Author: Virus Bulletin - Bewertung: 0x - Views:1
Presented at the VB2023 conference in London, 4 - 6 October 2023.
↓ Slides: N/A
↓ Paper: https://www.virusbulletin.com/uploads/pdf/conference/vb2023/papers/Web3-will-bite-you-in-the-Web-20-exploring-IPFS-threats.pdf
→ Details: https://www.virusbulletin.com/conference/vb2023/abstracts/web3-will-bite-you-web-20-exploring-ipfs-threats/
✪ PRESENTED BY ✪
• Morton Swimmer (Trend Micro)
✪ ABSTRACT ✪
Even though Web3 usage is still tiny compared with Web 2.0, that has not stopped bad actors from misusing some of its technology stack. Without the clear client-server architecture we are used to, the peer-to-peer nature of the storage layer of Web3 is able to fly under the radar and prevent normal methods of content filtering. In this presentation we will dive into IPFS as a technology to understand the idiosyncrasies of it and the ways in which it can be abused. Along the way, we have statistics that document the mounting dangers we have identified, and we will discuss how we can mitigate these.
Objects in IPFS are content-addressed and not location-addressed. For this reason, blocking IP addresses or domains cannot work.We access an IPFS object by asking a distributed hash table to locate someone with a copy of the object we can pull it from in a peer-to-peer manner, not unlike how BitTorrent works. Objects can be both file-like as well as directory-like, making distributed web hosting a reality. But content-addressing, by design, is not mutable, so there exists a mutable addressing scheme as well, called IPNS, that enables a constant 'name' to point to current content. Ensuring that content is well replicated requires the pinning method to be used and that is supported by services like Pinata or FileCoin. For those not willing to run the IPFS daemon, access is also available through a variety of IPFS gateways.
Despite the lacklustre uptake of IPFS for legitimate applications, we have seen a steady increase in phish and malware hosting, which will be discussed in this presentation, as well as why some of the problems for legitimate use of IPFS turn out to be positive for bad actors. We are also seeing increasing support for IPFS in browsers and application platforms, which may lead to increasing legitimate use and therefore greater difficulty in distinguishing bad from good IPFS usage. Further developments of Web3 technology will also be discussed as many may become dangers to our users in the future. Finally, we look at options for blocking malicious IPFS content.
SOCIAL SHARE CARD GENERATOR