1/
Ladies and gentlemen, esteemed guests, and all the passionate fans of Pebble Racing,

Tonight, under the moonlit skies, we stand here in sheer jubilation, basking in the glory of victory.

2/
It is with immense pride and gratitude that I accept this honour on behalf of the incredible Night Journeys and our entire team.

3/
To witness our beloved Night Journeys thundering across the finish line, seizing victory with unwavering determination, is a moment that shall forever be etched in our hearts.

I must first extend my deepest gratitude to the magnificent Eye of Sauron, Maybe and their team.

4/
What an extraordinary display of skill and sportsmanship showcased throughout the race. Their unwavering spirit pushed Night Journeys to strive for greatness, and for that, we owe them a debt of gratitude. To Eye of Sauron, you are truly worthy adversaries, and we salute you.

5/
To our dedicated supporters, your unwavering belief in Night Journeys has been the driving force behind our success. @mememaxis, @blocknoob_,  @chinchillaboots, @aRegularDad, @vanto77_ , @Ars0nic, @B_C_Bull, @ChrizRoc, @_MariaMu_, @crunch_fi, @fairlyoptimist, @imagine_sme

6/
Your encouragement and unwavering support have been the pillars upon which our journey has been built. Your cheers, your words of encouragement, and your undying loyalty have fuelled our passion and propelled us to this moment of triumph.

7/
We humbly thank you from the depths of our hearts and hope that you will continue to stand by our side as we embark on future endeavours. We will however understand if you happen to support any future opponents of Night Journeys instead.

8/
To our dedicated team of trainers, jockeys, grooms, and everyone behind the scenes who work tirelessly day in and day out, your commitment to excellence knows no bounds.

9/
Your expertise, dedication, and tireless efforts have been instrumental in shaping Night Journeys into the champion that stands before you today. Each of you plays an invaluable role in our success, and we share this victory with you all.

10/
Lastly, to the sport of Pebble Racing and subsequently to @mintfaced, @brookr, @seizeio, thank you for providing us with a platform to showcase the unparalleled beauty and grace of these magnificent rocks, and we thank @Ze_blocks, @punk6529 for their creation.

11/
It is through the spirit of competition and camaraderie that we forge bonds that transcend the racetrack, uniting us in a shared love for the sport.

As we revel in the glory of this moment, let us remain ever humble and ever grateful for the opportunities that lie ahead.

12/
With Night Journeys as our guiding light, we shall continue to push the boundaries of possibility, striving for greatness with every stride.

Thank you, one and all, for being a part of this extraordinary journey.

13/
Tonight, we celebrate not only a victory on the racetrack but a triumph of the human and rock spirit.

Long live Night Journeys, long live NextGen Pebbles, and long live the spirit of Pebble Racing!

Thank you.

14/
Looking Forward!

Round 2 has begun and we would love your support on this next leg against the an incredibly tough crowd-favourite from Round 1.

Good luck @0xAnimatedNFT and may the best Pebble win!

15/
To vote on the race, head to om.pub/races and click on the Pebble that you'd like to vote for.

You will be taken to the owner's Seize profile - here is an example when clicking on Pathway to Disorder.

In the "Assign Rep" section, type "Pebble Racing (Name)"

16/
You then assign any rep between 100-1000 for Round 2.

Please be aware that you must have accumulated Rep to be able to vote. Please let me know if you haven't got a Seize profile already set up.

Night Journeys: Racing Triumph

With the recent announcement of @delegatecash, I noticed some misunderstanding of what this implementation achieves versus the @CyberKongz Guardian and @0xQuit's Guardian

Let me explain each of these implementations and why I think they're essential to the future of Web3 🧵👇🏻

Firstly, let's begin with the trailblazer @OwlOfMoistness and his @CyberKongz Guardian contract.

This implementation allows a user to keep an asset in one address, while assigning another address as a Guardian.

While this Guardian address is set and the asset is locked, the asset cannot be transferred. Even if a bad actor has your seed phrase, or you've signed a token approval.

This implementation allows you to safely use your asset on a "hot" wallet while mitigating risk. Big win.

One of my favourite parts is that even when assets are locked, there is an Emergency Transfer button that allows you to initiate a transfer FROM the Guardian address.

This is important because it mitigates the risk of having to race the bad actor's transactions.

Usually with a seed phrase compromise a bad actor uses a sweeping bot that sends all ETH out from the address as soon as it's received.

This leaves people in situations where they are unable to retrieve staked assets, claim drops etc.

Emergency Transfer is initiated FROM THE GUARDIAN ADDRESS not the compromised address, so no need to race the bad actors transactions!

Pros:
-Locks any transfer of asset, unless unlocked or from Guardian
-Mitigates seed phrase compromise, token approval, and transfer phishing

Cons:
-Requires unlocking of asset to sell/transfer
-Asset loss if Guardian keys are lost

Secondly, let's take a look at @0xQuit's Guardian.

This implementation focuses specifically on Token Approvals. If you've been in Web3 for the past 9 or so months, you know that this is the number one attack vector during this time frame.
https://twitter.com/0xQuit/status/1555911623058935808?s=20&t=wDmJCsd7Ccen6thTON1KNg

This is great for those who use a hardware wallet and are less likely to experience seed phrase compromise, and for assets that don't require "hot" wallet usage.

It allows you to first set token approvals that you might want (OS, LooksRare etc.) and then lock future approvals.

When you call the lockApprovals function, you parse a "Guardian" address which is necessary when you want to eventually unlock approvals.

Only this Guardian address is able to revoke the lock on token approvals. However, you can still transfer the asset like normal.

Pros:
-Focus on most likely threat - token approvals
-Can list without removing control
-Can still transfer asset if Guardian keys are lost

Cons:
-Does not mitigate against seed phrase compromise
-Does not mitigate transfer phishing

And lastly, the newest kid on the block - @delegatecash.

While the other two focused specifically on asset security, this new implementation focuses on safe delegation of ownership, which inherently increases security posture.

The intention is to allow someone to hold an asset in a cold wallet, while simultaneously being able to prove that they own said asset via a hot wallet, while the hot wallet has ZERO control over said asset.

This allows on-chain provable ownership without having to expose your valuable private keys or assets or use a centralised platform

Examples where this is beneficial include claiming NFT airdrops, claiming yield from a staking contract, attending in-person token-gated events etc

All of these examples stemmed from the same risk, and this risk was one of the largest hurdles to a future of Web3 becoming mainstream.

As you can see, all three of these implementations mitigate different risks and they are all incredibly important in moving the space forward.

Massive thanks to everyone involved in all of these tools! We owe you much wei and many CDBs.

Credits:
@OwlOfMoistness
@0xQuit

Delegatecash -
@0xfoobar
@0xnook
@khivedoteth
@purphat
@punk6529
@andy8052

Follow them all and help support those who support the community!

You can read the unrolled version of this thread here: https://typefully.com/4lteredBeast/4y5dC7k

A more secure Web3

⚠️SCAM EMAIL ALERT⚠️



I just received the following email and it is 100% a scam.

Let me show you the attack and the warning signs!
🧵👇🏻

1/
If you are using gmail, this little arrow right here is your friend. Click that bad boi. Even if you are pretty sure. Click it.

2/
There are a few things of note here. Firstly, this one is sloppy since they didn't even attempt to spoof a legitimate Ledger domain.

secureliveupdates[dot]com should have you running instantly.

They then used a mailing service to send the email on behalf of secureliveupdates

3/
Using a mailing service is not inherently suspicious in itself - many companies do this. However, there is a right way to use a mailing service to prove legitimacy and ownership of the domain.

If I were to send an email legitimately from @jrny.club via a mailing service...

4/
it would show jrny.club in the "signed-by:" section. In the same way that you sign with the private key of your wallet to prove ownership, encryption of emails works in the same manner. I would use a private key that has been signed by a Certificate Authority..

5/
Proving ownership of the domain.

A legitimate signature however does not inherently prove legitimacy of the contents of the email though - it's always possible for this to be compromised. Stay sceptical at all times.

Ok, so probably don't do this at home, but let's see...

6/
where this link takes us!

Sneaky buggers. They are using a Google Site to make it seem legitimate. 

This is a great example of why you should always check the URL, but you should also ALWAYS make sure that the URL is relevant to what you are expecting it to be.

7/
And of course, because they are using the Google suite to deploy this page, it's also using a legitimate Google certificate. Again, another reason why you should check these things and question why a "Ledger" site might be using a legitimate Google certificate.

It shouldn't!

8/
Ok, screw it. Let's see what this does... quick bet: I bet it's phishing.

Oh, interesting. It's actually trying to connect to your Ledger?! Whaaaaat

9/
Naaah gamon (a bit of Northern Australia slang for anyone at home 😉)

Of course it's phishing!

Everyone talks about web3 being unsafe for users, but all of these attacks are simple web2 attacks. Don't get it twisted.

10/
It's a simple phishing attack to get your seed phrase... that's it. 

Please please PLEASE, never EVER input your seed phrase anywhere!

I know, you're saying to yourself, "no one would do that!"

These bad actors don't continue using attack vectors that don't work.

11/
Digging through code on the site, and I just had to share this little nugget of laughter. Just because something is written, doesn't mean you should believe it.

12/
I hope this helps at least one person, and if it helped you or if any of my other content helped, I would always appreciate a follow and retweet :)

You can read the unrolled version of this thread here: https://typefully.com/4lteredBeast/Mky5Wyq

Just another phishing email...

1/
I've seen this misconception far too often, along with an increased number of seed phrase compromises lately, so I need to make this clear -



⚠️If you are using a software wallet, prepare for your seed phrase to be compromised⚠️



A quick 🧵👇🏻

2/
I have seen an increase in seed phrase compromises recently from a number of different attack vectors. The difficult thing is that they're hard to track because the attack is entirely off-chain.

I noticed this increase a couple of months ago

https://twitter.com/4lteredBeast/status/1539456753959837696?s=20&t=nOxhawooyXTRx4ZVuBd2-w


3/
Your PC is INCREDIBLY vulnerable. While using a software wallet, your PC holds your keys. A hardware wallet is designed specifically for the purpose of keeping your keys private.

You're not safe if you "just don't click on dumb shit". There are a multitude of attack vectors

4/
Let's take the recent attack on @slope_finance.

Make all the Solana jokes that you may, but this attack could just as easily have happened to met@mask and everyone not using a hardware wallet would have gotten rekt.

https://slope-finance.medium.com/slope-update-11-august-2022-31d678d7cd97

5/
Not to boast, but I literally warned of a software wallet exploit possibility a month before the Slope attack occurred. 

Not exactly the same attack vector, but still a zero-day exploit nonetheless

https://twitter.com/4lteredBeast/status/1539456755532722176?s=20&t=nOxhawooyXTRx4ZVuBd2-w

6/
There are so many vulnerabilities on your PC that you are unaware of, and the software developers who wrote the code are also unaware of. 

At any moment, ANY piece of software on your PC could become a threat and your entire wallet could be drained. 

7/
When I say ANY software, I mean it... even native Windows apps, just like the Follina exploit in May, which Microsoft were ENTIRELY unaware of until it was being used as an attack vector.

This attack allowed remote code execution simply by opening a Word document.

8/
Are you happy with putting your entire crypto portfolio at risk of any number of these applications being attacked? Every piece of software is a potential door to your wallet.

EVERY. SINGLE. ONE.

Just get a hardware wallet already.

9/
I wrote a similar thread which went into a little bit more detail on this, and I think it's worth a read

https://twitter.com/4lteredBeast/status/1539456752072429568?s=20&t=nOxhawooyXTRx4ZVuBd2-w

10/
Also, check out my thread on wallet segregation and hardware wallet usage

https://twitter.com/4lteredBeast/status/1529362582767026176?s=20&t=nOxhawooyXTRx4ZVuBd2-w

11/
Here is a thread on zero-trust that I think is also beneficial

https://twitter.com/4lteredBeast/status/1542149365816786947?s=20&t=9pFg2eymhkMsUYARKCrdRw

12/
Still unsure what a hardware wallet actually protects against? I have a thread for that

https://twitter.com/4lteredBeast/status/1511356592913936385?s=20&t=7tQOVlz_-tXcBkxyE8DgXA

13/
And lastly, if you want my most recommended hardware wallet, I'd love if you could do me a solid and buy a @gridplus Lattice1 from my affiliate link. It costs you nothing extra, and just gives me a little kickback from the sale

https://gridplus.io/?afmc=8k

14/
@gridplus is best in market, however, it is limited in needing to be plugged in. If you need something for travel, Ledger is good too.

If you can't afford a GridPlus, definitely get something else instead... just stop using a software wallet!

You can read the unrolled version of this thread here: https://typefully.com/4lteredBeast/QK37Qof

Are you STILL not using a hardware wallet?

There have been a few browser extensions being built with the intention of helping users know when they are calling a token approval function.

The intention is obviously good, however, I believe they don't improve security and add unnecessary risk.

Let me explain why...🧵👇🏻 

1/
Let's talk vulnerabilities, threats, and controls.

The vulnerability is that a token approval gives full control of tokens to another address.

The threat is that a user delegates this control to a bad actor's address unknowingly, resulting in asset loss.

2/
Ok so we know the vulnerability and the threat. Now, let's talk controls.

There are 3 Control Types in cyber security - Administrative, Technical, and Physical. 

There are 3 Control Functions - Preventative, Detective, and Corrective.

3/
Let's just have a quick run down of each Control Type.

Administrative - human-based control, behavioural or management related. Known as a "soft control"
Physical - something tangible and not technology-based
Technical - technology based control (software or hardware)

4/
Next are the Control Functions

Preventative - prevents a vulnerability being exploited
Detective - detects unauthorised activity
Corrective - repairs damage or restores services to their original state

5/
Now that we understand control types and functions, let's go back to understanding the original threat and the control that has been developed by http://revoke.cash and others

Threat = uneducated user giving token approval to bad actor

Control = Technical and Detective

6/
The extension is a Technical control since it uses technology to apply a Detective function. It is Detective, because it does not prevent the user from accepting, it is merely detecting something and providing information.

So far, so good...

7/
So, why am I even writing this thread then?!

Let's look at the risk management process. We've assessed the risk of the threat. We are now looking at implementing this extension as a control to bolster our security posture. Then what? We re-assess for residual risk! 

8/
Residual risk is a term that defines any risk that is left over after security controls have been implemented.

So what residual risk do we have here? 

Well, for one.. we have just introduced an entirely new vulnerability to our security posture. Another browser extension!

9/
Why is a browser extension a risk? Because any additional code running on your device is another source of potential vulnerabilities.

"But, the code is open-source!" I hear you say!

So was the tool that @PREMINT_NFT were using to upload assets, that was recently attacked.

10/
Open-source != inherent security

Yes, open-source is imo better for security than closed-source products, but it doesn't mean that they are inherently secure.

ALL software products have security vulnerabilites, known or unknown - that's why we patch.

11/
Ok, so even though @RevokeCash seems competent, it would be unwise to inherently trust that their codebase will never be compromised. 

What even is the threat here in the first place? Let's look at how the extension works.

12/
The extension works as a friendly man-in-the-middle. It catches and checks for function calls == setApprovalForAll, if "approved" boolean is true

This basically means it's looking for a token approval call by intercepting your on-page click before it hits your wallet

13/
After you hit Continue on the extension, it then takes the original call and passes it to your wallet

So what is the threat then? 

A malicious code injection to this extension COULD allow the extension to act as a malicious man-in-the-middle. 

What does this look like?

14/
Say you go to OS and list an NFT that you haven't yet approved

The extension pops up as expected and shows that you are approving that asset and the spender is OS 

The compromised extension then changes the operator (OS) to the bad actor's address and sends to your wallet

15/
You have been conditioned to trust the extension, and now you aren't reading the data in your wallet and you have just signed away a token approval!

Another threat that I think is more likely is that something goes wrong with your extension or it is unknowingly disabled.

16/
You click mint on a fake mint site and the extension doesn't pop up. 

You are now trained to believe that if the prompt doesn't show, the transaction is NOT a token approval and you sign the token approval.

These two threats have been introduced, so how do we control them?

17/
The only real answer here is an administrative based control - education.

You as a user need to be able to read the functions that you are signing in your wallet. That is the only way that you can detect these two possible threats.

18/
Right, so we learn how to read what we are signing in our wallet. That's the best control that we have for these threats.

So let's assess where we are at in this risk assessment...

19/
We had a threat of a token approval unbeknown to the user, mitigated with the extension as a control. The extension then introduced a new threat of a token approval unbeknown to the user...

Oh... wait. 

BOTH THREATS ARE THE SAME 🤯

20/
The original threat that was mitigated with the extension STILL requires user education, while introducing new risk.

Either way, the user still needs to understand what a token approval looks like in their wallet.

EDUCATION IS THE APPROPRIATE CONTROL IN THE FIRST PLACE

21/
There is no easy fix for these issues in crypto. You are the custodian of your assets, you need to understand what you are doing with them. 

Education is key and no hard control is going to reduce the need for your education.

Learn how to read what you are signing.

22/
Let me be clear, I'm not being negative towards anyone developing these extensions. I applaud them for trying to provide a solution to a real problem.

But this solution is misguided and, without knowledge and understanding of the risks introduced, dangerous to users.

23/
I'll say it time and time again, security professionals are your best friend in this space.

If you are developing something like this, please reach out to me, or to any of the other security people that I regularly rt, qt or recommend in my threads. 

We can give feedback.

24/
If you like this breakdown, please follow myself and these peeps for more info like this
@0xQuit 
@Feld4014 
@mattborchert 
@Jon_HQ 
@Wii_Mee 
@Plumferno 
@GrassyEth 
@lukenamop 
@BoringSecDAO 
@Server_Forge 

And a big shout out to @JRNYcrypto for hiring me to do this stuff!

25/
Some more accounts to follow - 
@cryptoShields 
@wallet_guard 
@rugpullfinder 
@Serpent

Should I use revoke.cash's browser extension?

You bought a hardware wallet - great work! 

But hold on, what risks are actually being mitigated? ✅ 
And what risks are not being mitigated? ❌

👇A 🧵from a cyber security architect

Many people misunderstand the risks that a hardware wallet mitigates. This is dangerous and leads people to a false sense of security towards their blockchain assets. 

Which brings me to the first and most important, albeit bland, point of this thread...

Risk management starts with risk assessment 🕵️

You should not implement controls without first understanding the risks that you are trying to mitigate

Once the risks are understood, you should seek controls to mitigate those risks

Once controls are implemented, test them

Let's talk about risks and how we might categorise them. 

We have a useful model in security called the CIA triad - Confidentiality, Integrity, and Availability. 

All risks will align with at least one of these principles and they are foundational to security risk management 

Confidentiality - ensuring that data are kept private
Integrity - ensuring that data are correct, authentic, and reliable
Availability - ensuring that data are available when needed

Now that we've had a quick cyber security primer, let's get back to hardware wallets! 

RISK #1
Seed phrase / private key theft - Confidentiality risk.

The main goal of a hardware wallet is to provide a safe mechanism for interacting with the blockchain, while mitigating the risk of an unauthorised entity gaining access to your seed phrase / private keys

A hardware wallet mitigates the risk of this unauthorised access by storing the private keys in an environment that is specifically designed to keep these secrets secure. This is the sole purpose of the device and all other functionality is secondary to this one purpose.

The device that you are using right now to read this thread, is VERY insecure in comparison. Storing your keys on a wallet on this device is a bad idea as the attack surface is significantly higher. Your keys are exposed to a slew of potential malware and phishing attacks.

Just in case you missed it, because this is important -

A HARDWARE WALLET DOES NOT IMPLICITLY SECURE A SEED PHRASE

If your backup (you do have a backup, right?) is compromised, a malicious actor can use the private keys to access your assets regardless of your hardware wallet

RISK #2
Man-in-the-middle signature - Integrity risk

This isn't a risk that is explicitly designed for, it's more of a bonus control. There is a risk that your wallet software on your PC/phone could be compromised and have you sign an unexpected transaction that looks legitimate

The malware would display the correct function while taking your signature and applying it to a separate illegitimate transaction. 

If you are only using a software/hot wallet, you will be none the wiser. 

If you are using a hardware wallet, it will always show the actual transaction on your screen as you sign it.

This is one of the reasons why I recommend @gridplus Lattice1 as it has the capability to show you what you are signing in human readable form (not hex)

And that's it for the list of risks that a hardware wallet DOES mitigate.

What risks does it not mitigate? 

Well, the list is long, but here are a few - 

NFT / ETH drains on fake mint sites (you are approving these with your hardware wallet) - Integrity
Seed phrase backup theft - Confidentiality
Seed phrase loss due to lack of backup - Availability

Losing staked NFTs due to contract hack - Availability
NFT swap scams - Integrity

The list goes on and will continue to grow. Hit me with a reply if you would like insight into any other risks that didn't make this list!

Ok, so we understand the risks/controls and have bought an appropriate hardware wallet and set it up. You said that now we have to test the control? 

YES

Attempt a transaction from your software wallet without your hardware wallet connected. Does the transaction succeed?

If it does, your software wallet is holding your keys and you are still at risk.

You need to transfer your assets to an address that is derived from the seed phrase that ONLY lives on your hardware wallet.

YOU SHOULD NEVER IMPORT THIS PHRASE INTO A SOFTWARE WALLET

Many people have asked for help with their wallet behaving in an odd manner to find that they had imported the seed phrase from their hw wallet into M3tamask. 

If you have done this you are NOT SAFE. Create a new seed phrase on your hw wallet and transfer your assets ASAP

And lastly, PLEASE stop referring to hardware wallets as "basically 2FA". They are in no way 2FA and this implies controls that hardware wallets do not provide... 

like two factors of AUTHENTICATION. 

But let's leave that for another thread 😉

If you've enjoyed this thread, please follow for more posts about blockchain security from a cyber security professional! 

Please let me know if you have any particular subjects that you would like me to cover in future threads 🙂

Also, if you like the look of the @gridplus, I would appreciate the use of my affiliate link - https://t.co/vg9hVcVkK8 (back in stock in May)

And if you are looking for a great alternative to M3tamask, check out @0xFrame. It is an amazing wallet.

You can read the unrolled version of this thread here: https://typefully.com/4lteredBeast/XL99EvP