Web3 will bite you in the Web 2 0 exploring IPFS threats

### Overview Presented by a researcher from Trend Micro's Forward-Looking Threat Research team, this talk investigates how the InterPlanetary File System (IPFS) and decentralized Web3 technologies intersect with contemporary cyber threats. Originating from exploratory research into Web3, cryptocurrencies, and smart contracts, the investigation evaluates how criminals exploit distributed storage networks—principally for spear phishing, potential malware delivery, and data exfiltration—and highlights the defensive hurdles posed by decentralized architectures.

### Key Topics - **Web 3.0 vs. Web3:** Contrasting the semantic, agent-based web favored by Tim Berners-Lee against the cryptocurrency- and blockchain-driven concept of Web3. - **IPFS Architecture & Addressing:** How content-addressable storage operates using Content Identifiers (CIDs: v0 and v1) structured as Merkle Directed Acyclic Graphs (Merkle DAGs), alongside mutable pointer systems like IPNS, DNSLink, Ethereum Name Service (ENS), and Unstoppable Domains. - **Gateways and Centralization:** Why protocol complexity and performance issues drive users and attackers toward HTTP gateways (such as Cloudflare or public gateways) rather than native nodes. - **Observed Threat Activity:** Trends in spear phishing leveraging IPFS gateway URLs, historical displacement following the shutdown of SiaSkynet, and emerging indicators of data exfiltration. - **Defense Challenges:** The near impossibility of traditional content takedowns, the risks of relying on domain-level blocking, and sandbox visibility blind spots.

### Technical Details IPFS functions similarly to BitTorrent but is organized as a content-addressable network using CIDs representing cryptographically hashed Merkle DAG structures, allowing deduplication and file reuse. To address the immutability of CIDs, IPFS introduces IPNS (InterPlanetary Name Service). However, IPNS requires hourly DHT record refreshing and is noticeably slow, often taking 15 to 30 minutes to resolve, which led threat actors to largely abandon IPNS-based phishing after an initial surge following the demise of SiaSkynet (CSky).

Because native client adoption (via clients like Kubo or specialized browsers such as Brave and Opera Crypto Browser) requires running a local node/gateway, attackers overwhelmingly route victims through public or commercial HTTP gateways. The speaker observed that while overall gateway traffic has fluctuated, spear phishing URLs linking to IPFS-hosted content have steadily grown. Conversely, hosted malware samples remain low in retrospective analysis—earlier research by Cedric Pernet identified roughly 180 IPFS malware samples, but follow-up scans yielded zero, likely because endpoint security solutions eliminated them or original hosts unpinned the files.

Technically tracking or taking down content is thwarted because identifying the original IP address hosting a CID is nearly impossible across the peer-to-peer network. In addition, blocking single domains is ineffective because a single CID is frequently mirrored across numerous rotating public gateways. Defensively, while blocking IPFS traffic (such as default port 4000) is an option, legitimate enterprise use cases (e.g., Netflix using IPFS for container distribution) may prevent outright protocol bans. Furthermore, because IPFS requests can be deliberately slow, threat actors can abuse retrieval latency to evade sandbox analysis windows.

### Takeaways While IPFS threats currently represent a small fraction of overall cybercrime compared to traditional web infrastructure, phishing campaigns using gateway URLs continue to trend upward. Emerging underground activity indicates threat actors are exploring encrypted IPFS objects for data exfiltration and second-stage payload delivery. Security teams should monitor URL patterns containing IPFS CIDs rather than attempting to blacklist individual gateway domains, account for protocol blind spots in automated sandboxes, and maintain awareness of decentralized storage risks as venture capital investment continues to drive enterprise adoption.