jakiro
background
Wallets play a crucial role in the Web3 world. They are not only storage tools for digital assets, but also necessary tools for users to trade and access DApps.In the previous issue of Web3 security introduction to avoid pitfalls, we mainly introduced the classification of wallets and listed common risk points to help readers form basic wallet security concepts.With the popularization of cryptocurrency and blockchain technology, black market has also set its sights on the funds of Web3 users. According to the stolen form received by the Slow Fog Security Team, it can be seen that many users were downloaded/purchased for fake wallets.Steal.Therefore, in this issue we will explore why fake wallets are downloaded/purchased, and the risks of private keys/mnemonic words leaked, and will also provide a series of security suggestions to help users ensure the security of their funds.
Download to fake wallet
Since many phones do not support Google Play Store or because of network problems, many people will download wallets from other channels, such as:
Third-party download site
Some users will download wallets through third-party download sites such as apkcombo, apkpure, etc. These sites often claim that their apps are downloaded from the Google Play Store image, but how is their real security?The Slow Fog Security Team has conducted an investigation and analysis of third-party sources of fake Web3 wallets, and the results show that the wallet version provided by the third-party download site apkcombo does not actually exist.Once the user creates a wallet or imports a wallet mnemonic in the start interface, the fake wallet will send mnemonics and other information to the server of the phishing website.
Search Engine
The ranking of the search engine is available, which leads to the fact that the fake official website ranking is still higher than the real official website. Therefore, it is not recommended that users directly search for the wallet through the search engine, and then click the top-ranked link to download the wallet., this is very likely to enter a fake official website and download it to a fake wallet.If users are not sure what the official website address is, it is difficult to tell whether this is a fake website based on the website display page alone, because the fake website produced by the scammer is very similar to the real official website, and can be faked to be real, so it is notIt is recommended that users click on links shared by other users on Twitter or other platforms, which are mostly phishing links.
Relatives and friends/pig killing plate
Keep zero trust in the dark forest of blockchain. Your relatives and friends may not have any idea of harming you, but they may be fake to download the wallet, but it is not stolen yet, so if you use the QR code they share/Download the wallet with a link, and it is also possible to download it to a fake wallet.
The Slow Fog Security Team has received many stolen forms of pig killing incidents. The scammer’s routine is to first gain the trust of the victim, then guide the victim to participate in cryptocurrency investment and share the download link of the fake wallet. The final result is the victim.He was cheated of his relationship and lost his funds.Therefore, users should be vigilant against netizens, especially when the other party invites you to invest or posts unknown links to you, don’t trust them easily.
Telegram
On Telegram, by searching for well-known wallets, we found some false official groups. Scammers will claim that the group is the official channel of a certain wallet, and even remind users in the group to identify the only official official website link, but these links are allIt’s fake.
Application Store
It should be noted that the applications in the official application mall are not necessarily safe. Some criminals induce users to download fraudulent apps by purchasing keyword rankings and other means. Please pay attention to the identification.
So, how can users avoid downloading fake wallets?
Official website download
The ability to find a real official website is not only used when downloading a wallet, but also when users participate in Web3 projects in the future, so we will talk about how to find the correct official website here.
Users may directly search for the project party on Twitter, and then judge whether this is an official account based on the number of followers, registration time, and whether there is a blue or gold label. However, these can be faked. We have been doing real and fake projects before.Fang | Beware of the article “Great Imitation Number Fishing” in the comment area has told you about the black and gray products that sell high Imitation Numbers.Therefore, it is recommended that new novices pay attention to some security companies, security practitioners, well-known media, etc. in the industry on Twitter to see if they have followed the official accounts you found.
(https://twitter.com/DefiLlama)
Through the above method, users are likely to find the real official Twitter account, but we still need to do multi-party verification. After all, it is common for official Twitter account to be hacked, and hackers will also replace the official website links on the official account with fake official website links., so users need to compare the official website link you just found with the links found through other channels (such as DefiLlama, CoinGecko, CoinMarketCap, etc.):
(https://defilama.com/)
(https://landing.coingecko.com/links/)
After finding and confirming the official website link, it is recommended that users save the link to the bookmark so that they can directly find the correct link from the bookmark next time, without having to re-find and confirm each time, reducing the probability of entering the fake official website.
Application Store
Users can download wallets through official app stores such as Apple Store, Google Play Store, etc., but before downloading, you must first check the application developer information to ensure that it is consistent with the official developer identity, and you can also refer to the application score and download volume.etc.
Official version verification
Some readers who see this may wonder, how to verify whether the wallet they downloaded is a real wallet?Users can do file consistency verification. This operation is to compare the hash values of the file to determine whether the file has changed during the transfer or stored procedure.The user only needs to drag the apk file downloaded previously into the file hash verification tool. This tool will use hash functions (such as MD5, SHA-256, etc.) to generate the hash value of the file. If this value is given by the officialThe hash value matches, it is a real wallet; if it does not match, it is a fake wallet.What should I do if the user verifies that his wallet is fake?
1. First, you need to confirm the scope of the leak. If you just download a fake wallet but don’t enter the private key/mnemonic word, then you just need to delete the app and re-download the official version.
2. If the private key/mnemonic word has been imported into the fake wallet, it means that the private key/mnemonic word has been leaked. Please download the genuine wallet on the official website and import the private key/mnemonic word, and create a new address to quickly transfer the transferableassets.
3. If your cryptocurrency is unfortunately stolen, we will provide free community assistance services for case assessment, only if you need to submit the form in accordance with the classification guidelines (stolen funds/scam/scam ransomware).At the same time, the hacker address you submitted will also be synchronized to the InMist Threat Intelligence Cooperation Network for risk control.(Note: Chinese form is submitted to https://aml.slowmist.com/cn/recovery-funds.html, and English form is submitted to https://aml.slowmist.com/recovery-funds.html)
Purchase a fake hardware wallet
The above situation is why you download a fake wallet and the solution. Let’s talk about why you buy a fake hardware wallet.
Some users choose to buy hardware wallets online malls, but this kind of hardware wallet in unofficial authorized stores has a very big security risk, because before the wallet is in the hands of users, how many people will it go through, whether the internal components have been tampered with?These are all uncertain.If the internal components have been tampered with, it is difficult to see the problem from the appearance and function.
(https://www.kaspersky.com/blog/fake-trezor-hardware-crypto-wallet/48155/)
Here are some of the ways we provide to deal with hardware wallet supply chain attacks:
Official channel purchase:This is the most effective solution to supply chain attacks.Do not buy hardware wallets from unofficial channels, such as online malls, purchasing agents, netizens, etc.
Check the appearance:After getting the wallet, check whether there are any signs of damage to the outer packaging. This is the most basic thing, although the hacker is likely to not be exposed at this step.
Official website real machine verification:Some hardware wallets provide official real-time machine verification services. When users initialize their wallets, the device will prompt the user to perform official real-time machine verification.If the equipment is tampered with during transportation, it will not be verified by the official website.
Dismantling the machine and self-destructing mechanism:You can choose to purchase a hardware wallet with a disassembled self-destruction mechanism. When someone tries to open the hardware wallet and tamper with internal components, the self-destruction mechanism will be triggered. All sensitive information in the security chip will be automatically erased, and the device will not be able to continue to use it.
Risk of private key/mnemonic word leakage
Through the above content, everyone should learn how to download or purchase a real wallet, so how to keep the private key/mnemonic words is another problem.Private key/mnemonic is the only voucher for restoring the wallet and controlling the assets.The private key is a 64-bit hexadecimal string composed of letters and numbers, while the mnemonic word is generally composed of 12 words.The Slow Fog Security Team here reminds that if the private key/mnemonic word is leaked, the wallet assets are very likely to be stolen. Let’s take a look at several common reasons for the leakage of private key/mnemonic word:
Improper confidentiality:Users may tell their relatives and friends the private key/mnemonic words and ask them to help save them, but the funds are stolen by relatives and friends.
Network storage or transfer of private keys/mnemonic words:Although some users know that private keys/mnemonic words should not be told to others, they will save private keys/mnemonic words through WeChat collection, taking photos, screenshots, cloud storage, memos, etc.Once these platform accounts are collected by hackers and successfully compromised, the private key/mnemonic words are easily stolen.
Copy and paste private key/mnemonic words:Many clipboard tools and input methods upload users’ clipboard records to the cloud, exposing private keys/mnemonics to an unsafe environment.Moreover, Trojan software can also steal information from the clipboard when the user copies the private key/mnemonic words. Therefore, it is not recommended that the user copy and paste the private key/mnemonic words. This seemingly unproblematic behavior actually exists very much.Large risk of leakage.
So how to avoid private key/mnemonic word leakage?
First, don’t tell anyone the private key/mnemonic words, including relatives and friends.Secondly, try to choose physical media to save private keys/mnemonic words to avoid hackers from obtaining private keys/mnemonic words through cyber attacks and other means.For example, copy private keys/mnemonic words onto good quality paper (can also be plastic sealed) or use mnemonic words to save.In addition, setting up multiple signatures and storing private keys/mnemonics can also improve the security of private keys/mnemonics.Regarding how to back up private keys/mnemonic words, you can read the “Blockchain Dark Forest Self-Rescue Manual” produced by Slow Mist: https://github.com/slowmist/Blockchain-dark-forest-selfguard-handbook/blob/main/README_CN.md.
Summarize
This issue of the article mainly explains the risks when downloading/purchasing a wallet, how to find the authenticity of the wallet and verify the authenticity of the wallet, as well as the risk of leakage of private keys/mnemonic words.I hope this issue can help you take the first step to enter the dark forest. In the next issue, we will explain the risks when using your wallet, such as being fished, signed, and authorized. Welcome to follow up.(Ps. The brands and pictures mentioned in this article are for the purpose of assisting readers’ understanding only and do not constitute recommendations or guarantees).
