Brandon Arvanaghi, Security Engineer at Gemini: Covering The Popular Crypto Hacking Techniques

Brandon Arvanaghi is a security engineer at Gemini, specializing in security in cryptocurrency and the Gemini dollar. In this conversation, Brandon and Anthony Pompliano discuss the best security practices for protecting yourself and your crypto assets, popular hacking methods of nefarious actors, and prevention tactics. CRYPTO. COM-----Crypto.com is a pioneering payment and cryptocurrency platform that seeks to accelerate the world's transition to cryptocurrency. With the vision of "cryptocurrency in every wallet", the Crypto.com App offers a full range of financial products with competitive pricing, well designed UX and high security. It is the best place to buy, sell and pay with crypto. COINMINE-----The Coinmine One is like an Xbox that turns your electricity into Bitcoin. You just plug it in, connect to wifi, and tap on the crypto you want. It’s so easy anyone can do it. Everything is controlled from the Coinmine mobile app and the Coinmine keeps getting better with over the air updates that add new coins, features and services to your Coinmine. Visitcoinmine.com/pomp to get a Coinmine and earn crypto for powering a new world.

• 0:01Speaker 00

  What's up everyone, this is Anthony Pompliano. Most of you know me as Pomp. You're listening to Off the Chain, simply the best podcast in crypto. Let's kick this thing off. Brandon Orvani is a security engineer at Gemini specializing in cryptocurrency security and the Gemini dollar. In this conversation, we go over the best security practices for protecting yourself and your crypto assets. We also touch on some of the more popular hacking methods of nefarious actors while going over how to prevent each one. I really enjoyed this conversation and think this is an important episode. I hope you enjoy it too. Skrt skrt. Wanna know who has the best URL?

• 0:46Speaker 00

  Crypto.com. That's right, Crypto.com. They're a crypto platform with one goal, motherf***ing mass adoption. That's why we're all here. We're trying to get crypto in every wallet. Crypto.com is helping people do that through buying, earning, lending, and card payment. Everything you could want at Crypto.com. Go help your boy out, tell him Pomp sent you. Download the app or visit Crypto.com. Pomp's got you, always. Ever wanted to get into mining and didn't know how? Don't worry, your boy Pomp's got you. Everybody got some electricity and wifi. All you gotta do is go to CoinMine.com, you buy a coin mine. It's like an Xbox or a Playstation that helps you turn your electricity into Bitcoin.

• 1:28Speaker 00

  That's right, you purchase it, it shows up at your doorstep, you pull it out of the box, you plug it in, connect to your wifi, five minutes or less, you're mining Bitcoin. All you have to do is control it from the mobile app they provide and then you receive over-the-air updates that add new coins and new features on a consistent basis. Kinda like how Tesla does over-the-air updates and updates the car software. Just you're updating your coin mine. Consumer mining made easy. That's right, go to CoinMine.com, tell them Pomp sent you, and thank me later. Anthony Pompliano is a partner at Morgan Creek Digital. All opinions expressed by Pomp or his guests on this podcast are solely their opinions and do not reflect the opinions of Morgan Creek Digital or Morgan Creek Capital Management.

• 2:12Speaker 00

  You should not treat any opinion expressed by Pomp as a specific inducement to make a particular investment or follow a particular strategy, but only as an expression of his opinion. This podcast is for informational purposes only.

• 2:27Speaker 00

  All right, guys. Bang, bang. I am here with Brandon. We've got a pretty cool episode today in that we are going to cover an overview of crypto security. So you've been on before. You are now a two-time guest. I appreciate you taking the time to come over here and basically teach us how to be safe.

• 2:46Speaker 01

  Yeah, it's great to be back, Bob. Thanks for having me.

• 2:48Speaker 00

  For sure. All right, let's start with just the very standard or elementary levels of security, right, and kind of walk us through what kind of is in that layer, right? For those that don't know, we're going to basically go through three layers of crypto security, kind of a standard or elementary level, a medium level, and then the expert level of security. So let's start with that standard level and kind of what's in that bucket.

• 3:12Speaker 01

  Sure. So let me make clear first, the standard level is the worst you could possibly be. So people, a lot of times, use the same password on every site, right? And you hear all the time about why this is a bad thing, but you don't exactly hear the reasoning behind it. So it's not because I think you're going to tell anyone your password, which I know you won't. But the issue is, if you use the same password on every site, then one of those sites is going to be breached at some point. And say, when Yahoo gets breached, or when Capital One gets breached, then that username and password combination that you use there is going to be publicly visible to the entire world. Because what hackers do is they dump the lists of usernames and the passwords.

• 3:50Speaker 00

  And so what they'll basically do is Yahoo, we'll pick on them for a second, if they got hacked and your username and password is there, what they'll essentially do is people will take that email and that password combination, and they'll go try it at a bunch of other websites, trying to use the exact same combination.

• 4:05Speaker 01

  That's exactly right. And they're going to get in on multiple other places. So at the very minimum, you want to use a distinct password everywhere. And there's something called a password manager that makes that really easy to do.

• 4:15Speaker 00

  Okay, so we'll get into what a password manager is in a second, and what some of those may be in terms of the good ones versus the bad ones. So password is kind of the first level of defense when it comes to security. I think most people are familiar with that. Then you get into This two-factor authentication.

• 4:32Speaker 01

  Right.

• 4:32Speaker 00

  Usually in this first level of defense, it's a text message, right? And my understanding is there's two different reasons why you would have a service text you some sort of code, right? One is, I lost my password, so help me recover it or reset it. And then the second is as an actual security mechanism. So I'm going to sign in, it says, we're going to send you a code, type the code, and then we let you into the service, right?

• 4:56Speaker 01

  Exactly.

• 4:58Speaker 00

  Let's first go to just two-factor authentication via text. Explain exactly how it works and what some of the challenges there are.

• 5:05Speaker 01

  Sure, so that's a great distinction you just made, and that's the most important distinction there is. So what you were talking about, when you log in with your password to a site, if you have two-factor authentication with text or SMS, what happens is they will text you a code, and the site will say, please enter the code that we just texted you to your number. Now, this is problematic because phones are fickle. Phone numbers are very fickle. They should not be used for any kind of authentication. And it's actually more impactful when you have the second thing you discussed, which was account recovery, that makes it even worse. So you don't even need a password to recover someone's account with their phone number. So what will happen is, if I go to your Gmail, for example, and I type in forgot password, it'll say, okay, we just sent a text to the phone number associated with this email

• 5:50Speaker 01

  with a code that allows you to reset this person's password. So I didn't need their password at all, I just need control of their phone number. And there's a lot of ways I can get access to your phone number, which is why this is so dangerous.

• 6:01Speaker 00

  And so what are some of the ways that people get access to the phone numbers? Because I think that's kind of one of the core things that we've seen in crypto over and over again, and specifically talking about these SIM swaps.

• 6:11Speaker 01

  Right.

• 6:11Speaker 00

  Maybe describe a little bit, what is a SIM swap? How do they work? And then how does that interface with the security that most people have?

• 6:18Speaker 01

  Absolutely. So a phone porting is what happens when I call, say, your provider, say you have Verizon, and I say, I'm Anthony Pompliano, and I'm changing control of my phone number to this other SIM card on this other phone because I'm going abroad or something like that. Now, if I can get them to believe that I'm you, then they're going to give control of your phone number to the phone that I own. And all of a sudden, you'll lose service, and I'll get service, and I'll start getting all your text messages. And this is really easy to do because everyone's identity is pretty much public at this point with all the breaches that have gone out there, and social security number leaks. So what will happen is if I get control of your phone number and you have something like SMS account recovery, which we just talked about, I will just be able to get that recovery code and reset your password for your Gmail,

• 7:02Speaker 01

  for example, and just get into your accounts like that.

• 7:05Speaker 00

  Got it. And we've seen now this happen to a lot of people, right? The SIM swapping, the porting, it's not just for crypto, right? In terms of I want to steal your crypto, people are trying to use it to get into your bank accounts in the fiat world, also to get into your Twitter account, your email, right? There's all kinds of different services that they're using to kind of penetrate the security measure. And then we've also even seen people who have gotten crypto stolen from them, right? Michael Terrapin is the big guy out there with a, I think he's got a $24, $25 million lawsuit against AT&T. For basically them, you know, according to him, his claim is that they were complicit, or they've helped facilitate this theft of his crypto. So it's a huge deal.

• 7:48Speaker 01

  Exactly.

• 7:48Speaker 00

  All right. So two-factor authentication via text message can happen with the account recovery or with the security measures, and that's pretty much the standard or elementary level of security. Then there's the medium level, which I tend to think that most people in crypto were at the standard level. They realize, hey, I need a little bit more security because Bitcoin and other crypto assets are bearer assets. So they've moved on up to this medium level. In the medium level, there's kind of two separate components. There's the password manager you mentioned earlier, and then there's a two-factor authentication, not via SMS.

• 8:22Speaker 01

  Right.

• 8:22Speaker 00

  Let's do the password manager first. Explain what that is and how those products work.

• 8:27Speaker 01

  Exactly. So instead of using the same password everywhere, what you can do is have what's called a password manager. So this is an application that runs on your computer that can generate a secure, random password for every site that you want to log into moving forward. So if someone asks me right now what my Twitter password is or what my Facebook password is, the honest answer is I have no idea, because I just generated it once in this password manager, and it's stored there. And anytime I want to log in now, I just open the password manager, I look up Twitter, and I copy and paste the value into the login field. So anytime I want to register for a new site, I generate a new password in this, and it saves it forever, and I just copy and paste it into the create password field. So every single password is different, every single password is secure, and it's just beautiful.

• 9:12Speaker 01

  I don't have to remember anything anymore.

• 9:14Speaker 00

  Got it. And on the password manager side, there's a couple of different services. I think there's OnePassword, Dashlane, LastPass, etc. Anything to look for when you're evaluating the password manager that makes one better than the other, or maybe more secure or effective?

• 9:30Speaker 01

  I would just make sure it comes... So, these are all good ones that you mentioned. I would make sure it just comes from one of these reputable brands. I know LastPass has had a good amount of vulnerabilities lately, so maybe look into OnePassword. That's been a strong one lately.

• 9:42Speaker 00

  Got it. Okay. So, password manager, pretty simple and straightforward. The other aspect of this medium level of security is two-factor authentication, not via SMS, right? So, most people have, I think there's two main apps that people now have kind of popularized, which is, one is a company called Authi, and the other is Duo, D U O. Explain how these work for two-factor authentication.

• 10:07Speaker 01

  Right. So, that's a great question. So, these are called authenticator apps. And the difference between this and SMS authentication is that SMS is tied to your phone number, like we talked about, and phone numbers are fickle. Whereas authenticator apps like Authi and Duo, they generate this code tied to your physical device. So, even if someone else gets control of your phone number, they're never going to be able to generate those same codes that Duo generates on your app, for example. And that's, that makes it difficult for them. So, only your physical device is able to generate those codes that you use to log in.

• 10:40Speaker 00

  Yep. And really what you're talking about here is, if you go back to the phone porting or the SIM swapping, a text message can... The scary part to me, right, is I know people who have gotten SIM swapped, and when that text message is generated from a site, it goes to everybody who has a SIM card with that number attached to it. So, it can still go to your phone, but it will also go to the nefarious actor's phone as well. When it comes to these two-factor authentication applications like Authi or Duo, it doesn't matter if somebody else has your SIM card, right? You're saying it's just the physical device itself. Whoever has that physical device is the one who gets the code.

• 11:16Speaker 01

  That's correct. But it gets a little bit hairy, and this is why it's kind of in the medium tier. There's two things to look out for.

• 11:23Speaker 00

  Wanna know who has the best URL? Crypto.com. That's right. Crypto.com. They're a crypto platform with one goal. Motherf***ing mass adoption. That's why we're all here. We're trying to get crypto in every wallet. Crypto.com is helping people do that through buying, earning, lending, and card payment. Everything you could want at crypto.com. Go help your boy out. Tell them Pomp sent you. Download the app or visit crypto.com. Pomp's got you always. Ever wanted to get into mining and didn't know how? Don't worry. Your boy Pomp's got you. Everybody got some electricity and wifi. All you gotta do is go to coinmine.com. You buy a coin mine. It's like an Xbox or a Playstation that helps you turn your electricity into Bitcoin. That's right.

• 12:08Speaker 00

  You purchase it. It shows up at your doorstep. You pull it out of the box. You plug it in, connect to your wifi. Five minutes or less, you're mining Bitcoin. All you have to do is control it from the mobile app they provide, and then you receive over-the-air updates that add new coins and new features on a consistent basis. Kinda like how Tesla does over-the-air updates and updates the car software. Just your update in your coin mine. Consumer mining made easy. That's right. Go to coinmine.com, tell them Pomp sent you, and thank me later.

• 12:39Speaker 01

  There's two things to look out for. Number one, you're still dealing with a numerical code. So if someone, if you were tricked, if you were tricked into giving this numerical code to someone across the world, even if they don't port your phone, or you just, you got tricked into giving it to them. And they can log in from Asia, or Europe, or Mexico, wherever. So that's, that's kinda the issue, number one. Number two is, they also have a feature of these authenticator apps, which is called multi-device support. And you're gonna wanna make sure you disable this. Because what multi-device support means is that you can say, "I'm gonna register this same instance of this app on a different phone." Just to have a backup plan. And how they allow you to do that is with a text to your phone number.

• 13:22Speaker 01

  So it essentially gets back to the same level of security as text if you have this multi-device device support thing on. So it's important to disable that in these apps as well. So that's exactly right. Well, you call this the medium tier. It's not the best tier yet.

• 13:33Speaker 00

  Got it. Okay. And so let's move on to that expert tier. What do you see in the expert tier as if I want to protect myself, whether it is in the fiat financial world, in the crypto world, or even my non-financial applications like email, Twitter, et cetera? What is the best kind of approach to building that security?

• 13:53Speaker 01

  Right. So you're already using a password manager like we discussed. That's great. Security keys is the answer to that question.

• 13:59Speaker 00

  Okay. What is that?

• 14:00Speaker 01

  A security key is a physical device that uses the same mechanism to protect your account as what makes Bitcoin so secure, for example. It's public key cryptography. So there's nothing to spoof. It's a signature that can only come from that physical device. So if you have a YubiKey, for example, or even your touch bar on the new Macs, you can log in and the attacker would need physical access to these things to impersonate you. And that's very difficult for them to do, obviously.

• 14:27Speaker 00

  Okay. So you mentioned two things, the touch bar on the Macs and then a YubiKey. Let's start with the YubiKey because that's more, can work for Android or Mac or really any operating system. It is an actual piece of hardware.

• 14:40Speaker 01

  That's right.

• 14:40Speaker 00

  That is quite small. It's like basically the size of like a thumbnail almost, right? It plugs into one of the ports on your computer.

• 14:47Speaker 01

  That's right.

• 14:47Speaker 00

  And the ones I've used, at least in the past, is you basically tap the YubiKey and it generates what looks like an incredibly long random string of letters and numbers. And that is essentially the public cryptography that you're talking about that will authenticate this is the person who is supposed to be accessing this product.

• 15:08Speaker 01

  So independent of those letters, there's actually a signature that it will do under the scenes and behind the scenes. And what it's signing is your connection to that site. So there's nothing any attacker outside the world can steal from this connection. They can't impersonate a connection because they can't get that signature from you. So that's the key point is that no No one can spoof this signature, just like no one can spoof a Bitcoin transaction, for example.

• 15:29Speaker 00

  Got it. And then how does the touch bar work? Is it very similar to the YubiKey? It's just a different form factor on the hardware?

• 15:35Speaker 01

  Yeah, that's exactly right. So all of these are... So Gemini actually was the first custodian in exchange to allow support for all these with something called the Web auth and spec. I don't need to go into the details of that, but what that means is we were the first custodian in exchange to allow use of these security keys, which use public key cryptography to log in. And that includes the touch bar on your Mac, that includes YubiKeys and a lot of other security key options.

• 15:59Speaker 00

  Got it. And so let's go to security at Gemini, right? And not so much like, hey, how do you secure people's crypto assets? But more from like a framework standpoint, how do these exchanges and these infrastructure providers think about design of security, right? So the way I see it is like, you have to have certain things that are built that people don't know how they work, right? That's part of the security is the fact that they don't have the information. At the same time, you have to design the security functionality that you provide to users in a way where it's intuitive from a user experience standpoint and it's usable, right? You don't have to be highly technical to actually be secure on the site. Like, how do you think about it from a framework standpoint as you kind of build these nuanced features?

• 16:44Speaker 01

  So with the security keys that we're talking about, that's a great question, by the way. So people on the crypto-

• 16:48Speaker 00

  All I do is great questions on this podcast.

• 16:50Speaker 01

  I should stop saying that. People who use these security keys, if you're in the crypto space already, you're on the bleeding edge of understanding how public key cryptography works, the future of money and how to secure yourself, right? Security keys are very much going to be the next big thing in terms of securing your accounts. It'll be the standard across everywhere shortly. So with Gemini, it was very important for us to be on that front line, leading that push to get people on security keys, so no one can fish their accounts anymore if they have security keys only and no other backup plans. So being on the front lines of security is very important to us and educating our user base about that is very important to us.

• 17:26Speaker 00

  For sure. And look, it's one of these things also where I've even seen exchanges that they move funds quite consistently be- Because the example that one of the security folks at this exchange that does this told me is like it's hard to hit a target, but it's even harder to hit a moving target, right? And so the movement of the funds is almost where they don't know where something will be at any one given time. And so when you start to think about the complexities of security, right, it's not just can we keep people out, it's also, even if they get in, is there a way for us to prevent them from getting into a place where there's all of the money or the crypto, right? So compartmentalizing it and doing all these different things, I think, is not very well understood by users,

• 18:10Speaker 00

  but obviously very important if you're an infrastructure provider like Gemini.

• 18:12Speaker 01

  Right, right, yeah. And that's where kind of cold storage and cryogenic storage, geographically separated, makes it very difficult for anyone to try to target any one person or one place.

• 18:22Speaker 00

  For sure. For those that are listening and have not yet read Ben Merzick's new book Bitcoin Billionaires, when he came on, I think we talked about it as well, but there's a story of Cameron and Tyler Winklevoss, who are the founders of Gemini, that when they first started buying Bitcoin in sizable amounts, they actually went ahead and wrote down the private keys, split them up into different writings, and then flew around the country and put them in safety deposit boxes. And so if you want to hear that story, you can go read that book. Ben, I'm trying to help you sell books, man. Give me some love every once in a while.

• 19:04Speaker 00

  Let's go to hardware wallets, right? So everything we've talked about is kind of software products, right? Where I kind of log into an online infrastructure provider. There's plenty of people who are using these hardware wallets. Where are you and kind of help us think through the security on the hardware wallet side?

• 19:22Speaker 01

  Sure. So hardware wallets are a really innovative part and a unique part of the cryptocurrency industry, right? It's an exciting part that existing banks don't let you use. There is a trust relationship with the hardware wallet. So, anyone who tries to make you believe that there's no trust involved in a hardware wallet is being completely disingenuous. So, just keep that in mind when you purchase these products. You're essentially trusting that company. Now, what we offer, we say that security is our product, and that's important to us.

• 19:48Speaker 00

  So, going back to the idea of security, one of the things that I've seen on Twitter is people are very interested in the security of their cryptocurrency, right? They're very interested in how I protect my email, my Twitter. Like, they kind of go down this rabbit hole of security once they start trying to secure their crypto. Before we started recording, you were telling me that there's a hack around a voicemail PIN and WhatsApp. Tell me more about this.

• 20:15Speaker 01

  So, the research was done by a guy named Martin Viggo, and it's really exciting. We talked earlier about SMS account recovery. So, if you forget your password, if you write "forget password," then the service will send a text to the phone number associated with that account with a code to reset your password. Now, some services also allow you to get this code via phone call. So, it'll be a robot voice on the other end of the call saying, "Your code is 82653." And the issue is, if you don't answer this call, it goes to your voicemail, and that code is still being read by that robot voice in your voicemail. Now, the thing about voicemails is that they're remotely accessible. I don't need access to your phone number, I don't need to have control of your phone number, to be able to try to log into your voicemail.

• 20:59Speaker 01

  So, if you don't have a voicemail PIN set, then yours is the default for your carrier. And some carriers just make that default the last four digits of your phone number, for example. So, I can remotely log into your voicemail, recover this code from this automated voice being played, and log into that service. So, WhatsApp is a really good example of a service that's affected by this. Anyone who has no voicemail PIN is effectively vulnerable to having someone else access their WhatsApp because they don't have a voicemail PIN.

• 21:25Speaker 00

  What's the connection between the voicemail and WhatsApp?

• 21:28Speaker 01

  So, WhatsApp is a service that allows you to reset or give control of your WhatsApp to a different phone number, and you get that verification code. Via call to your existing phone number. So when that call goes to your voicemail and that robot voice is reading that code, then anyone can get control.

• 21:44Speaker 00

  Got it. So if you're able to listen to the voicemail, then you could get the code and they can go to WhatsApp and you could hack into it. Yeah. And so in most phone settings, I'm guess you can just put in an actual voicemail PIN number.

• 21:56Speaker 01

  Or even disable it. You can even call your carrier and disable your voicemail altogether.

• 21:59Speaker 00

  So I don't have voicemail set up, not for security reasons, because I don't want to get anybody to leave me messages. But I was being more secure than I even realized.

• 22:08Speaker 01

  That's right.

• 22:09Speaker 00

  Awesome, man. Anything else that's kind of top of mind for you when it comes to security in crypto?

• 22:14Speaker 01

  I think we enumerated a lot of really good steps here and it's just that simple. Everything that we just talked about today can take you from very bad security to very good security for your personal accounts. And anyone listening to this, anyone who's involved in crypto or wants to have secure accounts should implement these simple steps.

• 22:31Speaker 00

  Awesome, man. Thank you so much for coming to do this. I think this is probably one of the shortest podcasts we've ever done, but one of the most important because there's so many people I meet that they simply have a email and a password with all of their crypto on an exchange and it's just waiting for somebody to come and take it, right? And hopefully people listening to this can move from whatever level of security they are to a more expert level of security over time. So thanks so much for coming in and sharing this.

• 23:02Speaker 01

  Thank you so much, Anthony.

• 23:03Speaker 00

  Hey, everyone. Pop here. If you liked this episode of Off the Chain and want to help us take crypto to the top of the Apple, Spotify and other podcast charts, please do us a favor and rate, review and subscribe. To review, simply go to the Off the Chain homepage, scroll down until you see the five blank stars. Taking 15 seconds to fill those stars in and leave a quick review goes a long way in helping us take the entire crypto ecosystem to the top of the charts. I appreciate you listening and see you next time on Off the Chain.