"Remove the video as soon as possible"

Key Takeaways

today we have a little bit of company drama involving rapid 7 Ford and nahem SEC so let's check it out [Music] this video is sponsored by hexstreet.io if you are a developer or a student and you want to learn more about it security be it web hacking reverse engineering Hardware hacking or whatever we are creating courses over at x3.io so please check it out so this story starts with a video by nahem SEC API hacking with jet GPT it's a pretty neat video he uses jet GPT to basically generate some word lists and API paths that he then later uses with a huge list of subdomains to then find Swagger files Swagger files are basically API documentation usually used by developers to you know document the different API endpoints that exist as a hacker or bug Monty Hunter the Swagger files are of course interesting because now you save a lot of time instead of having to deal brood all the different API paths you basically just have the documentation on what exists and in this video nahan SEC used Ford as an example because they also have a public back Bounty program and backbone is usually give you a safe harbor so as long as you don't act maliciously you'll probably are fine but then nahan SEC posted this tweet rapid7 is asking me to remove an educational content from YouTube over the fact that use them as an example for publicly accessible Swagger file and here's the email hello rapid7 is an international cyber intelligence provider we serve as an agent for our client to identify and neutralize active cyber threats that endanger their brand customers and employees as the legal representative of Ford Motors ford.com will request the immediate takedown of this video this video directly threatens our clients by using their name and identifiers it operates illegally and is active in aiding criminals in their fraudulent activities we request that you remove the video as soon as possible we appreciate your assistance in handling this matter there were of course lots of reactions here John Hammond with a good yikes but also Daniel Cuthbert wrote that this is odd given that the company has a back Bounty program which is public as you said and this is all public information already published on the YouTube and Corbin Leo also very experienced buckhunter and hacker wow don't comply some other people were arguing well blur the domains why you know expose them but nahan SEC has a really good point he's responding to that domains I found using similar services to Rapid 7's project sonar so what is Project Zona by rapid7 let's have a look here on the website gaining insight into Global exposure project Sona started in September and the goal is to improve security through the active analysis of public networks while the first few months focused almost entirely on SSL DNS and HTTP enumeration the discoveries and insights derived from these data sets especially around blah blah blah blah blah so basically project sonar is actively scanning and scraping the whole internet being DNS names and you know Associated IP addresses HTTP server and they're probably doing full port scans as well they just contact all over the Internet and collect this data this means project sonar does basically exactly what nahan SEC did in his video the subdomain enumeration for example is something that project Zona is doing as well so Ford is a client of Rapid 7 and Rapid 7 has a product where they you know figure out all the exposed stuff from their customers and nahem SEC found a subdomain that exposed a Swagger file I don't know seems fair game to me now here's the thing exposing a Swagger file is not really a security issue because the Swagger file just defines all the different API endpoints the implementation of your IPA and points they now have to be secure now it's true that a Swagger file does help the attacker because it saves a lot of time but so it also helps back Hunters that do alleged work it helps to identify all the API endpoints that you can then test this way you can make sure you don't miss anything during testing I think it improves a lot the back Bounty impact imagine how low some back Bounty amounts are like fifty dollars a hundred dollars maybe 500 or so and then you have hundreds or maybe thousands of bug Hunters trying to find all the different API endpoints all of them running scanners and deal Busters trying to figure out all these different paths provide them a basic Swagger file and none of this has to be done so the buck Hunters as well as the evil hackers they now have access to the Swagger file but hopefully because the backhandles have access to it as well they can also make sure that all the endpoints are implemented method correctly and the basic principle behind this is something that we can take from cryptography because there exists the kalkoff's principle the karkos principle of cryptography was stated by a cryptographer in the 19th century the principle holds that a cryptosystem should be secure even if everything about the system except the key is public knowledge and this can be adapted to web security as well you know there are open source web application basically the full source code and all the API endpoints and basically all the Swagger files are public already and you still want this to be secure so you should always operate under this principle that the attacker knows even all your source code or at least knows all the API endpoints and even if they know that now you have to make sure your API is secure and it's perfectly fine to assume that the attacker does not have a valid key for example they don't have the password or the session tokens of other users or the admin user or whatever it is but they know all the endpoints as a secure researcher when auditing client applications and you know thinking about the threat model this is definitely something I have in mind usually while I might mention it in a report or there are some exposed deck traces there the attacker can get some information about the underlying system and so forth I might mention that but generally my opinion is that these are not security issues it can obviously help with a little bit defense and depth making it harder but if you have a public back Bounty program and you want hackers to hack on there I feel like you should be actually a lot more open anyway nehem said was thinking about how to deal with it and thought about recreating the whole video with notford.com then I suggested Nord maybe it's also something more known in the German hacking Community I'm not so sure but I did find in English a Wikipedia article and Nord is a word that has been used in News Group and hacker culture to indicate irony humor and surrealism and if there isn't a better matching word I don't know so if anything a name six should definitely re-record the video with snort com but to be honest I think Mayhem sex should definitely not remove that video I think this is a mistake by rapid 7. I feel like something like this would set a bad precedence and I'm in full support of name SEC for not taking down this video and helping in whatever way I can if it would ever get into any trouble this happened a few days ago so I did ask him if there were any updates yet but so far he hasn't heard anything back so hopefully the situation just resolved and it was maybe just an automatic email or something like this I don't know I hope this was interesting to you if you want to see more videos they are linked over here and if you want to learn hacking yourself check out our courses over at x3.io