Recently, I’ve started to play with OWASP crAPI (completely ridiculous API) to help me prepare for INE eWPTX certification. There are a lot of vulnerable apps and environments (Juice shop, Multillidae, DVWA, WebGoat and so on) to get hands-on experience in application security testing in a safe way. However crAPI got my attention because it is designed specifically for API security tests and includes modern features (like LLM, email and OTP integrations).

Security Assessment of Video Upload Feature

During my inspection on video upload feature of crAPI, I realized some sensitive data is being returned (conversion_params). This data exposure weakness is also known as CWE-213.

During testing to change video name feature, I suspected that it may also be vulnerable to mass assignment (see CWE-915 and BOPLA in OWASP API Security Top 10). I wanted to check if the request body was being passed directly into database query (without stripping out the properties other than videoName).

Verifying The Vulnerability

To test if other parameters are passed to database query, I injected conversion_params into the request (by intercepting and manipulating the communication between browser and web server via Burp Suite).

I assumed those params are passed to a video processing tool like ffmpeg, so tested if it is being executed directly. I’ve appended && sleep 10 to test command injection weakness (CWE-78) along with mass assignment. I assumed the conversion operation is done by combining command and conversion params (something like: ffmpeg ${conversion_params} -i ${video_name} ${video_output_name}).

As you can see the image below, user input is stored as it is in the database. Hence I confirmed that it is vulnerable to mass assignment.

If it did wait 10 seconds to return the response, I would prepare my script and listening ports to get a reverse shell inside the web server. But the response returned within a second.

At this point, I am thinking that this video conversion is not done in this endpoint, and most probably done by a separate worker process. This is a logical thing to do in a good system design, since video conversion may take a while and users do not need to wait for it.

Then I saw the “Share video with community” button in the application. When I clicked, browser sent a GET request to /identity/api/v2/user/videos/convert_video?video_id=52 endpoint and it returned following error response:

{
    "message": "Thi-S endpoint S-hould be accessed only inte-Rnally. -Fine? , endpoint_url http://crapi-identity:8080/identity/api/v2/user/videos/convert_video",
    "status": 403
}

crAPI creators gave a hint for the next step (see abbreviation for S-S-R-F - Server Side Request Forgery), which supports validity of my assumptions.

Wrap Up

Up to this point, I’ve confirmed that POST /identity/api/v2/user/videos endpoint has Broken Object Property Level Authorization vulnerabilities (excessive data exposure and mass assignment weaknesses are exploitable). These types of vulnerabilities can be prevented by mapping and validating user input, specifying expected structure (via Data Transfer Objects - DTOs).

Also see OWASP Cheatsheet for Mass Assignment for understanding and preventing such vulnerabilities.

The next steps can be:

• finding some other part of the application which is vulnerable to SSRF,
• then get a reverse shell by chaining this vulnerable video upload feature.

I will cover these in next blog posts.

And tried to install n8n on them via npm and had following error:

FATAL ERROR: Reached heap limit Allocation failed - JavaScript heap out of memory

As error log tells, I need to tell npm to use less memory. I set heap ceiling limit for node with NODE_OPTIONS="--max-old-space-size=512". Still receiving the same error.

Then I figured out that there is no swap space set in the VM! Probably digital ocean does not set it up since my droplet’s RAM is too low.

Anyway, I have learned how to setup swap space in Ubuntu 23.10 today.

After a while, I found out there is a guide on setting up n8n on a Digital ocean droplet with docker. Yet, I’ve learned something today 🙃

Today, I went to my local coffee shop and ordered a latte. The staff asked me to mark the loyality card if I have any. I told her that I have it but left it at home. Then she told me that every customer tells the same thing and she could mark it in my next appearance. This led me questioning whether such thing (forgetting loyality card at home) can be prevented.

I don’t want to carry anything more at my wallet or bag, so keeping the card with me all the time is not an option for me (obviously for others too).

But everybody carries their phones all the time, so can’t we use those? Starbucks developed a mobile app for this but why develop another for my local coffee shop?

Then I wondered if blockchain can be used. This would be a challange for me to build a complete product (at least MVP version).

So in this post, I am sharing my chain of thought for the problem: how I can develop a customer loyality program using blockchain. In future posts, I will be sharing my experiences on development of this program.

2) Keywords

A quick search led me some of these keywords:

• loyality program / token
• web3 loyality scheme
• token redemption (for discounts, free products, special offers)
• NFT

3) Related links

• Making blockchain real for customer loyalty rewards programs - Deloitte
• The Power of Web3 and Blockchain
• Other companies adopting loyality programs - like airlines, restaurants
• Raise of blockchain loyality programs

4) Requirements

These requirements are determined solely by me, without gathering with customers or coffee shop’s owner.

• low transaction fees (less than 50 cents)
• fast (transactions are completed within less than one minute)
• mobile phones shall be used, but no custom mobile app shall be developed
  • only frontend as a web app shall be developed
• user friendly, frictionless onboarding for people who don’t have experience with any blockchain technologies.

  • users should be guided for wallet creation & usage, and those operations should be simplest

  • common wallet apps like Metamask is preferred since many of the customers do not have enough experience, nor want to install another app to their phones

• easy to use by coffee shop personnel who will verify the customers’ rewards
• all transaction fees shall be paid by coffee shop’s wallet
• coffee shop staff can have their own accounts different than coffee shop owner’s
• easy and fast development

5) So which blockchain platform is best for such use cases?

Quick search using ChatGPT, several projects are offered such as;

• Stellar
• Solana
• Polygon
• Binance Smart Chain (BSC)
• EOSIO
• Tezos

I know this is a very bad architectural decision making but I am opting out the projects that I do not have prior knowledge. Keeping Solana, Polygon and BSC.

All of them provide low transaction fees and high speed. But in terms of customer onboarding, Polygon and BSC are better alternatives since they are supported in Metamask. But for Solana, another mobile app needs to be installed as a wallet app, which can cause friction. Remember, one of my requirement is easy integration for people with little experience in blockchain technologies.

However, I stumbled another wallet called Phantom, which can replace Metamask, I will look into that. If Phantom wallet is used, then Solana can still be an option.

BSC has an advantage since probably most of customers have Binance app installed in Turkey. However, Binance has a separate app (Binance TR) to operate in Turkey, which does not support such features yet. Hence, I cannot use this advantage.

So Polygon is the final candidate. It has a good community, which will make my development easier.

6) Before implementation

I prefer to determine example use cases before doing any development.

After that, I want to visualize those operations from each user (role)’s perspective. Hence, I prefer starting front-end mockups before any backend development.

I did not generate any mockups yet, since I need to speculate about possible features first.

7) Minimal Viable Product

Starting from frontend, only single feature

⇒ after each 10 product purchase, customers can redeem 1 free product as a reward

I can develop a responsive Next.js app and free Vercel deployments can be used!

Basic features:

• 1 product type (generic like “coffee”, not specific like “americano” or “latte”)
• 3 user roles: customer, staff, shop owner
• Each user is initially hard-coded. Customers can:
  • purchase a product
  • redeem a reward
• Conditions for reward redemption:
  1. Calculate non-redeemed reward count
     • customer may have purchased 32 products with no redemption, so they can have total 3 free products (in any time)
       • example flow for tests ⇒ 32 purchase + 1 redemption + 1 purchase + 1 redemption + 7 purchase + 1 redemption + 1 redemption
  2. If user has not-redeemed reward → allow redemption:
     • coffee shop’s wallet will pay the fee for NFT minting or transaction

8) Next Features

• Onboarding for users without a wallet/metamask etc
  • QR code scanning
• Customer and staff can see
  • Customer’s purchase and reward history
• Staff
  • Can view history of particular customer
  • Verify/approve reward by scanning a QR after customer has successfully redeemed the reward
  • Add/remove new products:
    • If carrot cake is added to the menu, staff can insert to blockchain (or remove it)
  • Generate different reward types:
    • 50% discount for products X, Y, or Z
    • For product X: 1 purchase - 1 free
  • generate time-limited rewards:
    • 50% discount on all cakes until the end of the day/tomorrow night
    • 1 free americano for any product purchase between April 20 and 27
• Owner
  • All things staff can do, plus:
    • Add/remove staffs
    • Deposit or withdraw money from/to coffee shop wallet
  • See stats like:
    • How many rewards have given in this month
    • How many purchases have done in this month

9) Next

• Should I use Phantom wallet instead of Metamask?
• Why starbucks is dropping its nft program?
• Similar projects in Github that are already developed
• See Open Loyality - uses Hyperledger fabric
• Find out the average fee in peak times to calculate possible cost

Recently, I’ve been working on a licensing mechanism that should work offline (client’s on-prem environment without internet access). This is an age-old problem, I remember variety of cracking methods & keygens in Windows OS and games. But hopefully, using the concepts I have learned in my cyber security masters degree, I came up with a solution. I want to share a simplified version of it.

In this post, I am roughly specifying the terms, requirements and ideas on the problem. In the future posts, I will share details on how & why we have implemented these in a particular way.

2) Problem

• We have a product that shall be installed in on-prem environments and there can be no internet access after the installation
• We want to control which features are enabled in customers according to the license keys that is provided by us
• We need to do this as secure as possible (focusing specifically: confidentiality, integrity and non-repudiation)
• Many month later, we may provide another license key to the customer and the verification mechanism should work just fine without an internet connection
• Customers should not be able to generate their own license, inject it to our product or bypass the license feature checking mechanism anyhow

3) Defining some terms

• License feature
  • the functionality we want to enable
  • fields such as: feature name, description, start date, expiry date, and other details (such as feature quota)
• License document
  • a JSON formatted document including required information like start date, expiry date and enabled features
  • if a feature is not included in license document, then it is not enabled
• License key
  • encrypted version of the license document
  • encryption is necessary to ensure that document is generated by us, not anyone else
  • as a side effect, encryption helps obscuring document details
• License encryption/decryption key
  • a symmetric key that will be used during both encryption & decryption of the license document
• License certificates
  • PEM formatted X.509 certificates for storing license decryption key
• License verification mechanism
  • checking validity of license document and certificates
    • whether certificate chaining is correct and license can be decrypted
    • whether current date is within start-expiry date range of certificates,
  • checking whether current date is within start-expiry date range of license document,
  • checking whether a specific feature is in the license document
  • (optional) checking whether quota is sufficient for the specific feature
• License feature check
  • checking whether a license feature is enabled & available in the license document

4) Requirements

A license document should be confidential (not in plaintext)

We need an encryption mechanism to ensure confidentiality

A license document should include necessary info

• Client’s basic info (like company name)
• Features enabled
• Start and expiry dates
• JSON format is good enough

A license document cannot be tampered (if so, it should be detected)

• The system should accept only the documents/keys that are generated by us
• Again we can use cryptography for checking license’s validity
• Digital signatures are an option
• Also since a plain-text license document is a simple JSON object, JWT comes to mind
• A JWT can be verified easily with digital signatures

License verification mechanism cannot be bypassed

• In other words, this is not a good idea: storing boolean fields in a Postgresql table, and using that to mark features as on or off
• This is not a good idea either: decrypting the license key, storing the plain-text license document in database and using that plain-text version for license feature checks
  • Since the product is in customer’s own environment, they can access database tables and manipulate documents there
• Ideally, everything should be verified every time we want to check whether a feature is allowed or not
  • Every time we do a license feature check, we should verify every part:
    • license key (to be decrypted and parsed as license document),
    • license certificates,
    • and whether a specific license feature is in the license document
  • In other words, we should only store encrypted data (license key) at rest. We should do decryption & other verifications in run-time
  • Here we are assuming that customers are not able to intercept and manipulate our product’s Linux processes in run-time

If customers share license keys between each other, the system should detect it

If customer A shares the encrypted license key to customer B, system should reject it in customer B’s environment. To implement this, each customer should have their own license encryption/decryption key

In the next blog posts, I will dive into the reasoning that led us to a particular solution.

I have been following talks on latest developments in AI and I want to share one that caught my attention very much.

In this talk, Tom Bilyeu talks with Emad Mostaque, who is founder of Stability AI. Here I am dumping my raw notes on the talk.

PS: I will be using “AI” without adding “models”, “apps” or “services” afterwards. You know what I mean.

PS #2: I am using the emoji (👀) for marking my observations.

Keywords

• AGI → artificial general intelligence
• ensemble of models
• talented young people
• open models and private data
• augmentation vs generalization

Notes

Humans vs AI

AI won’t replace humans. Humans with AI will replace the humans that don’t use AI

Bilyeu says we will have better friends who will be AI apps. But if you have introvert personality and have problems of drug abuse, many will completely cut off from the world. Since feeling “no need”

Emad is using gpt4 as therapist. Also he shares his own story: his autistic child, searched for causes (there can be multiple) Used AI to curate latest research in the literature

Curating knowledge

Wouldn’t it be great if someone can find the latest knowledge easily?

He states that we (humans) can never scale intelligence & expertise. So, his vision is that everything will be personalized AI. Like a personal trainer.

💡 Talented young individuals

Another example from him on scaling intelligence & expertise:

Imagine that you are not alone anymore. You have a team of talented young people. And this team can also build other teams !

👀 This part has a huge impact on me! Since models can do a lot of things (both correctly and incorrectly), they are like new graduates. So with AI, finding and working with new graduates will take less time and resources.

Attention is all you need & inner workings of GPT

The working principle of GPTs: not all data is important → paying attention to most important parts of speech.

From Shannon’s info theory ❝ Information is valuable only if it changes ❞

A Gpt model is just a single file, like a codec. Gets input and maps it to some of its content It is just compression of intelligence or a filter Similarly, a book is compressed knowledge

Emad suggests viewers to watch alphago documentary, it plays with itself → hallucinations.

Emad’s aim in Stability AI: Layer-1 for AI

• open models and private data
  • for addressing privacy concerns.
  • models will be shared publicly, anyone can find and use them
  • apps will be built using these open models but not sharing the data they generate with external third parties (like OpenAI).
• models will be small & specialized
  • gpt-4 has all the knowledge that it don’t need
  • like if you won’t ask calculus, there is no need for storing those data
• multiple models
  • as if they are teachers who specialized different areas”
  • not just one model but an ensemble of models, a model combining other models with a right flow, chaining one’s output to another’s input
    • just like a talented youngster organizing other talented youngster in a right flow
• He is not building big enough models that can be used as AGI on purpose !
  • because AGI may benefit or destroy the humanrace. Two very polarized results
    • “embed guardrails, standards, make it predictable & boring”
  • His objective is augmentation not generalization !

Effects of AI on Education

It will transform many things! Like personalized tailored content & learning methods according to your skills & tendencies !

Current education needs 1-on-1 attention. With AI, this can be done 1-to-many, much more efficiently.

Since every person is unique and different needs, multiple AI models can guide you by adapting your needs (such as audio/visual learner etc). So AI can generate content according to your level. This is also called adaptive learning.

As well as single child can have multiple “AI teachers”, an AI model can guide multiple children, which makes teaching efficient.

on Medicine

Doctors will be the most affected since AI will have more empathy

Alignment

Emad thinks that:

There is no way to align outputs, we can align inputs, in other words, raising a child right

This is done by controlling the AI, making it predictable, “boring”. Tom says that this is not alignment, this is enslavement.

👀 I can related to arguments of both sides, controlled freedom is required. But wait, isn’t this concept already employed on humans? 🧐

Web3

Emad says web3 has no AI in it, it is just solving problems of identity and value transfer.

But AI will play well with the ledger idea, since it is automating the value transfer.

Autonomous AI agents won’t be using banks but will use crypto.

Tom mentions “protocol 6551” ~russian nesting doll, wallet + storing other data But Emad says that storage value of blockchain may not be that important, but the identy concept is important.

I can relate to that because (currently) storage is not so efficient

Future of Culture & Society

How would your life/society/community/business change if you have infinite talented young people ?

Emad thinks AI as:

• talented young people
• army of analysts & teachers

• How will we adapt to potential widescale job loss ?
• What are the cults, religions and political movement over 5 to 10 years?

This question is important because those will be hyper-organized/persuasive utilizing AI. Tom says these may even be started by AI !

On the one hand, we will have youths with AI girlfriends. On the other hand, youths that want to believe something bigger to fill the void. Here who is gonna step in?

Emad emphasizes that we build many things around stories and whole AI discussions are built around “power of the controller who tells the story”

Emad also mentions positive & negative liberty:

• Positive → freedom to believe in any “ism”s
  • fascism, communism, islam(ism)..
• Negative → freedom for being told what to do
  • capitalism, consumerism

👀 Are we really free in negative liberty? Or are we being manipulated in some other way (without our consent) ?

👀 I think that main difference between positive & negative libery is:

• in positive → we “surrender” our free will with our consent
• in negative → we choose(?) what to do, but may be manipulated (i.o.w directed without our consent)

Conclusion 👀

• There shall be smaller AI models that specializes more specific areas, instead of a AGI. He calls these “talented young individuals”.
  • I remember that Daniel Miessler mentioned similar things in one of his newsteller article.
• Businesses will transform rapidly by those who have many “talented young individuals”.
• Our culture is not ready for so rapid changes, we need to ask questions and think more about that.

I’ve been trying to use Notion to make my blog posts prettier. Notion would allow me to use different page layouts, which I cannot do with markdown files. In addition to those, I wanted to use a custom domain for my blog.

But there were few drawbacks I did not like:

• The publicly shared Notion page URL is ugly, so I want to hide that
  • So, I don’t prefer redirecting my domain to that URL.
• Paid services like Super and Potion are expensive for me
• There is a cool workaround, Fruition, but it is still too cumbersome for me.

So I’m back to Github pages 🙃

The problem

I use Obsidian in my iPad + mac.

But I want to be able to use my vault from my android phone too.

But trying to do two way sync by pointing to same folder is making both iCloud and gDrive unstable.

Existing solutions

Obsidian Sync and other sync solutions (like MultCloud, syncToy, FolderSync) are too expensive.

Aim

From my phone, I want to at least view my notes (giving up editing).

So, my aim has became to do one-way sync from iCloud to Google Drive. I will do this using my old Macbook, keeping it open and running a cron job.

Solution

Conclusion

I have described a simple way to sync files from iCloud to Google Drive. I needed this for accessing my Obsidian vault in iCloud, but you can use it for any other folders you want to sync.

Enjoy.