NewsFlash Articles Data Fundraising BlockBeats Pro

Slow Fog: The Blockchain Dark Forest Self-help manual

Read this article in 18 Minutes

Remember: be skeptical, and always be skeptical.

原文标题：《慢雾出品 | 余弦：区块链黑暗森林自救手册》

Author: Slow Fog Security Team, Slow fog Technology

preface

Blockchain is a great invention that has brought about some changes in the relationship of production, partially addressing something as precious as trust. But reality is harsh, and there are many misconceptions about blockchain. These misunderstandings lead to the bad guys easily take advantage of the loopholes, frequently put their black hands into people's wallets, resulting in a large number of capital losses. This is already a dark forest.

Based on this, cosine of Slow Fog technology founder lean force output - block chain dark forest self-help manual.

This manual (currently V1 Beta) is approximately 37,000 words. Due to space constraints, this is only a guide to the key directory structures in the manual. The full content can be seen:

https://github.com/slowmist/Blockchain-dark-forest-selfguard-handbook

We chose the GitHub platform as the first place to publish this manual for the convenience of collaboration and access to historical updates. You can Watch, Fork, and Star, but we'd like you to contribute.

Okay, here we go...

primers

If you own cryptocurrencies or are interested in the world and may own cryptocurrencies in the future, this manual is worth rereading and practicing carefully. Reading this manual requires a certain knowledge background, and I hope beginners don't have to fear these knowledge barriers, because a lot of them can be "played" out.

In the dark forest world of blockchain, keep these two security laws in mind first:

Zero trust: Simply put, being skeptical, and always being skeptical.

Continuous Validation: To believe, you must be able to test your doubts and make it a habit.

The key content

1. Create a wallet

Download

1. Find the right website

a. Google

B. Industry famous collection, such as CoinMarketCap

C. Ask people you trust

2. Download and install applications

a. PC wallet: it is recommended to do the tamper check (file consistency check)

B. Browser extension wallet: pay attention to the number of users and ratings in the target extension download page

C. Mobile wallet: The judgment mode is similar to that of extended wallet

D. Hardware wallet: purchase from the source of the official website, and pay attention to whether there is a case of unauthorized manipulation

E. Web wallet: This online wallet is not recommended

Mnemonic Phrase

When creating a wallet, the presence of a mnemonic is very sensitive, so be aware that there is no one around, a camera, anything that could lead to voyeurism. Also notice if the mnemonic is random enough

Keyless

1. Two Keyless scenarios (distinguished here for the convenience of explanation)

a. Custody, for Custody. For example, centralized exchanges, wallets, users only need to register an account, do not have a private key, security completely depends on these centralized platforms

B. Non-custodial. The user only has the power to act like a private key, but is not a direct cryptocurrency private key (or mnemonic)

2. Advantages and disadvantages of mpC-based Keyless schemes

Backup your wallet

Mnemonic/private key type

1. Text: mainly 12 English words

2. With a password: the mnemonic with a password will get a different seed, which is later used to derive a series of private keys, public keys and corresponding addresses

3. Multi-signature: It can be understood that the target fund can only be used with multiple signatures and authorization. Multi-signature is flexible and approval strategies can be set

4. Shamir's Secret Sharing: Shamir's Secret Sharing scheme, which is used to divide the seed into multiple shards. When recovering the wallet, a specified number of shards are required to recover

Encryption

1. Multiple backup files

A. Cloud: Google/Apple/ Microsoft, combined with GPG/1Password, etc

B. Paper: Copy mnemonic words (plaintext, SSS, etc.) on Paper cards

C. Device: COMPUTER /iPad/iPhone/ removable hard disk/USB flash drive, etc

D. Brain: Pay attention to memory risk (memory/accident)

2. encryption

a. Be sure to verify periodically and irregularly

b. Partial validation is also possible

c. Pay attention to the confidentiality and security of the verification process

3. Use a wallet

AML

1. Chain freezing

2. Choose platforms and individuals with good reputation as your counterparties

Cold Wallet

1. How to use cold wallet

A. Accept cryptocurrency: Cooperate with observation Wallet, such as imToken and Trust Wallet

B. Send cryptocurrency: QRCode/USB/Bluetooth

2. Cold wallet risk points

A. Wysiwyg user interaction security mechanism is missing

b. Lack of relevant knowledge background of users

Hot Wallet

1. With & have spent DApp (DeFi, NFT, GameFi, etc.) interaction

2. Malicious code or backdoor methods

A. When the wallet runs, the malicious code packages the relevant mnemonic words directly and uploads them to the server controlled by the hacker

B. When the wallet is running, when the user initiates the transfer, the target address and amount information are secretly replaced in the background of the wallet, which is difficult for the user to detect

C. Destroy the entropy value of random numbers related to the generation of mnemonics, making these mnemonics easier to crack

What exactly is DeFi security

1. Smart contract security

A. Too many permissions: add Timelock (Timelock) or sign admin multiple times

b. Gradually learn to read the security audit report

2. Blockchain basic security: consensus ledger security/VIRTUAL machine security, etc

3. Front-end security

A. Internal evil: target smart contract addresses in the front page are replaced/embedded with authorized phishing scripts

B. Third party evil: supply chain evil/front-end page introduced third party remote JavaScript files evil or black

4. Communication security

a. HTTPS security

B. Example: MyEtherWallet security incident

C. Security solution: HSTS

5. Human safety: for example, the project party commits internal evil

6. Financial security: currency price, annualized income, etc

7. Compliance and security

A. AML/KYC/ sanctions area restrictions/securities risk related content, etc

b. AOPP

NFT security

1. Metadata security

2. Signature security

Be careful with signatures/anti-common sense signatures

1. What you see is what you sign

2. OpenSea Several high-profile NFT thefts

A. User authorized NFT on OpenSea

B. Phishing the user's signature

3. Cancel authorization (Approve)

a. Token Approvals

b. Revoke.cash

c. APPROVED.zone

d. Rabby extension wallet

4. A real case against common sense

Some advanced attacks

1. Sex fishing

2. Cast a wide net

3. Combine XSS, CSRF, Reverse Proxy and other techniques (e.g. Cloudflare man-in-the-middle attack)

Iv. Traditional privacy protection

The operating system

1. Attach importance to system security updates and act immediately if there are security updates

2. Don't mess with the program

3. Set the disk encryption protection

Mobile phone

1. Attach importance to system security update and download

2. Do not jailbreak, Root hack, unless you play security research, not necessary

3. Don't download apps from unofficial markets

4. The premise of official cloud synchronization: You are sure that there is no problem with account security

network

1. In terms of network, try to choose safe ones, such as not connecting to strange Wi-Fi randomly

2. Choose routers and operators with good reputation. Don't be greedy for petty advantages, and pray that there will be no advanced evil behavior at the level of routers and operators

The browser

1. update

2. Extensions are not installed unless necessary

3. Multiple browsers can coexist

4. Use well-known extensions for privacy protection

Password manager

1. Don't forget your master password

2. Make sure your email is secure

3. 1 password/Bitwarden, etc

Two-factor authentication

Google Authenticator/Microsoft Authenticator, etc

Science and the Internet

Scientific Internet, safe Internet

email

1. Safe and well-known: Gmail/Outlook/QQ email, etc

2. Privacy: ProtonMail/Tutanota

SIM card

1. SIM card attack

2. Defense advice

A. Enable the well-known 2FA tool

b. Set the PIN

GPG

1. Distinguish between

A. PGP is the abbreviation of Pretty Good Privacy, is a commercial encryption software, released 30& NBSP; For years. Now it's under symantec

B. OpenPGP is an encryption standard derived from PGP

C. GPG, full name GnuPG, is an open source encryption software based on OpenPGP standard

isolation

1. Have zero trust safety law thinking

2. Good isolation habits

3. Privacy is not to be protected. Privacy is to be controlled

Fifth, human security

- Telegram

- Discord

- Fishing from the "official"

- Web3 privacy issues

Six, block chain evil way

- Coin theft, malicious mining, ransomware, dark web trading, Trojan C2 transfer, money laundering, money tray, gambling, etc

- SlowMist Hacked Blockchain is Hacked file library

Seven, stolen how to do

- Stop first

- Secure the scene

- Analyze the cause

- Trace the source

The case -

Eight, myth

- Code Is Law

- Not Your Keys, Not Your Coins

- In Blockchain We Trust

- Cryptography security is security

- It's embarrassing to get hacked

- Update now

conclusion

When you finish reading this manual, must need to practice, skilled, draw inferences. If you have your own discoveries or experiences later on, I hope you can contribute as well. If you feel sensitive, you can desensitize appropriately, anonymously. Secondly, thanks to the global maturity of security and privacy related legislation and enforcement; Generations of worthy cryptographers, engineers, good hackers, and all those involved in making the world a better place, one of them is Satoshi Nakamoto. Finally, thanks to the contributors, this list will be constantly updated, any thoughts, please contact us.