Cristiano Frassineti, Author at Aiternalex

About Cristiano Frassineti

I'm Cristiano Frassineti, a fullstack developer with a passion for Blockchain. I've started my carreer since I was a kid: the curiosity has always driven me to understand how stuff works. With the year I keep studying, specializing in Python and nodeJS, until 2 years ago when I started my journey into Blockchain. With this newfound spark I started learning smart contract languages (Solidity) and I'm currently working on an Ethereum project, an entire ecosystem with the goal to ease the transition to the decentralized world.

Entries by Cristiano Frassineti

How Minecraft almost destroyed the Internet

05/04/2023/in Innovation/by Cristiano Frassineti

The Log4j Vulnerability and its Impact on Minecraft

Minecraft, the wildly popular sandbox video game created by Mojang Studios, has captivated millions of players worldwide with its limitless creativity and expansive virtual worlds. However, in late 2021, a vulnerability in a widely used logging library called Log4j threatened the game’s stability and, more alarmingly, the safety of the entire Internet. In this blog post, we’ll dive into the details of the Log4j vulnerability, explore how it affected Minecraft, and discuss the lessons learned from this cybersecurity crisis.

The Log4j Vulnerability: A Brief Overview

Log4j is an open-source Java-based logging utility developed by the Apache Software Foundation. It is widely used by developers to record system events and monitor software applications. In December 2021, a critical vulnerability known as Log4Shell (CVE-2021-44228) was discovered in Log4j.

This vulnerability allowed attackers to remotely execute arbitrary code on the affected systems by merely sending a specially crafted string to the vulnerable application.

The severity of the Log4j vulnerability stemmed from its widespread use and the ease with which it could be exploited. Within days of its discovery, the vulnerability had been weaponized by malicious actors, leading to widespread attacks on various organizations, including government agencies and private businesses.

Minecraft and the Log4j Vulnerability

Minecraft, which runs on Java and utilizes Log4j for logging purposes, was one of the most high-profile targets of the Log4Shell vulnerability. As soon as the vulnerability was made public, hackers started targeting Minecraft servers, exploiting the Log4j flaw to execute malicious code, steal sensitive data, and disrupt server operations.

The situation was further complicated by the massive scale of Minecraft’s player base and the sheer number of community-hosted servers, many of which were run by hobbyists with limited cybersecurity knowledge. This made it challenging for Mojang Studios and the broader Minecraft community to respond quickly and effectively to the threat.

How Minecraft Responded to the Threat

Mojang Studios, the game’s developer, and Microsoft, its parent company, took immediate action to address the Log4j vulnerability. They released a series of patches for both the official game servers and the client-side software to mitigate the risk of exploitation. Additionally, they provided clear guidance to the community on how to update their servers and protect their users.

However, the response was not without its challenges. Due to the decentralized nature of Minecraft servers, many community-hosted servers were slow to apply patches, leaving them exposed to ongoing attacks. In some cases, attackers took advantage of this lag by creating fake patches laced with malware, further compounding the problem.

The Fallout and Lessons Learned

The Log4j vulnerability in Minecraft serves as a stark reminder of the potential consequences of a single software vulnerability in our interconnected digital world. Although there were no reports of widespread destruction resulting from the Log4j exploit in Minecraft, the incident highlighted the importance of robust cybersecurity practices in gaming and beyond.

Here are some key lessons we can take away from the Minecraft Log4j crisis:

Regularly update software and apply security patches: Ensuring that software is up to date with the latest security patches is critical in preventing vulnerabilities from being exploited. In the case of Minecraft, applying the official patches released by Mojang Studios would have prevented many of the issues faced by community-hosted servers.
Increase awareness of cybersecurity best practices: Many server administrators and users may not have been aware of the importance of applying patches or the potential dangers of downloading unofficial patches. Raising awareness of cybersecurity best practices can help mitigate the risks associated with incidents like the Log4j vulnerability.
Strengthen collaboration between developers and the community: The Minecraft Log4j incident underscored the need for better communication and collaboration between software developers, like Mojang Studios, and the broader user community. By fostering a strong relationship with users and encouraging feedback, developers can more effectively address security issues and provide timely support during crises.
Emphasize the importance of layered security: While addressing the Log4j vulnerability in Minecraft was crucial, it’s essential to remember that no single security measure is foolproof. Adopting a layered security approach, which combines various defensive measures, can help protect digital assets and systems against potential attacks.
Encourage open-source software audits: The Log4j vulnerability remained undetected for years, despite the library’s widespread use. Encouraging and funding regular audits of open-source software can help identify and remediate vulnerabilities before they can be exploited by malicious actors.
Foster a culture of responsible vulnerability disclosure: The timely public disclosure of the Log4j vulnerability by its discoverers allowed developers and organizations to take swift action in addressing the issue. Encouraging a culture of responsible vulnerability disclosure, where security researchers and organizations work together to remediate vulnerabilities before publicizing them, can help prevent the weaponization of such flaws.

Conclusion

The Log4j vulnerability in Minecraft demonstrated the profound impact that a single software flaw can have on the digital world. While the incident did not lead to the destruction of the Internet as we know it, it highlighted the importance of robust cybersecurity practices and the need for collaboration between developers, users, and the cybersecurity community. By learning from this experience and taking proactive steps to secure our digital assets, we can hope to mitigate the risks associated with future cybersecurity threats.

Deep dive into cybersec: exploits

11/01/2023/in Innovation/by Cristiano Frassineti

In general terms, an exploit is a series of actions executed to derive the most benefit from a pre existing resource.

In computer security we could interpret it as a piece of software, a chunk of data, or sequence of commands that takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer software or hardware. This can include data leakage, privilege escalation, arbitrary code execution (often used as part of a zero-day attack), denial-of-service attacks and viruses.

Going even deeper, this term is used to describe the use of low-level software instructions that exceed the intended function or design of a computer program.

Hackers are always on the lookout for vulnerabilities. They use exploits in order to gain personal data, such as credit card numbers, bank account access, social security numbers and all kind of sensitive information.

The most common vectors for an exploit is injection:

A SQL injection, where a bad actor (or someone posing as is) injects malicious code into an entry field in order to extract data from a database.
An XSS attacks, where a bad actor injects malicious bits into a website’s source code in order to extract data from the website’s database or server.

Famous exploits

There are many famous exploits and hacks but some of the ones that are most prominent in the public eye are Heartbleed, Sony PlayStation Network Hack, Target Security Breach, Eternalblue (that started the Ransomware trend).

Heartbleed is a vulnerability in OpenSSL that was discovered on April 7, 2014: it was a bug in the protocol that allowed attackers to steal information from servers without being detected. This exploit affected over 66% of all web servers globally, including sites like Yahoo!, Facebook, Google, and Amazon.

The Sony’s PSN (PlayStation Network) one happened even before: In 2011 a group of hackers stole personal information from 77 million accounts. The hackers were able to do this because they had obtained PSN usernames and passwords from an outside party who had hacked into Sony’s network earlier that year.

Target‘s security breach occurred in the 2013 holiday shopping season and saw 40 million credit cards stolen from their systems: in that case the hackers used malware sent to Target’s point-of-sale terminals to steal card data while it was being entered into the system.

Another famous example has been the WannaCry exploit, carried through Eternalblue, a vulnerability discovered by the NSA and kept secret until leaked by a group called Shadow Brokers. It is a security exploit that affects Microsoft Windows and was unpatched at the time of public disclosure. The Eternalblue exploit has been one of the most dangerous exploits in the world, and it has been used to create some of the most devastating ransomware attacks. The Eternalblue exploit has been used to spread WannaCry, NotPetya, and BadRabbit ransomware attacks.

Ransomware is a type of virus that locks up data in the victim’s computer and demands payment in order to release it. It usually spreads through email attachments, downloads from untrusted sources, or in general through a vulnerability in the system.

Stay safe out there!

As the number of people and devices connected to the internet has increased, so have the number of cyber attacks: cyber criminals are always on the lookout for new ways to exploit vulnerabilities in your system.

To prevent it, it’s important to take measures to make sure you are not vulnerable:

always update your software and hardware regularly
use strong passwords and change them regularly
use two-factor authentication whenever possible
have a security suite installed that includes antivirus protection and firewall settings that block suspicious or malicious programs from accessing your system.

The latter is especially important for Windows users, but this doesn’t mean that Linux and macOS users should feel safe: as the usage and distribution of Unix based system increase and gain popularity, so are the researches on possible attack vectors.

Updates are a crucial part of keeping your device protected. These updates not only stop exploits, but they improve the security of the device and protect it from known vectors of attack: the biggest part of the most devastating exploitations have been carried out due to unpatched systems (even after the patches have been distributed).

The internet is a digital world that is both beneficial and harmful. It was created to connect people from all over the world, but it has also created a space for hackers to exploit vulnerabilities, posing a risk to everyone without proper knowledge of the problem. That’s why It is fundamental to learn how to protect your privacy and your data, and to gain consciousness about online security and online threats.

Knowledge is power, the power of defending your data from malicious attacks in this case.

Blockchains and Security

30/11/2022/in Blockchain/by Cristiano Frassineti

Blockchain is a digital ledger that records transactions across many computers. It is a distributed database, meaning there are many copies of it and new information can be added only if all participants in the network agree.

Blockchain technology is a powerful tool for improving security and reliability: however, it is not without its risks and dangers.

EXPLOITS

The most prominent risk in blockchain technology is the vulnerability to exploits. These are threats to the blockchain that arise because of bugs or violations of assumptions in the system’s design. There are two types of exploits: those that exploit bugs (e.g., denial-of-service attacks) and those that take advantage of flaws in the system’s design (e.g., reentrancy). For example, an attacker can use a denial-of-service attack to make a node go offline by sending it an overwhelming number of messages or queries that it cannot handle.

REENTRANCY

A reentrancy exploit happens when an attacker sends two different transactions at the same time, one after another, with each transaction making changes on behalf of the attacker without waiting for the other transaction to finish executing first. The second transaction will be able to carry out its changes even before the first transaction returns a response. If a blockchain’s transactions are not atomic, that means that if an attacker sends two transactions at once, and the second transaction executes before the first one finishes executing, it can carry out its changes without waiting for the first transaction to finish. This is called reentrancy and is considered to be a major problem for blockchains like Ethereal due to its reliance on smart contracts.

Other types of security concerns

Security in blockchains is a key concern for many investors and companies who are looking at ways to use blockchain technology in their business model. In addition to the ones stated above, there are various other risks that need to be addressed such as human errors, phishing attacks, and code vulnerabilities (especially in smart contracts enabled chains).

CODE VULNERABILITIES

Code vulnerabilities are a direct consequence of the smart contracts, a form of code supported by many Blockchains. Smart contracts are computer protocols that execute the terms of a contract. The best way to think about them is as a self-operating computer program that automatically executes when certain conditions are met.

The vulnerabilities in smart contracts are caused by poor coding and bugs in the code. There is a lot of risk within them, due to the difficulty of editing after they have been deployed. Bugs can be exploited by hackers, who can use them to steal money or data from the blockchain, eg. accessing functions of the code that shouldn’t have been executable.

In the blockchain world, smart contracts are used to automate some of the processes that are usually done manually, but as always, automation increases the level of risk.

One of the most typical vulnerabilities is the reentrancy risk stated above, which affects smart contracts in a very common way due to their method based structure with self assessed access control.

PHISHING ATTACKS

On the other side, phishing is when someone steals your credentials for a service such as logging into your bank account or social media account, by pretending to be another person who you know from an email, text message, phone call, etc. Private keys are used to sign transactions on a blockchain which means that if someone were able to steal your private key, they would have access to your funds and to all the functions of the smart contracts you deployed.

Phishing scams are, in general, the most common type of cyberattack. Malicious actors use social engineering to gain access to your private key in order to take control of your account.

It’s usually a pattern comprised of four steps:

Fraudsters will create a fake website that looks identical to the legitimate one;
They will send spam emails or messages on social media sites like Facebook, Twitter, etc.;
They will then trick you into entering your private key or mnemonic phrase on their site;
And finally, they will steal the information they need from you and use them to act on your behalf.

Phishing is not a new phenomenon but it has become more sophisticated with the advent of social media and other online tools. It can be difficult for people to recognize phishing attempts because they are made to look like legitimate messages from trusted sources.

Human Errors

Last but not least, there are many types of human errors that can lead to security breaches in blockchain networks. The most common type of human error is social engineering, which is an attack that uses deception to gain access to private information or data. Human error is a big risk in blockchain security because of its complexity. Social engineering is a type of human error that can be mitigated by ensuring people are well trained in what to do and what not to do when interacting with blockchain technology. Social engineering attacks can occur when humans are given organizational information that they’re not supposed to have access to, like passwords or keys (as stated before). We just talked about the most common type of social engineering attack – phishing – but as stated before it doesn’t stop there: other vectors of attacks are:

spoofing, which is when someone pretends to be someone else through email or phone, usually with matching geographical location;
vishing, which is when hackers call a victim on the phone and persuade them to give information for something that doesn’t exist.

Malicious actors: scams and rug pulls

The crypto world is full of scam projects. It is important to be able to spot them before investing in a project.

A scam is an intentional deception or fraud, typically involving the use of false or misleading information designed to take advantage of others.
A rugpull is a tactic used by market manipulators that involves convincing investors into buying tokens often by issuing positive statements about the project’s prospects, while having the only intention to pull (as to remove) all the value injected by users to steal it.

The crypto market is not a safe place and there are many people who want to take advantage of the lack of knowledge and experience. Scam projects are often launched by developers with the intention to steal from investors. They promise unrealistic returns in order to get more attention for their project, but in most cases, they fail miserably or just disappear without a trace. Some other ways scammers try to take advantage of inexperienced investors are:

Promising guaranteed profits that cannot be achieved in reality
Selling tokens at a discounted rate
Creating fake ICOs
Promising free tokens in return for major assets

Scams are a major problem in the crypto space. With so many projects launching and tokens being distributed, it is becoming more and more difficult for the average user to distinguish between a scam and a legitimate project.

To defend yourself from those risks, you should only invest in tokens with liquidity lock-ups. This prevents the token from being sold on the market before its release date, which reduces the chance of a scam or rugpull happening. With locked liquidity, nobody is able to pull the invested value from the project. Is also very important to be aware of the circulating supply of the token you are invested in and of the distribution of the same (tokenomics).

Having actors with unlocked high percentages of the total supply is a concrete risk.