MANAGING VULNERABILITIES IN CRYPTOWALLET

 

Cryptocurrency does not lie on wallets, it is just a way to store a private (secret) key. Just like a plastic bank card does not have the money itself, it only opens access to a bank account. Wallets are software or hardware that are vulnerable to vulnerabilities. Let's figure out what their peculiarity is and what methods are used to ensure information security in this area.

Problems and threats

Cryptocurrency wallets in all their diversity can be divided into two large categories: cold ones include hardware, which have physical access, and hot ones include browser or mobile applications.

Cold wallets do not connect to the Internet and are considered the most secure – these are paper wallets, flash drives, etc. They need to be connected to a computer or phone to make transactions.

It is important to note that when using cold crypto wallets, the owner himself is responsible for the safety of private keys and the funds to which they provide access, and when using hot ones, the responsibility falls on the service operator (custodian or depository).

The main problems and threats faced by users of cryptocurrency wallets include the following.

1. Hacking and cyberattacks. Cryptocurrency wallets can become the target of intruders who are trying to gain access to private keys and steal funds.

2. Phishing. Attackers can create fake websites and emails that mimic official cryptocurrency services where users enter their

authentication data and lose access to funds.

3. Loss of access. If the password, private key, or backup phrase is lost, users may lose access to their funds without the possibility of restoring them. The loss can also be attributed to the inability to remember them.

4. Social engineering. Attacks can be aimed not only at technical weaknesses, but also at weaknesses in the behavior of users who are being deceived in order to disclose their confidential data.

5. The influence of the human factor. Errors in wallet management, incorrect saving of a private key or a backup phrase can also lead to loss of funds.

6. The number of hacks related to insiders in the projects themselves is also growing. They leak information about wallets, platforms, and interaction protocols.

7. Many developers have recently been interested in protection against quantum computers, in particular protection against brute force of private keys. Perhaps the threat from quantum computers is exaggerated, but it still exists, and much depends on what steps blockchain developers will take until the moment when this threat becomes more real.

For example, Ethereum developers are developing cryptography methods resistant to quantum attacks, such as Winternitz signatures and STARK zero-knowledge technology.

Examples of vulnerabilities and their exploitation

In February 2018, the community noted several news articles claiming that the National Institute of Standards and Technology (NIST) was actively investigating a 2018 vulnerability in the iOS Trust Wallet application, which was promptly fixed in the same year. The developers assured users that their funds are safe and their wallets are safe to use.

In August 2022, there was a major theft of tokens from the Solana wallet, which was caused by a vulnerability in the centralized Sentry server. Researchers have discovered two new data collection technologies from Solana that can perform bit-swapping attacks.

At the end of November 2023, 1.5 million bitcoins were at risk of theft due to the Randstorm vulnerability, which allows passwords to be restored and unauthorized access to many wallets on different blockchain platforms. The vulnerability is related to the use of BitcoinJS, an open JavaScript library for developing cryptocurrency wallets in the browser.

The problem was the lack of entropy that can be used to carry out bruteforce attacks and recover generated private wallet keys, and vulnerabilities in the basic libraries used in open source projects can have cascading risks for the entire supply chain.

In December 2023, bitcoin "inscriptions" were added to the US National Vulnerability Database (NVD) and marked as a cybersecurity threat. This was done to draw attention to the security flaws that were made during the development of the Ordinals protocol in 2022. Adding to the NVD list means that the vulnerability is recognized as important for public awareness.

In December 2023, a new feature in the Ethereum Create2 blockchain caused the theft of $60 million. Attackers have found a way to bypass the security systems of cryptocurrency wallets using a feature that allows you to create smart contracts in the blockchain, and with the ability to pre-calculate their addresses before deployment. The feature is legitimate, but it has created vulnerabilities in the Ethereum security system.

The main way of operation is to create new contract addresses without a history of suspicious transactions. Attackers force victims to sign malicious transactions, after which they transfer assets to pre-calculated addresses.

Vulnerability management

When it comes to controlling vulnerabilities in the operation of cryptocurrency wallets, the recommendations are always trivial, but this does not make them any less important.

1. Using reliable wallets. Choosing a reliable and trusted cryptocurrency wallet with a good reputation reduces the risk of vulnerabilities and cyber attacks.

2. System and software updates. Regular updates of wallets and all related software components help eliminate known vulnerabilities and ensure system security.

3. Multi-factor authentication. Enabling multi-factor authentication provides an additional level of protection against unauthorized access to the wallet.

4. Backup and secure key storage. Regular backup copies of wallet access keys and their safe storage in a safe place will help to avoid loss of funds in case of loss or damage to the original wallet.

5. Training. Conducting training events on the security of cryptocurrency wallets will help users understand the main threats and take measures to minimize them.

In other words, in order to minimize threats, it is recommended to use reliable and verified cryptocurrency wallets, follow the rules of cyber hygiene and best practices in the field of security, such as using complex passwords, installing two-factor authentication, backing up the private key and backup phrase, and storing them in a safe place. It is also necessary to be vigilant and pay increased attention when dealing with cryptocurrency transactions and suspicious requests.

There are also improvements in the field of standardization: as an example, the BIP (Bitcoin Improvement Proposal) mechanism used to propose changes to the bitcoin protocol can be cited. BIP proposals are developed by members of the community, including developers, researchers and users, and are designed to discuss and coordinate changes in the network.

Let's pay attention to the proposal BIP-0039 (usually referred to simply as BIP39) is a standard that defines a method for generating mnemonic phrases for creating and restoring bitcoin and other cryptocurrencies wallets.

A mnemonic phrase (Seed Phrase) is a set of words that can be easily remembered and used to recover a wallet's private key. This standard was proposed to simplify the process of backing up and restoring wallets, as well as to increase security by providing the user with a convenient way to backup and store sensitive information.

The BIP39 mnemonic phrases are especially useful for creating and using wallets using a variety of cryptocurrencies, as they are usually supported by most wallets and platforms.

Concluding remarks

It is necessary to develop interaction and mutual support within the community on security issues and vulnerability elimination in order to increase the security level of cryptoplatforms and cryptoservices.

Increasingly, attackers are using phishing transactions, phishing airdrops (NFTs), and malicious smart contracts on websites to subsequently empty cryptocurrency wallets. This became possible due to the availability of tools to a wide range of attackers.

And of course, today it is necessary to prepare for the coming quantum threat by developing quantum-resistant protocols and technologies. In the future, quantum key-sorting algorithms may become available to attackers in a year or two.