bookmark_borderIntroducing CannSecure

Those who are looking for intormation security solutions in the Medical Cannabies industry will have a hard time finding the right company. CannSecure was initiated in order to fill the need. They are our partners.

CannSecure is made to support the Medical Cannabis industry with services such as consultation, audits, information security policy creation and crypto advisory services. If you are looking for the right company to make sure your pots’s systems are secured, don’t hesitate to reach out to them.

  • Information security services dedicated for the Cannabis Industry
  • Expert worldwide team members
  • Backed by publicly traded OTC company
  • Cannabis tokenization and crypto integration for external clients (ERC20, ERC721 and ERC1155 / NFT and more)

You can find the contact and the details of the services listed on the website: https://cannsecure.io/

bookmark_borderEvents in May 2021: Blockchain Budapest 4.0 and CCTF

BDAY is organized again in 2021 with great talks, presentations and the CryptoCurrency (is) The Flag hacker game.

This is another chance to meet the best in the largest cryptocurrency and blockchain gathering of Central Europe. Topics as follow:

  • NFTs and their real values
  • DeFi and its future
  • Largest Hungarian Blockchain projects such as CCTF or ILGON
  • …and the first Satoshi Statue 🙂
Website: https://blockchainbudapest.hu/

The presenters and those who own a VIP ticket will be able to take part in the networking. We hope to see you there!

bookmark_borderCrypto Guide for Beginners: Start playing CCTF

With our partners* and sponsors* we are organizing CCTF for the 5th and 6th time in 2021 May. Just like at the previous events, we are providing a guide for beginners. This helps you to get started with hacking Ethereum smart contracts.

It is recommended to move step by step. Follow this guide and you will understand the basic logic of cryptocurrencies, blockchain and smart contracts.

*Partners: CryptAll / H.A.C.K. / BsdiesBUD / BlockchainBudapest

*Sponsors: HODLbag / CasperLabs / MyCryptoSeed / ILGON

Vol 5. reward for the winners: ~$6000 in crypto (ETH and tokens) and some extra awards for those who are present at the conferences 😎

Vol6. rewards to be announced soon.

CCTF Vol5. registration (event finished): https://vol5.cryptoctf.org/

CCTF Vol5. starts on 18th May, at 9:15 and finishes at 16:00.

CCTF Vol6. registration: https://vol5.cryptoctf.org/register

CCTF Vol6. starts on 27th May, at 8:35 and finishes at 17:00.

Guide intro

Cryptocurrencies such as Bitcoin and Ethereum allow you to handle digital assets on decentralized networks. There is no central authority which can censor or block your account.

Accounts are stored in digital wallets, eg. “ethereum wallet”. If you use “Metamask ethereum wallet”, you have full access your wallet, meaning only you have the private keys that are needed to make transactions. The public part to share from this wallet is only your ethereum address. In fact, when you send 1 Ethereum to another person, to his address (into her/his wallet) what happens is that you sign a transaction with your private key that this 1 Ethereum no longer belongs to you, but to the other address. That’s it. The transaction gets propagated on the Ethereum network and miners verify that transaction.

Here are the screenshots in 3 steps of sending 1 Ethereum to another address:

No central bank or complicated legal processes: you have the power to make transactions anywhere in the world fast and with a few clicks. Also, none can block it. Follow this guide further and we will create your first Ethereum wallet.

But why Ethereum? Because you can do more with transaction: engage with smart contracts. Imagine coding a program that you upload to a decentralized network, it gets stored there and can be called anytime in the future. Or imagine a business that does not have physical contracts, just virtual ones on the blockchain. All these are secure as long as somebody successfully cheats/hacks the network consensus or exploits vulnerabilities in the smart contrats itself. It may sound complicated for the first, but it is not rocket science. Let’s start creating your wallet.

Creating a wallet

Most of the Ethereum hacks (breaking smart contracts, accessing accounts without or with weak authentication, phishing) do not require more than a web browser and a bit of coding skills. For the start, only a FireFox or a Chromium/Chrome web broswer is enough with the MetaMask addon. You can connect this wallet to the Ethereum test networks and play around.

  1. Open your FireFox or Chromium browser and install the MetaMask extension: https://metamask.io/. Currenly, MetaMask is the most commonly used software by end users to interact with Ethereum contracts (these are called “dapps”/”decentralized apps” too).
  2. After installing the extension, it either automatically opens up or you can open it from the top right bar in your browser.
  3. The first step of using MetaMask is to generate your wallet. At this point you are asked to provide a password. Preferably, use a passphrase that is like a sentence, but does not include words from dictionaries (example: “HaxxA11co|ns”). Choose wisely.
  4. Move on and read the phishing warning carefully!
  5. Finally you need to make sure the secret backup words that allows restoring the wallet is secured: of course in a place only you can access and see. For playing you can just use paper, but for real wallets with high balances it is better to write the words on something that can survive even if your house burns down (eg. MyCryptoSeed)
  6. All is set. Now you have an Ethereum wallet and inside: an Ethereum account.

Changing networks and faucets

MetaMask allows you to change between Ethereum networks. Please change to Ropsten Test Network and remember that the game will be played from there.

Faucets provide free Ethereum for you on the test networks. Now it is time to get some from: https://faucet.ropsten.be/ (if it does not work, you can find other Ropsten faucets online or contact the CCTF organizers).

Congratulations, you are ready: time to get into code and hacking!

Coding and compiling a smart contract

Let’s compile an example smart contract and interact with it. Open https://remix.ethereum.org/ where you get an example contract written in Solidity language. Remix website has an inbuilt compiler and if you click on “Start to compile” it will compile the code. Now you can swith to the “Run” tab. If you have MetaMask running, then you should see “Injected web3” in the environment.

MetaMask injects the so called web3.js into each website you visit, that way the website can communicate with MetaMask (also think about that: is it a good idea to inject to all sites?).

Deploying a smart contract

Make sure your MetaMask account is unlocked, switched to “Ropsten” and you got a coin from the faucet. Then click on “Deploy”.

MetaMask pops you up a transaction which is actually the deployment of the compiled smart contract to the Ropsten Ethereum test network. Now you may wonder what “gas fee” is? Gas limits the computational efforts of the smart contract, meaning you cannot deploy a computational heavy infinite loop for free. You can only use a smart contract if enough gas is provided. If you are ready, click on “Confirm”.

Wait until the transaction changes from “Pending” state to “Confirmed”. This is indicated in MetaMask. The network needs time to make sure your conract is broadcasted and mined successfully. If you click on the transaction, you have a button “View transaction on Etherscan”: click on it and have a look at what happened.

Interacting with the contract functions

By going back to https://remix.ethereum.org/ you can start playing with the “Deployed Contracts”, under the “Run” tab. You can call the deployed smart contract’s functions one by one. Each call you initiate takes a transaction. The executed code runs on all of the Ropsten Ethereum nodes.

Congratulations, you have compiled your first smart contract and interacted with it.

Congratulations!

You have seen the very basics and it is time to think about what else can go wrong… Weak passwords, MetaMask seeds all over the place, programmers making mistakes in smart contracts that you can call, logic, broken crypto problems and so on.

References, to learn more

Bitcoin white paper

Cryptography tutorial

Ethereum white paper

Ethereum beige paper (a readable version of the yellow paper)

History of Ethereum Security Vulnerabilities, Hacks and Their Fixes (2017 Sept.)

bookmark_borderUpcoming blockchain CTF games

Cryptocurrency is the hype and we are ready with our partners to publish the next CryptoCurrency is The Flag games. For the 5th and 6th time, paricitpants will have the chance to win real Ethereum and HODLbag tokens while learning about cryptocurrency, information security and hacking.

The upcoming events will be organized online and the participation is open for everyone local or remote. Like last year, a new guide for beginners will be provided, so don’t worry if you are just getting started! You are here to improve yourself!

If you want to have a look at past challenges, you can read the writeups written by previous CCTF participant:

BIPolognese

Don’t be eval

Pwncoin Challenge

Foxy

EVM bytes


CCTF Vol5 is focusing more on beginners, so don’t miss the chance. If you join the conference you will have extended rewards!

Live during BDAY 4.0 || 2021.May.18.

https://blockchainbudapest.hu/


Feel like a 1337 haxor? Prove yourself with the hardest crypto* challenges during BsidesBud and win the local prizes too!

CCTF Vol6 during BsidesBUD 2021 || April 27.

https://2021.bsidesbud.com/


Get ready and HODL yourself!

bookmark_borderBitcoin and Crypto* events in Dubai

Looking for meeting other people who are into crypto*? Wants to find the best place to start your blockchain business? Awalcon and the HODLbag project shares the best places to get started. If you are an enthusiast, already have a project, looking for investors or just a beginner who wants to learn and meet interesting people: this is what you need to know.

EcoX Networking Events

Every Tuesday, you have the chance to meet people from different backgrounds, many of them are into crypto*. Just get there and be brave to start discussions with people you do not know yet!

Find the flyers on Instagram: https://www.instagram.com/ecoxdubai/

Website: https://www.ecox.pro/

Crypto Mondays

Crypto* people in the space! Mostly for beginner, but you can meet some big names there. Last Monday, we had Tone Vayes and Gary Sheynkman with us.

For the next meetup, make sure to follow: https://twitter.com/CryptoMondaysSJ

You can also join the cryptoDubai group on Signal where we keep posting about the events. Contact: https://linktr.ee/awalcon

Dubai allows crypto businesses to set up in free zone

Just as the heading says, things are moving on in the free zone.

An economic free zone in Dubai has opened for businesses that are offering, issuing, listing and trading crypto assets. The Dubai Multi Commodities Center (DMCC) signed the initial agreement with the Securities and Commodities Authority (SCA) to allow licensing for firms that deal with crypto assets.

Find more details on this link:

https://www.arabnews.com/node/1828681/business-economy

bookmark_border4 Microsoft Exchange Server vulnerabilites

March is not a good month for Microsoft in 2021. At the beginning of March, Microsoft has given out warnings about critical unpatched Exchange Server vulnerabilities.

These vulnerabilities can infect tens of thousands of businesses, government entities in the U.S., in Asia, and in Europe. In addition, the number of targeted attacks have increased.

Outside of U.S, the malware also infected services in Norway, the Czech Republic, and the Netherlands. Attackers scan offensively Microsoft’s email servers, which represent high-value. This time the numbers of attacks were higher compared to last December’s SolarWinds hacking spree. The vulnerability allows breaking into Microsoft Exchange Servers and allows the installation of unauthorized web-based backdoors to facilitate long-term access.

Awalcon recommends updating or disconnecting the affected Exchange Servers immediately.

The vulnerability CVE-2021-26855 allows the bypass of authentication of an on-premises Microsoft Exchange Server that’s able to receive untrusted connections from an external source on port 443. The next vulnerabilities are CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065: these allow malicious parties to gain remote access to the vulnerable systems. It is an interesting fact that both CVE-2021-26855 and CVE-2021-27065 were reported in October 2020.

On March 12, 2021 Microsoft released an emergency patch for all the four security issues. As always, the bad news for the affected businesses: installing the patches is not enough if you have already been backdoored.

bookmark_borderGoogle Chrome zero-day vulnerability

Google has introduced an update to the Chrome browser and released a second patch within a month that fixes five vulnerabilities, including a zero-day vulnerability. One of the most important bugs can be traced as CVE-2021-21193 and affects the Windows, Linux, OS X versions of the browser.

This vulnerability was detected by an anonymous user, and through this bug an attacker can execute arbitrary code on the target system. The measuring of this error is  8.8 out of 10 on the CVSS scale. To avoid this security issue, update your Google Chrome browser at Settings -> Help -> About.

Why the browsers?
Browsers tend to evolve faster in many organizations than other applications, and browsers are a great way to reap the benefits, and attackers continue to target them because they continue to be excellent entry points for endpoint threats within the organization. In addition, the extensions are usually updated less frequently and require hardening to prevent further attacks.

What is a zero-day vulnerability?
Timing is most important here. The moment the flaw becomes known, hackers around the world can try to exploit it. Overall, programmers have zero days to find a solution to the issue, henceforth the term “zero-day vulnerability”.

This can take almost any form, such as missing data encryption, buffer overflows, missing permissions, SQL injection, broken algorithms, URL redirects, errors, or password security issues.

How protect yourself?
Here are some tips to help protect your business from these types of attacks:

Be informed: pay attention to software vendor spending, it may be time to take advantage of security measures or respond to threats before taking advantage of them

Take additional security measures: consider seeking the assistance of an experienced professional, as the safety measures mentioned above are not sufficient to fully protect you.

Keep your system up to date: make sure your software platforms are up to date. The best solution is to allow automatic updates so that the software is updated regularly without any manual intervention.

bookmark_borderInspiration from Dubai and the Global Blockchain Congress 2021

The Awalcon HODL Bag team visited Dubai for finding new possibilities, inspiration and attending the Global Blockchain/DeFi congress which took place between 2021.02.09.-10.

The whole trip was a positive experience from the point of meeting new people, learning more about DeFi projects and discussing with investors (VCs, Private Equity Firms, Family Offices and High Networth Individuals). Though we are not seeking financial support, advice is always welcome from individuals who have already created projects that work on the long run.

The days we have spent in Dubai truly gave us inspiration and new ideas to push our IDeaLs (Indpendent Decentralized Life System) further. We are very soon making the HODL Bag system public and accessible for everyone who is interested.

Awalcon OÜ has also been fully initialized in Estonia (registration code 16156552). That means we are ready to sell the HODL Bags and also ready to work for the system.

We take decentralization serious: you will be able to use the first functions in this HODL Bag NFT smart contract with just your MetaMask app and the frontend will also be runable from any computers, not centralizing all the contact interactions to a single website.

We are looking forward to keeping in touch with all our new friends.

bookmark_borderA global start from Estonia

Awalcon becomes global in 2021. If you haven’t followed us during the first year, here are some active projects we are working on:

Awalcon Information Security and Blockchain Services

HODLBag DAO (will be presented first around mid-January)

CryptoCurrency (is) The Flag – CTF game, in a collaboration with our partners

CryptoZSH – Tools and configuration for ZSH users

2020 was not an easy year, but with clear goals and enthusiast people around, growth occurs even in the hardest times.

We are looking forward to go global in 2021!