Source: CrossSpace

The Web3 ecosystem, built on blockchain underlying technology (Distributed Ledger), is rapidly iterating. The technological innovations of public chains L1 and L2 make it feasible as the next generation of underlying computing networks. Various infrastructures are constantly improving like "Lego" components, and Web3 BUIDLers are constantly building rich dApps in multiple application tracks.

As the underlying infrastructure of Web3, cloud services are particularly important and indispensable to the entire Web3 ecosystem. Tens of thousands of programs run on cloud servers every year. According to the public report data from Immunefi, a security organization, "46.5% of the funds lost in security incidents in 2022 came from underlying infrastructure, with the management, practice, and emergency response plans related to private keys being the most important." Web3's cloud security continues to face challenges, including issues such as private key leaks, unauthorized access, Smart Contract analysis and auditing, DDoS attacks, internal threats, compliance, and stability, which have been plaguing Web3 BUIDLers and constantly bringing new challenges to cloud service providers and security service providers.

As a company that was among the first to introduce cloud services, Amazon Web Services (AWS) has always been a leader in the field of cloud services. Today, AWS is actively embracing the Web3 ecosystem and has partnered with the Web3 leading community brand CrossSpace to launch the "Web3 Security" series of online and offline seminars, delving into the field of cloud service security, listening to security practice challenges from exchanges, public chains, infrastructure, and dApps, and exploring practical and feasible solutions.

As part of this series of discussions, we are honored to interview four outstanding Web3 security service providers, Beosin, CertiK, MetaTrust, and SlowMist, as well as experts in AWS cloud security, to explore the challenges and solutions to cloud security issues.

Why is cloud security so important for Web3?

Safety is of utmost importance for any enterprise. Cloud services and Web3 complement each other. Since the launch of the Bitcoin mainnet in 2009 and the Ethereum mainnet in 2015, security incidents and asset losses have increased year by year. Therefore, security is even more important as the cornerstone of the Web3 world. Whether it is centralized exchanges or decentralized scenes such as DeFi, GameFi, NFT, DAO, Social, Bridge, etc., various application scenarios based on tokens will be involved. How to ensure the security of the entire token processing process is a problem that Web3 BUDLers need to carefully consider. As an expert in cloud security and a service provider for many Web3 project parties, AWS has always closely followed the security of the Blockchain and Web3 fields, actively communicated with project parties, and held various forms of Web3 security sharing and training.

As we approach the end of 2023, bullish signals are becoming increasingly clear, and the number of Web3 projects that are positioning themselves on cloud servers will rapidly increase. The role of the cloud as an infrastructure layer is becoming increasingly important, making cloud security a crucial element that every developer and BUDLer must pay attention to.

What are the major challenges facing cloud security today?

Security company Beosin stated in this interview that "attacks on cloud service data providers are one of the main types of attacks in recent times, mainly through DDoS attacks, account hijacking, malicious implantation, and other methods, targeting the computing and storage services provided by cloud service data providers. The consequences are sensitive data leakage and service interruption." The team shared that "recently, Mixin Network and Fortress IO lost $200 million and $15 million respectively due to attacks on cloud service providers."

The leakage of sensitive data, especially private keys, was repeatedly mentioned by security experts during this interview as the cause of security incidents. CertiK's Q3 Security Report also stated that "private key leakage was one of the reasons for significant losses in that quarter. 14 incidents of private key theft resulted in a total loss of $204 million."

Other than data leaks, the SlowMist team has identified several other major categories of cloud security threats, including:

1. Account Leakage and Unauthorized Access: Hackers can obtain user accounts and credentials through password cracking, social engineering, or weak password attacks, thereby gaining unauthorized access.

2. DDoS Attack: Distributed Denial of Service (DDoS) attacks can render cloud services unavailable by occupying resources or flooding network traffic to paralyze services, resulting in business interruption.

3. Malicious Internal Threats: Internal users or employees may abuse their privileges, steal data, destroy information, or engage in other malicious behavior.

4. Compliance and Data Management: The project party did not effectively use various tools to protect data during the process of processing data on the cloud service provider's platform, resulting in data confusion or loss.

Facing the multi-dimensional attack angles of hackers and potential internal security risks, Web3 security experts are calling for awareness that cloud security requires a comprehensive security strategy, and therefore cannot rely solely on simple security measures in a single dimension.

The "Attack and Defense War" of Cloud Security, How to Break the Deadlock?

Facing the ongoing challenges of cloud security, how to do a good job of "defense" and help ensure the privacy and financial security of users? Experts and teams from various security organizations have given their opinions.

Beosin Team:

"Sensitive data leakage incidents occur frequently. It is recommended that technical personnel encrypt data when storing and transmitting it to prevent unauthorized third-party access. For sensitive data such as private keys, it is recommended to use privacy computing and homomorphic encryption technology to avoid private key leakage."

At the same time, the project party needs to confirm that the client only accesses cloud services through secure APIs to avoid malicious activities such as injection attacks and cross-site scripting. Using APIs can also authenticate and verify data on the client before accessing cloud services to ensure access and data security. Considering that personal computers have weaker security capabilities as clients, it is not recommended to directly call APIs through personal computers for data access and operation of the system, but to use cloud virtual desktops or secure jump servers to complete relevant access.

CertiK Chief Security Officer Professor Li Kang:

We mainly observe two common risks when using cloud platforms, which are improper configuration of cloud data by users and risks caused by users hiding cloud backend services in dApps. Most of the time, cloud platforms provide protection for resources and control of data, but often external personnel have the opportunity to enter the user's backend due to improper configuration by the user. The other type of risk comes from developers of the project hiding cloud backend services in dApps - some developers design an interface for the entire project that they believe is only for internal use, allowing dApps to access it directly on mobile apps without being publicly available. Although the project's cloud API has specialized control, this still leads to a lot of interaction between dApps and the backend.

In the face of these two types of risks, CertiK has established security services for the cloud and cloud-based dApps, including code auditing, risk assessment, team identity verification, and background checks. "Professor Li Kang added: "If you cannot guarantee that the development team is absolutely trustworthy, it is still necessary to have an expert audit of the dApp."

MetaTrust Co-founder Professor Liu Yang:

As a practitioner in the encryption industry, I will translate the following Chinese text to English without considering the context or industry-specific terms and names. English words and phrases, as well as capitalized English words and phrases, will not be translated or abbreviated, such as ZKS, STARK, and SCROLL. Links containing English characters will not be translated and will be returned as is, without omitting any a tags. When the content only consists of punctuation marks, the punctuation marks will be returned as is. HTML tags in the content, such as

, , , and

, will not be translated. If an HTML tag contains English characters, the translation will be omitted and the tag will be returned as is. The content within a link will not be translated. All Chinese characters will be translated. The following text will be translated: "As a foundational layer of infrastructure, cloud security needs to ensure data security and protect user privacy. It is important to build end-to-end full-stack security protection, with particular attention to data protection. Corresponding access permissions should be set for different types of data to prevent unauthorized access. The mechanism of cloud services is complex, and different types of data require independent access mechanisms.

In addition, data compliance also needs to be valued. Now, many data are in the same cloud, which may be restricted due to different regions, leading to compliance issues caused by cross-border data leakage if not understood. Therefore, access control and identity authentication are also very important. We need to build a relatively strict and fine-grained access control and identity authentication mechanism to prevent unauthorized access. "

SlowMist Team:

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia