Menpo: DeFi Incident Database

Transcript

go ahead go ahead I'm Herman jungle metama security team so we're here to discuss Memphis project we want to deploy a public database of defy incidents but using standard call sticks we will explain everything here first let's agree on the definition of incident there's a formal definition we get several in fact but we can narrow it down to an event when a defy agent loses an asset people need collections of incidents for several reasons we want to make studies

for papers we want to hire what do I hire I hire an expert of a smart contract or hiring expert on web3 wallet phishing I want to train my people what is the most complicated incident taxonomy what is the most complicated event where's the money lost Etc and risk management same reason sources we have lots lots of sources papers shout out to the centralized Finance attacks that's Joe 2022 it encompasses all the work done before we have all the kind of

attacks we can find and Define the device space plus the taxonomy in five levels this is what we leverage to explain the ttps on each incident we have a sources security companies BSC insertation analysis to slow Miss they do a lot of live data they do a lot of frequent reports we have newsletters with risk going just great Molly white wrecked shout out as well blockchain threat intelligence by Peter kachorginski it's important you you need to subscribe if you can you will find a lot of hacks that happen scans you will have

indicators of compromise and we have the individual research extension stack xvt whatever you are hi sunsec who has a repository that reproduces attacks by doing Forks in the same block is happening this is something that we cannot just do that we have two we can do it with three where we see exactly that I have it happen internal transaction Etc so we have the data we have the necessity so what's the problem the problem is we don't have a fixed a standard on how everybody publishes this information so for example if I want to make a recapilation of oil the Oracle compromise attacks I need to comp all

the sources one by one I need to do the job get the data do uh spreadsheet maybe a Json then do the processing and then get the total so if I get a report of 2022 see all the attacks I get a final amount but I don't get the data set I don't get a unique data set we need to have that we need to have a standard so do we build the standard and then mandatory joke we have 14 standards do we make a standard Stream Global no because we will have 15.

so how do we solve it we don't need to do standard that's the funny part sticks sticks is the standard we need for thread Interiors sticks is been around from 2012. More Than A decade is what the big boys use at web to to share information uh threat intelligence around big companies small companies Styx represents the data as a graph with node and it just sticks can be represented in XML can be represented in Json so due to these properties is really easy to automate the process by pipelining or by automating the consumption

the adding update Etc so sticky has what is called as domain objects which are types so I have types for attack pattern the dtps I have identities for researchers big teams attackers Etc indicators which are key in our case our addresses transactions intuition set which are the apts threat actors which is the actual hacker the malicious actor malware which can be exploited in our case vulnerabilities you want to put CVS and we can relate all of this in a graph way so for example we have two

campaigns by the same apt used in a specific redactor that has different kind of attack patterns ttps right we can associate the indicators to malware so we have a hatch we associate it to a malware and then if we have all this information together we just do a traversal over the data set we can as well put researches when the researchers makes an observation to get the credit or to get the reputation over the kind of data is being collected we can relate it which is very useful in our case if we want to evaluate if we want to give a value over a tweet over a publication a blog or confidence

information whatever this doesn't look very clear here but is the apt-1 the first apt defined by Mandy and mandiant makes a PDF report but at the stick representation how all the elements all the actors all the exploits all the techniques are together put it together inside this report and most importantly sticks can be extended so we don't need to have a web 3 metaverse certify sticks we just use the same protocol and we add the elements we need in our proof of concept there are not more than seven

here we name address transaction and import and estimated loss recall that for us an event is important if the actor loses an asset so the proposal was spoiled we really want to have this public that set available for everybody in web interface and in an API public because we want to make the community contribute you know a proof of concept for example we took the kyber swap incident last year you can see the threat actor all the addresses the third actor used the TTP which was leveraging Google tag manager the victim and the address of the victim now these are very simple

objects but everybody every person who has done investigation can see that relating chips appear as soon as you start to collecting enough data if you have a lot a number of objects the star randomly start to do the traversal you you may find a relationship between two types of attacks that were underrated at first this is when motion last year as well lost 42 million dollars we can see the addresses the kind of attack in this case is compromised on the private key and and the attacker if we don't have an attacker it doesn't matter we just Define that uh as a threat actor and then by virtue of looking at the

relationship we just set the node we can add as many nodes if we want and and when we're rendering by doing some algorithm we get the objects we need to understand visualization let's not forget that is Json I just put some examples because in our first version we want to use this object on GitHub this is the most the centralized way to have it everybody can just contribute via pull request there will be curated and added to the set then every actor who wants to do the analysis go into the repository gets all the data and and process it in their own graph database SQL database whatever flavor they want

um notable examples the attack pattern the TTP is asset taxonomy this is that taxonomy we borrow from from the last article on defy attacks so this is in the layer axillary web development so in this case for example we're missing the Google tech manager but as long as we start to recollect to compile more cases we can create extended taxonomy which is one of our goals we have addresses as well as indicators and we Define thread actors so finally what are our goals why are we doing this it's all about intelligence collection analysis and dissemination

collection really want access meta Mass security team and the community to add data to this Repository so remember we come well we put a total order distributive list of all hack transactions ever this has been asked in several form I want to have that I want to have all the transactions all the hacks in one single place while this is centralized in a way if we use uh decentralized source is possible to manage one minute I will make it analysis uh of course if we got all the data the taxonomy uh reduction will emerge so the

actors will find a use for this database the actors that make decisions to take decisions and finally dissemination I got the seconds basically we look forward to mempo to become an essential infrastructure element essential fundamental it's vertex to the element on the device security community people will get into member will get links and we'll identify incidents indicator for compromise we think that this is a product that is needed it's an application will be maintained by the community keeping the spirit of ethereum um the GitHub repository where we can

discuss the rest of the features on on the issues thank you very much