As the world is digitally transforming at a rapid pace, attackers are evolving too. With better connectivity, comes an increased threat of cyberattacks. Blockchain technologies have revolutionized and there are new threats against them on a regular basis. Microsoft recently warned about a new class of threats, named ice phishing, affecting Web3 and blockchains.
Diving into details
- Ice phishing involves luring a user into signing an agreement that assigns the user’s tokens to the bad actor. It completely ignores private keys.
- The transaction requires interaction with DeFi smart contracts for a token swap to occur.
- The attacker can gather approvals for transactions over a period of time and quickly drain the victim’s wallets.
- In ice phishing, the threat actor only needs to alter the spender’s address to their address. This is an effective method as the UI doesn’t display all relevant information regarding the tampering of the transaction.
Instance
- The attack on the Badger DeFi platform last year is the most high-profile instance of an ice phishing attack.
- Threat actors compromised the front-end of the platform to gain access to a Cloudflare API key to inject malicious scripts.
- The script blocked Web3 transactions and urged customers with high balances to approve a foreign address to operate on ERC-20 tokens in their wallets.
- The attackers stole approximately $121 million.
The bottom line
The attack against BadgerDAO emphasizes the need for integrating security into Web3 during its early adoption and development stages. Microsoft recommends software developers focus on the security and usability of Web3. in addition to that, end users are advised to verify information via extra resources, including project documentation and external reputation websites.
Publisher
/https://cyware-ent.s3.amazonaws.com/image_bank/eb3e_shutterstock_547561240.jpg)
/https://cyware-ent.s3.amazonaws.com/image_bank/babc_shutterstock_686172.jpg)
