Blockchain technology has recently gained attention, but the increase in popularity has also lead to an increase in various cybercrimes. A common example often reported, an unfortunately claiming many victims is known as a phishing attack.
They have been found to make a sizable sum of money, posing a severe threat to the security of the blockchain ecosystem. For example, in the first half of 2017, Chainalysis reported that phishing attacks cost 30,287 victims $225 million. Chainalysis is a provider of investigation and risk management tools for virtual currencies, showing that financial security has become a crucial concern in the blockchain ecosystem.
This article aims to create awareness about crypto phishing attacks and how to detect and prevent them.
What is a phishing attack in crypto?
Phishing can be seen as the union of technology and social engineering. A phisher often seeks out information that will enable him to gain access to his victims' resources.
Furthermore, phishing is a type of online cyber threat defined as the practice of pretending to be a legitimate company's link/website to get sensitive data from users, such as passwords, usernames, and 3-4 digit CVV numbers.
But how do phishing scams work? Typically, a common phishing attack is an email purporting to be bank or corporation, telling the user their account has been locked and that they need you to login or provide your personal information to regain access to your account. Attacks by phishers go through multiple stages, as explained below:
- The attacker acquires the email addresses of the targets. These might be conjectured or discovered from a number of sources, including public databases.
- The attacker creates an email with a convincing professional appearance that asks the recipient to take a specific action.
- The attacker disguises the true source of the email and distributes it to the targeted recipients in a way that makes it appear authentic.
- Depending on the email's content, the recipient might click a link, fill out a form, or go to a website.
- The attacker gathers the victim's private information with the potential to use it later.
When Bee Token, a blockchain-based home-sharing service, prepared to start its initial coin offering (ICO) on January 31, 2018, a conventional phishing fraud on the Ethereum blockchain occurred. Before the ICO's formal launch, phishers sent phony emails to prospective investors, promising them a bonus for all contributions made within the next six hours and a token's worth to double within the following two months.
In the end, this phishing fraud stole about $1 million in just 25 hours. This highlights how important it is for each individual to exercise caution and due diligence until more robust scam detection and prevention measures are in place.
Common crypto phishing attacks: How to detect and prevent crypto phishing attacks?
Being familiar with a scam can enable you to recognize when you are the victim of one. Here are some common cryptocurrency phishing scams to watch out for.
Fake Browser Extensions
Browser extensions for wallets like MetaMask and others are the target of cybercriminals. The bogus browser extensions can aid in the theft of user wallet log-in information. More than 120 downloads of one example of such an attack from the Chrome Web Store made the news last year. For example, Ledger Live, a malicious Chrome plugin, was advertised with a sense of respectability through Google Ads.
Due diligence is all you need to protect yourself from such fake browser extensions. That said, invest some time in reading about a particular browser extension provider and never trust web stores without a proper audit. Understand the team and project, and read the reviews before using any browser extensions. In addition, always download browser extensions from the developer's official website and avoid giving any unusual permissions for using the service.
Phishing bots
Bots, short for robots, are automated computer programs replicating human action or acting as agents for users or other programs. The most popular bots on the Internet are lawful programs called spiders or web crawlers that browse websites and gather content for search engine databases. Additionally, bots have been developed to check stock quotes or compare prices on online stores.
IRC (Internet Relay Chat) bots are utilized more frequently for nefarious intent. For example, the installation of a backdoor program, such as a Trojan horse (a malicious program that disguises itself within legitimate software) or a computer virus or worm, results in the creation of this type of bot. In the crypto world, bots are used to drain funds from users' accounts.
It can be challenging to identify the sophistication of the fraud when phishing bots are used. However, users should check the message's sources to ensure it came from an official account. One can put effort into determining whether a communication originates from a trustworthy source by auditing the website and social media handles of the sender.
Spear Phishing
Spear-phishing attacks are much more targeted than mass-mail phishing campaigns, which were initially spammed out to thousands of users in the hopes that some would fall for the trap. Spear-phishing attacks involve tricking people within a particular organization into unknowingly downloading malware onto their computers. Because they send customized, convincing emails that seem to be from a reliable source, these attacks are successful.
In the crypto world, spear-phishing emails have become more convincing, typically containing a link to a bogus website or renowned crypto wallets urging the recipient to open an attachment that contains malware or update their recovery phrase. They are made extremely personalized, improving their legitimacy and authenticity and raising the likelihood that the person would agree with their request. For example, suppose the user is duped into downloading malware. In that case, the hacker will likely obtain remote access to their computer, record their wallet keys, and, more dangerously, access the network to which it is connected.
To safeguard themselves from crypto spear phishing scams, enterprises can use machine learning and artificial intelligence techniques and spread awareness among employees via training. Similarly, individuals should avoid unprotected WiFi networks, implement two-factor authentication, carefully verify the sender's email address, and avoid sharing log-in credentials with suspicious senders.
That is not to suggest that firewalls and anti-virus programs have no place in security; they are still reasonable foundational measures. They do have restrictions, though. While they are valuable tools against well-known dangers like viruses, worms, and trojans, organizations and individuals must take action to strengthen their layers of defense as complex threats like spear-phishing attacks become more common.
DNS Hijacking
After hijacking authentic websites, DNS hijacking or spoofing attackers replace it with a fake interface. Users' crypto assets may be compromised if they utilize their private keys and log-in information on a fraudulent website that looks otherwise legitimate. Cream Finance and PancakeSwap defi protocols suffered a DNS spoofing attack. However, the details of the loss aren't precise.
Although not all attacks lead to loss, crypto users must be aware of the protection measures in any case. For instance, using a virtual private network (VPN) that bypasses the router's configurations can ensure that data is transferred through an encrypted channel.
Due diligence (of the website) is another way of authenticating the website, including verifying the URL and checking trusted certifications. Moreover, using offline hardware wallets will protect you against online cyber threats.
Final thoughts
A crypto phishing attack is a type of data theft that uses sophisticated attack vectors and social engineering techniques to collect financial information from unwary customers. A phisher frequently tries to trick her victim into clicking a URL leading to a malicious source. However, awareness and knowledge of the countermeasures could help users in the digital world protect themselves from cyber criminals and hackers in the cryptocurrency world.