Lazarus! How to stay safe from the biggest threat actor in crypto by Mudit Gupta | Devcon SEA

[Music] everyone uh thanks for coming um it's going to be a fun talk uh so we have slides up uh everything's ready so we'll just get started um so first of all me uh if you don't know me I'm mod Gupta I'm Theo and interim CTO at polygon Labs um I lead security and Engineering at polygon today I'm going to talk about Lazarus which is the biggest threat actor in crypto if you ask me or if you ask the numbers uh they have stolen the most amount of crypto among uh our threat actors in the space and by far uh most of the other larger hackers have actually ended up returning their funds but good luck getting anything back from Lazarus so um it's definitely a Hot Topic and we'll discuss about that I have 20 minutes to discuss about 20 hours of content so we'll go a bit fast uh so first of all like who is Lazarus uh they are a North Korean hacker group uh which is notorious for um like compromising they traditionally use all the web to attack vectors for compromising web3 companies so but they didn't start at this um they started out in 2019 or so or 2009 or so maybe 8 with just simple DS attacks against South Korea I mean that's how it starts in North Korea um but then they realized they can go Global so they started attacking Banks and uh other big companies from 2014 or so the Sony hack was a big one where they were inside the Sony systems for over one year before Sony realized oh someone's in here um then they started focusing on crypto exchanges in 2017 because they realized oh these guys have lots of money and no security so let's do it um but they hit the defi lottery in 2022 with the 600 million Maxi hack 100 million Horizon hack um and a few others and that's when they actually started printing like now it's a really big source of revenue for North Korea which we definitely should be stopping so let's talk about the top hacks from these guys um you can see the numbers here and there is something interesting uh in all of this um let's see if you guys notice that uh the question is how did they do it we'll go over that but do you see anything common in all of these acts I know it's a bit small to see for far but I'll just give the answer it's basically social engineering or fishing like every single hack that uh Lazarus does starts from fishing or social engineering um so that is their uh signature move and that's their expertise Lazarus allegedly has around 25,000 operatives by best estimates um and they have the expertise in all the web to attack vectors uh they have most of the operators are based in North Korea but Intel suggests some of them are in Thailand some in China uh some in Cambodia and so on so um they are getting Global slowly um yes it was fishing all along like no matter how much we secure our keys in everything uh if you get fished it's uh it's a bad thing um most of the fish like fishing attacks as a category falls under social engineering um so it's it's a big category that you need to be careful about um I'll go over really quickly some social engineering techniques uh that they have uh Incorporated and just imagine like how many of those will you fall for so one very common one right now is they get hired at your company they'll do the interview they'll do a great job at it they'll do all of the homework you give them and boom they are your employee now and uh if you are an employee it's relatively easy to compromise your company um Zach did some research lately and he found at least 15 companies in crypto that were employing North Korean hackers there might be more that we don't know about but this is definitely a big one another big one I've seen people fall uh for is VC investment so have lots of young Founders here who are looking for VC Investments and this is one uho that these guys have picked up they would reach out to you and say hey we are this big name VC or whatever we invest in you uh want to invest in you and start chatting up with you now they can attack you at various stages it can be uh at the first stage where they say hey uh join this uh video call and then uh the video call wouldn't work and they'd say oh run the script to fix it or let's use this another software to do it and boom once you install that or run that job is done but I've also seen them go through do it at later stages and get to like uh legal paper side and then do it like we are getting just having this trouble in this thing can you help us or whatever so that's one thing News interviews a big one like um they will act like hey I'm the senior reporter at FBS or something uh can you do an interview with me uh things like that and then same attack Vector fake video call software and things like that uh fake video call uh job listings this is a big one this is what the axi fell for um they would try to hire your employees they would offer like a massive package great bonuses and everything perfect work condition and things like that and ask you hey come join us work for us um and they would give you like either a malicious exercise to do uh your start writing code you execute it to say it's working and you're compromised or they give you malaci PDFs you execute them and then you're done for um so there are a bunch of these things like using which they can get you and the reality is like if they actually come for you it's very hard to defend but there are some things you can definitely do and you should do first of all is fishing awareness training everyone thinks like they won't get fished or they know better but the reality is like the other side is getting so Advanced that it's it's important to keep up to date just look at the latest methods they are doing do some trainings um if you have a security team ask them to do fishing campaigns to make sure everyone in your or is safe um because even if you are perfect if the other guy in your or is stupid you will still get wrecked imagine a scenario where you're working on a GitHub repo together uh you're following all of the best practices but the other guy guy gets compromised um they end up pushing some malicious thing to your GitHub repo uh you pull the code for your latest work and boom you're You're gone as well so it's very hard but the only way to do it is um to have proper training is to do it for everyone um you can't skip anyone then the other big thing is be skeptical of unsolicited communication like if you don't expect to receive any communication uh then just ignore it if it's important they'll reach out again um can be messages emails letters anything uh the other one is verify identity independently it goes into like the rule of multiple factors of authentication everywhere uh where like if someone does you to do something critical over telegram for example make sure to verify it over slack also or verify over WhatsApp also to make sure it's the right person you're talking to um things like that if a new person connects to you at this conference via telegram hey I lead this thing at this company blah blah blah maybe ask them to send you an email from their corporate address to make sure it's actually them and you're not following for another attack uh some of the operatives might be here with us learning how to get better so we have to stay a step ahead of them uh avoid clicking suspicious things use strong passwords tofa keep software updated um educate yourself um and so on like I'm going really fast because lots of content to go through uh the thing is if they really want to get you they will get you there are so many attack vectors that it is almost impossible to defend against so what we need is layers of security layers of security is what's going to help you for example um it should NE it you should architect your things in a way that even if you are compromised or even if one person is compromised nothing is lost this is why multisig are very handy if properly done I'll come to that but imagine a scenario where there is um let's say even a 3x5 multis to compromise a 3x5 multi-c you need to compromise three people even if it's VI fishing or social engineering compromising three people at the same time which might be using different uh mechanisms or might be physically located differently or will have different ways to responding messages is very hard versus just compromising one person um so I can like if they want to compromise any one person they will reach out to you now you might get compromised today or you might defend against 100 attacks and you might get compromised two years later but eventually you will fall if they want to come after you but if they have to go after three people it is very hard even if one Falls they will know and recover by the time they can get the second one um so just have more people in line layers of security uh then that's the other thing like yes social engineering is the common thread here but actually it's none of the attacks are just social engineering social social engineering is just a step inside the door uh it doesn't give them anything if you architect things properly and that's how things should be um you avoid social engineering at all costs you make it hard and expensive for them to do it but you architect your things in a way that even if someone is social engineered nothing really happens um and one of the best things to do is is principle of lease privilege uh but we'll get to it first let's yeah delays of security first one I mentioned is principle of lease privilege I really stand by it in the sense like I see in a lot of companies like the CEOs and everything will say oh give me all the access like I'm the most important person but the reality is if you want a proper security architecture the most public faces should have the least uh Authority or the least access if you look at polygon like the founders have no access sandep can't even open my calendar um so it's just like even if they get wrecked they the attackers will get nothing even me have I have less access than anyone reporting up to me uh just because I am a bigger Target it it's natural people will go after me um but yeah you come after me you will get nothing so uh definitely follow principle of lease privilege don't let ego come in between that hey I'm at a higher position I should have more access or things like that that is not how you secure things multiple factors of authentication is very important um I said like if someone sends you on telegram verify it on WhatsApp and so on MDM EDR is very underrated but a very nice tool it's basically corporate antivirus um and I said it's all about layers of security you will stop 99% of the fishing attacks MDM EDR will stop another 99% and um it's additive in the sense like it's then you're stopping 99.99% attacks like um so it's better to have those layers um then uh just architect things properly don't have a 3x1 multi for example that's not very safe uh don't have a 1 by two multisig as well uh don't give access to all of your keys of the multisig to one hot wallet um it doesn't help that way so um yeah just architect things properly in a trust minimized uh setup where you don't need to trust anything the other big one is safe custody most of the hacks uh that Lazarus is done if those protocol were cing Keys safely it wouldn't have happened the underlying root cause really was just poor custody of keys um and always use your Spider Sense like if something smells wrong it probably is wrong be because cous about that um and this is the big topic how do you custody safely um so it I'll focus on multi6 but um I'll start with the caveat that consider using a professional custodian um maybe even service like fire blocks if you don't know what you're doing um once you get comfortable with it once you learn the things then you can do it on your own but there is no shame in using someone better if you are not experienced in something nobody can know all of the things in the world so it's better to not risk it and just use a professional custodian if you're not comfortable but if you are self custody then let's talk about it one thing you need to do is use Hardware wallets it doesn't matter if it's $100 of crypto ous of crypto or if it's just a multi key use Hardware wallets like browser wallets are just inherently not safe enough um the other one the obvious one is do not share your nimonic private key whatever with anyone do not share it with metamask support do not enter it out in a computer do not copy paste it uh do not take a photo of it and upload it on Google photos as a backup there's so many ways but this is the most common way that people fall for it believe it or not so just keep your private key safe and make sure it's backed up don't lose access to that wallet uh then I'll get on some more dedicated tips one is if you're using Hardware wallet always try to connect it through rabby or metamask or other browser wallets to uh websites and the reason for that is then you can verify what's happening in your browser wallet as well so you're basically instead of completely just trusting the website you're trusting your browser wallet to be safe which is which has more chances of being safe um so yeah you're connecting uh to nosis safe connect your ledger to your rabie and connect your rabby to your nosf so whatever nosf sends for Signature you verify on rabby and then you click execute and then you verify on Ledger and then you execute um then you can consider using a dedicated device for signing which should be semi- a gabbed which means you do not do anything else on it uh you throw in a firewall and only Whit list these things you really need like the noses Safe app uh and everything is blocked so it limits the attack VCT on that device significantly um then use multisig it's a very basic one um but yeah like Hardware wallets are totally fine but definitely use multi6 before that I will focus on one more Point uh which is verify what you're signing even on your Ledger wallets like I know it's you only see hash sometimes but you need to verify it um there is actually a good script by PC for verifying save transactions um you can use that perhaps that that would take your safe transaction convert the hash and then you can verify that the hash on your computer screen and your Hardware wallet matches the reason for uh doing that is U it protects you in the scenario where your computer is compromised or the website is compromised and you are seeing one thing you are seeing okay I'm transferring $100 to Alis but the data that is being sent to your Ledger is transfer everything to Bob um which you don't want to do but if you don't verify it on your Ledger there are so many ways in between the screen and the device which can and your Ledger which can be compromised which can change this so you should verify always everything on your Ledger device as well uh when using multi6 the other thing is ensure a secure threshold for signatures um so 3x1 is not secure it's not the industry best practices as someone some might claim um so just you have to balance out risk and practicality with security so I'm not saying do like 99 by 100 multis it's not going to be practical nobody is going to follow it but create risk profiles and uh set standards for what you are going to do if it's very critical software then um I I would say like use some ratios like uh uh 8X 11 9x 12 something like that uh very high ratio uh so people would have to compromise like 8 n people to uh compromise what uh you're doing the other thing is always segregate wallets based on their access and funds they hold don't just use one multisig for all purposes for operations and everything like don't use your critical multis to do $10 payments no like have a separate operational multisig have a separate treasury multisig have a separate one for uh smart contract upgrades and so on just separate risks so and you can have different thresholds then accordingly so your operations are not blocked I'm expecting nobody is doing upgrades every day so that multis can be a lot more secure if you're doing smart contracts every day let's have a talk something is wrong um but yeah like ideally you should not be upgrading things every day and I'm not going to stop you from making $10 payments every day that one you can do in a more practical way uh then for uh signers try to use a diverse set of signing devices um and the reason for that is compromise uh like a Windows machine plus metamask is a completely different risk profile than compromising Android plus uh Ledger uh nanox with Bluetooth and so on um so the more diversed set of signing devices you have the harder it's going to be to execute an attack against you um it you can argue that one stack is uh theoretically safer than the other but having the diversity gives you security of both it gives you benefit of the Both Worlds um and you you can enforce you don't really need to enforce it if you let naturally people use what they want to use you will have a diversified set but if you somehow end up everyone with one set you can ask them to move to another the other big one I want to mention is do not ignore failures when signing this is how vazer X and other folks uh fell for it they signed a malicious transaction and they saw a failure on the screen because it wasn't the right one the app was expecting and they was like H it's web 3 five failures one success it's normal Let's uh let's try again uh but no if you fail a critical if you have a failure on your critical device figure out why it failed before moving on to more signatures um that is uh very important so these are some of the things you need to do to stay safe uh once you have safe custody it's it's actually you you would be in a very good situation and when I say custody it's not just crypto custody but any secret custody um for example for axi their C system was there private keys for validator signing keys for validators or the bridge operators basically they had to keep those secure but they weren't that's where they got hacked all of these attack vectors are not really web 3 it's web 2 compromise of a secret the secret can be a private key it could be something else it's at the end of the day it's the same thing we have not seen Lazarus execute a big smart contract hack so far uh I'm not saying they don't have the expertise I'm sure they are building it up but in the current world uh we need to be more worried about uh these Basics instead of the smart contract I think we have gotten a we have made covered a lot of ground there and we are very good at smart contract security we just need to get better at other things and that's it for today uh thanks for coming I will open it up to questions awesome thank you very much mudit nice big round of applause for you all right uh first question on the screen which I also had in mind do you think there's anyone from Lazarus in Defcon or even in this talk what do you think mudit most likely yes I me most likely yes when you were saying there in Thailand I was like oh my God in Thailand um you know so do I mean what's the possibility I had a Heckler yesterday at my workshop so I don't know but like the likelihood is if they are serious about this so it does make sense for them to slip someone in that's why like just be careful with your security don't scan random QR codes for questions maybe yes yes but this one this one no wait this is not random this is randomly generated but it's not random it's purposeful there's a secret inside you can get an nft and it's 100% secure right right mudit say yes yes yeah very good thank you okay next question um did you say that Lazarus has 25,000 operators I'm not sure but was that what you said so nobody knows the exact number uh but this is the best estimates from different Intel sources that I've gathered it's around 25,000 all right have you ever applied to work at Lear that's all right um P keys versus UB Keys what do you think it doesn't need to be versus it can be both they just have multiple act factors of authentication I'm not a big fan of just using Pas Keys as your authentication mechanism because again then you're relying on a single medium and the way Pas keys are implemented it's a whole different topic but I have so many complaints for example like all of that would be if you're using iPhone it would be bagged in your iCloud if it's Ed if you're using Google it would be with Google yes it's encrypted but people lose their password so again it becomes a single factor which you should be against like have multiple factors of authentication every time exactly I think echoing what he said diversity in your security all right do you think the guy asking if Lazarus members are here is from Lazarus could be could be Double Double Bluff technically they Lazarus tries to stay under the hood they don't want the Limelight so unlikely that the person would ask unlikely but possible uh um did Lazarus ever try to fish you and if yes how so I've been trying to like since morning probably 10 fishing attempts um I don't know if it's Lazarus I don't want to know if it's Lazarus um and you shouldn't care either like you treat all threat actors as the same and try to not get hacked sorry 10 fishing attempts as of this morning yes and most of the people sitting here probably had a few look up your emails and you'll see what what what what were the 10 fishing attempts if you don't mind sharing a little bit so people yeah for sure I mean uh just telegram messages uh Twitter messages emails through those and all of the attack vectors I mention um here probably half of them already happened since morning and it it keeps happening the more public visibility you have the more people will go after you and the more security and like that critical mindset you need don't trust anyone I don't even trust myself all right thank thank you I mean that you don't trust yourself okay uh well I hope you put your trust in the blockchain uh given your position have you ever been a victim maybe not perhaps of Lazarus but have you fallen victim to a fishing scam or another type of scam before um I we have detected at polygon a few times when Lazarus tried to get in in fact even with our hiring program we know at least eight instances where they applied um and uh we never even took their interviews but it was obvious it's Lazarus uh on the infra side they keep trying to get in with scanners and everything it's very ineffective but they keep trying every day there are known Lazarus IPS that we block um and so on so I know they are trying um but so far we have not detected any successful attack I'm I'm very happy to hear I'm sure the audience is as well they've tried but they failed what is the highest impact thing a user can do to improve their personal security uh just be cautious of things don't trust anything or anyone you would be fine yeah yeah don't trust anything or anyone or as I experienced on Twitter a guy named Kobe messaged me and I blocked him because I thought it was a scammer I was wrong it was the actual Kobe um so if he's watching this I'm sorry um moving on to the next question are you considered a local Dev isolation as one of the security or do you consider local Dev isolation as one of the Security Solutions I mean I'm not sure what this question refers to maybe it's something like a cube OS setup um so it definitely in that setup you eliminate lots of attack vectors uh but there are still a few which sneak in so here you have to manage the practicality of things uh versus actual security concerns because I can set up like the worldclass policies which would make you impenetrable but if you are practically not able to follow those it means nothing all right thank you for that answer as well very comprehensive few more Before Time runs out what what's one question should you ask a potential candidate oh this is a good one to screen out lazarous operator so you said when you received those job applications it was obvious to you but how is it obvious so the most obvious giveaway for me has been fake job experience like um I was leading R&D at Sushi swap before this and I've gotten three resumes where the developers say they are the lead developer at Sushi swap like no you are not um so verify the references that's the biggest one and beyond that like it's it's usually gets clear from the resume if it looks fake it probably is fake like even if you miss out on a good candidate it's better to be safe but once if you don't detect that at stage you got get in a call try to get them to turn on their video and you would see like the way they behave is very like robotic kind of um their English is broken they would say I've been living in America for 25 years and then say speak broken English um things just don't add up uh it could be anything but you if you have that Spider Sense you'll realize right very very good points as well veryify uh are you part of lrus I'm going to answer that as uh leave it as mystery um uh let's go to a few more we got a 1 minute and a half fishing campaigns are too basic and fishing done by dprk is very sophisticated so why do you think it's useful to do them good question fishing campaigns are not basic maybe the fishing campaigns you have seen are basic um but I can construct fishing campaigns that almost everyone here will fall for um so it's it's it's just that yes by default the default template fishing campaigns are simple but some examples I shared earlier in social engineering techniques they can be very very very complex I absolutely agree I almost fell for fishing fishing hack once when uh someone sent me an email with my manager's name and said please join this meeting urgently Ross and I almost hovered over it and I was like wait a second check with my manager and found out it was fishing uh we got 30 seconds let's see one or two more who do you think or who sends you these estimates about 25k people where do you get the information from about laus yes some private Intel but this number I think is on the internet as well all right fantastic obviously we don't know the exact number it's best guess how do they Cash Out coins 10 seconds to answer this um they have a big laundering Network um they use U you can learn about it a lot more I don't want to detail how to launder coins but uh there is ways there are wayed a nice careful answer ladies and Gentlemen let's give our speaker a big big round of applause M Gupta thank you guys thank you very much thank you thank you thank you