Taking Your Crypto Security to the Next Level

Transcript

and writer CEO of cryptic Sage he will be sharing his insights and expertise on cyber security today and I don't really want to take up his time because we are here for you Armin the floor is yours yes thanks thanks a lot so hello everyone it's really great to be here at this great conference and to have this master class and let me at first quickly introduce what we at cryptics do so cryptics is a venture Building Company and in the last few years we established a few ventures in the web free and blockchain space we act here as a One-Stop shop so if you have any blockchain projects we can

deliver full service which means that we do marketing we take care of legal topics we do software development product development and I.T and I.T security so in the last year we for example build block trade block trade is a cryptocurrency Exchange we build e-credits e-credits is a layer one blockchain solution for merchants for shopping we also have Ambassador programs and so on and we also use it for tokenization projects then we have Akito Akito is a mifi2 license broke in Slovenia where we do crowdfunding projects and financial services in general

and finally one of the last branches that we did is Rock Solid estate it's a real estate tokenization project where we have a few apartments in Vienna we will tokenize them we will do a crowdfunding via Akita the investors will get a security token on the e-credits platform and in the next month they will already receive payouts from their Investments we all do this because we want to create wealth and we have such an infinity loop which starts on the e-creative side so you go shopping you get some Kickback and you can save this kickback you can then use this Kickback to invest into real projects like in the real

estate project you will then get paired like dividends or or rental income and you can use this again to go shopping and the good thing and the nice thing here is you will get it on the next month and you will get it to your e-wallet so you will wake up you will have a notification and you know that the money is coming in we have founded 2017 we are about 60 people at cryptics but if we look at our whole ecosystem then we are about 200 people working there our main locations are here in Turk in Austria and in Slovenia and we already created eight Ventures including Akita Rock Solid estate and the cryptic security

we then split our services into three areas so one is business and consult it and Consulting where we do for example cyber security software development blockchain research blockchain Consulting we have a marketing and Communications area and we have a financial services area and below that through all the services we've built our Ventures and we do business development so here you can see an overview of all the services that we provide starting with tokenization software development blockchain research cyber security marketing and many other things so let's now start to talk about why we

are here so let's talk about crypto security and at first I would like to ask you so who of you feels secure in the crypto space and with your funds so basically just three people so so you're in the right room here so that's good and um let's start to talk about what happened last year so we had a lot of crypto breaches uh security gets more and more important and then last year we saw for example about 3.8 billion trained from their free protocols so it's a quiet lucrative business to be in there we have about 200 million lost due to exit camps we have

about 355 million lost because of flash loan manipulations and exploits and we have about 1.3 billion lost because of bridge exploits but it's not just about crypto security what we talk here it's in general cyber security and we also had a Twitter breach last year where about 6 million users were affected Nvidia lost about one terabyte of data Revolution also WhatsApp and we all can remember the lock for Shell this big issue that affected basically yeah I would say

nearly all companies and finally we had the last pass hack and I would like to talk a bit about what happened there because it's really interesting to see how they were able to get in there and what happened so in August last bus stated um that they detected an unauthorized access they said it's still fine in September they said that no customer data or passwords are compromised so it's still secure in November and here you can see how it's step by step evolves so in November they notified the customers about another security incident and then they confirmed the theft of source codes and

Technical documentation so that's already a huge issue because in in source code you sometimes have secrets maybe they are encrypted maybe not the attackers will know what libraries do you use so they can really start to to attack the system in January the CEO said that an attacker was able to exfiltrate and encrypt the backup of the Vault this is an issue it's not that bad because it's encrypted right so you can you need a key to decrypt it so basically it would be secure but in February they said that the devops engineer was hacked and as part of that

the attacker was able to get a decryption key and that's a huge issue so they still said it's fine because we have our zero knowledge architecture so if we look at this picture we can see that you have a master password and they will put the the master password into a password-based key derivation function until May they did 100 000 rounds to make it hard to brute force it and now they increased it to 600 000 rounds which makes it a bit more secure but it's also important to mention that in earlier years they just had five thousand rounds and some people did migrate or change that so they are still

at this like old security so all of this password-based key derivation function they get an encryption key and this encryption key is used to encrypt and decrypt the data they use the advanced encryption standard as we know it's a symmetric encryption so they use the same key for encryption and decryption and it's required secure encryption mechanism and that's basically how you get the data in addition to the store the encrypted Vault on their servers so by sure they need to have it there so that they can provide the service and they have no access to it and all these walls of the users they are for sure also backup and this

attacker got access to these backups and let's see how this this evolved here so we already know the attacker has access to the encrypted walls basically with that he can't do that much but the attacker found out that there are four devops Engineers who have this decryption key because they previously we know that they hacked the source code and the technical documentation and most probably they found the information there so then they started to attack those devops engineer and they found that one of them had an outdated media server running at home so he didn't update the it was the Plex Media Server for about three years and there were a few

vulnerabilities already found in third-party libraries that are used in this media seller so by doing that the attacker was then able to install a key locker and capture the keystrokes of this devops engineer and one part that the the attacker was able to get was to master password of the Cooperative Vault of this devops engineer so the attacker had basically accessed to the to the password Vault of the death of the engineer which included the decryption key for the for the backups so the attack the attacker took that and is then now able to access it

what LastPass then said is that the attacker was able to copy a backup of customer volt data from the encrypted storage container container contains both unencrypted data such as website URLs and fully encrypted data such as passwords so the thing here is they still say they have their zero knowledge architecture and that's why it is secure but let's think a bit about what this means so they have access to all the walls of all the users so they exactly know who are the users that use LastPass and take hand already try to prove for us the

walls of the high net worth individuals of VIP persons so they can really Target specific people in addition to that there is unencrypted data such as website URLs so they know that the user is for example using Facebook that the user is registered as a bank or that the user uses whatever other service so that's very useful because you can start to do very targeted phishing campaigns you already know a lot of the of of those users and in addition to that if they store such website URLs so sometimes there is some session information included some link for a reset password so you can the attacker

can use that to get access it's also that they write such as so what does such as mean there is also other data that is leaked and you will find a support article where they describe in detail what is included there so what was preached and one field in there is for example if the password for this website was generated by LastPass or created by the user itself so that's also very useful if you want to Target some specific websites and try some some passwords that you know from previous hacks so it would be good if that would

already be the the whole thing so I mean we have this encrypted data and that one is still secure but we need to assume that it is secure that they use a strong master password so they state that their requirements are 12 characters and it must be mixed up and in that case it takes a few million years to crack it but who of the users really uses a super random password so that doesn't happen that often to be honest and that opens a huge issue the next thing is they have this backup so even if they are not able to crack it now maybe they are able to

do this in five years and if you for example store your seed phrase in there and they are able to hack it in about five years and they train your funds then you basically lose everything so it was a very very interesting thing and we can learn a lot out of that so I just wrote down a few things here see the first is for sure keep your software up to date it was in the home office and the home office is a very interesting and good thing for the red teamers because usually people don't update their routers at home you don't have logging so you don't know what is going on you don't have a mobile device

security and such things so that's already a huge issue so that's why you should really limit the access to your information and only allow compliant devices what's also important is I mean users are lazy and you always have this like trade-off between security and usability and users they even they have the VPN the company VPN they sometimes tend to just turn it off to surfing the internet because it's maybe faster so that's another huge issue and I mean it somehow understandable but what's really strange

in this whole thing is that this devops engineer was able to access really highly sensitive data so that should really not be possible so make sure to to restrict the access and think about how it is possible to access this data and where and how you store it so what does all of that have to do with crypto security so crypto security is not just hot and cold wallets so if you talk to crypto people they sometimes just say okay you need to have your offline seat phrase and then all is good but the topic is much more complicated and let's at first

have a quick look at what is a hot and cold wallet so a hot wallet is basically connected to the internet it is therefore less secure you will use it for small amounts and for a daily use so this is for example your mobile app the colored wallet is something that is offline so it's not connected to the internet and therefore it's also much more secure and much difficult to hack you can have for example a paper wallet you can have a hardware wallet to store your amounts there and usually you then just transfer from the cold wallet to the hot wallet and then use the hot wallet so I now have a few questions here so just think about if you have crypto

what happens if for example an exchange gets hacked do you have lots of funds there then it's probably a huge issue what happens if someone hacks your PC what happens if a password manager is hacked I mean we just saw that this is possible what happens if someone threatens you so if someone visits you with a gun and says hey give me your money but it's not just about that it's also if the government comes and wants to have your wants to know how much crypto you have and so on what happens if your house burns down and what happens if your Hardware wallet firmware update is manipulated

so there are a few things you can do we all know not your key is not your coin so just transfer away to start from the exchange to mitigate this risk what if your PC gets hacked you can say okay let's use a hardware wallet but if a password manager gets hacked yeah then you use something like an offline or cold wallet and you make sure that you don't put your seed phrase into the password manager if someone threatens you there is something called a hidden wallet so some Hardware wallets offer this option where you you basically unlock it and you have your wallet and in this unlocking process you enter a passphrase

and if you enter another passphrase then you come to your hidden wallet so even if someone comes to you and says hey give me your crypto money please unlock your Hardware wallet you do this with your main wallet where you just have a few hundred bucks and the other Millions you store in your hidden wallet in case your house burns down you can have multiple Hardware wallet for example and you can spread them or you can have a paper wallet where you have the seed phrase stored in the bank for example and yeah if you're Hardware wallet or firmware update is manipulated you can be sure on one side split funds or use a multi-stick wallet the

multi-stick wallet is by the way the one option that helps you in basically all of these cases so many people now think okay how high is the chance that the firmware update is manipulated so I found a few examples on the internet and there are people who said okay I updated my lecture life and it asked me to enter my seed phrase so that's somehow now a bit suspicious but not that much so they entered their seed phrase and then all the funds were trained another example is someone used windows reinstalled windows so far okay everything is fine

then install the electron wallet enter the seed phrase and then the funds were also gone so just because you reinstall the windows it doesn't mean that everything is cleaned up and all them always removed our Purity is a lot of traps why if you think about a hardware wallet if you want to have it available basically everywhere because it could be that you say okay if I fly somewhere I still want to have some possibility to access it or what if you are in a country with where you have a let's say a strange government and you

want to basically flee from the country so then you want to have a backup available not at your bank and not in your house because probably you are not able to access it so if you're safety seat phrase for example in a in the password manager or you use a pgp encrypted file for it something like that what could go wrong so you can have a malware or a virus on the PC there could be a key Locker which records your keystrokes it could be could be that your password manager gets hacked it could be that someone does an acoustic key logging attack so they basically try to monitor the audio sequences when you

enter something in the keyboard and try to derive the seed phrase out of that the same is they could have a camera where they try to to film your keyboard from the outside through the window and there is something called side Channel attacks so they can be used for your PC but also for your Hardware wallet and also further update as we have seen can be an issue so what is the side Channel attack Channel attack is you have a protocol and you don't attack the protocol itself but something that happens beside it so if you decrypt data for example then you

have your source code and this takes time and power so if you have more statements then it probably takes more power and you can measure it and you can then see it and try to get the key out of that another good example here is a voltage glitching attack so that's what a team did last year on a very popular Hardware wallet and what they basically did is they put extremely voltage into this Hardware wallet and we're able to switch a bit from no access to partial access with this partial access they were able to access the random access memory of

this device that's still not a big issue because there is not so many interesting information especially the seed phrase is stored in the secure element but then to initiate the firmware upgrade and as part of the firmware upgrade this device stores the seed phrase unencrypted in the random access memory so that they can just in case write it back to the secure store and that's how they were able to hack one of the most popular Hardware wallets so even with a hardware wallet you are not secure so here is just a quick overview how you can protect your Hardware wallet so that's really Basics you should only buy

it from the vendor you should only use your own seed phrases that you generate you should never enter it into a PC because it could be leaked use it for storage only and double check if the firmware updates are really legit so we now already learned that there are side Channel attacks and that the hardware wallets also have some issues so how can you really protect your funds the best thing here to do is to use a marquisig wallet such as technology safe in combination with a hardware wallet so a multi-seq wallet is basically a wallet where you need multiple signatures to

transfer money out of it so you can allow free people to sign a transaction and you need two people to do it so that the transaction is possible you can basically have all kinds of combinations here so you can have three out of five or you can have two out of five whatever fits best for you and I would like to go now through an example of a company which deals with crypto so let's assume it's a company has a few thousand in crypto and they want to store it in a secure way so the CEO creates a hardware wallet because Hardware wallets are more secure and

then they think they are fine so what happens if the CEO has an accident then the funds are gone so what you can do is you can create a second Hardware wallet and give it to someone else so in case the CEO has an issue you can go to the CEO who also has an access and who also has a hardware wallet puts you under another risk so what if the COO somehow wants to damage you and wants to steal your funds so that's why you start to introduce multi signatures you can now create a market SQL and say okay two out of two there is the CEO and the CEO and they are allowed to transfer the funds away that's even worse than the first option

because now if the CEO has an accident or the COO has an accident you lose all your funds so let's go for two out of three you add your CFO as a data Siler those three people are all in the same office so a chief comes to you with the gun and says hey I know you all three have the the possibility to sign a transaction so please do it and transfer your funds to me so at the next step you say Okay I want to be protected against that so let's spread across multiple locations so we have two out of three across Market locations so what could still happen is that those other two people

they come together and say okay let's take the funds and let's run away then you say okay let's go for a three out of five so you create a paper wallet which you put to the bank you have your CEO in one location you have your Co in another location the CEO is in another location and you have one wallet which you give to one of their employees for example so then you're already quite safe but we can continue to play this game and say okay what if three of those people are in the same airplane and the airplane crashes then only two keys survive and again you lost all your funds so that's why you should do something like

a risk assessment where you should go exactly through all those things and think about okay what risks do I have in general if you want to secure your your funds and stuff then for sure use strong password use multi-factor authentication make sure your notebook is secure and compliant and beware of phishing scams coming back to the risk assessment so a risk is basically here in the middle of this triangle where you have an asset the asset is your crypto for example the thread is a phishing email and developility is the human error so you need to think about what assets do you have

at what potential when the pillar is vulnerabilities and threats are there so you just list that you go through it so that's not a rocket science you just do it quite fast think about it and then you rate those risks you add a value for the likelihood so How likely is it that this happened and then you add another value for the severity so how how high is the damage if you have a lot of funds and you have just one Hardware wallet then maybe the chance that the house burns down is not that high but you will lose all the funds so the damage is extremely high and that's how you can can rate those risks you can act on it and that's the

basic of cyber security in general let's now dive into the topic of corporate crypto security so for companies you have different challenges like multiple users needs to have access to the funds the users are often that crypto heavy users so what we experienced in the last years is for example there is a hardware wallet and I want to hand it over so I just give it to my colleague but this person still knows the seed phrase right so that doesn't work out but that's really hard to understand for people who are not in this crypto space you also need to make sure that you you have procedures available if an employee

leaves the company or if you have an inside of red and you also need to think about how do you generate those keys and Seed phrases and so on and there is a thing available it's called the cryptocurrency security standard so that's a standard developed by the group by the cryptocurrency certification Consortium there are a lot of of prominent people also in there and they created a standard which is an addition to the iso standard and which focuses on crypto security you can get an audit for your company there are three levels so you have a self-custody so that's basically a shop

that uses crypto and accepts it there are qualified service providers and they're a full system which is for example a custody provider or an exchange have various topics so it's for example key seat generation how does that work how do you create wallets how do you store your keys do you document it in the right way what happens if a key is compromised what are the procedures going on there um and there are other things like audit logs so that's a very important thing um or security tests penetration tests audits so that's all included the standard is public available so you can

just go through the table check it if you fulfill those things it's a very very good input for you if you want to increase your security and if you want to get audited according to the cryptocurrency security standard then via cryptics for example can do that because my colleague Alexandra Ellis Cesar he is the first ccss Auditor in Europe and yeah we are happy to support you here I would like to close this with 10 General tips for for security so the first is don't pull all X in the same basket because even if you have a bridge just one part of your group disc is gone

especially careful with hot Walnut so we saw a few examples where we where users had an issue make sure that you always have a secure backup of your wallet beware of phishing scams double check the addresses that you have make sure that you don't store too much on on one exchange do not share your wallet pressure and finally use this multi-seek and Hardware wallet because it allows you to access it from different locations also for you personally so if you're like traveling around and even if someone like preaches your Hardware wallet you still have two other options how you can access it

so thanks a lot for your attention finally I would like to mention we have a booth out there so if you're interested in cryptex and in cryptic security visit us and we also have a cyber security challenge where you can win 100 Euros in Bitcoin and something in e-creative and yeah just visit us there and yeah thanks a lot for your attention and if you have any questions then please come up with them do you have a question or okay

yes absolutely so we have these multiple Ventures and what's important for us is to always include security when we build those Ventures and we help them so in the crypto space sometimes this unfortunately doesn't happen but we really think Security in all areas if we build a solution we think about how can we secure the software how can we secure the smart contracts we we audit all the smart contracts that we do and what's very important to mention here we don't focus on the crypto part but on having compliant devices on following an ISO standard so following the best practices

in the general cyber security area because in most of the cases it's like fishing males and such things and yeah we also have cyber security awareness trainings that we do with the employees and those are quite successful so yeah that that's a very good topic I wanted to include it but I forgot it so The Ledger recovery is really interesting to us a huge hit show that happened here at the backlash they got from the from the community um

the issue here is they they announced that it's possible to back up your seed phrase so like the recovery service and the big issue is that the in the past they always said they are not able to access it there is no way never also not in the future and now they just deliver a firmware update and it works so there is a very good reason why they they have this like a black backlash from the community I mean what must also be clear somehow is that this Hardware wallet providers they deliver the firmware updates and they always have some opportunities to get your seed phrase so they can for example

have a firmware update you start the letter in that case and it says something like the firmware upgrade failed so please enter your seed phrase you enter the seed phrase and in the source code they could basically store it somewhere send it somewhere so in general there are such possibilities but by sure if you announce it's never possible and then it is possible so that's a huge issue and that's why multisig wallet is a very good option because we see all those Hardware wallets are also not the the perfect solution yeah so I will quickly repeat the

question so that everyone hears this so the the question is how many companies are already ccss audited and how many companies are allowed to do that so in the last half year we half year to a year we see that it gets more popular one of the reasons especially the FTX debacle that we had for example and for example fire blocks is one of the companies that is already audited so you can look on the website you will find all those companies and as I know there are currently about three to five who are audited or the crypto.com is working on it and regarding Auditors there is also at least on the website with all

certified Auditors and there are currently about 20 to 30 people in various companies across the globe I said so we were the first one in Europe I don't know if there is already someone else but yeah yep yeah so I don't have a recommendation here so there are a few interesting wallets that allow that out of the box um there is also a hardware wallet available which supports Bitcoin Marty

seek wallets so I would go into such a direction I don't want to have any names here but um yeah it's a Swiss provider it's interesting project so any other questions thank you so much thank you thanks thank you if you're if you have any questions to Armin cryptix has a booth outside to the right so feel free to

stop by talk to them say hello ask any questions thank you