News
Microsoft Cautions of Growing 'Ice Phishing' Threat on the Blockchain
This week Microsoft released a warning that it's seeing an increased number of phishing attempts aimed at web3 -- a term used to describe the decentralized environment created on the blockchain.
In a post on Wednesday, the Microsoft 365 Defender Research Team dissected the recent Badger DAO attack, which stole more than $120 million from blockchain users at the end of 2021, and said that these attacks are growing more frequent.
"There are multiple types of phishing attacks in the web3 world," wrote Christian Seifert, member of the Microsoft 365 Defender Research Team. "The technology is still nascent, and new types of attacks may emerge."
Microsoft said the Badger DAO attack is what the company calls an "ice phishing" attack. Instead of going after private keys and credentials, these attacks try to trick a user into "signing a transaction that delegates approval of the user’s tokens to the attacker." The tokens in question are ERC-20 tokens, which are the smart contracts containing the blockchain balance sheet, and sometimes represent a monetary value, as in the case of Bitcoin tokens.
Due to the differing landscape of web3, compared to the centralized nature of the current Internet, Microsoft said that the tried-and-true techniques used in older phishing attempts (like through e-mail), do not work. The company has identified new techniques that ice phishers are using, which include:
- Monitoring social media and direct messaging individuals mentioning cryptocurrency or the blockchain.
- Distributing (known as airdropping) fake tokens that fail on delivery, prompting users to a phishing Web site.
- Impersonating wallet software to directly steal keys.
One bright note is that security experts may be in a better position to counter attacks on blockchain technology, due to its decentralized nature. Attacks can be studied with full detail to establish countermeasures and best practices because of the full transparency of information that the blockchain provides.
Microsoft said that because there is so much money at stake (the crypto market is estimated to be worth $2.2 trillion), coupled with the relative infancy of the technology, incidences of attacks like that seen with Badger DAO will continue to grow. The way to counter its rise is to start focusing on strengthening security on web3 now.
This includes full audits for blockchain project managers that encompass the entire infrastructure and incident response process. It also calls on the entire security industry to stay flexible and work cooperatively to quickly respond as new and more sophisticated attacks appear.
"Blockchain technology is developing rapidly, and with broader adoption in the horizon, we encourage researchers to continue examining this emerging tech, sharing findings with the broader community, and helping improve security through both secure code and informed security products," said Seifert.