Anti Fraud and Phishing: Web2 vs Web3 - Dimitar Petkov

i'll try to keep it fairly brief my internet identity outer ego is dubster my background is mostly related by it i've been working in it since 1996 back when the internet was accessible via dial up and unfortunately a lot of things have changed but a lot of things have remained the same when compared to the early days of the internet the so-called wild west and if we compare the digital revolution i guess that's happening right now with the decentralized finance systems like uni swap and i guess in a way is uh comparable to the basically to the way internet changed our lives uh two decades or three decades ago and when it comes to phishing attacks users are somewhat protected when it comes to um let's say traditional or web based web 2 based fishing as opposed to web 3 based fishing which is more or less a bit again like the wild west unfortunately and the key difference is i guess from what was that from from a scammer's perspective the the chances of getting caught versus the return of investment there isn't a big danger for threat adversaries and threat actors who fish mostly crypto because it's largely unregulated and some authorities don't even know what to do and or are not technically prepared to deal with such kinds of such kind of internet threats and again anti-fishing vendors are well uh acquainted with traditional phishing methods that are targeting web 2 organizations let's say ebay or netflix or banking and the worst case scenario if somebody gets phished in such an attack what happens is that they either lose their credentials or their digital identity let's say if somebody loses their netflix somebody could use their account or if somebody loses their ebay somebody could beat on their behalf or maybe do fraudulent transactions resulting in money was or purchasing ebay vouchers but all of those events are more or less mitigateable by contacting the relevant entity let's say netflix or ebay and up to a certain amount losses are redeemable in the banking world most banks have some sort of deposit guarantees even though they are more or less imaginary due to the quantity feasing and artificial principle printing of money which is uncontrolled and is totally tolerated by the central banks and of course the regional banks do whatever suits them so even though they're broke basically most of the bugs they still lend money to uh institutions and people alike but if you get fished they will at least try to return the losses uh and this is the big difference in the web3 world if you get fished basically that's it it's early assets won't be recovered so in that aspect it's very crucial to to target web tree fishing specifically and tackle it in a little bit different way than the traditional fishing and i have just a few methods here that i have prepared it's nothing well we do actually have a bunch of non-disclosure agreements and the methods that i cannot show but the ones i can show you are already uploaded and they are applicable both to web 2 and web 3 phishing the key difference is that in the web 3 world we have to shut down the bet size as fast as possible and add them to all sorts of black lists like google save browsing just so that we can protect users in almost real time the other bit that i do in order to protect users even if a given phishing site has not been taken down yet is to add the the phishing urls to to github namely in the meta mask it phishing detect repository and by doing that anybody who has the metamask extension is actually protected even behind before the site gets revoked and that's actually the power of open source anybody can contribute here and this is really a nice thing and this information gets consumed by a lot of entities so not only metamask but wallet connect trust wallet and other vendors also consume it so let's go to the methods and dive in the first one is fairly straightforward just use any email that has been leaked i guess everybody has such email that was linked somewhere and simply wait for phishing to arrive there and then report it the first place to report it is spam cop because it checks the urls and it automatically sends the reports to the relevant entities then we can send the bad urls to vendors like fish tank urlscan or netcraft or fishfort so the more vendors of the bad content the better and this is uh again it's good to have let's say some fish is gay offense so it opens from only a given country the more vendors flag it the the higher the chances are it will get revoked even without reports being sent to the registrar so the other bit that we do this is perhaps my favorite pit it's done in real time the script's called fishing catcher by source it's uh open source and it can be used to sniff a search stream in real time and what it does is basically checks kalidok's stream which is service provided by sectigo and it matches any weird so to speak domain names based on a scoring system this scoring system uses a bunch of entropy checks and mathematical checks and language similarity checks to check out let's say variations of brands that we're interested in so let's say uni swap dot cc or something like this was registered the moment the threat actors create a certificate for it the clock starts ticking because we see this in the certificate stream so this is a neat way to actually monitor everything that's happening on to ssl level and that way we can have a sneak peek at scammers activities the other thing it's a retrospective check it's called hunting newly registered domains it's a python script again it's more or less does the same but instead in real time it does it for the day before so let's say today it's the 2nd of july we grab a file which contains all new files i mean sorry all new domains which were registered on the first of july and again if they can contain um keyword which is interesting to us let's say uniswap we can again observe the results the other scent that i tend to use for catching phishing is url scan and it's very nice because uh scammers are lazy they tend to reuse their both hosting domains and scam templates so by hashing a given file we can experimentally find other sites which have those file there so that way even if domain has nothing to do with uni swap let's say it's a completely different domain or defaced site if it has the fish the fishing kit inside of it we can grab it as long as somebody scanned it on url scan this is applicable again to file names so let's say metamask logo is svg file and it's fairly often used so we can simply search for this svg file and find metamask fishes same goes for hashes so hash hash sounds of the files same vps this is scammers tend to reuse a lot of hosting providers especially bulletproof hosting like for example close back ukraine or craigsfaxpex russia so those registrars and hosters don't usually pay attention to abuse reports and thus on the same ip address it's likely to find more than one fish other vendors like security trail and security trails risk iq and dns dumpster also allow us to deep dive into the bad guys infrastructure and find even more scams so by finding one scam by observing where it's hosted we can find even more scams and the last bit of my so-called presentation i don't know how the time goes but whatever so this those are the common uh ways scammers try to scam users i'll be very brief on those so fake youtube videos you've seen those they use supported systems to generate views so that youtube's algorithms pick it up and user who users who are interested in crypto will receive the video in their side view as a related live stream or whatever and usually there is a recording of an existing event but they just changed the text and it's like hey i'm vitalik and i'm sending you 5 8 if you send me two first or whatever so this is the other scam in the book and oddly enough it still works the bad thing is youtube are too slow to take those down and it's a constant guacamole game bitcoin revolutions comes those are again very common depending on where you live the sites are made so that let's say if you're in the uk and you open the bitcoin revolution scams you will see a famous person who is in the uk let's say sir jeremy clarkson or some tv personality who got rich from crypto and whatever and if you're in the us it will be a famous u.s person and so on and they those are semi-legit because they're always related to legitimate payment services but they ultimately seek to rob investors and they then disappear fake exchanges and investment platforms those are the same those are a dime a dozen i mean there are so many so much they constantly spam with them and they only change the woko and the name so it's easy to spot them once you have one sample twitter verified scans again very of often seen and unfortunately hard to tackle twitter is late what what can you do it's uh useful to monitor those because that way we can see the urls used by the scammers and nuke them and report them two is they do all sorts of trickery like they find a legitimate tweet by a legitimate crypto person and they use reply scam with stolen verified accounts so that it looks like as if the same person replied to the to their own tweet but it's actually a different one um discord dm unsolicited spam so again very often every day we have uh spam in discord we try to warn users we have all sorts of warning messages like don't uh don't do this don't do that but it's i mean users ignore it and yet we have is we constantly spam with this thing and it doesn't really help what can you do uh fake icos those are well again from 2017 nothing has changed but people still fall for them well some of them are pretty complex and have like a provo trickery and other hidden functions that can still rob you and the red polio so always be careful and the fake uni swap notes that's like resynchronize your wallet or whatever fake reason to enter your seed phrase never enter your seed phrase compromise device this is the tough one well if your computer tablet or iphone gets hacked and you use it to trade crypto it's a matter of time that you'll be robbed and unfortunately usually very high profile targets are victim of this so it's spear fishing plus whaling so whaling is like fishing but targeting uh very rich people and the last vector i guess is fake hardware wallet supports which make you enter again your face phrase sim swapping is very dangerous but only if you use two-factor authentication with gsm socially social engineering attacks this is again similar to the discord the spam but can vary fake wallets and google play store apps very big vector for scammers to operate and unfortunately hard to take down and the last i think pieces fake forms in google uh google forms or other forms which are like hey do you want to participate in this airdrop enter your stuff here and you're good to go so those are the common ways scammers try to scam users of course the list is not comprehensive and we tried to circumvent the front circumvent the fraudsters as much as we can but it's it really is a constant guacamole game so thank you for the support and for your time and i hope this has been at least to some extent useful cheers