SmartState blog

December 23, 2022

Blockchain Security Audit

A Blockchain audit is a code review of a blockchain development project which can be carried out only manually. This process involves extensive use of static code analysis tools, but the majority of the work consists of searching for bugs and vulnerabilities relying primarily on the experts.Why is it needed?Blockchain is a very secure technology by itself, still, errors, loopholes or vulnerabilities are possible. Security assessment of a ...

Read more
December 19, 2022

What is STO?

Security through Obscurity (STO) is the reliance on secrecy and confusing attackers instead of building proper controls to keep them out. It is based on secluding important data. It provides protection from attacks, but it is not a panacea. Hackers and bots can try to exploit the user’s plugins in order to access the system. If plugins' and themes’ names are hidden deep on the server inside a ‘.htaccess’ file, it ...

Read more
December 16, 2022

OCTAVE Threat Modeling method

OCTAVE (Operational Critical Threat, Asset and Vulnerability Evaluation) is a risk-based strategic assessment and planning method. It was developed in the beginning of the century by CERT (Computer Emergency Response Team). It focuses on evaluating organizational risks without addressing technological ones and its main aspects are: operational risk, security practices and technology. Its specifics concern the fact that all the analysis is ...

Read more
December 13, 2022

What is the Attack Trees Threat modeling method

Attack tree (threat tree) is a graphical formalism used to structure, model and analyze potential attacks. It starts with a security threat, modeled as its root, representing the attacker's top level goal. It divides into subgoals through logical gates, modeling how successful the attack steps may be. Basic attack steps are presented as leaves on the tree. It includes so-called ‘and-gates’ (when the attacker has to deliver ...

Read more
December 9, 2022

What is SRS?

SRS (Software Requirement Specification documentation) is a type of document which describes how the software is required to be written. It includes an in-depth description of the system or software in question, which makes it different from the SyRS (System Requirements Specification), which only presents data with regards to the system or software requirements. It is usually made ‘once and for ever’. Different people are ...

Read more
December 5, 2022

Crypto phishing attacks: CertiK deceptive copycat site example

Surfing the web in search of Ankr audits (see the Ankr hack review by the SmartState team) we found a strangely duplicated CertiK page: Looking more closely, we realized that we had come across a fraudulent phishing copycat site mimicking CertiK, cerLik - cerlik.com.We wrote to CertiK but got no reply, so we decided to inform the community ourselves and wrote a short article about phishing, using the fake site as an example.What a phishing ...

Read more
December 4, 2022

Framework: Anchor

Anchor is a framework which allows users to create secure projects on Solana and develop smart contracts in Rust for the Solana blockchain. It helps to do it quickly thanks to a number of boilerplates (e.g. account serialization and deserialization or instruction data). It also offers security checks and keeps them separately from the business logic. This allows developers to decrease the time spent on working with raw code and focus on the ...

Read more
December 3, 2022

Ankr hack review by SmartState team

Ankr, a Web3 infrastructure provider, was hacked on December 1st. The loss amounted to approximately $5.5M. Seems the attacker somehow gained access to Ankr's deployer private key.Shortly before the hack, Ankr had performed project updates. The private key could have been compromised during those updates, or the attacker could have gotten access to the key earlier and just used that moment to execute the attack.Source: linkThe malicious ...

Read more
December 2, 2022

What is PASTA threat modeling method

PASTA (Process of Attack Simulation and Threat Analysis) is a ‘risk-centric’ threat modeling method, aimed at helping objectives meet technical requirements using a large range of tools. PASTA brings about an attacker-centric perspective and makes an asset-centric output in the form of threat enumeration and scoring. It makes the threat modeling process even more effective by means of requiring security input from operations, ...

Read more
November 27, 2022

White Box testing method

The White box (Open box, Transparent / Clear / Glass box, structural testing) is a testing method where security, usability and input-output flow of the internal structure of a system, its design and code are checked. The code is ‘open’ (visible) to testing specialists using this method. It concerns the inner works of applications and revolves around internal tests.White box testing involves a series of inputs verified against ...

Read more