Technology

Explaining crypto’s billion-dollar bridge problem

Published

2 years ago

April 11, 2022

On March twenty third, the Ronin blockchain community underlying the favored NFT-driven sport Axie Infinity was hit with a hack that noticed the attackers stroll away with an eye-popping $625 million in cryptocurrency.

The Ronin hack was the most important amount of cash that had ever been stolen from the kind of service referred to as a “bridge,” which connects one blockchain to a different in order that worth may be despatched between them. Sadly, it was removed from the one hack to hit a bridge: lower than two months beforehand, one other bridge platform referred to as Wormhole was exploited for near $325 million, and about six months earlier than that, greater than $600 million was stolen from one other cross-chain bridge referred to as Poly. (In a shocking twist, the hacker later returned Poly’s stolen funds.)

In brief, bridges are the weak level in quite a lot of cryptocurrency techniques, and hackers are focusing on them for greater than $1 billion in little over a yr. So it’s price laying out precisely what they’re, why they’re essential, and the way crypto firms can attempt to plug the billion-dollar gap of their pockets.

When you don’t have time to learn additional, the brief reply to the primary half is “sure, they’re weak however possibly much less so over time.” For the second half, the story is extra advanced.

(We’re assuming what a blockchain is already; if not, you can begin right here.)

So what’s a “blockchain bridge”?

Basically, it’s a system for connecting totally different blockchains, permitting customers to change one type of coin or token for one more. Each cryptocurrency runs by itself blockchain: there’s Bitcoin, Ethereum, and newer currencies like Tether, Ripple, Solana, and so forth. There’s no easy means for these totally different blockchains to work together — they may all use the idea of “addresses” to ship and obtain forex transactions, however you may’t ship ETH on to a Solana tackle.

A blockchain bridge is what builders have constructed to make that crossover a little bit smoother. When you’re holding ETH and also you want Solana’s SOL to join a sport, you may ship your ETH right into a bridge, get SOL in return, and use the identical technique to transform again once you’re achieved enjoying.

Why are bridges notably weak to hacks?

The brief reply is that they’re dealing with quite a lot of advanced requests and holding quite a lot of forex — and in contrast to the blockchains themselves, there’s no normal for a way they’re supposed to maintain all the pieces safe.

Image a blockchain bridge as an precise bridge between two islands. Every island has totally different guidelines about the kind of automobile you may drive (possibly there’s an EV island and a daily fuel island), so that they gained’t allow you to drive your automobile from one aspect to the opposite immediately. The truth is, you drive as much as one aspect of the bridge, go away your car in a parking storage, stroll throughout, and choose up a rental automobile on the opposite aspect. Then, once you’re achieved driving across the different island, you deliver your rental again to the bridge, stroll throughout, and so they hand you the keys to your automobile.

Which means for each rental automobile driving across the island, there’s one other automobile parked within the storage. Some are saved for hours, others for days, others for months, however they’re all simply sitting there, and the corporate that operates the bridge has to maintain all of them secure. In the meantime, different unscrupulous individuals know precisely what number of automobiles are within the storage and are on the lookout for methods to steal them.

Functionally, this implies bridges are receiving incoming transactions in a single sort of cryptocurrency, locking it up as a deposit, and releasing an equal quantity of cryptocurrency on one other blockchain. When bridges get hacked, the attacker is ready to withdraw cash from one aspect of the bridge with out placing something within the different aspect.

Bridges are notably tempting targets due to all of the advanced code, creating plenty of alternatives for exploitable bugs. As CertiK founder Ronghui Gu explains: “When you’re attempting to create a bridge between N totally different cryptocurrencies, the complexity of that’s N squared,” — which suggests N extra possibilities for bugs to creep in.

Crucially, these totally different cryptocurrencies aren’t simply totally different models of cash: they’re written in numerous programming languages and deployed in numerous digital environments. Determining how this stuff ought to work together may be very laborious, particularly for on-chain bridges that convert between a number of totally different cash.

Have bridges made cryptocurrency much less safe general?

Most likely not. Attackers are focusing on bridges proper now as a result of they’re the weakest level within the system — however that’s partially as a result of the business has achieved an excellent job securing the remainder of it. Kim Grauer, director of analysis at Chainalysis — an organization that has produced research on DeFi thefts — instructed The Verge that bridge hacks are taking the place of the earlier era of damaging hacks in opposition to exchanges like Coincheck, BitMart or Mt Gox.

“When you checked out our ecosystem just some years in the past, centralized exchanges have been the principle goal of hacks. Each hack it was, ‘Centralized change goes down once more,’ and the business labored laborious to have options that allowed us to beat these hacking issues,” she says. “We’re seeing quite a lot of DeFi hacking, however I feel the tempo of it’s truly slowing down. Undoubtedly the speed at which this hacking is happening can’t proceed for the business to develop.”

Isn’t the entire level of the blockchain to forestall this type of assault?

The issue is that many bridges aren’t on the blockchain in any respect. The Ronin bridge was set as much as work “off-chain,” working as a system that interfaces with the blockchain however exists on servers that aren’t a part of it. These techniques are quick, versatile, and comparatively light-weight — lowering among the “N squared” complexity challenges — however may be hit with the identical sort of hacks that have an effect on net companies anyplace on the web. (“This isn’t actually blockchain,” Gu says. “These are ‘Web2’ servers.”)

With out the blockchain to settle transactions, the Ronin bridge relied on 9 validator nodes, which have been compromised by means of a mix of code hacks and unspecified social engineering.

There are different bridge techniques that function as good contracts — principally, the “on-chain” various. It’s much less possible that an attacker might subvert the code of an on-chain system by means of social engineering, and getting majority energy over the community is extraordinarily unlikely. The downside is that the good contracts themselves are extremely advanced, and if bugs do exist, it may be laborious to replace the system in a well timed means. (Wormhole used an on-chain system, and the massive theft occurred after hackers noticed safety updates that have been uploaded to GitHub however had not been deployed to the reside good contract.)

How will we cease bridges from getting hacked?

It’s laborious. The reply that got here up time and time once more was “code auditing.” In the kind of case described above, the place a venture’s improvement crew may be working throughout totally different programming languages and computing environments, bringing in outdoors experience can cowl blind spots that in-house expertise would possibly miss. However proper now, a surprisingly giant variety of tasks don’t have any auditor listed.

Nick Selby, director of assurance follow at specialist safety auditing firm Path of Bits, mentioned that that is partly due to how briskly the market has sprung up. Most firms are beneath enormous strain to develop, scale, and construct new options to fend off opponents — which might typically come on the expense of diligent safety work.

“We’re in, I wouldn’t name it essentially a bubble, but it surely’s definitely a gold rush,” says Selby. “I feel quite a lot of occasions, executives who’re attempting to innovate within the area will take a look at the specified characteristic end result and say, ‘Effectively, this [product] does have the options I need. Subsequently, it’s good.’ And there’s quite a lot of issues they’re not taking a look at, so that they’re not seeing them, which is the place the code audit is available in.”

Technology

Google Translate is getting support for more than 110 new languages

Published

7 hours ago

June 27, 2024

Press Room

Google Translate is getting support for more than 110 new languages

Google is adding support for 110 new languages to Google Translate, the company announced on Thursday. Before now, Google Translate supported 133 languages, so this expansion — which the company says is its biggest ever — marks a significant jump.

Google’s PaLM 2 AI language model helped Translate learn these new languages. It was especially good at learning ones that were related to one another, such as languages “close to Hindi, like Awadhi and Marwadi, and French creoles like Seychellois Creole and Mauritian Creole,” Google’s Isaac Caswell says in a blog post.

The list of newly-supported languages in Translate includes Cantonese, which “has long been one of the most requested languages for Google Translate,” Caswell says. “Because Cantonese often overlaps with Mandarin in writing, it is tricky to find data and train models.” Caswell also says that “about a quarter of the new languages come from Africa.”

Most of the new languages are spoken by at least one million people, Caswell tells The Verge in an interview, while “several” are spoken by hundreds of millions of people.

Technology

BMW M5 gets its first plug — and gains a lot of weight

Published

14 hours ago

June 26, 2024

Press Room

BMW M5 gets its first plug — and gains a lot of weight

BMW’s 2025 BMW M5, which is coming as a plug-in electric hybrid (PHEV) for the first time, will be a husky vehicle. With an electric motor to go along with its 4.4-liter V8 engine, the sedan will weigh in at a hefty 5,390 pounds when it launches during the fourth quarter of 2024.

That makes the new M5 about 1,000 pounds heavier than the 2023 model that preceded it. It also weighs more than trucks like the 2022 Chevrolet Tahoe (5,356 pounds), the 2024 Lucid Air Sapphire (5,336 pounds), and the 2024 Range Rover Sport (5,090 pounds), Motor1 noted today. Unlike Lucid’s EV, though, the M5 can’t blame as much of its heft on the battery, which is only big enough to go 25 miles without using gas.

The new M5 PHEV can go from 0–60mph in 3.4 seconds and tops out at 190mph under gas power if you get BMW’s M Driver’s Package. Using just the electric motor, it can go as fast as about 87mph. By default, the car runs in hybrid mode, using both internal combustion and electric power, with the output ratio of each determined by how the driver configures the car in the M Setup menu. And when the battery gets low, BMW says the engine will start outputting more power to charge it.

BMW Vision Neue Klasse X on the road

Image: BMW

Future BMW M model EVs will use the company’s own internally developed batteries and EV motors, M program boss Franciscus Van Meel recently told Road & Track.

That platform includes new systems to detect and relay sensor data to the car’s central computer, which the M division has been involved in developing. Van Meel said BMW’s EVs equipped with this system, dubbed Heart of Joy, would “react ten times faster than before” to things like wheelspin or locked-up brakes, along with enhancements to stability control, traction control, and overall performance.

Technology

Tech security check: Am I doing enough to keep my computer safe?

Published

14 hours ago

June 26, 2024

Press Room

Tech security check: Am I doing enough to keep my computer safe?

It’s easy to feel overwhelmed by the number of steps you can take to keep yourself and your computer safe and running smoothly. With the increasing number of cybercriminals, it can feel like you are fighting a losing battle. While it is impossible to be 100% effective all the time, creating some routines in your computer’s maintenance can help you feel more secure and at ease.

That’s why I want to highlight Joe from Hainesport, New Jersey, who has a question about routine steps he could take to stay safe and sane: “I don’t like feeling there is ‘clutter’ or malware lurking on my computer simply because I don’t have the knowledge to keep it orderly. I pay for antivirus software and have … free VPN but still am not confident I am doing all that makes for [good] maintenance. Any comments about that statement?”

Joe, I understand your concerns. It’s important to keep your computer clean and secure. We’re glad to hear that you are using an antivirus program and VPN. I’m on a mission to help you be resilient against today’s privacy and security threats. Below are some additional tips to help you enhance your computer’s security and maintain its function.

GET SECURITY ALERTS, EXPERT TIPS – SIGN UP FOR KURT’S NEWSLETTER – THE CYBERGUY REPORT HERE

A woman frustrated by her computer (Kurt “CyberGuy” Knutsson)

How to enhance your computer’s security

Here are five steps to help you enhance your computer’s security:

1) Update your antivirus software regularly

It’s great to install antivirus software on your computer, but it is equally important to update it regularly because it ensures that the software can protect your computer against the latest threats. Antivirus updates contain the latest files needed to combat new viruses and protect your computer. These updates often include the latest list and behavior of known viruses, improvements to the scan engine, and patches for security vulnerabilities in operating systems. Without these updates, your computer would be at risk from new viruses that the outdated antivirus software wouldn’t recognize or be able to defend against. Get my picks for the best 2024 antivirus protection winners for your Windows, Mac, Android and iOS devices.

FREE ANTIVIRUS SOFTWARE: SHOULD YOU USE IT?

2) Scan your computer for malware regularly

There is no use in installing your antivirus if it isn’t actively scanning your computer regularly. Some antivirus software programs can be set up to automatically run on a schedule. If you can’t remember to scan regularly, definitely set up a schedule if your program has that option. If any threats are found when scanning, quarantine or remove them.

Illustration focusing on security on your devices (Kurt “CyberGuy” Knutsson)

HOW TO KNOW IF YOUR COMPUTER GOT HACKED, WHAT TO DO NEXT

3) Update your operating system and applications

If you keep your operating system’s software as well as the applications you regularly use updated, you are less likely to be exposed to certain vulnerabilities. Even if you have set your devices to automatically update, it’s worth forcing a manual update when a security flaw has been patched.

4) Remove unnecessary applications

Older, unused applications take up space on your drive and can pose security threats, especially ones that can no longer be updated to ward against new vulnerabilities. Remove applications from your phone or tablet you haven’t used in a while.

TIDY UP YOUR TECH: TIPS FOR SAFEGUARDING YOUR DATA

5) Use a high quality VPN

A virtual private network (VPN) enhances your digital security by encrypting your internet connection and concealing your IP address. This makes it significantly more challenging for unauthorized parties to intercept your data or track your online activities. However, it’s important to be mindful of the limitations of free VPN services. Here are six reasons why you might want to avoid using a free VPN:

Limited data and speed: Free VPNs often have data caps and slower speeds, hindering your browsing experience.

Security risks: Some free VPNs may not use strong encryption, leaving your data vulnerable.

Privacy concerns: Free VPNs may collect and sell your browsing data to third parties.

Ad intrusions: To support their service, free VPNs might show intrusive ads, which can be annoying and potentially dangerous.

Limited server options: You may have fewer servers to choose from, which can affect your connection’s reliability and speed.

Customer support: Free VPNs typically offer limited customer support, if any.

While no system can guarantee complete invulnerability, these practices can substantially reduce the risk of cyberthreats. Always exercise caution when handling sensitive information on the internet. For the best VPN software, see my expert review of the best VPNs for browsing the web privately on your Windows, Mac, Android and iOS devices.

A woman using a VPN on her laptop (Kurt “CyberGuy” Knutsson)

HOW TO TELL IF YOUR BROWSER HAS BEEN HIJACKED

How to ‘declutter’ your computer

Here are four steps to help you declutter your computer and enhance its operation.

1) Remove old apps

Free up space on your drive and help you find the apps you use most frequently by searching for and removing old apps that you no longer use.

2) Delete unnecessary system files

Deleting unnecessary system files on your PC and Mac is important for several reasons:

Free up disk space: Unnecessary files take up valuable storage space that could be used for other applications or data.
Improve system performance: Too many unused files can slow down your computer’s performance, as they consume resources and make file searches more time-consuming.
Enhance system security: Some of these files could potentially be exploited by malicious software. Removing them reduces this risk.
Maintain system hygiene: Regularly cleaning out unnecessary files helps keep your system organized and makes it easier to manage.

3) Organize your files

Keeping your files and folders organized can make it easier to find what you need and make your computer feel less cluttered. You can also group files within folders by type, which might help you sort through what you need to keep or delete.

4) Regularly clean your inbox

A cluttered inbox can make it harder to find important emails. Regularly delete or archive emails you no longer need. Create filters or flag specific individuals or companies as a priority so that they don’t get lost in the shuffle, deleted accidentally or redirected to your spam or junk folder.

Update antivirus software regularly (Kurt “CyberGuy” Knutsson)

SUBSCRIBE TO KURT’S YOUTUBE CHANNEL FOR QUICK VIDEO TIPS ON HOW TO WORK ALL OF YOUR TECH DEVICES

Have strong antivirus software

Make sure you have strong antivirus software installed on all your devices to safeguard your private information. With strong antivirus protection, you can prevent malware from sneaking in through malicious links, keeping your personal data secure. Additionally, it will alert you to phishing emails and ransomware scams, keeping your digital life secure. Get my picks for the best 2024 antivirus protection winners for your Windows, Mac, Android and iOS devices.

Kurt’s key takeaways

Regularly employing the security and decluttering strategies listed above doesn’t just keep your computer more secure but also keeps your computer running more smoothly and efficiently. While no process is foolproof, utilizing these strategies on a regular basis can give you greater peace of mind and ease of use. If you’re unsure about how to implement any of the strategies, you can look into the more in-depth articles or seek professional help. There is a reason why these professionals exist, and it is always better to be safe than sorry.

Do you feel like you’re doing enough to keep your computer safe and running well? Let us know by writing us at Cyberguy.com/Contact.

For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter.

Ask Kurt a question or let us know what stories you’d like us to cover.

Follow Kurt on his social channels:

Answers to the most asked CyberGuy questions:

Kurt “CyberGuy” Knutsson is an award-winning tech journalist who has a deep love of technology, gear and gadgets that make life better with his contributions for Fox News & FOX Business beginning mornings on “FOX & Friends.” Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.