Background
The previous segment of the Web3 Security Guide delved into the dangers associated with wallet downloads or purchases, the significance of verifying official websites, methods to confirm wallet authenticity, and the risks posed by private key or seed phrase exposure. The phrase "Not your keys, not your coins" underscores the critical nature of controlling private keys. However, the possession of private keys or seed phrases does not always ensure asset control, especially in cases of compromise through a malicious multisignature setup.
Drawing insights from MistTrack's stolen funds report, some users encounter situations where their wallets hold funds that are inaccessible for transfer due to malevolent multisignature setups. This guide utilizes the TRON wallet as a case study to elucidate the concept of multisignature phishing, the mechanics of multisignature systems, common tactics employed by hackers, and strategies to safeguard wallets from malevolent multisignature configurations.
The Concept of Multisignature Mechanism
A multisignature (multisig) mechanism is engineered to bolster wallet security by enabling multiple users to collectively regulate and control access to a digital asset wallet. With this structure, even if some managers misplace or disclose their private keys/seed phrases, the assets within the wallet could remain secure.
The TRON multisignature system encompasses three distinct permission levels: Owner, Witness, and Active, each fulfilling specific functions and objectives.
Owner Permissions
- Possess the highest authority level, empowered to execute all contracts and operations.
- Only an owner is capable of altering other permissions, such as adding or removing signers.
- Upon creating a new account, the account automatically receives the owner permission.
Witness Permissions
- Linked mainly with Super Representatives, this permission grants an account participation in the election and voting processes for Super Representatives, along with managing associated operations.
Active Permissions
- Utilized for daily operations like transfers and smart contract executions. The owner can establish and modify these permissions, typically assigning them to accounts requiring specific tasks. Active permissions encompass a spectrum of authorized actions, including TRX transfers and asset staking.
As mentioned earlier, a new account's address inherits owner permissions (the highest level) by default. Subsequently, the owner can shape the account's permission hierarchy by determining which addresses receive permissions, the weight assigned to these permissions, and setting thresholds. The threshold dictates the requisite weight of signatures to execute designated actions. For example, if the threshold is configured to 2 and each of the three authorized addresses holds a weight of 1, approval from at least two signatories is mandatory for the operation to proceed.
Insights into Malicious Multisignature Processes
When a hacker gains access to a user's private key or seed phrase, and the user has not implemented a multisignature mechanism (indicating sole user control of the wallet), the hacker can either grant themselves Owner/Active permissions or transfer the user's Owner/Active permissions to their address. These actions are commonly known as malicious multisignature, which can be broadly classified based on whether the user retains any Owner/Active permissions.
Exploiting the Multisignature Structure
In the depicted scenario, the user's Owner/Active permissions remain intact; however, the hacker adds their address as an authorized Owner/Active party. Consequently, the account is jointly managed by the user and the hacker, with a threshold set at 2. Both the user's and the hacker's addresses carry a weight of 1. Despite the user holding the private key/seed phrase and retaining Owner/Active permissions, asset transfers are impeded. This obstruction arises because any transfer request necessitates approval from both the user and the hacker, as both signatures are essential for operation completion.
While transferring funds from a multisignature wallet mandates multiple signatures, depositing funds into the wallet does not require the same. Failure to conduct regular account permission assessments or absence of recent transactions may obscure changes in the wallet's permissions, leading to extended losses. For wallets with meager assets, hackers might bide their time until the account amasses more assets before executing a comprehensive theft.
Manipulating TRON's Permission Management System
Alternatively, hackers exploit TRON's permission management system by directly transferring the user's Owner/Active permissions to the hacker's address, maintaining a threshold of 1. This maneuver strips the user of their Owner/Active permissions, effectively relinquishing control over the account, including voting rights. Although not technically labeled as malicious multisignature, this occurrence is commonly categorized as such.
In both scenarios, regardless of the user's retention of Owner/Active permissions, actual control over the account is forfeited. With the hacker holding top-tier permissions, they can alter account configurations and execute asset transfers, rendering the legitimate owner powerless in managing their wallet.
Common Malicious Multisignature Attack Techniques
Drawing from insights compiled from MistTrack's stolen funds report, several prevalent causes of malicious multisignature attacks have been identified. Users are advised to exercise caution in the following instances:
-
Downloading Counterfeit Wallets: Users may fall prey to counterfeit wallets by accessing links from deceitful websites distributed through platforms like Telegram, Twitter, or other sources. This can lead to the exposure of private keys or seed phrases, fostering malicious multisignature attacks.
-
Inputting Private Keys on Phishing Sites: Individuals entering their private keys or seed phrases on phishing platforms offering unauthorized services like fuel cards, gift cards, or VPNs could compromise wallet control.
-
Over-the-Counter (OTC) Trading: During OTC transactions, private keys or permissions might be intercepted or acquired by someone else, paving the way for malicious multisignature attacks.
-
Private Key Scams: Scammers may furnish a private key under the pretext of inability to withdraw assets, while offering rewards for purported assistance. Despite the wallet illustrating a fund balance, withdrawal permissions are configured to an alternate address, obstructing any transfers.
-
Phishing Links on TRON: Engagement with phishing links on TRON and signing malicious data can culminate in a malevolent multisignature setup.
Closing Remarks
This guide utilized the TRON wallet as a case study to elucidate the multisignature mechanism, tactics employed by hackers in executing malicious multisignature attacks, and common strategies. The objective is to foster comprehension and bolster defenses against malevolent multisignature attacks. Notably, some users, particularly novices, may inadvertently configure their wallets for multisignature functionality, necessitating multiple signatures for transfers. In such scenarios, users must fulfill multisignature prerequisites or revert to single signature mode by conferring Owner/Active permissions to a singular address.
Recommendations
The SlowMist Security Team advocates for periodic scrutiny of account permissions for irregularities, sourcing wallets exclusively from official channels, refraining from clicking on unfamiliar links, and abstaining from divulging private keys or seed phrases on dubious websites. Enhancing device security can be achieved by integrating antivirus software like Kaspersky or AVG, alongside phishing protection plugins such as Scam Sniffer.
About SlowMist
SlowMist prides itself on being at the forefront of blockchain security, honing expertise in threat intelligence over numerous years. Specializing in providing comprehensive security audits and advanced anti-money laundering tracking, SlowMist serves a diverse clientele. Through the cultivation of a robust threat intelligence network, SlowMist has established itself as a prominent player in the global blockchain security arena. Tailored security solutions, ranging from threat identification to the implementation of robust defense mechanisms, have earned the confidence of numerous renowned projects globally, including entities like Huobi, OKX, Binance, and more.
SlowMist offers an array of services encompassing security audits, threat intelligence, defense deployment, security consulting, and related security services. Additionally, SlowMist provides AML solutions, Vulpush for vulnerability monitoring, SlowMist Hacked for crypto hack archives, FireWall.x for smart contract firewall, Safe Staking, and other SaaS products. Through partnerships with domestic and international firms like Akamai, BitDefender, FireEye, and more, SlowMist delivers comprehensive security solutions tailored to individual project requirements, preempting risks and safeguarding against potential threats.
Website: https://www.slowmist.com/ Twitter: https://twitter.com/SlowMist_Team GitHub: https://github.com/slowmist/
