Using Threat Intelligence in Web3

Transcript

our next speaker is Andy Bill and is going to talk about thread intelligence in web3 well thanks for sticking around everybody I know it's been a long day um so I'm going to talk about threat intelligence in web 3. we're going to talk about what it is how you get it and how you can use it I just want to kind of frame my comments uh by saying that I think it's a really exciting time for threat intelligence um I don't know if any of you attended the real-time monitoring panel earlier this afternoon but there were I think nine different companies on stage during that panel all of them doing some form of uh detection which is uh

the uh sort of the the necessary function that generates threat intelligence in this space so there were at least nine companies doing it I know of dozens of others which means there's a lot of teams out there generating threat intelligence a lot of it's being captured internally and used by those teams at Florida we're taking a slightly different approach and we're sort of opening it up and allowing a community to develop detection tools on top of the network and then make their make their threat intelligence as public as possible so let's get into it so let's Define threat intelligence real

quick so it is Data first of all that is collected and analyzed and I just mentioned there were nine teams earlier doing this there's many others that are collecting and analyzing uh data as well and the purpose of doing this is to one hopefully prevent attacks but you also want to learn about your attackers their their techniques their tactics their processes Behavior Etc and you can you can glean insight into all those things by collecting and analyzing uh threat intelligence so what kind of data are we talking about um the security Community will bucket

threat intelligence in different ways for purposes of today I'm sort of organizing it in three categories the first one is operational so this would be the identity timing and techniques of a particular attack and I'll get into some examples of this here in a second second category tactical threat intelligence sometimes this is referred to as TTP so tactics techniques and processes of a of a threat actor or a campaign third category strategic threat intelligence so this is more higher level sort of uh threat landscape Trend type Intel that will often a form like an executive

team or board's decision about what to do with the product or an investment or things like that okay so let's look at some examples so operational threat intelligence um for for purposes of the presentation let's think about it in the context of a phishing attack so some operational threat intelligence might be the scammer eoa that was responsible for the attack we know this attack happened on ethereum so the chain ID might be relevant the malicious URL that was used to trick the the the user or users um scam technique was ice fishing so maybe there was uh token approval farming that

was involved and then the timestamp so all of this um you know you can you can glean on chain and off chain um and this is something that that Florida is doing today second category tactical um so we're zooming out a little bit from the specific uh sort of instance of an attack and we're interested in the tactics and techniques that were that were used so for this phishing example um the attacker might have air dropped a Spam token right so they needed to create a token first and then airdrop that spam token to hundreds or thousands of of potential victims

um one example of this is called Sleep dropping if you're interested in this particular threat you can go read about it on the Florida blog another example of a tactic is using excessive funds to make a scam token seem legitimate so if you were to go to uniswap or some other amm and you saw you know a substantial amount of liquidity there you might think that that was a legitimate token but we're now seeing scammers that are you know seeding liquidity pools with millions of dollars of liquidity to just to make it seem like their their token is is in fact uh legit and then a a third example of this is um utilizing verified proxy contracts to make it again to make it look like your

your um your token is is legitimate and that the code's been verified okay and then strategic so a couple insights that we've that we've gleaned from looking at uh phishing attacks over the last year one of them is that on ethereum in particular the focus seems to be on stealing assets that are already held by users and this is because a lot of the most valuable assets particularly nfts are on ethereum today another Insight is that on BNB chain for example the focus is on getting users to buy and invest in scam tokens and they can they can do this because or it's

it's more profitable to do this because the transaction fees are are lower on BNB and some of these other chains so the setup cost the infrastructure cost of these scams is is a lot less okay so how do we collect threat intelligence I'm going to talk about it in the Florida context specifically so forta is a essentially a giant security camera and alarm system for web3 so from a tech stack standpoint we sit above layer ones and layer twos and the Florida network is just looking down on all the on-chain activity and we're looking for exploits scams patterns that look like those activities and when we see it we're essentially raising our hand and

saying we found something and emitting public alerts about that right so it's a giant public security camera and alarm system for for web3 there are about 1100 Bots or little security cameras running on the Florida Network today um some of those were built by the Florida Foundation some of them were built by some problem some teams or individuals that are probably in this room Ford is an open platform so any developer can can develop and install a little camera on the network and watch whatever they want to watch so what are some techniques that are used by some of these Bots there's a lot of heuristics you might

hear this referred to as rule-based detection an example of this is if I see a plus b that's a scam we're going to flag it right so it's a very kind of rigid way of defining what is what is bad another technique which we're seeing uh more of now machine learning based detection so an example of this would be I've seen 500 previous phishing attacks and this one looks similar so I'm going to label it as a as a as an attack as well um some other things that uh some of the developers in our community do are they'll do essentially they'll apply sort of guilt by association so

if we know that b is an attacker and it's an eoa and they deploy a new contract will automatically label that new contract as a scam because it's associated with something it's associated with an entity that we've already identified as a as a bad actor similarities another approach so we will analyze [Music] thank you well analyze smart contracts and uh apply different engines to to identifying and labeling in a new smart contract that's subsequently published on chain that looks or resembles uh a scammer contract okay so how can you use web3 or how can

you use threat intelligence in in web3 so um there are a variety of uses I'm going to start at the bottom actually because for the last couple years um the entities that we're leveraging threat intelligence in crypto I'm not going to say web3 but in crypto more web 2 crypto we're law enforcement agencies exchanges and AML compliance platforms right so think about um uh government agencies CIA FBI cyber crime teams things like that um and your large centralized exchanges right but over the last really year or two web three wallets dapps and protocol teams and also end

users now have access to more threat Intel right if you're using a wallet today you might see a warning pop-up that is telling you the you know the the contract or the transaction you're about to sign has a malicious entity involved right you may want to you may want to stop what you're doing so that's becoming more more common behind the scenes there's a lot of threat intelligence that's informing those those warnings protocol teams like we've heard right can react to potential exploits if they have timely threat intelligence um and end users can also do this right if you're you know perusing Twitter and

Discord and other social channels right you want to be mindful of um threat intelligence tactics and things like that so you can you can prevent yourself from being victim to social engineering so I will pause there it looks like I'm out of time thank you if anyone wants to talk more about threat Intel I'll stick around for a few minutes foreign