As the invisible Achilles heel, “zero-day” exploits have been behind some of the most infamous hacks in the history of cybersecurity. They are the unknown unknowns, the bane of every Security Architect tasked with shielding the project from ingenious attackers. How could one possibly guard against an exploit that, by its definition, has been known for zero days?
This question has become particularly pertinent ever since Web3 has turned the discovery of “zero days” into a highly lucrative pastime. Black hats pore over the on-chain application code in the hopes of finding a novel vulnerability and cashing out on their hard labor. The $600m cross-chain transaction vulnerability of the Poly Network and the unlimited minting bug that cost Qubit Finance $80m are just two examples of how devastating zero-day attacks can prove.
In our latest addition to the Web3 Security series, we explore the security strategies and best practices designed to mitigate the impact of future zero-day exploits in Web3.
“ 0 days since last accident”
As highly-sophisticated attacks that target previously unknown vulnerabilities, zero-day exploits are frequently ranked among the most severe security threats facing any Web3 project. Although plenty of projects fail to put up defenses against already known exploits such as the re-entrancy bug, it is the “surprise factor” behind zero-day attacks that makes them so notoriously difficult to defend against.
At the same time as sprawling digital supply chains and numerous interdependencies have broadened the attack surface of many organizations, Web3 has turned zero-day hunts into an enormously profitable activity. Since stolen crypto is impossible to recover in many instances, the labor-intensive search for vulnerabilities now has a very tangible monetary incentive.
Organizations that are serious about their project security must be proactive in their approach to the cat-and-mouse game. Although zero-day exploits remain in some ways unpreventable due to their as-of-yet undiscovered nature, organizations should take active measures. These include efforts to reduce the attack surface, develop a robust patch management strategy, draft a clear incident response plan, practice strong security hygiene in all operational activities, and have a fail-safe in case things turn sour.
Reduce attack surface
To guard against the unknown, the first line of defense is to streamline all operations, limiting the number of possible attack vectors. Although there is often a clear sales incentive to quickly expand the list of features and points of access, every hastily-implemented functionality brings about an entire array of potential vulnerabilities. By limiting the number of entry points available to untrusted users, reducing the amount of running code, eliminating non-essential services, and otherwise shrinking the attack surface, you also limit the probability of malicious actors discovering a zero-day vulnerability.
Develop an Incident Response Plan
No one likes thinking about the worst-case scenario. Nevertheless, a well-thought-out plan for incident response measures with clearly defined procedures and roles is a must for all projects. When push comes to shove, the clarity of the plan will help guide you through the chaotic first hours of an attack, allowing your team to efficiently mitigate the spread and damage. Not only that, the process of drafting the plan itself may help you prioritize your mission-critical activities and gain some perspective on your overall cybersecurity strategy.
Scan for vulnerabilities frequently
Strong security hygiene and reduced attack surface are not in themselves sufficient to prevent zero-day vulnerabilities. The best means of active prevention is to go out looking for vulnerabilities. Have your developers try to break into their system; develop a bug bounty program to provide an incentive for white hats to attempt it too. Make sure that your code is frequently audited by reputable third parties and have their experienced security teams scan for vulnerabilities. And remember to act on the advice of others — sanitize the code even if it means slightly delayed development of new features.
Implement a fail-safe
Organizations that wish to inspire confidence in their project security should also introduce a fail-safe — a mechanism that shields the project community from the financial loss associated with zero-day exploits. Lossless has developed an additional layer of blockchain security designed to foolproof Web3 protocols, ensuring that transactions associated with smart contract exploits are identified, frozen, and recovered. Lossless utilizes community-driven threat identification tools and a unique stake-based reporting system to provide real-time protection.
In the distant future, as Web3 advances along the path towards maturity and widespread adoption, the increased presence of white hats should raise the bar for attackers looking for novel vulnerabilities. Until then, the responsibility to ensure security for their communities is very much in the hands of individual projects.
About Lossless
Restoring trust in web3 security. Lossless incorporates a new layer of blockchain transaction security, protecting projects and their communities from malicious exploits and the associated financial loss.
Lossless protocol implements an additional layer of blockchain transaction security for ERC-20 standard tokens, mitigating the financial impact of smart contract exploits and private key theft. Lossless protocol utilizes community-driven threat identification tools and a unique stake-based reporting system to identify suspicious transactions, providing real-time protection.
Twitter | Platform | Telegram | Discord | Website | Documentation | Github
