From vanity to poison: the evolution of address poisoning attacks

Transcript

[music] [music] Oh, so hello everyone. Uh, my name is Tommyo and next to me is Varyia. We are from >> Okay. Next to me is Varyia. We are from Safe Wallet, Berlin, Germany. So today our topic is from vanity to poison the evolution of address poisoning attacks. So for me I will give you an overview about um what is address poisoning and how your asset is lost because of the attacking and then warrior will give you an overview

about how safe wallet will protect your asset from being attacked. So talking about address poisoning uh we have two very popular attacking model. Imagine the first address is your safe. The first attacking model is the attacker will create a very similar safe address the first address and then at you as owner if you're not careful enough then you transfer your asset to the second address then your asset is lost. And then the second very popular model is that uh the attacker will mimic your your um uh the address you always have

interaction with and transfer a small amount of money to your account. Then you copy paste address from your transaction history. If you're not careful enough, then uh your asset is gone. Uh so uh it's very easy to create similar address. It only needs several minutes by a very good GPU and uh every year there are a lot of lost and uh yeah we found initially the attacking model is very easy. The attacker will use one factory contract to create thousands of saves and it is easy to tracking. So we just block all of the saves and then it gets involved. So the attacker will

create one save by one EOA and passing the files to another EOA for uh yeah then it is hard to track but we still have the solution from our safe wallet. So we just block all the zero value transfers, fake tokens and dust transfers from your transaction history and then I will give the microphone to warrior. [clears throat] Hi everyone. Um yeah thank you. So, safe wallet has several layers of protection and our pro users get the strongest protection against address poisoning. For example, here the user entered the address that looks very similar to the one the user already has

in the address book. The first four characters and the last four characters are the same. And on the right hand side uh the user gets an instant risk detection and a warning with two addresses put side by side. So the user can make an informed decision if uh they want they really want to transfer money to the address they typed. And also there is a couple of more hints why this address could be malicious. This address has a few transactions and the user is interacting with the address the very first time. So it is already suspicious and this address is not in the user's address book and also um on the safe pro level users get extra checks from our

partners from locate and hyper native. So on the transaction level the user gets everything in the UI and can read everything and can decide if they really want to um send any assets to this address. Another layer of defense is on the accounts list. So if any similar addresses are detected, for example, um if someone added this user as the owner of a safe and the safe is malicious and similar to the safe the user already owns. We show it in the UI and put these two addresses aside um next to each other so the user can compare the full address and not only the first and the last characters. So the address is not

truncated. Uh it's a bit it's blurred for the presentation purposes. And um the same goes for the address book. If the user wants to import a single address, then there is a warning that this address looks similar to an already existing address. Um and the layer protection on the bulk um address import is similar. So if there are any similar addresses in the CSV file, the user wants to import, we get the warning because the CSV file could be tempered and um under the familiar name, there could be a poison address hidden.

Um yeah, but as already mentioned many times at Defcon and uh from Nick in the previous talk, the weakest link is always a human. And um there are simple rules how we can protect the transactions. So first always check the full address, not only the first and the last characters. Then name what you trust. Add your familiar addresses to your address book and stop at every warning. If something looks suspicious or if the UI gives a specific warning that this address might be tempered, stop, read it, and make an informed decision um about your transactions. Thank you.

[applause] Thank you very much. Okay, we have a little bit of time for questions. So, if you have a question, please raise your hand and uh look [snorts] out for a box that will be thrown towards you. Okay. See one over there. Yeah. >> Yeah. So, I was wondering if you like I usually see this if you go to Eper Scan with your safe and you have like decent amount of money, there's a lot of fake transactions that are like that look like they're incoming uh or like no instead they're like they look like outgoing transfers of like a copy of a ERC20 token that you sent. So there is

like an original transaction of you sending let's say 10,000 USDC and the second one that looks like an outgoing transaction which goes right after it. Could you tell us like if you study different methods of address poisoning because like incoming transactions are very easy to spot even if you look at efforts how do they like forge outgoing transactions? How does it work? >> Uh you mean the transaction is coming from your account? It looks like it at least and every scan and this is like far more complex to like to understand. >> Okay. Yeah, I think yeah I think for for now uh I cannot answer this question.

Maybe I I will need your uh safe account address and I can I can check it for you. >> Yeah. Okay. No worries. >> Yeah. Yeah. >> Okay. I I'll see you after. >> Yeah. Yeah. Yeah. Yeah. Cool. Welcome. >> You know the answer. >> Okay. We I think that will be it for the questions for now. We just have a few seconds left. Um, but please come up and and approach them for questions afterwards and I'm sure they'd be happy to answer them. We'll just have one minute and then we'll be [music]