Partnered With:

Web3: what Discord users must know to protect themselves from scammers

Read this article in 26 Minutes

As a public chat platform, Discord is a hotbed of scammers.

原文标题：《 Web3 防骗须知：Discord 安全指南》

Original author: Alpha Rabbit, Alpha Rabbit research notes

With the rapid growth of the NFT market, the transaction amount of the NFT market in 2021 nearly reached 44.2 billion DOLLARS. The huge amount of temptation leads to a large number of professional fraudsters and professional fraudsters in the digital world to infiltrate the encryption world, and these scammers in the encryption world, in the face of the inexperienced encryption white carry out dimension reduction strike, In order to provide you with some useful safety guidelines, this is the writing of the opportunity.

This paper is mainly divided into the following parts:

1) What should you look out for as a new Discord or someone wanting to participate in an NFT project?

2) Current Discord environment status

3) From the official Discord Security Guide

4) Reiterate

NFT Cheat Prevention guide

Here are some safety guidelines to keep in mind for the average user, which we'll examine later.

First of all, we should note that the main deceitful nature of scams is usually to take advantage of human hopes, greed (e.g., lucky luck! Congratulations, won the big prize) and fear (we are official personnel, you cheat, want to arrest you, hurriedly report id card and bank card password).

0. Turn off all Discord messages that have links attached to them

This is one of the more frequent Discord messages because if you are not a real friend, you are likely to be a malicious stranger and at risk for fraud.

Some possible questions about the NFT project

1. Discord doesn't have public chat rooms

2. Twitter doesn't comment

3. Unoriginal design

4. Non - WL can also be Mint in Presale

5. The team is completely anonymous, especially the designer

6. There are very few core members, and the MOD is all volunteers found online

7. Never held an AMA (Ask Me Anything)

8. Only WL or free NFT of the project will be drawn

9. There was little activity except the raffle

10. In WL requirements, pulling heads accounts for a large proportion

11. They are in a hurry

12. Lots of Mint per wallet (3 counts)

13. Short project cycle (even 2 weeks is considered short)

14. Very low activity of General Channel (Precise harvesting of Chinese leeks)

15. Few followers on Twitter, few retweets

16. No linkage between other project parties (rubbing against blue-chip Holder does not count as linkage)

17. All DM with links do not letter, it is suggested to directly turn off the DM

(Above for reference only)

One consequence of a decentralized system is that no one is solely responsible for anything. Does Discord have a security responsibility to its users? Or does the person in charge of each server need to protect users? Or do users need to learn all the basics of security themselves, such as not clicking on links sent by strangers?

Note: From a security expert's perspective, the number of scams is only one thing; What's more, many frauds are becoming more sophisticated. It works like an immune system: although NFT holders are somewhat immune to common scams, such as not trusting any unfamiliar information, they protect their mnemonics. However, with limited security features, more and more new ways are emerging to trick Web3er.

background

Let's start with a story:

In July 2021, part-time outdoor instructor Heart, 50, was out training with her children when her home burned down due to an electrical short circuit. Her home insurance had expired, so all her belongings were destroyed. Later, through a gift from blockchain company Nametag, Heart got a boring ape CALLED NFT.

NFT has the brand identity of Louis Vuitton and Chanel of the consumer goods world, and is currently selling for millions of dollars on the secondary market. When Heart received the monkey, it was worth about $35,000, which has since risen to $80,000.

But in August of last year, Heart received a link to a VeeFriends giveaway sent directly by a stranger on Discord, the chat platform. It all seemed reasonable, and the URL pointed to the project's official website. But when she was ready to claim the gift, the website asked for her mnemonic, and when she did:

All the Eth and monkeys in my account are gone.

Discord, as a public chat platform, is one of their hotbeds.

In January 2022, at least 44 Discord servers were hacked, costing more than $1 million, according to the data. NFT project as a huge temptation for fraudsters arena, some people have begun to enter the FIELD of NFT in an industrial model, large-scale fraud team. But none of this has slowed Discord's growth. In September, Discord raised $500 million, more than doubling its valuation to $15 billion amid huge growth. The chat service has long been a popular platform for video game players, and over the past year it has become the de facto city square for the crypto community, so much so that every major NFT project and decentralized autonomous organization now has a Discord server.

On the surface, Discord doesn't offer anything radically different from traditional corporate messaging platforms like Slack or Telegram, which focus on voice and text chat. Founded in 2015, Discord began as a communication platform for video game players, but in the past year it has become an active organizing presence in the cryptocurrency community. But Discord doesn't offer anything that's completely different from traditional corporate messaging platforms like Slack or Telegram. Mainly voice and text chat tools.

Discord was primarily a place to hang out, but gamers were replaced by crypto gold miners, many convinced that the decentralized Internet era was coming, and as NFT prices soared, Discord provided a ready place for daOs and NFT, a free-for-all club without gatekeepers, And a conference space big enough to host thousands of people.

Since 2019, Discord has grown from 56 million MAU to more than 150 million. This has created a lot of security challenges. There has been no iteration of the rules governing individual Discord servers. In some cases, the DAO and NFT projects have a relatively chaotic staff division.

Although Discord has introduced new management tools, such as blocking certain users, and hired a full-time security team, moderators are often the first line of defense when scammers start scamming Discord over a channel.

The way Discord is set up, it makes it really easy to fall for those scams between notifications flying in every five seconds and the way you can Change your Avatar, your username, "said Nicholas Ptacek, A former computer security specialist at SecureMac who now writes about NFTs and crypto. "It's kind of a scammer" s Paradise."

Nicholas Ptacek, a former computer security expert at SecureMac, said:

"The way Discord runs -- you can send messages at will, change your username and avatar at will -- is kind of like a liar's paradise."

Even in the Internet age, phishing schemes are frequent, but because the NFT industry is still in its early wild days, the influx of valuable digital anonymity, super large assets, mysterious technology, and little white people... This really is a playground for criminals.

One consequence of a decentralized system is that no one is solely responsible for anything. Does Discord have a security responsibility for the welfare of its users? Or does the person in charge of each server need to protect users? Or do users need to learn all the basics of security themselves, such as not clicking on links sent by strangers?

From a security expert's perspective, the number of scams is only one thing; What's more, many frauds are becoming more sophisticated. It works like an immune system: although NFT holders are somewhat immune to common scams, such as not trusting any unfamiliar information, they protect their mnemonics. However, with limited security features, more and more new ways are emerging for users to trick Web3er.

But there is little recovery for the defrauded. While OpenSea flags stolen items and blocks them from being traded on the platform, it cannot undo transactions, meaning it cannot return stolen NFT to its rightful owner. Jonathan, an intellectual property lawyer at Chilton Yambert Porter, says that usually victims can only write to the person who inadvertently bought the stolen NFT and buy back the art in full. Because the authorities have no clear oversight of the world, most of the time they are willing to gamble.

Security advice from Official Discord

First of all, when we're ready to click on a link to join the server for a new airdrop, something can happen that even though the link looks right, something still seems wrong.

Sign one, they talk in an impersonal way, like threatening you with certain things, with certain deadlines, warning you that you have to join a certain project? Links? Otherwise you will lose the opportunity. One of the characteristics of this scammer is that he has never posted information in any common server with the user, nor does he share the common server with you, but will suddenly hit on him.

Online fraud spiked in 2021, according to the Federal Trade Commission. While Discord's mission has always been to make It the best place on the Internet for people to feel like they belong, it's great to see interest-based communities bringing people together, but we've also seen some dangerous people trying to take advantage of those communities.

So I'll share some of the additional steps we're taking and some ways you can protect yourself on Discord. I hope you keep these safety skills in mind:

For ordinary users:

· Do not click on links from unknown senders or that look suspicious.

· Don't download programs or copy/paste code you don't recognize.

· Don't give out your password to anyone!

· Do not share or screen share your license token.

· Don't scan any QR codes from people you don't know or from people you can't verify.

· Enable 2-factor Authentication to keep your account as secure as possible.

For the server owner:

· Audit server permissions, especially for advanced tools like Webhooks.

· Keep your official server invitations up to date, especially if most of your new server members are from communities outside of Discord.

· Also, don't click on suspicious or unknown links, if your account is compromised, it could have a bigger impact on the community you manage.

Internet Safety Checklist

It's important to be in awe of online security, and here are some simple and effective ways to go some way to keeping you safe in DMs, and even outside of Discord.

1. Only open trusted links from people you know

A lot of security issues stem from users clicking on links before checking to see if they're real, always double-checking what links you're clicking on, and Link Shortening Services makes it easy to mask insecure sites or programs. It is recommended to check it through a resource like VirusTotal to see if anyone has flagged it as a potential hazard.

2. Pay attention to URL spelling

3. Don't download programs or run code you don't understand

4. Do not download or run software from unknown sources

5. Be wary of strangers sending your app

If someone claims to have "a great piece of software" that you need to run on your computer, they're probably trying to mislead you so they can use a phishing program to get your personal information.

The Discord Safety Checklist

Decide to send you a list of DMS: Disable DMS for specific servers and prevent scammers hiding in large communities from contacting you.

To adjust who can and can't DM you, head into User Settings & GT; Privacy & Safety, then scroll down to "Server Privacy Defaults" From there, You'll find the option to "Allow direct messages from server members." Note that this new status only applies to servers that have changed their Settings to join; It won't affect your existing servers.

If this option is turned off, new members of the server cannot contact you through the DM unless you are friends with them in advance, and there is some risk of receiving suspicious messages from people you don't know.

If you're on a server you trust and don't mind being messaged by people inside, you can toggle privacy Settings on a personal basis. Head to that server on desktop or mobile and select its name to open the server's settings, And choose "Privacy Settings." Once there, You'll find the "Allow direct messages from server members" option. Turn that on, And you're free to receive all sorts of DMs from everyone in that server, regardless of if you're friends or not!

Audit server permissions

· Knowing what permissions the template and server members have is key to keeping each member safe. If you are the owner of a server, have you checked the permissions list recently? Who has what access? Do you know how long they had access?

· Make sure that only moderators you trust have permission to change powerful server tools, including any bots you might add to the server, and be wary of bots that impersonate large, well-known bots.

· Keep the invitation link updated

If you update links to your servers, make sure your community and new users are aware of the changes, and keep any social media pages where you share links updated. If possible, refer to old invitation links and let everyone know those links have been updated.

1. This is free -so for servers, Verified or Level 3- Description that Partnered vanity URL: if your server loses or changes its custom invite link, nefarious communities may swoop in and claim your old one. If this happens before you update your public-facing invites, People trying to join your community may instead join a server that's looking to cause trouble.& NBSP;)

Attention! If someone takes control of your Discord account, they can change your username, password, emails tied to your account, and any other information related to your account. Once the thieves enter your Discord account, they can see all of your personal information. From server layout to server permissions, to bots, you can even kick all of your users off the server, and if your account is the person in charge of the server targeted by the hacker, you can even use your account as a stepping stone to further damage within the community, impersonating you to deceive unsuspecting members.

Professional scammers can also target Discord accounts that have unique profile badges that can't be copied, such as the franchise badge of an early supporter. If you have one of these unique badges, you should be extra vigilant about your account.

It is recommended to enable 2-factor Authentication for your account, because fraudsters also need to provide 2FA code to change your password (more on this later).