The Road to Becoming a Web3 Security Specialist

Transcript

all right all uh really important topics so we have the last session but uh before before lunch and another really interesting one for uh all the people here so this is uh the road to becoming a web 3 security specialist by Iran honig from consensus diligence please welcome Iran uh thanks for the introduction yeah so uh I'm gonna be speaking a little bit about the road to becoming a web free security specialist um to give a little bit of background I myself started my journey on web 3 security by implementing mithril uh

symbolic execution engine for the evm this is maybe a little bit of an unconventional way to start uh out doing security things and it's also well does work it works really well it might not be the most efficient way so today I want to talk about like how you can design your own your own like pathway or road to becoming a security specialist what things you need to look out for and also kind of like what not to focus on like what's the important things and what's not the important things so kind of what I want you to do is not waste all of your time doing like only reading blog posts all the

time and never actually trying to do anything related to security all right well that doesn't work oh okay unfortunately the picture is not working let me see if I can pick that real quick okay nope fingers crossed now it's black okay

okay awesome pictures yay 10x Improvement for the talk okay so very simply put there's going to be two parts to this talk how do you get there and how do you stay there and it's interesting how kind of getting to be a security specialist is very similar to staying there like the types of things you focus on end up being the same in the end um although maybe the activities are slightly different in your approach as well okay so first how to get there um which makes chronological sense um I think that uh it's very easy to focus on the wrong things when you just

get started I feel like personally like eighty percent of the information you need to learn to become a security specialist it's just like the basics like how the solidity work um how does the evm work uh but there's a key thing here is not enough to just know like how to deploy a smart contract or or it's not enough to know like that op codes use gas and like did you kind of know how things work on a high level but not really When anybody asks you real questions like you got to know these little details about the evm that are very important and I think so there's a short quote on this slide here from Five Elements of Effective Thinking

which is a very short book but I think it's very much worth reading one of the things so this is a book written by some mathematicians that teach math in a university and they figured out like what are the patterns that students have that make them succeed at math and those things actually work like pretty generically for learning in general and so one of the things is that what sets the Specialists apart from the common crowd is a very deep understanding of like the material so in the book there's an example of a violin

player being really really good and a very simple piece of music even though in practicing this over and over even though it's very simple like they would get so much better at it and in doing so become a much better violinist and I think the same is true for deep high security like if you have a in insanely thorough understanding of the evm or solidity this is it just gives you information at the time you need it to find bugs that others would have missed and I think to to give you like um oh no uh to give you like a kind of a

benchmark for how deep I think you should go by with learning the basics is I think you should know most of defy architecture better than the developers themselves um and this is kind of a very vague Benchmark because it's just impossible to Define anything um yeah and essentially what you're learning here is security agnostic so you're not necessarily thinking about security or learning about security when you learn these Basics like you can play around with Huff or build your own symbolic execution engine maybe build a fuzzer building tools is like an interesting way of

getting to learn something deeply um you are not necessarily thinking about how to exploit smart contracts using the evm but just building that knowledge and that knowledge on its own will pay its dividends later on all right so there are so many ways that you can go about like building the basics learning setting up your basic knowledge I think like there's tons of blog posts out there projects um there's so many road maps on on GitHub you know with all the links uh there's a couple of coupons out there um I think it's difficult to go wrong uh

if anything don't stay reading the same kind of blog post too long like there's also like a little bit of a rabbit hole like you gotta understand things deeply but if you focus only on learning the UVM and nothing else that's maybe also not a good user for your time and so I have a little spoiler here too so towards the end of the presentation um I said of kind of like this interesting thing of uh content curation essentially of different blog posts and road maps that you might be able to use um on your journey but more on that later all right so I think the first part is building the

foundation uh like foundational knowledge of just the environment the second part and probably the part that sounds the most sexy and interesting is the attacker mindset um and this term is often used without any definition uh people just throw it around oh you gotta think like in a Decker uh I know what's it even mean so to me the attacker mindset is a couple of things um on the one hand it's like these thinking patterns that are both innate and come from experience that allow you to just take an idea and mess with it so

this is also something interesting and why I put in lead web 2 hackers I have full confidence that a lead web 2 hacker that's built these mental models of how to play around with ideas in such a way that you can they can see the perspective that the developers don't have to actually see if there's something possible with the system that wasn't intentional um this is uh here's another book by mathematicians um called how to solve it way older I think is like early last century um

and this book also describes how or the difference between students and experienced mathematicians and it's it in in one of the early chapters it shows like a simple like puzzle really um where you had to connect like multiple dots like maybe you know the game where you have two red dots two green dots two blue dots and you got to connect them all without crossing the lines and this was an interesting example because um ex or the author explains how mathematicians have this because of their practice like in their toolbox their mathematicians attackers mindset

they have this kind of thing where um I think he called it the the like the concept of isomorphism like they instantly in their brain map the configuration of dots to a different like uh format where it's very easy to connect all the dots and I think a phenomenal phenomenon like this is exactly what the attacker mindset is this is like the ability of your brain or your experience really to take something and play around with it look at it from different angles that allow you to find issues um that said I think there's more to it I think

[Music] um we yeah that's going to be on the next lecture okay so I don't think um you can build a universal infallible attacker mindset like it's not perfect like um everybody is kind of unique in how they built their experience and this is kind of why everybody wants multiple archers to look at their project because they'll just find different things this also means you'll miss things inevitably this is just yeah a problem of Being Human I guess although AI is also miss almost everything for now also it takes a very

long time to really build these parts of your tool set like building a good attacker mindset uh will take you quite a Time okay so how do you even build this um I think so I was talking to a couple people the other day about security training like how do you get to become a very good auditor and one of the things that came out of this discussion or what we talked about is what's happening around code Arena so and Sherlock or this type of contest model and I think

and so the phenomenon phenomenon that we see happening that is so great for building your attacker mindset is the ability to have what's commonly called deliberate practice so you have the ability to try your hand at a real smart contract like you try your hand at auditing and and this is the important part you have a feedback loop I don't know what the timeline is two weeks to a couple months later where you can actually check back and see what you missed and I think this is the most important thing to do when you're like

kind of starting out is this part like you try your hand at it and then review what you missed and that kind of deliberate practice will allow you to build up like this this kind of expertise and it's important to to go over the issues that you missed and then see kind of why you missed them and kind of make a general pattern for yourself that allows you to find this bug in the future so I wrote down imitate and make your own like just looking at boundary reports or whatever something like this figuring out how the bug actually

happened so maybe the oilberg was like um a liquidation event with um some environmental situation uh that made it vulnerable so oh no um so you can look at this and think like hey liquidations are probably very difficult to implement and in this case there's like these environmental factors where you can instantly make a position liquidatable you can look at this pattern and think hey so what if I like go out and search for situations where you have positions that can be

liquidated where I can create them and instantly make them liquidatable like this is a very interesting and vulnerable pattern and orders definitely not the first to to make this mistake um so yeah once you have this you have kind of this additional tool in your attacker mindset toolbox and you can continue um and over time you'll also develop these General more generalized mental patterns okay how to stay there so what do you do when you actually achieve being a security specialist which is still a pretty vague term uh it's pretty much

the same I think the thing that most like smart Auditors do is a non-human to stay a smart auditor it's just because they're interested is they just keep exploring so once you're into solidity smart contracts you have like understand them pretty well now go and look at Cairo or something else and I think in all of this it's very important to keep going for that deep understanding so one of the topics for today um maybe one or two talks I'm not sure is kind of like using fussing and doing property based testing there's kind of a couple levels of doubt that you can go

here um you can first learn how the tool works like how do you set things up how do you do a fuzzing campaign all that fun stuff and you can start finding bugs but I feel like this is still like a sphere or fairly superficial type of understanding and I would recommend you to like play around with the tool itself and actually try to figure out how it's doing the fuzzy because once you get to a point where you actually understand how the different fuzzers work how Foundry Works how the Echidna fuzzer works you actually achieve something that's going to help you also you use the tools better because all these tools have flaws like there's just certain

things that are very difficult for fuzzers to do and there's certain ways of going about writing properties that make a lot of sense if you know how things work um and this type of understanding is just not available to you if you just do the basic tutorial and use it although over time of course like you'll build a better understanding as you use it but I would just go deep down the rabbit hole I enjoy the rabbit hole and then continue so to build the attacker mindset uh I think it's important to kind of build this feed of information uh and I think

there's kind of two prongs to this so um or this is at least what I I look at um on the one hand there is the like stream of bug Bounty reports and postmortons and I think these are probably some of the most interesting um because these are the bugs that other Auditors and developers missed um and so it's important for you to also know about them so that you don't miss them next time um it's also usually a stream of like critical bugs that are super interesting uh and worth checking out but I think it's also worth

not sticking to just this uh the cool hacks like whoa 10 million 100 million got hacked I want to know how it works um I think it's also pretty much worth checking out audit reports from like or reports from code Arena oh cool and um added reports from some of the top auditing firms like just scroll through them and see if there's any type of bug that um you haven't looked for before that you think you might have missed um I think like a quick skim of a couple of alert reports every week or every month and then just taking a few and

Diving a little bit deeper on those issues definitely worth the time and it's important to also do these um because there's always new things in security um and these are gonna be kind of the bugs that Auditors are looking for right now so if you don't know about these you'll be one of the Auditors that lets us get into production into the first class of bugs um so yeah I would definitely do both and then the other thing is practice so um yeah brains are very slow uh to optimize although if you practice use a particular type of thinking a whole

bunch it starts to optimize really well so the more time you spend hacking and thinking and playing around with ideas and systems looking at them from different perspectives the easier this will become for you and I guess the faster and the more bugs you'll find okay so how does this learning and approach reflect in practice I feel like auditing in a way or finding bugs is all about just asking questions so here I hope it's readable I think it is uh is a sequence of questions um in a situation that kind of highlights which parts are this

foundational knowledge and this and which parts are the attacker mindset so um this is Loosely based on the URL hack not really like a couple details don't match up um but it's just to highlight this this idea okay so the first part is like asking the right question so this is the attacker mindset like knowing which questions to ask um so in this case um it's like you know to ask for like let's see to see if there's a situation where an attacker might be able to turn a profit doing a liquidation and so the answer to the question is also important

and in this case you'll have to look at the code um so again so in this case I'm assuming yes that's possible second question it's very important to make the profit instantly if you can make a profit and it takes you months it's not very interesting from a security perspective so this is also kind of the attacker mindset then another code understanding answer um and eventually you have this question of okay um I gotta send these two transactions and um is it possible that someone might mess with my attack so this is like also

the attacker mindset like is someone gonna hack you will you try to hack this thing um and the answer is going to be yes potentially here and that's part of that foundational knowledge like knowing what guarantees you have when you submit a transaction um through through the mempool or even like what are the conditions that you have when you submit it through flashbots because flashbots has a lot of edge cases and interesting pieces as well where you might think oh I just submitted and nobody knows about my transaction nobody can understand which it or whatever this isn't always the case it's not that simple like and that's why it's very important to have

that foundational knowledge um yep all right so I'll make the short pants and Quest so one thing I did is like there's a lot of content out there it can be a lot so uh I thought it would be cool to do this thing called which I called passing quests it's Loosely derived from other things as well um it's kind of these bite-sized Adventures based on curated content from all over like content from people in this room right now as well um you do some research like a bit of learning couple blog posts and then there's objectives with um what I call like real goals so they

first uh Quest has you going out to D5 protocol figuring out how other protocols might integrate with it and then you figure out what all the edge cases are that other protocols might need to look into and this and then you can write a blog post about this that will be pretty cool and useful this is a very cool like objective I feel like is it something that Auditors do pretty much every day paths are like a more curated set of quests so like you want to do CK editing and there's a couple quests in that way here's a QR code um I hope it works I put the first one live um let me know what you think

I hope you like it [Applause] great advice from Iran so we have time for a few questions so everybody agrees nice all right I um what about using AI to discover pattern for for learning

I mean AI is pretty good at learning pattern you know to find attacks or exploits so I tried a couple of things to like I like giving charity pity an audit report or a bug report and then I said yo can you distill like the essence of this bug and it's very bad at this like it always it's it always either loses details and then writes something that's not related to the bug in the report or it keeps too many details like for example it's specif like starts talking about very specific components of the system and how they work together and then it gives

recommendations for how those components shouldn't work together um but in such a way that it's really not that useful for you to as a generic description of that type of vulnerability so I don't know maybe my problems engineering game isn't good enough but I feel like this part of like distilling information doesn't work that well yeah GPT something more more like a tool for nope I found that some time ago but I didn't use it much but basically they

are agent so you simulate through a protocol and they are agents like AI agents you know that try to interact protocol and it's a little bit like you can build I suppose it's possible to uh in the same way you know we we teach uh AI to play uh go or chess you know we can teach AI to it's a goal of this system to do security checks or to do economic modeling I think it's used for economic modeling and testing protocols yeah it can be used for whatever for so I think agent-based simulations very useful

um I think there's a quote I forgot who's from like all models of wrong but some are still useful um so this is for for economic modeling you can add like figure out like parameters uh do parameter tuning kind of make predictions about how people would will interact with it um from a security perspective in terms of simulation and I I think fuzzing is more of what you're looking for who's agent-based simulations are about seeing what median or like what the performance is under normal load and security is about what but what if it's not normal what if someone does something you don't expect and fuzzers are like better

geared towards figuring out like what things the code does not expect and kind of triggering those those weird behaviors although there's some interesting applications in like crypto Economic Security and figuring out the stability of economic systems where agent-based simulations are definitely very powerful and useful