Security Panel: Only the paranoid survive: Evading hackers, scammers, ruggers, and the Lazarus Group

hey everybody all right so we're the security panel and this is gonna be fun because we have 15 minutes so this is gonna be the fastest most exciting security panel in the history of East Denver I am Zach Seward and I'm going to quickly introduce you to our wonderful panel and I'm going to try to Typecast them a little bit just so you guys get a feel for the broad base of security expertise that we have up here because security panels are super fun because everybody can use some security tips and tricks if you're a project founder if you're a smart contract developer if you're just an average Joe so that's why this is gonna be fun let's do the intros All Right Far Side we got Andy from forta he is our on-chain monitor he sees all next to him is Robert he's from otter SEC he is our smart contract auditor next to him is Bruno Bruno is from Magna that's our opsec Pro right there next up in the cowboy hat is John from Aztec he's the Privacy person and last but certainly not least is Brooke from evolved threat she is the blockchain threat intelligence experts all right that's it so we're going to start this off with a little bit of context it was a big year for crypto crime according to analysis something like 20 billion in criminal transactions were monitored on chain and the standout star of that data was the North Korean hackers which brought home a whopping 1.6 billion dollars in hacked crypto through a variety of means Bridge hacks all sorts of other stuff we actually have some folks on the stage who have some personal experience with North Korean hackers so we start we start there um John you actually actually wrote a piece about this fairly recently what's your takeaway for why the North Korean hackers had such a great year last year yeah so we have a personal anecdote um we're a privacy project and we're very focused on protecting consumer privacy not the privacy of criminals but we actually had a run-in with a North Korean hacker who tried to apply to our company and it was only through paranoia that we didn't hire them um they famously signed off their cover letter with the world will see a great result from my hand which was sufficiently villainous for us to kind of raise some red flags during the interview um but to be honest you know in a space that's very desperate for technical Talent we're very vulnerable to hiring folks who might pose a vulnerability to our coding Supply chains and when someone gets access then we'll talk about some of these vulnerabilities in a little bit you know who knows whether they can get access to your private keys if they have privileged access and I think Bruno actually has a story on this I think our North Korean actor is a little more sophisticated they you know cast our coding screen a decent English and but we were a little suspicious so they were remote and we ended up hiring them but we like completely walled them off we had them in a separate repo they didn't have access to any of our internal tools they were working with us for a little while we we got suspicious when we realized there wasn't one person it was multiple people that with their camera off but you know the point being like I don't know how these crypto projects employ anons or if they do I would hope that they're being as secure about Walling them off because you don't know who they are you have no recourse no court of law you're going to go after them on of like what do they have access to what code they can they push what code can they read and you know what else they might be able to do internally I guess the question is is there ever too much paranoia when it comes to being a crypto professional Brooklyn toss this to you I think it's just really important to like remember that there's so much out there and if you're not Vigilant um and always watching what's happening in your own like sphere paranoia is such a good thing it keeps us safe it's the fight or flight I think we women have this great thing called intuition so it comes a little easier for us but being paranoid is the only way that you're going to be able to keep yourself safe all right let's go to like the the you know the fresh Alpha section of this conversation uh Robert I'm gonna throw this to you like when it comes to like emerging Trends in terms of exploit types what are we seeing what is the latest in how people are breaking these systems yeah that's a really good question I mean we work with a lot of protocols um like back in Florida here um I think one thing that we realized is there's a lot more really determined attackers who are well capitalized who are willing to potentially push the boundaries um in terms of you know what is economically feasible in order to exploit things right so you know the most obvious example I can bring up is a couple months ago in November mango markets lost around 100 million dollars due to some sort of economic exploitation after we saw that we actually saw the same sort of attack being mirrored across many other chains that we work with um so it seems like you know after this initial example people try to try to start copying them and they saw this you know new attack surface that came up um and you know mirrored mirrored what what Abby did and I'm Gonna Get You On The Board here what are you seeing when you look at the data like what are emerging Trends in terms of the exploits that you come across on a daily basis so Florida looks uh only an on-chain activity so we're looking at exploits we're looking at phishing attacks rug pulls other scams um and I guess you know hackers are sort of changing their approaches all the time um especially as the space is getting more sophisticated they get more sophisticated to avoid detection um so it's just sort of a it's a constant cat and mass game that never ends um but there was a coinbase actually wrote a great piece uh recently on something called address poisoning which is something we're seeing a lot about where a hacker will send you a zero dollar transaction to your wallet and the address they're sending it from has Beginning characters and end characters that look similar to other addresses you've you've sent crypto to or received crypto from so if you're really quickly you know fingering in an address or you know copying and pasting something in perhaps um you may inadvertently send it to a malicious address that you do have history with but you know it it's the hacker trying to essentially sort of spoof the legitimate address um and it's uh it's a really widespread scheme um and I'm sure most people don't fall prey to this but it's also something that's really easy to sort of implement so we see a lot that God that was called account poisoning address poisoning address poisoning that was a good one uh I guess the question there is like does anyone have strong feelings as to whether or not like wallet providers should be being like more Vigilant about this stuff is this sort of uh is this just like it's your fault that you got to fall okay so like unpack the it's your fault the personal responsibility narrative what do you think that's what self-custody is what we're here for like if you if you can't learn and know what you're doing and using the products that are there for you um then you really need to go back to the drawing board but the biggest threat to your security is yourself so whatever tool you're using it's not their fault you have to utilize the tool correctly it's like driving a car if you don't know how to drive the car you're going to get in an accident yeah I mean that's something even we train our team on in terms of like security is just like think like is your brain if someone is pinging you and saying hey I need to eat you know something we're talking about backstage so many of us are telegraphing our every move on Twitter right if you're out there you know you're looking at my Twitter you know exactly what panel I'm on or who I'm on it with what event we're co-sponsoring it'd be easy to send an email to my chief of staff and be like hey Anchorage needs two weeks for the food and beverage tomorrow can you send it to this address and like you know there's a good chance to look at and think oh I should send this first like hey think text me call me and confirm because in a world where everyone knows everything spear fishing which is like targeted fishing is so so easy to carry out gotcha Robert I'm gonna take this one to you so similar to sort of this emerging Trends thing you know what are some of the things that you think are like most overlooked whether you're a smart contract developer or just someone who holds crypto what are some of these common mistakes that you keep encountering yeah that's a really good question I mean I think we spend a lot of time reading code but oftentimes you know people are the weakest link and I think you know when it comes to protocol operational security there's a lot of improvements that can be made as an example we work with a lot of blockchains and oftentimes there's you know one or two people who have critical access to the code base um who can essentially push whatever they want into the main validator code right and if you have access to push you know whatever changes you want you could potentially convince the the validator network to to send yourself give yourself infinite funds or you know violate consensus um so one thing that you know we look really closely at is how many people does it take to break you know break the break the network is there one person with too much power you know who has you know direct access to push straight to master and push potentially malicious versions even you know whether that is intentional or maybe their computer got compromised I think overall trying to limit that attack surface is really important um you know more on the operational side did you want to chime in on the operational side we do we're going so fast I'm so proud of it we have five minutes and 39 seconds okay here we go good luck so much is the social engineering part of this and yes you as like the consumer need to understand social engineering and when you're being socially engineered and not hacked but these projects and these uh companies that come in I feel like it's being overlooked the um like educational piece of it you have to make sure that your customers your you know buyers um know who you are and that you're the only one they should be buying from and anything else that comes around like you just have to be vigilant on that if you're going to be providing a service or a product that is asking for money like you have to know that these people are are maybe like novices so they need to understand who you are and be really sure that they don't get you know somebody else trying to get their money if that makes sense that makes sense all right let's zoom out a little bit I think often in the realm of hacks and exploits you kind of hear that this is like battle testing the industry right we're strengthening the collective whole of crypto every time there's a major up John do you think that people are learning these lessons or do you think that it's sort of like you kind of have to have it happen to yourself before you recognize the behaviors that need changing yeah I kind of strongly disagree with that view mainly because the attack surface area and crypto is always changing um it happens to be that our current Paradigm is inside the evm but there are all these new blockchains and zks being developed right now and we need fundamental tools to help us navigate a very complex space and so working for a privacy project Aztec one of the things we believe is private identifiers might help so a private identifier let's say you are interviewing an Anon one of the really hard things is if you ask them are you a North Korean they can just lie to your face and we don't actually have a much better system to confirm identity than just asking them the question they can possibly in the near future um furnish a ZK identifier that says definitively I've gone through a third party verification process so we still deserve all these tools we shouldn't kneecap ourselves by saying you know all of this economic lossage is good for us because to be frank it's not I mean yeah we can have that attitude of like you know we can learn the hard way like we can't afford it at Magna we need managed you know these projects tokens because we distribute them and we've had 500 million dollars of tokens on a platform we can't have one hacker or we're done as a company and so when we think about lessons we've learned from crypto we also got to think about what are lessons we need to relearn from web 2 and so we are paranoid about what not only what messaging apps we use what productivity apps do we use but also what customer data lives on every single SAS app that every single person at our company uses such that we actually went through the whole stock 2 process not because we needed it to win deals but because I wanted the comfort of knowing that we had a thorough checklist and that everything we use within our company we had clear you know insight into who had access to it and what they could see yeah I'm glad you guys brought that up and I think it does sort of all these hacks like add to this um growing lack of of confidence in this industry right and keep scaring people off because these things keep happening with large sums of money and I want to put this to you I think the thing that you mentioned John about sort of these additional layers of complexity whether they're Roll-Ups or some of these I don't know cross-chain bridging or any other of these new emerging interoperability tools what does that level of complexity mean in terms of the type of exploits that you're seeing unfold on chain um what would like I think John described it well by saying the uh the surface area is always expanding um it expands as fast as the you know the pace of innovation um I think the other challenge that exists in particularly in Defy is that there's kind of this culture of like uh hands-off once something goes live some of that's to avoid regulatory pressure it's also just sort of an embedded part of the culture now too right which is why so much emphasis is placed on getting the code right before it goes live so a lot of security budgets are dedicated to Audits and formal verification and things like that but very little budget is dedicated to security post launch um and I think one thing I would just like to underscore if everyone listening is that you know even if you're building a web 3 product like you still have a lot of web 2 components so you still have front ends you still have apis you still have you know private key Management's not a crypto sort of native thing right um and if you look at a lot of hacks a lot of them start with web 2 components right it's not your oracles and your smart contracts and your governance it's it's all the stuff that's been around for decades right Robert I'm gonna put the auditor on the spot with this one I mean do audits guarantee success for these projects I mean it's do people like misinterpret these things as like a silver bullet for like future shenanigans yeah I mean definitely not I think yeah to be clear I do not think audits are 100 guaranteed um I think the point of an audit is to raise the water level of security for your project right I mean realistically most hacks that we've seen I think are relatively you know are not very complex in terms of the the actual exploit being performed um I think when projects you know when attackers look at projects they try to find the easiest one to hack and the point of an audit really is to make your project less appealing to an hacker I think it's very unlikely that you know over the course of a two to three week engagement you know a team of two or three people can find every single bug in your code right and you know anyone promising that I think is is definitely over promising and the other thing we talked about security culture and I think Autotech is one of the best Auditors but it's garbage in garbage out no matter how good they are if a project comes to them and the code is and they haven't prepared and it's not documented yeah they can only do so much all right rapid fire to close us out this is the security panel so it's news you can use what's the one sentence thing that you would implore people in the room to do to increase sort of their security awareness Andy I'm going to start down there we're going to finish over here what's the quick thing um I think uh just being aware of what you're doing which sometimes can mean slowing down okay a little bit okay slow down be aware Robert yeah I mean kind of echoing what he said uh spend more time testing I think the products that that test more attendive less bugs tend to be more secure test test test super cliche if you see something say something we had someone on our team the other day I was like hey this customer doc does our overseas engineer need access to it no be paranoid be paranoid I would say add to the social consensus layer see something say something when I published my North Korean thread many dozens of people came out with their own stories and some of these things you know they're just not in the common Consciousness disclose you weren't hacked you were socially engineered and that's what he said Insanity check if you feel like hey this is a North Korean in Game of like uh yeah like what do you do you weren't hacked you were socially engineered you were fooled tough love weren't hacked all right well that's the end of this panel thanks for being here everybody I'm Zach join me in thanking all these wonderful people that was great thank you thanks everybody stay paranoid [Applause] foreign