AllBridge Malicious DNS Hijack: Difference between revisions
(Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/allbridgemaliciousdnshijack.php}} {{Unattributed Citations}} thumb|AllBridge This is a global/international case not involving a specific country. <ref name="allbridgewebsite-10528" /><ref name="allbridgedocs-10529" /> == About AllBridge == Allbridge, founded in 2021, is a "[c]ross-chain solutions provider" which offers "[t]he most convenient cross-chain transfers". The se...") |
No edit summary |
||
| Line 1: | Line 1: | ||
{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/allbridgemaliciousdnshijack.php | {{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/allbridgemaliciousdnshijack.php}} | ||
[[File:Allbridge.jpg|thumb|AllBridge]] | [[File:Allbridge.jpg|thumb|AllBridge]] | ||
== About AllBridge == | == About AllBridge == | ||
Allbridge, founded in 2021, is a "[c]ross-chain solutions provider" which offers "[t]he most convenient cross-chain transfers". The service offers AllBridge Classic, Allbridge BaaS, and Allbridge Core. | Allbridge, founded in 2021, is a "[c]ross-chain solutions provider" which offers "[t]he most convenient cross-chain transfers"<ref name="allbridgewebsite-10528" /><ref name="allbridgedocs-10529" />. The service offers AllBridge Classic, Allbridge BaaS, and Allbridge Core<ref name="allbridgewebsite-10528" />. | ||
"Allbridge is a simple, modern, and reliable way to transfer assets between different networks. It is a bridge between both EVM (Like Ethereum, Polygon, BSC) and non-EVM compatible (like Solana, Terra) blockchains, that aims to cover L2 (like Arbitrum, Optimism) solutions and NFT transfers in the future. Allbridge’s mission is to make the blockchain world borderless and provide a tool to freely move assets between different networks." | <blockquote>"Allbridge is a simple, modern, and reliable way to transfer assets between different networks. It is a bridge between both EVM (Like Ethereum, Polygon, BSC) and non-EVM compatible (like Solana, Terra) blockchains, that aims to cover L2 (like Arbitrum, Optimism) solutions and NFT transfers in the future. Allbridge’s mission is to make the blockchain world borderless and provide a tool to freely move assets between different networks." | ||
"Allbridge Classic is a generalized bridge between EVM and non-EVM compatible blockchains, supporting native and wrapped token transfers." | |||
"Allbridge BaaS is a white-label bridging solution that supports Solana, NEAR, Tron, and all EVM chains. The product offers a simple, customizable UI, a flexible architecture setup, full ownership of smart contracts, and a validator." | |||
"Allbridge Core enables the transfer of value between blockchains by offering cross-chain swaps of native stablecoins. Being messaging protocol agnostic, Allbridge Core connects a variety of EVM and non-EVM networks."</blockquote> | |||
== The Reality == | == The Reality == | ||
| Line 70: | Line 55: | ||
== Total Amount Lost == | == Total Amount Lost == | ||
The total amount lost is unknown. | |||
How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie? | How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie? | ||
| Line 81: | Line 66: | ||
== Total Amount Recovered == | == Total Amount Recovered == | ||
The total amount recovered is unknown. | |||
What funds were recovered? What funds were reimbursed for those affected users? | What funds were recovered? What funds were reimbursed for those affected users? | ||
Revision as of 23:55, 20 February 2023
Notice: This page is a freshly imported case study from an original repository. While the original content had a similar format, some sections may not have been fully completed. Please help fill in any empty sections or any missing information you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.
About AllBridge
Allbridge, founded in 2021, is a "[c]ross-chain solutions provider" which offers "[t]he most convenient cross-chain transfers"[1][2]. The service offers AllBridge Classic, Allbridge BaaS, and Allbridge Core[1].
"Allbridge is a simple, modern, and reliable way to transfer assets between different networks. It is a bridge between both EVM (Like Ethereum, Polygon, BSC) and non-EVM compatible (like Solana, Terra) blockchains, that aims to cover L2 (like Arbitrum, Optimism) solutions and NFT transfers in the future. Allbridge’s mission is to make the blockchain world borderless and provide a tool to freely move assets between different networks."
"Allbridge Classic is a generalized bridge between EVM and non-EVM compatible blockchains, supporting native and wrapped token transfers."
"Allbridge BaaS is a white-label bridging solution that supports Solana, NEAR, Tron, and all EVM chains. The product offers a simple, customizable UI, a flexible architecture setup, full ownership of smart contracts, and a validator."
"Allbridge Core enables the transfer of value between blockchains by offering cross-chain swaps of native stablecoins. Being messaging protocol agnostic, Allbridge Core connects a variety of EVM and non-EVM networks."
The Reality
While the smart contract operates in a decentralized manner, most users will tend to interact with the contracts using transactions generated by a centralized website. When a domain name is accessed on the internet, a service called DNS is used to point the domain name to an IP address[3].
The AllBridge project used NameCheap for their registrar for their primary website[4]. The procedures at NameCheap were such that support team members were able to override the DNS of the website to point the domain name to a malicious server[5][6][7].
What Happened
The account of a customer support agent for NameCheap was hacked[8].
"The attacker was able to access the NameCheap account, even with 2-factor authentication enabled, a strong password, and security alerts. Convex team still had access to the account; 2FA was still enabled, the password was the same, but the attacker was still able to access the account, change the DNS to point to the malicious website, and disable security alerts."
| Date | Event | Description |
|---|---|---|
| March 22nd, 2022 | Domain Vault Announced | The first archived appearance of the "Domain Vault" service on NameCheap which costs $19.88/mo and is still "coming soon"[9]. |
| June 24th, 2022 10:01:00 AM | NameCheap Response | NameCheap responds that "We've traced this down to a specific CS agent that was either hacked or compromised somehow and have removed all access from this agent. This affected a few targeted domains but we will continue investigating."[10] |
| June 24th, 2022 11:21:00 AM | NameCheap DomainVault | "Usually we require a pin code from customer. We also monitor all actions as well a monitor a real time vip list. In the end our [customer support] needs to be able to modify to help customers especially when 99% don't understand dns. If you want complete security use [DomainVault]"[11] |
| June 24th, 2022 4:16:00 PM | NameCheap Clarifies Hack | NameCheap responds that it "[l]ooks more like [their customer support] person was hacked."[8] |
| February 7th, 2023 7:28:59 PM | First Event | Describe the event. |
Total Amount Lost
The total amount lost is unknown.
How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?
Immediate Reactions
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?
Ultimate Outcome
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?
Total Amount Recovered
The total amount recovered is unknown.
What funds were recovered? What funds were reimbursed for those affected users?
Ongoing Developments
What parts of this case are still remaining to be concluded?
Prevention Policies
The issue ultimately stemmed from a single customer support agent being compromised. A multi-signature requirement on DNS changes would have prevented this scenario entirely.
While NameCheap offers advanced protections on their domain names, this service had just launched two days prior to the DNS change, so it was unlikely to be a reasonable expectation that Convex Finance would have already signed up.
Users of platforms need to be careful and double check any new approval requested by any platform against the proper smart contract address. It is recommended to double check any new smart contract addresses being interacted with.
References
- ↑ 1.0 1.1 Allbridge is the best cross-chain bridging solution provider. (Feb 7, 2023)
- ↑ What is Allbridge? - Allbridge (Feb 7, 2023)
- ↑ https://www.cloudflare.com/learning/dns/what-is-dns/ (Feb 9, 2023)
- ↑ Post Mortem Of Events June 23 (Aug 24, 2022)
- ↑ @ConvexFinance Twitter (Aug 24, 2022)
- ↑ @DevanCollins3 Twitter (Aug 24, 2022)
- ↑ @LefterisJP Twitter (Feb 10, 2023)
- ↑ 8.0 8.1 @NamecheapCEO Twitter (Feb 11, 2023)
- ↑ Premium domain protection – Domain Vault - Namecheap (Feb 9, 2023)
- ↑ @NamecheapCEO Twitter (Aug 24, 2022)
- ↑ @NamecheapCEO Twitter (Aug 24, 2022)