Code BGP is a startup that descends from ARTEMIS, a state-of-the-art open source software for accurately detecting and mitigating BGP hijacks in real-time. The founders of Code BGP are among the researchers who showed for the first time that BGP hijacks can be accurately detected and mitigated within a few seconds from their origination. The ARTEMIS software was released in Dec 2018 and is presently used by some of the largest Internet Service Providers to protect their networks from BGP hijacks. Code BGP was founded to provide commercial-grade solutions at scale for network operators worldwide. We focus specifically on BGP security, visibility, and automation. Our mission is to provide highly innovative solutions that simplify BGP operations based on open source and proprietary software, making the Internet more robust and efficient. We aspire to disrupt the BGP security, visibility and automation landscape.

Code BGP

The internet is huge. The number of is approximately 200 million, with more than 250,000 new sites being added every day. The number of is approximately 5 million. With that much activity, it takes a lot to send internet traffic to its destination. That is where BGP comes in. active websites internet users BGP, which stands for Border Gateway Protocol, is a routing protocol. As with any network protocol, it supplies the rules that determine how routers operate. Basically, routing protocols direct traffic. BGP is the routing protocol that directs traffic on the internet, getting your internet traffic to its final destination. Directing traffic A router is essentially a type of computer that is designed specifically to direct network traffic. It uses numerous “network cards” to provide numerous network interfaces. The router’s job is to build a map of the network and use it to guide traffic. Incoming traffic is told which interfaces provide connections to the desired destinations. Routers are critical for ensuring that information on the network successfully gets to its destination. Because the internet is an ever-changing landscape, static routes are not the most reliable routes for getting from Point A to Point B. Dynamic routes are a much better option. Anyone who has ever used a mapping app knows how this works; the app gives you a route to get to your destination, but continuously monitors the traffic on that route. If something blocks the route, like an accident or construction activity, you are rerouted. If the app provided a static, unchanging route, rather than a dynamic route, you would find yourself sitting in traffic until the route was unblocked. Routing protocols are the tools that help routers build a map of the network in a dynamic manner. They give routers the ability to reroute in order to optimize traffic. If you have a static route from one location to another and something interrupts the route, you are stuck. By adding a dynamic routing protocol, you improve the availability and performance of your systems. The basics of BGP There are two kinds of routing protocols: interior gateway and exterior gateway. Interior gateway routing protocols are used for an organization’s internal network traffic. Interior Gateway protocols are usually either (OSPF), Enhanced Interior Gateway Routing Protocol (EIGRP), or intermediate systems to intermediate systems. Exterior gateway routing protocols are used by an organization that wants to connect with an external organization. BGP is designed to connect external organizations. Open Shortest Path First BGP fundamentals BGP operates using Transmission Control Protocol (TCP) port 179. BGP is a unicast protocol and forms a TCP connection to its peers. This means BGP peers must be manually assigned.  Almost every other routing protocol is multicast, which involves a router sending a “hello” to every other router to establish an adjacency. It is important to remember that BGP uses TCP port 179, especially if you are using a firewall. If BGP is traversing a firewall that does not allow TCP port 179, your BGP session will never be established. Also, if you are studying for any AWS certification or networking certification, be prepared for an exam question about BGP and TCP port 179. Why we use BGP We use BGP due to its scalability and tunability. BGP is incredibly scalable and can handle an incredible number of routes. Additionally, BGP can be used for traffic engineering due to its tunability. To understand how valuable this is, consider a typical router running BGP at an internet service provider. Often, there are routers connecting to 10 or more Internet service providers. Each internet service provider can provide 800,000 plus routes. This means BGP can scale into millions of routes, which is why organizations use it. Even organizations like AWS or Google, which have hundreds of thousands of clients, use BGP to connect to their customers. They use it because of its scalability and tunability. Understanding BGP messages BGP routers communicate with each other using a set of predefined messages. These messages are used to establish connections, inform BGP routers of new routing information, and signal BGP peers if something goes wrong. It is the BGP messages that enable BGP to provide dynamic routing information. “Open messages” are sent when a is established. These help to identify the connecting networks by providing a unique autonomous system (AS) number. They also establish the version of BGP that is being used. TCP connection “Keep alive messages” are sent to verify that a BGP peer is healthy, similar to a health check. I like to imagine we have the routers asking each other, “Are you there?” If the “keep alive” message does not get sent or received, the non-responsive router gets removed from the map, the session is torn down, and the routes are updated. “Update messages” are used to share information about routing updates. As one network establishes a new route or learns that an old route is no longer operational, it shares the update with other networks. An update message provides information including the prefix or the subnet that you were trying to reach, path attributes, your next hop, and your AS path. “Notification messages” alert the network that something has gone wrong. A notification message is not something you hope to receive. Generally, it indicates that a BGP session must be closed. BGP neighbor relationships The purpose of BGP is to establish a neighbor relationship, which is a connection with neighboring routers. BGP keeps track of the status of the connection that it has with neighboring routers, which are referred to as peers, by using a Finite State Machine. These connections can exist in one of a number of states. Understanding these various states is especially important when a connection goes down and troubleshooting must be done. “Idle state” is used to describe a BGP router that is waiting for a TCP session to come up. When things go wrong, BGP routers revert to an idle state. If a router was connected and suddenly went into an idle state, it is a sign that something has gone wrong. When a router is forming a connection, it is in a “connect state.” If the connection is not made, the router goes to an “active state,” in which it will retry making the connection. If the reattempt to connect fails, the router will go back to an idle state. When the connection is going well, connect state will transition to an “open sent state.” This occurs when the open message has been sent to the neighboring router and the router is awaiting a response. Once the response is received, the router transitions to “open confirm state.” At this point, the router sends a “keep alive” message and enters an “established state.” When you achieve an established state, you know your BGP neighbor relationship is good. Messages are going to be exchanged and routes will be kept dynamic. If the TCP session gets torn down for some reason at any point along the way, the connection will revert back to an idle state. BGP attributes As BGP seeks to provide the best routes, it looks at a number of attributes that describe the routes. By assessing these, it can determine which routes are most reliable and which should be avoided. Origin, which describes the source of information on the route, is one of these attributes. If, for example, the route was learned via an internal gateway protocol, like OSPF, it will be seen as more reliable than a route that is learned via an external gateway protocol like BGP. Routes for which the origin information is incomplete are always seen as last resorts. Because BGP is a path vector routing project, it will report the number of autonomous systems it has traversed as part of its route. Connecting to each new AS requires what is known as an AS path. Generally speaking, routers prefer the shorter path or the path with the least number of AS hops. is another attribute that is important for routing. This refers to the IP address of the routers that provided the routing update. If the next hop is not reachable, the route will not appear in the routing table. Next hop Weight is also an attribute that plays into BGP routing. Weight was originally a Cisco proprietary attribute that was used to influence outbound traffic. Now, it is supported by AWS and other organizations. Basically, the higher the weight of a route, the more routers prefer it. All of these components come together in the process that BGP uses to select routes. BGP prefers the path with the largest weight. If the weights are equal, it prefers the route with the highest local preference. If the local preferences are the same, it prefers the route with the shortest AS path. And if the AS path is the same, it prefers the paths with the lowest origin code. If BGP gets to origin codes and still finds routes to be equal, it looks to other attributes including multi-exit discriminators, next hops, and IP addresses. Ultimately, BGP uses these attributes to keep traffic on the most reliable routes. Tuning BGP Optimizing network traffic will sometimes require tuning BGP. In general, this involves tweaking BGP attributes in a way that elevates one routing option above another. Tuning BGP is a task that network engineers and architects are often called upon to manage. Adjusting the weight of a route is one way to tune BGP. By increasing the weight of a specific route, you signal to BGP that it should prefer that route. Raising the local preference is another way to indicate that a route should be preferred for traffic, as is lowering the multi-exit discriminator. Because AS path is a factor that BGP uses for selecting routes, tuning that attribute can also influence route selection. By prepending, or adding another AS path, to the route, you add more hops to the AS path, making it less desirable as a route and influencing BGP to select other options. Keeping the internet flowing is no small task. A tool like BGP makes it much more manageable. By providing a scalable and tunable protocol, BGP gives technology professionals the ability to engineer solutions that grow with the internet and respond to changing needs as they arise.

BGP – What It Is and Why People are So Consumed with this Protocol

93 Stories To Learn About Networking

Let's learn about via these 59 free stories. They are ordered by most time reading created on HackerNoon. Visit the to find the most read stories about any technology. Network Security /Learn Repo 1. Top Open Source Vulnerabilities to Watch Out Open Source packages are a mainstay for most software engineering projects. We are so accustomed as developers to run our (for Node developers) or npm install 2. Network Security: Things Most People Don’t Think About There are a lot of things most people do not think about that can dramatically increase the level of security on a network 3. 3 Key Takeaways from Biden’s Cybersecurity Executive Order Learn more about the consequences of Biden's Executive Order on Improving the Nation’s Cybersecurity on software vendors and government contractors. 4. Replicate PostgreSQL Databases Using async Python and RabbitMQ for High Availability PostgreSQL replication using python and RabbitMQ for providing your database server with High Availability by easily making replicas of your master server. 5. 8 Cybersecurity Tips Small Businesses Should Know Cyberattacks do not discriminate between industries, and no matter how big or tiny your organization is, it is vulnerable to them. 6. Your Wi-Fi Cameras may be getting Attacked Your Wi-Fi security cameras are probably not secure.  See how we disable our camera network with a simple DoS attack. 7. How DevOps Killed WAF Web Application Firewalls have been a key part of cybersecurity that are facing obsolencence thanks to the significant labour costs associated with WAFs. 8. Cracking the SANS GSEC Certification The SANS GIAC Security Essentials (GSEC) certification is for anyone working in the field of Information Security. 9. Top Signs that Indicate You Are About To Suffer a Cyber Breach There are few things worse than being told that your business’s security has been compromised. Organizations might not know that a security breach is taking place, or has been for some time. Yet, risk mitigation and technical safeguards are always getting better. 10. Why Network Security is an Integral Part of Any Internet-Connected Business Network security is vital for any internet-connected company. Without it, hackers can steal all the data the business has. Bad network security causes problems 11. Man In The Middle Attack Using Bettercap Framework Man-in-the-middle attack (MITM) is an attack where the attacker secretly relays and possibly alters the communications between two devices who believe that they are directly communicating with each other. In order to perform man in the middle attack, we need to be in the same network as our victim because we have to fool these two devices. Now lets initiate the attack by running our tools which is bettercap. To run bettercap we can simply open up terminal and type bettercap -iface [your network interface which connected to the network]. To know which network interface is used we can simply type ifconfig and here is what it shows us. 12. 4 Reasons To Learn Ethical Hacking In the digital world, cybersecurity and ethical hacking are arising as promising career options for IT professionals. 13. 5 Types of Cyber Security and Why It’s Important to be Aware of Them Cybersecurity is the process of protecting systems, networks, and programs from malicious attacks. But why is it important? Let’s find out. 14. An Introduction to Malware Analysis Malicious software (Malware) are either programs or files that are intended to cause harm to a system and thereby its user. 15. How I Created a Zero Trust Overlay Network in my Home Enabling a secure home automation experience, by creating a zero trust overlay network to access #HomeAssistant. 16. Fighting the Hydra of DDoS Attacks (Spoiler: They Got Worse) Interview with Link11 regarding their new DDoS report -- the state of DDoS attacks. 17. Do I Need A Degree To Become A Cybersecurity Professional? Do you need a degree to get started in cybersecurity? And do you need a degree to progress in cybersecurity? The answer is both yes and no. 18. DNS Queries Explained DNS is a topic often considered difficult to understand, but the basic workings are actually not hard to grasp. The first fundamental point to grasp is that every domain in existence is linked to an Internet Protocol (IP) address. 19. Why 5G Security Will Suffer From 4G Vulnerabilities The fifth generation of mobile communication networks isn’t on its way; it's  already here. You’ve probably heard plenty about 5G in the past few years, as this promising new generation of wireless technology is what’s enabling the continued spread of the internet of things and a host of other digital innovations. Virtually all tech experts agree that 5G technology is a good thing, given that it will lead to faster connectivity and more secure networks. However, there are good reasons to believe that the staggered deployment of 5G technology will mean that it remains vulnerable to a number of security woes currently plaguing 4G technology. 20. How to Make a Malicious USB Device and Have Some Harmless Fun Make an inexpensive BadUSB from an old USB drive and learn about Windows shortcut files and how malicious actors are using .lnk files to spread malware. 21. Getting started with NMAP (Network Mapper) “The quieter you become the more you are able to hear” 22. RBAC and PSPs Can Only Bring Your Kubernetes Security So Far Admins need to defend their organizations against a Kubernetes security incident. RBAC and PSPs will only get them so far; more security measures are needed. 23. Your Ultimate Guide To The 4 Types of IT Security IT Security protects your business against cyber threats. There are four types of IT Security: network security, end-point security, internet & cloud security. 24. Reference Architecture for Network Secured Azure Web App Cloud solution architecture of Azure hosted web application from Network Security perspective using Azure App Service, Azure SQL using Private Endpoints 25. Network Security vs. Cybersecurity: What's the Difference? While network security is a separate and important subset, cybersecurity covers a broader whole in terms of security. 26. Meet the Writer: HackerNoon Contributor Jessica Truong Talks Cybersecurity Meet Jessica! She is a Cybersecurity enthusiast whose goal is to educate readers of the different topics within Cybersecurity. Check out her HN page for more! 27. What is Subdomain Hijacking and How to Prevent it? Subdomain takeover or subdomain hijacking refers to a technique by which "unused" subdomains can be made to point to a location of the attacker's choice. 28. How to Protect Your Company's VPN When You Have a Remote Team Prevent malicious agents from exploiting their VPN connections! However, it's still critical for each employee to exercise cyber hygiene to ensure cybersecurity 29. Firewall Configuration: 6 Best Practices to Secure a Business Network Business success relies on network security. Here are six best practices to secure a business network. 30. IT Security: How to Deal With The Insider Threat A study by the Wall Street Journal found that almost 70% of companies admitted concern about violent employees! While workers continue to be a major security ri 31. Startup Interview with Tracie Thompson, HackHunter CEO HackHunter was nominated as one of the best startups in Docklands, Australia in in HackerNoon’s Startup of the Year. This is interview with their CEO. 32. Improve Kubernetes Network Security with Cilium This article will show how to, using Cilium, tackle the authorization concern and move to push it to the underlying platform from the application code. 33. Network Scanner Working and Implementation In this blog, we will see how a network mapper works and how we can implement these network security tools in Python for our cybersecurity related projects 34. 5 Popular Types of Penetration Testing for SaaS Businesses If you are running a SaaS business, you know that security is everything. Nowadays, we can see many different cyberattacks and their variants targeting SaaS. 35. Life-Changing Facts About Apple’s iOS Security Architecture Introduction to Apple platform security: 36. Best Practices for API Security APIs are a cohort of communication protocol that allows applications to communicate with one another. It works over the OS limitations and enables applications to share data without more complexities. And it is the magic bridge that possibly making things work together in our mobile applications and web interfaces. Yet, its open doors and wide visibility makes it vulnerable to attacks. Also, attackers can easily find the way to the heart of applications and systems via APIs. Hence it is essential to fence APIs with all possible measures. 37. Cybersecurity Basics, Tech Education and Market Review Cybersecurity is the protection against cyberattacks from devices linked to the Internet, such as hardware, computer software and data. 38. An Unboring Guide to Endpoint Detection and Response (EDR) EDR solutions detect, investigate & eliminate threats as quickly as possible. It generates alerts to notify security professionals so that they can investigate. 39. IoT Matters in 2021: IoT-Enabled Smart Office Automation to Work and Collect Data Human-Free An engineering approach to building IoT software like smart office ecosystem and IoT security concerns for smart office applications. 40. An Introduction to Layer 3 Switches In today's complex business networks that comprise many virtual LAN's and subnets, a Layer 3 switch plays an important role in many systems. But do you need this on your network? Let's see. 41. How to Improve Network Security and Visibility in 2020 and 2021 With the number of products available, it can be an uphill task to try to ensure robust network security and visibility. This, however, is a task that must be accomplished if you want to be competitive. 42. An Introductory Guide to Hacking NETBIOS When a hacker spots a system with open ports supporting NetBios, the hopes go high! Let's start by understanding the the nitty-gritty of NETBIOS. 43. Why OpenTelemetry Should Matter to Network and Systems Admins OpenTelemetry is young, even by internet standards. Born out of the merger of OpenTracing and OpenCensus projects at the Cloud Native Computing Foundation CNCF 44. Network Security 101: Everything You Need to Know Network Security is Vital. Its purpose is to prevent unauthorized users from accessing an organization's network and devices. It is intended to keep data safe. 45. Are VPNs Really Safe? Virtual Private Network (VPN) cloaks your online identity, and shielding your data from prying eyes. 46. Identify Wechat's TxBugReport File on your PC Through These Simple Steps In this post, we will learn easy steps to turn off the txbugreport.exe process running in your Computer and occupying more memory and prevent this .exe file from sending automated bug reports to Tencent Computer Systems. 47. How to Be Careful When Sharing WiFi Password With QR Code Share your QR code of your network carefully, mistakes can lead to disaster 48. Understanding What Security Testing Is & Its Importance with The Top Tools and Key Principles In this article, we will explore what security testing is, the top tools for security testing, and the key principles of security testing. 49. PoW Shield: An Application Layer Proof of Work DDoS Filter PoW Shield provides DDoS protection on the OSI application layer by authenticating traffic using a simple proof-of-work validation process. 50. Discovering 10 Cybersecurity Practices for Enhanced IT Infrastructure Protection The need to have secure IT Infrastructure is common for all companies worldwide. Learn the best cybersecurity practices to get yourself protected from hacking. 51. Understanding & Recognizing Different Cyber Threats: What to Look Out For This article will dive into understanding & recognizing some cyber threats. It will not cover every example for each attack or every attack. 52. Network Security Basics Ever since the creation of the internet with all of the good that it has brought to the table came the bad as well. In the age of information technology, an unsecured product is a surefire way to numerous issues. A company, which creates a product has to make sure both the software and the network security features of it are as robust as possible. In the previous article we discussed application security, however, it is never complete without a clear network safeguards to serve as a frontline against malicious users trying to exploit the system. But what is network security and what are some of the methods used to protect systems? 53. What is BGP Hijacking and How Do You Prevent It? BGP, which stands for Border Gateway Protocol, is a path vector routing protocol that is used to connect external organizations to each other. 54. What Are The Cybersecurity Risks Associated With Personal Devices? Let's look at some of the most significant risks posed by your personal digital devices, and what we can do to boost your security. 55. 5 Best Free Proxy Servers To Visit Sites Anonymously In 2020 A proxy server will assist you to mask your identity on the web. Perhaps you wish to access suspicious websites, bypass net censorship in your country or on your office/school network having a proxy website among your reach is very important. 56. Enterprise Cloud Security: Setting Up Structure, Identity-Based Access, and Network Control Security plays an important role in the Enterprise Cloud Foundation. This article covers the foundational security components that form the cloud foundation. 57. Top Penetration Testing Tools for Professionals Looking for penetration testing tools, which is good. Here is the list of some best tools with comparison. Check out this post. 58. WTF is Internet Of Bio Nano Things (IoBNT) and How Secure Is It? Internet of Bio-Nano Things (IoBNT) is a domain where biochemical processes inside the human body communicate the cyber world of the internet. IoBNT paradigm st 59. 7 Ways to Protect Your Router From Hackers Since we are in the modern technological era, the internet has become an indispensable tool in our modern-day life. As we speak, we need it to communicate, work online, learn online and even do business online. When it comes to internet connectivity, there are many ways to get internet in your home. One of the best ways to access the internet at home or workplace is by investing in a router. With this device in place, you will be able to create a home network that can be used by wireless devices such as smart TVs, home appliances, IP cameras, and so much more. Thank you for checking out the 59 most read stories about Network Security on HackerNoon. to find the most read stories about any technology. Visit the /Learn Repo

59 Stories To Learn About Network Security

132 Stories To Learn About Information Security

Let's learn about via these 61 free stories. They are ordered by most time reading created on HackerNoon. Visit the to find the most read stories about any technology. Scalability /Learn Repo 1. Decentralized Storage and Data Privacy for Developers Arcana Network runs on its blockchain, independent of a large centralized entity. have no central storage. Data Privacy on the blockchain. 2. Subnets are Solving the Crypto Scalability Problem The crypto industry has run into serious scalability issues. But subnets provide the best possible answer to resolve it once and for all. 3. Blockchain Field Review - What We Should Expect in 2020? The year 2019 is coming to an end, and the blockchain hype seems to be slowly dying as well as the crypto bubble. But is it really dead or maybe now it has to offer even more than it had in 2017 when the total market capitalization of crypto was near $800 billion? In reality, it was something like a great purge for many unprofessional projects. Without investors throwing money at them, they died, like dotcom bubble projects before them. The general audience begins to understand that the blockchain technology isn't something that makes everything it's applied to revolutionary. It has its own applications, where it can shine, such as finances and supply chains, but also there can be many occasions where blockchain is totally unnecessary. For example, maybe creating a decentralized network for dentists isn’t such a good idea? 4. Building Strategic Partnerships: A 5-Step Guide for Early Stage Startups Entering into strategic partnerships in the early stages of your startup can often do more for your brand than an outright acquisition. 5. Why Should Every Javascript Developer Avoid Using if Statements Stop using if statements unless absolutely necessary. Using if statement is a clunky way of writing code and should be avoided wherever possible. 6. We Built The World's Largest Real time High-Frequency, Low Latency Streaming System on Golang The evolution, failures and design decisions behind one of the world’s largest real-time, high-frequency and low-latency streaming systems. 7. Why do you need a Virtual Server? Explained In this article, you will learn why you need to migrate from a physical server to a virtual one. 8. How To Use Amazon API Gateway to Decouple and Scale Serverless Architectures One of the benefits of Serverless architectures is the possibility of scaling applications without worrying about load balancers and clusters of servers. While services like AWS Lambda hold their promises on this area, there are usually misconceptions about how they work. 9. Five Guidelines for Robust Logging This article describes best practices for standardized logging from the point of view of performance, debuggability, and security. 10. What is Cloud Scalability? Benefits, When and How to Use In cloud computing, cloud scalability refers to the ability of increasing or decreasing the IT resources to meet changing needs. Scalability is an element of the cloud and is the main driver of its popularity in the business sector. 11. Auto Scaling in Cloud Computing with AWS: Top 4 Advantages In this article I have mentioned what auto-scaling is all about and what benefits it holds in a cloud computing environment, especially with respect to Amazon. 12. How to Evangelize a Programming Language In today’s IT world, there is a vast array of programming languages fighting for mind share and market share. Of course, there are the mainstays like Python, JavaScript, Java, C#, and C++. But nipping at their heels are many recent entries in the programming language Hunger Games such as Clojure, Crystal, Dart, Elixir, F#, Haxe, Julia, Kotlin, Nim, Pharo, Rust, TypeScript, etc. There are even a few not-so-new languages like Haskell (1990), Lua (1993), OCaml (1996), and Racket (1994). And they all want to grab your attention and convince you that they’re the road to programming bliss. 13. Common Design Patterns for Building Resilient Systems (Retries & Circuit Breakers) We talk about two design patterns that highlight best practices for building resilient microservices architectures at scale. 14. Privacy Scales Better: Understanding Zcash, Zero Knowledge Proofs (zKP) & Electric Coin Company innovations at the ECC show not only  that Privacy and Scalability are correlated but also that Governance and Development is more fruitful when rewarded. 15. Will Solving Scalability make Crypto Transactions Faster? Not Really The issue of scalability first became apparent in 2017 or so when Bitcoin started to be very actively transacted through the blockchain as it was getting much more traction due to the sudden uptick in price. 16. The ABCs of Building Reliable, Scalable, and Maintainable Web Applications - Scalability Build scalable, reliable, and maintainable applications. Understand basics of scalability with focus on performance and load, vertical and horizontal scaling! 17. What is BGP Hijacking and How Do You Prevent It? BGP, which stands for Border Gateway Protocol, is a path vector routing protocol that is used to connect external organizations to each other. 18. The Real-World Benefits of Elastic Computing with Low-Code As we move into the cloud computing era, we've seen the floodgates open and waves of new development frameworks taking advantage of every opportunity that cloud computing technologies offer. 19. What Are Conflict-free Replicated Data Types (CRDTs)? In a world where most of the apps that we use on the internet are collaborative in nature, conflicts in data are common. Is there a way to avoid it? 20. How The Cloud Turned IT Outsourcing On Its Head In my previous article I interviewed Michael to discover just how a decentralized virtual private network might work. This time around, I wanted to learn what the cloud meant for IT professionals like himself: what their work was like before it became an everyday tool, and how they could describe its impact. 21. Data Mesh concept - buzzzzz or not? What is the recently popular data mesh concept and its benefits? 22. GPU Computing for Machine Learning By taking advantage of the parallel computing capabilities of GPUs, a significant decrease in computational time can be achieved relative to traditional CPU 23. How to Choose the Right Real-Time Communication Approach: Long Polling vs Redis Pub/Sub Real-time communication is essential for modern web applications that require fast data exchange between clients and servers. 24. Advantages of Using Windows VPS Hosting for Businesses Over the past few years, companies have been provided various web hosting solutions for their business, leaving them with the question of what to choose. 25. 9 Web Hosting Tips You Should Know Before Choosing a Dedicated Server Choosing a dedicated server can be one of the toughest decisions for small businesses. Do you want to invest in dedicated servers as soon as possible? 26. Subnets For Blockchain Scalability: Avalanche vs Internet Computer Subnets are a novel blockchain architecture innovation that the Avalanche and Internet Computer blockchains employ. 27. Understanding the Directions of Technical Data Platforms Scalability In this blog we’ll evaluate the direction of scalability and the tradeoffs you might encounter in the decision process. 28. Getting started with Distributed SQL 29. The Volatility Opportunity: Turning Risks Into Rewards With High-Profile Clients Want your tech company to be recession-proof? Diversifying your client base and offering exceptional service can build antifragility into your organization. 30. DynamoDB Key Partition Strategies for SaaS When using Amazon DynamoDB, you need to know how to effectively partition the tenant data in order to prevent performance bottlenecks as the application scales. 31. Starting Web Development? Remember These 5 Things Originally I shared this story to Syndicode blog, and now I'm making a summary with small additions. 32. 4 Ways to Grow Your Business Without Hiring Growing a company is tough, and it can become even more difficult if entrepreneurs don’t ask the right questions. 33. How to Enable MariaDB Replication: A Guide To set up replication for a new fresh MariaDB server, you can just enable the binary log in the primary and configure the connection in the replica. 34. Why You Should Move Your Corporate Infrastructure to Cloud Find out what benefits and opportunities you will get by moving your corporate infrastructure to the cloud. 35. 5 Key Load Balancer Performance Metrics You Should Track In this blog, I have mentioned top load balancer metrics that can help you to ensure that your web application is running smoothly. 36. Let's Go! 5 Use Cases When You Need Golang for Your Tech Project Reveal why there is hype around Golang and describe the best application variants for this programming language as well as cases when Go is not the best choice. 37. Grin Coin, the Private and Lightweight Mimblewimble Implementation A community focused project based on the Mimblewimble protocol 38. Garbage Collection in Erlang Helps Create Scalable Applications How garbage collection in Erlang can help you to create scalable applications 39. Break Free From the Work-to-Earn Chains, Help-to-Earn Supports Play-to-Earn Play-to-Earn needs support to overcome some major obstacles before it can become truly sustainable as a web3 business model that helps players generate income. 40. How Stream Processing Makes Your Event-Driven Architecture Better If you’re an architect or developer looking at event-driven architectures, stream processing might be just what you need to make your app faster, more scalable, and more decoupled. 41. Understanding The Block Propagation Problem in Blockchains The lack of scalability is known to be the foremost obstacle standing in the way of mass adoption of blockchain technology. All existing blockchain projects look for solutions that could improve the performance of their network. 42. Circuit Breakers in Microservices The circuit breaker is a design pattern, used extensively in distributed systems to prevent cascading failures. In this post, we’ll go through the problem of cascading failures and go over how the circuit breaker pattern is used. 43. Scale Your Microservices with an Easy Message Queue on Redis If you’re a microservices developer considering communication protocols, choosing an event-driven architecture might just help you rest a little easier at night. With the right design, event-driven architecture can help you to create apps that are decoupled and asynchronous, giving you the major benefits of your app being both performant and easily scalable. 44. Things to Consider When You are Building a SaaS Product From Scratch SaaS is not a buzzword in 2019! It's a proven, efficient and most widely used model to deliver software to customers. SaaS stands for software as a service, which means the software is delivered as a continuous service over the web/internet where the customer doesn't have to download and install the product on his system. Examples of popular SaaS products include Zoho, Salesforce, Mailchimp, Twilio, etc. 45. How To Use Modzy API for your ML Project Today’s world of machine learning (ML) and artificial intelligence (AI) presents a variety of challenges to organizations, particularly when it comes to product 46. Amazon API Gateway Vs. Application Load Balancer We recently wrote about whether API Gateway can act as a Load Balancer. The answer is yes and, in many cases, they are substitutes for each other. But how should we choose which one to use? 47. Is Layer 2 Scaling for Blockchains Living up to Its Promise? As crypto-mania approached its peak in 2017, it seemed like every project was striving to build the latest, greatest blockchain platform, resulting in rafts of mainnet launches in 2018. The reality is that many of those projects have struggled to survive. They’re competing for a limited pool of developers and see little activity beyond a few underused dApps. 48. Build Scalable Products by Coding for Future Feature Expansion How to build scalable products by coding for future feature expansion & code deprecation while maintaining a simplified user interface for complex functionality 49. How to Choose the Best CMS Architecture for Your Business Regardless of how great your content is, if you have the wrong CMS, your content won’t make even an ounce of impact on your customers. 50. Are You Behind on Cloud Migration? The cloud is quickly becoming the standard for IT operations. However, concerns still keep some businesses from making that transition. 51. 10 Steps To Digital Transformation While Simultaneously Cutting Costs Companies Must Transform Or Else (Photo by eelnosiva on Adobe) 52. Harnessing the Growth of Digital Agencies A look at how small businesses can scale quickly and relatively cheaply by using digital methods for marketing and other such technologies to their advantage. 53. The Aftermath of Going Enterprise Factors to consider in scaling your enterprise solution: the do's , the don'ts and the maybe. 54. Exploring Taiwanese Start Up Culture Following our hiring survey for Taiwan startups, this story discusses how local companies find talent, and the importance of employer branding for scalability. 55. Examining The Blockchain Trilemma In the interview I made last year, I asked a leading cryptocurrency expert Andreas M. Antonopoulos, about whether someone could solve the so-called Blockchain Trilemma – scalability and security without sacrificing
decentralization in the future. [56. Scaling Ethereum Blockchain Applications via Altcoins and Chain Solutions](https://hackernoon.com/scaling-ethereum-blockchain-applications-via-altcoins-and-chain-solutions-cv1k34jl) As you may know, there are differences between horizontal and vertical scaling in distributed systems which we have covered in another article (Horizontal Scaling versus Vertical Scaling in Distributed Systems). So in this article, we take a next step by learning how to scale up Ethereum blockchain applications.  We will also review different scaling solutions for Ethereum blockchain applications. To follow and understand concepts discussed in this article, we are assuming you’ve a basic understanding of blockchain technology and Ethereum. 57. How to do Database Read/Write Splitting With Your Browser A tutorial that explains how a database proxy like MariaDB MaxScale serves as a transparent read/write splitter that scales SQL queries. 58. Treat SaaS As A Business Model! Andreessen Horowitz: ‘’Software Is Eating the World’’ 59. How to Build A Well Structured 3-tier Architecture (MERN Stack - ES6) [Step-by-Step Guide] This project serves as a guide/template for a 3-tier architecture. If you are entirely new to Web Development. I highly suggest you watch this video first. 60. If You Learn to Build Scalable Applications, You Can Change Your Career What we're up to 61. The Results Are In - Public Testing of the Solutions for Privacy and Scalability in Ethereum Blockchain (decentralized ledger) is an innovative technology that promises to improve many diverse areas of human life. It transfers real-life processes and products into the digital space, ensures the speed and reliability of financial operations and reduces their cost, and allows for the creation of advanced DAPP applications by using smart contracts in decentralized networks. Thank you for checking out the 61 most read stories about Scalability on HackerNoon. to find the most read stories about any technology. Visit the /Learn Repo

61 Stories To Learn About Scalability

I sometimes surprise fellow technologists when I tell them that a successful digital payments company we built runs on . FreeBSD It’s not that they haven’t heard of FreeBSD—the open source operating system turns 30 this year, after all. Rather, it’s that they hadn’t previously thought of FreeBSD as an enterprise OS. But that’s exactly what it is and how we use it: FreeBSD is a critical enterprise-grade OS that is on par with—and in some ways surpasses—other operating systems when working in enterprise environments. I’ve been a FreeBSD user for 16 years now. Like many others, I got started as a hobbyist. I’d been working with various OSes in enterprise environments, mostly in the payments industry, and getting frustrated with some of the drawbacks of other well-known options: random error codes, endless support tickets, black boxes. A colleague tipped me off to FreeBSD, and I immediately loved it for its simplicity and capabilities. We rebuilt that company on the FreeBSD stack and the project was highly successful. When we launched our digital payments company, we built it on FreeBSD and never looked back; it is still our OS of choice today. We have nearly 60 servers running across two different U.S. data centers. We run on an active-active architecture, with our own IPV4 blocks that we Anycast. We operate several highly segmented VLANs for isolation and security purposes. And we do all of this with FreeBSD. One reason this surprises some people is that, as a payments company, we handle millions of credit card and bank account numbers. To put it in simple terms: a data breach would be extraordinarily bad for us. We do intensive pen testing and vulnerability scanning on a daily basis to make sure we’re as strong as possible. We regularly undergo security and compliance assessments, which we pass with flying colors. And in the process, I’ve spent many hours talking with auditors, InfoSec pros, CIOs, CISSPs, and others in the industry to make the business case for FreeBSD and teach with them what we’ve learned first-hand: FreeBSD is a remarkably powerful, reliable enterprise OS that can stand up to the most stringent security standards and regulatory scrutiny. Below, I’ll unpack five fundamentals behind why FreeBSD is our enterprise OS of choice—which can double as five fundamentals for making the business case for FreeBSD in your own organization. Using FreeBSD as an enterprise OS: 5 things to know Security & Stability One of the best features of FreeBSD—along with all of the products in its ecosystem—is that it’s a completely free and open source project. Historically, open source sometimes got a bad rap in enterprise environments, but that is changing as IT pros recognize that, when properly configured and managed, open source software can be just as secure (or even more so) than proprietary code. A key reason for this is that open source eliminates all of the black boxes. You can look under the hood and see everything that is going on; there are no mysteries. Even more importantly, there are lots of eyes on the code, which means issues tend to be discovered and mitigated much faster, especially where there is a longstanding, engaged community around the project (like there is with FreeBSD). Moreover, I’ve never seen another OS that has such a consistent behavior from release-and-patch cycle to release-and-patch cycle. With FreeBSD, we never encounter the common scenario where you install an update or new version and, suddenly, a bunch of tools stop working because an underlying library changed. FreeBSD’s base install also runs a very minimal set of services that are exposed to the outside world, which supports the many security frameworks that emphasize zero-trust or least-privilege principles by only running what is actually necessary. It’s easy to add what you need, while not needing to worry about uninstalling or disabling a bunch of things that you don’t. Similarly, it’s very easy to tune and configure everything from how your network stack runs to how your intrusion detection runs and more. The documentation is great; again, no black boxes or endless support tickets. The open source nature also helps deliver excellent performance, minimizing calls and other potential drags on your environment. Finally, from a security and stability standpoint, there’s separation between that base OS and everything else that gets installed on that OS. High Availability High availability (HA) is a hot topic and an increasingly common requirement in many sectors. In the past, I’d never been able to actually achieve it with other OSes without purchasing expensive firewalls and routing equipment. We built our active-active, multi-homed, Anycast-ed environment more or less using out-of-the-box FreeBSD. Even our firewalls are FreeBSD. The only third-party application we’ve had to add is BIRD for BGP routing. After two years, we have had zero downtime. We’ve load-tested the current configuration to 20,000 concurrent credit card transactions – and that didn’t even stretch the platform to its outer limits. And we’ve done this essentially with simple hardware and out-of-the-box FreeBSD. Patching This is probably one of the most compelling reasons to consider using FreeBSD in an enterprise environment—and one of my favorite aspects to talk about as a result. I am regularly asked some version of the question: “Wait, you’re using FreeBSD as the OS for running a firewall?” And my answer is always: “Yes, absolutely.” The reality is that a lot of auditing and assessment firms and CISSPs are used to seeing the brand-name OSes. There’s nothing wrong with that, per se, but I like to share my belief that many of those platforms are using a lot of open source—like FreeBSD and its PF firewall—under the hood. They’re wrapping their own UI and code around it, of course, but essentially it’s the same thing we do on our own. And what happens is that when we run things like pkg audit nightly to check our systems against CVEs and other known issues, we can patch those vulnerabilities much faster than would be possible if we had to wait on a commercial OS vendor. When a vulnerability becomes known, we have a fresh, patched build up and running soon after. Configuration Management Nobody loves the mysterious checkbox UI style of configuration management. It’s another form of black box, in that you don’t really know what’s going on in the background. For this reason, I love the simplicity of configuring FreeBSD. It’s all flat files. You don’t have to log into a UI to make changes. FreeBSD’s file-based configuration arms you with a persuasive case in terms of security and auditing because it creates a simple but powerful change management system. Just about any security and assessment framework requires some type of change management process in place. File-based configuration makes it simple to GIF those file configurations, or use version control on them, inherently adding change management to your configuration management. If you want to take it to the next level, we use SaltStack for centralized automation and orchestration of our configuration management. There is not a single manually created or updated configuration file on any server in our environment; everything is done via SaltStack and Git, which makes it easy for us to track configuration management and change management throughout the environment. That gives us a centralized audit trail of any change made on any system. Compliance Management Regulatory compliance is a major requirement for us as a payments company, as it is for other firms in the banking and financial services sector (as well as most industries now). We regularly work with PCI DSS and the NIST Cybersecurity Framework. In our experience, frameworks like these are heavily tuned toward one of the major commercial operating systems[, and, as a result, many of the auditors and assessors are more experienced with that OS as well. That’s created a learning curve when doing something like a PCI level 1 assessment or a NIST audit, where we’ve basically had to teach the assessors all of the above, because they weren’t familiar with how FreeBSD gets configured and secured. (As a result, there are now some vendors who know very well how it works!) If you do work with a vendor that doesn’t know FreeBSD, the first assessment or audit will likely be more painful than future ones, because you’ll have to help them navigate that learning curve. But here’s the great news: Every time we’ve completed a course with a security assessor who wasn’t previously familiar with FreeBSD, by the end of it they always become convinced FreeBSD is the best OS from the security, compliance, patching, and configuration perspectives. Seriously. And successfully completing those audits and assessments is ultimately what qualifies an OS as “enterprise-ready,” and I can say emphatically that FreeBSD exceeds that bar. That’s what I love sharing our experience and what we’ve learned—because inevitably that might help be a catalyst for helping our technologists and teams reap the benefits of such a great open source OS.

5 Reasons We Use Open Source FreeBSD as Our Enterprise OS

The over-hype of the blockchain, cryptocurrency and decentralized finance (DeFi) infrastructure was quite a show. Recent events have shown that a lack of understanding of emerging technology, exaggerated security features, and an overrated absence of centralized control are responsible for the misconceptions about blockchain. Anonymity was a major hallmark of cryptocurrency transactions and investments. However, it has been argued that if cryptocurrency transactions are touted to be anonymous, how then were cybercriminals able to hack wallets and decentralized ledger systems? Reports that authorities are able to retrieve stolen bitcoins and ransom payments have forced . many to rethink blockchain anonymity for pseudonymity The did not help issues. Blockchain’s acceptance gained traction due to the popularity (perhaps notoriety) of and other Overnight, cryptocurrencies produced and became criminals’ preferred means of payment. cryptocurrency crash bitcoin cryptocurrencies. nouveau riche It shouldn’t be a surprise that blockchain is under scrutiny due to the cryptocurrency crash and recent high-profile cyber incidents. While it is easy to dismiss skepticism about blockchain’s capability to deliver utopia popularized by opportunists and enthusiasts, the failure to acknowledge the limitation of the technology and its vulnerability to software flaws are partly responsible for the rise in successful cyberattacks. So, What Really is Blockchain? Blockchain is a distributed ledger technology that allows the transparent sharing of transactions and assets within a network. As an advanced database system; blockchain records, stores, and tracks blocks of transactional data. The technology builds on shared consensus, record immutability, and smart contracts. As a result of these features, records are trusted as no single network partner can alter or delete data without consensus from the network. As a peer-to-peer technology, blockchain facilitates faster information transfer, transparency, and trust among network participants. Other benefits include data accuracy, transaction non-repudiation, and improved efficiency. Beyond theoretical benefits associated with blockchain, its adoption has proved to be advantageous in the real world. According to , blockchain has evolved from the “peak of inflated expectations” to real-world benefits such as the use of smart contracts in aircraft maintenance and food safety. Other benefits include the use of blockchain to generate value in the supply chain, healthcare, retail, finance, and other sectors. Gartner Recent Blockchain Cyber Incidents According to , threat actors stole more than $1 billion in Q1 2022 due to vulnerabilities in blockchain platforms. purloined more than $667 million in Q2 and $398 million in Q3 respectively. Between Q1 and Q3 2022, the community lost more than $2.3 billion to hacks and scams. 97% of these losses were due to cyber incidents. Immunefi Hackers More than 98% of hacks occurred on DeFi platforms, pointing to the severity of exploitable flaws in one of the major features of blockchain technology - decentralization. Both BNB and Ethereum were the most targeted chains in Q3 2022. BNB suffered 16 incidents (28.6%), while Ethereum recorded 13 incidents (23.2%). An analysis of some of the projects affected by cyberattacks points to extensive inadequate cybersecurity controls. Compromised companies included Binance (the world’s largest cryptocurrency exchange), Nomad Bridge (a cross-chain communication standard), Beanstalk (a decentralized stablecoin protocol), and Harmony Horizon (a layer-1 blockchain bridging protocol). There were also Ronin Network (a crypto wallet and NFT game operator), Wintermute (a global crypto market marker), TribeDAO (a decentralized autonomous organization controlling three projects), Wormhole Network (a bridge that facilitates digital asset movement across blockchains), and many others. *Photo by Sea and Sun - stock.adobe.com* Broken Links in Blockchain Threat actors exploit vulnerabilities in blockchain to compromise projects and platforms. As DeFi platforms increase in adoption, their attack surfaces grow, leading to more exploits as seen in Q3. DeFi projects are more prone to cyberattacks due to a lack of appropriate security controls. Improper management of forked code is another reason why DeFi gets easily hacked. In 2021, the majority of the occurred on DeFi platforms. $14 billion lost in cryptocurrency The lack of secure key management exposes blockchain to exploitation. An automated cryptocurrency lending platform was exploited through a compromised private key, affecting team wallets on different chains. Threat actors leveraged vulnerabilities in the Domain Name System of an interoperability protocol to perpetuate a DNS hijack by redirecting users to a hacker-controlled frontend. Vulnerable blockchain endpoints are providing threat actors with rewarding opportunities to wreak havoc. Threat actors also weaponized vulnerabilities in contract source code, virtual machines, and cryptographic algorithms. Malicious mining software exploited unpatched vulnerabilities in operating systems. According to , the number of new miner variants exceeded 150,000 in Q3 2022, a 230% increase. Kaspersky Phishing attacks and other social engineering tactics impact blockchain networks. While these attacks are not particular to the blockchain, there has been a significant increase in blockchain phishing attacks. increased by 257% in 2022 from 2021. Cryptocurrency phishing Social engineering was responsible for targeting cryptocurrency and digital wallet owners. The threat posed by cryptojacking spread beyond blockchain platforms to internet infrastructure. Leveraging social engineering as the initial attack vector, cryptojacking in the finance sector increased by in the first half of 2022. 54% of cyberattacks 269% In 2014, a performed a Border Gateway Protocol (BGP) hijack by redirecting traffic from 19 internet service providers (ISP) to steal bitcoins. Also know as a routing attack, blockchains are susceptible to this attack as a threat actor can intercept data before reaching an ISP, thereby disrupting access to real-time data transfer needed to form a consensus and complete transactions. Users don’t typically recognize this diversion, thus amplifying unauthorized data access or disclosure. In Q1 2022, there were over BGP hijacks. hacker 6 million A consensus control attack focuses on achieving the majority of community consensus which gives a hacker control of the network. Two major examples include Sybil and 51% attacks. In a Sybil attack, the threat actor acquires majority control by creating nodes to operate fake identities. A successful Sybil attack gives a hacker the ability to gain the majority of network influence, perform unauthorized actions, block users from the network, undermine legitimate network authority and execute a 51% attack. A 51% attack enables a threat actor to control at least 51% of a network’s hash rate. A successful 51% attack allows a hacker to modify or reverse completed transactions, enable double-spending, prevent transaction confirmation and ruin the integrity of a blockchain platform. Examples of include Verge, BTG and Ethereum. successful 51% attack Insider threat is increasingly becoming a major concern for the community. Recent cryptocurrency crash is a result of rug pulls as project developers defraud investors. In 2021, there were over , resulting in billion of dollars in losses. 1,300 rug pull scams Other security issues include double-spending, transaction malleability, selfish mining, fork after withholding and flash loan attacks. The community should also be wary of Finney, eclipse, vector76, race, proof-of-stake, and distributed denial-of-service attacks. How to Keep the Blocks Well-Chained A securely implemented blockchain ecosystem provides a ton of opportunities for businesses and users. With any technology or business operation, there are always security issues that could cause adverse effects if the right controls are not in place. Without a doubt, blockchain has several exploitable vulnerabilities. However, the focus should be on cutting through the cloud of hype to ensure adequate controls are implemented to protect the ecosystem. Here are some controls to reduce cyberattacks: Enforce acceptable consensus algorithms. Implement monitoring capabilities to track changes in nodes’ behavior and mining pool. Install antivirus on endpoints and patch known vulnerabilities. Implement web application firewall and secure routing protocols. Emphasize appropriate security awareness, particularly common social engineering tactics. Improve browser security to prevent crypto mining and crypto-jacking attacks Patch vulnerabilities in contract source code, virtual machines, and cryptographic algorithms. Ensure strong access controls (such as strong passwords, and MFA) are enforced. Implement proper key management and use strong encryption protocols. Validate that APIs have no inherent security flaws. Develop innovative blockchain governance. The Future is a Secure Blockchain Blockchain isn’t going away anytime soon. Cryptocurrencies and DeFi are just part of the innovative technology. Modern businesses will continue to disrupt due to blockchain innovation. Businesses that avoid adopting blockchain should learn from organizations that paid dearly for delayed cloud adoption. To prevent such a risk, organizations should implement secure blockchain adoption strategies.

The Blockchain is a Broken Chain After-all

Data source: https://www.footprint.network/@Beosin/Footprint-Beosin-Q3-Report-Beosin Download the full report: https://beosin.com/resources/Q3_2022_BLOCKCHAIN_SECURITY_REPORT.pdf 1. Q3 2022 Blockchain Security Overview A total of 37 major exploits were monitored, with a total loss of approximately $405 million In the third quarter of 2022, Beosin EagleEye monitored over 37 major attacks in the Web3 space, with total losses of approximately $405 million, down approximately 43.6% from $718.34 million in Q2 2022, and a decrease of 59.6% from the loss of $1,002.58 million in Q3 2021. From January to September 2022, assets lost in the Web3 space due to attacks totaled $2,317.91 million. July saw a significant decrease in attacks, making it the least loss amount from attacks since 2022. Hacker activity increased significantly in August and September. In terms of each month, , 92% of the amount lost came from cross-chain bridges and DeFi protocols. 22 of the 37 attacks occurred in the DeFi space. In terms of the project types , after a sharp drop in TVL from May to June, the trend of TVL of each chain tended to be stable this quarter. Late July to early August showed a slight upward trend in TVL, which was also the period with the highest number of attacks and loss amount in this quarter. In terms of TVL the number of losses on Ethereum reached $374.28 million this quarter, accounting for 92% of the total losses. The most frequently attacked chain was BNB Chain, which reached 16 times. In terms of chains, 92% of the loss amount was caused by contract vulnerability exploits and private key compromises. In terms of attack types, about $204.2 million of the stolen funds flowed into Tornado Cash, accounting for about 50.4% of the funds stolen in the quarter. Only about 4% of the stolen funds were recovered during the quarter. In terms of fund flows, only 40% of the rekt projects were audited. In terms of audits, 2. Overview of exploits Overall attacks fell in Q3 compared to Q2 In Q3 2022, 37 major attacks were monitored in the Web3 space, with a total loss of approximately $405 million. There were two attacks with losses of $100 million or more, three attacks with losses of $10 million or more, and 14 attacks with losses of $1 million or more. The security incidents with losses over $100 million were ($190 million) and ($160 million). Nomad Bridge Wintermute August 2022 was the most active month for hackers in the quarter, with losses of around $210.62 million. Total losses from attacks in July were $30.05 million, making it the lowest amount of losses in a month since 2022. 3. Types of rekt projects Cross-chain bridges and DeFi projects account for 92% of the loss amount In the third quarter of 2022, three cross-chain bridge attacks resulted in a total loss of approximately $190.25 million; 22 attacks in the DeFi space resulted in a total loss of $186.79 million. Approximately 92% of the attack loss amount came from the cross-chain bridge and DeFi protocols. As of September 2022, there were 10 major cross-chain bridge security incidents 2022, with over $1.4 billion in losses. Cross-chain bridges were the most affected area by attacks in 2022. In addition to cross-chain bridges and DeFi protocols, other types of projects attacked this quarter included NFTs, exchanges, DAOs, wallets, and MEV bots, making their overall types more diverse than in the previous quarter. 4. Loss amount by chain Losses on Ethereum amount to $374.3 million 12 major attacks occurred on Ethereum this quarter, with a total loss of $374.28 million, ranking first among all chains. Solana lost $18.37 million from 3 exploits. Chains with major attacks in two consecutive quarters include Ethereum, BNB Chain, Fantom, and Avalanche. BNB Chain saw the most attacks, with 16 exploits, and their corresponding projects are all unaudited. The amount of money involved in these 16 exploits is relatively small, with 14 incidents involving a single loss of less than $500,000. After experiencing a sharp drop in TVL from May to June, the trend of TVL across chains stabilized this quarter. TVL showed a slight upward trend in the period from late July to early August, which was also the period with the most attacks and loss amount this quarter. The crypto market generally moved slightly downward in September. After the Ethereum merge on September 15, the Ethereum TVL saw a continuous slight decline. 5. Analysis of Attack Types 92% of the lost amount was caused by contract vulnerability exploits and private key compromise In the third quarter, contract exploits continued to be the most common attack type. About 15 attacks are contract vulnerability exploits, accounting for 40.5 percent of the total number. Total losses from contract vulnerabilities amounted to $201.6 million, or 50.9 percent of total losses. The four private key compromises this quarter resulted in approximately $167.24 million in losses, the second largest amount of losses after contract vulnerability exploits. Compared with the previous quarter, the types of attacks in this quarter were more diverse. New attack types that emerged this quarter include BGP hijacking, misconfiguration, and supply chain attacks. Q3 market share of loss amount by attack type Q3 market share of count by attack type By contract vulnerabilities, the main vulnerabilities exploited this quarter include: validation issues, reentrancy, permission issues, improperly designed business logic or functions, and overflow vulnerabilities. These vulnerabilities are all discoverable and fixable during the audit phase. Q3 loss amount & count by contract vulnerabilities 6. Typical Security Incident Recap 6.1 Nomad Bridge $190 Million Incident On August 2, Nomad Bridge, a cross-chain platform that supports asset transfers across Ethereum, Moonbeam, Avalanche, Evmos, and Milkomeda, suffered a massive hack that cost the project $190 million. 6.2 Slope Wallet Incident on Solana On August 3, a large-scale Slope wallet theft incident occurred on Solana, with losses estimated at around $6 million. 6.3 Wintermute Private Key Compromise Incident On September 20, crypto market maker Wintermute was attacked with a loss of $160 million due to a private key compromise. 7. Fund Flow Analysis Approximately $204.2 million in stolen funds flowed into Tornado Cash On August 8, the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) sanctioned Tornado Cash, prohibiting U.S. individuals or organizations from interacting with it. In the third quarter of 2022, approximately $204.2 million in stolen funds still flowed into Tornado Cash, representing 50.4 percent of the funds stolen in that quarter, which is lower than in the second quarter. Approximately $182.3 million of the stolen funds remained in the hacker’s address as the balance. Some stolen funds were bridged to addresses on other chains, and this portion is still counted as the hacker’s address balance. About $16.6 million of assets were recovered through on-chain negotiations and unsolicited returns from white hat hackers. In the third quarter of 2022, only about 4% of the stolen funds were recovered, a much lower percentage than in the second quarter. Around $1.92 million of stolen assets flowed into exchanges such as Binance and FixedFloat. Such incidents generally involved a small number of assets (usually around $10K to $100K) and the hackers transferred the stolen funds to the exchanges immediately after the attack, resulting in the projects failing to contact the exchanges in time to freeze the funds. Q3 fund flows 8. Project Audit Analysis Only 40% of the projects were audited In 2022, the percentage of rekt projects that were audited were: 70% in the first quarter, 52% in the second quarter, and 40% in the third quarter. The percentage of unaudited rekt projects shows an increasing trend quarter by quarter. Whether audited — count Whether audited — the amount Of all the rekt projects, the audited projects lost a total of $ 375.48 million, and the unaudited projects lost about $ 29.56 million in attacks. At first glance, it might seem that audits did not serve to protect the safe operation of the projects. However, a deeper analysis shows that most of these audited projects were attacked by non-contractual level issues such as private key compromise, supply chain attacks, DNS attacks, BGP hijacking, and misconfiguration. Among the unaudited projects, 85% were caused by contract vulnerabilities or flash loan attacks. It can be seen that professional audits are still effective in securing the project at the contract level to some extent, however, the safe operation of a protocol also requires a good job of offline risk control, safekeeping the private key, being alert to traditional network security attacks, and use third-party components carefully. Of course, in this quarter, some vulnerabilities should have been discovered in the audit phase but were not presented in the audit report, so it is recommended that the project seek a professional security company to conduct the audit. About Blockchain Security Alliance The Blockchain Security Alliance was launched by several units with diverse industry backgrounds, including university institutions, blockchain security companies, industry associations, fintech service providers, etc. The first batch of the alliance council includes Beosin, SUSS NiFT, NUS AIDF, BAS, FOMO Pay, Onchain Custodian, Semisand, Coinhako, ParityBit, and Huawei Cloud. The current members include Huobi University, Moledao, Least Authority, PlanckX, Coding Girls, Coinlive, Footprint Analytics, Web3Drive, and Digital Treasures Center. The members of the Security Alliance will work and cooperate to continuously secure the global blockchain ecosystem with their technical strengths. The Alliance Council also welcomes more people in blockchain-related fields to join and jointly defend the security of the blockchain ecosystem. Alliance Registration https://forms.gle/pb3NaUgS3a2Sswnc8 Contact Telegram：@kristenbeosin, @Web3Donny Email: market@beosin.com Alliance Member — Beosin Beosin is a Singapore-based leading global blockchain security company with 100+ security experts in formal verification and blockchain security. With the mission of “Securing Web3.0 Ecosystem”, Beosin provides integrated blockchain security products and services including code security audit, risk monitoring, alerting & blocking for projects, security compliance KYT & KYC, and stolen asset recovery. Beosin has currently provided security services to more than 2,000 blockchain enterprises worldwide, audited over 2,500 smart contracts, and protected over $500 billion of assets for clients. Alliance Member — Footprint Analytics Footprint Analytics is a tool to uncover and visualize data across the blockchain, including NFT and GameFi data. It currently collects, parses, and cleans data from 18 chains and lets users build charts and dashboards without code using a drag-and-drop interface as well as with SQL or Python. Also Published here

CODE BGP

codebgp.com

1-10 employees

Since 2021

COMPANY RANKING

CODE BGP

EVERGREEN INDEX #3289

Representing this company? Click here to claim and customize this page!

Code BGP WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!

CODE BGP

codebgp.com

1-10 employees

Since 2021

COMPANY RANKING

CODE BGP

EVERGREEN INDEX #3289

RELATED COMPANIESRANK

STORIES ABOUT CODE BGP

Representing this company? Click here to claim and customize this page!

Code BGP WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!