This webinar covers various aspects, including the rise in cyber security incidents, identification of vulnerabilities and loopholes, effective prevention strategies, mitigation techniques, and more. It aims to provide a comprehensive understanding of the evolving cybersecurity landscape in the context of Web3 technologies.

 

Key Discussion Points

  • Discuss Security Incidents & Business Use Case
  • Understanding Web 3 Pros
  • Understanding Web 3 Cons. Prevention mechanism
  • How to make sure that it doesn’t happen to you?

 

About Speaker

Gregory Pickett is a Blackhat USA Speaker, CISSP, GCIA, GPEN. He is the founder and Head of Cybersecurity Operations for Hellfire Security. He has presented research at over seventeen international conferences. He is a Six-time speaker at Defcon and three-time speaker at Blackhat.

 

(Webinar) Recorded

 

Discussion Highlights

1. Common Attacks

  • Price Oracle Manipulation
  • Improper Access Control
  • Improper Validation and Logic Errors
  • MEV Attacks (Front Running, Sandwiches)
  • Traditional Methods :
    SIM Swapping, Phishing Attacks, Vulnerable Nodes, Abused Permissions, Abused Network

2. NUWA Hack

  • ERC-20 Token
  • Price Oracle Manipulation
  • Publicly Known
  • Liquidity Pool Imbalance
  • Distorted Exchange Rate
  • Used to Exchange At A Favorable Rate

1.jpg?profile=RESIZE_710x

2.jpg?profile=RESIZE_710x

3.jpg?profile=RESIZE_710x

 

3. Important Events/States To Emit

  • Low Balances
  • Liquidity Pool Ratios (Or Exchange Rates)
  • Change in Ownership
  • Funds Distributions
  • Attributes Generated
  • Wins/Losses

 

4. Important Operational Capabilities

  • Blacklist Wallets
  • Transfer Pools
  • Pause Contract
  • Kill Contract

 

5. TenderFi Hack

  • DeFi Platform
  • Price Oracle Misconfiguration
  • Publicly Known
  • Implicit Decimal Point
  • Overvalued Token
  • Produced a very favorable loan (larger than total value of all Bitcoin)

4.jpg?profile=RESIZE_710x

 

5.jpg?profile=RESIZE_710x

 

6. AquaDAO Hack

  • Decentralized Autonomous Organization
  • Governance Attack
  • Insufficient Stake
  • Malicious Proposal
  • Destroyed Value

6.jpg?profile=RESIZE_710x

 

7. Exchange Hack

  • Hot Wallet
  • Abused Privileges
  • Not Public
  • No Privileged Access Management
  • No Compensating Controls
  • Transferred Funds Out of Hot Wallet
  • Drained Hot Wallet
  • No Privileged Access Management
  • No Log Aggregation
  • No Monitoring of Login/Logout Events
  • No Access Attestation
  • Enterprise Network
  • Abused Network
  • Not Public
  • No Zoning, No Hardening, and No Governance
  • No Compensating Controls
  • All Customer Data include OTP Seeds
  • Wouldn’t you like to know

7.jpg?profile=RESIZE_710x

 

8. Fintech Hack

  • Key Engineer
  • Phishing Attack
  • Not Public
  • Lacking Cybersecurity Fundamentals
  • Buying Products to Solve Problems
  • Who Knows
  • No Security Awareness Training
  • No SIEM Tuning
  • No Flow Monitoring
  • No Privileged Access Management

8.jpg?profile=RESIZE_710x

 

9. Buying Products (or Services) to Solve Problems

  • Protecting Users (EDR)
  • Protecting Network (SASE)
  • Monitoring Activity (SIEM)
  • Secure Software (SSDLC) (Audit Services)

 

10. Hope Is Not A Strategy

  • They Are Looking for the Perfect Products
  • If we have the right X/Y/Z, we will never have to worry about threats
  • Web3 Itself Is Seen In A Similar Fashion
  • Just Perform More Audits

 

(PPT) Presentation From The Discussion

 

 

E-mail me when people leave their comments –

CISO Platform

You need to be a member of CISO Platform to add comments!

Join CISO Platform

CISO Platform

A global community of 5K+ Senior IT Security executives and 40K+ subscribers with the vision of meaningful collaboration, knowledge, and intelligence sharing to fight the growing cyber security threats.

Join CISO Community Share Your Knowledge (Post A Blog)
 

 

 

Best of the World Talks on The CISO's Journey: From Expert to Leader

  • Description:

    We are hosting an exclusive "Best of the World" Talks session on "The CISO’s Journey: From Expert to Leader" featuring David B. Cross (SVP & CISO at Oracle), Bikash Barai (Co-founder of CISO Platform & FireCompass) & David Randleman (Field CISO at FireCompass).

    The journey from cybersecurity expert to strategic leader is a transformative one for CISOs. This session delves into the stages of a CISO’s evolution, the balance…

  • Created by: Biswajit Banerjee
  • Tags: ciso