WEBVTT - Hacking Crypto Through Social Media 0:00:02.400 --> 0:00:05.760 I'm Stacy Marie Ishmael, Managing editor of Crypto for Bloomberg News, 0:00:06.040 --> 0:00:09.240 and this is Bloomberg Crypto at Daily Bloomberg. I heart podcast. 0:00:09.760 --> 0:00:18.880 It's Monday June. Have you heard the one about the 0:00:18.920 --> 0:00:21.600 crypto investor who got hacked and lost all their bitcoin? 0:00:22.120 --> 0:00:26.040 It's true. Cryptocurrency spam, hacks, and fraud are all on 0:00:26.079 --> 0:00:29.120 the rise. That means there's an urgent need to think 0:00:29.120 --> 0:00:32.920 about the security risks to these often valuable digital investments. 0:00:33.560 --> 0:00:36.560 Today I speak with Bloomberg reportsa Hannah Miller about the 0:00:36.640 --> 0:00:39.640 nature and scope of these hacks, and I talked to 0:00:39.640 --> 0:00:42.760 a Wrong Way Google, a professor, and a CEO of 0:00:42.800 --> 0:00:49.839 a security firm about how to avoid them. Hannah, Hi, 0:00:49.960 --> 0:00:51.920 thank you so much for joining us today. Thank you. 0:00:52.320 --> 0:00:55.320 I am really really glad you're able to come on 0:00:55.320 --> 0:00:58.520 the show because you have been covering well. In addition 0:00:58.560 --> 0:01:00.800 to covering everything that you're covering, one of your recent 0:01:00.840 --> 0:01:06.000 stories was all about how social media hacks are particularly 0:01:06.000 --> 0:01:09.440 affecting people who have invested in crypto or who are 0:01:09.920 --> 0:01:13.319 thinking about investing in crypto. People may have heard about 0:01:13.360 --> 0:01:15.560 folks losing their board apes because they clicked on a 0:01:15.560 --> 0:01:18.280 SPAMMI link on Instagram. Can you just talk a little 0:01:18.319 --> 0:01:20.280 bit about what it is going on out in this 0:01:20.360 --> 0:01:23.560 wild West world? Yeah, I know, there's obviously a lot 0:01:23.640 --> 0:01:27.959 going on. I think crypto has really been entangled with 0:01:28.000 --> 0:01:32.160 scams for a very long time, and we've really seen 0:01:32.160 --> 0:01:36.720 an upswing recently in people using social media as a 0:01:36.720 --> 0:01:40.920 tool to rip off crypto investors. And a lot of 0:01:40.920 --> 0:01:45.800 that comes down to, you know, people posting malicious links 0:01:46.280 --> 0:01:49.800 click here and all your wildest dreams will come true, 0:01:50.200 --> 0:01:55.320 spam bots spreading those links, and you know, people really 0:01:55.360 --> 0:02:00.000 not being aware of the risks that they're taking when 0:02:00.040 --> 0:02:03.720 and you know they're on social media looking at crypto projects, 0:02:03.760 --> 0:02:07.520 you know, interacting with different accounts. So it's a it's 0:02:07.560 --> 0:02:11.320 a pretty interesting phenomenon and something that the industry really 0:02:11.320 --> 0:02:16.720 has has been grappling with. What does that experience look like? I, um, 0:02:16.760 --> 0:02:19.079 you know a person on Twitter, on on Instagram, on Facebook, 0:02:19.120 --> 0:02:22.200 I see somebody being like, hey, click here to get 0:02:22.200 --> 0:02:26.240 a free board ape. I think that sounds amazing given 0:02:26.280 --> 0:02:28.919 them board apes are selling for hundreds of thousands of dollars. 0:02:29.320 --> 0:02:32.760 What are the mechanics of how these scams work? Yeah, 0:02:32.760 --> 0:02:35.680 a lot of it comes down to mimicry. So you 0:02:35.760 --> 0:02:38.560 might be interacting with an account that looks like it 0:02:38.639 --> 0:02:41.960 comes from an official source. You know, maybe they have 0:02:42.080 --> 0:02:45.400 a handle that's really similar to you know, the name 0:02:45.440 --> 0:02:50.240 of an actual company, or they seem to have, you know, 0:02:50.320 --> 0:02:55.440 tweets that show legitimate activity in the space, and clicking 0:02:55.480 --> 0:02:58.080 on that link might lead you to a website that 0:02:58.120 --> 0:03:00.600 even looks like the official website for an n f 0:03:00.639 --> 0:03:04.120 T collection or startup, and you know, you're asked to 0:03:04.200 --> 0:03:06.840 link your wallet, and that just opens you up to 0:03:07.280 --> 0:03:09.480 you know, having n f T stolen from you, which 0:03:09.560 --> 0:03:12.160 was the case with the you know, board eight pack 0:03:12.320 --> 0:03:15.760 that we saw recently. So I'm a person who you know, 0:03:15.919 --> 0:03:18.200 I click on this link, I don't realize that it's 0:03:18.280 --> 0:03:21.680 it's not official. I hand over my credentials, and then 0:03:21.760 --> 0:03:24.160 some nefarious person on the other end it's like, great, 0:03:24.320 --> 0:03:27.160 we now own all of your stuff. Yeah, pretty much. 0:03:27.200 --> 0:03:30.280 I mean you it can happen very quickly. And again, 0:03:30.480 --> 0:03:34.040 you know, people think that they're going into something that's legitimate. 0:03:34.040 --> 0:03:35.760 They think that they're you know, maybe gonna be a 0:03:35.760 --> 0:03:38.520 part of an n f T drop or crypto giveaway, 0:03:38.840 --> 0:03:41.320 and they're excited and they might not pay attention to 0:03:41.440 --> 0:03:45.960 signs that this isn't a legitimate operation. I'm so glad 0:03:46.000 --> 0:03:47.960 that you said. There's two things in there that are 0:03:48.000 --> 0:03:50.360 so important, right then, not paying attention and the being 0:03:50.400 --> 0:03:53.760 excited pot Because you know, when I've when I've studied 0:03:53.800 --> 0:03:57.240 and reported on misinformation and disinformation and why people fall 0:03:57.320 --> 0:04:00.000 for things online, it's often because you're in an emotion 0:04:00.040 --> 0:04:04.320 chanel state that makes you particularly susceptible to making a 0:04:04.320 --> 0:04:06.920 bad decision. And in this case, it sounds like you know, 0:04:06.960 --> 0:04:10.240 these these these scammers, these hackers, they're preying on that 0:04:10.640 --> 0:04:12.760 not wanting to miss out on a deal instinct, or 0:04:12.800 --> 0:04:15.480 just the thrill of being invited to participate to something 0:04:17.040 --> 0:04:21.920 up your life that are insane. Yeah, that's exactly what's 0:04:21.920 --> 0:04:25.320 happening here. Um. People get excited, they you know, jump 0:04:25.400 --> 0:04:28.760 on board. And in some cases too, it's the actual 0:04:28.880 --> 0:04:32.520 account belonging to the startup or the n f T 0:04:32.680 --> 0:04:44.359 collection um, which adds another layer of deception. WHOA, Okay, 0:04:44.720 --> 0:04:48.080 so I might actually be looking at a legitimate Twitter 0:04:48.120 --> 0:04:51.479 accounts or Instagram, but they have been hacked. And then 0:04:51.640 --> 0:04:53.240 so when I click on those links, even though I 0:04:53.240 --> 0:04:54.800 think I'm doing the right thing because I check to 0:04:54.839 --> 0:04:56.719 see that Hell, okay, this is the verified account. This 0:04:56.720 --> 0:04:59.680 looks legit. Turns out it wasn't legit after all. Yes, 0:04:59.720 --> 0:05:02.279 that's a exactly what happened with the Board eight hack. 0:05:02.760 --> 0:05:06.680 It was their official Instagram account that was compromised. We 0:05:06.720 --> 0:05:10.039 don't really know the details of how that happened. A 0:05:10.080 --> 0:05:12.640 lot of people think it's because of social engineering that, 0:05:13.000 --> 0:05:16.360 you know, some an account holder for the board apiacht 0:05:16.400 --> 0:05:20.320 Club Instagram handle was somehow manipulated into you know, giving 0:05:20.360 --> 0:05:25.080 access um. But yeah, this was the official board apiacht 0:05:25.120 --> 0:05:29.320 Club account and it linked to a website modeled off 0:05:29.400 --> 0:05:32.719 of the board apiacht Club website. So really there was 0:05:32.800 --> 0:05:36.000 just uh an extra level of trickery here. So a high, 0:05:36.120 --> 0:05:38.760 high level of sophistication is what we're dealing with, correct, 0:05:43.520 --> 0:05:46.000 Given that, it seems to me a little bit unfair 0:05:46.120 --> 0:05:47.600 for folks to be like, well, you should just pay 0:05:47.680 --> 0:05:49.760 more attention to the incidents and not click on any links. 0:05:49.760 --> 0:05:51.120 I like, if people are trying to do the right 0:05:51.120 --> 0:05:53.760 thing and they're still getting scammed, what are the big 0:05:53.839 --> 0:05:55.960 social media companies doing about this? What are the big 0:05:56.000 --> 0:05:58.800 crypto companies doing about this? Because that does seem to 0:05:58.839 --> 0:06:01.880 be a direction that you know, systemic intervention sounds like 0:06:01.880 --> 0:06:04.200 it's what's needed here. Yeah, I know what the big 0:06:04.200 --> 0:06:08.600 tech companies do have options here encouraging users to do 0:06:08.839 --> 0:06:12.960 things like two factor authentication to secure their accounts, you know, 0:06:13.160 --> 0:06:17.200 requiring them to have it secured both via email and 0:06:17.320 --> 0:06:21.440 phone number. That's something that can help increase security. Uh. 0:06:21.480 --> 0:06:25.599 There are also you know, options like using AI to 0:06:25.960 --> 0:06:31.600 clean out spam bots that might be spreading these scammy links, um, 0:06:31.640 --> 0:06:36.159 and these tools for filtering out spam bots. Those also 0:06:36.200 --> 0:06:38.679 come at a cost to the social media company because 0:06:38.680 --> 0:06:41.240 it clear it lowers their user a count, which isn't 0:06:41.240 --> 0:06:45.400 a good look. So basically, by reducing spam activity, you 0:06:45.480 --> 0:06:48.920 reduce overall engagement. And there's some some analysts looking at 0:06:48.920 --> 0:06:52.040 metrics and being like why are your numbers down exactly? 0:06:52.120 --> 0:06:55.120 And for a company that's reporting those things and earnings, yeah, 0:06:55.160 --> 0:06:58.080 it's not a good look. Um. Yeah no. And with 0:06:58.520 --> 0:07:03.400 these user accounts, you know, they're also specific policies uh 0:07:03.440 --> 0:07:07.599 that prevent spam accounts being in place. Twitter requires BOD 0:07:07.600 --> 0:07:11.640 accounts to be identified as BOD accounts. Um. They have 0:07:11.720 --> 0:07:15.560 reporting tools that users can you know, put in concerns 0:07:15.560 --> 0:07:19.559 about suspicious activity that they see on the platforms. So 0:07:19.720 --> 0:07:21.600 you know, there there are steps that they can take. 0:07:22.000 --> 0:07:24.440 And as for crypto companies, you know, it's very interesting. 0:07:24.640 --> 0:07:27.040 A lot of these companies are growing very quickly, they're 0:07:27.120 --> 0:07:29.840 very young, UM, and they might be more interested in 0:07:29.960 --> 0:07:33.080 hiring you know, engineers, developers, people who can help them 0:07:33.120 --> 0:07:37.680 build out the product. And where they're cutting corners is cybersecurity. 0:07:38.040 --> 0:07:42.040 And part of what UM you know, recommendation that I've 0:07:42.040 --> 0:07:46.200 heard is that they should actually focus on hiring cybersecurity 0:07:46.240 --> 0:07:49.960 specialists early on, especially those who specialized of blockchain and 0:07:50.240 --> 0:07:52.760 you know, investing in that part of their business and 0:07:52.840 --> 0:07:55.440 that could help prevent scams down the line. UM. They 0:07:55.440 --> 0:07:58.920 can also do things like offer bug bounties, So if 0:07:59.280 --> 0:08:02.080 white hat had er see some sort of vulnerability in 0:08:02.120 --> 0:08:06.120 their code that could be used to scam users, they 0:08:06.320 --> 0:08:08.880 can work with the white hat hacker and actually reward 0:08:08.960 --> 0:08:11.840 them for for finding this flaw and you know, kind 0:08:11.840 --> 0:08:15.200 of advertise that to get more white hat hackers on board. 0:08:15.360 --> 0:08:17.480 And the idea of a white hat hacker hacker these 0:08:17.480 --> 0:08:19.200 are like these are the good ones. These are the 0:08:19.200 --> 0:08:22.440 ones who are not trying to steal money from people. 0:08:22.520 --> 0:08:24.960 They're trying to stop people from having money stolen from 0:08:25.000 --> 0:08:29.520 them exactly. They're using their expertise to find flaws in 0:08:29.760 --> 0:08:32.840 you know, different in the security of different platforms, and 0:08:33.080 --> 0:08:36.760 uh there will alert teams as to you know, what 0:08:36.800 --> 0:08:40.520 they can do to to patch these areas. Other than 0:08:40.920 --> 0:08:43.319 you know, while we wait for the big tech companies 0:08:43.360 --> 0:08:45.440 to put these things in place, and other than people 0:08:45.520 --> 0:08:48.600 just not clicking any links on the internet. Ever, if 0:08:48.600 --> 0:08:50.360 you had one piece of advice for folks who will 0:08:50.360 --> 0:08:52.160 worried about these kinds of scams, what would it be. 0:08:52.480 --> 0:08:57.319 Pay attention, you know, see whether like this is actually 0:08:57.480 --> 0:09:02.400 a legitimate operation. Check the Twitter handle, see if it's verified. 0:09:03.280 --> 0:09:06.040 Really you know a lot of these startups too, like 0:09:06.040 --> 0:09:08.240 they're pretty easy to reach out to, like on Telegram 0:09:08.320 --> 0:09:11.880 or Discord or whatever may like, do your homework essentially 0:09:11.920 --> 0:09:14.160 and try to find out whether this is like a 0:09:14.240 --> 0:09:18.880 legitimate announcement and really just I I don't recommend connecting 0:09:18.880 --> 0:09:22.560 your wallet to anything unless you're a pent sure that 0:09:22.880 --> 0:09:26.400 this is a real thing, a real legitimate operation. Awesome, 0:09:26.440 --> 0:09:28.439 Thank you so much, Hannah. You can find more of 0:09:28.480 --> 0:09:31.400 Hannah's repoising on the Bloomberg terminal. Of course, on Bloomberg 0:09:31.440 --> 0:09:34.760 dot com and on Twitter at h G milla nine. 0:09:35.920 --> 0:09:45.679 We'll be right back. So what can we do about 0:09:45.679 --> 0:09:48.200 these hacks? And how can people protect their digital assets 0:09:48.200 --> 0:09:52.200 in an increasingly decentralized environment. Wrong Waygo is the chief 0:09:52.280 --> 0:09:55.880 executive officer of a blockchain security firm, Cult Curtic and 0:09:55.920 --> 0:09:59.800 an assistant professor at Computer Science at Columbia University. Professor, 0:10:00.600 --> 0:10:03.360 what I'm hearing from you is we're dealing with a 0:10:03.400 --> 0:10:05.560 couple of things at once. We're dealing with more of 0:10:05.600 --> 0:10:09.360 these hacks. We're dealing with more sophistication in terms of 0:10:09.400 --> 0:10:12.760 these hacks, a bigger range of types of people who 0:10:12.760 --> 0:10:16.679 are being targeted, and you you work with different firms 0:10:16.720 --> 0:10:20.240 and companies to help them protect themselves and their users 0:10:20.679 --> 0:10:23.000 from these kinds of exposures. What does that look like 0:10:23.080 --> 0:10:27.040 in practice? You know, webstue and website are quite different. 0:10:27.280 --> 0:10:30.679 Webstry apps are built on top of blockchain, which can 0:10:30.679 --> 0:10:33.360 be viewed as a world computer that no one has stopped. 0:10:33.520 --> 0:10:38.760 So if obser the deployment meant even if people have 0:10:39.120 --> 0:10:44.040 identified militia transactions or code of avulnerabilities in their programs, 0:10:44.240 --> 0:10:47.280 is very hard to make changes or a hatches so 0:10:47.360 --> 0:10:50.160 that's why we have to make sure that the software 0:10:50.440 --> 0:10:53.480 all these applications are as cure as possible before the 0:10:53.559 --> 0:10:57.240 deployment and on the on kind of the individual consumer side. 0:10:57.320 --> 0:10:59.520 And like one of the things that you have alluded 0:10:59.559 --> 0:11:01.000 to a kind of quote to you on this in 0:11:01.000 --> 0:11:04.160 her story is around the idea of falling for what's called, 0:11:04.240 --> 0:11:08.040 you know, social engineering. How do you help people not 0:11:08.160 --> 0:11:10.800 fall for social engineering? So where where you know somebody 0:11:10.880 --> 0:11:14.720 is manipulated into revealing credentials, Yes, it's there. It's a 0:11:14.720 --> 0:11:18.160 good caution. How to I would say, how to protect 0:11:18.880 --> 0:11:22.559 you're accust you're as a form social engineering? One chips 0:11:22.679 --> 0:11:25.079 is as for all these accounts you are vality, the 0:11:25.160 --> 0:11:30.600 costs or their social medium accounts should be associated was 0:11:30.679 --> 0:11:34.480 let's say the phones or email addresses that are not 0:11:34.920 --> 0:11:38.040 publicly available for other people. So that means if somebody 0:11:38.040 --> 0:11:40.439 calls you and that you know, it's suspicious because nobody 0:11:40.480 --> 0:11:43.120 should have it. Got it? Um? What do you think 0:11:43.120 --> 0:11:47.679 the responsibilities are of you know, these decentralized companies that 0:11:47.720 --> 0:11:49.920 are coming up or even the web two ones that 0:11:49.960 --> 0:11:53.360 are playing in crypto in terms of user protection, Yeah, 0:11:53.600 --> 0:11:58.000 they have played their Their responsibility is to making sure 0:11:58.120 --> 0:12:01.000 their system their applications are are as you care as 0:12:01.120 --> 0:12:04.400 as possible. But as I mentioned, website is quite different 0:12:04.480 --> 0:12:08.320 from Websture company. Many have webbed to several defense techniques. 0:12:08.640 --> 0:12:12.079 Just counst be applied directly to this new too. Men, 0:12:12.480 --> 0:12:15.640 due to the challenges that I've mentioned that you can 0:12:15.800 --> 0:12:19.839 add patches right you you call many changes after the deployment, 0:12:20.200 --> 0:12:23.880 so they shouldn't make sure that their their software, our 0:12:24.000 --> 0:12:27.280 secure are free of boom better to before deployments, which 0:12:27.360 --> 0:12:29.880 is not a you know, a practice that will be 0:12:29.880 --> 0:12:33.280 followed by web to company, but they have to situate 0:12:33.440 --> 0:12:36.240 in web streets. Well, thank you very much for joining us, professor, 0:12:36.280 --> 0:12:39.120 who really appreciate you taking the time. Okay, yeah, Man 0:12:39.160 --> 0:12:43.920 of Thane. On the next episode of Bloomberg Crypto, have 0:12:44.040 --> 0:12:47.080 you ever heard the saying everything is bigger in Texas? 0:12:47.120 --> 0:12:50.080 The same applies to mining bitcoin in the state. The 0:12:50.120 --> 0:12:54.280 States of Texas is flush with bitcoin miners, including the 0:12:54.320 --> 0:12:57.640 city of Fort Worth that started a small mining operation 0:12:57.720 --> 0:13:00.720 out of its city hall. Tomorrow I'll talk with Bloomberg 0:13:00.760 --> 0:13:03.360 report to Mike Smith about what makes the states so 0:13:03.440 --> 0:13:06.800 attractive to crypto enthusiasts, and you'll hear from Lee Bratcha 0:13:06.960 --> 0:13:09.760 ahead of the Texas Blockchain Council, who will share more 0:13:09.800 --> 0:13:12.840 about that partnership with the City of Fort Worth. I'm 0:13:12.880 --> 0:13:16.600 Stacy Marie Ishmael, and this is Bloomberg Crypto, a daily 0:13:16.640 --> 0:13:19.800 podcast from Bloomberg and I Heart Radio. For more shows 0:13:19.800 --> 0:13:22.280 from I Heart Radio, visit the I Heart Radio app, 0:13:22.400 --> 0:13:27.400 Apple Podcasts, or wherever you get your podcasts. Email your questions, comments, 0:13:27.440 --> 0:13:31.400 or suggestions to Crypto at bloomberg dot net. Follow us 0:13:31.400 --> 0:13:38.200 on Twitter We're at Crypto. The supervising producer and editor 0:13:38.240 --> 0:13:41.400 of this episode is Vicky Vergalina. Desk to wonder At 0:13:41.480 --> 0:13:45.439 is our engineer. Original music by Leo Sidron. Bloomberg's head 0:13:45.440 --> 0:13:47.000 of podcasts is Francesca Levi.