The Rise of Phishing - How to Protect Your Team

Transcript

Hey everyone, I'm Nikita, co-founder of Chain Patrol. So, we'll be talking about how to protect your team from fishing. So, first thing here we're going to just talk about one, I was at uh Google's presentation recently. They had an interesting stat that 80% of recent hacks that they've seen in crypto have started with fishing. Uh this is things like developer compromises, somebody compromising your BD, somebody compromising just anybody on your team getting data about extracting that from your team and then going into areas like uh you know compromising private keys.

But we're also seeing a lot of attacks where now business logic is just abused, right? They don't always need to steal your private keys. They don't always need to hack your smart contract. Many teams are now in a hybrid environment where we're seeing cases where uh you know you just have some code on a server. The server is supposedly secure but it's managing your private keys and so we can still see that funds are being stolen without the private keys without like multi-IGs or anything like that ever actually being compromised. Um, and honestly in over the last couple of years, I think we've gotten much better as an industry at audits uh at covering this kind of area, but all the traditional kind of web 2 security

hasn't just magically gone away. We've just layered on top of it. And these are areas where like operational security and anti-ishing is areas that honestly the whole industry right now is fairly weakened. So just a quick overview of some of the types of attacks we see. So one, all of your developers are being targeted. People are interviewers are reaching out to them. They're, you know, it's a very normal part of an interview process that you go, you download GitHub repo, you do a coding exercise. Those GitHub repos contain malware. Your developer device is now compromised. Way too many developers use their uh, you know, company laptops for their uh, you know, for their actual interviews and then

their device becomes compromised. We're also seeing obviously the fake investors, fake VCs reaching out, you know, let's get on a Zoom call. Uh that's been like, you know, everybody knows the fake Zoom Zoom link one by now, but what many people don't know is there's a few other pieces. One, many people are now, let's say, hacking someone's Telegram account, reaching out to you over Zoom. It's a regular Zoom call, but they have a deep fake. They are impersonating somebody on your uh either on your team or somebody you might know, like maybe you met them at a conference. Their Telegram account got hacked. Now you're on a call. It's looks like them. They're getting sending you PDFs, maybe a deck to review or something else. Um, and also one thing to note is Zoom has a remote control

feature built in uh that is designed for, you know, tech support and other areas. But actually in Zoom, if you enable this and you give permission, you click the wrong button, you can actually they can fully take over control of your computer. Uh and then we have you know the classic obviously like I was just mentioning telegram account hacks uh fake uh also employees on LinkedIn and all these kinds of areas where uh we see that the user uh you know you might be want somebody might be just impersonating a per somebody that you know uh or somebody you might to do want to do a deal with. But what we're also seeing is now a ton of people losing access to their telegram accounts and now it's somebody you know they're reaching out to you. you already have a

history of communication, uh, but they're reaching out to you with malware or malicious links or something else that's similar. Um, and just like a PSA, uh, if somebody says they work somewhere on LinkedIn and it has it verified on their profile, that means literally nothing. Uh, LinkedIn doesn't really do anything to verify that, uh, somebody actually works there. So, anybody that works there reaches out to you over LinkedIn and says, "Hey, I work for this company. Let's do a deal." Uh, you really need to message somebody else at the company or have another way of verifying it. it actually doesn't mean anything. Uh so what do we do about all this? Uh couple of things. One, separation of devices. This is like a pretty clear one where you know make sure you don't use you know company laptop for interviews. These kinds of

areas um but there are some cases where it becomes a bit harder right for example telegram. Most people now have telegram on their personal phones. They're doing their BD. They're doing their you know um uh you know working with everybody. And this is an area that's becomes kind of tough because you have to uh really still put some MDM. You can put MDM on like personal devices and this kind of stuff. Uh you can at least enforce Google Workspaces for example, have them log into their company account. And these are areas that uh you can enforce. Also just tell your employees to run virus scans even on their personal devices. uh have a guide for them and this can help a ton because a personal device being compromised will lead to your official

devices being compromised. Um, now on social media, just quick thing. One, Telegram. Make sure you turn off the visibility on your phone numbers. Way too many people. You can see phone numbers uh of many contacts that I have. Uh, again, many people are surprised when I can see their phone numbers. Um, and we actually have our own search page, app.chain patrol.io/arch. Uh, and we have tons of data on compromised accounts, on fake social media accounts. You can put any Telegram link in there, link, you know, LinkedIn, anything else. We'll let you know if it's malicious, uh, if it's impersonate company. Um, one other area, firewalls, DNS, uh, at the DNS level, at the VPN

level, you can enable block lists. There are many public block lists out there. Uh, we contribute to many of them. There's like efficient tech, there's seizac, there's our own chain control API where you can pull data from. We're all kind of the same data set, but we have tons of data on malicious domains that are targeting crypto companies specifically. Some people that we work with, they're already implement this at at the DNS level where you just have a firewall checks all these malicious domains. You can also embed them into your like email filtering and all this kind of stuff and it will actually help significantly with preventing your team from being fished. Also, all this data is publicly available. It's not behind some payw wall or anything else. Um, and uh, last point like just using advanced email filtering. You can add, you don't

even need to pay. There's like many paid solutions out there. There's stuff like Proof Point, Abnormal AI. These are great companies are doing email filtering coming from the web two world used by tons of companies. Uh, but many teams I've seen are honestly just writing their own rules. There's some basic stuff you can write just like if email comes from CEO and it has certain keywords or anything else like that, uh, you know, just ignore it, right? And so many teams have actually gone quite far in filtering out a lot of these fishing emails just by writing a couple of custom rules in Gmail. Um, and then yeah, and then use MDM. You can set this up on, you know, company devices, but there's many MDM that you can actually even set up on employee devices as well.

It's a conversation you need to have with your team, but that's the reality of this distributed world we we live in. There's a lot of mixed devices. So, uh, encourage your employees to set this up. That's it. Thank you. >> [applause] >> Thank you so much,