Dimitris Pallis, Hakflow: Crypto Heist through Web2 | ETHSofia

[Music] hello everyone thank you for coming to my presentation my name is Demetri palis and today I would like to talk to you about some uh vulnerabilities that um are regarding traditional cyber security traditional infrastructure but can also affect blockchain and uh web three so my presentation is about a crypto Heist through web to if you want to network with me and collaborate with me you can find me on LinkedIn I've been an offensive security analyst for the past seven years I've also play the back bounties and I do have a channel telegram that I'm sharing all the latest tools techniques that I find online this is manual I try to update it on my own every now and then it's not something automated I'm just trying to help out the community now I want to give a small introduction actually first of all to crypto wallets we've seen lots of them outside here uh in the conference actually that those could be uh a service a program that can sore your crypto Keys it can also encrypt or or sign any information for uh transactions they can be a desktop um mobile they can be a browser extension or it can be Hardware like Ledger and Keystone I guess some of you must possess a hardware wallet or even software one functionalities of these wallets uh can be a smart contract which execute certain actions when conditions are met it can um interact with d apps we have governance like voting SES that can influence uh any uh projects or the future of these projects and then again staking which is very similar again to interests on savings and other uh optional Futures such as such as social media news uh and so on in regards to key handling we've got decentralized uh handling which is actually when private keys are handled by the user now both decentralized and uh hosted which means server Manas keys can come with lots of risks or the decentralized for example someone can steal the device someone can set my laptop your mobile phone and they can extract your private keys or your seed Fay and then extract your Krypto keys and the reason actually brought my lab together is because I want to show you a live demo of this of this attack which very simple to execute but can lead to uh crypto losses and again we've got uh hosted which is the less secure method when a third party service actually host your um private Keys which very similar to platforms like coinbase for example uh and potential compromise again would be for someone for an attacker actually to perform some kind of client side attack like cross scripting to extract session tokens or uh perform a command execution now according to the organization for application security the OAS the top 10 V abilities as you can see can R from broken as controls to injection insecure design we've also got security logging and monitoring uh that can be affected or any othered components so our demo today is going to be a live presentation on the insecure design varability now I got this um slide actually the top vulnerabilities from 2022 from immuni and it appears that over 46% of the variabilities within web 3 within blockchain were in regards to infrastructure which means basically that uh infrastructure could mean um Cloud that uh this compan host their um decentralized apps or it can be for example as we'll see later the um laptop the user's laptop um that can host any private Keys now in regard regards to insecure storage I'm going to start the demo on obite wallet so oby actually they have actually fixed the variability right now but uh few months ago they were suffering for vulnerability that allowed someone who downloaded their application on um a computer actually their personal computer to just right click on their wallet and read the local session storage where they could find their private keys so I'm just going to start installing the vable version of oby going to open it and start creating my private wallet and as soon as that's installed I'm going to show you how quickly how easily someone who could maybe steal this laptop could just extract my private keys and my seat phrase just going through the installation here I'll choose a name for this device get started it's creating my profile so as you can see here we've got our oite wallet we can see several functions here send history and so on so I'm just going to right click on my OB wallet inspect now again this very similar to a web browser yeah we just right click and go to developer tools go to resources local storage so as we can see here we've got config and profile now we've got the public key here which is fine but I'm just going to scroll to the right need to make this bigger I guess so as we can see here we've got the X PR key which actually our private key and if I scroll some more we've got our seed phrase right here so we've got on our local session storage on the computer basically I'm going to show how we can find this through the command line as well we can find our seed phrase and our private Key by reading the local storage so if I just go to bite ball default and then local storage if I read the local storage we can see here that we've got again our public key we've got the seat phrase and the private key so what this means basically if someone got our device and reach the local session storage they could just compromise any crypto that I have get into get access to my wallet and compromise my accounts drain my wallet and so on so the developers actually uh after a few months I think on the next version they fix this for Ability by not being able to read the local storage and also by disabling uh the ability to right click and inspect and go to the developer tools actually so they fix this varability that way um so again we can see how a simple probability actually that's reading the local soci storage and this is very common actually in traditional penetration testing and web two security we didn't do anything uh complex here we didn't uh exploit smart Contra varability uh we didn't do anything that requires coding or something very complex um someone who doesn't know anything about tech about security they can just steal the device just right click and read our private keys so we can see that all of these ver abilities that are very simple to exploit and they got nothing to do with uh blockchain security and web 3 they also apply to uh this industry now that was my presentation again thank you for being here uh anyone who would like to get access to my uh telegram uh Channel with all the resource they can communicate with me I do have a smart contract auditing company in a web two security company called hack flow so I would like to connect with anyone uh who's building a decentralized app or they're looking to get an audit and in general to network with others in the industry enjoy the conference thank you very much [Music]