Security monitoring for on-chain attacks

Transcript

well uh i'm uh christian seifert i'm a researcher in residence at the florida foundation and uh today i'll talk about um a comprehensive security strategy that allows you to reduce your risk uh against on on-chain attacks uh why this is the topic of my talk well generally it is not going so well if you look at 2021 there were about 2.3 billion dollars lost in uh web 3 attacks in 2022 uh even despite the market conditions it seems like we're going to exceed that that value if we're looking at a few examples here on this slide so inverse finance

this was a protocol that actually got hacked twice in 2022 the last one about 1.2 million dollars were lost uh it was a flashlight assisted price manipulation attack uh that lasted about eight minutes from kind of the first transaction to the last transaction uh badger dow this was an interesting one this was actually a web front-end compromise that where the attacker inserted a javascript code that tricked users into signing token approvals that happened over about a two-week period and then after that two-week period the attacker drained all the funds from the users accounts uh about 120 million were

lost and the last one is the ronin bridge which i am sure many of you are familiar with this was the the largest hack uh so far in terms of uh dollars lost 624 million dollars this was a validator key compromise um an interesting aspect about this particular attack was that it wasn't uncovered until six days after the attack so somebody wanted to withdraw some eth it didn't work and so then they contacted the protocol um and that's how this was uncovered the u.s government tied this particular attack to the lazarus group which is affiliated with the north korean government so that kind of gives you an idea on the type of actors that are

active now the way i think about security is is captured on this slide there's pre-deployment and post-deployment i think many of you are familiar with the pre-deployment stages in terms of utilizing template libraries like the open zeppelin library uh and and going through a smart contract audit um but i would argue that you need to take a more comprehensive uh view on on security and also think about post deployment and what falls into that category are our bug bounties uh real-time monitoring and alerting and incident response and uh real-time uh monitoring and learning is is where the ford protocol

and the ford network comes in so forda is a decentralized network that monitors on-chain activity uh for indicators of attack analogy here is think of it as big security camera an alarm system that that looks at your protocol at a high level the network consists of two components one are scan nodes and we have about four thousand scan nodes on on the network right now these are responsible to forward protection bots to analyze essentially for for attacks

these detection bots are a combination of ml models anomaly detection algorithms and and simple heuristics you can subscribe to the alerts that are generated by the the ford network or you can go to the ford explorer and and explore alerts as well as get a sense of the state of the network as i mentioned we have about 4 000 nodes currently on the network that support seven uh different evm compatible chains uh ethereum polygon uh binance avalanche optimism phantom and arbitron and i'm sure that that list

will uh continue to grow over the coming months now when i um think about on-chain attacks you may be a little bit skeptical that you're able to kind of monitor identify those attacks and have enough time to mitigate an attack a good counter example is the ronin bridge attack as i mentioned attack was successful users happily deposited into the bridge and so even though that the the attack was completed there is still value in identifying that attack but looking at you know past attacks over the last few months what we find is that an attack actually

goes through these four stages um an attacker first needs to get some funding uh in order to pay for transactions that they then submit on to chain that funding often comes through privacy protocols like tornado cache then they move into a preparation stage so depending on the type of attack so everything in for instance a reentrancy attack they would have to deploy a smart contract an attacker smart contract uh then they moved to exploitation where they actually fun uh drain uh financial assets from the protocol and then once they have done that they moved to the money laundering stage where they convert

non-native assets into native assets and then again utilizing privacy protocols like a tornado cash to to get the money out now monitoring and alerting is going to be of no use unless you have an incident response process hooked up behind your monitoring solution and for for that there's there's a few things that you need to do first of all you need to prepare your protocol to be incident response ready are you able to pause your smart contract what about if um your protocol is managed by a multi-sig do you have an on-call roster of all the signers so

when an incident occurs you're able to get the the right folks onto onto your bridge um um in order to actually respond um what are your communication channels so so there's a whole bunch of preparation work that that needs to happen then how do you actually find out that that an incident is occurring your community may be reaching out to you but how how do they do that without uh increasing the risk of whatever is happening um if there is internal monitoring systems like florida who is actually looking at those alerts and triaging those alerts and then and then as part of the triaging of course declaring an incident

once an incident is is declared well who needs to work on that incident do you have kind of the right folks available and then what is the goal of the incident and then when do you declare an incident resolved and then at the last stage once the incident is resolved uh conduct a post-mortem um that allows you to really tune your incident response process but then also um instill some confidence with your users in the community that you're taking this seriously and learning from the incident and making the necessary improvements uh to secure your protocol now when we when we're talking about risks to a protocol and and kind of the

associated monitoring well how do you identify those risks um in the web 2 world for many many years threat modeling is being utilized and i think threat modeling is something that can be transferred into the web 3 world as well and the threat modeling consists of these three stages first of all you decompose your protocol you understand how it interacts with external entities like users libraries and protocols you identify the use cases you identify what assets the attacker may be after as well as the special protocol

once you have decomposed your protocol then the next step is to identify the risks you can use threat categorization frameworks like stride or the decentralized finance attack matrix these are really prompts that cause you to ask questions so one prompt in the in the defy attack matrix may be hey there's a flash loan right that is a risk uh once you see that then you can basically ask yourself the question well what could an attacker do with large amounts of digital assets with your protocol once you have the list of

risks identified you should rank them based on the likelihood and the severity there is probably a long long list and you're not able to do everything um preferably you would want to mitigate uh the these risks in the protocol directly but that is not always possible in those cases choose to implement monitoring as part of the risk assessment you're also making some assumptions again these are great opportunities to put monitoring in place now fortunately at florida um it is a mature network that has a whole slew of detection bots and and

monitors already in place that you're able to utilize so what the community has done over the last few months is create these threat detection kits these are essentially bundles of detection bots that are identifying attack behavior in a generic way and they're customized for the type of protocol that you're dealing with so we have a threat detection kit on defy nfts stable coin governance and bridges yes sir [Music] well i think it's it's um there's

there's the way i would look at this the detection bots may look at an attack behavior from a variety of angles so it's really a a defense in depth sort of approach just because you know let's say somebody developed a token impersonation bot doesn't mean there isn't a bot that that also kind of identifies that related behavior not yet i think uh right now it's really um you know a passionate set of of community members that want to make you know secure web3 so these uh threat detection kits are

something that you're able to subscribe to today you merely need to provide your your contract addresses and how you want to receive the alerts a variety of channels slack telegram pagerduty etc also several protocols have integrated with with forda and have developed custom detection bots that really target identifying risks that are specific to a particular protocol so for instance compound they work with open zeppelin to develop detection bots if your protocol is a compound fork well that those bots are probably uh quite relevant uh to

your uh protocol as well so you're able to um get the code fork them and deploy them also uh you can look at the bot search page so let's assume you're interested let me look at the the slide here um well let's assume you're interested in flash loans maybe that that is is a threat that you identified and it's not part of the defy threat detection kit look at the bot search page just do some keyword searches it is very likely that some community members have developed a detection bot for the threat that you identified and then lastly of course you can develop your own custom detection bots

um forda provides sdks and python and javascript it is very trivial to develop a detection bot and it is permissionless in that you're able to develop and then deploy a detection bot onto the forda network without any involvement when a detection bot is deployed it usually gets deployed on multiple scan nodes in order to increase reliability and and redundancy and once you deploy a detection bot it is on the network within minutes and you're able to subscribe to alerts right after so so that's all i had um

overall i i feel like in order to secure web3 you need to have a comprehensive security strategy don't just think about smart contract audits also think about kind of the post deployment stage in terms of bug bounties of real-time monitoring and incident response if you have a protocol and would like to get monitoring in place i'll encourage you to check out app.fordog.network and subscribe to one of the threat detection kits uh thank you very much for the printation uh i have a quick question so

it's just like the posterior uh sorry um i'll find just to find the the the tag after the zero day it says we cannot um uh resist the word uh uh prevent this kind of attack right where we find this hacking happens and then we detect the events and lack the events in the network then we can subscribe to humans and find those uh issues so the goal is not to just alert you after an attack right we want to alert you as early as possible yeah so you're able to mitigate the attack okay now attacks for instance the inverse finance it had like an eight-minute span right and so there is detection bots for all these

stages right funding preparation and then exploitation if there's an alert right here you're able to uh mitigate the attack now you have to be very quick it probably is not a manual incident response process but more of an automated incident response process yeah but for some hackers they would like to do some experiment in a test night or develop some private network and to address the test for example the signature tag or the fraction text they already know what's the tbl inside this project then they probably will just use the product room and drain all of those tbrs if there are vulnerabilities there are certainly attacks that are atomic where it's like one transaction and game over but that is not what we have observed

looking at attacks over the last few months usually it goes through these stages the attack spans several blocks and there is an opportunity for automated incident response [Applause] you