Dustin L.’s Post

In a tweet on May 16, 2023, Vitalik acknowledges that all Ethereum L2s have “backdoors”. Buterin said temporary backdoors can be used by malicious actors to gain unauthorized access to a network. He also said that temporary backdoors can be difficult to detect and remove, which makes them even more dangerous. In Layer 2, a temporary backdoor is a technique to access a device or network while getting through standard security precautions. This can be accomplished either by setting up a switch or router to accept illegal traffic or by taking advantage of a flaw in the device's firmware.   Network administrators frequently deploy temporary backdoors for maintenance or troubleshooting. For instance, a network outage can force an administrator to construct a temporary backdoor to access a device. However, rogue individuals may also use temporary backdoors to breach a network's security.   There are several problems with temporary backdoors in Layer 2. They can be challenging to find and eliminate, to start. A backdoor can be challenging to locate and shut down once it has been installed, especially if it is well concealed. Second, it is possible to get around security mechanisms like firewalls and intrusion detection systems by using temporary backdoors. This may make it possible for hostile users to enter a network covertly. Third, malware or other harmful software can be installed on a device using temporary backdoors. This may further jeopardize the network's security.   Temporary backdoors should, in my opinion, be avoided if possible. They should only be used if they are really necessary, and they should be taken away as soon as they are no longer required.   The following advice may help you reduce the dangers of temporary backdoors in Layer 2: ·       Build temporary backdoors only when absolutely necessary; ·       For backdoor protection, use only strong encryption and passwords; ·       The capabilities of the backdoor should be limited to the necessary purpose; ·       Once it is no longer needed, remove the backdoor; ·       A network should be monitored for indications of unauthorized access. Only by being careful to create a system defense and providing effective protections can you help reduce the risks associated with temporary backdoors in level 2. Of course, nothing, however, is simple.     https://lnkd.in/e3trG9kf

Let's have a look at one of the most recent Smart Contract hack of the 𝘏𝘦𝘥𝘨𝘦𝘺 𝘍𝘪𝘯𝘢𝘯𝘤𝘦 protocol in which a staggering amount of $𝟰𝟴𝗺 user funds has been exploited, although the vulnerable contract has been 𝗮𝘂𝗱𝗶𝘁𝗲𝗱 by 𝘊𝘰𝘯𝘴𝘦𝘯𝘴𝘺𝘴 in Jun 2023! This shows that auditing is not enough by far to prevent hacks and ensure security of smart contracts. Another interesting fact is that the hack was due to a flaw in 𝗯𝘂𝘀𝗶𝗻𝗲𝘀𝘀 𝗹𝗼𝗴𝗶𝗰 of the protocol and not caused by any code/technical vulnerabilities showing that security experts in Web3 need to have an excellent understanding of code as well as economics of protocols. An 𝗮𝘁𝘁𝗮𝗰𝗸𝗶𝗻𝗴 𝗰𝗼𝗻𝘁𝗿𝗮𝗰𝘁 (0xc793113f1548b97e37c409f39244ee44241bf2b3) has been developed and deployed to run a series of attacks on the 𝘊𝘭𝘢𝘪𝘮𝘊𝘢𝘮𝘱𝘢𝘪𝘨𝘯𝘴 contract (0xbc452fdc8f851d7c5b72e1fe74dfb63bb793d511) of 𝘏𝘦𝘥𝘨𝘦𝘺 𝘍𝘪𝘯𝘢𝘯𝘤𝘦 draining in total $48m starting on Apr 19th. The funds were transferred to 𝗮𝘁𝘁𝗮𝗰𝗸𝗲𝗿'𝘀 𝘄𝗮𝗹𝗹𝗲𝘁 address 0xded2b1a426e1b7d415a40bcad44e98f47181dda2. All these contracts, addresses and transactions can be publicly viewed via the Ethereum blockexplorer etherscan. The exploit itself occurs by locking and unlocking (canceling contract) funds (𝘜𝘚𝘋𝘊 in this case) into the 𝘊𝘭𝘢𝘪𝘮𝘊𝘢𝘮𝘱𝘢𝘪𝘨𝘯𝘴 contract through the attacker. By doing so, the attacker receives 𝗮𝗹𝗹𝗼𝘄𝗮𝗻𝗰𝗲 𝘁𝗼 𝘄𝗶𝘁𝗵𝗱𝗿𝗮𝘄/𝘁𝗿𝗮𝗻𝘀𝗳𝗲𝗿 locked funds to the exploiting smart contract. Since the funds from the attacker were coming from a 𝘉𝘢𝘭𝘢𝘯𝘤𝘦𝘳 flash loan, the borrowed amount either needs to be paid back or new/additional tokens need to be claimed. This claiming of additional tokens is not allowed by the logic of the 𝘊𝘭𝘢𝘪𝘮𝘊𝘢𝘮𝘱𝘢𝘪𝘨𝘯𝘴 contract, however it is 𝗡𝗢𝗧 𝗿𝗲𝘃𝗼𝗸𝗲𝗱 for the 𝘜𝘚𝘋𝘊 token contract which caused the vulnerability and led to a series of attacks of this type. As a result, the 𝘊𝘭𝘢𝘪𝘮𝘊𝘢𝘮𝘱𝘢𝘪𝘨𝘯𝘴 contract has been working as intended, but the business logic had flaws that were not detected in a smart contract audit before. Exactly that's what we're working on at TRUSTBYTES with our 𝗦𝗺𝗮𝗿𝘁 𝗖𝗼𝗻𝘁𝗿𝗮𝗰𝘁 𝗔𝘂𝗱𝗶𝘁𝗶𝗻𝗴 𝗣𝗹𝗮𝘁𝗳𝗼𝗿𝗺 in order to not only prevent hacks from code vulnerabilities, but also from flaws in business logic. Credits: CUBE3.AI & Hedgey Finance #staysafe

Smart contracts are for sure the future rails of our financial system- away from data base entries to process transactions to irrevocable transactions written into Blockchain, publicly accessible for anyone. However, smart contracts are not secure enough yet: $4b of user funds get lost through hacks or scams each year. In total, even $79b were stolen over the last couple of years, since the inception of smart contracts about 10y ago. With TRUSTBYTES we change that to secure the future rails of the financial system on-chain that will also be used by the big incumbents in the industry! Many big players like BlackRock, Societe Generale or DWS Group are already dealing with digital assets and thus, smart contracts and offering products on-chain. Are you ready to switch to on-chain finance, secured by TRUSTBYTES or what are your concerns? #smartcontract #security

August 30 newsletter is out now! Get the latest insights and news on web3 security! Check out our analysis of recent exploits at Exactly Protocol, LeetSwap, JPEG’d, and Pond0x. https://lnkd.in/eSNpHU3N

Asymmetric encryption, also known as Public-Key cryptography, this method of encrypting data using a pair of keys: a public key and a private key. The public key is used for encryption, while the private key is used for decryption. Key characteristics of asymmetric encryption include: 1. Key Pair: One Public key is shared openly, while the other private key is kept secret. 2. Encryption and Decryption: Data encrypted with the public key can only be decrypted with the corresponding private key, and vice versa. Asymmetric encryption provides a higher level of security compared to symmetric encryption because even if the public key is know, the private key remains secure. Commonly used in digital signatures, secure communications, and key exchange protocols., like RSA ( Rivest-Shamir-Adleman), DSA (Digital Signature Algorithm), and ECC ( Elliptic Curve Cryptography).

Remember how hard it was to transition to IPv6, actually still not quite there, remember how hard it was to get everyone to move their apps to support TLS 1.3? Compared to the effort this will take to accomplish is like flying to the moon. Everyone needs to start inventorying your current crypto in your network and make a plan to migrate to these new algorithms. This is an area of security we cannot ignore and hope it happens organically, this will take effort and support from the highest levels of leadership in all organizations. Failure to successfully implement new Post Quantum Encryption standards can destroy all of the security we have worked so hard to put in place.

Understanding the underlying custodial and security models is an important consideration for everyone in the ecosystem—if you're launching a new project or simply interacting with tokens. Different security models have different use cases. Get to know your infrastructure in today's article, live on the blog now. https://lnkd.in/g8WQ3KDd There may be certain jurisdictions in which our Wrapped Tokens are not available to users, including the United States. These Tokens are not available to US Persons and US Persons will not be permitted to mint/burn.

NIST Finalized Post-Quantum encryption standards NIST has released a final set of encryption tools designed to withstand the attack of a quantum computer. These post-quantum encryption standards secure a wide range of electronic information, from confidential email messages to e-commerce transactions that propel the modern economy. #encryption #pqc #quantum

PCI DSS 4.0 Requirement 4: Protect Cardholder Data with Strong Cryptography During Transmission Over Open, Public Networks, 4.2.1-Strong Cryptography and security protocols are implemented as follows to safeguard PAN during transmission over open, public networks: *Only trusted keys and certificates are accepted. *The protocol in use supports only secure versions or configurations and does not support fallback to, or use of insecure versions, algorithms, key sizes, or implementations. *The encryption strength is appropriate for the encryption methodology in use. WHAT IS STRONG CRYPTOGRAPHY? Cryptography is a method to protect data through a reversible encryption process, and is a foundation primitive used in many security protocols and services. Strong cryptography is based on industry-tested and accepted algorithms along with key lengths that provide a minimum of 112-bits of effective key strength and proper key-management practices. Effective key strength can be shorter than the actual "bit" length of the key, which can lead to algorithms with larger keys providing lesser protection than algorithms with smaller actual, but larger effective, key sizes. It is recommended that all new implementations use a minimum of 128-bits of effective key strength.

Did you know that… 🔹 HSMs are providing highest security for generation and storage of cryptographic keys 🔹 No other solution in the market (such as software or USB solutions) can compete to the security of an HSM   Based on their strong physical and logical security, the level of key security they are providing is unbeaten. HSMs are secured against attacks, theft or manipulation and provide compliance to the highest security requirements, such as FIPS 140-2 Level 4 (physical), VS-NfD or eIDAS. Based on their unique capabilities to securely generate and store high-quality cryptographic keys, they provide the #RootofTrust for all use cases within your digital infrastructure.     Utimaco’s General Purpose #HSMs have been designed to meet the needs and standards for multiple use cases in various market segments in a highly reliable and secure manner. Get an overview of our complete portfolio of HSMs addressing different performance and physical security levels across industries on our website. #security #secureyourfuture #hsm #cybersecuritysolutions