Paul Hauner I Practical Security Measures for Web3 Founders I Sigma Prime I Pragma Sydney 2024

[Music] we are GNA bring on Paul from Sigma Prime to talk about how you can think about practical security measures for being in we 3 that includes your personal security how you can think about securing smart contracts your websites just your organizations and everything in between so with AF do please welcome Paul on stage thank you thank you everyone so my name is Paul hner uh co-founder and director of Sigma Prime proudly Australian crypto company uh this speech was actually written by medy Z also a co-founder and director of Sigma Prime unfortunately he has covid at the moment which is very 2020 of him uh so he's not here uh I'll be giving instead lucky you all righty So today we're going to be covering a bunch of topics not just like how to secure your smart contract cuz that's not all of web security web 3 security instead we're going to be looking at how you can secure you the founder like is in yourself uh your infrastructure that runs your web three products um and also the other like the software that you write and look at how you can do like extern when it's time to do an external um review all right so Sigma Prime uh we do we're mainly two facets to the company one side of security assessment so we do um evm nonm smart contract reviews um we do we look at all all sorts of um software to do with crypto like we do clients like blockchain implementations we look at uh networking implementations crypto we'll do l1s L2 Bridges we do a bunch of zero knowledge stuff um we've built fuzzers for a bunch of different protocols uh we also do red teaming and social engineering which is uh coming in and looking at the security of your organization we've also built Lighthouse which is an open source uh rust implementation of the ethereum consensus protocol so deeply involved in um the merge and our software produces just under a third of ethereum blocks today so very proud of that as well we're based mostly in Australia well we're headquartered in Australia but we have a lot of people all over the world um like most organizations now so if chances are we're on your continent uh we have a lot of amazing beautiful clients um synthetics of course um ethereum Foundation chain link um we've learned a lot from these people and hopefully they've learned a lot from us as well we've done over 180 security assessments um over seven years uh we started in 2017 doing security assessments 14 full-time security Engineers about just under 40 people in the company in total over 2,000 vulnerabilities reported so we're going to look at uh how to secure you the founder you don't need to be a Founder you can just want to be a person that get secured but um yeah talks for Founders so if you're a Founder you're a Target uh that might be because you've made a whole bunch of money from your successful business operation and people want to seal it from you or it might be because you have a lot of Goodwill uh like a social media platform that people can uh use and abuse uh and there's not a lot when you become a Founder someone doesn't give you an info pack of how to be secure so hopefully we can we can start with that so the first thing to think about is sell you the security so that's your mobile phone more importantly your mobile phone number it's most important piece of uh ID you didn't know you had so the ability to answer uh calls on your phone read texts on your phone and send text from your phone identifies you as far as a lot of people are concerned um so there's a thing called Sim swaps uh which has happened to a lot of people in Industry even italic has been Sim swap um basically someone says they call out pretend to be you say I lost my phone um I lost my sim can you please transfer my phone number to this phone that I have the attacker has all of a sudden the attacker now answers your phone so you need to be very careful of this what you should be doing is not using services that use your phone number to identify you so I'll send you a text with a code enter the code that's that's not a good idea it's not safe from swi safe from SIM swaps um you can look at using a high security carrier uh you can also place a note or a lock on your carrier account um which is not bulletproof because basically you're hoping that the person in the phone data center pays attention to the note and doesn't let you get swim swapped and I don't know I don't really trust people in phone provider data centers so Twitter SLX um is a big part of crypto um so you should be using a unique and complex password for your Twitter account your X account um use a password manager great idea make sure it doesn't get reset to like an old hot mail account from your teenage years that's completely insecure um go and check for inactive sessions you don't want your old mobile phone it's in the bottom drawer to have access to your X account put it in the bin now the guy at the tip has control over your your tweets uh and remove your phone number from Twitter um Twitter will sometimes use your phone number to try and identify you even though it seems like it wouldn't um but if you just take your phone number out of Twitter there's no no no reason for it to have it um you'll be protected against that as well you also want to be configuring two Factor authentication um this goes for everything but don't use SMS based because phone numberers unsecure um revoke access from third party attacks uh third party apps um delegated apps uh enable password reset protection this is just a little tick boox in in the settings um and that will like you can see here we've got like without um password reset protection it gives you like a really nice hint here to what email it is and then with it it's just like tell me what your email is so just makes it a little bit harder for people to try and reset your um your X account um I feel like I slipped this did I skip a slide then sorry one second telegram all right so telegram uh it'd be great if we all use signal but we don't um so we got to secure telegram two Factor um hide your phone number uh you know you don't want people to call you also any information that an attacker has can con convince other people that they know you or that they are you to other people uh disable peer-to-peer calling um this is where you can like call directly between devices not through telegram servers which sound great it sounds great but it reveals your IP address to people um delete inactive sessions um and have like an expiry on messages so if you say stupid things in the past those those things don't come back to haunt you that's great for all aspects of life um Discord two Factor um understand how the security permissions in your Discord works you don't want it your Discord getting taken over and scammers you know like pumping crap in there um braid protection use moderation Bots use verification levels to try and make it so it's hard for people just to like pop out of nowhere and start pumping crap into your Discord Google so this is like Google apps Google Docs these kind of things two factor of course um hide your personal information anything that you leak about yourself is something that people can use to convince uh other people that they are you or convince you that they are somebody else that you know these are all bad uh and consider removing your recovery methods personally I just have all my recovery methods disabled in my Gmail account except for there's like a code it can give you a code um that you can use to reset I just write that code down on a piece of paper and put it somewhere secret uh in terms of the organization you want to be hardening your email policy um disable rid receipts um this leaks information about your organization automatic forwarding for instance um can make outside emails appear legitimate um SPF and dkm is like a signing scheme for preventing people from um pretending to be you on the internet um disable unnecessary Services things you don't use that are enabled just a risk um deleting sessions uh and there's Advanced Protection Program as well um which is like something you can opt into but it will affect usability so if you're like a a journalist uncovering State Secrets I highly recommend that but if you're in like an early stage startup that's still flying under the radar it's probably not worth it infrastructure all right so we're going to talk now about all the things that is around your web 3 business U that might not be your core smart contracts um so SM contract security is only a subset uh and if that's all you focus on you might get um popped through some really boring web 2 way that you weren't even thinking about so dos Dynamic denial of service this is where people spin up botn nets and then just H your website with requests um this happens in crypto um these are screenshots from the F security telegram this is happening to ethereum project people will try to um extort you uh ask for a ransom or it might be part of some more complicated attack ways that you can prevent uh these is use a CDN um so something like cloudfare this will generally make your website faster for your users also makes it really hard for people to take it down you can also go serverless which uh of course means that there's serverless means that just instead of One servers there's hundreds of servers and you don't know where they are um but these have all of the you know big cloud Prov ID dos prevention are built into it so they're pretty resistant from dos attacks if you are running servers which you probably have to do you know keep them keep them up to date um block your SSH Port from IPS that don't need access to it if you can um you know blocking ports it's really easy for like accidentally to accidentally expose Docker services so like look at your firewalls on your host consider using firewalls at your cloud provider level consider using Hardware firewalls just put firewalls everywhere um yeah things like fail to band can project your SSH access from Brute Force blocking remot remote route and then having like different account levels for people um can help protect like an attacker from getting in that makes it hard for them to escalate uh and use SSH keys not passwords so looking at software security so this is the software that you are making um that may not include smart contracts either so you got Bridges you got relays you've got like Auto uh automated market makers uh you've got websites you've got like apis like you've just got so much a tax surface in your web 3 organization you might not have thought about um at Sigma Prim we look at all of these things but we encourage you to think about them as well so GitHub is a good one um so for GitHub you want to be enforcing multiactor for all users um you're going to have to tell your users not to use their phone based authentication as well um protected branches so just don't let anybody push to the main bran of your of your main GitHub repo at like require a PR a review for it require a PR request or just give it the privilege to a couple of people you can enable um you can enforce commits to be signed um require PR reviews um so that means that if somebody wants to merge a bad PR in now it requires two bad people rather than one bad people person or two compromised people um don't commit secrets so like API tokens private Keys you don't want them in your repos obviously GitHub has a little feature to SC your pushes to try and detect um private information in your pushes so the push will get refused before it even makes it into the repo you want to turn that on um and padding obfuscation um is an interesting one as well when you're doing PR reviews so let's have a quick look so we have a smart contract here um erc20 looks pretty simple um we've got a balance of function here Prett straightforward right there's an empty line there you know who cares could be nothing right oh wait that wasn't a blank line it was actually just a whole bunch of spaces and tabs and behind it is hidden this malicious code um so on the GitHub UI it's pretty easy to forget to scroll right uh and see this so we've seen developers um Miss This and like basically this code get introduced to Applications um so be aware of this your CI is also um something you should be considering so a lot of people use GitHub actions for testing and deployment um it's actually pretty complicated uh and you should really be thinking about it um you got to be aware that all the dependencies that you bring into your program are going to be present when you're building when you're testing and when you're building release artifacts um you should be restricting who can run workflows so obviously you don't want um just random people from the internet triggering release builds um you also don't want um random people from the internet being able to trigger CI in a way that exposes secrets so think about how you use secrets in your um GitHub actions and and and and try to follow github's best practices rather than going off piece and just like you know hacking things together um you want to be cautious of sub modules of course um yeah securing CI is really tricky um especially if you're using um self-hosted Runners as well that's something we we deal with a lot at um Sigma Prime and yeah just being thinking about like if if somebody can run if a random person can run a PR to trigger GitHub actions on one of your machines think about what they can do to persist something through to the next time it's used which might building a release artifact um so yeah got to think think quite hard about GitHub um next is uh external assessment Readiness so you as a Founder um when is it time for you to start getting a company like Sigma Prime uh or one of our great industry colleagues um to look at your software we you can see the word order is crossed out here that's what most people call it but we try to avoid it audit tends to infer that there is um like some set of laws like tax law and where analyzing you and saying yes you do you you abide by the laws you are okay you are safe that is not what we're doing safe doesn't exist all we can do is approximate it approach it um so we use um assessment assessment or reviews rather than audit so we recommend that everybody documents all of the things so we'd like to see system overview we want to understand the system and what it looks like what it looks like to you um include diagrams we want to know big design choices you've made um it might help us get up to the speed with the quicker which means we can spend more time finding bugs rather than figuring things out we also gives us a chance to um to miss some um bad assumptions in your design choices um we want to know the know restrictions and limitations of your application something really important to think about like what where where does this app like what can it do and what can't or shouldn't it do um because pushing that boundary is is usually where we find bugs we want to know why using particular dependencies um who can do what in the application like who are the users who are the different roles that you've thought about in the application what should they shouldn't be able to do um and if you have a formal specification that is also great as well all these things are great for security assessors to help us get up to speed and understand the application and I assure you that you'll learn something by writing them yourself as well we are big fans of comments and code there's some people that like to keep their code like a zen garden um no comments you know the the code should be able to comment it itself and that might be the case in very small isolated things like if you're writing a small cryptography Library maybe like throwing in a whole bunch of comments as it's like not super useful but as soon as it gets to any scale we really recommend adding in comments um it helps us and I know as a developer myself like the amount of times that I write code and then I go to comment it and I'm like oh actually my code isn't anything like what I'd expected to do um so please comment your code should you be testing your own smart contracts before you get a review yes you should be um there's a few different types of unit tests you got positive unit tests this is testing the things that you know the application should be able to do we've got negative unit tests um and this is handling things that you don't think the application should be able to do this is usually the hardest part for developers to do that is figuring out what people will do with the application that they shouldn't be doing with it and I'm going to stop them from doing with it um so it's very important to try and think um adversarially about your own program integration testing so how your program fits in the in the in the landscape of all the other programs it works with this is great to write before you get a review because obviously it's great regression testing uh and it also helps us to understand how it interacts and it gives us a base environment to start testing from um and you want to be testing all the time so you want to test you know while during development but you want to keep testing after you've after you've made it public because you know that that that's when there's money on the line there's also bonus points out there for formal verification and fuzz testing you can test yourself it's it's really easy hard hat brownie Foundry lots of options for it if you're writing smart contracts you you should know how to test them when should you be considerate when should you consider getting external review um when you're ready for feedback so once the programs like it doesn't have to be dumb it's when you need to get feedback um you can get us in at kind of any point we recommend once the program's like mostly done but at any point when you're ready for security feedback you can start to talk to us um if you get a review from a security firm and you make significant changes to the code base you should have G get them retested um and it's probably going to cost a fraction of the initial engagement because there's not as much to do um you should be running static analyzers against your code base there's a bunch out there um they're really easy to set up and you could you could find something very easily running things like static analyzers before you get a security security review is very helpful because bugs that you find before we get in there um means that we can spend more time looking for other bugs um and reputable blockchain security firms are booked out for months that's the case for us um so you really need to be thinking about getting your Security review early in the process um I don't think any of the firms will be annoyed if you come to them too early um but it happens all the time that we get people coming to us they're like oh we want to release next week but we need to but yeah we don't have a slot unfortunately so either the project just gets delayed or it doesn't um it doesn't get reviewed so think ahead all right finally I want to talk a little bit about seal this is a very exciting initiative um It Is by Sam Sun he's the head of security um at Paradigm and he's a very notable um famous security researcher in ethereum so seal is a neutral Alliance it was established in 2023 uh aims to be an authorative voice on blockchain security across the whole crypto industry um it wants to be ambitious practical and impactful so what's really interesting for your application I think is one is Seal 9 911 so that's a 24/7 emergency hotline via telegram um to help incident response B disclosure um and anything like that so if you're if you notice that something is going down in your application you think you're being exploited you can reach out to to seal 911 and and get in contact with Security Professionals who have done this before we can help we can help you through it um and also alternatively if you found a vulnerability in a program you can reach out and we can help with um responsible disclosure it's very important um another thing that's really interesting I think for Founders as well is the idea of the white Harbor white hat Safe Harbor agreement so a white hat is a hacker that hacks for the purpose of good so for an example is I find a protocol on the like on the blockchain it has a big vulnerability in it so I go and I exploit that vulnerability take take the money and then find the founder of that project and give it back to them and say all right you give it back to the users so what I did is I like I found something and I was the first one to exploit it I took the money and I gave it back so that I would say is a morally okay thing to do problem is that isn't legally okay um it might be that the founder is a bad guy and just wants to like grief me for doing that because I he I should have just stayed in my lane and not not embarrassed him or it might be that the police take that on themselves and think you know what that guy shouldn't have done that let's send him to jail so a white hat Safe Harbor agreement is something that projects can Implement to say they can put out the details of what a white hat is they can outline it and say if you do this to us you are operating within the bounds of our protocol and we accept you so that means that white hats can feel safe to be white hats uh safe from you and safe from the police um so this is definitely in definitely definitely in your interests as a um as a web 3 company there's also war games with seal uh so war games are preparing your organization for when hits the fan so that's like faking an attack uh and then seeing how you can respond to it extremely useful um helps you stay calm helps you understand what you're going to do um helps you make decisions it's very very easy to make a very bad decision um when when is hitting the fan and finally we have uh seal ISAC so this is a threat intelligence um program it's in beta now you can sign up to it uh and it gives you information on like what threats are out there what's going on how can you respond to it and how you can protect yourself all righty that is the speech um my name is Paul hner uh thank you so much slid of by medy if you want to reach out to Sigma Prime you can um find out website or you can reach out to me uh GitHub Twitter anything um with this handle thank you