[Application]Anti-phishing browser extension

💸 Grants
1

Radworks Grant Application

This document will be part of the terms and conditions of your agreement and therefore needs to contain all the required information about the project. Don’t remove any of the mandatory parts presented in bold letters or as headlines! Lines starting with a > (such as this one) can be removed.

See the Grants Program Process on how to submit a proposal.

  • Project Name: Nighthawk
  • Team Name: PhishFort
  • Payment Address: 0x689874C41A979082EEd74ca880Ca3487aF85710D
  • Category: Web3 and FOSS

:warning: The combination of your GitHub account submitting the application and the payment address above will be your unique identifier during the program. Please keep them safe.

Project Overview :page_facing_up:

Phishing is the biggest security challenge that end users face in crypto, period. We are in desperate need for crypto centric solutions to our security issues in the space and phishing is no different. From fake Vitalik giveaways on Twitter to phishing streams from the EF on youtube to good old fashioned phishing emails, we have a challenge on our hands when it comes to keeping our users safe. Users need to know:

  1. That when they interact with websites, social media accounts, social media posts, that they are in fact interacting with the person(s) they think they are (authenticity).
  2. That as far as is possible, they are not interacting with malicious content online.

NightHawk addresses both of these problems using a clean UI and UX for the end user.

Phishing is far more than just a security threat to the ecosystem. It’s regularly cited by both newcomers and experienced users as one of their biggest fears and hurdles to adoption in the space. Phishing is a hurdle to adoption. We put forward this project as a positive step towards keeping users safe online in our industry.

Overview

Nighthawk is a free anti-phishing browser extension offering safe browsing in the web3 field.

The plugin is 100% open source, privacy focused and does nothing to store users browsing history or anything else privacy compromising on our servers. It is almost completely serverless with all activity happening in the browser for the user.

It’s widely known that the crypto space, including the Polkadot community, is consistently under the threat of scams. While quantifying the exact losses is challenging, phishing attacks have resulted in the loss of hundreds of millions of dollars across the crypto ecosystem. PhishFort is embarking on a significant initiative by creating a consumer-oriented, community-driven, free, and efficient solution to combat this problem. While our primary business involves providing B2B services to various industry communities, this project is our way of giving back to the entire crypto industry without commercial interests.

Our motivation to undertake this endeavour stems from our deep understanding of the crypto landscape and the severe damage inflicted by phishing attacks in a matter of minutes. What has been missing in this fight against phishing is a swift response mechanism driven by the community. Although we take pride in promptly removing malicious content from the internet, we recognise the need to offer real-time protection to end users if we are to collectively address this problem. Nighthawk has been designed to serve this exact purpose.

For too long, end users have been easy prey for scammers, but we aim to change this dynamic. By allowing users to report scams and disseminate these reports to the entire userbase for near real-time protection, we aspire to transform potential victims into proactive responders.

The MVP of the project has been successfully deployed to the Chrome Store and Add-ons Store, available here:

https://chrome.google.com/webstore/detail/nighthawk-by-phishfort/bdiohckpogchppdldbckcdjlklanhkfc

https://addons.mozilla.org/en-US/firefox/addon/nighthawk_plugin/

The stack is mostly TypeScript based, with React for most front end components and GCP cloud provider to facilitate the sharing of threat intel with the extension.

As a next step, we aspire to integrate auto-classification and rule-generation engine into the plugin.

Here are three steps to this:

  1. Heuristic engine development
  2. Rule generation and integrating submitting rules suggested by the community
  3. LLM based rule generation

Team :busts_in_silhouette:

Team members

  • Team Lead: Valentyn
  • 23 team members at PhishFort all of whom will contribute to this in various ways, from engineering to analysis of reports, to the design of the project.

Contact

Legal Structure

  • Registered Address: 160 Robinson Road, #14-04 Singapore Business Federation Centre, Singapore
  • Registered Legal Entity: PROTAKEDOWN PTE. LTD.

Team’s experience

PhishFort is an anti-phishing security team dedicated to fighting phishing in the crypto world. We’ve been working in the space for 5 years now, building quietly and helping some of the biggest web3 and crypto companies in the world execute an anti-phishing strategy with us. We detect and shut down scams in the space and we’re proud of the work we’ve done and continue to do to date. EF will know many of our partners (wallets, DEXs, dApps etc) who we work with in the space to keep safer.

The above is shared to say that above all else, we as a team do nothing but fight phishing in the crypto space, 24/7.

Team Code Repos

Public repo of the project: https://github.com/phishfort/nighthawk-extension

Team LinkedIn Profiles (if available)

Project Description :page_facing_up:

Please describe why you are applying for this grant.

Deliverables :nut_and_bolt:

  • Total Estimated Duration: 10 months
  • Full-time equivalent (FTE): 5 (see)
  • Total Costs: $50,000

:exclamation:The more you can organize your milestones into manageable chunks that are conducive to iteration, the better!

Milestone 1 — Heuristic engine

  • Estimated duration: 2 months

  • FTE: 6

  • Costs: 10,000 USD

Number Deliverable Specification
1. Research Conduct a final research on set of rules to start off with
2. Design heuristic engine and rule structure Finalize the architecture and rule definition
3. Create initial rule sets For the first milestone we’ll be handcrafting and manually assessing the initial set of rules
4. Accuracy modeling and testing Run initial rules in controlled environment and minimize false positives and assess performance

Milestone 2 — Rule generation

  • Estimated Duration: 3 months

  • FTE: 5

  • Costs: 15,000 USD

Number Deliverable Specification
1. Functionality for accepting rules from users Add UI/UX, testing, evaluation and distribution of users’ submitted rules
2. False positive check False positive auto check for community rules against an appropriate dataset
3. Performance feedback for users’ rule Run a test of the users’ rules on sample websites and report performance back to users. This allows the user to assess whether the rule performs as expected
4. Data collection Search, sort and pack subsets of data sets for model training for Milestone 3

Milestone 3 — Auto-classification

  • Estimated Duration: 5 months

  • FTE: 5

  • Costs: 25,000 USD

Number Deliverable Specification
1. Model configuration Group rule datasets and relevant training data for LLM processing
2. Model training Apply insights to the data using human and machine-assisted activities and expose the model to a vast amount of data. Research to be conducted on performance of RAG/FT/PEFT and choose an appropriate mechanism
3. Model performance evaluation Determine the effectiveness of the data within the model and adjusting pre-trained parameters to improve its performance
4. Alpha testing Test the model within small group of volunteers and team
5. Open beta After bug fixing and mitigating issues, open testing to a wider audience
6. Release Public release

Future Plans

We are a team of security professionals who will battle phishing to make web3 space as secure as possible for everyone. We believe that auto-classification would bring anti-phishing protection to a new level. In addition, crypto communities is a crucial part of our venture, thus we want to foster a strong sense of collaboration, transparency, and innovation within these communities to drive the success of our project and contribute to the broader growth of the cryptocurrency ecosystem.

:exclamation:This is a good place to share how you might like to get more grant funding for future work

Additional Information :heavy_plus_sign:

How did you hear about the Grants Program? Medium

Last year we acquired a grant from Coinbase to build the MVP. Unfortunately, their grant program is closed this year. Thus, we are actively seeking fresh prospects to enhance Nighthawk further.