Are hackers two steps ahead of security in a game of cat and mouse? Experts answer

Raz Niv, co-founder and CTO of Web3 security company Blockaid, and Kate Kurbanova, co-founder of risk management company talked about the evolution and high adaptability of crypto thieves, the “sophisticated” methods attackers use to empty our crypto wallets, which is what we do to protect our own money and what steps we can take if we become a victim of theft.Apostro

Security and Threats: A Constant Game of Cat and Mouse

Raz Niv from Blockaid said that hackers don’t necessarily always care about security are a few steps ahead. Rather, the attackers are very adaptable.

Niv said,

“The relationship between security measures and cyber threats is more like a constant game of cat and mouse, especially in our rapidly evolving industry. Attackers have the ability to identify vulnerabilities in current infrastructure and exploit them to their advantage.”

This capability is reflected in the development of attack methods, he said. It went from direct Ethereum transfers to approvals, then to offline signatures and recently to malicious drops. Bad actors will closely monitor innovation in the ecosystem. And they will adapt, cleverly incorporating these innovations in ways that serve their own interests. However, Niv noticed

“The dynamic nature of this area means that as technology evolves, so do security measures to counter new threats.”

Apostro’s Kate Kurbanova noted an “unfortunate lack of awareness” that the average crypto user often displays. This “often leads to vulnerabilities that fraudsters are only too happy to exploit.” A crucial factor in keeping users’ finances safe is that the crypto industry spreads knowledge and awareness about how to properly download and manage crypto apps, Kurbanova said.

Most Popular Hacker Tactics

There are four “sophisticated” methods hackers often use to empty crypto wallets, Blockaid says. These are:

• Phishing: Cybercriminals create fraudulent websites and apps that imitate popular wallets to steal login credentials.
• Malware: Hackers use viruses and Trojans to gain remote access to users’ inventory.
• Insidious Wallet Drivers: This is a newer threat; Malicious browser extensions shadow a user’s activities and wait for an opportunity to steal money. For example, millions were lost in such a trick with a MetaMaske xtension. Niv recently discussed the dangers of wallet drainers in more detail.
• Social engineering sleuths: Hackers monitor social media for users who openly share wallet addresses or transaction details to exploit public information.

Kurbanova also warned against fake websites. Fraudsters often fabricate platforms that mirror legitimate decentralized finance (DeFi) protocols in order to trick unsuspecting users into disclosing sensitive information or transferring their valuable assets to malicious addresses.

Therefore, it is important to check the authenticity of websites before making any transactions.

Niv also pointed out a new attack vector: incoming malicious tokens. These are the “spammy” non-fungible tokens (NFTs) that show up in users’ wallets, or the random spam tokens that are given to a legitimate one Project can see similar. However, these attempt to trigger users’ actions that ultimately lead them to sign a malicious transaction.

The most commonly used methods, Niv added, involve repeating the same type of attack by impersonating different people or companies in the hopes of defrauding an unsuspecting user. Kurbanova also warned against conducting transactions over or connecting your wallets to public Wi-Fi. She explained that,

“Hackers can infect or even clone a public network and gain access to the personal data of unsuspecting users. Use mobile internet if you absolutely have to to minimize risk.”

Also, do not use USB ports in public areas as you may become a victim of so-called “juice hacking”. Criminals use damaged ports to load malware onto devices and steal personal information and passwords.

Protect Your Funds Starter Pack

As crypto owners, we cannot settle for half measures but must take security practices very seriously, says Kurbanova. And while it may seem daunting, there are some basic, simple steps that every one of us – newbie or veteran – should take.

Kurbanova warns against storing funds in crypto apps, saying:

“It is better to only keep an amount that you plan to spend immediately or that you can afford to lose.”

Ideally, you should get a cold wallet and split your cryptocurrencies into several different wallets with different private keys. Additionally, you should not use any crypto operations app until you do thorough research. Check how long the app has been on the market, its development history, the team behind it and user feedback.

If something comes anywhere near your money, you need to know it well.

Never use the same password for multiple – or worse, all – of your apps. Also, change your passwords regularly. “Once a month should be enough,” advises Kurbanova. Use two-factor authentication (2FA) whenever possible. As I said, stay away from public Wi-Fi and USB ports. Finally, you should ensure that all your apps are updated with the latest security patches. Also update your device’s operating system regularly.

The theft has already happened, what now?

Kurbanova warned that there is no completely foolproof method of protecting against attacks. Attackers can find a way to get your money. If you suspect that this has happened, you should not panic at first. Move any remaining balances to a new wall

Re-update the app and check for updates in Settings. Change all your passwords and increase security. Check the wallet’s website and social media for hacker warnings and security-related information. You can also check their wallets via a token tracker like Etherscan to see if their coins are accounted for. If there are unauthorized transactions, report them to the wallet provider.

If (some) funds are missing, Kurbanova also suggests using the services of cybersecurity firms that specialize in monitoring suspicious blockchain addresses and transactions. These can track down digital assets, she said, adding:

“It is likely that the trail of your stolen funds can be traced back to the criminals and their wallets.”

Unfortunately, as we know from numerous theft stories, success in recovering funds varies from case to case – and you should probably call the police on it.

However, let’s do our best to protect our own assets so that this scenario (hopefully) never occurs.

Crypto exchanges with the lowest fees 2023