your from the user's device. they cannot be stolen from the service where you sign up because in every service when you set up pass keys a pair of public and private keys is generated right and then this is protected by the um biometrics from your device but the big issue with pass keys and this is very important is that if you synchronize your pass keys with your

iCloud account or with your Google account or you save them in the password manager that's not a in my opinion that's not a pass key anymore. That's it's better than passwords, but that that's not a secure pass key. The only way where you should store pass keys is in devices that do not do synchronization or inside the U key. Okay. Um I think I I think that we can now um go to the panel section and to see the questions. Yep. Thank you very much, Pablo. And uh I've got a few questions prepared for you all and I think we also have some that uh are coming from the

audience. Um but a couple things I think just I've been thinking personally lately about what um I've been noticing like on my devices. And I'd say that for for a while I was getting maybe like 20 or 30 attempts to reset my Microsoft password every day. And lately in the middle of the night at like 2:00 in the morning or I'll wake up and I'll see that I have like six or seven uh attempts on my Google account to reset. Um is that a sign that something has already gone wrong or if I like am diligent in saying like no, this wasn't me and should I always go in and say no, this wasn't me every single time because I'm always like worried that I'm going to open the notification and accidentally click yes, this was me. um like what are some of the risks around

like kind of interacting with those like password reset um things that come in when we're not expecting them and yeah open to either of you guys. Uh Peter file yeah Peter I I can go I've been getting those messages from Microsoft and Google non-stop. Basically, it's it's it's a security trade-off by all these companies to be user friendly that if you are a legit user and you try to reset it, they'll send you a message. But it's basically very low friction way attackers don't need to know your password or anything else. It's just when you go through the standard like dialogues of resetting your recovering access to your account, they will generate that email for you, the recovery email. And if you click yes, then then that's what they're

trying to get you for is that if you say like, "Yeah, that was me. Let's recover password." And they'll be able to uh pick it up from the other side. Um so that said that if you don't do anything, then they're not necessarily going to be able to get anything. So the question is like action versus inaction. The fear of action is that it could also be a fishing email, right? they they can craft a nice message for you to click on and it could be even unrelated to Google but just like some kind of CSRF type exploitation scenario where just one click is enough. So safely ignoring is fine I think. What do you guys think?

And then if you if you're really paranoid as as I was. I had a freak out a few days ago when I got the Google message. Go into a panel, see what's going on and then say no. But, um, I think for default users, if you're if you receive messages like that at 2 a.m. and you're tired or you're at a party, just just ignore it. Don't don't make a mistake. And would a key help you? Like, if if I had a Ubi key on my Google account, which I think I might, would that also like if with a Ubi key, can they can somebody still go in and like do those requests of like reset my password or would they also necessarily have to have my Yes. Well, they'll still generate that recovery email.

they'll but there'll be an extra step further on but you'll still get the spam which is annoying itself. Again, this is like usability versus security. Uh so don't freak out and ignore. I think yeah I think a nice a nice exercise that we don't always do is like just open an incognito window and try to recover access to your account and for sure for sure there will be something that you say I didn't know that this was happening. I didn't know that I had a pin in Google. I I didn't know that I had this phone number. I thought I had removed all my phone numbers. I I didn't know like the the the recovery process from accounts they change very usually and they are not as good as we think.

Then regarding what you asked um Isaac regarding UV keys if for example in your Google account something that we see very often you have three UV keys but then you also have the SMS as an option for 2FA well then they will go for for the for the SMS or they will go for the recovery email that you had in Gmail that it's a hotmail account that that you have not logged in in eight years and that does not exist anymore and that they can perhaps register again because it was free. Uh so that's a first thing and then regarding these notifications that we get specifically with Microsoft accounts, if anyone goes to the logs from a Microsoft account, you will see

like 20 or 30 attempts daily. That's mainly from bots. But there's also something called multiffactor authentication fatigue attack. And it's that for example if you have a Microsoft account that is passwordless so you only log in just put in the okay in Microsoft authenticator I will try to do that like 300 times really 300 times so you get the popup a popup a popup popup and eventually you you cannot believe this people will just say okay yes so I don't see the popup anymore and the person is logged in that you won't believe it but it works um and So that's good. Oh yeah, go ahead.

You know, and and that's the thing regarding this. If you're seeing notifications of someone trying to reset access to your accounts, it could be a bot, but it could be also someone trying to understand what are your accounts, what's tied to what. So that's a warning. I would prefer thinking someone is investigating and seeing how to attack me. So I would dedicate some time to to leverage and to to my nice just just a heads up all of us I was going to say all of us are most likely most people on this call we are on some mailing list probably Ledger that got hacked a few years back so we're all there they all have our email

addresses maybe some other leak that happened as large as Ledger so as P will say it could be that they are targeting Or it could be they're going down this list like if you recall like what was the email that I used for for that for that time back in the day when I was registering Ledger or whatever other thing that was leaked. You're probably on that list. So yeah, it's made me quite paranoid. I even got like a a request from my my local gym, like my like local gym saying like, "Hey, we have a new user agreement for you to sign." And I went in and was like, "Wait, this email didn't actually come from the gym. what if this is and it turns out it was legit, but it was just like I think I actually went to the front desk at the gym and I was like,

"Guys, your emails should come from your own domain." Like I I would be careful about that. I was actually just reading uh let me see what this attack was. They do they did start crafting this ah DK DKIM replay attacks. So I would research a little bit on that. They started spoofing actual domains too. So even if you see it's coming from let's say Google, you know, they there's there's an approach now where they can try to spoof your uh illegitimate domain as well. So guys, just be paranoid as hell.

I agree. I think it would be very nice, Peter, if you can show that link in in the chat. We we saw that Twitter post not so long ago about the emails that were signed by Google but were not coming from Google. And also I think five minutes ago. Perfect Isaac, you shared the fishing dojo, which is a CTF challenge to to to check fake fishing campaigns. There's like the first part that is about fishing emails and then fishing and then spoofing transactions. It's I think it's a must for anyone working in web three to to pass that test. And yeah, when when it comes to fishing, I think anything that ask for credentials or fast actions, it's a red flag. You

should ask yourself, what if I don't do anything? Are you really in danger? And most of the time, as Peter said, if you don't do anything, you will be you'll be okay. Why are they saying there is a security alert or you should do that to update your account or to make your account safer? Most of the time there is. And I think while UB keys offer today the highest level of protections, unfortunately we still see scenarios I'm thinking about Twitter where you can if someone sends you a link on Twitter delegate basically the you malicious application can act on behalf of you and this you can have you can have two FASAs

you can have backup codes they will have a remote basically control of your account. We saw that recently many times. So I would say on Twitter, never click on a link. As Pablo showed, the link can be embedded and hide something else. It can be a totally different link. And you should check, especially on Twitter, what are the applications that have access to your account? What are you sharing with other applications? We saw a funny scenario with Pablo where it was a malicious application called Twitter for browser with a very beautiful logo from Twitter and the attackers you added like a huge padding and people were not able to see the revoke button. It was it was a funny one. Nice. Um another thing before we

move on a critical thing that just just so we don't have false sense of security here. UB keys are great, but if you have malicious code running on your machine, that's game over because attackers don't need your UB key to hijack the session. So if you already are authenticated somewhere or some you're already, you know, in your AWS environment or whatever and you're in attackers can either comeandeer your existing browser session or steal session cookies or whatever and do all the same stuff. So just just to be mindful that UB key is good for fishing defense, but it's uh it's not a thing like oh I have UB keys, so I can just I

can just download this Zoom uh desktop uh thing right now, so I'll be fine. So just just to be mindful of that. Don't get negligent. Yeah. And if we think about like how this malicious code gets onto our computers, I've been curious like how um should be we be thinking about PDFs because like as someone that sends like sometimes reports to clients about like here's the here's our findings or whatever like what are the safest ways to actually send and like if I get a PDF and I'm on my Mac and I open it in preview, does that have an ability to escape and can compromise my computer? So yeah, what's our level of paranoia around like PDFs and sending documents?

Well, very short for for sending documents for example we used doc send right because we were telling our clients that don't open PDFs and then we were sending guides and reports in PDFs and we said no Louis said we cannot keep on sending PDFs so we we use docend for that and then if someone sends us a PDF that we try to tell to ask everyone not to do it you option number one is open it with a Google drive but you have to download you can from from from the from the email in Gmail just uh save it in in Google Drive and open it from there. So it will be um the the render will be done in in in Google Drive and it should not have an

issue. It shouldn't be an issue for you. Um no and then another option that we use sometimes is to have a dedicated virtual machine for that kind of stuff and open it opening it there. But I think that uh Peter will be able to give more details on this. I would be even more paranoid like anytime anytime you're downloading any file externally and you're running it, I don't care if it's a it's a you know an image or whatever, you're running some kind of executable code. So preview is much safer than full-blown Acrobat client. So that's already win. Running in an isolated environment is still much better. writing inside Google Drive is

even better because they they strip out whatever nasty scripts that that could be embedded inside. So, I'm I'm leaning towards like there there are few third-party solutions that will simply take you can upload your PDF file there and it will just generate a nice image for you that you can view. Um I have to think if I remember what they're called. I have I have it written down somewhere. So, Google Drive would be good, but preview is better. But, um, just just be wary like uh whatever you do, don't whatever you're downloading externally, try not to run it on your desktop on your actual OS.

Nice. So, maybe if we're sh can you upload a PDF to Google Drive, generate a sharable link, and that's a gener a bit of a safer way to transmit them rather than just sending the raw file. Yeah, exactly. Okay. And in fact you can configure you can configure individually in Google drive that that file cannot be downloaded for example. So they can only view it and that's it. Any anyways infected PDFs like two things as Peter said a corrupt reader is pretty dangerous. So if you have a corate reader it must always be updated but anyways PDFs that are infected are not so common because they are expensive right? Usually they are like zero days

or or nearly, but they exist, right? They're not so common, but if you're a high target, you for sure you will receive them. Yep. Nice. Now, let's imagine that like some of this bad code has gotten onto my machine, like maybe I joined the Aurora interview, I don't know, security webinar, and gave them remote access to my machine. if I noticed it right right away and I just like I don't know close my laptop or shut down my computer like what like what are the what are the immediate steps if somebody thinks that they might have messed up what are the things that they should do absolute first um and can I just if I like close my computer and throw it in a trash can or like like what what are my next steps because I've had call I've had like friends that me

they're like oh I was talking to this person they were going to give me a grant for like weeks and then they got on and suddenly like oh crap I think I downloaded something wrong like what are what is like step one once you think you've messed up. I was brainstorming this guys. So shutting off I think shutting off internet would be step one. That will probably cut off remote access to your machine. So they can't whatever they already exfiltrated they that's gone. Mhm. Um, step number two, open a 911 ticket.

Yeah, start the app. Reach out to on a different device. Uh, and is it like crosscontaminated? Like if I download something bad on my Mac, is my iPhone wrecked now? Or like how how does that kind of stuff like are uh I know that some people are like, "Okay, is my Google now account now like gone for good?" Like how do how do you think about that? No, I think that was my I guess step step number two that was seal seal number one. Step number three is if you have a phone or alternative device where you do have those login sessions now you have to have well since we are talking about this start building a plan like what would be your recovery plan where you go through prioritize list of

accounts and then sequentially go in log out all sessions change passwords go in log out all sessions so probably you should start with your password manager if you're using something external then proceed to your uh definitely like email accounts because everything else gets opened up by email accounts. So your Gmail, Outlook, whatever you guys are using. And then proceed to where your immediate assets can be lost. So maybe your banks or something like that. Just because just because you're a crypto person doesn't mean that you don't have a bank account with something you should protect. Nice. So you will have to you will have a very like hopefully the SEAL folks will be on your side uh supporting you but you will have a dedicated day

probably of maybe weeks and you'll sequentially go one after another start uh logging out and changing things. Nice. Let's get towards final final thoughts and comments. So yeah, one more from one more from each and then we'll have to get towards the end. U but yeah, go ahead. Uh okay, I'll start. Um what what I was uh going to say is that obviously uh when you get your computer infected your key store file with the private keys from your hot wallets is stolen and in a matter of minutes that assets are gone.

So you have to move all your assets to a new secure uh address. Then final thought um I will say that we have to be really really really paranoid more paranoid than we really are. I'm usually very paranoid. Last week I had a call with teacher and after that call I became like highly more paranoid that I was luckily and it made me work all the weekend. Sorry. And then the other thing is as I as I always say like everything is an scam until proven otherwise. Right. If we have that mindset that I cannot trust anyone and that everything could be an scam, I think that we are in good in the good

path. Any last thoughts Peter Louie? No, I think it was very interesting. Uh, unfortunately safe was a very unfortunate events but I think many many people are realizing the importance of UB keys and everything we are doing and we learn from such hacks. Yuri, yeah or go ahead Peter. Oh, I was going to say adding on to what Lou said like we have we have an amazing community from thanks for organizing this mini webinar we have conferences um folks in this community are very good at sharing knowledge uh but the fact

that bybit happened with previous incidents which were kind of related there were some lessons and indicators that you know maybe either I think we're sharing knowledge fairly well maybe we need to package that knowledge better. But at the same time, security teams for all, not even if you don't have a security team, but DeFi protocols in general need to constantly be vigilant and see what are the trends, who's getting compromised, and learn see have a weekly meeting on a Friday afternoon at lunchtime where you sit down and ask, "Hey, who got hacked this week? How did they get hacked? Is that applicable to us? Should we change something?" So just

do this fun exercise while having lunch and if something does show up where hey like this is similar project we also use safe wallet and we also sign with hardware hardware wallets and that's how they got hacked it probably could target us as well. Then you have an action item for to to step in and start working on it. Nice. Yuri, would you like to close this? All right. Yes. Thank you everyone for tuning in and listening. Special thanks to Isaac, Peter, Pablo, and Louie for making us all hopefully a bit more paranoid and aware of uh potential uh social engineering that could be done to

us. Uh keep tuning in, following us for more information in the future about uh the location, the venue, and the date of DeFi Security Summit 2025. And see you next month. Byebye. See you guys.