Monitoring Panel

Transcript

all right welcome back hope you had a good coffee break so we're going to get started with uh the next session it's a panel on monitoring the panelists are Alexander from pessimistic security uh Carlos from foda Foundation the mantas from lossless gal from hypernative Mir from cybers Asaf from iron blocks Andy from bloxek and yanev from hexagate and it's going to be moderated by Ernesto from bgd Labs thank you please give them a warm welcome [Applause] yeah

so hello everybody has already presented like I'm I'm Ernesto from bgd Labs we are working on Abby on our protocol uh previously I was like yeah the CTO on on David and his team that created the protocol and but uh yeah today we have quite a lot of people here like and the idea is that the there is a lot of talks of security procedures and security tools during this DSS um some of them like is quite a lot of them are more focused on pre-production but we we want to talk a bit about what

happens when smart Contours get deployed when you have production systems and all the tools that all these people here and what they can help for for these kind of systems so yeah maybe the elephant in the room first that there is a lot of hacks there is a lot of capital getting exploited like in a weekly basis sadly on on defy and blockchain systems so looking at that can we prevent that is the big question is it realistic to to prevent them and maybe if you can give your your thoughts about that and at the same time maybe

you can present yourself like if you want a bit more maybe we can start in order so Andy yeah thanks my name is Andy and I'm the CEO of black sack blocksack is a security company I'm focusing on build um interesting scenes for the um divide and for the production area so we um we have a couple of tools and to monitor the ongoing stress and ongoing attacks and we have some internal systems to you know to um trying to block such threats and we also provide some plugins and phone analysis tools to the whole Community to

fully understand how they um to fully understand how the funnel goes without an attack um yeah so this is basically an introduction of me and the company so in terms of your question um so can we detect the uh the attacks and it can be preventing them I think the answer is both yes and no and from one perspective um we I think every guys here are the experts in the device code area and we are every day we are developing some methodology strategies to uh trying to detect the D5 hacks and if one person asks me that anything can you detect all the happening attacks

my simple question is yes but that doesn't matter because if I Mark all the transactions as malicious transaction as attack transactions then certainly I can detect all the hacks but the problem is that we need to maintain a balance between the false positive and the first active right so if we develop a product for our customers and we have a monitoring annotation system for our customers we if our system can report like 50 or 100 alerts or even 200 alerts every day then no one will look at your system again because most of them are false positives so we need to maintain a very good balance between false positive for snacks that's what we are trying to do inside Block Set we have some a good

strategies you know we're trying to detect the attacks but we're trying to maintain the false positives I think uh so um from this direction I think in the future we uh by the efforts of the community by all these guys working in the security Community I think we can detect most of the attacks not even not level them but we can detect most of them yeah certainly yeah yeah let's let's keep it a bit short like the introduction because I think we have plenty of topics to to discuss all right I will make it short so my name is Mary delev co-founder in CTO at cybers Cy versus AI power threat detection and

response platform uh proactively securing different protocols and other crypto businesses so about your question so it's yes we can detect them but we cannot prevent everything right and so we can detect attacks on D5 and we saw it recently we detected the poly Network's attack and the multi-chain attack that it was more about private key leakage servers detected them in real time also shared the alerts with the community community via our Twitter Channel but as Andy said it's not only about detection right you can alert on every transaction but the false positive will be very high so it's about effective detection and actionable insights and actionable insights are

very important for detecting an early to give an early warning and for potential trades automate response but meanwhile maintaining a low false positive rate in order to prevent pose of protocols and contracts right so this is a trade-off always between recall and precision and with sivers we have almost 100 years of experience in AI detection and AI application so this is what we are doing in Daily Miner yeah so uh I'm dominant as politis I'm co-founder and CDO at lossless uh basically we started lossless with idea of building on chain uh hack prevention and mitigation system uh which is

basically which allows you to freeze and retrieve assets from from like many different exploits and we already managed to freeze and retrieve for hundreds of thousands of dollars so I guess that answers the question that yes it's possible to like spot and and like manage retrieval of these assets but very early while building uh lossless on-chain mitigation platform realize that you also kind of need to have a good detection system in order to spot these incidents early so we started building lossless Ages which is our current focus and it is a threat detection system which which yeah is

kind of open for everyone to use and and is powered by a lot of heuristic-based rules that kind of I guess a lot of other guys here use but also the we use different AI modules to to help us to spot these incidents so yeah yeah that's lossless hi asafeli CTO of iron blocks prevention and detection of malicious activity on the blockchain I believe that we can prevent most of the attacks that happen today the ones that will be much more difficult their the unknowns of the futures but most of the attacks today are

possible to prevent hey so great being here and thank you sir Torah and the rest of the sponsors of Hosting this event my name is Yaniv CEO at texagate exagate is a web 3 security provider we build a real-time web 3 threat intelligence system that basically provides early detection on all types of web free threats ranging from cyber exploit to financial exploit to fishing fraud and scams regarding your question so so first you know think two years ago D5 summer if

you would start try to build this kind of panel you wouldn't find anyone so I think with everyone that are sitting here in the panel and I'm seeing Andy there from forta so uh you have enough people in the space that are working on this problem each and every day and we see at least from the tweeters of everyone here that everyone can detect exploits I'm sure not like 100 of the exploits are detectable but with time we will have more and more coverage when we started the company we wasn't we weren't sure that we will be able to have like such an accurate uh detection models but luckily because the nature of blockchain

because the data is there and you start to see these patterns and you build the right models exploits and other threats are detectable and then you need to optimize and we put a lot of effort there and I know that the rest of the the pack here is doing the same thing on early detection right now of course not everything can be already detected like Atomic exploits right luckily today with exploiters so running an exploit operation takes a lot of experience and they live this like traces so so many types of hacks are detectable but I think that detection and again we see it with everyone here and and I think like

the next step is for collaboration in the space where like detection models and companies will collaborate and send the alert to like a security orchestration platform where you will have the right incest response procedures and you'll have a better coverage because it's not like one company because each and every one for example uh although everyone are saying Ai and machine learning or security heuristics you take a different approach you have different Personnel you have different ideas right um so I think that we'll see in the upcoming year more of this kind of collaboration and orchestration that will improve the security in the

ecosystem for sure I would say that most of the hacks are detectable even Atomic ones um it's just a matter of also from the protocol side of things how they should build their procedures and we'll talk about it of course in the in the panel I think how you need to orchestrate everything in order to protect the system okay hello everyone I am gal from a hypernative hypernative builds a platform to detect and prevent all sorts of risk from on-chain from security to financial governance and community-based risk uh I I think in addition to what was said here I think that in the end

when we look at security and any other domain or industry security is always a large approach like it's not it's not a zero zero sum game there isn't one solution that can fits all we need to use a combination of solution a combination of techniques and combination of preventive mechanism to really protect in the end the user funds and the community which I think invest and put their money their identity and Trust in the protocols so I think everyone here are trying to increase that awareness and create tools and I think we all obviously believe that what we are building can help and prevent more hex and exploit and I

believe it's it's an ever-evolving process of adjusting right adjusting the Security Solutions adjusting the attack techniques and trying to find more and more of these risks and mitigate them hi I'm Carlos Corolla data scientist at Florida we do real-time network monitoring to find threads and scans and so on and going back a little bit to the question of can these threats scans video tactic the answer is absolutely just wait two hours and someone will see that like the funds have been gone right or you're always

going to find it but if you find it two hours afterwards absolutely pointless so it's a little bit what what everyone has been commenting on can we be early enough so that you actually can take action and can defend the funds or can help defend and not just find that something has disappeared because you're always going to find that something has disappeared a posteriori anyway so hi my name is Alex I'm CEO of pessimistic security Carlos stole my point about that about of course we can detect HACC but I would also add on this that even knowing about the hack that is all that also has already happened is use he

can be useful for the protocol because the faster they know about it uh so we will remember the case with the running protocol when they didn't know about the hack like seven days after it happened so uh even even two hours after the hack happened it can be still useful uh in the knowledge about it can be still useful so and I would also add on the point about false positive rate uh that the earlier you can throw the alert the earlier you can launch the defensive action the the more you are ready to you know to to deal with the higher slightly higher

false positive rates I mean that uh if you if if you react within five seconds and have for example false positive rate of 10 it's better than if you have false positive rate of zero and you react within five minutes this is my point so and I think everyone here agrees yeah and I forgot to uh introduce myself so uh yeah we had pessimistic security we have been working in webpage security for six years and we performed hundreds of security audits we developed several tools for developers mainly focused on security also on static code analysis and last year we started developing

spotter the product that is aimed at alert at detecting and preventing the hacks as early at this as it is theoretically possible yeah let's follow up in in that topic is a pretty interesting one of a false positives so a well as as we know like the big majority of device is quite open in a lot of cases controlled by even smart countries like governance in the case of let's say a and false positives it feels like that if you act and you do something on false possibly you can create like some

problems so what is your take maybe we can yeah we can have like two or three people commenting on that like Assaf starting what are the problems that you see if a protocol notified protocol reacts and it is actually a false positive a higher Force positive and react fast I don't think that it's a good solution because damaging the user experience that much it's not something that bring a lot of adoption to the market and a lot of protocols and confidence to this ecosystem we have the ability to minimize the first positive to a very

low number and I think that some of us reach that small very small number and this is something that we can accomplish and we don't need to to just uh let it be a number okay yeah maybe the Alex that you were already talking so like what do you think about false positives like do you think they can be a big barrier even for the adoption of we have three monitoring tools because you know from the perspective of the protocol like even my personal experience is that yeah if everything is really good and it seems that it will

prevent but if we if a big protocol like takes like the decision of freezing like uh let's say a pool this could be quite damaging if uh like the alert was not correct yeah it's it absolutely is it can be quite quite damaging sure and this is why we should deal with this problem of increasing the you know the both uh the Precision and recall um however I think that uh false positives are inevitable if you want to act early so we still need to deal with the risk of false positive alert and I think that uh so yeah it's inevitable yeah and now

we uh all we have to do is to uh is to design the protection system for which uh some degree of false positive rates would be not critical for example if we if we discuss the architecture that you personally uh that you personally uh created for the monitoring detection of Avia I think that is pretty reasonable because it's uh it's it's a decent it's decentralized in a way and it involves several types of reactions not just you know just pulling the trigger and posing the whole protocol

you know nothing can happen and all the pro all the Integrations are damaged in immediately etc etc no we can just perform some minor actions for example limiting the funds withdrawals or limiting transfer size inside protocols and these could normal users won't even notice such such minor actions but they still will be very [Music] um how to say so they still will be able to prevent the hack from happening so I won't take more time I think I can go from forever yeah but yeah and and related with a similar topic is it feels

that there is like some big difference in in structures like of those and like even the teams themselves and their approach to Security on web3 versus uh well traditional software and security related with traditional software so do you really think that there is something really fundamentally different or it's just a matter of that we are too early like and this will just improve over time maybe later you can comment uh yeah so it also connects to your previous questions about false positive right in the end organization need to build an incident response plan right so if you want to protect yourself from

specific attack vectors maybe in this attack Vector there is less what's positive and then you can be much more reactive versus for example private key leakage that you we will face more false positives and then you need to bring a different response so you need to come with a response plan and this real-time monitoring and response incident response plan are well established in the traditional Finance right you can see them in every organization and basically this enables the organizations to come with a structured way to deal with incidental response because during an attack there is a chaos you need to Define who will be what the communication the responsibilities the decision makers so all of these plans

should be defined before the incidence response plan right and together with the real-time Monitoring Solutions it can bring a lot of benefits to the device space so we don't see such planes and such Monitoring Solutions mature yet in the D5 space but I think that's a manner of evolution right it will take some time but we will be there yeah maybe the Mantis you you have anything uh yeah so I I have a few points about this first of all like we talked with one of the projects that mentioned that they would bet better stop their protocols like three four times per month then lose a dollar so like it seems that some projects are kind of okay with you know false positives and reacting on those uh but second I think

we are still quite early in our like Monitoring Solutions so they should be threaded like carefully and like you I think like you can rely on them and they are pretty reliable but uh as as my colleague mentioned like you really need to have a good incident response you know and and have a good plan okay I got this trigger this is for smart contract a what do we do next how do we trash this who is the person responsible for triaging this game maybe in the middle of the night who is responsible at night so the problem is that a lot of current projects don't have that set up yet and and yeah that's that's a huge problem um so yeah

yeah following have we done that like because it's I mean it feels quite natural you know that the like web 3 should learn from from traditional security so uh which is the role that you think that the tools themselves because how it works usually in web 3 is that somebody puts example uh or and even not on the product side but more on the tooling side puts example of how they should be used and and well then there is some adoption so for example like what do you think which is the role of like basically the teams building the tools on educating like uh there were three developers like and and trying to build Frameworks uh procedures yeah that's uh that's a great question um and I must say that we want to and we

are starting to building that and um like inviting everyone here in the panel and in the group to to collaborate on that to build this open framework for best practices of how a protocol should be protected and I think that companies should work on that together with the ecosystem so we'll have similar thing to what we are seeing uh in traditional world where you have Security in depth in layers it is starting from you know security by Design because if you design your protocol the right way you can prevent many hacks it continues to to auditing to form a verification to

appsec to monitoring to security orchestration interest response red teaming which is let's play and let someone hack us um and see how we react on that because when there is a hack and we've been in like dozens of War rooms it's chaotic like everyone is asking who is connected to binance who is connected to Circle uh who can uh help us trace the funds right and it's of course it makes sense today because uh the ecosystem is still not mature um but there are so many things that we can learn from traditional Finance where you have like procedures in place you

have playbooks in place and I totally agree with what domantas and mayor just mentioned um like this question is just a segue to just what what they answered right um I think with that like companies like everyone here in the panel should offer the ecosystem like this Frameworks um again in an open and Joint initiative but also I think protocol and this comes like to you uh Ernesto and like we're seeing that with other Forest um protocols should also like raise this awareness because I think that when

you'll have these Blue Chips protocols that will start to raise the awareness um everybody else will follow so it's kind of a like a joint work both from the security companies and the Blue Chip protocols maybe your thoughts on on the topic of procedures and so yeah sure uh I think when I look at the traditional security like where where is the focus so there is a very big assumption uh that you will get hacked like um a lot of the budgets and a lot of the tools that are used today in traditional security are around finding finding hacks finding malicious

activity in your web application or in your network and then limiting uh the blast radius or limiting the exposure of the tech and I think uh and I by the way talk about this later today but I think that we we haven't come with that mindset uh in in crypto and and when we look at layer tools and more infrastructure optimized infrastructure that is being built more code will be more complex like there will be more complex application and I I think hex and exploit will not stop they will just increase so I I think we need to get to this mindset of really thinking uh I think as Yaniv said as well fit doing the right processes building

the right design inside the smart contract that address this like how do I limit something bad from happening when it does happen how do I have the right processes in place even in a decentralized manner to stop this from hurting and I think there are there are solutions like we are building these Solutions and we it's a lot of Education because a lot of the teams that are building applications today don't have a security function in the team so there is a lack of talent in in the area in and I think a lot of what I think everyone here is trying to do is

also to wear this uh to increase this awareness and and to be this function to all of these applications yeah and following following a bit on on the topic maybe Carlos you can comment on that like but is is there because when you explain like and what we are just talking it seems pretty obvious right like that if you can protect the protocol like and if the tools kind of work like even being an early stage or not they are just net positive why not why the movement is still starting or almost starting nowadays and not one year ago or two years ago and is there any fundamental difference

between like the the web 2 and web 3 teams like it's just what I'll just mentioned that is lack of awareness like of security procedures or what do you think is I would definitely lack of awareness is there but it's also difficult because it's so flexible when you're working the web3 space like if you are working in in web tube it's much more limited things that you can do whereas you can have like almost whatever going on in a contract and that's already like a starting point and then on top of that everything happens so fast all the time with a lot of limitations like for example if you try to use machine learning models and you are trying to run real time

it's since you want to be decentralized and you don't want to have everything together you are going to face at some point problems of okay where do I have my history of data like you cannot keep collecting things in each one of your decentralized nodes because you're going to explore them so how do you want how can you do machine learning where you need like six months of historical an address if you cannot keep that um that information in memory and there is no real way where you can keep querying all the addresses that are doing any type of um anything in a network right so there is like on top of it being very new and it's something that it's actually difficult to do like it's just wide and they're a part of

a part of it is also being learning on how to do things and like putting things in the right direction and like starting creating Frameworks and everything that we have been commenting but that also is going to take time and it's it's moving it's definitely moving in the in the last couple of years and it's going to keep moving and it's going to keep better in better and we are going to be learning how to do the things and we are going to be improving all the all the systems and being more safe but it's not something that we are going to learn overnight because it's actually a difficult problem what do you think Andy like on the on the top yes thanks for watching I I think there are a couple properties in the website compared to web 2 that makes the Webster more vulnerable and more attackable so I

think I can sing a couple of scenes one of that is open is in the web3 it's everything is open the smart contracts open the source code is open right so everyone can look at your source code to locate the vulnerabilities but in web 2 even you want to know cut the vulnerability inside some bank system you cannot do that because you do not have the source code right even you can reverse engineering to do that but it's it's highly reasonable so I think openness makes the web stream more vulnerable than sorry not even one of which makes the web3 more open but more open to everyone or even to the attackers so this is one of the point and the second is that some mechanisms inside the blockchain makes the attacker

much easier like the flash known since right so in traditional Finance system we do not have if you want to attack a protocol you need to have 1 million US Dollars then this may make most of the attackers they cannot do that because it you know have one million dollars but on blockchain you can have that right you can use a flashlight to borrow like 10 million dollars to announce your attack so this also makes things worse and the researching is that we do not have enough tools inside the website um to no credit vulnerabilities because um I'm a professor in universities and um I I can see many students they are working on a traditional web to a

security area they can develop tools to locate some sophisticated vulnerability inside some traditional software but for web3 on Smart contracts their next are very useful tools we can locate some vulnerabilities that have the business logical oriented because the business logical is a logical bug if you want to um detect notchback like if we want to develop a funding system to The Logical bug vintage there are a lot of challenges into how to mutate the inputs how to uh how to detect dependency between the different intact inputs and how to um how to provide a very good Oracle these

are challenges we have not solved in the website so we Knack of tools so all these things make the website a very um on good place for attackers but unfortunately a very bad place for protocols yeah I think that's my points yeah some idea that was commented before is that well it's possible to to detect that is clear like is is possible to prevent a at least up to certain point uh but then about the levers like that needs to be exercised like on on the particular protocols that it could be an option that uh partially like stop the deposits of certain amounts like and and be focused on a subset of users versus

the others uh for me that leads to to think like that monitoring is not something that it should be just thought once the protocol is deployed but something that should be taken into account like while you are actively developing like the system so maybe for example Alex like when do you think is like a good moment to start like already thinking on okay I want to apply this kind of tool and it will be important to have these mechanism of my protocol in order to protect it's a great question I would say that as for now we are so early and we have so little

actual battle experience with the threat prevention with the active I mean active threat prevention when we actually when we really prevented some hack from happening and we didn't see a lot of unsuccessful hack preventions and they will also take place somewhere in the future so the best practices are still to be developed somewhere maybe a year from now maybe further further so I think that as for now we are in the place when we should just experiment with things I think that at some point we will have

something like open Zeppelin library for threat prevention and you could just just uh integrate it into your project and and just just be sure that it works that okay I can set up any kind of monitoring now and it will just work but for now I think it we should set up you know a big discussion with the protocols with customers like with the liquidity providers in order to find a solution that could feed everyone in the place not only I mean not only defy protocol owners I mean Dow participants because liquidity providers are also very

important players and the retails retail customers are also important people in this in this ecosystem so I think with all with with all being said I don't know probably that is like the most responsible answer like I don't know but yeah something that you mentioned like you mentioned the different participants right like on like it's not only about the the protocols developing I mean the the teams developing the protocol but liquidity providers and so on and of course like then there is like multiple different systems like so one question that maybe on this like I want the opinion of multiple one of you is that if you can put an example like more than

an example like which is the system at the moment or systems one each that you think makes these monitoring techniques to shine so let's say defy versus breaches versus like security of funds like on on wallets like yeah if you can maybe go yeah I I think that um and I'm referring a bit to the topic that we talked about previously I think that we need to at least at least my personal thinking is that we need to to change the like change the mindset right like we talked about all the challenges that right that

web3 and the centralized system brings uh to security but the way that I see it is actually it's an opportunity because quite frankly and I've I've builted systems before in web true building a hypernative on web 2 would have taken us years to get the data and the and the vulnerabilities and to look like the fact that you can see all the code the fact that you can see all the interactions with the code across all the chains uh and see it historically I think is a huge of course it's a huge Advantage for attackers but it's also a huge Advantage for the protect and the people that are building the security so

I think that that if we'll look at the characteristics of web tree system and actually leverage them we can build Solutions together that that will be even better than than solutions that are built on web2 so to me it's like D5 of course D5 is is a target for a text because right like the the gain is very clear for for a hacker in the end hackers have um like a very you know they go where the money is and where they can get the most uh gain in the in the simplest manner right like hackers don't like to work hard if possible and this is what I think what

we are trying to do here right like make their life harder yeah maybe mirror your opinion like system that is particularly good for yeah as a as gal said so I think it's eventually in evolution right we will learn from every incident and every attack and we'll build a better system and a better monitoring and response systems but eventually I I believe that AI can bring here the advantage because in the end also it will be a cat and mouse game right the attackers will be more sophisticated and they're the protectors and so on and so on and then we'll need to come with novel ways to

detect and in the end you know with D5 protocols I would say it has a huge surface attack right it's not only an on-chain it has also UI right it also has a wallet it has a contract so you need to protect it as a system So eventually I believe that we'll come with the holistic system that will be able to protect different protocols or take um yeah so I think we should use uh 2080 per simple principle here because basically the biggest tvl is in D5 protocols and of course naturally the hackers are targeting those so of course we should also focus our monitoring uh on that but then going deeper I think

what's particularly interesting to monitor is the the forks because previously we we noticed that like a lot of hacks that happened where on projects that decided for a well-established protocol but then did some changes maybe in the tokenomics or like some other adjustments and in the end developers maybe didn't know what exactly they're doing they maybe added or removed some code and that led to some like bathmath bath calculations and and basically with those protocols you have pretty clear understanding what they are supposed to do and they how they are supposed to work but then if you know that this protocol is a fork of an error you kind of cannot apply the same monitoring rules to all of them and then see what's

the the Delta there how they are like different and and then if the Delta is big enough you can kind of understand that maybe there's something wrong with that protocol so I think yeah that's that's where I would put my eggs basically okay yeah maybe you yeah so as for the protocols out there right now I think the most obvious one that can use the monitoring are of course the bridges uh there are most of the logic is of chain and uh it's uh logical that they use it first of course the D5 protocols as most of the money in it so it's obviously the best approach to go

to these customers first but we will see it first of all it Bridges then we will see a standard for security at D5 protocols in 2016 audit wasn't uh wasn't the standard for security yet 2017 it becomes standard for protocols now monitoring becoming standard for protocols and we will see I believe a prevention that's going to be a standout also for the protocol some of it will be on chain some of it will be maybe in the other layers of the ecosystem yeah yeah maybe following on on another item that was mentioned that a

well everything is quite open on defy but that includes also like even the teams that are contributing to a protocol so one potential problem that can be can be ambitioned is that the malicious attackers like will understand so deeply like the technology of monitoring that they will try to like uh well avoid it and still do the attack so how do you think that the this because in traditional software and security the systems are of course way more clues you can have privileged higher privilege that are enforced but when let's say an example like of a dial on where you have like three different teams and you need

to provide them or provide to the dial like certain monitoring tool like so how to do it in a way that the attackers don't know uh how are the the techniques so maybe Yaniv you can yeah that's a great question um so I think first having like the fact that we're decentralized is very challenging it's like among other things like I think it's like it's top three um challenges in the space but I will enter it like and also combine an answer to the uh to the previous questions I think the way to deal with that and to deal with like system that will shine from like using Monitoring Solutions is

basically combining security by Design procedures and tools it's like when you want to build the Fortress you won't build it like in the bottom of a valley but rather on top of the mountain right and then Things become much easier so even if you're building um like a protocol and you know that everything starts centralized and then along the years it become decentralized you need to think ahead of time of okay let's build it and do security by design for the moment when we will be fully decentralized and now everybody everybody else are aware that hex will happen and like I'll mentioned it before

uh there is a challenge that people in the space don't think that can they can be hacked when you will have this notion where you understand that dowels are the next phase in each and every protocol then you will build like the right procedures then you will build maybe like time locks maybe you will um you will organize the Dao in a specific way that will be able to to react and act upon uh incidents um time will like time will tell I think we are still not there yet um but with the evolution that we see with the monitoring and the awareness in

the system and the ecosystem I hope that next year will have like uh like more like we'll have white papers that will talk about it um and this notion of combining security by Design with how Dao should react and the the providers will just consolidate and will have the right security procedures yeah maybe your take Carlos on that completely illustrator yeah so uh like the same as the teams like know like the the that there is monitoring

tools and work certain way how you avoid the attackers to be aware of how the monitoring tool to then like circumvent the monitoring tool by new methodology honestly at some point like as it keeps evolving at getting better if you are good enough does it really matter that they actually know that they are going to be detected like at the end the point what you want to do is to put there a deferent for them to actually not do things if it's just so much more difficult because they know that no matter what they are trying to do they have exactly the code that is going to be run and they are running it locally then doing simulations and you're always finding it and they are spending time and time again until they actually can do something that might not trigger everything then that's also still

successful right like because you're just making it so much more difficult and putting it in the end you're giving security by okay I'm going to find you almost whatever you do unless you find something super Niche and then once that happens we are going to be on top of that and building on top of that and it's ugly because that shouldn't happen but it's a way of learning like it's a little bit of um of a cat and mouse game like okay we get better they get better we get better they get better and so on but that's the thing at some point I feel that as we grow and we learn more and we build better defense mechanisms even if they even if they know the mechanisms and they can reproduce it it's still going to find a lot of the things that they are doing it's like

when you have a lock on a bicycle like if you really try to break a lock you break it right but it's therefore deferring you and making it very difficult and wasting more time and giving more traces so that you can be found it's a little bit of the same yeah I think following on that is actually quite interesting but a the same as like maybe looking for Perfection is not the not the approach because like it will work without the Perfection like how how you see like in terms of speed and the Practical speed nowadays so because for my way of thinking I think like a lot of people like in the web 3 development side is that we are used like to Kind of Perfect Solutions like and we we think that okay

monitoring there should not be any case like on where it can be skipped like so maybe your your take Alex on like in practice like on the last month's year like is that Perfection from the part of the attackers there or is more like there could be always ways like of or almost always so uh I would say that in the tree we are not really accustomed to security for security to be perfect so security is always imperfect in the tree at least um I would say yes that we we will still be imperfect uh but I think that for the same for that the

same reason uh you know just uh let me rephrase so as far as I remember in the middle of the 20th century uh bank robberies in England suddenly stopped it's just because the risk was too high to take it so we can just uh just increase the risk for the hacker you know increase the difficulty the complexity of the task Etc et cetera Etc so at some point it will be just pointless it will be easier to just I I don't know Farms some coins to get some easy money than to Drain Liquid people and

I also had another point on this Martin could you please repeat the question sorry no I was more focused like on the on the Practical speed like so uh when you look like a potential solution it will be okay like I want to protect an Mev case that you will get executed atomically like and it will drain the whole protocol so I was more asking of from what you see like last month last year like is that the case at the moment are so sophisticated the actors or it's just more of overthinking from part of the engineers that right I think I think uh that uh when we really start stopping the actual attacks

they will need to do to do something about this and I think that within a year we will see more sophisticated sophisticated hackers and they will try to obfuscate the attack they will try to hide the attack completely with the prior going to private pools and for any of these ways of uh you know hiding attack or obfuscating it or bypassing monitoring in any other way there are solutions and I'm afraid that I will go over time if if I you know describe all of them but Solutions exist and but they will but I think that we will start thinking about them in practical way only maybe the

next year because earlier it's to me just doesn't make sense because hackers are not that complicated they are so lazy they deploy attacking smart contract and then and then broadcast actual attack transaction you know maybe sometimes uh within several hours and so it's it's insanely slow they must not do this but they do this because they are lazy so I think that we must teach them to be less lazy yeah and and a bit related with that like maybe for maybe for you and like how do you see the implementation of new privacy

Solutions like on on blockchain Smart content how you you see the relation with this monitoring because like on one side it will benefit the attackers even more like on the other side it could actually be a place maybe to plug monitoring in some optional way so oh yeah uh this is a really very good question because we have an audio debase Insight in inside but outside so um for the pricey um um transaction so it's like the flashbot right so we can see many attackers and abusing these services to launch attack so um one of my one of my colleaguers uh um he proposed absolutions that we

should you know invest some transaction inside the flat spot to preventative response from being abused but I do not think this solution this solution Works in practice but I do not I think this solution can be accessible by the community because you are in the transactions on a decentralized world right this cannot be accepted by the community so I think but but still um how to how to uh but still from the um privacy so it's providers perspective how to prevent their service plan from abuse by the attacker still an open question I think at least we can do a a couple of scenes first we can

um if if the is attacker has been confirmed at least we can you know work with authority you know to solve some um to to share some information with sort of to check the attackers by such uh service providers I think exactly what one thing what we can do I think another thing is that uh maybe uh in the future we can add some community-based Eventing systems inside the transactions it's not just a centralized community-based we can invest some transaction if it's a malicious then we can like we can delay sending a transaction between a block station you can um I think they can they can not solve the issue but they can mitigate the issues currently we have yeah thanks okay

yeah maybe like uh last one that also was mentioned during all your takes like is it worth the console like the forks like so that there is like a lot of people like a lot of developers that just work other protocols like and there is quite repeated pattern of detecting hacks into Forks like so what tool actually questions together one is why you think is so it's just like the the team that doesn't put too much effort and the other will be how they like big protocols that maybe don't give so much importance to that the how they can incorporate that in the procedure so basically looking like uh all the hacks happening in Forks as a way of

understanding of of your own product maybe mayor can comment on that yeah so I think that this might be addressed during the development right maybe tools like Satora or other tools can address this problem and to see what kind of libraries are using maybe this libraries in Blacklist and so on and so on so I think that this problem might can be easily addressed you know it doesn't just needs attention education and to be more uh more precise when you're developing but I don't think that this is a huge problem that we cannot solve today okay

yeah so we are kind of almost at the end so thanks everybody maybe we can leave like some we have four minutes so maybe if there is any question from the audience for anybody here include hi um I'm I'm just like here that Andy talked about some traditional web 2 uh software that your students and probably like PhD student or undergrads were

using for detecting like traditional traditional security flaws so is there any recommendations that we can take a look at oh yeah um excuse me right you're asking me right you're asking me right yeah okay yeah so um I think for for some recommendations I think I'm looking after the the the the D5 hack Maps is a very good start you know two from uh transforming from the web to security website screen because it has some so many uh so many past hack transaction you can analyze to an understanding the why the hack happens what's the vanapin is there and how to trigger attacks and

after after um getting all these insights then you can have more um understanding of the website hacks and you can write some tools you know to analyze their attacks to detect these attacks you can have the static Dynamic analysis to us um you can you can develop by yourself you can improve all the existence towards and you can have more knowledge on this area hey thank you everyone for the panel interesting so I have a couple of questions but I will just start with one is given that we have today on the panel I know eight nine companies doing monitoring I was wondering how are you guys collaborating on

sharing data uh it feels like um you could all benefit from sharing thread data monitoring data put into their standard for alerts in a machine real way my question is where you are starting to win that and if you're not away all of the of all of the startups over here I believe it's their it's the starting point they're finding the the market and how to reach the market the better way but you're absolutely right and we already discussed before a few of

us to collaborate and and we're showing the data because it's bringing more security for the ecosystem and security for the ecosystem is the first thing that we should take care of and yes we are starting to move this also as a share vision uh yes I have a question could you explain the process of front running a malicious transaction for example like uh what would be the infrastructure setup somebody wants to tackle maybe somebody different yeah I can talk something about it

because we have some some experience of you know from Iranian attack transactions so basically you need to have infrastructure to listen into the memory Port transactions and then you need to have a automatic way to synthesize your uh your from a running transaction act you need to copy all the attack behaviors from the attack country inside yours once my contract they need to replace order some critical variables like you need to replace other attack address to your own black hat addresses then you have some infrastructure to quickly as soon as your transaction on blockchain so that's basically uh how the system basically works collaborate with other flash ball

Builder I cannot say public here but I think have a your own load is a very good a very good start yeah okay so yeah thanks everybody we were a lot of people here but I think it was like a good result so uh hopefully yeah it was interesting for the for everybody there thanks [Applause]