Ice phishing attacks on Web3 platforms occur because of the lack of awareness among the users.
Human intervention in the cyber world heightened during the pandemic period. Joining the spike were cybersecurity attacks, of which social engineering attacks stood out. Ice-Phishing is one such type of Social Engineering attack.
So, what is Ice-phishing, and how does the attack occur?
Ice Phishing, a term coined by the Microsoft 365 Defender Research Team, targets Web3 blockchain websites that are decentralized platforms with no intermediaries involved.
In an Ice-phishing attack, the cybercriminal performs a social engineering attack that includes typo squatting-fake URL attacks, distribution of free tokens, or plugins to hack out the money from the user’s accounts. The cybercriminals alter the sender’s address on the payment confirmation page and trick the user into signing a transaction. This, in turn, delegates the approval of the user’s tokens to the attacker. Once the approval transaction is signed, submitted, and mined, the attacker can access the funds. This way, cybercriminals get easy access to the user’s token without even intercepting the blockchain.
The cybercriminal injects malware into the system or develops fake wallet software similar to the original where the users will type in their credentials. The attacker will harvest these credentials wherein they get the cryptographic key. This way, the private key is disclosed to the attackers, which sanctions access to crypto coins. Then, they directly transfer funds by changing the sender’s address.
An example of an Ice-Phishing attack is the Badger DAO attack that dates to 2021. Badger DAO, a Decentralized Finance platform (Defi), underwent a loss of 121 million US dollars through an Ice Phishing attack where a malicious code was injected into the application with the help of a compromised API key.
How to mitigate Ice-phishing attacks?
With the broader adoption of Blockchain technology on the horizon, related security threats are rising rapidly. Remember, understanding the threats is the first step in mitigating them.
Blockchain is a highly secured platform with transparency, which helps researchers track and learn about an attack. An ice phishing attack on these secure platforms occurs mainly because of the lack of awareness among the users. Therefore, users must make sure to reassess the sender’s address before signing the transaction. Smart contract auditing needs to be done regularly to identify vulnerabilities and patch them.
