Pablo Sabbatella / DCxPrague

Transcript

well hi guys uh this is this is going to be a small presentation about uh what we are doing at block fence uh I head of security research and we are basically unmasking Connections in web3 so what we have found is that um information in blockchains holds lots of Secrets right we have Smart contracts we have EAS we we have transactions but uh the most important thing are the connections between them right not when you see them apart we are also seeing that traditional security methods like oits uh fall short there are not enough and we are looking for a new holistic approach where we can have

more context when we investigate hacks scams and these kinds of um incidents right so we think that uh it's very important to add a new layer right the web to layer and to be able to anal I that uh basically to add the front ends uh front ends are very underestimated but are some of the some of the attacks that are growing the most are attacks on front ends right like uh fishing attacks or hijacking domains for example and there they take you to malicious smart contracts and there you lose millions millions of dollars uh so we think that it's very important to add

that uh that layer in what we have lots of information we have DNS IPS ER API Keys multiple security protocols and standards and in web three we have lots of risks and problems right we as I was saying we interact with fishing websites we transact with or new contracts and addresses and it's very difficult for investigators and for devs to understand user interactions and how assets flow if they don't have information about where is that user coming from right sometimes we don't know if a transaction uh is a real transaction or is an scam or whatever because the information that we have on blockchain for example in you that you can see nether scan is not

enough so basically what we are doing is web three mapping we are bridging Bridging the Gap between web two and web three the frontend the blockchain we uh we analyze and we detect fishing websites and fishing campaigns sometimes before those campaigns start right we thecate the code of those website automatically we discover all these rotating URLs we relate to all of them we connect this front ends to malicious smart contracts the uh many times those contracts seem to be uh good contracts because they are verified and all that but they are proxy contracts so we find we also find those

connections and in this way we are able to predict uh malicious campaigns basically and alert users right uh um and we also think that it's very important to have this kind of information because we have more context right as I was saying if we only rely on information from blockchain when analyzing um these kind of campaigns is not uh is not enough so basically here is an example of of our tool where we have for example one malous smart contract and many many different uh fishing websites that are all related to them uh I don't know if you know but nowadays there are lots of fishing as a service

uh providers right where you can go and pay for a service that will give you the contracts to be deployed on chain and your role is just to fish everybody and take them to that that website you will be making the money from the scams and the uh fishing as service provider will be getting a 15% of all the scams that are being uh generated right so what we can find with this kind of tools is how perhaps different fishing campaigns that don't seem to have any relation have a relation in fact right and with all this information be able to track uh to track malicious actors easily because what we are seeing is that this is all related

to incentives and we see that most protocols and DBS nowadays are not really uh focused in like let's say there has been a campaign that has targeted I don't know X Proto some protocol users and they have lost Millions nobody's after those Bad actors right so if we start making the uh if we start having better tools to track them it will be they will have a less incentive to do this this kind of s right so here we were seeing for example a smart contract connected to different fishing websites and how then we find that this contract is related to to

another fishing website related to all these different Mal contracts and like this we have lots lots of of information and lastly to show you a little uh case that we we worked with the people from fora uh it's about an nft slip drop campaign that was targeting uh half a million addresses and had 20K victims and 32 Millions were lost basically how the how in a slip drop campaign uh works first you have like The Lure like you have a deceptive nft airdrop that you get to your your your

address uh that nft seems to come from a legitimate Source right uh because of and taking advantage of the implementation of of the Oken standards in this uh airdrop you have information here in the description about a website you should should visit to get more benefits when you get to the to the website uh this is a fake website obviously but something that we have seen lately is that these groups are becoming more and more sophisticated and most of the time most of the times fishing websit and scam websites seem to be uh far more authentic than real projects right uh so you get here you

connect your wallet and when you connect your wallet you're basically um this this code will analyze what assets you have will check if your address is in is in is in some list they have in fact they have black list of security researchers or or from some wallets that they don't want to they don't want to attach they will check what you have in your wallet and depending on that we'll ask you for some approvals with offchain um approvals and after done after that you are done basically what ation techniques they use as we were saying uh they use non-standard proxy patterns and multiple contracts right uh and in the offchain world they are rotating URLs and

websites all the time right so you may see the same fishing campaign for example targeting metamask users with 35 different URLs H they have anti-de they detect BS they they try to stop uh all that um and what what they also do is perhaps with the same contracts uh they target multiple user groups and multiple uh let's say um yeah user groups for example Bard apes or openc users or Unis swap LPS um well that's what we are uh what we are connecting and here is an example of uh something we found these are all different fishing websites and

there we can see how all those fishing websites connect to to uh the same contracts and deployers and here basically combining uh we analyze smart contracts code and we also analyze bite code we get signatures from there and we we check for similarity we also check for deployment patterns and in that way we are able to to connect the whole um the whole uh scam networks right here for example we we can see how we have the deployers on red of the contracts then we have uh on green the proxy contracts right and what the scammers try to do is to make them uh seem to be isolated but then we could find thanks to uh to

connecting all this information that they were all connected to these blue dots that are the implementation contracts right and we could find how campaigns that seem to be from different groups were all uh basically related so uh um this is the approach that we're having uh we think that uh this kind of mapping and adding the web to layer information to the web three layer is essential to to investigators and to be able to to find this to discover these campaigns faster now we have like two approaches we have the B2B approach that is giving this tool to investigators right and to security researchers and we also give all this

information in in an API that can be consumed by any Exchange or in need app and we also have a Chrome extension and a metamask snap that allows users to check uh if the website they are interacting with is the real website or Is a fishing one one and if the contract they're interacting with are also the real contracts or are uh fishing contracts uh so well that's what we are doing um uh that's how we want to uh add our uh our work to make making a little better the the security of the ecosystem that we think that it's a very complicated issue nowadays and well uh any opinion that you have on this or

what you think is valuable from this or where uh do you think that uh we should be putting more Focus would be very valuable thank you we have both we have both now the focus of the compan is more uh on the on the mapping tool for researchers and for investigators uh but we also have the API so for example any wallet or any exchange can integrate it and check for any transaction before it's done and I forgot to say that we also have Integrations for example with fora or

with go plus so we take we take data from and we will have more Integrations from different uh data providers uh so when we analyze something perhaps one provider can not see something but another one can so yeah we have both approaches yeah totally totally well totally yeah in fact something that I I perhaps see that would be interesting for the future is another another one more layer and saying okay the the user came from this fishing website but to also know how did he go to that fishing website right from this mailing campaign from MailChimp or from this post in Twitter from this user or

from this Discord or telegram message from this other user and to have the whole path because when you have the whole path you also have more information to be able to get to these organizations right yeah okay thank you very much guys