The State of DeFi Security - 2024

Transcript

hey everybody Welcome to session four I'm Jack Sanford CEO and co-founder of Sherlock we have a very exciting session coming up for session four first we're going to talk about the state of defi security then we're going to go into some of the opsc issues which is very relevant because we've seen a ton of obsc hacks in the past couple of months way more than smart contract hacks then going to talk about how to build secure D5 protocol is going to have a great panel of Builders up here and then I'm going to close talking about the state of the audit contest area of security um so please give it up for Peter catri

ginsky who's doing our first talk he's been at coinbase on the security side for about six years and he writes probably the best security newsletter in the entire web 3 Industry um blockchain threat intelligence so if you haven't subscribe to it do so now and I'll take it away Peter soik crab welcome to the state of D5 security DSS 2024 Edition so in case we haven't met my name is Peter kinsky and as you just heard I'm the editor of the blockchain thread intelligence newsletter for the past 5 years how many subscribers do I have

here in the room by the way awesome okay okay I appreciate every single one of you thank you so as is now a tradition we meet once a year where we talk about the latest trends in defi security and most importantly identify what are the key issues you really need to focus so that when we meet next year you can push this security needle a little bit further and make the ecosystem safer the way we're going to do things this year is we'll jump into the threat landscape right away um something different is that we'll talk about who's responsible for all those attacks and finally what is it that we can do to what is the course that we can chart to make things safer so let's talk about the D5 thread landscape so the last time we met was

middle of 2023 so a few things changed since then by the end of the year the one thing that really started jumping out is the stolen private key theft that went from I think it was like number four number five to number two now with over $531 million stolen by the end of the year um the other interesting things that popped out last year were the kind of like Black Swan events we had just one-off attack vectors having out sized impact on the ecosystem so we had the Viper compiler bug and the uh the third web dependency issues where a bunch of different projects got compromised but the issue is the same that said the last time we talked about this chart here is

I asked you to focus on two things when you do code audits when you develop brand new smart contracts I really wanted to you to focus on price Oracle and reward manipulation so let's see how you did for this year so this is upto-date top 10 list right up to November so this is as recent as it gets you may want to take a picture um so let's start with the good news the price Oracle manipulation if you saw at the previous Slide the losses were around $200 million this year we're only seeing 50 so you 4X reduced the number number of losses to the ecosystem at the same time the number the

instances of that attack Vector also about half so that's great what about the reward manipulation same story there we've seen almost 10x reduction in the number of times protocols were hacked using this attack method and about the same number of instances so what's behind those numbers though is very interesting is because the majority of loss comes from just a couple of really large hacks the reality is that most of the hacks are to really small tvl value projects around 100K each meaning that most likely they're small enough that they didn't even go through the full audit um so as Security Professionals we rarely get a thank you to say hey like

you did a good job preventing all those hacks so this is my thank you to you whatever you are doing right now as code Auditors whatever you are doing as defi developers you're doing something right you you really took down those top two issues that were prevalent the past year caused almost $400 million in losses and you really cut it down now the bad news that Trend that we saw in the previous year with the stolen private keys well that's back and that accounts for the majority of losses in this year so far 4 almost $450 million stolen the other issue that we're seeing is the malicious Insider attack Vector that that thing did not even pop up on our top 10 list

it was not even registering and yet this year we're seeing $95 million stolen across 17 incidents here's the key though between private key compromises and malicious insiders those are not smart contract issues you're not going to catch those with smart contract audits because those are all operational security issues we got so busy focusing on Smart contract bugs that we kind of neglecting the rest of the security P so how bad is the problem so this piie basically outlines the likelihood of your whenever your project does get compromised what is the likelihood of it being compromised by whatever attack vector and you see this like big red slab that's your stolen private Keys that's uh what is it it's

around 64% and then malicious insiders another seven and a half so in case of a compromise the likelihood that you will get hacked because of the operational security issue is around 72% and what stands behind them on the stolen private keys side we have highly targeted fishing campaigns we have sophisticated malware that is replacing your transactions because before you sign it on your Hardware wallet old days getting drop at developers on the malicious Insider side we're seeing just single points of failure a single person making a few bad decisions can wreck your whole protocol so we've been doing well so far I I think we' really moved the needo on security on those smart contract hacks I think we need to evolve and really step

up how our security game and the way we're going to do this is first understand who are our adversaries what are there at ttps so tactics techniques and procedures and based on that we can start building a strategy of how to defend against them the key here is we need to step out out of our smart contract comfort zone looking at solidity code all day is is good please don't stop don't stop doing this but we need to on top of that add a few more things like infrastructure security uh hiring practices governance and so on and so on okay so let's before we move on let's cover a really big elephant in the room that we rarely talk about you know we are introducing uh operational security

issues today and we get we usually talk about smart contract security what about the users more than $461 million were stolen from our users not through scams or rug Bulls no those were technical fishing attacks those are the drainers that you keep hearing about 461 million I think we can't ignore this anymore we really need to put a dent into that number soon because I don't want to end up in the world where we have a bunch of defi projects which are Super safe but users are just pissed off and don't want to use defi anymore so they're all your Super Save defi projects are just sitting and no one uses them that said let's go back to thread actors so let's start our journey

understand who are the bad guys doing and stealing hundreds of millions of dollars from us every single year uh when I talk about threat actors I roughly divide them into four categories so those are the crypto natives criminal APS AP stands for advanced persistent threat those are basically kind of cluster together a group of people who are just persistently using the same techniques and targeting in the same way in the same similar targets nation state APS and we'll talk about one nation in particular and of course malicious insiders that's the new category so Crypton natives Crypt natives are basically one of us anyone of us in this audience right here you know someone who is participating in the

same talks Capture the Flag competitions audits but at one point or another they crossed the line um one example is uh Shakib Ahmed so he's a security engineer at Amazon so a security professional found a few bugs price Oracle and reward manipulation in a couple of projects on salana so Nirvana and Crema and decided to exploit them unfortunately well un fortunately crypto natives are not criminals so just one of us we made a few bad choices so often times they get caught very quickly because they're not very good at laundering money they're you know Googling things like defi hacks prosecution things like that so unfortunately this this person made a

mistake got arrested now facing five years in prison so when we think about crypto natives we have to think like what motivates them they're financially and ego motivated you remember kyber swap you know like there's a lot of ego in there and pride like I want to be the smartest person in the room so you have to kind of keep that in mind when negotiating for example they specialize in smart contract hacks and usually get caught due to opsc or when trying to launder funds and this year so far we can attribute around roughly like $300 million in Theft across 319 uh incidents new category malicious Insider right and this is someone that you trust this this is not really a hack it's

someone that you you let in through your front Gates and you give them all the access that they need but we don't really know what's going on inside every one of us right so one example of that is Jared Reginal Dunn stack um who basically had you know he was a smart contract developer he had full access to Smart contract uh private Keys got pissed off at the company so it was the uh pump. fund and decided to drain the wallet and revealed who he was was pretty like immediately on Twitter hospitalized there were mental issues involved and you know like this is something that we have to keep in mind when we think of malicious insiders we think like oh there's this evil person that we hired and they were out there to

get me from right away you know we're all people we all make mistakes and honestly we're we can mess up very quickly by just making a few bad decisions here and there so the key here is that you need to build your system accounting for that you can't have a single person who had just a single bad day wreck your entire thing you have you have to have resilience to your protocols so when we think about uh malicious Insider tactics they're usually financially sometimes just maliciously they're pissed off at you that's what motivates them they don't need to hack smart contracts or do any tricky things usually they have all the access that they need to your smart contracts to your infrastructure to your social media to do the things that they do usually easy to identify it's uh

usually the person who stops replying to their text messages and and Slack and just like uh crypto natives they have limited resources and laundering capabilities so they get caught pretty quickly things are about to get darker let's talk about criminal APS um so these are hardened criminals they don't necessarily specialize in crypto but if they see an opportunity to steal crypto from us they will they have traditional security or criminal security background like they used to stealing credit cards and identity and data and ransomware and all that crazy stuff they operate on net criminal networks where you have dedicated teams reserved for initial infiltration then stealing data then laundering funds and

monetizing so they there's a very tight Network that operates around the world uh so one group you should be it should be on your radar is it's know as the Comm uh also known as the scattered spider or octopus or un 3944 the reason for all those weird names is that every security company likes to use their own ways to name things just as a ownership almost so you always have this like alphabet or word salad of names associated with each thread actor uh so this one uh a couple of folks were caught so uh they're all in their late teens early 20s uh B based in Western countries so one was based in Us and other one was based in UK their primary techniques are Sim swapping AOS

social engineering and these are the folks responsible for hacks like LastPass uh they took over last bass they were able to exfiltrate that and then they realized H like a bunch of people are storing pneumonic keys in their comets which are unencrypted let's drain them so that was $50 million or Fortress $16 million hack and the way that it started was with retool compromise they got to retool they started scanning what they have access to they say oh people are dumping API keys by accident let's use that um MailChimp took over MailChimp looks like a lot a bunch of crypto companies are using that let's sent out fishing emails notice a lot of these attack are opport opportunistic they are not like targeting the protocol I want to hack this one target I'm going to steal money

from it like no they hack whatever they can get their hands on and then they see how much value they can exfiltrate from that so the key from here is uh things are about to get darker now so we uh everyone that we talked about so far are kids compared to the level of sophistication organization in danger to defi ecosystem this takes it to a completely new level uh nation state APS and one nation state uh AP in particular that we'll cover this is who you should stay awake at night thinking about are they looking into your protocol Lazarus AP Lazarus AP is a North Korean threat actor operating

under the reconnaissance General Bureau RGB almost ryes with KGB similar to kind of like a mix of CIA and FBI smushed together and they have very simple task obtain hard to obtain foreign currency Financial assets for the North Korean regime which is is a sanctioned country so it's very hard for them to trade and operate so they found this wonderful cryptocurrency industry as a ready source of income uh when we talk about Lazarus AP we often you know we think it's like oh it's just like one single group uh according to one report that was published in 2020 there around 1,700 members operating Under the Umbrella of Lazarus AP that

was 4 years ago based on how successful they are I would triple or quadruple that number so just imagine like you have a a team of a few thousand people each with like separate subgroups uh specializing in initial penetration exfiltration laundering funds uh highly organized uh group that is targeting your protocol very very hard adversary to deal with so this chart that you see here this is something that was shared by Paulo Alto team unit 42 and they roughly organize it into six groups here some the some are specializing in more like industrial Espionage and data theft the ones that we're going to cover are the ones that

are targeting us they are the ones that are stealing funds from our defi protocols from our centralized exchanges and so on so the first group we're going to cover is ap38 blue norf how many of you heard of that subgroup grp of Lazarus okay wonderful um their primary tactics are spear fishing they impersonate you know VCS they they lead you on through social engineering and then they you know they hop you on the video call and for some reason the video website is not working you have to download this video package you download the video package and now you're compromised um they the latest thing that they're doing they're they're dropping old days left and right the the one o day that they dropped recently was targeting a defi game so they comp prise a lot of users and just this morning I

was reading yet another old a campaign that they're running so they are a highly sophisticated actor with custom malware capable of developing zero day vulnerabilities to Target you and their background is fascinating way before a cryptocurrency industry even existed they were hacking all sorts of large industry like I started my career as malware reverser looking at the Sony Pictures malware and that was a very sophisticated piece of malware with all sorts of aisc techniques later on they targeted Bangladesh Bank they almost got away with a billion dollars that's a central bank that they hacked in a country um want to cry ransomware campaign yeah these guys are highly sophisticated and guess what they moved on to you now they're very

interested in the cryptocurrency industry uh so the status there are a few uh actors that were identified so uh these are pictures from the FBI Most Wanted chances are that we ever going to catch them notexist I mean this is a nation state with nukes that we're talking about so if you are compromised or you're targeted by this entity there's not much that you can do the other group we really need to uh discuss is Trader uh Trader Trader AKA Jade SLE and there a bunch of other names that they uh that the security industry is identifying these are the big boys these are the ones that you really need to worry about if you're not worried already now get scared so the Wier $230 million hack Ronin 600 million Harmony I mean the theft is measured in

hundreds of millions of dollars highly sophisticated highly organized if you ever watch how they La their funds they are machines they will go for days moving money from bridge to bridge to chain to chain with very little breaks because they operate as a very large team as I mentioned there are a few thousand people operating uh under this umbrella the these are the same folks that were running apple juice Mal campaigns where they were sending fake trading apps to infect machines these are the folks that are sending you sending your devs uh fake job offers like hey like we have a interesting interview for you download this npm with a few dependencies see what happens let's see if you got the skills you download the npm and then you hacked

um the latest one are North Korean IT workers and that really comes from a separate group it's not necessarily sitting under the same umbrella as the rest of them those are the IT workers that have legitimate jobs you know you may have seen doc iies how they're North Korean uh restaurant workers they generate currency for the regime um there are also 4,000 IT workers out there somewhere uh posing as Western programmers IT workers and so on making like 100 150 G's of pop so you can imagine like this this group even without stealing anything is already generating like half a billion at the very least for the regime that said sometimes they go Rogue sometimes they steal stuff so Cosmos they developed all of the um uh liquid staking for Cosmos

munchables and tapi a few weeks ago sometimes they just take the keys that they have and they run so nation state apts financially motivated intelligence motivated sometimes they can get destructive as we've seen with Sony Pictures well funded and resourced spear fishing social engineering laundering tactics uh that's what they operate with so far these are the folks responsible for three and a half billion dollars lost to our industry um we talked about you know the SEC uh chart like how much of it how much of uh how much of the opsc total loss is Lazarus responsible how much can we attribute well about a third and that's I think that's a very conservative estimate like we didn't

attribute every single hack due to operational security issues to Lazarus my guess is closer to 50% but you can you have to dig a little further okay so the bad news if a sophisticated team like nation state AP will talk you you will get hacked no matter how many defenses you put in you can do all your code audits you can train your staff if they are out to get you they will get you so you're not going to like the solution the solution is to be just a little bit harder to attack than the other guy and the way that we do this is we start building a more comprehensive Security Programs so

we can't think just about smart contract security anymore we have to think about a whole lot of stuff we have to stop talking about application security as we had just an incident with uh 1 inch we have to talk about cloud and infrastructure security how many of you have proper logging and minimized access to all your Cloud Ino Key Management operational security can you wake every all of your devs and key signers at the right time at 2 am in the morning at Defcon to make sure that you can quickly move the funds while you're getting hacked Personnel security endpoint security and I added social media security because I'm just tired of seeing Twitter and Discord and all those other getting compromised every week my grade for the industry today is green for smart contract security not

because we soled it as an industry but because we know what to do we know what the code audits are we know we have a variety of code audit offerings out there but there's very little information other than what was recently introduced by medy a few a few hours ago we have the seal framework that starts to address the rest of them so we need to start adopting those recommendations at the industry start thinking about things which are not cool you're not looking at solidity code anymore you're looking at boring Cloud infra but that is what we have to do four things that I would love for you to do today that will have an outsized impact on your on your security program for the love of God please have multi- with time locks there's no reason why you need to upgrade a contract

instantaneously just give it a few days sleep over a weekend let make sure that someone looks at your whatever code that you're about to execute the code data and sees if it's actually doing what it's supposed to be doing have Guardians that can override that set up unchain modering practice incident response I don't care how many alerts you get if no one is looking at them it doesn't matter hire carefully protect your personnel teach them about spear fishing look at the latest attack Trends the last one please buy devs really crappy slow machines that are dedicated for administrative and signing functions the reason why they should be slow and crappy so they don't feel like they should use it for anything other than what it's designed to do so no email

checking no social media no downloading repost from you know from the interviews and so on okay so I think just to be on a positive note I think defi security ecosystem got a lot safer we graduated to the next level so this is a good thing we also are now facing much more serious villain so now it's also time to UPG how we defend ourselves through mature and complete Security Programs the journey continues and see you all next [Applause] year not sure if we have any questions

maybe one question Yeah couple questions yes sir maybe you have a Micon yeah so It's Tricky so you can't you're not controlling Twitter for example it's like highly centralized entity so you need to make sure that you established security contacts and you have some kind of practiced Playbook that you can use if something happens every minute that

you shave off especially for social media you're saving your users a few million dollars So the faster they can react um you should probably engage uh brand management companies that have those like Insider connections with all these companies that something that honestly as a as a di5 protocol you shouldn't be worried about so think of it as like a necessary expense just sign up to those brand protection things and they will Fast Forward your request to take it down yes all um I definitely strongly agree with like the operational security and uh I feel about it but the the ask that you have for the industry um do you have any for that side of it because I think

there were they were all smart contract related your 8020 slide says that ask to deploy multi with time locks set up on train monitoring uh protect personel from spear fishing and have laptops for signing but what about the operational security side that you were talking about so those four there's a lot more the security program like I showed you like it takes a lot and even the graph that I showed you is like a subdivision of like a fully mature security program those four things are based on the most recent hacks so I can tell you like the radiant Capital like I wish there was a you know time lock or something like that I'm just watching like the most painful ways that protocols get compromised and those are the most the the smallest things that you can do

they'll have the outsized impact on your security St but yes like I wish we could invest into full monitoring and threat modeling and all of the like understanding like every single way that someone can get attacked those are just that's just the beginning uh cool I think one more question oh yes sir but but the beginning you know as you said it's like if you're harder to hack than the next person you won't be the victim but the industry is still going to cop it right that's maybe that's something I'm taking away from traditional security

where we just try our best I just remember like I mentioned Sony Pictures right and you know I remember there was a discussion at that time like wow if a nation state attacks you what's our response you're not going to respond to it yourself you can't hack back you don't have any legal background is your government going to respond on your behalf no as we've seen so if you don't have any counteraction action you're not legally allowed to counter hack what's what's your recourse is just try to be better so it's a it sucks as I said like the solution you're not going to like the solution but it's uh it's the one that we have cool all right everybody please give a hand to Peter thank you very much Peter