Powered by ApeCoin - Security Awareness Public Good for Web3/NFTs and beyond We provide free classes, security awareness, and track scam/hack trends in Web3.
shop.boringsecurity.com
Joined March 2022
- Tweets3.2K
- Following218
- Followers22.8K
- Likes8.1K
Pinned Tweet
August is here, and so is our new class lineup.
We have several ApeChain partner classes starting with @mutant_cartel on the 11th and 19th, and @archieapes_ on the 25th.
Back by popular demand, we end the month with Sleuthing and DeFi Safety and Security.
P.S. We remain on the lookout for more community partners. Send us a DM or file a Partner Ticket in our Discord.
All classes are free.
Attention BAYC Holders: 413 of you, and roughly ~1000 apes are at risk (10% of the supply) and have approvals open to a Blur contract. With only 2.6% of the collection listed, the majority of these are certainly old approvals.
Once you've revoked your BAYC containing wallet to it, let us know! Oh, and do us a favor and put it in a wallet address you don't use for frequent (or any) transactions!
Other collections have similar ratios, so please don't wait!
Last month, the contracts powering Magic Eden were exploited to the tune of millions of dollars. I was lucky enough to be in a position to rescue a good portion of that, but it highlighted the danger of leaving approvals open as adversaries get access to better and better tools for finding holes in contract logic.
Today, Blur announced that they will be deprecating their frontend.
I've investigated Blur and found no exploits within the current contracts. However, the Blur contracts are upgradable, meaning that they could turn malicious at any time.
They currently have eight figures worth of NFTs approved to them. The safety of those NFTs effectively hinges on the opssec of the Blur team, which appears to be disbanding at this time.
If you have open approvals to Blur, I recommend you remove them immediately. Use revoke.cash or similar to ensure that you are protected in case of a contract exploit or later upgrade.
Don't wait. The time is now.
Since many people have asked, Our custom Ledger stock is not affected.
We have a small supply of custom branded Ledger's that we acquired a few years ago.
Any stock sent to Asia was done with the explicit purpose to give to students without involving any other 3rd parties.
So it would appear that the "authorized reseller" Was bought out in March of this year and forced to sign an NDA that prevented them from telling anybody that they had sold the business.
The NDA expires in 10 days.
It is now more likely that we're not dealing with a malicious employee, but probably a well-funded and relatively sophisticated bad actor, possibly DPRK.
It is also likely that this is not the only third-party reseller that they attempted to buy.
If you purchased a ledger (or other hardware wallet) from ANY reseller and not from Ledger directly, you should carefully and slowly move funds to a new device.
If you do not have a new device, you can start with a 2-of-2 multisig where your ledger is one signer and a hot wallet is another. Use that in the interim until you have another hardware device.
And in the long term, the safest way to store your self-custodied tokens remains a multisig (but not a 2/2, where loss of one key leads to loss of funds). Prefer 2/3 or 3/5.
Sorry we've been quiet a while, but Boring Security is switching gears ⚙️
Don't worry, we will always be that free public good that you know and love, but we're focusing on creating an education platform for the regular user, who is out here in the trenches!
We are revamping the website and breaking our lives classes into short, self-paced modules that learners can utilize at their own pace! Once a particular level is mastered, students will be able to claim the same NFTs on ApeChain that they would have otherwise had to attend our live classes for.
For now, free live classes are suspended, as we redirect our efforts into launching this platform. If your community is interested in a paid class, feel free to reach us in our DMs or in a Discord ticket! Below are some mockups of the re-design (nothing final yet). We'll post more as we progress!
Thanks to Quit for this shout out.
We've currently suspended live classes for the next couple months, but we are still available for paid partner classes, and will have self-paced content coming before the end of the year!
18/ Malevolent parties will continue to attack our space. Education is our best defense. For that I recommend @BoringSecurity and all of its contributors (including myself).
Attackers will continue to get better.
It's important that defense does too.
Boring Security retweeted
Claim site is live. If I was able to save your NFTs, you can now reclaim them. You will have to revoke the PaymentProcessor approval first, if you haven't already.
You may also opt to donate as part of your transaction.
nftsaresafu.xyz/
Boring Security retweeted
At 9AM EST today somebody abused a bug in Payment Processor V2 to steal 10 Meebits, 50 Otherdeeds, 10 WoW, and 235 Desperate Apewives.
It wasn't until over 12 hours later that somebody reported it to me, and upon digging in I realized that a great many NFTs were subject to the same exploit.
I got in touch with the team over at LimitBreak and they quickly paused Payment Processor V3, which was subject to the same exploit. Unfortunately, V2 was not pausable, so the only path towards protecting affected assets was to run a whitehat operation.
Similarly, V3 on ApeChain is temporarily in a state where it cannot be paused, so ApeChain assets approved to V3 needed to be saved as well.
All in all, we rescued 23,155 NFTs worth north of $5.7M USD.
We later discovered that a similar exploit could be used in reverse to steal WETH. 660 WETH was at risk, which we unfortunately were not fast enough to recover. Apologies to those affected.
Shout out to @Boomskite for flagging the initial exploit tx to me, and @coffeedev @0xjustadev and @whiteoakkong for acting quickly and assisting with the recovery.
All NFTs are safely relocated. Soon, owners will be able claim them back after revoking the exploitable approvals.
Addresses to revoke below.
Boring Security retweeted
REVOKE APPROVALS TO THESE ASAP:
Payment Processor V2 on Ethereum: 0x9A1D00bEd7CD04BCDA516d721A596eb22Aac6834
Payment Processor V3 on ApeChain: 0x9a1D00000000fC540e2000560054812452eB5366
use revoke.cash or similar.
Boring Security retweeted
exploit discovered a few hrs ago, Quit is in the pocket rn white hat rescue of affected assets, everything safu, more info soon.
We're hosting our second class with @mutant_cartel.
Join us on August 19th at 8 pm to learn the basics of Web 3 security.
Slots are still open, sign-up in the Discord.
We're two months out of @Giveth's TheDAO round, and we wanted to provide updates on our progress so far
1. Brand New Learning Experience
You've seen our posts. You've seen the hype. Boring Security is headed to the Otherside.
We've listened to past feedback from communities re hosting classes within Discord.
With Otherside, we're providing a neutral online space where we can gather and learn about security. Expect some future classes in the metaverse.
ICYMI, all our alumni can claim the BSec avatar, playable right now.
2. Class Refreshers
We've been updating our classes to provide you all with up-to-date info in the space. Starting this August and beyond, you'll see new material in the classes and quizzes.
3. New Security Content
We've drafted new material for our website and X. These will serve as long-form, more permanent content that people can reference.
We've already made some progress, but still have a long way to go.
Thank you to @thedaofund and @wintermute_t for helping us continue our mission.
Let's welcome the StonkBrokers from @ClutchMarkets as our latest community partner.
We're working together to ensure their community is secured and locked down.
📍Join us on July 27, 8 pm EST with instructors Dreww and KFX.
Thanks to @the_alpha_dgn for setting this up.
Sign-up links are in our Discord (pinned in our bio).
Just spotted our special edition Ledger.
There are still a few of these bad boys available, with a special discount for our Alumni.
Grab it here: boringsecurity.myshopify.com…
It’s official. My first Ape related swag has arrived!All courtesy of @WelcomeApes with their welcome package 🎁
Shoutout @lawofthesaw & @0xdort for putting this initiative together 🦍🦾
If you bought your @BoredApeYC this year, make sure you tap with the WelcomeApes team.
Sadly for me, my wife has instantly claimed the @ApeChainHUB bag 😂 but she did agree to let me borrow it for events 😅
I think the Zachxbt post about hardware wallets is being taken wildly out of context.
Using a jailbroken airgapped smart phone can have its benefits as a daily driver wallet, but the audience in which he said that in probably also wasn’t meant to be picked up by numerous news outlets and consumed by the masses.
Although the discourse caused by this may be valuable, this has opened our eyes to just how many people have sworn off hardware wallets due to missteps with the handling of customer data by wallet providers. Rather unfortunate.
Fundamentally we disagree because we still deal with users day in and day out with compromised seed phrases, and bespoke solutions don’t scale well. Proper Hardware wallets are still the strongest form of self custody that we have today that is accessible and will documented, especially now with clear text initiatives and hardware wallets with large screens.
Your security stack and behaviors aren’t about perfect or “doing what the pros do”, because we’ve dealt with developers and security professionals who have been hacked as well. Often. It should protect yourself from yourself, as well as reducing your overall attack surface.
Also, there is value in subscribing to a shared security model across the space that is proven, accessible, and easy to use. The amount of flexing like “never been hacked, just don’t click weird links dummy” we’ve seen on the timeline as a result of this debacle is maddening, but overall I am eager to see this conversation unfold, because it’s an important one.
We are team hardware wallet. Solidly on the team that “doesn’t want to have to trust a phone manufacturer with a million competing priorities to not accidentally leak my notes app logs in some SIRI AI training data when a rogue model erroneously sweeps a few thousand wallets for some Skynet, type shit.
Just kicking back in the @OthersideMeta after a long day of buidling. Soon. 😉
Check out our July Web3 security class calendar!
We're kicking off the month with a Web3 101 class by @wiimee and @SimonartOnline later today.
Expect a refreshed set of quizzes and insights from our instructors.
P.S. We're on the lookout for communities to partner with for classes. All classes are free; just send us a DM or Discord ticket.
GM. First day of the new month! 🌞
Great to see so many new apes over the past few days.
We invite all new apes to hop in our Discord and avail of our free crypto security education. We're here to ensure you keep those apes secured and locked down.
Our July class calendar will be out in a few days. Join our Discord to sign up for classes (link in our bio).
Are you a BSec Alumni? Then come fly with us in the Otherside!
Our new Avatar is now available for anyone who has claimed ANY Boring Security Badge!
Big shout out to @RidazLp2 and @imjameshall for making it possible. Higher!
