This issue is the 3rd special issue of security . We invite industry-renowned security experts 0xAA and OKX Web3 wallet security team to explain the common security risks and preventive measures of "furry people" from the perspective of practical guidance. Previous link: https://followin.io/feed/10718303
Q4 : For professional hair removers, what safety precautions should be taken when using various tools?
WTF Academy : Since there are many kinds of tools involved in porn, users should strengthen safety precautions when using various tools, such as
1. Wallet security: Ensure that private keys or mnemonics are not leaked, do not save private keys in unsafe places, and avoid entering private keys on unknown or untrusted websites, etc. Users should store private keys or mnemonics backups in a safe place, such as offline storage devices or encrypted cloud storage. In addition, for wallet users with high-value assets, using a multi-signature wallet can increase security.
2. Prevent phishing attacks: When users visit any related websites, please be sure to check the URL carefully and avoid clicking on links from unknown sources. Try to obtain download links and information from the project's official website or official social media, and avoid using third-party sources.
3. Software security: Users should ensure that antivirus software is installed and updated on their devices to prevent malware and virus attacks. In addition, wallets and other blockchain-related tools should be updated regularly to ensure the latest security patches are used. Since many fingerprint browsers and remote desktops have previously had security vulnerabilities, they are not recommended.
Through the above measures, users can further reduce security risks when using various tools.
OKX Web3 Wallet Security Team: Let us first give an example from a public industry case.
For example, BitFingerprint Browser provides functions such as multi-account login, preventing window association, and simulating independent computer information, which is favored by some users, but a series of security incidents in August 2023 exposed its potential risks. Specifically, the " plug-in data synchronization " function of BitBrowser allows users to upload plug-in data to the cloud server and quickly migrate it on the new device by entering a password. Although this function was originally designed to facilitate users, it also has security risks. Hackers obtained users' wallet data by invading the server. Through brute force cracking, hackers cracked the user's wallet password from the data and obtained wallet permissions. According to server records, the server storing the extension cache was illegally downloaded in early August (log records are as late as August 2). This incident reminds us that while enjoying convenience, we must also be vigilant about potential security risks.
Therefore, it is crucial for users to ensure that the tools they use are safe and reliable to avoid the risk of hacker attacks and data leaks. Generally speaking, users can improve certain security from the following dimensions.
1. Use of hardware wallet: 1 ) Update the firmware regularly and purchase through official channels. 2 ) Use on a secure computer and avoid connecting in public places.
2. Use of browser plug-ins: ) Use third-party plug-ins and tools with caution, and try to choose reputable products, such as OKX Web3 wallet, etc. 2 ) Avoid using wallet plug-ins on untrusted websites.
3. Use of transaction analysis tools: 1 ) Use a trusted platform for transactions and contract interactions. 2 ) Carefully check the contract address and calling method to avoid misoperation.
IV. Use of computer equipment: 1 ) Regularly update computer equipment systems, update software, and patch security holes. 2 ) Use security anti-virus software to regularly check and kill computer system viruses.
Q5 : Compared with a single wallet, how can people manage multiple wallets and accounts more securely?
WTF Academy : Since LUMAO users interact frequently on the chain and manage multiple wallets and accounts at the same time, special attention needs to be paid to asset security.
1. Use a hardware wallet: Hardware wallets allow users to manage multiple wallet accounts on the same device. The private key of each account is stored in the hardware device, which is relatively more secure.
2. Separation security strategy & separation operating environment: The first is the separation security strategy. Users can achieve the purpose of risk diversification by separating wallets for different purposes. For example, airdrop wallets, transaction wallets, storage wallets, etc. For another example, hot wallets are used for daily transactions and cashing operations, and cold wallets are used for long-term storage of important assets. In this way, even if one wallet is damaged, other wallets will not be affected.
The second is to separate the operating environment. Users can use different devices (such as mobile phones, tablets, computers, etc.) to manage different wallets to prevent the security issues of one device from affecting all wallets.
3. Password management: Users should set a strong password for each wallet account and avoid using the same or similar passwords. Or use a password manager to manage passwords for different accounts to ensure that each password is independent and secure.
OKX Web3 Wallet Security Team: For crypto users, it is not easy to manage multiple wallets and accounts more securely. For example, the wallet security factor can be improved from the following dimensions:
1. Diversify risks: 1 ) Do not put all assets in one wallet, store them in a dispersed manner to reduce risks. Choose different types of wallets, such as hardware wallets, software wallets, cold wallets, and hot wallets, according to the type and purpose of assets. 2 ) Use multi-signature wallets to manage large assets and improve security.
2. Backup and recovery : 1 ) Back up your mnemonics and private keys regularly and store them in multiple safe locations. 2 ) Use a hardware wallet for cold storage to avoid private key leaks.
3. Avoid duplicate passwords : Set strong passwords for each wallet and account, and avoid using the same password to reduce the risk of one account being hacked and other accounts being threatened at the same time.
4. Enable two-step verification : Where possible, enable two-step verification ( 2FA ) for all accounts to increase account security.
5. Automated tools : Reduce the use of automated tools, especially those services that may store your information in the cloud or on third-party servers to reduce the risk of data leakage.
6. Limit access rights : Only authorize trusted people to access your wallet and account, and limit their operating permissions.
7. Check the security status of the wallet regularly : use tools to monitor wallet transactions to ensure that no abnormal transactions occur. If any wallet private key is found to be leaked, replace all wallets immediately, etc.
In addition to the dimensions listed above, there are many more. In any case, users should try to ensure the security of their wallets and assets through multiple dimensions as much as possible, and not rely solely on a single dimension.
Q6 : What are the protection suggestions for transaction slippage, MEV attacks, etc. that are specifically related to the profiteers ?
WTF Academy : It is crucial to understand and prevent transaction slippage and MEV attacks. These risks directly affect transaction costs and asset security.
Take MEV attacks as an example. Common types include: 1 ) Front-running, where miners or trading robots preemptively execute the same transaction before the user's transaction to make a profit. 2 ) Sandwich attack, where miners insert buy orders and sell orders before and after the user's transaction to profit from price fluctuations. 3 ) Arbitrage: arbitrage using price differences in different markets on the blockchain.
Users can avoid public broadcasting on the blockchain by submitting transactions to the miners' dedicated channels through the MEV protection tool. Or they can reduce the risk of being attacked by reducing the transaction disclosure time, that is, reducing the time the transaction stays in the memory pool, using higher gas fees to speed up transaction confirmation, and avoiding large transactions concentrated on one DEX platform.
OKX Web3 Wallet Security Team: Transaction slippage refers to the difference between the expected transaction price and the actual execution price, which usually occurs when the market is volatile or liquidity is low. MEV attacks refer to attackers taking advantage of information asymmetry and trading privileges to obtain excess profits. The following are some common protection measures for these two scenarios:
1. Set slippage tolerance: Due to the delay in uploading transactions to the blockchain and possible MEV attacks, users need to set a reasonable slippage tolerance in advance when trading to avoid transaction failures or capital losses due to market fluctuations or MEV attacks.
2. Trading in batches: Avoid large transactions at one time and trade in batches to reduce the impact on market prices and reduce the risk of slippage.
3. Use trading pairs with higher liquidity: When trading, choose trading pairs with sufficient liquidity to reduce the occurrence of slippage.
4. Use anti-frontrunning tools: Try not to use Memepool for important transactions . You can use professional anti-frontrunning tools to protect transactions from being captured by MEV robots.
Q7 : Can users use monitoring tools or professional methods to regularly monitor and detect wallet account anomalies?
WTF Academy : Users can use a variety of monitoring tools and professional methods to regularly monitor and detect abnormal activities in wallet accounts. These methods help improve the security of accounts and prevent unauthorized access and potential fraud. The following are some effective monitoring and detection methods:
1 ) Third-party monitoring services: Many platforms currently provide users with detailed reports and real-time alerts on wallet activities.
2 ) Use security plug-ins: Some security tools can automatically block some phishing websites.
3 ) Wallet built-in functions: Wallets such as OKX Web3 can automatically detect and identify some phishing websites and suspicious contracts, and provide warnings to users.
OKX Web3 Wallet Security Team: Currently, many companies or organizations provide a large number of tools for monitoring and detecting wallet addresses. We have compiled some of them based on public information in the industry, such as:
1. Blockchain monitoring tools: Use blockchain analysis tools to monitor abnormal transactions of wallet addresses, changes in funds, set address transaction notifications, etc.
2. Secure wallet: Use professional wallets such as OKX Web3 wallet, which can support transaction pre-execution and detect suspicious transactions in a timely manner; it can also detect and prevent interactions with malicious websites and contracts in a timely manner.
3. Alert Systems : can send transaction or balance change reminders according to the conditions set by the user, including SMS, email or App notifications, etc.
4. OKLink token authorization query: Check the wallet's authorization for DApps , revoke unnecessary authorizations in a timely manner, and prevent authorizations from being abused by malicious contracts .
Q8 : How to protect privacy and security on the chain?
WTF Academy : Although the open and transparent nature of blockchain brings many benefits, it also means that users' transaction activities and asset information may be abused, and on-chain privacy protection becomes increasingly important. However, users can protect their personal identity privacy by creating and using multiple addresses. Fingerprint browsers are not recommended because many security vulnerabilities have occurred before.
OKX Web3 Wallet Security Team: Currently, more and more users are beginning to pay attention to privacy and security protection. Common methods include:
1. Multi-wallet management: Disperse user assets and reduce the risk of a single wallet being tracked or attacked.
2. Use a multi-signature wallet: Multiple signatures are required to execute transactions, which increases security and privacy protection.
3. Cold wallet: Store long-term assets in hardware wallets or offline storage to prevent online attacks.
4. Do not disclose your address: Avoid sharing your wallet address on social media or public platforms to prevent being tracked by others.
5. Use a temporary email address: When participating in airdrops or other activities, use a temporary email address to protect your personal information from being exposed.
Q9 : If a wallet account is stolen, how should the user respond? Are there any efforts or mechanisms to help stolen users recover their assets and protect their assets?
WTF Academy : We focus on phishing attacks and private key / mnemonic phrase leaks separately.
First, when a phishing attack occurs, the assets authorized by the user to the hacker will be transferred to the hacker's wallet, which is almost impossible to rescue / recover; but the remaining assets in the user's wallet are relatively safe. The RescuETH team recommends that users take the following measures:
1 ) Withdraw the asset authorization given to the hacker
2 ) Contact security companies to track the stolen assets and hacker addresses.
Secondly, when a private key / mnemonic phrase leak occurs, all valuable assets in the user's wallet will be transferred to the hacker's wallet, which is almost impossible to rescue / recover. However, assets in the user's wallet that cannot be transferred can be rescued, such as unlocked pledged assets and unissued airdrops, which are also our main rescue targets. The RescuETH team recommends that users take the following measures:
1 ) Check your wallet immediately to see if there are any assets that have not been transferred by hackers. If there are any, transfer them to a safe wallet immediately. Sometimes hackers will miss some assets on unpopular chains.
2 ) If your wallet has unlocked pledged assets and unissued airdrops, you can contact a professional team for rescue.
3 ) If you suspect that malware has been installed, perform a virus scan on your computer and remove the malware as soon as possible. If necessary, reinstall the system.
Currently, we have made many attempts to rescue stolen users' assets.
First, we are the first team to conduct a large-scale rescue of stolen wallet assets. In the Arbitrum airdrop event in March 2023 , I collected more than 40 private keys of leaked wallets from nearly 20 fans and rushed the airdrop with the hacker $ARB . In the end, we successfully rescued ARB tokens worth more than $ 40,000 , with a success rate of 80% .
Second, when a user's wallet is stolen, assets with economic value will be transferred away by hackers, while NFTs or ENS that have no economic value but are of commemorative value to the user will remain in the wallet. However, because the wallet is monitored by hackers, the transferred Gas will be transferred away immediately, and users cannot transfer this part of the assets. In response to this, we have made a self-help rescue application: RescuETH App , which is based on the MEV technology of Flashbots bundle . It can package transactions for transferring in Gas and transferring out NFT/ENS , preventing hackers from monitoring scripts to transfer out Gas , thereby successfully rescuing assets. Currently, RescuETH App is in internal testing and is expected to start public testing in June .
Third, for the part of the assets that can be rescued in the stolen wallets of users (unlocked pledges and unissued airdrops), we provide paid and customizable white hat rescue services. At present, our white hat team consists of nearly 20 security /MEV experts, and has rescued more than 3 million RMB in assets from stolen wallets of chains such as ETH , Solana , and Cosmos .
OKX Web3 Wallet Security Team: We will discuss this from two perspectives: user measures and OKX Web3 Wallet security mechanism
1. User Measures
Once a user finds that their wallet has been stolen, it is recommended to take the following measures urgently:
1. Emergency response measures
1 ) Transfer funds immediately: If there are funds in your wallet, you need to transfer them to a secure new address immediately.
2 ) Revoke authorization: Immediately revoke all authorizations through management tools to prevent further losses.
3 ) Track the flow of funds: Track the flow of stolen funds in a timely manner and organize detailed information about the theft process in order to seek external help.
2. Community and project support
1 ) Seek help from the project and community: Report the incident to the project and community, and sometimes the project can freeze or recover the stolen assets. For example, USDC has a blacklist mechanism that can block fund transfers.
2 ) Join blockchain security organizations: Join relevant blockchain security organizations or groups and use collective strength to solve problems.
3 ) Contact the wallet’s customer support: Contact the wallet’s customer support team in a timely manner to seek professional help and guidance.
2. OKX Web3 Wallet Security Mechanism
OKX Web3 Wallet attaches great importance to the security of user assets and continues to invest in protecting user assets, providing multiple security mechanisms to ensure the security of users' digital assets.
1 ) Black address tag library: OKX Web3 wallet has established a rich black address tag library to prevent users from interacting with known malicious addresses. The tag library is continuously updated to respond to changing security threats and ensure the security of user assets.
2 ) Security plug-in: OKX Web3 wallet provides built-in anti-phishing protection to help users identify and block potential malicious links and transaction requests, enhancing the security of user accounts.
3 ) 24 -hour online support: OKX Web3 Wallet provides customers with 24 -hour online support, promptly following up on incidents of customer asset theft and fraud, and ensuring that users can quickly get help and guidance.
4 ) User Education: OKX Web3 Wallet We regularly publish security tips and educational materials to help users improve their security awareness and understand how to prevent common security risks and protect their assets.
Q10 : Can you share some cutting-edge security technologies, such as whether AI can be used to enhance security protection?
WTF Academy : Security in the blockchain and Web3 fields is an evolving field, with various cutting-edge security technologies and methods emerging. The most popular ones are:
1 ) Smart Contract Auditing: Using AI and machine learning to automate the security auditing of smart contracts can detect vulnerabilities and potential risks in smart contracts, providing faster and more comprehensive analysis than traditional manual auditing.
2 ) Abnormal behavior detection: Use machine learning algorithms to analyze on-chain transactions and behavior patterns to detect abnormal activities and potential security threats. AI can identify common attack patterns (such as MEV attacks, phishing attacks) and abnormal transaction behaviors, and provide real-time warnings.
3 ) Fraud Detection: AI can analyze transaction history and user behavior to identify and flag possible fraudulent activities.
OKX Web3 Wallet Security Team: Currently, AI has been widely used in the Web3 field. Here are some scenarios where AI can be used to increase Web3 security protection:
First, anomaly detection and intrusion detection: Use AI and machine learning models to analyze user behavior patterns and detect abnormal activities. For example, deep learning models can be used to analyze transaction behavior and wallet activities to identify potential malicious behavior or abnormal activities.
Second, phishing website identification: AI can detect and block phishing websites by analyzing web page content and link features, protecting users from the threat of phishing attacks.
Third, malware detection: AI can detect new and unknown malware by analyzing the behavior and characteristics of files, preventing users from downloading and executing malicious programs.
Fourth, automated threat response: AI can automate response measures, such as automatically freezing accounts or taking other protective actions after detecting abnormal activity.
Finally, thank you for reading the 03rd issue of the OKX Web3 Wallet "Security Special Issue" . We are currently preparing for the 04th issue, which will include real cases, risk identification, and security operation tips. Stay tuned!
