Inside Samczsun's SEAL Team | Laurence Day - Wildcat Labs

[Music] excellent excellent how's everyone doing we're still good awesome that was uh very fun robot um okay so uh our next speaker uh you guys should know who he is and he's going to talk to us about something that's um top of mind so please give a round of applause for Lauren St founder of Wildcat labs and he'll be talking about inside Sam Sons SEAL team cheers hello everyone I've been given the graveyard slot now it does feel like a real like personal take to be like here you get the Friday afternoon slot but it's good to be here last time I was here I was on a panel on this stage and I got blinded by the lights which has happened again so if any of you at the back want to leave I don't mind cuz I won't know I am here as a proxy for the security Alliance you may have heard of them even if you have not you probably have heard seal 911 or some of the various other Bots that like and efforts that and initiatives that they do specifically I'm going to be talking to you about the work that the security Alliance has been doing in the last 13 months about uh wallet drainers and kind of how they've evolved how they've been being fought back against and how people are generally keeping your Apes safe I have only been in the room for a small part of this I occasionally get brought into telegram chats I have turned up to events in person where people talk about this but I am very much the mouthpiece for a story for uh at least a dozen people so if there's questions I'll just route you to seal at the end and you can talk to them so we are at February last year and seal starts getting a lot of reports on the seal 911 bot going hey like this is a domain for fishing and so you know the main thing there is you you'll see these all the time like every time you open up your message requests on Twitter or like you you get some like young attractive looking woman in your DMs it's always something like as an airdrop or a trade link or something of the sort you sign a transaction your site takes you to a commander control server you lose all of your link now it turns out having looked into it a little bit like speaking to the guys at chain Patrol and so on that a lot of these reports that were coming in weren't organic they were other drainers reporting their competition which made it really useful for us because that meant that we could be like oh there's actually enough of them to Warrant us having a look at this so they self-reported so we started looking at this ourselves and so as a response seal built the seal fishing bot bot where you could just hit it with a domain and what that would do is just push direct to a repo on GitHub which is e fishing detect and if something's there then it just gets blocked up at the top level now it turns out that you know some people were screwing this up or doing the wrong thing and like blocking things that they shouldn't because it was like a easy Vector to push things in if you just wanted to irritate someone so like they they ended up like having kind of a request override instead but that's kind of where we were in February now around this time like I think we hear about drers a lot but not many people know about the names of them but they do have names and there are several so like on ethereum there's like pink Inferno um yeah Angel Ace Ms there was a bunch of them and like it's not unique to ethereum we've got a bunch of them on Salan too but we're not at a salon conference so I'm only going to focus really on these five was that someone barking in the back and the front Jesus I'm lucky today so like the [ __ ] Houser when it comes to how wallet drainers evolve happens on salana too but I don't really care about talking about that because we focus on them atal on ethereum and they're a lot faster to evolve so drainers normally work as like a little bit of a Ponzi like most other things in crypto so a Dev or a team of devs will develop the code and then they'll just sell it like at some base price to some affiliate uh and they're the ones that will hit you with like you know the uh the pig butchering or like something more advanced or the you know I want to animate your ape and they'll keep the the vast Lion Share of whatever it is that they take from you uh but these are closed Source because if you open source it no one's going to pay you for your stuff so every so often you would see if you're in the right telegram chats recompile your drainer and so what that would mean is you would have to go to a site you'd log in you'd provide a config and it would like it would give you like a new binary like with like hardcoded with some values that you could then go and like MK people with and so here's an example don't ask me how I have an access login to The Inferno drainer but this is what this looks like generally you would log into it there's like you know account they've even got multiple languages because they're very very considerate customer service on drainers is topnotch so you know you would say like here's my config here's other things I want and you just download it and off you go so as if like again I'm I'm telling all this story from February last year and you could only block command and control requests from a top level domain so like a specific LL but and this gets more technical if you did some kind of resource request so like you would be like I want to dot fetch some Earl like plus some kind of like suffix we could see it happening and we could see all the function signatures that like we knew what was happening but we couldn't stop it metamask was effective blind so we needed to like go okay how do we track wallets that are hitting like you know certain domains and the other things that they could do so we needed request blocking that took eight months that is not an indictment on anyone involved in the process here it's just that you know when you're dealing with something as large as say like or as important as the metamask repo you do need to go slowly there's a lot of work to reverse engineer you need to make sure you're not accidentally bricking things but it did take that long so what we're going to do now is we're going to kind of like like Zip through to October 2024 which is uh so as of like yeah version 12.4.1 we finally got malicious request network uh detection that was implemented in metamask hooray so in those intervening 10 months um one of them pink did a very very polite we're done we're leaving now we won't be coming back thank you for all of your time we're really honored that you uh that you like trusted us which is a weird vibe from a drainer gang but there you go Angel upgraded itself started going by Angel X it turns out that drainers also work on aquires and they started like so they bought The Inferno drug code and they like implemented themselves into Angel Ferno and no one really gave a [ __ ] about Ace like it it was fairly like run-of-the maill so as I mentioned when people talked about recompiling their drainers you would get you would log in and you would find a panel like you you just click a button you get a new version and that was hard coded so I would get inside like if you reverse engineered it you would see a string [ __ ] you function zero and there' be a fetch request to a specific like you know subdomain like part in there and like that would be fine like you couldn't block against that but with request blocking enabled if you said here's the top level domain and then you like you blocked it you would red screen every single instance of a drainer as soon as someone started try and like fish you you would just get hit with this which does not look too different to when you are an innocent side d trying to use like you know use a protocol and you end up getting hit by like blockade or what have you but like if this doesn't turn you off and make you think about what you're doing you deserve to lose everything that is designed to be a turnoff so as of October last year so we're only talking about 5 months ago there was Angel X Angel Inferno Angel Ferno and Ace and so the most dangerous looking ones were Angel X and Angel Ferno so we were like okay let's go focus on them we can start hitting them around like we can see what they're doing with their domains we can start just like smacking them around with a stick and so we we do like we we have this ability now to start blocking things and we go about it we notice very rapidly that angel X just stops in retrospect this is because they've bought The Inferno code and they've like onboarded everyone from their own platforms into this kind of uni pool of bastards and then we notice that we stop seeing transactions like or we we stop seeing that like the code itself is containing the ears and we start seeing it appearing on binance Smart chain in contracts so I don't think the quality of this is not good enough for you guys to see I'm very sorry but you would start seeing like really early versions of this where like the code like a drainer would start referring to an address and you would just hit some kind of read method and be like this is the address of the C2 server so like down here like you can literally I mean you can't there because the [ __ ] couch is in the way but down here the actual like data translated is cloud JS cdn.com and they were just very brazenly going like this is where it is they started moving it to encrypted versions very quickly with like AES but you I mean if you want to you can go and see this like go and have a look there's not much to it but like it's there and then we start seeing that instead of just offering c2s hardcoded we started seeing that like cloud has this thing called workers dodev which is able to like spin up things really quickly and we start seeing them being offered as the c2s first off they're like you know every few days and then eventually they twig that metamask only updates parameter config so like the state of its world every 5 minutes so they and BC is really cheap they start updating exactly the same time so even if we could see it happening metamask can't propagate damage so they can just move in the open we're stuck there's not really much we can do at this point so we switch to something else like something's just come out of the void and we start looking at that instead and it turns out that's Ace the one that we thought was shite and it's evolved itself into its V2 that is much harder to reverse engineer it's a much more complex game recognizes game good job we recognized okay they're vulnerable to the same kind of thing so we start hitting them with the same C2 blocking stick and the thing is these guys are a lot more proactive and irritating and they notice this and they start actively trying to countermand the efforts that are being done against them so they rapidly work out that like so when you do like a fetch request like they scope to certain types of data and they're like okay like the XML HTTP request is like where that's scoped to so you could be like okay a fetch metamask will stop that if you're like anything in like image source or like a script or anything where effectively this is the same data like you are just pulling it and shoving it out menam mask is blind to it and they work this out very very quickly another thing they could do is that like websockets which is you know a client server connection that allows you to communicate we can't see those either and so they do this for ages they just move completely to websockets very quickly well done and that's kind of where we are again we we just in we can't do much about it we do patch it but it does take a while again as all it has to again important repo you can't really screw this up and so Jacob at metamask augmented mode does a big part of this Sam is helping to reverse engineer stuff and then like helping to drive the PRS Ace finally does like you know we get this push through and then it pisses them off so we noticed this transaction that comes through again the quality is not great but it's it's an AES encrypted like uh bit of Cipher text with an initialization Vector in front and if you translate it it um you can see here like we the IV comes from the the front of the text and then you can reverse engineer the uh the drainer itself to get the uh the key but uh they' said like funny Earl is augmented mode please kill yourself.com so like they've noticed that they are not able to do their websocket stuff anymore and that irritates them and surely after because there's a million ways to like hit this whole like as soon as you start talking about kind of client server connections like to to like that are not just like fetch requests you you could do the same thing there's web RTC as well which is like direct peer-to-peer so like you have the signaling step you connect to a to a server and then like you just like you got full duplex communication and like you can do that there and so they they write a proxy and they just start doing the same kind of contract like signaling on binance Smart chain to tell you where to go and again we're stuck again and this is how Ace looks right now if you get drained it is very likely because someone used Angel Ferno or Ace and this is how they're doing it don't sign things it's very simple now whilst all of that was happening we started noticing like we could get a little bit heavier with the hammer that we were hitting we started noticing that like if you're rotating things every 5 minutes you eventually just kind of lapse into like algorithmic patterns and we start seeing some of these algorithmic patterns in terms of like what they're putting up and eventually we go [ __ ] it ban everything everything that matches this pattern regx done and then we like they change it they do it again and even people at Cloud flare themselves are sitting there like actually actively intervening but it's not really helping at the time so after enough of this when they realize that cloud are actively like conspiring against them they moved to coer then they mov to bunnynet where they live today um I won't go into like the secure proxy setup they've got like there's a little bit more of a step now if you go to Inferno they ask you to like set up an end point for a server to like run a PHP script and then like it just pretends that it's there if you ask it for something like in like you're not a drainer it'll give you some dummy response like suggest it's clean and that's what Angel Pho looks like today and that's quite frustrating because it means that seal and these drainers are kind of stuck in this cat and mouse game where like they do something and we notice and we reverse engineer it and we fix it and we're like found like job done and then about a [ __ ] week later they're like surpris you didn't think about this and then it comes out again and then the wheel turns so yeah like it very much does feel like you know how to save yourself from wallet drainers is draw some circles draw the rest of the [ __ ] owl it is immensely frustrating but we we're getting there like there is like constant progress it is not a bad ending it's just a thing that we need to constantly be working at if this is the kind of thing that like tickles you if you're technical in this kind of way and you want to like help or you want to learn more I'm not the one to ask what you need to do is you need to find Sam and the others like Janine Etc the security Alliance and you need to hassle them because they are welcoming the hassle that we we need more people at seal we need more like eyes contributors like a lot of it is the person like just the Manpower needed to help um if you don't want to do that send me some money and for the love of God I okay guys that are here probably going to be relatively smart enough to not fall for this kind of thing if you're watching this online no one actually wants to animate your ape so stop clicking the link thank you very much everyone f [Music]