Becoming the most secure crypto organisation

Transcript

thank you good afternoon everybody um pleasure to be here thank you for providing me the opportunity to speak with you i apologize that i'm not there in person unfortunately uh covert is making the travel restrictions a little bit uh difficult i would have much preferred to have been there in person to make this a little bit more interactive so hopefully i'll be there next next year and we can pick up but likewise if there's any questions afterwards you know please feel free to reach out to me i wanted to talk today about ledger and building and securing a community my name is matt johnson and i will just make sure that that was moved on the slide perfect uh i'm matt johnson um as you can hear from my accent i'm actually australian

um i joined ledger back in january of this year so still relatively new to the organization i started my career off working with the australian federal police i moved to the uk more than 20 years ago and i've been focusing on information security and cyber security for more than 20 years now last couple of roles that may be of interest was i was the group chief security officer for um for ingenico and i ran cyber security information security for visa europe for uh more than eight years now what i wanted to touch on today was i wanted to talk briefly through who and what is ledger don't worry it's not going to be a sales pitch but i know that there will be some people in the

room who are probably very aware of ledger the products and services but other people may not be aware of all of those so just want to bring everybody about that i'll talk about those business areas and the security and privacy at the core of what ledger does um i then wanted to raise how it is we go about establishing that trust and building the security within the crypto within a crypto organization so here i want to focus a little bit on the effort and work that ledger goes through to ensure independent certification and verification of its products and tool sets i'm going to talk through one of the security approval schemes certification schemes that we uh that we go through so i won't be going through all of them

but i'll be touching on one then i'd like to talk briefly about how we contribute to the wider community what else it is that ledger is trying to do to help protect us all keep us safe and give a couple of examples of some of the uh the the scams and take downs that we've been working on and then finally i'll end with a a very short call to uh to action and hopefully that's okay for everybody as well so who and what is ledger so ledger has three primary lines of business so we've got our b2b so business to business our b2c so the business to consumer and what we refer to as our iot origin so our b2b business so

ledger enterprise services its main product is we refer to as the ledger vault and this is a self-custody service for our enterprise clients who want to ensure the protection of their digital assets and over the top of that we place an overlay of immutable governance rules so what this means is for large enterprise organizations you can set up rule sets where you require a minimum core remove of two or perhaps three people or even four you can define that rules who are required to sign a transaction before that will be approved and authorized it means you don't have one person sitting in a treasury department with access to potentially you know tens of millions hundreds of millions or billions indeed with one

person being able to uh to to make those transactions or transfers it's also important to note that the master seed is held by that organization only this is not something that ledger has access to seas controls uh it is purely down to the organization to make sure that they like all of our products with self-custody are responsible for protecting and maintaining that it also means that we can't inadvertently delete uh the master seed and thereby lose access to uh to funds the are responsible for that uh the b2c business so that's our consumer wallets and that's probably where most of you in the room would be familiar with us today

our nano x nano s products and uh along with our accompanying ledger live and nano applications so that's the hardware wallet providing self-custody um and sort of an unparalleled level of security the only still independently verified security product on the market for a hardware wallet um and i will talk through that certification process as i mentioned earlier and then we've got iot so the uh the internet of things so this is our origin business and the uh this is using the same technology but applying it to multiple different things just not just always the uh the crypto uh crypto sphere crypto ecosystem

um so if you think here how do we actually confirm that electricity has been generated using green methods this will allow us to actually uh tag that energy generation and then when i go and buy i can actually show the traceability of the source of that energy that i'm actually buying so through once again through ledger technologies so how do we go about doing this so the secret source for for ledger we've got um sort of three three different areas that i'll touch on so first of all is our donjong so we've got a world-class security team so we've got a number of uniquely qualified individuals many of whom are you know leaders in their respective fields

regularly published materials these materials could be anything ranging from vulnerability notifications or contributions to new industry specifications or patent applications you use certified hardware devices i've mentioned that a couple of times now what i'm going to talk about next so the only company to have hardware devices independently certified and it's all layered over the top of our own bitcoin open ledger operating system or bolos so all developed in-house for us okay so who and what can actually be certified we're able to actually certify uh against people information and technology systems products and services

and then there are the organizations that are in charge of that evaluation so we certify a number of people within our organisation to ensure that they achieve the necessary skill sets have the right certifications we then go externally we have independent auditors coming in and validate our technology systems and so these can range anything from twenty seven thousand one through to sock two type two or indeed we've just been uh released our sock three report then our products and services we build these over the top a number of different security certification schemes so this ranges from the use of things like common criteria so the secure element that's used in our hardware wallet is independently certified using common

criteria and that's to eal 5 plus level so you know that actually anticipates attacks with an attacker having physical access to the device itself we've got the cspn so that's the the french specific certification that we use for the nano s and nano x and then we've also got other industry our other globally recognized standard for example the fips federal information processing standards and the hsms that we use in our vaults product for our enterprise customers they have been certified to fips so hopefully all of that makes sense that there are different levels and different layers of schemes now talking about the certification i wanted to give a very brief overview of

one of these so the cspn certification scheme this is run by ansi so this is the french certification authority depending upon which country the number of stakeholders can differ slightly but predominantly it's it's usually a a three-party type model with a certification authority an independent security laboratory and then the developer and in this instance we're referring to uh ledger as as the the developer so the certification authority they're actually responsible for signing off and issuing the certification of a product they are not paid by either the security laboratory or the developer there is no

commercial relationship they maintain their independence uh through the provision of public funding so it means we can't pay them to go faster we can't pay them all withhold payment if they don't certify our products they are completely independent alongside them we've got a security laboratory now the certification authority has to approve which companies can work as a security laboratory they've got to go through and be recertified every 12 months and they've got to meet minimum criteria set down by the certifying authority and that includes things like training training standards the number of staff that are employed the years of experience their equipment that's available to them to carry out the tests and the accuracy

of those test results it may be that some labs are only certified for conducting software certifications others have to be specialized to be able to conduct hardware certifications as well and then there's the the developers who i mentioned a ledger so that you will actually go and develop its products and we'll have a commercial relationship with security laboratory so walking through how that process works um ledger has to define which security evaluation scheme so we look for which are more globally recognized which has greater appeal to our markets and which are generally viewed with a greater level of trust

we develop a product we select the third party laboratory prepare the deliverables and then hand all of that across to the laboratory so in particular what i would like to highlight here is when we hand this information across to the laboratory we are handing over the high level light design low level design our source code the user manual samples we conduct workshops because quite often i hear the discussion around open source in-house proprietary develops what i want to make sure clear here is when we're using the independent laboratories for conducting this testing they actually have full access through to the source code and the ability to view that it is full white box testing that they conduct

okay so the security laboratory then takes the product in they review it they then work out and define what their penetration test plan is going to be based upon if it's just a hardware product if they're just doing software work um they'll then do the test and then they re create what's called the evaluation technical report the etr and they send that direct through to the certification authority we don't have the ability to respond to that that goes through to them direct and then the certification authority may come back and ask additional questions based around that evidence and information that's been provided and then the certification authority the roles that they play is they create the

the evaluation schemes they accredit the labs they also do publications and notifications of new attack techniques new counter measures and they then make sure that they continuously update the security certification standards and that actually that they are testing and assessing the independent labs to make sure that they continue to meet um those those skill sets to be able to do it okay and certify the product so if all goes well at the end point here you will then be issued with a certification report now that certification report you can go online and go to the the ansi website you can download that and you can see all of the elements and components that

are have actually been assessed so looking at the architecture of the nano x here uh things i'd like to call out here once again is that we're building on the common criteria certified element on the right hand side that's actually the integrated circuit so the actual chip themselves been through hardware certification through common criteria and this is then when we bring it in and we continue to build out our our nano x the product itself we have the hardware layer and then the software layer over the top of it we defined the target of evaluation so that's everything inside the light green box you'll see on the left hand side and across the bottom and then overlay the top of that we've then got the um

the ledger applications that are then loaded on top over the uh the evaluated product set so we then specify making sure that the individual components we have a separate certification for the um true random number generation to make sure that that is actually not predictable and not able to be circumvented our integrated circuit so the the secure embedding and use of the common criteria certified product set itself and then all of the ledger software that layers over the top of that so that's our bonus firmware and the dashboard with it the secure channel to operate in between the um the the buttons and the secure display and then being able to access the secure element

so through those you've got the independent validation and verification typically as a process this takes us roughly 12 months for each certification cycle to run through so you know it takes about three months to prepare all of the evaluation works to actually hire and get these statements of work done the evaluation is actually you know takes between six and nine months through the security lab itself they present the the report to the certification authority and then they will actually take generally around about three months for them to work through uh their internal processes and before they will actually issue a certification um sorry and it's about here i'd

normally ask you know are there any questions but unfortunately i can't really get the feedback from the room at the moment so once again apologies i'm not there in person so i've sort of spoken a lot now around the the importance of privacy security independence of certification and validation of the ledger products and toolsets against one particular scheme there are multiple of them but i'm not going to spend all afternoon talking through all of the different ones what i'd now like to do is to move into um the fourth thing that i wanted to touch on and and this is something that's very near and dear to me which is around

what is it that ledger does and what can we all do collectively to help the wider community and how is it that ledger is involved in investigations and helping clear and clean the ecosystem within which we all work most of us aware you know as a community we are frequently targeted by the scammers in the old days you know before we had the decentralized finance you know before we had self-custody we used to have to go to a bank now if you're as old as i am you'll remember when the banks were closed on the weekends so you couldn't actually do any financial transactions at all you couldn't get money out then atms came along and you know so on and so forth it's improved a great deal

since then but now we've actually taken on that self-custody so we've actually taken on the responsibility of the banks we cannot rely upon them to protect us we have to protect ourselves and it means that we've become the common denominator that these scammers are now targeting so if i move on so what do we see and i don't think this will come as a surprise for very many people uh in the room um what are they after the main thing that they're after is your seed so they want the cryptographic seed or your 24 words that you use for generating your wallet the main scenarios that we're seeing is the fishing websites

asking for the uh the seed in order to access third-party services a an attempt to trick you into restoring your wallet or saying that your wallet has been frozen or blocked a fake wallet so smartphone app fake hardware wallet or browser extensions or indeed malware we've seen zeus is one of the examples out there actually trying to capture the malware and indeed also if people are doing things like taking photos of it um you know and then it's being uploaded to the cloud you know applications that are then going through photographs to see if there are any that are particularly text heavy we've also seen scams involving physical hardware so what we're now getting

is people being mailed devices now this doesn't apply just to ledger there are other other products out there where we're seeing this occur too but that device will have been physically tampered with so either it has been pre-configured and a seed has already been generated and will be placed within a scratch card or indeed it has been tampered with as a usb device with a set of installation instructions with fake applications down on there now with the the phishing websites we're actually seeing more of these being functionally based so rather than being a ledger specific that they are able to be used for any one of a

number of different uh wallet and wallet providers so ledger's gone and we've actually built out our own dedicated internal team to focus on investigations and to focus on scams in the last couple of months we've taken down 414 websites that have been associated with scams fake downloads fake support websites and we've actively monitoring continuing to work with the community where this is uh where these are reported to us and this is one of the things i'll touch on with a request for assistance and help later on now we can only share information with law enforcement that we have so to be really clear here

i've seen a number of comments about a ledger tracking ips or keeping ips that sort of thing i can assure you that actually isn't the case there are instances where a geographical ip check may be made to see which country or region an individual is in for localization it may be that there is only a particular swap services available within the geography to pass through to there but then we do not actually keep that information once the check has been done i've been contacted directly by the dhs by the fbi and i've been asked to hand over ip addresses which we've not been able to comply with because we don't actually store retain that information because of the privacy and the nature of which the

design of the ledger products were set out with from the very beginning we do however work with law enforcement so if we can assist and we've got the permissions from individuals involved we will do um we assist them with training a number of law enforcement agencies have been in touch and they um i i'm not meaning this nastily but they don't actually have a clue how it all works so you've got the average policeman all of a sudden has been given a uh a theft or lost cryptocurrency to investigate and they struggle to understand just how it is that this uh value has been moved around and then how we can actually trace um through you know watching the

transactions on the blockchain block blockchain itself um we're then also trying to level up the security awareness of the community explain the threats we're putting out technical studies on a regular basis around our vulnerabilities to be concerned of and going forward we're looking to further build out a cyber security communication community dedicated to cryptocurrency and i'll be again inviting you know some of ledger's competitors and peers uh to join and be part of that in a a nonpartisan way so that we can all share the the common threats and intelligence to allow us to keep our own customers safe and we'll continue to share that information with our

end users and end consumers to make them as safe as we can so tools that we use for this now we need to have shared confidence that the crypto users to make sure that we all feel safe and that we can actually continue to encourage other people to come into this ecosystem with us and that if there are things that go wrong that we can actually gather sufficient information to hopefully enable us to freeze recover funds um if they have actually been stolen or indeed to get to the point where law enforcement is able to undertake actions most of the people in this room will be very aware that you know while incredibly difficult it isn't

impossible but it does take an awful lot of time and effort and so we need to be able to tie that back with people get real life attribution preferably in a jurisdiction where we can then get law enforcement to be involved so it is a very long slow hard process i don't want to leave anybody on the notion that actually it's quick and easy because by the very nature of the technology and the products themselves they are designed to be very very privacy centric i just wanted to take a short moments and talk through a um an example of a fishing phishing website that we became aware of um so this particular website came to our attention it was

previously branded using uh ledger logos making it look very very authentic that has since actually changed and since it's been taken offline before was done it was actually then made to look a lot more generic and we believe the reason for that was because the uh the the scammers were using it uh in a range of phishing scams against you know multiple wallet providers and it was then just pointing them all to the same location to uh to try and trick people into entering their backup or their 24 words so they can actually use it across multiple without having to redo one for all of them now by going through and conducting analysis of this

we found that the huis were very poorly configured the attacker had actually registered multiple multiple sites and had actually given away individual components of legitimate information one of the pieces that they'd given away was a phone number that phone number was then also able to be attributed to a large number of additional websites that had been registered using that same detail that allowed us to build up a profile or a cluster of identities that were being used the technical research then allowed us to locate a single specific dedicated server that was being hosted that had 50 uh 50 phishing websites on it targeting crypto users but interestingly as well it was also being

used to host a number of very traditional banking scams so these were uh website pages that were purporting to look like a a login page for a website or indeed 4a if you're applying for a loan now interestingly enough when we went and we looked at the server um there was zero in the way of security controls on there the directories were open browseable um so you could just see on there there were no controls no access controls on there and indeed you're able to see all of the personal information and documentation that victims had uploaded when they thought that they were actually applying for a loan

and they're actually giving away their identities as part as identity theft scams so all of this has been since taken offline and shared with law enforcement but the interesting points to note is that the scammers were operating in a jurisdiction with such impunity that they didn't feel that there was any necessity or any need to even bother applying basic levels of security or access control to their own infrastructure and what they are actually pushing out there so um you know i think that's one of those continued areas where we needs to be mindful dependent upon the um the location in the jurisdiction um we may get better traction than in others okay so bringing it through to the final ends

what is it that we can do um and i want to sort of spread the word and stop the scammers so there's a few things here and a few calls for assistance requests for help but first and foremost i'm just going to go back with the the very common theme you know please whatever you do don't share your 24 words under under any circumstances let your support legible never ask for them we don't need them we don't want them if you give those away you're giving away control for your digital assets so i just can't specify that enough and that applies for you know any one of our other you know brands that are out there other wallet providers because these scammers are out there doing exactly the same

thing not just against us but other people if you go to the ledger.com website right at the very top of the page there is a link if you click through to that we continue to update the latest scams that we become aware of be it phishing be it malware be it drive be it downloads uh be it people being sent new physical hardware devices you know please go there and refresh yourself uh on what the the latest uh tricks and um scams are that we're seeing so that you're educated and aware likewise if you fall victim to one of these and i seriously hope that nobody in this room

will or or has but if you do you know please do report it to your law enforcement agency your local law enforcement please then also report it to us and then that way we can make sure that if there's any information that we can get through our investigations team that we're able to share it back with the right law enforcement agency if we can if there is anything that's gained from there uh and also it means that we're able to update the page and educate and make other people aware and keep the broader community safe if it is a if it's a new scan so other ways that you can help yourself education please use reputable sources to educate yourself and when you've got those good education

sources make sure you share those with your friends and family there are too many locations or sources of really bad or really dodgy information out there you know there are a number of good locations once again at ledger.com we've got the school of block we've got a a whole pile of a wealth of resources there for education material please go to that there are other brands available crypto casey she does great podcasts good information you know so do please go and have a look at those make sure you educate yourself and others another piece another word of warning don't share your 24 words i think that's about the fourth time i've said that during this presentation now but i'm going to say it a couple more

times before we finish if you have information pertinent through research relating to any of the scammers you know there is the ability to send that information to ledger we've created a specific mail address for that and we actually have a bounty program that is running so once again if you go to the ledger.com bounty page you'll be able to find the details about that if you have information that actually leads to you know the identification and uh successful uh actions by law enforcement um you know bouncies are in some instances payable um and the address for that is bounty phishing ledger dot fr so you'll be able to send

any information into that next piece that i'd ask for is please don't share your 24 words with anyone that's going to be the last time i actually mentioned that during this conversation and i'm also calling out to any other partners or members of the community who would wish to be involved in broader information intel sharing um to get in touch because we'd like to create a a safe community and a safe haven for us to be able to share this valuable information and keep ourselves keep ledger customers to keep the broader ecosystem and community safe now is where i would actually go through to i'll go through to q a but unfortunately we don't really have the ability to do

that um so i would just like to take this moment to say thank you one and all for um your time and attention giving me the opportunity to speak with you today i know that i've rattled through a lot at a very high level and once again apologies that i can't be there in person i look forward to getting out to the uh the next conference and uh being able to see you there and do a much more interactive take on q a but hopefully i've left you with a bit better understanding of the uh the actions and activities that ledger undertakes to ensure the security privacy and trust both of its products its individuals and its services as well as what we are doing to help keep the community safe and what you can all do to help not only keep yourself safe but contributes to uh

to the wider community thank you one and all and look forward to speaking and meeting with you in person soon many thanks stay safe okay okay so so it's a really really really

good question listen that's one that i get asked quite frequently and i would actually say this depends upon your own assessment of risk if you're only um if you're protecting a relatively small sum uh of crypto then i would say you know keeping it in in one location is fine other people other people would disagree with that if you are holding vast sums i would highly recommend that it is split at least across two if not three sheets so you've got the way of doing the three separation where you need at least two of the component parts to be able to rebuild i would look at something like the physical protection around crypto steel so that if there is a house

fire the passphrase isn't going to be uh be destroyed by the fire and indeed you know storing those uh across multiple low safe locations um so once again remembering what we're using that pass phrase for is to protect all of our assets so that's where we have become the bank we don't rely upon them anymore it's down to us and it is our responsibility to keep that safe so if you're holding you know good or substantial sums i would recommend splitting at least two if not three components needing two to recompile and use of things like a crypto steel or similar to be able to protect against things like a house fire and have those stored in different

locations also remember you know escrow requirements as well so what happens if you do have a vast sum and you should unfortunately die your family able to use part of that estate and benefit from your shrewd investments or will that be lost forever thank you sure so basically it is it is

installed and it acts as a key logger so it is actually capturing key locks when you're going in and either doing an initialization or a restoration so there are different variants of it but it's got to capture it at that time thank you sure yeah of course so once again i think it's a really good

question and i think this comes back to you know one of my favorite topics and it comes against assessing that level of risk um you know my aim is that we have a community that's safe and secure that everybody can easily do all of this and manage it themselves so we don't need that but by that same token i think it's a great way of getting others involved and being able to uh to provide that for them so you know once again i would say you know be mindful be wary of the the pros and cons with it but you know certainly something that i think does have value in certain instances

yeah yeah yeah okay and it's another really good question and i believe there's been a couple of presentations about some of some of the upcoming uh future releases and um features for the ledger product sets so some of the things that have been very much discussed is things like white listings so that we can actually put a white listed address uh book in there so that people will know that they're only sending it to that they can't be uh be tricked into sending it to uh to the wrong address and also being able to put in transaction limits as well so those are definite functions and features that we've been looking for uh if we go to the ledger vault product so this is our b2b so the enterprise service around the governance engine that we have there we

actually have the ability to do whitelisting already and actually transactional level so you can actually specify limits that can go to either to an address or needs to be signed by multiple people so so looking at taking sort of some of that and that will be rolled over on top of the uh the consumer products as well yes it will be but you know it's it's one of those things that you know uh the other question we keep on getting asked is we know when are we going to do this coin integration or that coin integration so it's striking the balance on the release and keeping up with the speed of the coin integration and making sure that um that that is all maintained correctly and appropriately

so we don't have branching and and things falling off at the same time also looking at the additional functionality that we can introduce in there to make it a an easier and smoother seamless experience for everyone thank you very much and thanks everyone one and all really appreciate it and look forward to seeing you soon hold on bye

you