I’ve long been frustrated with the status quo of the web3 security talent panorama.

Not only has the quality of security work throughout the industry been the furthest from standardized (with many players capitalizing greatly on the lack of ability of the general public to validate the quality of the output), but the talent market for security researchers in the web3 space has also, for a long time, been entirely lopsided. The demand for security work is now orders of magnitude higher than the talent available to complete it.

So many problems, so little time. The standardization issue is one that needs to be solved systemically, but the latter is not.

I co-founded and worked alongside many friends, for the past five years, at an offensive security team on the web3 space. Diligence, incubated at and now an integral part of ConsenSys, has been at the forefront of security services and tooling for the Ethereum ecosystem for a while now.

Even though we’ve always prided ourselves in having the best possible work environment, caring for each other, and continuously improving our processes, the struggle to hire and maintain talent is genuine.

To add to the overall problem, good security/dev tooling suffers from a great monetization issue. It is hard for us and our peers to create financially sustainable products that help developers when, in all fairness, the developer base is still this small.

Successful security tooling is being built as a public good for Ethereans. And, as we all know, the incentives are not yet there to properly create positive feedback loops on public goods.

We need to change this.

Tackling problems all at once

Instead of solving the problems one at a time, I believe we can align incentives properly all at once. In a swift move, we might create a structure that favors both the talent crisis and the public goods funding.

Summing up the topics of interest in our problem space:

• Talent retention.
• Talent enablement.
• Public goods funding.

— Talent retention —

We need to create a dream haven for security researchers.

Somewhere that fosters creativity and rewards people for building the secure substrate of our industry. A place that appropriately recognizes the efforts of the highly talented humans working in web3’s security.

They should be happy, be adequately compensated, and support their colleagues in the type of top-tier work that we’ve all been accustomed to.

Right now, the incentives of private corporations working on security are misaligned without fair value flowing down to the people doing the job.

— Talent enablement —

Security researchers need to be able to work on innovative things.

Structured and permissionless innovation should be the norm. Informed partly by the need to do security reviews and research, people in the security sphere are in a prime position to know what tools are necessary (interactive or not) to secure the entire developer community.

Private security service providers have to very finely balance the time spent between projects extraneous to the core business model and their core activities. But security researchers individually need to have a stake in what is more important for the broader community at any given moment, whether it is to help a specific project or produce a new piece of security software.

This kind of ownership issue has already been solved countless times in the web3 space.

— Public goods funding —

We need better security tooling available to the web3 community.

Good tooling usually comes from broad contribution more than from wide usage. OSS has repeatedly shown that building in public and carefully accepting external contributions creates very robust pieces of software. There is an evident lack of such tools in the web3 security space. The security tooling panorama is fragmented, making it difficult for developers to learn, set up, and use the vast set of tools available with different capabilities.

Not only is the moment of open-sourcing security tooling code a balancing act for a security firm (as there might be some advantageous piece of research that gives some tooling a competitive edge), but the incentives may not be there to even start building it at all.

VC funds have admittedly gotten the incentives right when we talk about innovation in security and developer tooling. Since their business model is tied to the performance of several portfolio companies (which are hopefully a decent enough sample of the broader ecosystem), by enabling these teams to perform better, they will be increasing their gains. This translates into the creation of tools that, by proxy, are good for the ecosystem with positive feedback loops all over.

We should try to mimic the incentives at play in this last example as much as possible.

It’s time we do something. And we will.

The Diligence team will be in Paris next week. 🎉

*audience roars loudly*

Our members will be wandering about in the city of eternal love hacking, talking security and having fun! 💻 ❤️ 🥐 🍷

We will be present at most Ethereum and security-related events of next week. Let me give you a quick break down.

CTF

We have been preparing a great CTF to be held for the duration of EthCC (from the 5th to the 7th) with some of our friends at HellHound, Kleros, Trail of Bits. Ledger has, very kindly, sponsored the challenge with several prizes for the top teams. Also, some very special thanks to @palkeo and our own Nathan Peercy for the huge help setting all of this up!

There will be several EVM challenges involving several flaws in smart contracts, reverse engineering and straight up cryptography ones.

There is a nice storyline too! Come find what @devops199 has been up to since “accidentally killing” Parity’s multisig. 😏

If you want to be there for the opening announcement be in the Paul Painlevé room at 11 AM on the first day (Tuesday, the 5th).

Talks

We are speaking, too! 🗣

More specifically, Niran Babalola, the man behind Panvala, will be talking about incentives for security.

You will be able to see him on the #blockchainhackers meetup at 7PM on Monday, the 4th, speaking about “Panvala: Incentives for Common Security”.

And also at EthCC, on the Jean-Baptiste Say room, at 4PM on the second day of the conference, Wednesday, the 6th, speaking about “Slate Governance for Effective Token Votes”

The Paris Ally Guide

Panvala has launched the Spring edition of the Paris Ally Guide. ETHCC attendees can use the Ally Guide to find businesses around the venue who donate to making Ethereum safer. The more customers the Ally Guide brings to businesses, the more they will donate to be listed. You also earn an ERC721 badge each time you shop at an Ally Guide business, and you can earn tokens for referring your friends.

Office Hours

Last but not the least, I’ll be doing a couple of office hours at both EthCC and ETHParis. 🏢 Ready to talk about anything security-related you can think of, talk Diligence, talk audits, … Anything, really!

I’ll be doing one hour after Niran’s talk right out the Jean-Baptiste Say room (starting at 4:30 PM) and one hour at the ETHParis venue, on the first day, Friday, the 8th, right after the hacking starts at 9PM.

If you are looking for an audit, are a talented hacker or just want to hang with cool people come meet me. 😸

You can also reach out directly to schedule something outside of these times by shooting an email to goncalo.sa@consensys.net!

Excited to see you all there! 😄 👋

ConsenSys Diligence is going to Paris! was originally published in Consensys Diligence on Medium, where people are continuing the conversation by highlighting and responding to this story.

Imagine you could you could easily rent a crazy expensive computer by the CPU cycle to render your next animated motion feature, wouldn’t it be great?

— It sure would, Gonçalo!

Then look no further my friends because the Golem Project is here to do exactly that.

As stated on their webpage:

Golem’s objective is to use (almost) any computing resource to execute tasks that today need to rely on centralized solutions.

Golem Network is going to be a decentralized ecosystem, with combined power of users’ machines and dedicated software delivering all necessary resources to complete any computing task.

What this means is that you’ll be able to connect your computer to Golem’s network and rent out CPU/GPU cycles and RAM you’re not using and get paid for it (whom they call the providers). Or, if you’re in need of some serious computation power, pay to use the network’s huge computing power (whom they call the requestors).

Now, you’re asking yourself:

— But, Gonçalo, will this only work for 3D modeling software?

Of course not, you silly!

This is a distributed computing network much like Folding@Home and similar well-known and acclaimed projects. It gives the possibility to rent computing power, what you do with it is your business (which raises some questions I’ll address below).

There are some major differences between those projects and Golem, though:

• When most of them were made with specific goals in mind (protein folding simulations, for instance), Golem was made to be a general-purpose network
• Most of them were made as non-profit endeavours so the only thing you get in return is moral satisfaction. Golem, on the other hand, pays you for your resources
• Golem uses the Ethereum chain to decentralize payments and relies on no external entity

I find the core concept not only interesting but important for the Ethereum community as a proof-of-concept for larger scale P2P networks that don’t necessarily run on the EVM but implement smart contracts as part of a larger architecture.

I must say I fell in love with the idea and it is the most important use case I see for Ethereum since theDAO. Decentralization fits this project as a glove.

Praises aside, I must say that when I first heard of Golem a few months ago the bad guy in my head burst right out:

Hey, what if I used Golem to crack stolen password hashes?

This is probably what many black hat guys thought the minute they saw this as well. A more general question poses itself:

How is the network going to stop bad bits from being processed?

Guess we’ll have to wait and see!

To finish I must say I just read a really good article on their recently announced crowdsale. An awesome analysis of the project and the team.

If you’re into crypto trading (or only into Golem) you should definitely check it out!

Golem just made me believe a little more in a truly decentralized future. Just made me a little more of a crazy technocrat that dreams of equal power in the hands of everyone!

All hail decentralization! :D

• Present a write-up of said hackathon
• Tell you why I think we won it so you can replicate! :)

1. WRITE-UP

Github Repo: https://github.com/GNSPS/pixelstrike-cisco-hackathon

I think I’ve made all the steps and explanations really clear on the repo’s README and so I’m going to focus more on guiding you through our thought process during the event.

We started out by reviewing all the tools Cisco made available:

• phone (Tropo)
• SMS (Tropo)
• geolocation (Meraki)
• other CMX data (Meraki)
• chat (Spark)

We decided we would do something with its main interactions based on Tropo voice capabilities as that had the biggest wow factor of all the APIs provided.

After thinking what could both be distinct and challenging at the same time we got around to building a geolocation game loosely based on Counter-Strike in which players would either choose to be Terrorists or Cops (Counter-Terrorists) and either plant bombs or defuse them.

Summarizing the game’s nuts & bolts:

• All the players are playing simultaneously in either one of the teams (T/CT).
• All the non-active devices geolocated by Meraki are used to count the victims of each bomb.
• Players are identified by their mac address (Meraki) and can then associate their Caller ID (Tropo) to start playing.
• Terrorists call the assistant to plant bombs at their location (only 2 bombs can be active at any time)
• CTs get the distance to the nearest bomb by repeatedly calling their intel assistant (which queries the PHP backend in real-time to answer).
• Status updates are sent by the assistant to the player through SMS whenever a call is terminated.
• And finally Meraki is constantly polling our server to update the locations of all the devices surrounding it which also triggers bomb explosions (their timeout is 7 mins by default)

Having summarized all the game’s mechanics I must say that for such a short time of development we were really glad with the results. The game was running smoothly with a couple thousand non-active players inside the building plus a dozen active ones.

2. Why we won

And now to what I consider to be the most valuable piece of information in this article: an explanation on why we won the competition (AKA my cheap take on psychology and social engineering)

First of all I must tell you that before we got to Pixels Camp they sent everybody this article (which is awesome, by the way) but I must tell you it is lacking something.

Pedro Queiros starts by telling you to have a great idea and that hard projects are the ones that will get you the gold. But Pedro… That’s where I beg to differ!

It’s not about it being hard, it’s about being different.

I think what Pedro Queiros means by “hard” is more of what I’d call finesse! :D

And I find finesse to be a careful balance of different things:

Wow factor

Make sure you get other people a little sense of wonder when you present them you project for the first time (AKA “magical moment”)

Exquisiteness

Don’t go for the obvious because that’s where you lose your edge. If you’re doing the same thing as 10 other teams and you’re doing it because you know you’ll do it better, please remember: you and them are now all tarred with the same brush!

KISS

I believe the Keep It Simple, Stupid motto works really well here. You should keep things simple and elegant. If you find things simple while developing your users will love it when using it.

Just as a wrap up I want to tell you that I am in no way saying we did it all or even placing ourselves as experts in any area at all (because we’re totally not!) but that we tried all of these techniques and it worked out for us, so maybe it will work out for you, too. :)

Gonçalo Sá on Twitter

Excited to have won the @Cisco hackathon yesterday on @pixelscamp! Thank you so much Austin, Stéve and Rui! You guys rock!

Good luck!

And I’ll tell you why…

I’ve been paying attention to the cryptocurrency markets for the past years. I’ve been studying them and trying to figure out all the inner workings of different altcoins but it wasn’t until Ethereum showed up that I felt the urge to participate.

It was the first currency (if we can even name it that way) that had a radically different value proposition and I as an individual believed in its vision and all the good things it would bring the world through decentralized computation.

So I started my path of investing in cryptocurrencies always keeping my Ether as the piggy bank of all my day trading.

• I built a mining rig and joined the Ethereum network.
• I bought Ether through several exchanges.
• I bought altcoins that aligned with Ethereum’s vision in one way or the other.

And then comes theDAO:

The DAO is a digital decentralized autonomous organization and a form of investor-directed venture capital fund.

The DAO has an objective to provide a new decentralized business model for organizing both commercial and non-profit enterprises. It has been instantiated on the Ethereum blockchain, and has no conventional management structure or board of directors. The code of the DAO is open-source.

It had a crowdfunding phase which turned out to be the biggest crowdfunding to this date amassing a whopping $160 million.

It was decentralization at its best, in service of humanity 2.0

Sadly theDAO’s contract had an exploitable feature and roughly at 4AM UTC today all of its funds started being dumped into a single hacker’s wallet.

It was its end. Before it turned a month old.

I woke up to this catastrophic scenario, losing most of my investment as theDAO dragged Ether’s price through the gutter with its failure.

And although I panicked, as did the whole community, I quickly started seeing it as the social experience it was meant to be. It didn’t work. We were not prepared.

Vitalik Buterin (one of Ethereum’s creators) urged to find a solution as this was the most publicly covered project that Ethereum had to offer until now. It’s first real baby.

So he came up with the idea of a fork to the blockchain.

What this means is that the blockchain would be rolled back to undo these wrongly made transactions and theDAO would be dismantled giving back all lost Ether to those who invested.

Now the community gets divided: those supporting the fork and those opposing it.

More important than which side I am on is the point I’m trying to make writing this.

Those opposing the fork say that it would hurt the supposed immutability of Ethereum’s blockchain and ultimately faith in all cryptocurrencies but this is just not true.

Decentralization is not immutability.

It was the new democracy at its best. It still is. Just needs some tweaking.

And this fork is the same thing. It is not Vitalik trying to control people but guiding them instead. Ultimately people make the choice whether to do it or not. This will be the masses choosing their own faith.

That’s what crypto is and why it is the only possible future.

Today was the blackest friday of all. But decentralization is certainly not broken, it just got a little smarter.

How secure is your home?

Although it doesn’t seem like it, this is a manifesto about IT security.

This is meant for the people building IT products that need fast, agile development and too often disregard security in favor of many other things.

I am an InfoSec aficionado;

Never formally taught on the topic but learning about hacking (whatever the color of the hat) since the age of 6.

The need to publish this piece has been building up for almost 2 years now, and do not get me wrong: I am not trying to teach anything to anyone, I am just expelling my demons.

I will tell you a real story that will, hopefully, make you review your product’s security at least once.

Let us begin.

I’ve always liked lock picking. Probably because it is the physical equivalent of breaching a server or owning a box in the digital world.

Please imagine this imposing, 2-meter tall, steel double door protecting a nuclear bunker that has a single pin tumbler lock.

It is protected against huge impact projectiles or even biochemical weapons… But not against a clip and a Uni Ball pen.

This brings us to a tech retailer store, about three years ago, that, like many other stores, has multiple laptops on display, all turned on with bright screensavers telling you why you should spend all your money on them.

They are all connected to a local WiFi network protected with WEP encryption. This network has several in-store servers connected to it: some hosting intranet webpages for setting up the laptops’ screensaver, others streaming music to the store’s CD trial players, some MySQL databases with info on the CD’s, other servers controlling the TV displays around the store and a myriad of other minor servers with archives and backups.

By now you have probably realized this wireless LAN had all kinds of sensitive information on the store and that you wouldn’t like it breached if the store was yours, right?

This random morning, I’m checking out the new gadgets that had arrived that week and I got myself thinking about how to pick this (metaphorical) lock. So I started trying out one of the “on-display” laptops and just hopped from one to the other until I found one logged in as an admin account. I then went and got the password for the WiFi LAN.

This is the moment you say:

“But you just got lucky right there.”

To which I respond:

You’re right! And you know what? I got lucky on lots of other occasions, too.

And that, my friends, is the problem I’m talking about here.

If you just still ain’t believing me, let me sum up really quickly how this whole thing snowballed:

• I enter the WLAN
• After scanning the network I find several flaws including remote root of a really outdated MySQL server
• From there I upload a PHP shell to a MySQL table and create a file from that same table (weak system configs)
• I run system commands from the PHP shell (weak PHP configs) and own the Windows box
• In that server there were plaintext files containing all the international domain’s admin credentials
• By now I own it all, and I mean it ALL (credit cards’ details, transaction databases, control of the stores’ ticketing system, LCD displays, you name it!)

So once again you’re saying I just got lucky and that I am not some “1337 wiz that wrote his own 0-day” and once again I tell you that those exact thoughts were crossing my mind at the time: how can someone be so careless?

They were obviously too trusting of their store’s LAN and that nobody ill-intentioned would ever access it, let alone mess with their outdated, unsecure code and software.

The world of black hat hacking is not pretty and filled only with people that write their own 0-day exploits. It is instead filled with everyone from script-kiddies to social engineers with a single drive: money.

I’ll rewind.

How secure is your home?

Do you leave your jewelry just hanging in your living room walls, waiting for the first burglar to easily scoop them up?

Or do you instead buy a safe to hide behind a painting in your corridor if you’ve got some valuable asset that justifies it?

You’ve got the point right?

Summing it all up:

• Update your software
• Don’t just leave credentials lying around in plaintext
• Don’t think that no one will ever reach your safe haven
• Always lock the doors behind you, even if it is the living room door and not the big entrance door
• Don’t overlook security in your products

I will soon publish part two with another true story and some other perils of disregarding security when thinking about UX.

Hope you enjoyed your time reading this. Stay tuned! ;)

Should we fear hackers? Intention is at the heart of this discussion. — Kevin Mitnick

DISCLAIMER: All the involved were immediately warned about the breaches and readily patched up the whole system.