"The ETH in my wallet is gone!"
Today, Arthur, the founder of DeFinance, stated on social media that he had suffered a spear phishing attack. Arthur clicked on a PDF document in an email that resembled the official address of the Defiance Capital cooperative asset management platform, resulting in the theft of his hot wallet and the loss of a large number of NFTs and other assets worth over 400ETH.
The world of Web3.0 does not seem to be safe, and our on-chain assets seem to be threatened everywhere. Indeed, from the perspective of the upper layer, on-chain applications not only need to consider the loopholes in the application logic, but also consider the possible potential attack routes (such as preemption, etc.) of the consensus layer of the deployed chain. In addition, we also need to keep our eyes open to see the front end of the interaction and prevent various phishing links. The most deadly point is that once the transaction is guaranteed to be liquidated, the cost of rollback is extremely high. In this way, the overall security level of Web3.0 is not as good as that of Web2.0.
But from a lower level perspective, theoretically speaking, Web3.0 should actually be more secure. For example, the decentralized parallel execution on the chain creates a trustless execution environment for the applications on the chain. DoS attacks often encountered by Web2.0 applications are also resolved by the Gas mechanism. The open source of the protocol also gives users the "right" to DYOR before using it, etc...
This article is from Tal Be'ery, an encrypted wallet ZenGo, which explains in detail the inherent security advantages of Web3.0 and proposes potential solutions to existing problems. Rhythm Research Institute translated the full text:
I know this sounds ridiculous, after all Web3 security is one of the biggest laughing stocks in tech right now, and Web3 lost over $10 billion to security breaches last year. However, I think the current situation should be phased rather than continuous. Once Web3 applications become more mature, they will surpass many "traditional applications" in security.
Definition of Web3
image description
Web3 triangle
After defining Web3, we can start to discuss its security, which mainly includes the security of smart contracts. For simplicity, we will only discuss smart contracts on Ethereum, but I believe the conclusions apply to other similar systems and blockchains as well.
Web3 Security Has Its Inherent Benefits
Imagine what an upgrade it would be if malware, denial of service attacks, and other types of attacks were free of Web3 software environments. Let's take a look at Web3, which realizes a security utopia:
- Web3 solves the problem of trusted execution: For traditional applications, trusted execution is a major unsolved problem. Currently, an application must trust the execution environment of its software (operating system) and hardware (processor and firmware). If this trust is breached by malware or a hardware supply chain attack capable of implanting a malicious processor, an attacker could gain control. Web3 addresses this fundamental security problem with the decentralization of execution. All blockchain nodes are executing web3 code in parallel and must agree on the results of the execution. Unless there are some systemic risks in the execution engine itself (for example, there are vulnerabilities in Ethereum's EVM itself), the attacker must launch a "51% computing power attack" to infect most blockchain nodes with malware to disrupt its execution.
- Web3 is immune to injection attacks: For traditional web applications, all parameters are sent as strings. This design flaw is at the heart of most traditional web application vulnerabilities, including SQL injection and command injection, which allow attackers to smuggle unexpected input into flimsy web applications. In contrast, due to the strongly typed nature of Web3, such unexpected input (such as a string when a number was expected) will fail immediately, and Web3 applications do not need to do anything special Prepare.
-Web3 is more resistant to denial of service attacks: although these attacks are not smart, because they usually rely not on "brain power", but on the "brute force" of botnet armies, sending garbage to the attack target at a lower cost traffic, but they remain a major problem for traditional web applications. In contrast, Web3 applications will not suffer from this problem, because the blockchain has set high transaction fees to prevent excessive usage, so that DoS attackers have no way to start.
In addition to the above points, Web3 has also shown good security in other aspects (for example, in responding to software supply chain attacks). However, just doing the above points is already quite powerful.
However, in addition to the above-mentioned technical advantages, Web3 also has some security advantages in a conceptual sense due to its complete openness and transparency. Long before the emergence of Web3, the concept of open security has many advocates in the security field, who believe that it has more advantages than "hidden security". Web3 takes the idea of open security to the extreme: in Web3, not only is code open source by convention, but binaries are by definition public on the blockchain and verifiable as a result of published source code . Furthermore, by definition, all code executions (transactions) are public and can be verified and reviewed by anyone.
Theoretical advantages are not practical advantages
If the security of Web3 is much better than traditional applications in theory, why in practice, DeFI applications are still not as secure as traditional banking applications?
I don't think it's because of how bad Web3 security is per se, but because it operates in such a hostile environment that attackers can more easily make money from hacking. Web3 applications are dealing with "liquid funds" all the time, because the transfer of funds on the blockchain is almost instantaneous and immutable; while in the traditional banking system, even if the bank application is hacked, the The property involved in these malicious transactions can be recovered before the attacker cashes out.
Specifically, we can look at one of the largest bank hacks, the 2016 Bangladesh Bank hack. Attackers used malware to infiltrate banks and send fraudulent SWIFT wires in an attempt to steal $1 billion. In order to actually get the $1 billion, the attacker needs to target a specific date, which coincides with a bank holiday, giving them enough time to cash out. They also need to be prepared ahead of time at a Philippine bank that can handle large wire transfers to get the funds out before the wires are returned. In the end, the attackers got "only" $60 million of the $1 billion, not because the bank's software was more secure, but because the environment was more permissive, giving defenders enough time to recover the wire transfer.
Therefore, we can conclude that in order to defeat the attacker, we need to buy more time for the defender.
To do this, we need to reduce the detection time of an attack, or increase the time before a transaction can be reversed, or both.
I am very optimistic about our community's ability to improve the attack detection time, because some security companies (such as peckshield) can make use of the above-mentioned blockchain transparency and "open security" concept based on public data to make advance detection of hacker attacks. early warning. Judging from recent hacks and their post-mortem analysis, nothing prevents analysis from being performed in real-time as transactions are executed (even when a transaction is executed as a "possession" in the mempool of the node). When we integrate such an advanced early warning system into the contract, it may be enough to prevent such malicious transactions, as recent projects such as Forta.network have shown.
Even today, cashing out is not as easy as it seems. Some Crypto Tokens have set up their own blacklists to freeze the assets of listed users. In addition, to cash out into fiat currency, attackers usually need to rely on centralized exchanges, which are increasingly regulated and have added KYC functions (know your customer) and blacklists to prevent attacks are cashed out. As a result, some attackers today prefer to return most of the hacked funds, keep only a small portion, and launder these funds into "bug bounties" issued by hacked applications. Just like the recently seized hacked funds of Bitfinex, it is actually difficult for these hackers to cash out large amounts of Crypto. To be sure, cashing out will only get harder.
Conclusion: We will succeed
While the security of Web3 is far from enough, as it continues to improve, it has the potential to become a safe shield for our digital activities in the future. As with most revolutionary technologies, the more feature-rich Web3 becomes, the more of an issue its security becomes, and this has always been the case. However, with the financial support of venture capital and successful Web3 projects in the future, security system talents will continue to pour into the Web3 field from traditional security products, and I believe that the security of Web3 can be fully utilized by then.
Web3 and Crypto technologies involve many disciplines in computer science and economics, while I only understand the field of security. I believe that Web3 will bring about major breakthroughs in the security field, and I also believe that it can improve other areas that I don't understand.
Original link
