Web3 Security: Types of Attacks and Lessons Discovered

#web3 #security #blockchain #hacks

Web3 security is largely dependent on blockchains’ unique capacity for commitment and resistance to human interference. These software-controlled networks are a prime target for attackers because of the related property of finality, where transactions are typically irreversible. As blockchains, the distributed computer networks at the core of web3, gain value, so do the supporting technologies and apps, making them more and more attractive targets for attackers.

We have seen similarities with historical software security trends, despite web3’s variances from earlier internet iterations.
The major issues are frequently still the same.
By researching these topics, defenders — whether developers, security teams, or regular crypto users — can better protect their projects, personal belongings, and wallets from would-be thieves.
Based on our expertise, we’ve listed several recurring themes and predictions below.

Following the money

Attackers typically want to get the best return on their investment. Due to the higher potential rewards, they can spend more time and effort attacking protocols that have more “total value locked,” or TVL.
High value systems are more frequently the target of hacking organizations with the most resources.
These desirable targets are also more commonly the target of novel exploits, the most profitable kind.
We anticipate that for the foreseeable future, low cost assaults like phishing will grow more prevalent.

Patching the holes

As programmers gain knowledge from tried-and-true assaults, web3 software may eventually become “secure by default.”
Application programming interfaces, or APIs, are frequently tightened in order to reduce the likelihood of errors leading to the introduction of vulnerabilities.
The effectiveness of the following attacks, including governance assaults, pricing oracle manipulation, and re-entrancy flaws, may significantly decline as security techniques and technology advance.
The cost of assaults may be increased by removing most of the low hanging fruit for attackers, even if security is always a work in progress and nothing is ever hack-proof.
Platforms that can’t guarantee “perfect” security will need to employ exploit mitigation measures to reduce the likelihood of losses. By lowering the “benefit,” or upward, component of their cost-benefit equation, this may dissuade attacks.

Categorizing attacks

Attacks on diverse systems can be categorised based on their similar properties. Defining qualities include how complex an assault is to pull off, to what extent the attacks can be automated, and what protection measures can be put in place to fight against them.

Pricing oracle attacks: market manipulators:
It’s difficult to value assets accurately. Market manipulation is prohibited in the conventional trading environment, and you risk being fined or even arrested if you artificially raise or lower an asset’s price.
The issue is severe in DeFi, which enables arbitrary individuals to “flash trade” hundreds of millions or billions of dollars, resulting in abrupt price changes.

Numerous web3 initiatives rely on “oracles,” which are computer systems that offer real-time data and serve as a source for data that cannot be obtained on-chain.
Oracles are frequently used, for example, to calculate the exchange rate between two assets.
However, attackers have discovered a means to deceive these purportedly reliable sources.

As the standardization of oracles progresses, there will be safer bridges between the off-chain and on-chain worlds available, and we can expect markets to become more resilient to manipulation attempts. With any luck, this class of attacks may, one day, disappear almost entirely.

Profile
Who: Organized groups (APTs), solo actors, and insiders.
Sophistication: Moderate (technical knowledge required).
Automatability: High (most attacks likely involve automation detecting an exploitable issue).
Expectations for the future: Likely to decrease as methods for accurate pricing become more standard.

Governance attacks: the election stealers:
The first crypto-specific problem to appear on the list is this one. A governance component is present in many web3 projects, allowing token holders to submit and decide on network change requests. While this offers a chance for ongoing development and improvement, it also creates a backdoor for the introduction of malevolent ideas that, if implemented, might harm the network.

Attackers have developed novel strategies to get around restrictions, seize control of the leadership, and plunder coffers. Governance assaults have now been seen in the wild, while they were formerly only a theoretical worry. As happened recently with the decentralized finance, or DeFi, project Beanstalk, attackers can take out substantial “flash loans” to sway votes. Attackers can more easily take advantage of governance votes that trigger automatic proposal execution; but, if proposal enactment is delayed or needs human approval from many parties (via a multisig wallet, for example), it may be more difficult to carry off.

Profile
Who: Anyone from organized groups (APTs) to solo actors.
Sophistication: Low-to-High, depending on the protocol. (Many projects have active forums, communities on Twitter and Discord, and delegation dashboards that can easily expose more amateur attempts.)
Automatability: Low-to-High, depending on the protocol.
Expectations for the future: These attacks are highly dependent on governance tooling and standards, especially as they relate to monitoring and the process of proposal enactment.

Supply chain vulnerabilities: the weakest links:
Safety recalls are issued by automakers when they find faulty parts in their cars, and the software supply chain is no different.

Libraries created by third parties for software increase the attack surface. This has long been a security issue for systems prior to web3, as demonstrated by the log4j hack from last December, which had an impact on a lot of web server software. In order to locate unpatched vulnerabilities they may exploit, attackers will search the internet for known flaws.

Although your engineering staff may not have created the imported code, it still has to be maintained. Teams must maintain track of the progress and condition of the projects they rely on, check for vulnerabilities in the individual components of their software, and make sure updates are applied. It is difficult to appropriately inform library users of these risks due to the actual and immediate costs of exploitation for web3 software vulnerabilities. The jury is still out on how or where teams should share them with one another so as not to unintentionally jeopardize user funding.

Profile
Who: Organized groups such as APTs, solo actors, and insiders.
Sophistication: Moderate (need technical know-how and some time)
Automatability: Moderate (scanning to find faulty software components can be automated; but when new vulnerabilities are discovered, exploits need to be constructed manually).
Expectations for the future: Supply chain vulnerabilities are likely to increase as the interdependence and complexity of software systems rises. Opportunistic hacking will likely also increase until good, standardized methods of vulnerability disclosure are developed for web3 security.

APT operations: the top predators:
Expert adversaries, sometimes referred to as Advanced Persistent Threats (APTs), are the security industry’s bogeymen. They have a wide range of motives and skills, but they are frequently wealthy and persistent, as their name would imply; regrettably, they are quite likely to constantly exist. Although various APTs carry out a wide range of operations, these threat actors are more likely to directly target the network layer of businesses in order to achieve their objectives.

We are aware that certain highly developed groups are actively pursuing web3 initiatives, and we believe there may be more, unidentified entities as well. The individuals responsible for the most worrisome APTs typically reside in nations lacking extradition agreements with the U.S. and EU, making it more challenging to bring charges against them. Lazarus, a North Korean organization that the FBI has blamed for carrying out the biggest crypto attack to date, is one of the most well-known APTs.

Profile
Who: Nation states, well-funded criminal organizations, and other advanced organized groups. Examples include Ronin hackers (Lazarus, widely linked to North Korea).
Sophistication: High (only available to highly resourced groups, usually in countries that won’t prosecute).
Automatability: Low (still mostly manual efforts with some custom tooling)
Expectations for the future: APTs will remain active as long as they can monetize their activities or achieve various political ends.

New weaknesses: unknown unknowns:
Web3 security is no different. “Zero-day” vulnerabilities, so termed because they were widely known for zero days at the time of their debut, are a contentious topic in the world of information security. The hardest strikes to ward against are those that appear out of nowhere.

Web3 has, if anything, made it simpler to monetize these pricy, time-consuming operations because it might be challenging to recover stolen crypto money. Attackers can invest a lot of time looking through the code of on-chain apps in an attempt to uncover a defect that will make their efforts worthwhile.

Unaware projects are still plagued by certain former new vulnerabilities; for example, the re-entrancy problem that notably brought down TheDAO, an early Ethereum project, is still present in other places today.

Profile
Who: Organized groups (APTs), solo actors (less likely), and insiders.
Sophistication: Moderate-High (technical knowledge is required, but not all the vulnerabilities are too complex for people to understand).
Automatability: Low (finding novel vulnerabilities takes time and effort and is not likely to be automated; once found, scanning for similar issues across other systems is easier).
Expectations for the future: More attention attracts more whitehats and makes the “barrier to entry” higher for discovering novel vulnerabilities. Meanwhile, as web3 adoption grows, so does the motive for blackhats to find new exploits. This is likely to remain a game of cat-and-mouse as it has in many other areas of security.