Web3 Phishing Has Finally Arrived

It was only a matter of time before phishers took attacks against the crypto industry a step further by integrating their attacks with the web3 ecosystem. Up until this point, phishers have focused on gaining access to users’ seed phrases, private keys, or usernames and passwords. Today, that changed. A world of DeFi applications, which only interact with a user via their wallet and never require a user to enter credentials, recovery phrases, or passwords into them are now being targeted. These new attacks are beginning to exploit the tools that we use to interface with our crypto - in a world where Crypto is already full of scammers.

In the past two weeks, we’ve started detecting the first instances of these attacks in the wild, with the first victim being MakerDAO. This blog post details what’s novel about these attacks and why we predict that they’re likely to become more commonplace in 2020.

The MakerDAO Phish

Our analysts first became aware of the MakerDAO phish after receiving a community report for makerdao[.]tools on 14 January. The fraudulent website mimicked the process of converting SAI to DAI.

It used a similar aesthetic to Maker, with a minimalistic, light color scheme, and a Maker logo. A fairly typical phishing attack. You can see the legitimate portal depicted below.

After clicking on the “continue” button on the phish, it proceeded to request access to MetaMask.

Again using the Maker logo, a name of “Upgrade Sai to Dai”, and in this instance the fairly inconspicuous migrate.makerdao[.]click domain. Once connected, the main screen would change to a pending screen indicating that it was waiting to receive the SAI.

At this time, MetaMask would prompt you on whether you wanted to send the SAI.

Visiting the address on Etherscan, we can see that at the time of writing, no code is deployed to the address, meaning that it is mostly likely a normal account controlled by the phisher.

Since being notified of the attack, we’ve detected another 3 attacks targeting MakerDao:

makerdao[.]help

makerdao[.]cash

makerdao[.]live

Isn’t Crypto Phishing Old News?

Crypto apps being targeted by phishing should come as no surprise. In fact, we’re all too familiar with these attacks, having helped protect a number of crypto apps from phishing, including the likes of Binance DEX, MEW, and IDEX. Until now, crypto-phishing has been limited to traditional phishing kits, aimed at stealing the credentials of victims, or socially engineering users into sending funds to a specific address. This approach is familiar to attackers, as it’s technologically similar to web2.0 - clone a website, plug-in a backend to harvest credentials, and voila, you can launch a phishing campaign against an exchange. However, when you’re a crypto-user, your username and password are only the start of your problems - and phishers are beginning to realize this.

What’s new about these attacks is that they’re beginning to exploit the specific tools that we use to interface with our crypto. We started seeing the first signs of this last year when attackers began crafting attacks targeting Trezor. To target these trusted devices, phishers attempted to socially engineer the victim into handing over their seed phrase by notifying them that the device had been corrupted. A fairly ingenious idea to bypass all the security controls built into the device itself.

Now, attackers have moved to integrating with web3 to more closely imitate the legitimate behavior of apps. We see this being a growing problem for a couple of reasons.

The set up is simple

Phishing is the most common attack vector used by cybercriminals to launch attacks. This is in part due to the relatively low skill requirement for conducting this type of attack. Purchasing a basic phishing kit off the darkweb can cost as little as a few dollars and with a little tech know-how, take less than an hour to set up. Moving slightly up the production chain, we get the developers of the kits. Here the technical barrier goes up, requiring at least basic web development skills. While it’s possible to use a tool like HTTrack to clone a website’s front-end, and plug that into an existing backend, for traditional websites it’s often necessary to modify the front-end to include some purpose-specific features.

Phishing awareness training will often advise that users stay vigilant, looking for discrepancies between the website they’re currently on and the version they know. Are the fonts the same? Are images bugging out? Has the process flow changed? You might be on a phishing website. This usually helps because phishing devs will often value quantity over quality.

However, a core part of dApps is that you have the ability to download them and run them on your own machine, removing the need to rely on a potentially compromised web server to serve you your dApp. This means that we’re serving these bad actors our entire products on a golden platter, and allowing them to weaponize it by changing a single line of code. What happens when instead of asking web3 to sign a message to authenticate a user, the attacker changes the logic to send all of the ETH in the current wallet? The front-end will render and function perfectly right from the get-go. Cloning content has never been easier.

Crypto UX is still confusing

While major progress in improving the standard of UX in the cryptoverse in 2019, we’re still operating in a space that is largely driven and used by technical minds. To give you an example of this, let’s consider the process of exchanging ETH to sUSD on uniswap.

Step 1

Visit the uniswap.exchange website.

Step 2

Connect MetaMask and initiate a token swap.

Step 3

Confirm the transaction.

So here begins the problem. How do I go about ensuring that nothing has gone wrong and that I’m performing my expected action with the smart contract? Maybe clicking on the “DATA” button will help.

Well, that doesn’t help. The data wasn’t parsed, so as an average user, I have no idea what I’m signing. At least I know it’s sending it to 0xAb72...14AE, which is the real uniswap address, right? Wrong. In fact, go take a look at the url in the first photo. Notice anything funny about the letter ‘i’ in uniswap?

To give you another example of how things can go wrong, let’s turn again to hardware wallets. Performing the most basic action of transferring an ERC20 token should be simple. Here, we’re about to use MEW to send 1 USDC to another address.

We’re sending funds stored on our Trezor, so naturally we need to confirm the transaction.

Besides the fact that the token value couldn’t be parsed, we’re again expected to recognize that the 42 characters matched correctly. Which they didn’t by the way - did you notice? In case you didn’t know, attackers are able to dynamically generate addresses that they control to match the first and last few characters of an address. Whether it’s malware on your system, a compromised dApp, or a phishing website, you should be checking at least 5 characters on either end of an ETH or BTC address, and the more the better.

Crypto user awareness training is harder

Given the amount of tech and the speed at which it is changing, your average user is going to have a hard time staying on top of how to avoid being phished. In web2.0, we saw this being an issue when for years users were told to look for the green padlock on a site. Then, phishers started using HTTPS and all of a sudden that check failed. Then visual indicators for Extended Validation certificates were dropped. Remember this look:

After telling users for over a decade to look for specific visual indicators, browsers removed them (because they were misleading).

We’re undoubtedly going to face similar issues in the crypto space as we figure things out - how do you ensure that an ENS address resolved correctly? Verify that a webserver hasn’t modified dApp code? That you’re interacting with the right smart contract? Over time we will develop more standards and tools to help protect users, but in the meanwhile malicious minds are going to take full advantage of these gaps.

Web3 users are now facing phishing threats, including address poisoning and credential harvesting attacks. PhishFort provides robust phishing detection, removing fraudulent websites, fake apps, and harmful social media content. By securing the Web3 space from these scams, PhishFort ensures a safe environment for decentralized digital finance, strengthening business reputation and user confidence in Web3. Learn about specific phishing campaigns targeting DeFi applications in Phishing Campaigns Take Aim at Web3 DeFi Applications or see how Twitter vulnerabilities impact phishing in Deceptive Previews: Exposing Twitter’s 'Cards' Feature Vulnerability.

‍

Conclusion

Crypto is a high value target for criminals and as such we can expect an immense amount of resources to be thrown into developing new attacks to target its users. We can already see the first moves being made by phishers, so it’s important that we stay ahead of the curve. Good UX design, user education, and security-minded development all contribute to this.

In the meanwhile, you can install our free browser plugin that can help protect you against a number of threats mentioned in this post.