Cream Finance DNS Hijack - Revision history

Azoundria at 18:59, 2 May 2023

2023-05-02T18:59:45Z

← Older revision		Revision as of 12:59, 2 May 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/creamfinancednshijack.php}}		{{Imported Case Study 2\|source=https://www.quadrigainitiative.com/casestudy/creamfinancednshijack.php}}
	{{Unattributed Sources}}		{{Unattributed Sources}}

Line 6:		Line 6:
	It is not known how many users decided to enter their seed phrase and were affected.		It is not known how many users decided to enter their seed phrase and were affected.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.<ref name="decrypt-2445" /><ref name="creamdotfinancetwitter-2458" /><ref name="creamfinance-2459" /><ref name="creamdotfinancetwitter-2448" /><ref name="czbinancetwitter-2449" /><ref name="coindesk-2455" /><ref name="creamdotfinancetwitter-2460" /><ref name="openblocksecgithub-2342" /><ref name="creamfinancemedium-2461" /><ref name="cointelegraph-6291" /><ref name="coinbureau-6292" />
	<ref name="decrypt-2445" /><ref name="creamdotfinancetwitter-2458" /><ref name="creamfinance-2459" /><ref name="creamdotfinancetwitter-2448" /><ref name="czbinancetwitter-2449" /><ref name="coindesk-2455" /><ref name="creamdotfinancetwitter-2460" /><ref name="openblocksecgithub-2342" /><ref name="creamfinancemedium-2461" /><ref name="cointelegraph-6291" /><ref name="coinbureau-6292" />

	== About Cream Finance ==		== About Cream Finance ==
Line 57:		Line 56:
	!Description		!Description
	\|-		\|-
	\|March 15th, 2021 ~~12:00:00 AM~~		\|March 15th, 2021
	\|Main Event		\|Main Event
	\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
Line 65:		Line 64:
	\|		\|
	\|}		\|}

			== Technical Details ==
			This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

	== Total Amount Lost ==		== Total Amount Lost ==
Line 84:		Line 86:
	== Ongoing Developments ==		== Ongoing Developments ==
	What parts of this case are still remaining to be concluded?		What parts of this case are still remaining to be concluded?
			== General Prevention Policies ==
	== Prevention Policies ==
	In general, most users are educated against entering their seed phrase on any website, DNS hijacking incidents are relatively rare, and only a small portion of platform users would interact with the platform site while the event happens.		In general, most users are educated against entering their seed phrase on any website, DNS hijacking incidents are relatively rare, and only a small portion of platform users would interact with the platform site while the event happens.

	This type of situation is likely best dealt with through education for users, better training for platform operators regarding the proper domain name security, and having a fund set up to assist users in case of loss events.		This type of situation is likely best dealt with through education for users, better training for platform operators regarding the proper domain name security, and having a fund set up to assist users in case of loss events.
			== Individual Prevention Policies ==
			{{Prevention:Individuals:Placeholder}}

			{{Prevention:Individuals:End}}

			== Platform Prevention Policies ==
			{{Prevention:Platforms:Placeholder}}

			{{Prevention:Platforms:End}}

			== Regulatory Prevention Policies ==
			{{Prevention:Regulators:Placeholder}}

			{{Prevention:Regulators:End}}

	== References ==		== References ==
	<references><ref name="decrypt-2445">[https://decrypt.co/61431/pancakeswap-hacked DeFi Exchange PancakeSwap Warns of Hack: ‘Do Not Use the Site’ - Decrypt] (Jun 25, 2021)</ref>		<references><ref name="decrypt-2445">[https://decrypt.co/61431/pancakeswap-hacked DeFi Exchange PancakeSwap Warns of Hack: ‘Do Not Use the Site’ - Decrypt] (Jun 26, 2021)</ref>

	<ref name="creamdotfinancetwitter-2458">[https://twitter.com/CreamdotFinance/status/1371448627663491088 @CreamdotFinance Twitter] (Jun 25, 2021)</ref>		<ref name="creamdotfinancetwitter-2458">[https://twitter.com/CreamdotFinance/status/1371448627663491088 @CreamdotFinance Twitter] (Jun 26, 2021)</ref>

	<ref name="creamfinance-2459">[https://app.cream.finance/ C.R.E.A.M.] (Jun 25, 2021)</ref>		<ref name="creamfinance-2459">[https://app.cream.finance/ C.R.E.A.M.] (Jun 26, 2021)</ref>

	<ref name="creamdotfinancetwitter-2448">[https://twitter.com/CreamdotFinance/status/1371475887720439808 @CreamdotFinance Twitter] (Jun 25, 2021)</ref>		<ref name="creamdotfinancetwitter-2448">[https://twitter.com/CreamdotFinance/status/1371475887720439808 @CreamdotFinance Twitter] (Jun 26, 2021)</ref>

	<ref name="czbinancetwitter-2449">[https://twitter.com/cz_binance/status/1371473348866179072 @cz_binance Twitter] (Jun 25, 2021)</ref>		<ref name="czbinancetwitter-2449">[https://twitter.com/cz_binance/status/1371473348866179072 @cz_binance Twitter] (Jun 26, 2021)</ref>

	<ref name="coindesk-2455">[https://www.coindesk.com/defi-projects-cream-finance-pancakeswap-hit-with-dns-hijacks DeFi Projects Cream Finance, PancakeSwap Hit With ‘DNS Hijacks’ - CoinDesk] (Jun 25, 2021)</ref>		<ref name="coindesk-2455">[https://www.coindesk.com/defi-projects-cream-finance-pancakeswap-hit-with-dns-hijacks DeFi Projects Cream Finance, PancakeSwap Hit With ‘DNS Hijacks’ - CoinDesk] (Jun 26, 2021)</ref>

	<ref name="creamdotfinancetwitter-2460">[https://twitter.com/CreamdotFinance/status/1371495499413385227 @CreamdotFinance Twitter] (Jun 25, 2021)</ref>		<ref name="creamdotfinancetwitter-2460">[https://twitter.com/CreamdotFinance/status/1371495499413385227 @CreamdotFinance Twitter] (Jun 26, 2021)</ref>

	<ref name="openblocksecgithub-2342">[https://github.com/openblocksec/blocksec-incidents/blob/main/defi/2021.md blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub] (Aug 10, 2021)</ref>		<ref name="openblocksecgithub-2342">[https://github.com/openblocksec/blocksec-incidents/blob/main/defi/2021.md blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub] (Aug 11, 2021)</ref>

	<ref name="creamfinancemedium-2461">[https://medium.com/cream-finance/postmortem-report-of-dns-hijacking-66ab9c6ce63d Postmortem Report Of Dns Hijacking] (Aug 10, 2021)</ref>		<ref name="creamfinancemedium-2461">[https://medium.com/cream-finance/postmortem-report-of-dns-hijacking-66ab9c6ce63d Postmortem Report Of Dns Hijacking] (Aug 11, 2021)</ref>

	<ref name="cointelegraph-6291">[https://cointelegraph.com/news/cream-finance-launches-1-5m-bug-bounty-to-improve-defi-security Cream Finance launches $1.5M bug bounty to improve DeFi security] (Feb 8, 2022)</ref>		<ref name="cointelegraph-6291">[https://cointelegraph.com/news/cream-finance-launches-1-5m-bug-bounty-to-improve-defi-security Cream Finance launches $1.5M bug bounty to improve DeFi security] (Feb 8, 2022)</ref>

	<ref name="coinbureau-6292">[https://www.coinbureau.com/review/cream-finance/ Cream Finance Review: What You NEED To Know About CREAM!!] (Feb 8, 2022)</ref></references>		<ref name="coinbureau-6292">[https://www.coinbureau.com/review/cream-finance/ Cream Finance Review: What You NEED To Know About CREAM!!] (Feb 8, 2022)</ref></references>

Azoundria at 17:30, 22 February 2023

2023-02-22T17:30:18Z

← Older revision		Revision as of 11:30, 22 February 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/creamfinancednshijack.php}}		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/creamfinancednshijack.php}}
			{{Unattributed Sources}}

	[[File:Creamfinance.jpg\|thumb\|Cream Finance]]Cream Finance uses GoDaddy as their domain registrar. Due to what appears to be an error in GoDaddy, the attacker was able to change the CNAME records to point the domain name to a server they control. They then modified the site to display a request for the user to enter their seed phrase.		[[File:Creamfinance.jpg\|thumb\|Cream Finance]]Cream Finance uses GoDaddy as their domain registrar. Due to what appears to be an error in GoDaddy, the attacker was able to change the CNAME records to point the domain name to a server they control. They then modified the site to display a request for the user to enter their seed phrase.
Line 6:		Line 7:

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.
			<ref name="decrypt-2445" /><ref name="creamdotfinancetwitter-2458" /><ref name="creamfinance-2459" /><ref name="creamdotfinancetwitter-2448" /><ref name="czbinancetwitter-2449" /><ref name="coindesk-2455" /><ref name="creamdotfinancetwitter-2460" /><ref name="openblocksecgithub-2342" /><ref name="creamfinancemedium-2461" /><ref name="cointelegraph-6291" /><ref name="coinbureau-6292" />

	== About Cream Finance ==		== About Cream Finance ==
Line 35:		Line 37:

	Don't Include:		Don't Include:

	* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.		* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
	* Anything that wasn't reasonably knowable at the time of the event.		* Anything that wasn't reasonably knowable at the time of the event.
Line 57:		Line 58:
	\|-		\|-
	\|March 15th, 2021 12:00:00 AM		\|March 15th, 2021 12:00:00 AM
	\|~~First~~ Event		\|Main Event
	\|~~This is an expanded~~ description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
	\|-
	\|
	\|
	\|
	\|-		\|-
	\|		\|
Line 81:		Line 78:

	== Total Amount Recovered ==		== Total Amount Recovered ==
	~~It is unknown how much was~~ recovered.		There do not appear to have been any funds recovered in this case.

	What funds were recovered? What funds were reimbursed for those affected users?		What funds were recovered? What funds were reimbursed for those affected users?
Line 94:		Line 91:

	== References ==		== References ==
	[https://decrypt.co/61431/pancakeswap-hacked DeFi Exchange PancakeSwap Warns of Hack: ‘Do Not Use the Site’ - Decrypt] (Jun 25)		<references><ref name="decrypt-2445">[https://decrypt.co/61431/pancakeswap-hacked DeFi Exchange PancakeSwap Warns of Hack: ‘Do Not Use the Site’ - Decrypt] (Jun 25, 2021)</ref>

	[https://twitter.com/CreamdotFinance/status/1371448627663491088 @CreamdotFinance Twitter] (Jun 25)		<ref name="creamdotfinancetwitter-2458">[https://twitter.com/CreamdotFinance/status/1371448627663491088 @CreamdotFinance Twitter] (Jun 25, 2021)</ref>

	[https://app.cream.finance/ C.R.E.A.M.] (Jun 25)		<ref name="creamfinance-2459">[https://app.cream.finance/ C.R.E.A.M.] (Jun 25, 2021)</ref>

	[https://twitter.com/CreamdotFinance/status/1371475887720439808 @CreamdotFinance Twitter] (Jun 25)		<ref name="creamdotfinancetwitter-2448">[https://twitter.com/CreamdotFinance/status/1371475887720439808 @CreamdotFinance Twitter] (Jun 25, 2021)</ref>

	[https://twitter.com/cz_binance/status/1371473348866179072 @cz_binance Twitter] (Jun 25)		<ref name="czbinancetwitter-2449">[https://twitter.com/cz_binance/status/1371473348866179072 @cz_binance Twitter] (Jun 25, 2021)</ref>

	[https://www.coindesk.com/defi-projects-cream-finance-pancakeswap-hit-with-dns-hijacks DeFi Projects Cream Finance, PancakeSwap Hit With ‘DNS Hijacks’ - CoinDesk] (Jun 25)		<ref name="coindesk-2455">[https://www.coindesk.com/defi-projects-cream-finance-pancakeswap-hit-with-dns-hijacks DeFi Projects Cream Finance, PancakeSwap Hit With ‘DNS Hijacks’ - CoinDesk] (Jun 25, 2021)</ref>

	[https://twitter.com/CreamdotFinance/status/1371495499413385227 @CreamdotFinance Twitter] (Jun 25)		<ref name="creamdotfinancetwitter-2460">[https://twitter.com/CreamdotFinance/status/1371495499413385227 @CreamdotFinance Twitter] (Jun 25, 2021)</ref>

	[https://github.com/openblocksec/blocksec-incidents/blob/main/defi/2021.md blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub] (Aug 10)		<ref name="openblocksecgithub-2342">[https://github.com/openblocksec/blocksec-incidents/blob/main/defi/2021.md blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub] (Aug 10, 2021)</ref>

	[https://medium.com/cream-finance/postmortem-report-of-dns-hijacking-66ab9c6ce63d Postmortem Report Of Dns Hijacking] (Aug 10)		<ref name="creamfinancemedium-2461">[https://medium.com/cream-finance/postmortem-report-of-dns-hijacking-66ab9c6ce63d Postmortem Report Of Dns Hijacking] (Aug 10, 2021)</ref>

	[https://cointelegraph.com/news/cream-finance-launches-1-5m-bug-bounty-to-improve-defi-security Cream Finance launches $1.5M bug bounty to improve DeFi security] (Feb 8)		<ref name="cointelegraph-6291">[https://cointelegraph.com/news/cream-finance-launches-1-5m-bug-bounty-to-improve-defi-security Cream Finance launches $1.5M bug bounty to improve DeFi security] (Feb 8, 2022)</ref>

	[https://www.coinbureau.com/review/cream-finance/ Cream Finance Review: What You NEED To Know About CREAM!!] (Feb 8)		<ref name="coinbureau-6292">[https://www.coinbureau.com/review/cream-finance/ Cream Finance Review: What You NEED To Know About CREAM!!] (Feb 8, 2022)</ref></references>

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/creamfinancednshijack.php}} Cream FinanceCream Finance uses GoDaddy as their domain registrar. Due to what appears to be an error in GoDaddy, the attacker was able to change the CNAME records to point the domain name to a server they control. They then modified the site to display a request for the user to enter their seed phrase. It is not known how many users dec..."

2023-01-26T05:30:57Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/creamfinancednshijack.php}} thumb|Cream FinanceCream Finance uses GoDaddy as their domain registrar. Due to what appears to be an error in GoDaddy, the attacker was able to change the CNAME records to point the domain name to a server they control. They then modified the site to display a request for the user to enter their seed phrase. It is not known how many users dec..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/creamfinancednshijack.php}}

[[File:Creamfinance.jpg|thumb|Cream Finance]]Cream Finance uses GoDaddy as their domain registrar. Due to what appears to be an error in GoDaddy, the attacker was able to change the CNAME records to point the domain name to a server they control. They then modified the site to display a request for the user to enter their seed phrase.

It is not known how many users decided to enter their seed phrase and were affected.

This is a global/international case not involving a specific country.

== About Cream Finance ==
"C.R.E.A.M. Finance is a decentralized lending protocol for individuals, institutions and protocols to access financial services. Part of the yearn finance ecosystem, it is a permissionless, open source and blockchain agnostic protocol serving users on Ethereum, Binance Smart Chain and Fantom. Users who are passively holding Ethereum or Bitcoin can deposit their assets on C.R.E.A.M. to earn yield, similar to a traditional savings account."

"On March 15, C.R.E.A.M. Finance encountered DNS hijacking. Our GoDaddy account was compromised, redirecting users to a phishing page." "GoDaddy DNS CNAME record not pointing to our hosting IP, consistent with the website outage." "[O]ur GoDaddy login credentials were compromised." "The first unusual behavior in GoDaddy activity log is a password reset request sent to attacker’s email address, but there is no record of email address change."

"Earlier today, a similar service called Cream Finance said its DNS (domain name service) had been "compromised by a third party." PancakeSwap’s Twitter account then confirmed that it had been attacked through the same mechanism."

"To our community ~ http://cream.finance and http://app.cream.finance are now considered compromised sites - DO NOT USE either domain until further notice."

"The hijacker appears to be asking users to input the 12-word seed phrase unique to each crypto wallet in order to steal funds."

"[W]e want to thank the community for all of their support while we worked to fix the DNS hijacking issue. W[e w]ant to assure you all that all funds are safe, and we have regained control over our DNS!"

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:

* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - Cream Finance DNS Hijack
!Date
!Event
!Description
|-
|March 15th, 2021 12:00:00 AM
|First Event
|This is an expanded description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|-
|
|
|
|}

== Total Amount Lost ==
The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
It is unknown how much was recovered.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==
In general, most users are educated against entering their seed phrase on any website, DNS hijacking incidents are relatively rare, and only a small portion of platform users would interact with the platform site while the event happens.

This type of situation is likely best dealt with through education for users, better training for platform operators regarding the proper domain name security, and having a fund set up to assist users in case of loss events.

== References ==
[https://decrypt.co/61431/pancakeswap-hacked DeFi Exchange PancakeSwap Warns of Hack: ‘Do Not Use the Site’ - Decrypt] (Jun 25)

[https://twitter.com/CreamdotFinance/status/1371448627663491088 @CreamdotFinance Twitter] (Jun 25)

[https://app.cream.finance/ C.R.E.A.M.] (Jun 25)

[https://twitter.com/CreamdotFinance/status/1371475887720439808 @CreamdotFinance Twitter] (Jun 25)

[https://twitter.com/cz_binance/status/1371473348866179072 @cz_binance Twitter] (Jun 25)

[https://www.coindesk.com/defi-projects-cream-finance-pancakeswap-hit-with-dns-hijacks DeFi Projects Cream Finance, PancakeSwap Hit With ‘DNS Hijacks’ - CoinDesk] (Jun 25)

[https://twitter.com/CreamdotFinance/status/1371495499413385227 @CreamdotFinance Twitter] (Jun 25)

[https://github.com/openblocksec/blocksec-incidents/blob/main/defi/2021.md blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub] (Aug 10)

[https://medium.com/cream-finance/postmortem-report-of-dns-hijacking-66ab9c6ce63d Postmortem Report Of Dns Hijacking] (Aug 10)

[https://cointelegraph.com/news/cream-finance-launches-1-5m-bug-bounty-to-improve-defi-security Cream Finance launches $1.5M bug bounty to improve DeFi security] (Feb 8)

[https://www.coinbureau.com/review/cream-finance/ Cream Finance Review: What You NEED To Know About CREAM!!] (Feb 8)