# From Web2 Security With Love by Joe Dobson | Devcon SEA

- Channel: [Devcon](https://streameth.org/devcon)
- Date: 2025-10-09
- Duration: 24:45
- Topics: Science & Technology
- Watch: https://streameth.org/watch/yt-s-8nDKk_kkM
- YouTube: https://www.youtube.com/watch?v=s-8nDKk_kkM

## Description

Web3 organizations often rely on Web2 for infrastructure, communications, and development, yet their Web2 security posture is often neglected. This leaves them vulnerable to a wide range of adversaries, from well-funded sophisticated attackers to opportunistic script kiddies. In this talk,Joe Dobson will share hard-earned lessons from the Web2 trenches that can help secure Web3.Don’t make it easy for the adversary. Learn from the past: strengthen your Web2 security to safeguard your Web3 future.

Speaker(s): Joe Dobson
Skill level: Beginner
Track: Security
Keywords: Security, Hacks, intelligence

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum, https://warpcast.com/devcon
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/ 

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers. 
Devcon SEA was held in Bangkok, Thailand on Nov 12 - Nov 15, 2024.
Devcon is organized and presented by the Ethereum Foundation. To find out more, please visit https://ethereum.foundation/

## Transcript

[Music] thanks folks and you know it's it's better that you have someone that infiltrated North Korea's uh IT workers rather than having them infiltrate your company so I'm I'm Joe Dobson and first I want to thank Andrew if you saw the the funny speaking guy with the uh the Mohawk in the last talk he mentioned that he doesn't want web three to repeat the mistakes of web 2 he doesn't we shouldn't have to speedrun through web uh two's mistakes and he he's spot on and I actually want to build on that and so let's let's kick it off uh by the way the views and opinions they're mine love them or hate them they're all mine so who am I I am Joe Dobson you can call me dobs and I've got over 15 years of experience in cyber security which is kind of crazy I didn't have any gray in my beard when I started in this industry but I'm pretty sure if you just do it for a year you'll still have gray and my job is threat intelligence I track bad guys and that means the infrastructure the malware what they're doing dayto day that is my goal that's that's my role and previously I did digital forensics focused on uh extracting data from hard drives thumb drives I did instant response I've worked for a couple startups I actually worked for mandiant twice now I'm at Google because Google acquired mandant now in traditional cyber security there's a terrible thing called fud fear uncertainty and doubt right everyone is trying to sell you something and they're doing it by saying oh the sky is falling if you have to run out you have to buy something right now to solve all the problems and that's not what I'm here to do is to spread fud because the security situation you heard Andrew talk you're going to hear more folks talk this afternoon the security situation is not as good as it should be and the solution isn't to run out and buy things the solution is to innovate we need to innovate our way through the problems that we have in web 3 and part of that is understanding where we are in web 3 there is no web 3 without Web Two in 2024 that's just how it is and you know what does that mean well think about your web two exposure your website has DNS that's going to be web too your social media right if you're interacting with your users on Twitter on telegram that's going to be web too think about your development pipeline right how are you code your cicd if you're using AI models to enrich the code that you're writing probably doing it all through web too and that all has an impact because that's an attack surface is what it is and thread actors are looking for ways to infiltrate and attack that surface this also means that web 3 security is about a lot more than just smart contracts that's not to say that smart contract security isn't important I think the community has done a fantastic job of focusing on that and and and you know refining that but web 2 has made a lot of mistakes and we we need to learn from them and so what I'm going to do is I'm going to walk through a few hard truths we're going to do three hard truths about the what's going on in web 3 and then we're going to talk about principles from web 2 that can be applied to web 3 and make it a better safer ecosystem so first hard truth is everyone is a Target in crypto it doesn't matter if if you're a user if you're a developer if you're someone that's going on to pump fun you're making a bunch of trash coins and you're trying to make it rich you're all Targets every single one of you and that also means that you're the front line of defense and we're going to talk about that a little bit more later but you have to first understand that you are a Target the second hard truth is that you're outgunned um cyber conflict is asymmetric you have nation states with what seems like endless amounts of resources and they've targeted individuals how do you defend against that how do you expect a user to defend against that uh it takes about 35 seconds from the time that a a wallet gets its first deposit 35 seconds until it gets aird dropped a malicious token that means Crypton nobs are getting airdrop tokens before they know what a token is is it fair to expect those same noobs not to fall for the fish that is a problem that we have in web 3 and it's pretty bad um attackers they're they're clever they're well resourced you know there's a reason why the term advanced persistent threat AP was coined and that's because they they're going to keep coming it's they are required to it's their job and the third hard truth is that if you don't act you're going to get wrecked and it's sad but it's the truth crypto is under attack billions of dollars have been siphoned out of the ecosystem every time there's an attack against you know anyone and they lose funds that hurts everyone that hurts the entire ecosystem social media accounts are getting hijacked Dows have been hacked right front ends get hacked and you know bugs and vulnerabilities they're going to be found the the trick is you need to find and address them before the motivated attackers do not to mention attackers they have the element of surprise so the other day uh Hudson Jameson was giving a talk at the defi security Summit about the 2016 Shanghai attacks and one thing I thought was interesting about that is when the attacks happened it was at like 4:00 in the morning Shanghai time so you have a crew that is jet lagged they're tired it's the middle of the night and that's when the attack happens it's you have to be prepared because it's it's like a car accident right if you say oh I'm not going to wear a seat belt I'm going to put the seat belt on right before the accident happens that's that's ridiculous and so it's the same thing in security you have to be intentional about security and to be intentional about security there's a few key principles that I think are really important one of those is and this comes from web 2 web 2 security has been here before it's assume compromise you have to expect that you're going to get compromised you're going to get hacked think about what that means for your key management if you assume bad guys are going to get a hold of your keys how does that change how you're managing your keys what what they can do right how those systems are protected and you need to Tool your system so that you can be prepared so that when you are compromised you can actually do something about it and you can have a bulletproof smart contract but is your DNS bulletproof is your code supply chain Bulletproof the SIM card in your phone but you know you don't want to get SIM swapped all these things you cannot expect not to get hacked right a zero hack policy I'm sorry it's just it's not realistic right you zero days happen bad guys at some point they're likely to get in and at this point you might be asking well if I'm just going to get wrecked anyway then what's what's the point right why bother well that's because it isn't just about stopping hacks it's also about minimizing the severity and the impact of those hacks one way to do that through defense and depth defense and depth was first deployed or applied to information security by the the NSA in America and what it does means layered defenses and layered defenses can be applied to ethereum especially but it can be applied to uh to cryptocurrency so here's some very simple examples of Defense in depth and practice and and really what it comes down to is just having a well-planned defensive posture right so let's say you you work for a centralized crypto exchange well you're customer customer support they should be on a separate Network segment than your you know your actual operations folks uh maybe you set up a trigger so that if uh X percentage of the funds are moved out at once then it it enacts a cooldown period and these are simple things but if if more dexes and centralized exchanges and bridges did these kinds of things then we wouldn't see as much theft as we do but you have to assume that there's going to be a compromise so you have to expect at some point someone is going to get access to those keys or they're going to be able to sign the transactions if you're a freelancer developer right isolate your social media access put it in a VM make it a separate device something throw a wallet on there that's got a few bucks in it so if an unsophisticated ATT attacker if they get in there then they're not going to you know you'll know it right because you'll see the funds move but they're not going to get access to anything more than your social media another thing is to have an instant response plan right don't make it easy on the attackers and that's what so many organizations do I can't tell you how many compromises we've seen from web 3 organizations and they they don't have logs their logs don't exist right they people in web 3 hate EDR in point uh detection and response tools and so there there's no centralized logging on the devices they'll have something in their AWS instance or gcp in the cloud somewhere they'll have some logging there but a lot of the compromises don't come from the cloud they come from attackers getting access to the devices of the developers the the people working on the project you want to have a plan that helps offenders and costs attackers with proper tooling you get earlier detection earlier detection means you can actually get the word out about the attack you can share that information to the rest of the community again it comes down to how how do you make the ecosystem better and early identification of the attacks how those attacks are happening that that would help significant significantly you know unlocked homes are easier to Rob so lock your door that said I want to talk a little bit about something called attribution right I know what you're thinking all right but dos I I need to stop every attack it doesn't matter who's attacking me because I have to stop them all and you know that that's the mindset but really attribution matters and when I say attribution it's understanding who is attacking you a deep dive in attribution is for some future talk at some point but protecting users and organizations means we need to understand who's attacking us script kitties cyber criminals nation states who is it what kind of resources do they have and fin Financial theft that is just one motivation that we've seen when it comes to compromises in web 3 uh there's a whole slew more excuse me for example malware delivery uh there is a thing called either hiding either hiding is where portions of malicious JavaScript will actually be stored on chain that's using web 3 that impacts everyone uh Commander control there's been a drainers like Angel drainer that will actually use uh C2 they'll do smart contracts as part of their C2 there's going to be a talk later today that mentions drainers misinformation so there's blockchains where you know that are focused on blog posts and storing information like that that can't be taken down so that's you know and there's nation states out there that are posting misinformation it's being hosted on chain it can never be taken down again that involves web 3 activism you get activists that may or may not be sponsored by nation states that are posting information storing it somewhere like ipfs these are different ways that web 3 Technologies are being being abused and understanding how that's happening can help us understand what we can do to mitigate attacks to uh to identify and track the bad guys so that we can protect the users and protect the ecosystem so on this slide I have a mapping here of malware relationships this is for a group called ap45 also known as enderal andariel is a North Korean threat group this image comes from a a mandant Blog and the reason why I have this here is so that you can see that that's one threat group using all all those different families of malware it's important to understand attribution because then we can identify who's using the malware how are they using the malware when did they develop it do you have subgroups that are using separate versions of the malware how many people do they have on their teams that are doing this type of activity how sophisticated are they with their malware what where does it Beacon to what's the infrastructure look like can you identify it offchain or onchain and these questions also apply to Smart contracts and onchain activity when you're looking at malicious smart contracts who wrote them when where were they first published were they on a test net first or were they on you know published in the main net does it have code segment or portions of the code that were used in other malicious attacks before all these different things can feed into attribution and help you understand who is the attacker how did they get here and what are they doing comes down to the who what when where why and how and then there's dwell time right dwell time is the time between compromise and detection so if a bad guy gets into a network and they're there for a week two weeks then the the uh the victim may not know it and this comes down to detection the earlier that they're detected the less dwell time that they have the less time they have to to actually deploy their attacks um and ask yourself how can the ecosystem prevent attacks uh this is also a quote from uh mandant mtr's report and it mentions that in 2023 the dwell time was down to 10 days in 2022 16 days now that's not just for web 3 right that's across all Industries but that that's a pretty darn interesting statistic if you ask me but all that being said there there's hope right again this is not Doom and Gloom I'm not here to tell you the sky is falling you need to to to to ditch web 3 it's not the case you don't have to go It Alone the industry is decentralized and so is crypto security right you all are the front line of defense remember it's because everyone is a target that also means that everyone is getting access to the information of attacks share it out let folks know there you can do it through something like an ISAC there's the seal ISAC there's crypto ISAC you can also you know there's tons of posts on Twitter telegram areas where people can go out and they can share the details of what they're experiencing and what they're seeing because trusted sharing that is critical to the health of the ecosystem and think about the future right the people in this room you're building world changing technology all right you don't have to accept security way that it's always been think about how you want to change it what should it look like what responsibilities should or shouldn't fall to the users what what information should or shouldn't be out there and you know you don't have to repeat the the mistakes of web two security web 3 is Young it's Innovative that's the thing that has astonished me going to Devcon at other conferences is just how much Innovation there is in the space and how unique that is when compared to other Industries but you have to be intentional about security you have to think about it you have to actually account for it from the get-go and web 3 security can also look a lot different than web 2 security think about dows dows they they should be investing in security when it comes to developers they should consider what are the the the different security practices that developers should have but I really encourage you to be Innovative consider building something to support or enhance security think about what it should look like and that is it for me if we've got any questions thank you thank you thank you very much let's give him a warm Round of Applause very very inspiring as well um I think a wonderful followup as well from our previous session to this session they compliment each other perfectly and I appreciate all the questions that are coming in if I could get you to upvote your favorite questions and if you want to add in some questions please go ahead and scan the QR code remember as well that if you want to collect your card you have to scan this code you can't collect it from the app itself you must scan the code because there's a secret embedded in the code yeah very secure H all right so let's address our first question right at the top we've got two votes right up there um okay what is the biggest Web Two Gap you see in terms of security amongst web three products great question uh I would say it's lack of preparation that's that's the biggest Gap lack of preparation lack of preparation preparation they expect to never get compromised and so they don't set up logging they they don't have an instant response plan so when something bad does happen they may not have a way to contact their other developers it may be that they only talk to their developers over telegram or signal and then that get gets compromised and guess what you you don't have a back Channel exactly I think it's surprising when you said that teams don't have logs that seems unbelievable to me how can you not log things these days it's awful awful and and when I say logs I I also mean logs on endpoint devices right so what machine is a developer using to write their code cuz so many projects they'll they'll Outsource they'll hire someone to do code development right and then that person is just shipping out the code they get compromised there's no logs from that developers box exactly I think a great tip I believe all the developers here have logs right okay silence means they don't have logs and they're going to have it now so tonight let's go to the next question we got four votes up there flip the question a little bit what can web to security learn from web 3 that's interesting that's a that's a good question it's a it's a tough one too because I'd say that web 3 security is still sorry Jo could you hold the mic close yeah that's fine thank you I think web 3 security is still pretty young and figuring out what it wants to look like but I would say the collaboration is perhaps the best part in web 3 if one team gets hacked that impacts other teams as well in web 2 if someone gets hacked well they may not want to share that information because it'll help their competitor right and so there's a lot more rivalry I think in web 2 than there is in web 3 and I think the collab of spirit is something that web 2 could learn a lot about that's a good point whenever things happen you see it spread out across Twitter everybody knows immediately when there's a vulnerability I think that's a wonderful learning point as well let's look at the next question what do you think about banning note JS front end for web 3 DMS I'm not I'm I'm not touching that question okay spicy question I'll just mark it as answered um but I'm sure if you again if there are questions that you want to ask for a more personal opinion I'm sure you can check with him later once he's finished right okay but for the stage let's go up again uh DIY Services Consultants how much of security should I do myself versus Outsource I love this question this is great I I think that's really up to the team but I I'll say this much y if you're Outsourcing anything I encourage you to do some research on North Korean IT workers because North Korean IT workers they are a Scourge a Scourge and it is awful how successful they have been at infiltrating companies because they're they're going out there and they're freelance jobs they'll go out there they get the job they'll do a little bit of work but they can also put in back doors they can enable uh attacks right and North Korea is a sanctioned country and it impacts again it impacts everyone when they come in and they're able to steal funds and turn around and use that for their nuclear program through something like uh it work that is scary so Outsourcing can be useful but you got to do your due diligence on who you Outsource to again let's go up to the top we got we got still got time for some questions let's do it uh how many attacks have youve traced that was state funded spicy question Joe you you got the spicy question today yeah nation states are they're in crypto they're in crypto they're doing attacks right and and it more than you would expect really yeah oh more than you would expect more than you would expect crazy crazy it is a crazy time to be alive all right how to do asset inventory of web three assets I don't have a good answer for that one okay no worries not not my area I'm sorry not your area that's fine what do you think is one thing teams can do that would make a big difference in their security posture that isn't EDR EDR EDR that's the solution I I I understand the question right if if because a lot of folks you know if if you're not familiar with EDR imagine like a um kind of a big brother antivirus that's on your device that's monitoring what you're doing that is looking you know it's looking at files it's looking at the content of your devices it's trying to find something malicious and a lot of folks don't like that idea because they've got keys on their devices they've got crypto the their their device might be dual use so they're using it for you know work and they're using it for uh for the personal and that is risky right exactly um so I understand that but what's something else that they could do Hardware wallets Hardware wallets yeah yeah I mean it's it's an old answer but it y tried and true no I I've sat next to a friend of mine and his hot wallet just got drained right next to me and he's asking me for help cuz I I come from a security background and I what can I do it's not a hardware wallet I can't do anything there's no backies in crypto exactly right so that is definitely some things to take note of um let's see um what's the security 101 to be followed by small teams so I'm sure many of the developers here the projects here they're really small they don't have the money they don't have the resources to do Audits and stuff like that what what would would you advise them to do sorry your microphone just a little bit perfect thank you with small teams often times they don't even have a full-time it person let alone having a full-time security person so I would encourage you talk to the folks like seal right um ma is going to be up here talking here shortly about seal security framework go through that look at that that will give you a lot when it comes to security posture but just being aware communicate get on Twitter and it amazes me that it's 2024 we're still talking about how Twitter plays such a incredible role in security but it does and having that collaboration and communication I would say is the answer yeah we got time for maybe one or two more uh what keeps you a personal question what keeps you up at night regarding the state of web three web through security security web 3 security is adapting but I'm not sure it's adapting fast enough and there's too many good people that are losing their money you know you're people that are losing their retirement funds they're they're lo you know college kids that have invested all their Savings in crypto and then it gets wiped out because they don't know any better and so it really comes back to should the burden be on the user or should the burden be on the um the organizations the Dows and wallets it's tough question yeah uh big fan of web 3 is doing great I'm not familiar with this particular handle no spicy question I I think I think I know what that is all right I I love things like uh like wck news but I wish wck news didn't have to exist right right right of course yeah um let's do a few more we got 30 seconds on the clock what's the highest impact thing a user can do to improve their personal security great question I I think it comes back to awareness and Hardware wallets okay yeah uh the next question is pretty cool too um where can I learn more about dprk I believe that's North Korea and ttps ttps I'm not so familiar yep dprk is uh that's North Korea ttps that's t uh tactics techniques and procedures y uh I would say go check out there's some awesome blogs out there um look at uh some social media there's a lot of great folks like teay out there talking a lot about them and and isacs yes like seal ISAC ladies and gentlemen that comes to the end of our Q&A for security let's give Joe a big big round of applause thank you Joe all right