Professionals hack people, not systems

Transcript

hey guys how are you um well today we're going to talk a bit about uh operational security and how I I I say that professionals hack people and not systems right well for the ones that don't know me I'm Pito I do operational security uh research and trainings uh I'm a s911 contributor I also founded OBC doio where we do these audits and trainings on operational security and I have the blockchain security series podcast perhaps you heard about it so um as Bruce sneer says professionals hack systems H amatur hack

systems sorry professionals hack people and as Kevin mnik said uh so engineering can bypass all Technologies including firewalls right so as today ER Peter was was showing uh most of the funds stolen in in crypto nearly 80% are not due to Smart contracts we have gotten far better in smart contract security but due to operational security issues right so today I'm going to share with you five stories or perhaps six depending on the time we have and some things I learned from them right so the first one this is something that is perhaps known by by most of you

but has an small twist there have been been lots of scams regarding ER scammers impersonating recruiters BCS and journalists right so this is an example of one I got H contacting me saying hey we want to invest in your company er very fast I realized this person was an scam was an scammer how because the I mean I follow three 3,500 security researchers and no one was following in this account so if that happens for sure they and scammers but I said hey let's continue this to to to have a bit of fun we go to a telegram Channel they said that they were from Eden blog BC that's a real BC and one of

the guys told me hey for you to check that I am real and this is not an sc scam go to the website go to our website and check there you will have my profile you will have my Twitter and you will see that I have just followed you so I go to the the BC website and I see the the account link I go to the account and they see that this person has just started following me right so I said hey what's happening here we continue h talking a bit H I got tired of this but um basically what had happened is that this guy Yan D the real founder from Eden blog had changed his TW his Twitter username and when you change your Twitter username your old username becomes available for anyone to register

it right so scammers had had seen that they had taken the user name and they started impersonating him what do they do after this we all know it you have one call two calls three calls and after they have gained trust with you saying that they are going to invest money if they're ABC or they are going to offer you a job if they are recruiters or they are going to give you some uh something in fors or some media saying that they are journalist they uh you are in the fifth or fourth call they tell you that your video doesn't work please download this platform or this platform you download that as most of us use MacBooks and we have that very stupid idea of with MacBooks and Mac OS there are no

virus no malware we download anything we install it we are done right um so what do we have to know from this uh today it's full of Z the exploits for uh you all know Z the exploits are exploits that are not uh that exploit vulnerabilities that are not public and we also have lots of zero day Zero click exploits right exploits that can be sent to you you don't have to do any click anything and your computers are totally compromised one that is very used in these Cas is apart from sending you perhaps uh some platform to download which has an insall infected is using PDFs that are infected so it's very very

important if you use a cow reader to have it always updated to the last version this is very common just by opening a PDF you are totally compromised and as some people don't believe me when I when I say this H you have many companies that buy this kind of of exploits for example if you developed a zero click zero day exploit for Android you get paid two M two and and a half million dollars right so there's a very big market for this this exploit used to be bought by three L agencies but now can be bought in the dark web for a bit of less money so they are being used by by thre actors so we have to be very very careful with this and here we have for example a price

proposal from inexa that is a company that sells these kind of exploits where you can see that you can uh compromise any Android or iPhone device up to date with the last uh uh update you can compromise 10 devices for uh $10 million so 1 million dollar per device so it depends on what you're what you're protecting how much you should spend in your security one thing that is very important to to think about this is there are lot they are targeting a lot of devs right and even security researchers and something that is happening is that when a Dev is compromised and he gets hacked then they don't go and tell their bosses hey I was

compromised yesterday because I was doing a series of interviews to go to another company so it's very important to have a very transparent culture with our employees and our teams so that if this ever happens to someone that person discloses very fast and we as a company can do what we have to do knowing that this person has uh been compromised right and the other thing to know is that 90% of these cases are not published right so we are just seeing a tip of the iceberg in Twitter or whatever when we see someone telling about this this cases so the second case is uh about social engineer right a bit more more

advanced in my opinion what happened here we had a fund manager and an invest a supposedly investor right that was an scammer this investor contacted the fund manager and told him that he wanted to do a 3 million uh OTC operation he didn't want to use any Dex any smart contract anything for the for the operation but he proposed to to use an escrow right and he proposed to Peter to use John as an escrow someone that was very known in the ecosystem so he said hey I trust John and Peter was friends from JN so he said hey we can use John as an escro right so John uh joins the Discord and they say okay we're going to

do this operation we're going to we are going to send you the to um the investor is going to send the stable coins to John and Peter is going to send the other tokens and then John is going to send them the other way what happened here and uh the supposed investor proposed to uh continue the conversation in telegram right not in Discord for security purposes and here comes the magic what did he do instead of creating one telegram Channel with uh the three of them he created two telegram chat two telegram chats in one he was impersonating Peter and in the other one he was impersonating John right so what does he do next they start talking and

he starts copying the conversations and the chats from H from one to the other and from that one to this one so John knows how Peter writes and Peter knows how John writes but when he sees the messages he sees the exact same thing that Peter is saying in the other chat right so there's no doubt about nothing they weren't thinking that they were going to be compromised or something so what does it happen they keep talking and talking and in a moment H John informs his address for the transfer and that's the only thing that the scammer changed is here right John informs a fake address so what happens next Peter would have transferred and they would have lost everything right but what

happened here luckily or not so luckily they had thought about this for this kind of operations they have a second Channel where they confirm everything right that in this case it was WhatsApp so they talked in WhatsApp saying hey this is the address where I should send you the funds right and he said no no this is not the address what's happening and there they realized about this this scam but when I saw this really I said I could have fallen victim victim of this it's it's getting far more sophisticated every day so third case domain hijacks this is happening a lot a lot uh some weeks ago Athena Labs had their Twitter compromised ER we all saw this they had

configured registered with domain.com and domain.com did not even have the possibility to have FAA for authentication right it was just username and password but in this case what happened the support was Soldier engineered right our case either F they also had their their account hacked how was it done through social engineering the the support so uh how are they uh so engineering the supports with fake IDs we are going to see a bit about that and also with Sim SW right this is very very common we talked about this 1,000 times but it keeps on happening a lot and regarding this I did

a bit of research right I said okay the I think that the operational Security in in crypto is one of the worst operational Securities standards that we have worldwide like we're the worst industry I think uh but I said okay let's check security companies right so I have a database of 350 security companies and products from the ecosystem that's us and they checked for examples where we have registered our domains right so 25% use GoDaddy right as GoDaddy domains can be hijacked in three days right and I say that because we we tried that and we could do it with a client obviously right then 20% name

chip the same 7% square space approximately 70% of domains of security companies security companies can be hijacked in less than a week right and it it must not be done by someone that is super sophisticated no it can be done by any any kid as Peter was saying in his uh H being a teenager so what kind of register should be using for this H Cloud flare ER AWS Mark monitor for example and something that is also very important is for this kind of of accounts for example for registers it's important to use cold email accounts

right a cold email account is an account that you have really secure that is not public and you don't use for anything else and you don't have logged in your computer during your daily use and also using U keys for TFA right not uh TFA with applications now we're going to talk a bit more about that fourth case Twitter fishion or why we should stop using uh TFA with uh applications like oi or Microsoft Microsoft authenticator what happened here this is uh from some weeks ago you receive an email at 3:00 a.m. saying that there was a login in your Devi in your Twitter

account from North Korea or Russia or whatever this is obviously efficient but if you look at it from your phone it's very easy to to fall for it because it goes directly to the inbox it's not the Ed by uh by Gmail uh fishing detection system you get to this website for this example I changed the username in the URL for my Twitter account so it it asks you for your password if you put the first time you put your password it says that it's incorrect but I don't know why they do this next time you put it uh it asks you for your tofa right and when you put your TFA here in real time it's being proxied to Twitter so your account

is gone even if you use TFA with app or if you are using UV keys with the OTP mode the traditional UV Keys use that can be fished and your account is totally gone so in this example I I put a code you are logged in here and here you have some options and you can click on some things but in this moment your account is gone and as we know if you don't have a contact inside Twitter there's no way to to recover your account it's very very difficult so some things for this we have said this like 500 times but in c911 we keep on seeing like lots of accounts being hijacked because of using uh SMS for um for

TFA uh so please remove your phone number from everywhere everywhere and if you are in some platform where you have to use uh your mobile phone because it's mandatory as UFA don't use your public number your public phone number you have to think that any day you're going to go wake up and it has been Sim swapped right so you shouldn't put it anywhere you should use a called virtual phone number right from Skype Google F or Ido and keep it private don't let anyone know that that's your your phone number also as I was saying if we use normal TFA from applications or from the U Keys the traditional top from U keys that can be fished right because we

touch a u key the U key sends a code and that code is proed to the real website through the fishing website and our account is gone so when we use H UB Keys we should configure something called fedo 2 or u2f and when you do that H every time that you use your UV key with a website it validates that the website you're sending the the signature too is the real website right so this cannot be fished um if you have your U key and you download the U U authenticator there you will be able to disable the OTP uh function that is the unsecure one and

use fedo 2 or fedo uh u2f and also one more thing that I added here uh one password added the possibility of uh saving to a in one password I think it's it's the most stupid thing they did as a product it's like it's not a feature it's definitely a b so we it's obvious that we should not save to a face in the same place that we that we save our passwords right so Story number five H Twitter account takeovers uh even if you have your Twitter account configured in the best best way it's very easy for account to

be H taken over how here's an example this was published by Athena some some like one week ago an attacker attempt to take over their account and they did it H with social engineering right what did they do they contacted uh Twitter Twitter support saying that they wanted to buy ads more ads uh there with that first call they got information about their account manager then they targeted the account manager right using information from that first uh contact saying that H they wanted to uh change the the account access and for that they used uh Forge uh IDs right uh and force

company documents luckily as Athena had a premium X account if you're protocol you should have a premium X account they are I think like $2,000 yearly they contacted them and they said hey is this account change real and there they could validate it was not real so the the change was not done but if they hadn't had the the premium account the they would have their account uh totally hacked uh so basically what they do what they did there they lock down the account and they were secure so important things regarding this this is a very long text but because you will

have this presentation then uh it's important to have ER verification protocols with your account managers right from X and if you have this premium support uh for your account you will have many more features that will allow to have your your account far more securely Implement ER multiactor authentication and change it like three every three or six months and conduct routine H security audits right and the other thing to know about this is that there are also lots of Twitter accounts takeovers due to insiders right you can do the best thing that you can but for really important accounts there have

been many that have been take taken over with uh insiders people working at Twitter changing the email from the account disabling to fa or whatever so in your in your plans you should know if you're a big protocol that any day that account could be hacked so you must you must know before that happens what you will do that day right exactly who who you will contact uh Etc so how do they do this kind of stuff for uh social engineering for example with IDs there are platforms where for 20 or $15 you can create a fake ID from any country like this is software as a service it has a very very

good support and you can example say Okay I want an ID from Argentina this type of ID with this name this year this this is and that and the photograph that you that you want and you can create any ID from any country and these IDs H they can go for 90% of the kycs that are out there and they go with no no issue H this is very very dangerous because basically they can impersonate uh any of us and well the last one that I wanted to show you is uh also about soci engineering and malware right this happened some weeks ago to two persons dard and one more guy

he was basically contacted by someone saying that was from parafi Capital that they wanted to do some collaboration whatever he wanted to verify that it was a real account so he checked his followers and he was saying that uh the other Founders from Pari Capital were following this account so he said this is real but what happened here all those accounts that were verified we're all scammers also right I mean having the very having the verified uh blue check in Twitter it doesn't mean anything in fact the only people who who get some profit from paying this are scammers right so it's very logical to to pay for this if you're a scammer so the next

thing is that they invited him to a telegram Channel they offered some things and they said hey uh come to this slack Channel where we can continue talking and we can introduce you to our clients when he went to this H slack Channel he got a sever error right and as we can see here uh the real um invites for Slack are like join. slack.com and this this was app. slack.com but what happened after this he had that uh error and they told him hey uh yes this happened last week to someone and we found the the way to fix it here and they sent him a link from

Reddit and this link had lots of abouts lots of comments this this and that and it explained in detail how this should be fixed so he went to in part of of this it said that you had to go to this website to update some driver he went to this website checked for update downloaded the driver and obviously it was malware gone and um so about this it's it's very common for security researchers or people in crypto to not use antivirus not use firewalls not use anything because we say no we are we are sophisticated we won't click any link we won't download anything I do not believe

that uh I don't know if you know Objective C but Objective C is a foundation that develops many products many security products for Macos one of them is called tax task Explorer this will check all the tasks that are running your computer H with virus total and if you have something infected it will detected then you have Lulu that is a firewall so basically if you are ever infected when the malware tries to steal information from your computer this will this will stop it and then you have knock knock and block block that basically what they do is they allow you to detect a

malware that has been installed persistently right these tools are very very good H I recommend to have them all and I also recommend this is something that most of the security researchers don't agree with but I think that we should all use antivirus like some people say oh no but you use aspery is is Russian or you use malware bites and you you must give too many permissions to this to this antivirus and they could have complete control of my computer I never knew anything or that's my experience that had an issue because of installing antivirus but I knew thousands of people that had issues because of not installing them right um this I will show it a bit fast

but something also very important is that there are lots of targeted fishing very targeted fishing for example this one in E Denver was H ether F even Bri account was hacked and one hour before the event they sent a message to everyone going to the event saying that you had to me your nft pass and the link and the amount of people that got direct there was terrible then the same thing happened to Tresor when they hacked their their uh newsletter system and they sent an email from Tresor that was validated from their servers and everything but it was fake and they are also doing this ER when they mix databases for example from The Ledger Le

coin market cap or other crypto uh newsletter or systems and they uh then use that to to Target us so the important thing to know about this is that the attack can and will come from a trusted Source right it's not that it will come from an email that seems to come from Treasure but it will come from an email that is really really treasure so we have to be very very difficult very careful with this uh well lastly some things H that I recommend also for for conferences there are many people that have been H robbed or hacked during conferences right so some things that I recommend first of

all this is not for conferences but for physical security storing SE phrases in paper is something that is always difficult because you store it in some place and you don't know hey could someone have gone there and seen it if you use these anti-tampering bags they are very very cheap you can put your seed phras there and if anyone ever wants to see that they will have to break it basically so this is a very simple and in my opinion a secure way to store them then hotel rooms uh I think it's very important uh more if you are like if you're the founder of a big defi protocol or you are a signer for an important multi or a security Council or

whatever physical attacks could happen so whenever I I leave my hotel room I use this free app called Alfred camera you can turn any old phone into security camera you leave it there and if someone goes into your room you will get a notification and it will be recorded in the moment very very easy to do and the last one is faray bags basically H I always bring this to conferences uh you can put your computer your your phone or any electronic device inside here and there's no chance that it's will be hacked during that that moment so to finish some things that I really I'm really convinced of but most

people H do not agree with me eventually we will all we are all going to fall for f fishing we are going to click a fishing link eventually like people say no no I'm sophisticated I don't click anything whatever we will eventually we will click on a fishing link so that's why it's important to have for example a 2 FAA with a yuiki eventually we are all going to be social engineered too right and eventually we are all going to download some malware in some moment we are going to do it so that's why I think it's important to have tools like antivirus or task manager or a firewall to to stop that and the last thing as Peter was saying H threat actors are closer than we think

right I am convinced that some of them are even sitting in this uh conference room right now so we we should be very very careful with the information we share and with the with the things we do in every place more importantly and more specifically in crypto conferences so that's it many thanks all right thank you so much Pablo time for one or two questions anyone has any do you have your phone in the Faraday

bag right now sorry do you have your phone in your Faraday bag right now like do you always carry it around with you yeah I have it there in my I'm impressed it's a small it doesn't it's sorry mine's a trolling question too I've got this really big airdrop that I got to get right now and all of these different you know protocols and procedures that you put in front of me are preventing me from getting in my airdrop how yeah I'm telling I'm like making up an example use case right of when I might want to be able to initiate a transaction immediately on chain right but all of these different you know processes that you're putting in place

is slowing that down right why why why are these tools preventing you from getting the airr I didn't get that because I want to do it quickly I want to get it rapidly let's say that there's a specific like nft drop that I have to get before you know it all sells out right right happens all the time in your examples that you've kind of shown us right now it there are a lot of sort of steps that I need to take to make sure that I'm secure how do we get to a world where I can get whatever my mint is as fast as possible while also remaining secure I mean most of okay most of this stuff can be done before like if you invest good time in in in having a secure environment and having a good

upset from that on from that moment on you will be able to operate in a more secure way but even uh even when you have that I think that trying to do things fast is the best way to to to be hacked to be social engineered and to lose money because they it usually they they leverage from that that right like this are drop is right now and you try to do things right now I I prefer to do things a bit more slower but to keep my Capital basically and the and there are things for for airdrops and all that is to try to to to compartmentalize right to have many different wallets different browers different users as a minimum two computers and with that you you also

make it more difficult to be to be hacked but anyways I think that you can do things pretty fast but paying attention if you try to do it fast and you're tired and it's late and you're doing it from your cell phone in the car perhaps you're you're going to be wrecked okay okay thank you everyone please give a big hand for Pablo [Applause]