JAYMAN¹

Front-end web developer 💻, blockchain dev 💻-💻 , an aspiring software engineer. Currently building aparti-i 🏡

[JAYMAN¹ @jaymandev]

First million this year 🙏

[JAYMAN¹ @jaymandev]

@solweirdos @avaxpepee 8w7Zha3aLwrQjTrk4Gvtxj1zgubmxQ9UKAcd7QYsfjhk

[JAYMAN¹ @jaymandev]

@gohighlevel Yeah, Your server is down

[JAYMAN¹ @jaymandev]

I just passed the Certification: Blockchain Basics exam on Cyfrin Updraft! https://t.co/8nIx4OpHW2

[JAYMAN¹ @jaymandev]

@FlooffiOfficial 0xD1977617BEa784aDEfB85e35CF57E3625F869FB3

[JAYMAN¹ @jaymandev]

@jayman_dev @FlowX_finance @GiveRep Good

[JAYMAN¹ @jaymandev]

@jayman_dev @GiveRep Take

[JAYMAN¹ @jaymandev]

@MagicEden 8w7Zha3aLwrQjTrk4Gvtxj1zgubmxQ9UKAcd7QYsfjhk

[JAYMAN¹ @jaymandev]

@solpengumeme 8w7zha3alwrqjtrk4gvtxj1zgubmxq9ukacd7qysfjhk

[JAYMAN¹ @jaymandev]

@LucaNetz 8rDtUUgXk7E6G97RsnNFCHbPpVRVNJEXk7Pk7fJpSzX2

[JAYMAN¹ @jaymandev]

@LucaNetz @pudgypenguins 0xD1977617BEa784aDEfB85e35CF57E3625F869FB3

[JAYMAN¹ @jaymandev]

@monad_xyz 0xD1977617BEa784aDEfB85e35CF57E3625F869FB3

[JAYMAN¹ @jaymandev]

@SentientAGI really testing my IQ to get a piece of Dobby

https://t.co/9rAwpkKtik

[Sentient @SentientAGI]

Dobby enthusiasts, the time is now.

We had 661,494 pre-registrations, and we want to give 𝐘𝐎𝐔 participants early access to a fingerprint and ownership claim in Dobby.

Prove your intelligence.
Claim your ownership.

https://t.co/y2o1MGywYt
https://t.co/P9gm6reWyg

[TrustSec @TrustSecAudits]

Found myself one click away from falling to a spear phishing attack today! If you're giving services in the web3 space, be VERY careful with who you interact and how the initial exchanges of information are done.

2 weeks ago, @nftbigsummer approached for security services for their supposed project, https://t.co/AKp3VxyDOv

He asked to discuss things in "the conference". I understood that to be EthCC, later I realize that referred to a Zoom conference.

So we scheduled for today over my calendly. Once it was time, instead of joining the Google meet they sent a Zoom link

That was weird, I asked them to join the meet but they insisted:

Since they were already waiting, I went ahead and tried joining. The link led to the page below:

[TrustSec @TrustSecAudits]

Clicking Launch downloaded the Zoom exe

But that didn't make sense since Zoom is installed. This could happen perhaps if the local Zoom is outdated, but it was suspicious enough to start checking things.

- Checking the URL was an instant fire alarm - https://t.co/1txVmQtO8o (Real one is https://t.co/YskcoZnxB3)
Running it by a URL reputation checker shows it can't be a legit Zoom URL.
- Going back to the video pic, googling their names showed they are GitLab employees🤨
- Connecting to the meeting ID through the Zoom client fails.

At that point I stopped comms with the scammer, but this was a whole lot closer than it should have been.

Scammers are becoming more sophisticated now and Web3 sec bros are a prime target for social engineering:
- Mostly on-chain payment of serious cash
- Access to zero days during disclosure periods
- Access to sensitive private repos

Here they went for the maximum pressure play by making it seem like everyone is waiting to start the call. The conf call link is also an unusual vector, and the link to a legit looking project lowered my defenses somewhat. They also popped a redirect to the real Zoom website after pressing the download button, quite sneaky.

Takeaways:
- Don't accept powerful/complex file formats from clients (.exe, python packages, .zips etc)
- Sensitive files, wallets etc should probably not be on the day-to-day device
- Be on the lookout for more advanced social engineering vectors. Assume the next one is only going to be harder to spot.

[JAYMAN¹ @jaymandev]

I just deployed a Smart Contract to the @zksyncdevs testnet!

Thanks @PatrickAlphaC and @cyfrinupdraft!

[JAYMAN¹ @jaymandev]

@twistedbeing7 @Adetunjijay Late comer 😂 😂 😂

[Jaylead (CAPM®) @Jaylead5]

I do outdoor once in a while

Thanks to Big B @boldrack with @jaymandev

[Patrick Collins @PatrickAlphaC]

If you are a devrel in web3.

Or a documentation writer.

Or a solidity developer framework.

And you are encouraging developers to put their private keys into unencrypted plain text (in a .env or elsewhere)

These are partially your fault.

Fix your documentation now.

[Patrick Collins @PatrickAlphaC]

Working on updating everything for the 2024 edition of the Cyfrin Updraft foundry and solidity curriculum.

Wish me luck

[JAYMAN¹ @jaymandev]

@PatrickAlphaC 🤞