Web3 Security is Embarrassing: Why We Can and Must Do Better

Transcript

okay cool uh yes I will really tell you how I feel about this uh this is my talk wave3 security is embarrassing and a very small text that you can't really see why we can must do better um so a little disclaimer at the beginning I really love security like I go to a lot of security things I always have people who are like oh I enjoy bouldering and cooking doing other things I don't in my free time time I also enjoy security so I do security at work and then I also do security for fun I also love drama it's great that's why I work in crypto um I will definitely be able to convince you why you should watch Survivor if you do risk assessment uh and I also love ranting so that's

likely what you'll get here uh okay so who am I the Alias I usually use is Andrew Mohawk you'll never figure that out why I pick that uh it's because I'm very creative uh no I picked it when I was very young and now I have to deal with it so uh my background is I worked at bovo for 10 years we built multigo uh then I did instant response at bitmex I set up inent response and detection response at Robin Hood then I was a head of scw at Unis Swap and now I'm at uh privy and big shout out to privy for letting me do this talk after a month there are embedded wallet company and my talk is about to rage about wallets so that's really nice of them uh also part of the blackout review board and I've

been part of SE for a while now okay so it'll be a short rant in four parts it's short because this is the longest slot we have if there was a 2hour slot I would fill that up um so start with web 3 it's obviously web 2 plus one I'm really good at maths that's how I figured that out uh if you take like the traditional Web Two stuff our connectivity the things that we add on that are like really functional here are it's inherently more financial right everyone is using it to uh you know do things with assets that that have value so obv has a much higher returnable investment for attackers um and then there isn't really a safety net of providers like we see in

traditional web to like especially in fintech so you have a user that directly interacts with a chain or with crypto rather than saying oh it goes to a bank you know if I if my mom takes her card and she tries to draw all her money out in an ATM the ATM is going to be like whoa you should go to the bank but if she tries it in crypto just getting she W then it will allow her to do it uh it's obviously digital so there's 24hour coverage and whatever you do you have irreversible actions so the first part is we are genuinely failing our users like it is Security's job to keep everyone safe to make sure that people make safe choices and we are losing to uh I don't know if you can see that on the slide we're

losing to ransomware there's more there are more funds being lost from fishing than there are from ransomware how can we lose to that that is always in the news that's terrible um then also we have uh 314 million lost in fishing in the first half of 2024 these numbers are crazy uh so we should all feel embarrassed then also drainers are really cheap and easy to find you can go on telegram there's hundreds of them um this one is like $600 for f fully featured drainer you don't actually need to understand crypto at all so they will help you set it up they will teach you to go through Cloud FL they will tell you how to deploy it uh they have automation that

will help you and they also have redundancy so every now and then they get they get banned from telegram or the channel gets banned and they very quickly can communicate with all the people who have made purchases and get them into a new channel um I mean that's a lot better than most crypto companies that I know sorry the App Store is also rif with fake apps uh so it's really difficult for us to get our real apps in there and I think this was the part where I was like wow we're really losing uh so when I was at Unis swap there was like a fake Unis swap app that was in the store and I was like well I got some free time I'll take it apart I got the IPA decrypted it uh reversed it and inside that IPA was just a web View and it opened up and there

was just this big text at the top that said ENT seed phrase and then there was a big block it was a text area that was it and then there was a button that said submit I was like this person did not even skin this like this is in pink there's no logo like I'm losing to someone who literally went through like an HTML tutorial uh a few days ago and you know they're making millions of dollars so but upsetting um then also obviously we have dependency issues uh you know more recently uh with the L files but also like we see it regularly on mpm we had The Ledger connect thing but this is something that we don't see in web 2 like when the last time Robin Hood served up malware from their core site uh or any Financial place I can't even remember the last time that

happened uh also I'm not going to into to Smart contracts there's lots of attention to that a lot of your Auditors you're great at this also every single workshop at def5 security Summit is about either smart contracts or evm except for one uh so a lot of coverage there it's also outside of the scope of this talk and if you're old like me then this is a layer eight talk um also really good at graphic design uh so I've uh carefully crafted this that it's going to get worse okay so we still at the top your daps uh so daps obviously the crypto applications they're the pivotal point between the users and their wallets and the providers in underlying crypto okay you have a responsibility to your users if

you build something you should know that users are going to put their life savings into it right you need to at least turn on logs I've been in way too many incidents now where we'll get there we'll be like oh something bad has happened I also love incidents cuz it's drama something bad has happened I'll be like oh great let's get the logs let's have a look no logs they'll be like can we turn them on now unfortunately time doesn't work that way so you cannot also if you application does really well huge application dprk or going to try and uh cause some trouble steal all your funds that sort of stuff uh so it's really important that we help our users right because you're a super high uh value attack vector and I think one of the core things that we always see is that we need to do web

two before web 3 right we don't have to speedrun all of the web two security problems like they have solved some things we should just take those and move on from there um and then our goal should be that if we're building things we should be trying to help users make safer choices that are easier and that they want to make like you don't want to tell them hey if you need to sign something go to the roof have your em shield on make sure you type in your password into your Ledger every single time you need to go to openc and say oh I'm signing in like that would be ridiculous right sure it is more secure but it's unusable um and I think a good example of where it has been usable is like the UB keys and pass keys and also I'm a

webo maxi so if you don't believe in that come find me I will convince you uh then the other thing is also is like it's not externally facing only right if you are a group of Engineers even a small team that's running something please just get a password manager and either use UB keys or pass Keys like that will cut out 80% of the risk that we see um and it's it's really important like you're taking care of people's funds you should do this then of course you need to secure your code you write code let's secure it so if you have the money get an audit of it okay we see places with like seven smart contract Audits and zero front-end audits it's really important that if you're going to let users interact with

your things you should order all of it right if you don't have the money you can also use something well I guess even if you even if you do have the money you should do this anyway you can go to the Frameworks right Frameworks is great has a lot of like the foundational things that you'll need um you can see there I got at the corner repository hardening cloud provider hardening these are things that you want to do anyway um then I'm going to go on again about this please turn on logging so if you're looking at like your risk assessment you're going to say what are the things that are going to totally wreck my company those are the things that I'm going to try solve first and then you're going to say like what are the things that will totally wreck all my users I'm going to try solve those

but actually what you should do is at the beginning turn on all the logs right make sure that you have logs of everything that happens just put it in a database it doesn't really matter um and then you can try and solve those things that are very critical because in the event that something does happen you want to be able to say like okay I can see what happened I understand it and I can provide like a a fix that this doesn't happen again right um so I think that's that's really important then obviously you want to do the secret code independenc scanning okay you can do this for free there is no reason that you shouldn't have this on by default all of these things will integrate with GitHub whatever your cicd is um and you can use the free versions if you're making something that's open source all

of them are free so truffle hog will find your secrets and it'll find it where you know you committed that key and then you were like oops and then you write a a commit over it and then you're like great no one can see it um you will everyone will find it you just run trule hog you'll get it I found one in a very large F project last week um they can use soccer. they do their dependency scanning for JavaScript things really good they'll be like hey this package suddenly has network access or this package suddenly has new Authors um you can also use uh sneak code for uh scanning code so they'll be like oh there's a vulnerability in the code that you developed this is how you should fix it uh then the last thing is plan for when and not if so have a big red button

that says I'm disabling everything right have a plan that says like oh if our front end is compromised and the CTO is on a plane we don't wait for him to land we can still be like hey this is we're turning this off right practice rotating credentials CU so many of the attacks we see are people who have like left the company had those credentials from when they work there and somehow leaked them right you should just be able to rotate credentials always um and we see a lot of these okay then also you should promote good engineering and security culture so if you're building a Dap and this is one of my favorite uh models that we have at privy is all engineering is security engineering right whatever you are building users will use it will be have a financial impact especially if

you're obviously building Financial applications okay now we'll talk a little bit about providers um there we go so security is kind of like an arms race okay everything is hackable there's nothing that's unhackable if you give me enough time and money I'll break in um you just need to make that bar you know higher what we want to do all the time is like make it more more difficult for attackers I don't want to see them make a text box next year um but one of the things that's really difficult is to try and get providers to to change right because usually you don't have a choice if you want to have DOS protection you can't use anything but Cloud flare basically right they provide the best service um so you're probably going to use it but the only time that you're going to get a

provider to make any changes that you want or to add anything to their road map is during renewal season okay so if you're a company and you buy from a provider just wait till it's renewal time and then be like hey what are you doing about all those web3 fishing sites um so that's the best time please if you have that do that okay as part seal myself ampled this uh block list it's like a mamas block list that we update automatically by scanning for stuff so we can try and catch drainers ahead of time um and now it's Sam and others and tiny bit of me um and that you'll see like when you get the red window that says like oh a deceptive s so what I did was I went to look at all the all the domains and all the things

that we've put in there and I say okay well who is hosting this who where are these registered uh so we have like some stats about it there's like 226 uh th000 uh 173 still of who's data and 127 you can still get to like you can BR to those things still which isn't great uh also it's very difficult to do 220,000 H's requests and my girlfriend will be very angry if I got a house banned from the internet again so uh I reached out to some people they hooked me up with uh who is XML who was super nice and they were like send me a CSV that's you know two 200 Megs and I will send you back the who information which is really cool um so then I built some scripts I mean just kidding Claude built some

scripts I ran those scripts so I have a lot of job safety um and here's what you'll see so this one is the most important one I basically have this whole section so I can have the slide um clle hosts 68% of all fishing sites that we have seen everything that we've seen for uh like known bad they host more than half of it and someone brought up like oh but maybe clle does you know more than half of the Internet it's like okay but in their Q3 report from last year they said they do 16% of the internet so while they only do 16% of the internet they are hosting 68% of these uh malicious domains uh and they again clly please reach out to them if you use them during your renewal time awesome what they're

doing uh they also also have a way that you can uh submit but you can only submit one domain at a time and I'm going to tell you that if I have to submit 128,000 domains it's I will kill the computer before then okay regist is kind of the same thing uh they're a little bit more diverse um and I have the data if anyone wants it afterwards Twitter they're going to give away your account 100% if you are worried about this you should be plann for it already follow the seal guide to set up Twitter but at some stage know that that is out of your control uh they almost made a really great thing where they said we could disable links and replies which I think would have made the biggest difference in crypto to anything I could ever do but they decided against it 18t

and Verizon these places suck they're doing our Sim swap protection really badly they've been forced by the government to do something and they've done the bare minimum so adding a note to my account that says hey if this person phones to have a SIM swap ask them if their dog's name is Sandy and if I say yes then great do the Sim swap that's not any protection so that's really annoying um and if you are worried about this move to Google F it's basically the only choice you have your sim is locked behind your Google account and your Google account can be locked behind Hardware tokens or par keys so you don't have to worry about uh Sim swap okay now my favorite section oo we're running out of time wallets wallets obviously like evolving rapidly

I'm going to be mostly talking about the extensions um and they take like I guess the the complexity of the underlying crypto they make it easier for us to understand right they have great UI and ux uh they have cute animations and sound and colors and it's really easy to onboard to crypto with it uh Unfortunately they don't have the same guarantees right because you can't say like oh I send all my money away and someone says Whoa is that what you want to do like you have to go into the bank to check that no obviously that's what we want we want to be in control but you know we lose some of these guarantees okay so then I was thinking about wallets and I was like well does a wallet know if I use it it's on my computer it knows where I am right now

it knows my IP address it knows my time zone all of that stuff it knows where I connect to because I've clicked connect and the wallet was like hey do you want to connect right it knows where I connected to before because I used the same thing so it knows this right it also knows who I sent funds to so if I send funds to andrew. eth you're all welcome to do that that's no problem um it will remember that okay and I understand there's like a spoofing thing I put a little star there and they also know what you usually do so they know like oh after 5:00 p.m. you go to pump. fun and just buy every meem um so these are the problems that I have with wallets the first one is look alike addresses so this is an attack where an

attacker will see that you've sent money to some or send assets to some other um account they'll pregenerate a public key that looks similar to that so like the first four and the last four digits are the same um and then they will then they will make it seem like you sent money to that address then when you go to send money again uh send assets again you'll click on the last one that's the malicious one okay you've sent all your funds away um I spoke to someone yesterday who was like this has happened to me this week um in this list you can see that the very bottom one is the rocket pool transaction that they did and then all the ones above that are just malicious actors trying to get their their cash uh most of the wallets in terms of protection will give you a

popup that says hey you've never sent this address before okay the odds of you finding a dress with just the same first four and last four are one in 18 quadrillion I promise wallet you can just block that just don't let that happen you have all the information and if you hit that if you hit those odds I will buy your a hat okay I will buy a hat for every time you get that um do we have similar URLs like let's say you were like o I like unchain I went to un train.org the wallet knows where you connected to it knows what you've done if I connect to UNI chain.

toop it should be like hey this is pretty close to something you connected to before but it's not the same like maybe we shouldn't let you do dangerous actions or things that are sensitive right and you can solve these problems pretty easily this is well documented in web to we have lots of stuff like the Levenstein distance to see how close they are together we can have a list of known good domains we can do an SSD Pat against uh good domains and say like hey this side looks very similar to one that we use it connect to that's worrying uh we can also look at domain age so if the domain is one day old just don't let the user connect to it uh it's it's crazy uh then we also expect people to be Crypton native which is kind of like the equivalent of when security people

used to tell everyone that they need to check the headers of the email I promise you if anyone checks the headers of every email I will also buy your hat apparently this is my go-to now I'll buy hats um but if you look at that like no one is going to understand what is happening there even if you have it as you know text it's put out the form it says get my money and a recipient address you can guess what that does but like how are you possibly going to understand that um then understanding the permit permit two and approval flows I promise you my mom is never going to figure this out uh there is like a huge page it explains it really well it's really nice but there's no way my mom will figure that out um if you love your mom I love my mom then you wouldn't let

her go on Twitter with metamask right now right you know that she's going to get wrecked there are loads of like scams it's super easy without that um you know without any any training that that will be the first crypto experience that someone has is losing all their funds um what I really want is this thing called Mom mode this has come up before uh where it's a safe mode where I can say hey here are all the daps that I approve that are good I want these to to be the only places that you can connect to okay because if you have that then I know while my mom's prob going to lose her money on shitcoins but at least she didn't get scammed and I won't be embarrassed okay cuz that's my job so so that would be that would be bad um

wallets don't warn users when things are unexpected so if you are draining a wallet you have to do multiple transactions like you need to do an approval and then you move the funds you have to do it for each asset type um there are some intricacies there but W it's never warn you they never like hey all your usdc just left do you want to do something about this maybe we can have like a a backup plan of this seed phrases these are terrible we suck at remembering passwords we suck at keeping things safe this is just a combination of two things that we're bad at um for seed phrases there are alternatives so this is the one slide I got to say put the company in so that's great see I support them uh if you use something like privy or some of the other embedded

wallets then you can sign in with things that you know before like Google Twitter you can use a pass key so you can just sign in with your pass key and get it every time you don't need to send uh a seed phrase across and the other one I really like is how uniswap handles the from your mobile wallet to the extension when you install the extension you can scan a QR code it will then do an OTP and it will verify that you're on the same land so you have to be at home you know if an attacko is in your house like you've got other things to worry about but at least here like we have a good way that I didn't have to copy a seed phrase put it somewhere you know copy it again okay loads of improvements oh I'm way out of time so webo and pass Keys

it's fish proof authentication we've got to have this like we can solve fishing there is a solution to it allow listing mom mode I love this High net worth individuals like we see people who get drained for millions and millions of dollars but if I'm a high individual and I go to a site for some reason I have millions of dollars in this scenario that would be great if I go to a site and it wants me to interact then why don't you just spend up a new wallet for me it takes no time I will pay the $2 extra so that I know that the rest of my assets are not at risk um we don't I don't see a lot of emergency buttons like revoke all or I want to move all my assets I feel unsafe about it um and then rethinking their approval

flow so ux people are incredible they're super good at what they do let them do it um and then of course clear signing people need to understand what they're doing I know tons of wallets already do this and you're the best I love you long time okay security this is my last one oh I have 18 seconds it'll be fine security folks need empathy so I think that a lot of the time I see that real people get scammed and people are punching down like don't do this this is really hurting uh the industry uh people are going to you know feel ashamed uh feel guilty they're not going to want to say oh this is what happened to me without that information we can't make security better right this is something in a thread uh that was part of someone

said you know what's sad is I know a victim they sold their house for a scam and then another person said well you know what's more sad is that I warned the project seven days ago I promise you you warning the project seven days ago is not more sad than someone losing their house um they not security folks should dog food like security advice is difficult um but if you want to give out security advice I expect that you are doing the same things if you say oh you want to put your phone you think everyone should put their phone in lockdown mode run your phone in lockdown mode not everything works I promise you my phone has the worst rendering of all websites you've ever seen so understand what the difficulties are like do you have a hardware wallet do you sign every transaction if we're giving out

suggestions you have to be able to run this yourself um and also being able to run it yourself means that we can work on good and workable Solutions cuz you need to be able to use it as well oh okay security folks should also support people so call a good security work if you see something that's good be like hey this rocks you're awesome I love this like we don't only need to be like wow these people suck um then also share your knowledge so people are very hesitant to share their knowledge they have like they know a huge amount about something and they'll be like but if I share it then people will steal you know my credit and the place that I can be in I promise you that one blog post will not steal all your knowledge and then you will lift up other people and you

have a chance of like expanding it uh then also you can submit a bug without getting paid a million dollar uh okay so that's the end let's make crypto safe enough for Andrew's mom that would be great thank you thank you so much Andrew I think we do have uh time for like one question anyone why don't Cloud play take down those demand oh no someone does have a question I was going to ask it's fine really love your comments on asking all the developer and the DF like enable locks but one thing I do want to add as a comment is that based on our

experience very often people didn't pay attention to protector locks and also didn't pay attention about what put in the locks so that actually are some of the you know vulnerability of security risk we have found before so uh we really want to hear your suggestion of how people should you know pay more attention protecting their logs thank you cool um I mean I I think that if if you're looking like the uh extension wallet side or the the application side then I think the main thing is that there's a huge push in the industry that we need to get out features fast people need to deploy stuff as quick as they can we don't spend enough time being like okay how does this work do we have unit test for everything that makes sense

um and I think that calling out like hey here are some things that cost other companies in similar positions this much money and losses like is why you should spend extra time but mostly I think that it's it's just a time thing discussing with the dev team I find is really good I'll be like all right you're all criminals now tell me how you're going to break in they know the code better than I will ever know the code so um a lot of that stuff really helps I think like you know normalizing normalizing that thank you so much Andrew uh thank you all for being part of this session