Web3 Security: Revolution or Evolution of Web2 Security Principles?

Transcript

good afternoon so looks like uh people are trickling in after a good lunch um so hopefully we'll keep this interesting and uh interactive at least definitely want to have uh the audience ask ask the panel questions um let's I don't think the people here need introductions they've been giving talks multiple talks and multiple panels but we'll do a quick round of intros I'll Kickstart it I'm Rajiv I've been a security researcher uh my whole life founder of secum one of uh the organizers of DSs and uh really trying to get the community rolling and this is a topic that's really um close to my

heart um because I've been doing security for a long time so what we could have renamed this panel multiple ways but what we really want to talk about is what are we doing with web3 security right is it are we really trying to reinvent the wheel or as Andrew said it you know we shouldn't be speedr running all the things that went wrong with web 2 in the web 3 space so that's that's really um the goal for this let's look at sort of all the historical things what went right what went wrong can we learn something or should we you know really restart that but before that quick round of introductions uh by all the panelists here okay I'll start I am Pao saatela paito I'm a SE 911 contributor I founded

obsc where we do operational security Audits and trainings for we3 companies and I have the blockchain security series podcast and well H operational security is is my stuff I like I I I enjoy hacking people more than systems that's my my stuff uh hi I'm Andrew I did the talk two sessions ago uh I previously worked at bitmex my crypto experience and then Robin Hood and then Unis Swap and now I'm at uh privy doing a better wallets I like all factors of security and mostly my goals are just not to be embarrassed a lot of the time not to look really

dumb in front of my other security friends um so that's my motivation for doing security amazing so I'm Anto uh I work as a principal security engineer at aenl uh previously in my web to job I've done Hardware security mobile security Android that kind of thing and I got into coinbase so that was my first crypto job uh did base and now ion ler so security has always been my thing love breaking things and uh trying to fix as much as I can hey everyone U May co-founder and director of Sigma Prime we're a blockchain security and research

firm doing a whole bunch of security stuff across the entire web three stack uh we're also the founders and maintainers of Lighthouse ethereum consensus client responsible for a third of the ethereum network today my background is also in web2 security I've done a bunch of pen testing web app security assessments and so on red team engineering uh social engineering and whatnot so yeah Web Two security is a concept that's also really really close to my heart and Keen to dive into this hey everyone I'm Peter kinsky I'm at coinbase units z x team I'm also the editor of the blockchain thread intelligence newsletter I had a lot of web two experience in the past anywhere from malare reversing exploit writing red teaming blue teaming just kind of keep

on hopping security jobs so so Web Two is fun but web 3 is even more fun fantastic so I mean as you've heard right so we've fantastic set of panelists who been around way further back than than web 3 so that's that's really the the motivation for this panel but before we kick things off right just just some fun historical facts for for those of you for those of us who are are new to sort of web 3 security or even for those who've been around for web 2 a lot of these things are not new right Fact one the first message that was sent on arpanet right the the predecessor of the internet the first

message that was sent from UCLA the university in Los Angeles to Stanford SRI yeah we see some hand pumping um so that crashed the machine on the other end right so there was actually a memory it was a buffer overflow it was a memory corruption so they tried to remote log in and the story is that yeah you can look up wikkipedia they started typing l o and before it got to G machine on the other end crashed the bit rate they expected was way I mean they expected was way smaller they had a 10 character 10 bite uh memory buffer allocated but that didn't uh really fit right so the details you can look up so this was

arpanet right I mean this is uh what 1969 I think but of course security goes way before that right I mean ciphers cryptographic ciphers have existed since the Greek and Roman and Indian civilizations and social engineering I mean Pablo talked about it I mean that's existed as long as humans evolved right so this is sort of not new while it may seem like that specifically when it comes to security right some of you may have heard of the salzer and schroer principles so this look it up so this was in in the US 1975 set of I think 10 principles really captures things like lease privilege common mechanism user experience um so separation of

privileges we talk about multix a lot of that has been sort of talked about captured formalized in a different context right obviously they didn't have ledgers back then now blockchains the reason we talk about blockchains consensus security is the bantine fall tolerance bantine generals problem right was formalized in the context of distributed systems in 19 what 78 so things have existed in the blockchain space in the web 2 space in the web 1 space so for a long time right but just want to sort of kick things off sort of level level set ourselves and the audience with how do you guys think about what is sort of web 3 security

versus web 2 security do you sort of compartmentalize it or is it one big thing anyone would like to hear all of you I can it off um I guess I look at web3 security as kind of like a a subdomain of a larger security field like it's a it's a domain specific thing and domain specific knowledge uh we have very unique challenges right we have to think about everything is decentralized wide open to everyone you can't submit a secret to someone without everyone knowing about it um but it's it's almost like a like I think it's a misnomer to say that web3 security is this own this special thing and it exists in isolation and we have to forget about everything else that exists no it's a it's another

domain it's it's it's a lot of fun but we also have to remember all the different lessons that we learned since I guess the 69 not to send messages that crash things we still send messages to crash blockchains and uh we have to learn from that as well yeah um Kos to both of you in your talks for you know sharing with people that web 3 systems are typically deployed on web two systems right and I I'm sick of seeing people get popped because of poor security hygiene that's got nothing to do with onchain activity and solidity and the evm um we're we don't have to reinvent the wheel um um people have come up with great set of

standards that we should all be following I walk around in the conference and I see a lot of people having leaving their um workstations their laptops un monitored and unlocked in a security conference like that's wait I have a problem with this yeah okay hit me I'm allow of controversial topics all the time right yeah yeah how many attacks have ever happened from someone leaving their laptop unlocked heaps uh I I don't believe that there was any of the big attacks left from someone's machine unlocked well that doesn't mean that we shouldn't prevent that from no I agree but I think that security people focus too much on that one no that's one example of um so back back back to your original point of you know being um aware of of of some of the limitations of of our space um I think

we're among a lot of people think that we're amongst friends here um you look at me when you I like we we're friends but this is this is like just don't leave the machines open please yeah this is this is a prime um this is a prime conference for anyone wanting to potentially attack Founders right and back door laptops those laptops will potentially be deploying sensitive smart contracts sensitive systems and and protocols in the future so um yeah so that that's one example one of my teammates said that he even found an unlocked phone in the bathroom today so yeah I think we can do better I'm not saying that like this will automatically lead to compromises of web three protocols but the bar is so low at the

moment that we should all be um you know working towards raising it um and yeah it's a lot of people think that you know oh I've I've gotten 10 audits I have a bug Bounty program on immuni so you know my protocol is safe but not not really not really yeah I I I think uh we see a lot of smart contract attacks early on and now we have gotten to the point where Protocols are getting Audits and it's difficult to exploit may maybe not difficult but it's it's a higher bar to exploit protocols so attackers would probably want to go for the lower the low the low low-lying fruits right so

web 2 like if you do not have your web 2 security down we you do not have to be exploited on the smart contracts you could be exploited in the UI so the recent attack people saw something in in the UI and they signed that but they never verified it on their Ledger devices that is a very Web Two attack it has been going on like you know remote code executions uh so we are seeing more Web Two attacks than web 3 attacks because hopefully we got our solidity smart contract security right now attackers will go on to the next thing which is web 2 so I think we've also seen that in web too so previously there

were like loads of service attack like people would attack is5 for you know days and days because you could just get it to drop shells all the time and now that that security is improved like people have moved like further up the stack or closer to closer to real people um but I I don't really differentiate between the two like I I don't really have a differentiate between web two and web 3 security like it's it's all security it's slightly different um you know there were some like some differences in how it's used but the same would be like if someone was using a completely esoteric language or or there was some other way that we deploy things um I think that the nice thing with web 3 coming in is that we finally have a chance to change some of the web

two things so if you look at web two companies like everyone is very stuck in how we do security like there is a basically a hard and fast rule but coming into alpace like we have a chance to make a difference so like if you if you wanted to be like I'm going to flash the machines every single day before you get to work I there is no web 2 company that is going to going to to go for that but I think that you have a have an option with people uh in the space being like you know like more fresh and dynamic like they're okay with taking with trying new things um and that's that's really why I like it I think that uh especially if you work in absec like you have a chance to make a significant difference um in what we do and like

have a cool way to do it yeah uh I think that well as you have already said uh there's no web three without Web Two And I think that we shouldn't make too much of a difference but I think that that the key thing with with web 3 is that it's much profitable and cheaper for threat actors than going and I don't know stealing credit cards database and then doing stuff with the credit cards so I think it's a matter of incentives uh first of all uh and then I think that a very big issue that we have is that I know banking industry has regulations and they tell them you have to do this this this and that and they

do it and in the crypto industry there's no regulation everybody does what whatever they think that they that they should be doing but we have no processes no standards no nothing there are some things that are being created around that now and I think that's pretty important but anyways we are realizing that that's important because funds are getting stolen like in the thousands H sorry hundreds of of millions so when that happens we say okay we have to to make a change here and another thing that I think that it's very important is that lots of web two attacks that are uh on on defi protocols for example I don't know taking over a domain or a Twitter

account affect users and not the protocol itself and sometimes protocols then don't reimburse users or whatever so some of them don't care too much about their users I think that should change H and that's why they say okay no our contracts are okay we we if there's a fishing campaign that's not relate that that's not our responsibility let's say I think it is uh um but I think that it's mainly a thing of incentives and due to that we are we are paying more attention to that all great points I mean I didn't think we would disagree that you know web 3 and or web two security is not important it's a bit of

an EO chamber right I mean in this room and amongst ourselves uh so it's really to get the word out right so good glad we agree that you know this is critical but we do see that I mean we do have ant of sort of representing the protocol side of things right and uh so maybe just a simple question I mean you did agree that web2 security is critical as well so that's good but we do see that when protocol uh when we say web3 security I think my guess we haven't done a poll the first word that comes to people's heads is audit right and that is smart contract audit yeah Andrew talked about it uh Peter talked about I mean all all of you agree with that so protocols don't have a budget right

for whatever reasons to get a web to to get an infra audit or any of the other things what I mean why is that and what needs to change uh to make that happen I mean protocols pay a million dollar I mean depending on how big your tvl is Right couple of tens of thousands hundreds of thousands goes up what do you think maybe Anto you can sort of give the protocol perspective and we can all chime in what what is that mindset and what can we do to change that mindset I oh did I say Andrew I I mean I can I can do this from so we let Anto sort of yeah take the spotlight first vitim okay yeah so um protocols do spend

a lot of money on audits we we get like the audits from the top security firms and uh we we do not have unlimited budget unfortunately right we I would like to get audits from all the security venders that I met here uh I think you're all amazing but we have limited uh money to spend on these audits so we have to unfortunately pick a criteria and uh go with uh who is the right uh audit firm for the specific audit that we are doing so if you do anything with Beacon chain which we do we would like someone uh who has experience with like a light client or or like a a consensus

consensus client because they really do write that code right so uh we definitely pick our Auditors based on what is it that is being audited but security doesn't stop there uh there is a lot more you can do like we do get infra audits uh we do get web two audits I'm an ABC guy who became a crypto guy so I understand how important it is but there are Stacks that you do not control uh so uh like for example you have a uh X account right like a Twitter account right uh you can do everything right but uh you do not control that platform it's not a

blockchain you have a username and password in a database yeah you can you probably know what can go wrong with something like that right and uh that go around a lot especially in crypto because the incentives are so high but what can you do as a protocol to prevent that unfortunately not a lot uh you can follow all the best practices and and I'm sure like we all have contributed to all the best practices dock here but there is no guarantees that even if you follow all the best practices you won't be popped I see Peter has uh I just I just wanted to point out like I just kind of I'm sitting here and watching you talk about the Audits and how we have to invest you know hundreds of

thousands of dollars and millions of dollars can we just recognize just how much time we spend as protocols thinking about security what do you think is going on in the web 2 world how much do you think a typical Web Two company spends on their security budget and how much time do they think they worry about this cool mobile app they're about to dump on everyone that's going to collect everyone's you know credit card numbers and password and Social Security numbers how much money do you think they spend on whatever security audits just I just want to point out just how far ahead we are and just how much more paranoid we are as a web three industry as a defi industry

just worrying about those things that said we have no choice but to worry about those things because once the money's gone it's gone and one thought that I have is we still have to worry about audits we still have to invest and that and if you saw my talk I'm all about like oh you have to build your Security Programs just teach your teach your entire team to be a security Team every single member of your team has some kind of security role like I don't care if you're a marketing person well now you're responsible for social media security and you're supposed to hunt down the fishing scams if you're a Dev obviously worry about smart contract Cod but if you're infra person freak out about your Cloud infrastructure so dividing up responsibilities may be able ble to alleviate like some of the fear

and just all the load that we have uh as a as a defi industry and a typical defi project which has like five people on it great point so um I'm sure we can talk about so many topics you guys have talked about right private Key Management uh all the things from the web 2 space and the web 3 space right but just sort of to start dialing up the heat a bit right there we go so anyone should we move slow break nothing or should we move fast break something or in other words should we treat web3 security like Hardware

security I know there's a school of thought here that believes that we had talks from a as well on on that or should it really be along the lines of web two software security right where move fast or you break up update upgrade life goes on Okay who wants to take that maybe there a whole bunch of yeah so so there is the need for security versus the need for uh product Market fit right right like we can move really slow but uh your competitor might just go all out and uh there is always that first mover Advantage which is a

very real thing and so you cannot just sit back chill even if you look at Hardware security sure they go slow and they still have bugs like how many micro code updates have you applied to your Intel processor very slow process right even Apple M1 chips they have bugs that can never be fixed so moving slow doesn't mean you don't have bugs you still have bugs I think you should design your protocol to localize your failures so the whole thing doesn't blow up but like localized failures so you can move fast still have localized failures which

is I believe more of a practical approach then of course you should do your Audits and all that don't be irresponsible with that but you have to also understand that you have to ship yeah cool can I ask a question just following this how about uh capping deployments that's something that I've seen some of our clients do when they don't have the time to um perform all the due diligence that they want to perform before going live they could potentially cap user deposits at like let's just say a few hundred worth of exactly would that be a good good strategy in your opinion yeah yeah localized failures right that is exactly like capping deployment guarded launch few tokens have a certain T exactly

exactly incremental stuff yeah I think there's a a like when we're talking about like fast or slow a lot of people see like security as a blocker for deploying things and I think that as like security practition is everyone needs to realize like one you will never be a good engineer like I can make any engineer a good security person but going the other way is very difficult um and then also uh you know normal devs are paid on like the features that they release things they get they're not paid on how secure their code is or how well they did in an audit so every time that you stop them and be like hey you need to do all these things and make it slower like you're literally taking from them so you need to have a lot of empathy I think to be like okay we can

find like a middle ground I think that like empowering the the development team um you know is a good idea and the you know the B metric is like people will rear to security I think that's the that's how you know like your security is making a difference cool all right so I I have a few of these yeah just one more thing you can also do other things right like you can still move fast as long as you think of like compensating controls for example you deploy your contract really really fast and you're scared that you may get hacked but if you build some kind of functionality that can allow you to respond to incidents either automatically or at least fast enough you can kind of mitigate or control how many funds you're going to lose in case

of a hack so if you have a system that can just pause the prot protocol right away just a second you see the funds started moving or one of the volts is getting compromised you can kind of speed up the process maybe a little bit if you have like a faster incident response program built in you can you can kind of speed things up a little bit so it's a game it's a balancing game that you're always playing like how how much do I invest before the deploy versus like how much how many controls I can build after deploy and that can allow you to maybe take slightly more risk than you normally would yeah absolutely I mean so that's a great segue to the next question right I want to I want to come back to because I forgot to add

something to your question before regarding budget and what I have found because I I offer this operational security trainings and audits is that it's not a matter of budget but something that I see is you know this concept of security by obscurity many companies have a very shitty obsc but even with that they say no we don't want to we don't want you to audit our computers or our phones or for example devs devs hate to be told to be to have to install something in their computer or to be told that you have to do this in this way and this way they don't want to be told that it's very difficult to convince them to to do it in the end we can do it most of the time but it's very difficult and then they are think of no

I don't want you to know how we have our setup right and the reality is that you can get to know how they do it anyways without them telling you but they have this idea that we have known for years that doesn't work of security by oburity you know I won't tell you what software we use which are wallets if I have Windows or Mac or Android or Ledger or Tresor or how I have config my twwiter if I have a u key or a Titan and they think that doing that is far more secure like no no no no we don't want you to know anything if you audit us you will know our setup and you will be able to hack us right so this is literally sort of speedr running the web two thing right of we don't want to reveal anything

right you may attack us yeah the whole yeah so this is this is a great Segway so there's a lot of surface attack surface to cover right I mean web 2 web 3 you know add them up web five I don't know uh but obviously we constrained right time bound budget bound awareness bound all those things so if you were to pick I mean the question is what's the weakest sling in vet 3 Security today you think it's software sorry it's fishing humans fishing okay yeah so software Hardware you're working with wallets right or is it really people wetware I I think that just maybe we can to answer

that huh yeah you literally had to talk about that yeah I I think the number one is so engineering conf mixed with fishing and with malware that's number one I think so people yeah yeah people people yeah Andrew I mean I definitely think it's it's people as well I think it's it's you know things like oh people were like oh we'll do fishing training but the data says that fishing training doesn't work spend that money on buying UB Keys you solve this problem like is it is a solvable problem that we somehow have still MH which is very frustrating yeah I I love that cuz things like Pas Keys is actually better than fishing training you know like a decent solution and I think we need to do that for

wallets too how many people understand what is a private key like like you know it's it's a very Niche thing to understand or should they even need to understand exactly exactly it's even in the name private key private they should be private yeah right but oh yeah yeah you know people write their passwords on a sticky note and they put it on their computer right so they this is like difficult for them to write down the full private key you know what I mean we they shouldn't be doing that like we can name them whatever but just having a user custody a private key do that whole Ledger thing is probably not the way we'll get Mass adoption we probably need something familiar ux like account

obstruction right and then things with things like pasis maybe the fishing will go away web 2 has been trying to solve fishing forever and ever since they invented browsers we've been trying to solve it and it's been like what 30 years or something now yeah it just seems like it's much worse in web 3 somehow yeah because there is money involved right yeah so yeah no I I can't can't disagree I think humans are always going to be the weakest link of the of the chain as Pablo pointed out U but I also strongly agree with Andrew I think it also highlights failures of the security industry I think we should all Thrive and aim to provide tools that are inherently safe for users to actually

interact with and we've done the shittiest job of that I think as an industry over the past 10 years that we've been doing this stuff um yeah your your talk Andrew is just I was just watching you and be like amen please everyone hear this um yeah but I think humans are always going to be the weakest link um I like a quote from um morelan from optimism who said you should design your processes so that even if you hired 49% of DKR agents are still you know resilient to to actual attacks um because you know I don't know if you have plans to talk about this particular topic but um it's it's

certainly uh a thing right like we we're all being actively targeted by that particular threat agent um and yeah um you will most likely hire one of them you know within the long run you'll fall for that so it's about tweaking your processes so that even if you do hire some of those malicious actors you're not effectively going to get popped to the extent where your users are going to lose their life savings so we need we need a honest majority right bft at the dev level really is what I guess I guess um yeah it's a it's a complicated um topic but um I think optimism for once for like they they've set up set of guidelines that are perhaps worth sharing and following um and one thing

to add with that uh is that apart from from saying okay I have a North Korean guy working at my company I don't know it I think that we should always know even with companies that have more than 30 people that any normal Dev can I am convinced of that many people don't any day can turn evil as as Peter was saying in his talk the other day we said no no but we know these guys who screen and we talk to them there you you never know you never know people are people and that can happen totally so it's the same as people who have an issue with like they're like oh Sim swapping the people who are doing the Sim shpping are terrible so that person earns zero money compared to you and someone was like here's your entire salary all you need

to do is click a button they're going to do it like it would be insane for them not to make that choice and I think that that's what you need to budget for like spicy spicy CH wait that was I have spicy that was good good the food was spicy I think the panel should be exactly St SP we all know the human factor is always there yeah so we're running out of time but I think we've talked about the past and sort of touch the present we can go on but want to sort of talk about the future as well right so if I can request you guys to bring out sort of your crystal balls and look into at least next year you know Peter does a state of defy every year so how do you guys think web 3 Security

will be when we let's say reconvene for DSS 2025 will we still have the same you know six guys talking about the same things from 20 years ago people software Hardware you know or or is is it a sort of a more optimistic future I mean one year is a long time in the crypto industry right I think the future is optimistic we'll still be talking about I hope we're still talking about human the human factor is always going to be there we'll still be talking about this but there there's so much interesting Tech that is coming out which is unique to our industry where we can do so many more things that we could we just cannot do in web 2 for example

I'm watching every every time there's a hack I immediately see Mev bot just swarm the attacker you know the attacker drained one volt and then you have these automated Mev bot basically like draining everything and then saying like it's all it's all happening on chain they're saying oops sorry we hacked your project by accident here's your money back I imagine five I don't know how many years from now probably a lot sooner we're going to have a degree of inative response automation which is simply not possible in the web 2 world because everything exposed everyone can see all the transactions MS I'm not sure where you going to stick that automation could be just uh in public or private mle sequencers Bridges whatever there's such an amazing opportunity to build

something that will hack back the attackers even before they have a chance to execute their attack I'm actually seeing those Bots come in and steal the money from the attackers before they even have a chance to do what they need to do and that happens on more than one occasions so that's showing me the future that we can do even better than web 2 world on the user side there are also opportunities look we have wallets we're we did not have any user protections just a year ago we did not have any monitoring just a couple years ago look how far we move forward as the industry so it's hard not to be optimistic when you see transaction simulations coming in we're still lost $460 million or something like that so

those transaction simulations obviously not simulating everything they should be but this is year one so I hope that in five years we get smarter uh our approaches to user Security will also get just as good so we'll be able to catch more stuff so things are dark but they got a lot brighter this year and I think as we go year after year we'll focus on maybe problems we can't even anticipate today yeah I I think as always say that it's a matter of incentives and there are two things that we are doing very good that are changing the incentives for third actors first thing is uh creating uh standards and procedures for

example the Frameworks that is created by my Mata like having a guide on these are the things that you you that you you have to do well mat and a couple more from from SE and and so know yeah it's it's there and if you want to do it it's there and we know it works so that's for a thing so we will make it more expensive for a third actor to attack someone and the other thing that I think it's very important is that now th thre actors are being followed right we have people like Taylor Monahan or Sak xvt or many that are following the money freezing the money making it more difficult for them so I think that that will help a lot those both things will make it far less profitable uh and that

will will help yeah uh one thing I also see is sequencer level commitments so if you are a like Unis swof right you have an invariant you do a lot of invariant testing before you deploy but maybe you haven't thought of like a specific Edge case right so what if you can enforce invariance at the sequencer level right so in web two we have firewalls why can't we have like web 3 firewalls which are like sensoring but enforce these commitments and we can have decentralized sequencing and this

would give us even better guarantees in production and if we are to like get all the consumers on board I think we need that level of assurance and I think we'll see a lot of that at least on l2s and l3s uh L1 is tough but it can be done uh yeah I I think I think we're running out of time so okay I I think I think it'll be just as bad next year um all right I think I think that there's going to be like a lot more abstraction um in terms of like users accounts in terms of the change like everyone you know well a lot of the LTS are using the the upstack and I think that as we abstract further like

the lower levels can focus more on security and hopefully it will it will Bridge up but I don't think in one year we will have any difference to what we have today all right we're going to have the same panel next year then cool so um I I think we're out of time I don't know if you have time for maybe one quick question but all the panelists are going to be around for the rest of the day hopefully we have a question from Mata oh thanks um so the Microsoft Esa framework was deprecated in December 22 but it left in place a lot of really good guidance around guard rails for hierarchical administration of systems have you seen similar guard rails put in place for human and non-human identities

between like identity providers security systems in a tier zero space flowing downwards don't all answer at once I haven't yet yeah no I'm saying no I don't think so no I don't think everyone is very focused on their code Audits and smart contract audits like this stuff is Way Beyond we should we should be thinking about that like we should get there but maybe we should distribute that uh that uh the Microsoft article report to everyone all right thank you gentlemen I think that's all the time we have so