Microsoft Warns of ‘Ice Phishing’ Threat on Web3 and Decentralized Networks

Microsoft has warned of emerging threats in the Web3^[1] landscape, including
“ice phishing” campaigns, as a surge in adoption of blockchain and
DeFi technologies emphasizes the need to build security into the
decentralized web while it’s still in its early stages.

The company’s Microsoft 365 Defender Research Team called out
various new avenues through which malicious actors may attempt to
trick cryptocurrency users into giving up their private
cryptographic keys and carry out unauthorized fund transfers.

“One aspect that the immutable and public blockchain enables is
complete transparency, so an attack can be observed and studied
after it occurred,” Christian Seifert, principal research manager
at Microsoft’s Security and Compliance group, said^[2]. “It also allows
assessment of the financial impact of attacks, which is challenging
in traditional web2 phishing attacks.”

The theft of the keys could be carried out in several ways,
including impersonating wallet software, deploying malware on
victims’ devices, typosquatting legitimate smart contract front
ends, and minting rogue digital tokens^[3]
for Airdrop scams^[4].

Another technique involves what Microsoft calls “ice
phishing.” Rather than stealing a user’s private keys, the
method works by deceiving the target into “signing a transaction
that delegates approval of the user’s tokens to the attacker.”

“Once the approval transaction has been signed, submitted, and
mined, the spender can access the funds,” Seifert elaborated. “In
case of an ‘ice phishing’ attack, the attacker can accumulate
approvals over a period of time and then drain all [the] victim’s
wallets quickly.”

The high-profile hack^[5]
of DeFi platform BadgerDAO, which came to light in early December
2021, was one such instance of ice phishing, wherein a maliciously
injected snippet using a compromised API key enabled the adversary
to siphon $121 million in funds.

“The attacker deployed the worker script via a compromised API
key that was created without the knowledge or authorization of
Badger engineers,” BadgerDAO said^[6]. “The attacker(s) used
this API access to periodically inject malicious code into the
Badger application such that it only affected a subset of the user
base.”

The script was programmed such that it would intercept Web3
transactions from wallets over a certain balance and insert a
request to transfer the victim’s tokens to an address chosen by the
attackers.

To mitigate threats affecting the blockchain technology,
Microsoft is recommending users to review and audit^[7]
the smart contracts for adequate incident response or emergency
capabilities and periodically reassess and
revoke^[8] token allowances.