Web3 + scams = It's a match
0 likes46 views
The document discusses various scams and vulnerabilities related to cryptocurrency and web3 technologies. It begins by introducing Zoltan Balazs and his work researching vulnerabilities. It then describes several types of scams, including rug pulls, giveaway scams, advance fee fraud, and hardware wallet scams. Best practices are suggested, such as being wary of unsolicited messages, verifying sources of apps/dapps, and using strong passwords and hardware wallets to protect funds. The overall message is that web3 and cryptocurrency technologies have enabled numerous scams that have impacted many users.
Web3 + scams = It's a match
- 1. Web3 + scams = HiTB Singapore, 2022 Zoltan Balazs, CUJO AI
- 3. Head of Vulnerability Research Lab @ CUJO AI
- 4. Head of Vulnerability Research Lab @ CUJO AI Zombie Browser Toolkit https://github.com/Z6543/ZombieBrowserPack
- 5. Head of Vulnerability Research Lab @ CUJO AI Zombie Browser Toolkit https://github.com/Z6543/ZombieBrowserPack HWFW Bypass tool Similar stuff was used in PacketRedirect in Danderspritz FlewAvenue by EQGRP https://github.com/Z6543/hwfwbypass
- 6. Head of Vulnerability Research Lab @ CUJO AI Zombie Browser Toolkit https://github.com/Z6543/ZombieBrowserPack HWFW Bypass tool Similar stuff was used in PacketRedirect in Danderspritz FlewAvenue by EQGRP https://github.com/Z6543/hwfwbypass Malware Analysis Sandbox Tester tool https://github.com/Z6543/Sandbox_tester
- 7. Head of Vulnerability Research Lab @ CUJO AI Zombie Browser Toolkit https://github.com/Z6543/ZombieBrowserPack HWFW Bypass tool Similar stuff was used in PacketRedirect in Danderspritz FlewAvenue by EQGRP https://github.com/Z6543/hwfwbypass Malware Analysis Sandbox Tester tool https://github.com/Z6543/Sandbox_tester Played with crappy IoT devices – my RCE exploit code running on ~600 000 IP cameras via Persirai https://jumpespjump.blogspot.hu/2015/09/how-i-hacked-my-ip-camera-and-found.html https://jumpespjump.blogspot.hu/2015/08/how-to-secure-your-home-against.html
- 8. Head of Vulnerability Research Lab @ CUJO AI Zombie Browser Toolkit https://github.com/Z6543/ZombieBrowserPack HWFW Bypass tool Similar stuff was used in PacketRedirect in Danderspritz FlewAvenue by EQGRP https://github.com/Z6543/hwfwbypass Malware Analysis Sandbox Tester tool https://github.com/Z6543/Sandbox_tester Played with crappy IoT devices – my RCE exploit code running on ~600 000 IP cameras via Persirai https://jumpespjump.blogspot.hu/2015/09/how-i-hacked-my-ip-camera-and-found.html https://jumpespjump.blogspot.hu/2015/08/how-to-secure-your-home-against.html Invented the idea of encrypted exploit delivery via Dif fi e-Hellman key exchange, to bypass exploit detection appliances https://www.mrg-ef fi tas.com/generic-bypass-of-next-gen-intrusion-threat-breach-detection-systems/
- 9. Head of Vulnerability Research Lab @ CUJO AI Zombie Browser Toolkit https://github.com/Z6543/ZombieBrowserPack HWFW Bypass tool Similar stuff was used in PacketRedirect in Danderspritz FlewAvenue by EQGRP https://github.com/Z6543/hwfwbypass Malware Analysis Sandbox Tester tool https://github.com/Z6543/Sandbox_tester Played with crappy IoT devices – my RCE exploit code running on ~600 000 IP cameras via Persirai https://jumpespjump.blogspot.hu/2015/09/how-i-hacked-my-ip-camera-and-found.html https://jumpespjump.blogspot.hu/2015/08/how-to-secure-your-home-against.html Invented the idea of encrypted exploit delivery via Dif fi e-Hellman key exchange, to bypass exploit detection appliances https://www.mrg-ef fi tas.com/generic-bypass-of-next-gen-intrusion-threat-breach-detection-systems/ Co-organizer of the Hackersuli meetup Programme committee member of the Hacktivity conference Volunteer at IoTVillage
- 11. I ❤ Singapore
- 12. I ❤ Singapore
- 13. I ❤ Singapore
- 14. I ❤ Singapore
- 15. What and why
- 16. What and why This is a 2 hour presentation compressed into 25 minutes
- 17. What and why This is a 2 hour presentation compressed into 25 minutes Fasten your seatbelts
- 18. What and why This is a 2 hour presentation compressed into 25 minutes Fasten your seatbelts I love playing with new technologies
- 19. What and why This is a 2 hour presentation compressed into 25 minutes Fasten your seatbelts I love playing with new technologies I fi nd blockchain + Web3 fascinating
- 20. This presentation is NOT about/for
- 21. This presentation is NOT about/for WHOLE CRYPTO WORLD IS A SCAM!!!!
- 22. This presentation is NOT about/for WHOLE CRYPTO WORLD IS A SCAM!!!! Smart contract developers
- 23. This presentation is NOT about/for WHOLE CRYPTO WORLD IS A SCAM!!!! Smart contract developers Financial advise on which shitcoin to invest in
- 24. This presentation is NOT about/for WHOLE CRYPTO WORLD IS A SCAM!!!! Smart contract developers Financial advise on which shitcoin to invest in Crypto exchange hacks - see six/David's presentation
- 25. This presentation is NOT about/for WHOLE CRYPTO WORLD IS A SCAM!!!! Smart contract developers Financial advise on which shitcoin to invest in Crypto exchange hacks - see six/David's presentation Cryptocurrency is used as a form of payment, e.g. ransomware
- 26. How did we get here?
- 27. How did we get here? Lot of people got rich from cryptocurrencies
- 28. How did we get here? Lot of people got rich from cryptocurrencies Lot of people want to get rich from cryptocurrencies
- 29. How did we get here? Lot of people got rich from cryptocurrencies Lot of people want to get rich from cryptocurrencies Total market capitalisation is around 2 1 trillion USD
- 30. How did we get here? Lot of people got rich from cryptocurrencies Lot of people want to get rich from cryptocurrencies Total market capitalisation is around 2 1 trillion USD 2 1,000,000,000,000
- 31. How did we get here? Lot of people got rich from cryptocurrencies Lot of people want to get rich from cryptocurrencies Total market capitalisation is around 2 1 trillion USD 2 1,000,000,000,000 New complex technology with crappy UI
- 32. How did we get here? Lot of people got rich from cryptocurrencies Lot of people want to get rich from cryptocurrencies Total market capitalisation is around 2 1 trillion USD 2 1,000,000,000,000 New complex technology with crappy UI What could possibly go wrong?
- 35. What is Bitcoin anyway? Let’s hear it from a trusted, 3 Grammy award winner Blockchain expert!
- 36. What is Bitcoin anyway? Let’s hear it from a trusted, 3 Grammy award winner Blockchain expert!
- 37. What is Bitcoin anyway? https://youtu.be/5AN5veSPfY4 Let’s hear it from a trusted, 3 Grammy award winner Blockchain expert!
- 42. Step 1: Buy a lot from something what is cheap and has low volume
- 43. Step 1: Buy a lot from something what is cheap and has low volume Step 2: Advertise as the NEXT BIG THING
- 44. Step 1: Buy a lot from something what is cheap and has low volume Step 2: Advertise as the NEXT BIG THING Step 3: Sell on top
- 45. Step 1: Buy a lot from something what is cheap and has low volume Step 2: Advertise as the NEXT BIG THING Step 3: Sell on top Step 4: PROFIT
- 46. Step 1: Buy a lot from something what is cheap and has low volume Step 2: Advertise as the NEXT BIG THING Step 3: Sell on top Step 4: PROFIT Optional Step 5: Short on top
- 47. Step 1: Buy a lot from something what is cheap and has low volume Step 2: Advertise as the NEXT BIG THING Step 3: Sell on top Step 4: PROFIT Optional Step 5: Short on top
- 48. Rug pull
- 49. Rug pull Similar to pump and dump
- 50. Rug pull Similar to pump and dump But you are the owner/ developer of the cryptocurrency/token/ whatever
- 51. Rug pull Similar to pump and dump But you are the owner/ developer of the cryptocurrency/token/ whatever Even Conti ransomware group knew about SQUID
- 52. Rug pull Similar to pump and dump But you are the owner/ developer of the cryptocurrency/token/ whatever Even Conti ransomware group knew about SQUID
- 53. Rug pull Similar to pump and dump But you are the owner/ developer of the cryptocurrency/token/ whatever Even Conti ransomware group knew about SQUID
- 54. Giveaway scam
- 55. Giveaway scam
- 56. Giveaway scam
- 57. Giveaway scam
- 58. Giveaway scam
- 59. Giveaway scam
- 65. What is an NFT anyway? https://twitter.com/zh4ck/nft https://etherscan.io/nft/0x06012c8cf97bead5deae237070f9587f8e7a266d/634517 https://etherscan.io/tx/ 0xfe21bd24d7748890c4deb2453bcd22ab451349fdacb5e812422e16772a664723#eventlog https://etherscan.io/address/0xb77feddb7e627a78140a2a32cac65a49ed1dba8e#code
- 66. The “magical” world of NFTs … 1 ETH = 1700 USD
- 67. The “magical” world of NFTs … 1 ETH = 1700 USD
- 68. The “magical” world of NFTs … 1 ETH = 1700 USD
- 69. The “magical” world of NFTs … Paris Hilton BAYC - 119 ETH 1 ETH = 1700 USD
- 70. The “magical” world of NFTs … Paris Hilton BAYC - 119 ETH 1 ETH = 1700 USD
- 71. The “magical” world of NFTs … Justin Bieber - 500 ETH Paris Hilton BAYC - 119 ETH 1 ETH = 1700 USD
- 72. The “magical” world of NFTs … Justin Bieber - 500 ETH Paris Hilton BAYC - 119 ETH 1 ETH = 1700 USD
- 73. The “magical” world of NFTs … Snoop Dog - 2500 ETH Justin Bieber - 500 ETH Paris Hilton BAYC - 119 ETH 1 ETH = 1700 USD
- 74. The “magical” world of NFTs … Snoop Dog - 2500 ETH Justin Bieber - 500 ETH Paris Hilton BAYC - 119 ETH 1 ETH = 1700 USD
- 75. The “magical” world of NFTs … Snoop Dog - 2500 ETH Justin Bieber - 500 ETH Eminem - 123.45 ETH Paris Hilton BAYC - 119 ETH 1 ETH = 1700 USD
- 76. The “magical” world of NFTs … Snoop Dog - 2500 ETH Justin Bieber - 500 ETH Eminem - 123.45 ETH Paris Hilton BAYC - 119 ETH https://etherscan.io/token/0xbc4ca0eda7647a8ab7c2061c2e118a18a936f13d#readContract https://ipfs.io/ipfs/QmeSjSinHpPnmXmspMjwiXyN6zS4E9zccariGR3jxcaWtq/9055 https://cid.ipfs.io/#QmTHcV6mGxHGeeXCnYtV129eRiR8Exni4sT8dDikBWBgzY 1 ETH = 1700 USD
- 103. Discord scam
- 104. Discord scam
- 105. Discord servers hacked via bookmarklets Discord scam
- 106. Discord servers hacked via bookmarklets Discord scam
- 107. Discord servers hacked via bookmarklets Discord scam
- 108. Discord servers hacked via bookmarklets Discord scam
- 110. HW wallets - Ledger, Trezor https://whotookmycrypto.com/ ledger-wallet-scams/
- 111. HW wallets - Ledger, Trezor https://whotookmycrypto.com/ ledger-wallet-scams/
- 112. HW wallets - Ledger, Trezor https://whotookmycrypto.com/ ledger-wallet-scams/
- 113. HW wallets - Ledger, Trezor https://whotookmycrypto.com/ ledger-wallet-scams/
- 114. HW wallets - Ledger, Trezor https://whotookmycrypto.com/ ledger-wallet-scams/
- 115. HW wallets - Ledger, Trezor https://whotookmycrypto.com/ ledger-wallet-scams/
- 116. HW wallets - Ledger, Trezor
- 117. HW wallets - Ledger, Trezor
- 118. HW wallets - Ledger, Trezor
- 119. Best practices
- 120. Best practices don’t trust random people (or celebrities) on social media
- 121. Best practices don’t trust random people (or celebrities) on social media check source of the app/dapp
- 122. Best practices don’t trust random people (or celebrities) on social media check source of the app/dapp don’t send funds to someone you don't trust, or verify via phone
- 123. Best practices don’t trust random people (or celebrities) on social media check source of the app/dapp don’t send funds to someone you don't trust, or verify via phone block people/email sharing login, password, private key, seed phrase, backup phrase
- 124. Best practices don’t trust random people (or celebrities) on social media check source of the app/dapp don’t send funds to someone you don't trust, or verify via phone block people/email sharing login, password, private key, seed phrase, backup phrase extra careful to interact with KNOWN and unknown smart contracts
- 125. Best practices don’t trust random people (or celebrities) on social media check source of the app/dapp don’t send funds to someone you don't trust, or verify via phone block people/email sharing login, password, private key, seed phrase, backup phrase extra careful to interact with KNOWN and unknown smart contracts use password manager
- 126. Best practices don’t trust random people (or celebrities) on social media check source of the app/dapp don’t send funds to someone you don't trust, or verify via phone block people/email sharing login, password, private key, seed phrase, backup phrase extra careful to interact with KNOWN and unknown smart contracts use password manager enable 2fa, don’t use SMS based
- 127. Best practices don’t trust random people (or celebrities) on social media check source of the app/dapp don’t send funds to someone you don't trust, or verify via phone block people/email sharing login, password, private key, seed phrase, backup phrase extra careful to interact with KNOWN and unknown smart contracts use password manager enable 2fa, don’t use SMS based use HW wallet if you have a lot to protect
- 128. Best practices don’t trust random people (or celebrities) on social media check source of the app/dapp don’t send funds to someone you don't trust, or verify via phone block people/email sharing login, password, private key, seed phrase, backup phrase extra careful to interact with KNOWN and unknown smart contracts use password manager enable 2fa, don’t use SMS based use HW wallet if you have a lot to protect keep PC free of malware
- 129. Best practices don’t trust random people (or celebrities) on social media check source of the app/dapp don’t send funds to someone you don't trust, or verify via phone block people/email sharing login, password, private key, seed phrase, backup phrase extra careful to interact with KNOWN and unknown smart contracts use password manager enable 2fa, don’t use SMS based use HW wallet if you have a lot to protect keep PC free of malware cold wallet for valuables - like you don’t store your life savings in your pocket wallet
- 130. Best practices don’t trust random people (or celebrities) on social media check source of the app/dapp don’t send funds to someone you don't trust, or verify via phone block people/email sharing login, password, private key, seed phrase, backup phrase extra careful to interact with KNOWN and unknown smart contracts use password manager enable 2fa, don’t use SMS based use HW wallet if you have a lot to protect keep PC free of malware cold wallet for valuables - like you don’t store your life savings in your pocket wallet take time, don’t rush
- 131. Best practices don’t trust random people (or celebrities) on social media check source of the app/dapp don’t send funds to someone you don't trust, or verify via phone block people/email sharing login, password, private key, seed phrase, backup phrase extra careful to interact with KNOWN and unknown smart contracts use password manager enable 2fa, don’t use SMS based use HW wallet if you have a lot to protect keep PC free of malware cold wallet for valuables - like you don’t store your life savings in your pocket wallet take time, don’t rush install security extensions like "Wallet Guard" or "Sunrise: NFT scam protector"
- 132. Conclusion I can send white-paper if you want
- 133. Hack the planet One computer at a time zoltan.balazs@cujo.com https://hu.linkedin.com/in/zbalazs Twitter – @zh4ck www.slideshare.net/bz98 JumpESPJump.blogspot.com