Application Name:
DevOps Infrastructure Security & Darknet Information Monitoring for MVPs
GitHub Application:
https://github.com/ZcashCommunityGrants/zcashcommunitygrants/issues/340
Project: Offensive Security
Requested amount: $88,000
Category: Infrastructure
Project Summary
External offensive-security assessment of the Zcash ecosystem’s deployed infrastructure - organisation websites and email, light client and indexer servers, payment tools and CI/CS pipelines - emulating how a real adversary would compromise it. In parallel, and with each person’s consent, we monitor the darknet exposure of Zcash MVPs and employees against a 94B record dataset to surface the leaked credentials, addresses, PII, infostealer and live adversarial infrastructure & operations (long before it reaches the average breach check database). The same starting points an attacker would use, giving each participant a private report.
Project Description
The security of Zcash’s software code is well-supported by Least Authority’s role as the ecosystem security lead and Taylor Hornby’s efforts for Shielded Labs. This grant proposal supports those efforts by evaluating and improving the security of deployed infrastructure, and the exposure of the people who operate it. These are the two things a real external adversary actually attacks, and they are equally important: an attacker probes the deployed systems, and uses information leaked about individuals as the starting point to target them directly.
On the infrastructure side, we evaluate:
- Websites, email infrastructure, etc. of Zcash-related organisations,
- Light client and indexer servers that wallets connect to (lightwalletd, Zaino),
- CI/CD and software release infrastructure,
- Any other DevOps deployments that are important to the community.
Additionally, Zcash MVPs (leaders, developers, etc.) and employees would benefit from understanding their risk profile as a result of information exposures in leaks/hacks circulating on the darknet. With these individuals’ permission, we also propose to perform darknet searches for personal information including:
- Home addresses, Number Plates, PII
- Apps used, accounts registered (regardless of compromise), music preferences, diets, enough intimate details for social engineering
- Compromised accounts,
- History of malware infecting their systems.
These searches draw on a darknet dataset we have accumulated of over 94 billion records (breach data, credential combolists, and infostealer logs). By providing a private report to these individuals on which information is available about themselves on the darknet, these individuals can better understand their risk profile for physical attacks, phishing and social engineering, and system compromises.
Proposed Problem
The code auditing performed by Least Authority and Taylor Hornby is valuable for ensuring Zcash-related software is security-bug-free. In addition to the code being secure, it is also important that the code is deployed securely, and that the people responsible for it understand what an attacker already knows about them.
Even with perfect code, an insecure server deployment can put users at risk, for example from attacks such as:
- Replacing a wallet binary download with a malicious copy,
- Drive-by downloads and other browser-based attacks against visiting users,
- Extracting sender/recipient information from light client servers,
- Stealing deployment keys from CI/CD systems, to release malware.
An attacker targeting a specific person usually begins with information that has already been leaked about them. A home address enables a physical or coercion attack against someone holding funds. A reused password, or a session token captured in an infostealer log, can lead to a compromised account, a signing key, or a malicious code release. Leaked personal information is the adversary’s starting point, which is why monitoring it is as important as testing the infrastructure.
Services like Have I Been Pwned already offer Zcash MVPs information about what has been leaked about them on the darknet. However, Have I Been Pwned does not disclose the actual leaked data such as passwords and addresses. Having access to this information would help MVPs better understand the source of the breach, whether their system had been compromised, and which home addresses have been leaked. TechSlayers’ darknet search reports include full copies of such information, drawn from the dataset described above.
Proposed Solution
With permission, TechSlayers will perform black-box penetration testing against Zcash’s public infrastructure to identify weaknesses such as:
- Out of date server software and operating systems,
- Out of date and vulnerable WordPress plugins,
- APIs lacking access control, leaked credentials, etc.,
- Other vulnerabilities (XSS, CSRF, etc.),
- Email server misconfigurations creating phishing risks (DMARC, DKIM, SPF),
- Light client and indexer servers leaking sender/recipient metadata,
- And much more.
These penetration tests will be performed manually with the assistance of the latest AI models. If given access to server source code and deployment scripts (e.g. WordPress plugins, Kubernetes configurations, etc.), we will also perform white-box security review for similar problems.
To direct this testing to where it matters most, we have surveyed the deployed surface of the current Zcash ecosystem. It includes:
- Organization websites and email, such as ZODL (zodl.com), Electric Coin Company (z.cash, electriccoin.co), the Zcash Foundation (zfnd.org) and its community forum, Shielded Labs, and the Zcash Community Grants portals,
- Light client and indexer infrastructure, including the zec.rocks light-server network (a Kubernetes deployment behind HAProxy on Fly.io), the Zaino indexer that is replacing the deprecated zcashd RPC, and legacy lightwalletd instances,
- Wallets with deployed components, such as the Zodl wallet
- Payment and point-of-sale tools, such as ZGo (a WordPress plugin) and Free2Z,
- Block explorers and chain-analytics services,
- CI/CD and release pipelines across the ecosystem’s GitHub organizations,
- Community and social platforms, such as ZecHub and the community forum.
We will also make available our darknet search capabilities to any MVP, employee, or community member, to look up their personal information.