This is Chichu. Now if you've been following my comic book videos You'll know that I've started reading the new Valience, the new relaunch of valiance. There was a comic book few lots that I bought off of eBay and I've been meaning to read them. I sort of started off with the new valiant relaunch with with Rai, and I really loved it. I loved what they did. I loved the artwork and I found it to be sort of authentic, true to the original valiant, true to the original Rai. So what I've been doing is, since I started reading Rai, I've sort of started picking up random valiance and then I saw a big bunch of lots on eBay and I made a video of buying those lots and I have gone through and read at least half of those anyway. I read all the Harbingers and most of the Bloodshot and Harbinger Wars and some of the Quantum Woody. Well, I read the Quantum Woody a lot that I bought, the four issues that I bought, it was awesome. And since starting to read valiance, I found that I've basically dropping every most of the books I was collecting on a weekly basis, my pull list, and I'm sort of almost exclusively going valiance about 80, 80, 85, 90% of my buys are basically valiance now, except for, I think I'm just picking up four other titles. I'm picking up all the valiant books that are being put out and four other titles, one being Lobo, because I like Lobo. I don't know, it's just something that I like reading and it's sort of my guilty pleasure, I guess, and about three other titles, three or four other titles that I have. Okay, so since going exclusively valiant, almost exclusively valiant, because they're, wow, they're absolutely amazing stories, amazing characters, and they're building magnificent universe and if you remember when I bought the comic-lock and the comic-lock that I bought and I made the videos and I shared them with you, at that time I mentioned that if valiant comes out and announces that they're gonna do a movie deal, expect the price of these comic books to start increasing and people start paying attention to valiant, and since that time, that's exactly what's happened. Valiant has come out and announced that there are five movies in the works, which is, wow, it blew everyone away. And if you remember the lots that I bought off eBay, I bought a lot of the new valiants, they're relaunched, and I bought some older valiants, which if you consider the price I was getting them for, which was insane, it was a little bit over a dollar, like I bought, you know, you can take a look at that video, but I bought, you know, XO number one, two, solar number two, three, and a whole bunch of other stuff for $20 and a lot, like those, I don't know how many comic books are in there, in that lot, right? Just to give you a price idea, solar number three right now, it's selling for, you know, 30 plus dollars, and that's for the older valiants, right? For the newer valiants, they're selling out, they're extremely hard to find now, they're becoming scarce, like divinity number one sold out off the top, dropped that number one sold out right off the bat, on eBay, online, divinity number one is going anywhere between 20 or higher, right? 15, 20 or higher, right? And, you know, I've sort of been getting all the valiants, so I have all those issues, and I've been trying to go back and fill up whatever I'm missing, because I was missing like three years worth of stuff, so I've been going back and trying to fill my runs, right? So I can read them, and so far I've, you know, gone through all the harbingers, zero to 25, and it's beautiful, magnificent, right? I've read, you know, most of the bloodshot, bloodshot reborn as well, wow, wow, wow, right? The valiants are fantastic, right? Very excited about the Book of Death coming out in the summer of 2015 in July, I believe it starts off, right? So what I've been doing is checking online to try to get lots, right? And I've been going to comic shops in my area, and I live in a, you know, reasonable sized city, Vancouver, British Columbia, it's fairly big, and I've had to go to, you know, so far I've gone to like basically six comic shops and checked their back issues. Some of them didn't even carry any valiants. The ones that did carry them, they were carrying them mainly, well most of them anyway, were carrying it just for subscribers, and there were, you know, two or three that were buying more than what the subscribers were requiring, but no one, no one has complete runs of this stuff, right? So I've had to go to, you know, all these different stores to be able to put complete runs together, and I'm not, you know, I don't have everything yet. However, I did just come back from one comic shop that I hadn't gone to and I asked them, I checked their back, back issue, I was picking up Ninjak number four, and that's sold out as well, right? Ninjak number four is completely sold out, if you can't get your hands on it, especially with Ninjak number one as well, because that's the first appearance of the new character, right? And number four was the origin, right? That's totally sold out as beautiful, beautiful artwork. I haven't had a chance to read it yet, right? But I went to this comic shop and I looked at their back issue bins and I couldn't find anything, they didn't have anything, so I went up to the desk and I asked them if they had any back issues, and the guy was walking me to the person who takes care of their back issues and he, you know, yelled across and the guy didn't respond, and I looked over and they were, right, of books that they sell, and these are usually books that aren't selling, and my guess is these things were sitting there a while, right? So I sort of looked and said, oh, here's some back issue of valiance, and the price on these things was 10 valiance for five dollars. Okay, so I looked at the lots and almost all of them. There were a couple where some of the valiance were put together with other indie books that I didn't grab, but this is what they had. Me, well, none of the other comic bookstores have these, right? So 10 valiant comics for only $4.99. Yes, please. That's for how many? One, two, three, four, five, six, seven, eight, nine, ten. And that was basically all the ones that they had. So that's 100 valiant books for 50 bucks, 50 cents a pop. Pretty happy about this. So I figured that, I don't know what's in these. I asked them if they had any rhyme or reason with them, and they said, no. We just took the valiance and put them in there. I said, okay, okay, I might as well grab them. So I'm gonna crack these open and take a look at to see what's inside. And we'll go through this quickly, because I do need to bag and port these, and they look to be in really good shape. So I think they just took them off the racks and put them in packs and decided to dump them. Right? These guys had, I brought scissors so I can cut the pack they're in. Now this guy had XO number 27 on the front. They're in pretty good shape. What do we got? We got XO number 27. Let's run through these, right? XO number 27. XO number 29, which is very sweet. I had to go to a few different places to be able to get some of the early XOs. I do have, I was able to pick up XO number one, but I'm missing some of the ones from less than 10. XO number 28. XO number zero. Right. Nice. Oh my god, there's harbinger number one. Check this out. Wow. Very nice. Oh, this is the dollar one. This is the reprint. I was like so excited. I do have the first issue of this, but another one would have been sweet. There's none around. You can't find it. Harbinger number three. Very nice. Look at that cover. Beautiful. If you haven't read harbinger, you're in for a treat. Harbinger number five. Very nice. Very nice. And this was harbinger number 16. Right? Okay. That's the first 10 pack lots. Let's put these on one side gently because they are in pretty good shape. Let's crack another one. We have the 50 cents of pop. And armor hunters number one. Very nice. The one thing with the comic book industry, it's very much a funny industry. If it's not, especially if you're into reading comics, harbinger's number one. Number nine. I'm still missing archer and armstrong number one. I don't have it. And I can't find it anywhere. 22. I've been looking online, but the prices are going up for these. Number zero. And they're getting very hard to find. Number eight. Very nice. Number seven. I used to love reading archer and armstrong. I haven't read this new relaunch yet. Number two. Right? And here's the dollar reprint of number one, which is perfect. And these are in good shape. Fantastic shape. Very nice. Okay. Oh, that's fantastic shape. Really good shape. Right? Very fine plus harbinger. What an issue this is. Wow. If you read while zero to 23, this one is a kick. And 25 is beautiful. They're all magnificent. And an award number 27 to find out what the print run of these is, since it was so hard to find them, right? And the print run on a lot of these is extremely low. Wow. I couldn't believe it. Some of these, the print runs on average, they're anywhere between print runs on these or anywhere between 10 to 20,000. That's it. Right? Number one is pushing the 2020 for XO was more from what I could find. You know, if they're number ones, they're maybe 20, 25,000. And as the numbers increase, the print run drops, drops, some of these that looked, you know, I haven't checked out my second sources and stuff. I just checked one source because I was getting frustrated. I couldn't find these, right? Some of them are as low as like 10,000, sometimes less. Number 27. Oh, that's the other side. So what have we got? That was XO number 27. Harbinger number 24. Very nice. Number 23. I read these. These are double whatever, right? This was a very good story. And the bleeding monk is the first scythe born with special powers. And I read the harbinger all the way to 25. And after that is harbinger omegas. And I was, I've been looking everywhere for this. And I had to get a comic shop to back order it. And he's, you know, they said I could get it. But I got it. Right. It's okay. I'll get the other one too since I ordered it. Right. So harbinger omega is number one. Oh, number two is not here. Oh yes, there is. All right. Armor hunters. Okay. So we got harbinger, armor hunters. Number one, armor hunters, number two, omegas. Harbinger omegas, number two. And armor hunters, number three. Look at this. Armor hunters, number two. That's a mask good cover that you can actually cut out, which you're not going to do. Right. And what's on the other side? Archer and Armstrong, number 12. So how many of them? That's like three we've gone through. We've got some beautiful goodies. Let's see. This is perforated as a mask. Armor hunters, number one. Archer and Armstrong, number nine. Number eight. I guess there's doubles of these whoops. Armor hunters, number one aftermath. And here's an Archer and Armstrong, number one, the dollar one again. Maybe a good gift for 18 and number 11. Archer Armstrong was very, very funny. And from what I've heard, this series is amazing as well. It's supposed to be just as good as Quantum and Woody, which I'm really excited about. Delinquents. Delinquents, number one. Very nice. I think Delinquents is omegas for $4.99. I think Delinquents is a crossover of Archer and Armstrong and Quantum and Woody. And if you remember the video where I bought the comic lots, I did buy Shadow Man a lot. I haven't read it yet. Delinquents, number one. I've read Dr. Specter. Oh, I don't know if I've read Dr. Specter. I've read Dr. Mirage, and Dr. Mirage was a good for issue. Oh, look at this. It's ruined. Dexter. This isn't valiant. This is a marvel. Dexter, number one. Dexter, number two. I guess we get Dexter. Number three. It is not valiant, right? So these are dynamite, which is okay. Valiant used to produce published Dr. Specter. And here's Solar, number four. I did start reading The Two Rock from Dynamite. It was okay, but I had to drop it. We already got this one in another pack. Shadow Man, number six. So Delinquents, number one, I think was in here. Yeah, Delinquents, number one is the highlight of this pack. Master Dark. Master Dark is, there's X1, number 17. Master Dark is supposed to be the villain for Book of the Dead. Master Dark. Master Dark and Herada I think of them, you know, in my opinion anyway, they're two of the greatest comic book villains ever. I really like Herada mainly because of the Harbinger books, the storylines, but Master Dark about evil. Anything like Master Dark in any of, not in my opinion anyway, any of the other publishers. X1, number 17, 16. I haven't read Shadow Man yet. Some people are saying it's not their strongest title, but I really like the Shadow Man character. Now here's Two Rock. I already got these I read, you know, up to I think five or so. I guess they put it together with Valiant because Valiant used to have the rights for Two Rock. I think the biggest mistake, Valiant hasn't made any mistakes as far as I've seen in their relaunch, but the only mistake I can say they've made is they didn't take Solar, Magnus, Two Rock and I guess Dr. Spectre. I wish they were doing those books as well. XO, number three. XO, number seven. Nice. I don't think I have this one. This one's Ninjak in there, right? Ninjak is very good as well. I've been reading that. Looking forward to reading XO. I still have a couple of gaps. I think I just filled a couple of them. I think I'm missing number four. Harbinger, number 14. This is a crossover with the Harbinger Wars and wow, that solidified my decision to basically go exclusively Valiant. Almost anyway. Quantum and Woody number two. I've read this one. How hilarious. This, if you haven't read it, I don't know if I'm going to be giving you spoilers. I doubt it if you'll remember to mention a lot of things. I doubt it if you remember to decide to read this. You'll remember this stuff. But when these guys fall out of the building in this issue, I think it's in this issue or the next issue. And the banter between them, when the cops show up, is priceless. And it just got up to 50 cents. I guess more boards and nice. Look at this. Woody number two and Valiant gone. Woody number seven. I haven't read this one. I read the first four or five, I think. There's the goat. I don't know. I haven't read the issue where this guy comes in. Harbinger, number three again. I guess that's three Harbinger, number three. Well, Harbinger, number five. We got this one in another pocket thing. Harbinger, number four, sweet. Harbinger, number 14. This one's damaged here a little bit. Squished it in. Reading copy. This is old school Valiant. I stopped buying Valiants before this bloodshot yearbook, 1994. When they got rid of Jim Shudder, I basically stopped buying Valiant soon after. Go on to my Woody. I don't know what number this is. If you're curious, what you see behind me are the EC comics that I have framed from 1952. These are all from 1952 comics. They're amazing. If you haven't read ECs, you should read ECs. There's lots of reprints available as well, if you're interested. They have them in hard-cover balance books. I have one of them. I read through it. It's fantastic. I've read some of the old EC books. I pulled out a couple of them to my favorites, the annuals. What have we got here? Look, it does a couple of old school bloodshots. Bloodshot yearbook. Bloodshot, number 17, old school. Don't have this one either. We got Shadowman, number 16. Shadowman, number 1. The $1 thing. Reprint, number 3. Sweet. This is the first print. Tell me this is the first print. Oh my god. You won't believe this. You Valiant lovers. Right, number 1. First print. This thing is completely sold out. You can't get this. You can't see it. It's too dark. Oh, that's one second printing. Look at this. First printing. I have a Rai, number 1. I've read it, but it's like a cover. This is the second printing of Rai, number 2. This is completely sold out as well, right? Okay, second printing. Nice. I don't have Shadowman at times. Number 1. Whoever put these packs together at the comic bookstore? Thank you. Quantum Woody, number 6. What's this one? This is Quantum Woody. I don't know what number this is. I think it's a number 4. Yeah, number 4. Quantum Woody, number 4. I don't really have this one, but I don't want to have this cover. That's not bad. 50 cents a pop. Rai, number 1. Very sweet. I got two more packs left. Look at this. Exo number Bloodshot first. It's 4.99. So Bloodshot, Hard Corpse, number 18. I haven't read this one. I read it all the way to the end of the Harbinger Wars with Bloodshot, the crossover. After that, I just started going to the comic shops and trying to buy back issues because I had gaps. I wanted to read Bloodshot number 12. Sweet. This is Harbinger Wars. I've read this one. Number 11. For those of you who don't know, they're making the Harbinger Wars into a movie. Bloodshot is the first movie they're making from what I've heard. I guess that's my next reading because I think I stopped at number 13. Number 15. From what I've heard, Bloodshot is the first and then Harbinger and then Harbinger Wars. So there's a serious amount of stories coming from Valiant. If you want to know how Valiant's doing according to number 17, this is a nice run. Thank you, thank you, whoever you are that put this. Yeah, just to let you know about the numbers. From Diamond's list of that the print runs was what they shipped last month, or was it the month before I can remember. Valiant, since I've been checking for the last year or so, the ones that I've come across a year and a half or two years, Valiant was always categorized as the other publisher because they didn't make it in the top 10. The last one that I looked at is either June or May. May or June I think was May. The numbers that they released, Valiant was number nine. So they've made it out of the other publishers into number nine. One of the trade paperbacks made it into the top 10 out of all the publishers, the trade paperbacks that they released. I think it was Harbinger that made it into the top 10 of the top trade paperbacks sold. Okay, so there is a lot of people jumping onto the Valiant books here and this is the last, so I guess there's like three of these we've got so far. I wonder what's in this one? And at the back it's number two, Kaunton and Woody number two. Really if you want, if you want a funny read, this is it. I haven't read the new Archer Armstrong yet so I can't comment on that yet if it's as good as Kaunton and Woody, but from what I've heard it's just as good. And I know the old stuff, Archer Armstrong was fantastic. Maybe Unity until Jim Schubert was there. Again, I don't know how many of these we've got, three of them. XO number three, XO number eight. I don't think I have this one either, nice. Another one filled. XO one dollar one. We saw this one already, XO number 12. XO number 17. Shadow one number 12. It's like a lottery. It's like I'm hoping to get into the Rye number one here. I shadow one number eight. What's this? Geomancer, this is like old school Geomancer. Geomancer number one. Wow, glossy. I didn't pick up this one. I was, I dropped all the Valiants by the time this came around. I might give it a read. Silver foil cover. The gimmick covers at the time. Some of that stuff around now. And this was Kaunton and Woody number three. Very nice. That's what I wanted to do. I wanted to share with you what I just came home with. I was really happy about it, okay. Excited to read these and just as a nice read recommendation. If you want to read some amazing stories, Valiant has some books for you, depending on what you're into, right? Do a little research, read up on forums, give it a shot. They got from humor to very, very serious books. And it's a brilliant universe. And I plan on continuing to read Valiants and collect them as long as the quality stays up here. And I can't see the quality dropping. Like, I don't think anybody else, any other publisher is doing anything like Valiant right now. They're magnificent reads. And again, thank you whoever put these talks together. I might go back and see if you put any more together. Okay. I'll see you guys in the next video. Bye for now.


Vascular anomalies are a heterogeneous group of congenital blood vessel disorders more typically referred to as birthmarks. Sub-categorized into vascular tumors and malformations, each anomaly is characterized by specific morphology, pathophysiology, clinical behavior, and management approach. Hemangiomas are the most common vascular tumor. Lymphatic, capillary, venous, and arteriovenous malformations make up the majority of vascular malformations. This paper reviews current theory and practice in the etiology, diagnosis, and treatment of these more common vascular anomalies. This article was authored by Greshan T. Wiktor and Adva B. Friedman.


today we shall look at the effect of the flow of corrosive environment on the corrosion of metals. So far what we discussed was related to the environment being it is static and in several cases at least in the industry the environment need not be static. The environment you know there is a flow. There are so many complex flow conditions that exist in the in the industrial scenario. The corrosion of metals are different if the if the environment you know flows in relation to the metallic structures. So, this topic so assumes very greater importance. So, we will discuss in detail what are the kinds of flow that affect the the metallic structures from the corrosion point of view and what are the mechanisms involved. The factors that control the flow assisted or you know velocity affected corrosion and then also we look at the control measures. So, here we will say that flow assisted I am going to separate out like this and or erosion, cavitation, corrosion. Now, as I told you there can be a relative movement please notice that when you say the environment we talk about not the benign one it is a corrosive environment. Now, let us try to understand what do you mean by relative movement first of all. The structures can be static can be what happens the environment moves I will say. So, in example is a pipeline carrying water carrying waste types of chemicals and an example could be heat exchangers. The structure is static the environment moves maybe at different velocity, different pressure, temperature all this happen. The structure moves. Can you give me an example? Anybody? You can say shape, but the velocity is not ok you can say shape . We can talk about an aircraft also stage craft in fact, aircraft moves at a very high speed. Other examples, industrially agitators right in a in a in a turbine right a turbine blades it could be a gas turbine or it could be hydraulic turbine gas engine anything else? Impullers they move propellers you know. So, these are about the two types of structures I would like to say ok. Now, let us look at the the environment. What is mean by the environment here? Of course, we have talked about the fluids only one has to be a fluid I mean corrosion environment is a fluid. It could be a single phase could be a multiphase. Generally two phases can happen commonly. It is a simply a water a sea water an example. This is a sea water plus some sand right can happen. In a in a in a thermal power plant for example, you talk about a steam generators you may have a gas steam you may have water in a gas turbine there can be corrosive gases there can be particles. So, when you say a fluid it is not necessarily a liquid ok. It can be a corrosive gases it can be liquid, but the solid is not necessarily a corrosive. In most cases, you do not even consider them as corrosive. The role is to give an impact we will see this later how they can really affect the corrosion of structures. If you look at you know in the fluid in the fluid conditions when the when the fluid moves how the corrosion rate of the structure or metallic structure can change with respect to the velocity. We have seen in you know somewhere right I think the role of velocity on corrosion corrosion rate right. We have seen before can anybody recollect? Yeah. Yeah, we talk about a concentration polarization right. When there is a concentration polarization when increase the velocity the corrosion rate increases it is simply a diffusion control process actually there. If there is no diffusion control process the velocity does not play any significant role. You can go back and see your you know the first part of the course in thermodynamics and kinetics of electrochemical corrosion. If you plot this something like that the corrosion rate initially increases you know gradually like that a steep increase in corrosion then again it slopes off like this. There is there is you see here there is a velocity called a critical velocity above which the rate of corrosion steeply increases with velocity right. When you when you when you visualize let us say a pipeline suppose visualize it and if the fluid moves travels in the pipeline the movement of the fluid is parallel to the surface. What do you call that? You call a laminar flow. If the fluid is increased what happens now? It is no more parallel to the surface it is going to hit the surface ok. What do you call this? Now, the laminar flow turbulent flow they all depends this is described by Reynolds number and there are equations we will not get into that kind of discussion here ok. But it is it is enough to understand that the velocity or I put other way around the natural flow decides the kind of corrosion you can happen. The laminar flow or a turbulent flow that depends on velocity density the dimensions of the pipeline so many factors. So, the rate of corrosion over here the natural corrosion over here is different from that of over here can happen. So, you can say that in this case you can divide this something like this is going to be a turbulent and it is going to be laminar and major part of the laminar flow I mean we can say that can be you know the corrosion rate can be controlled by the diffusion processes. If it is essentially a corrosion is a diffusion controlled right. Some of you would have the study effect if you can recollect that right. If you recollect if it is a cathodic reaction say diffusion controlled right this is called I L and the velocity increases we talked about this in the first part of the class. So, it is a diffusion controlled process and the corrosion can assist and the mass transport is important. You see later how the corrosion can get affected right. Now, the depending upon the kind of flow conditions exist in a pipeline the types of corrosion can be broadly classified into three types ok. Nature I call as types of corrosion which are induced by the flow. One is called as flow induced corrosion. This is essentially related to increase in mass transfer. Mass transfer of what? The mass transfer of the corrosion product. How quickly it can get removed from the surface? Earlier we talked about the diffusion control process of what? In that case what is what is diffusion control there? If you remember when we said here what was the mass transfer control here? It is the cathodic species that is mass transfer control. We will see here in this case it is not necessarily the cathodic species reduction species mass mass transfer control. It is oxidized species which are mass transfer control I will just talk about soon. Next is erosion corrosion here it is mechanical damage mostly of surface films. So, there is an impact there is there is a real erosion taking place right in the in the sense of mechanical factor. The other one is is a cavitation corrosion it is majorly mechanical if you can say is minor ok put within quartz ok is minor. Now, we have classified the the corrosion occurring on a metal into three different categories primarily because the mechanism of corrosion in all these cases are different when the mechanisms are different the solutions are going to be different ok. So, we are not going to apply the same solution all the case of course, I mean there can be an overlap of properties and the protective measures, but distinctly they are different you can see that. So, now, let us look at the the first type of thing I mean that is the flow assisted corrosion flow induced or flow assisted you know you can you can call what are this flow induced corrosion or flow assisted corrosion what is this? What does it do? What it does is that the flow that happens in the system mostly in the pipelines the assist the solubility of corrosion products then reduce film formation. So, it can enhance corrosion it can happen in single or two phase conditions two phase yeah two phase flow I would say. Let me try to explain what we mean by this all these factors here. The flow assisted corrosion was you know was first a problem were found in thermal power plants here formed in thermal power plants and they made a survey in 1990 1997 of 63 power plants 63 plants utilities. In in all these cases they found you know quite an extensive you know plants suffered the flow assisted or flow induced corrosion. Now, you know in in power plants what do you use? I mean to to I mean you generate steam right and steam is used to run the turbine and so that means you are going to use water it is essentially a pure water ok. So, we are not discussing that probably in the next course on industrial corrosion control we will talk about corrosion of boilers and all the steps. The generation of steam means you use pure water there are certain specifications depending upon the pressure of the boilers they maintain the pH they maintain the the purity levels conductivity and so on so forth. They normally use steels ok. How does the corrosion resistance of the steel occur there? Primarily because by controlling the pH you can do that. When you do that they form a film on the surface. See otherwise you can imagine that steel is you know in a in a typical boiler the temperature can be about to be to 280 degree Celsius ok and in economizes maybe 130 140. The temperature of the steel tubes are in this range and use water and you know it will undergo corrosion right. See you you know very well and you have a lot of steel structures here when rain comes you see a flash just couple of hours you see is all done turning that it is brown. How is it possible for the steel to resist corrosion here? By controlling the environment that means you change into into a in alkaline pH and the film formation becomes a dominant mechanism of corrosion prevention of steel. So, that means, these oxides are generally a magnetic oxide right. This is what is the magnetic oxide Fe 3 O 4 is a magnetic oxide formed and this oxide prevents the corrosion of steel structures. See please look at you have this formation. When does it form? This will form only when the solubility of Fe 2 plus and Fe 3 plus right. This constitute Fe 2 plus and Fe 3 plus am I right? The solubility of this one is less than concentration of ions right. So, here what happens? You have Fe 2 plus and Fe 3 plus ions are coming by dissolving. If the concentration exceeds at a limit they form the precipitate they form a protective oxide please understand this ok. So, that is how generally these metals are prevented. Now, if I have a flow what happens? They swept away these ions from the surface. These ions are not going to get enriched and so, the film formation becomes very low right. So, high velocity high flow rate means they are I mean the low concentration of Fe 2 plus and Fe 3 plus taking place. That means, the metals start dissolving more and more ok as you increase the velocities. Here that is what it means. Here the velocity increases the dissolution process by sweeping away the corrosion products. That means, the film formation becomes very low in that cases. So, that is the primary mechanism of corrosion of steel by flow induced corrosion process. How do they appear? How do they appear? This is the photographs taken on a steel pipeline I mean you know of a superheated water. You see the left side has got a single phase flow here the two phase flow. You can see that the surface is quite rough ok. Because of the dissolution process the surface become rough. See they are all they are dissolved in in water. Here it is they call it they call it as tiger stripes. It looks like a appearance like a tiger stripe. So, they they they they named as tiger stripes. Please understand that these these are not very high magnification they are lower magnification they are not micro structures ok. This is the kind of appearance of the surface they are affected by flow assisted or flow induced to the corrosion process. Now, these are very important it occurs in the power plants in several places boiler feed water pump, place of occurrence, feed water pump, tube sheets, tubes in HP heaters, heated drain lines, economizer inlet tubings, piping to economizer heads, de aerated cell. Now, there are several places I think I just give some illustration that they are important for thermal power plant. Of course, it can happen to a nuclear power plant as well right. So, you have seen now the mechanism of flow assisted corrosion. We have seen the importance of the flow assisted corrosion ok. Now, let us look at what are the factors that affect the flow assisted corrosion. Obviously, you always have a material component, you have the environment conditions, then you have what is called as hydrodynamic conditions. So, people have modeled this actually. In fact, this is one of the serious problems in nuclear power plants ok. They have modeled this flow assisted corrosion. The factors that involve our material I have seen the environment and the hydrodynamic conditions existing in a in a in a in a flowing system. Now, in the materials mostly people talk about the chromium content later. The environment we have the pH, temperature ok the oxygen content and the hydrodynamic condition means it is all related to mass transfer coefficient right, how the mass is being shifted from the surface to solution. So, there are going to be a complex parameters ok. So, if you look at this it is very interesting now. In a pipeline the hydrodynamic conditions might change depending upon what?  These locations are affected by severely by this flow assisted corrosion, but these are straight forward pH, temperature and oxygen content and increase in chromium content is supposed to be better from the resistance point of view. Chromium, chromium increases, increases in chromium lowers flow assisted corrosion and say that if it is more than 1 weight percent chromium, there will be no flow assisted corrosion. I do not say no and it says I would say I think significantly lower. It does not occur in stainless steel and you know stainless is are not used very extensively you know because it is expensive process you know materials. So, in economizes many of the units we discussed here they are not made up of stainless steels, they are earlier they made up of simply carbon steel. Now, people go for chrome steels ok, one chromium or even two you know two quarter chromium kind of, but one chromium is is quite common materials. Now, people use in order to prevent the flow assisted corrosion of metals. How one percentage chromium?  Let us look at the environment now ok. First the temperature and the velocity these two are very critical to plot temperature versus the corrosion rate you will find like this. And very interestingly the temperature in these range these are different velocities v 1, v 2, v 3 and v 4 and v 1 smaller than v 2 smaller than v 3 smaller than v 4. When the velocity increases the flow assisted corrosion increases, but note notice here it increases a steeply at this temperature with temperature rises and then again there is a drop in in the corrosion rate. So, it is a very unusual thing that you notice for any corrosion process. It is not same as we discussed earlier you know you remember earlier we discussed that the effect of temperature on the corrosion rate of water remember I think some of you. I said that when you rise the temperature above 85 or so the corrosion rate of water drops because the oxygen escapes from the surface right from the from the water. You know boiler that does not happen right the oxygen cannot escape from that nor the oxygen is present in this water at all. So, what happens is that essentially if you rise the temperature what happened to solubility? In some cases the solubility increases some cases the solubility decreases. What do you call the solubility called? Have you heard of this retro agressive solubility? So, the metal starts precipitating after certain certain temperatures. So, when rise the temperature the ability of the system to to precipitate to form protective film increases. So, the rise in temperature increases the kinetics of metal dissolution assume that there is no film on the surface. The rise in temperature will only lead to increase in the corrosion rate am I right? Assume that no film is formed and if you rise only the temperature the corrosion rate only will increase with temperature. But so, there are two factors the rise in temperature increases the corrosion rate, but the rise in temperature also increases the scale forming tendency. So, the corrosion rate starts falling like this. So, you have an optimum value here wherein the corrosion rate is highest and then it starts falling ok. So, this is a typical of in a in you find in terminal power plants they are they are operating for the utilities actually ok. And this temperature is in the range of this temperature is in the range of 129 to 149 degree Celsius for a single phase flow and it is in the range of 149 to 199 degree Celsius for two phase flow. So, what are the factors that that then can control flow assisted corrosion, velocity, the temperature right the pH. Now, all of them should be seen in in in in in light of the ability to form an oxide film or to damage the oxide film please look at that ok. So, those factors which assist the formation of the film will lower the flow assisted corrosion and those factors which dissolves the film will increase the flow assisted corrosion. So, you do not need chromium to form a passive film in steel. How does the film is formed? The film is formed by maintaining the pH. So, pH is is a primary thing for that. So, the role of chromium is just to assist the film formation. So, it is not going to be a pure chromium rich passive film that you see in stainless steels ok. Here the same the film will be here having rich in iron oxide is Fe 3 O 4, but the chromium assists the formation of a stable Fe 3 O 4. So, the kind of film formed here is not same as the kind of film formed in stainless steels. The chromium is only assisting it. If if the pH is not properly maintained I do not think that chromium will be sufficient to form any film at all actually ok. So, that is from we have seen from only from that point of view. And so, the one percent chromium is good of course, you increase the chromium content is even more better, but of course, cost increases. In industry every penny is important you do not want to keep increasing the MOC better materials because that is going to cost more ok. Now, what else can improve the improve the film formation interestingly is the role of dissolved oxygen ok. So, whatever you discussed is is supported by this dissolved oxygen content, deo content versus the corrosion rate. Now, so it is this is called as polished surface this is pre filmed. Please notice that generally the boilers are passivated you know it is called a treatment called passivation treatment people do they call alkali treatment in order to form the film ok. If you have a film here it is even better. So, please notice that the oxygen content helps to decrease the corrosion rate because the oxygen will what does oxygen do? It it stabilizes the it increases the corrosion rate no doubt, but if it increases the corrosion rate beyond certain level it will increases the metallic ions on the surface and it forms a film. It is very similar to critical condensity right. When it is a critical condensity at that point of time you have more metallic ions than the passive film starts forming. So, you need a critical amount of metal ion concentration on the surface in order to form the protective oxide film. So, the oxygen content it does help to do this. This means it is a very interesting here the corrosion control in this case is done by injecting some oxygen content in the boilers ok. And they it is it is about it is about 50 p p p please look at ion it is not ppm level this is 50 p p p levels. So, they lower lower the the flow assisted corrosion ok. So, we will not get into discussion of the mechanism of that there are a lot of papers available those who are interested you can can read. Please notice this water treatment is not common for all the boilers. The normal boilers we talked about they do not use this, but now we use boilers such as hope you people might have aware of this super critical boilers they give this treatment. They give the this called as oxygenated treatment in order to in order to reduce the flow assisted corrosion. So, I just summarize now what we have seen so far so that you have some clarity. You have flow assisted corrosion what are the factors that affect flow assisted corrosion? It is a material the environment involved and of course, the flow conditions or hydrodynamic conditions. The mechanism here is is is what the flow assist what? Simply the electrochemical dissolution process notice no mechanical damage it is simply that the flow conditions help to sweep away the corrosion products and so, the corrosion is increasing. They do not allow the film formation or or lowers the film formation on the surface. So, how do you control this? Control measures chromium alloyed maintaining the optimum pH very important thing the design right. Why you say design? The hydrodynamic conditions existing on the surface depend upon flow conditions right. So, you could it could it could change. If you are going to have a sharp bends you are going to have more flow assisted corrosion. If you avoid that it may reduce if reduce a velocity then also the erosion I mean sorry not erosion corrosion flow assisted corrosion would could decrease. So, the design of the system also is is equally important and of course, the corrosion allowance you do not want that as the primary way of preventing it, but that still is we are not going to totally eliminate flow assisted corrosion, but incorporate the flow assisted corrosion rates in the design. Especially you know in a unit some places inlets for example, or maybe the bends elbows if you incorporate that you know the corrosion allowance to lower the flow assisted corrosion. What next topic which is erosion corrosion? Let us straight away bring out the difference between erosion corrosion and the flow assisted corrosion ok. Here no mechanical damage the erosion corrosion mechanical damage is predominant. It happens very widely across several industries. The flow assisted corrosion mainly I would say related to the the power plants whether it is a nuclear or fossil fired by I mean power plants ok. So, you see this I now in almost the pipelines the the the locations I would say the locations or where you see them the erosion corrosion are the pipelines especially on the bends and elbows. You see this you can see that them in the heat exchangers especially the inlet. You see them in the reaction vessels you will see the agitators grinders for example, see in the in the the mining industry that grinding is very very common right. And sometime even this over is transported as a slurry along the pipelines. So, you see huge amount of erosion corrosion taking place in the in the pipelines. Again you will see that you know impullers and gas turbines and hydraulic turbines, nozzles they are all quite common examples of erosion corrosion taking place. It is an example of the erosion corrosion please do not use the term flow assisted corrosion here. It is now erosion corrosion. What you see is a this is a reactor vessel reactor vessel it is a valve actually it is a valve. Today it is there is a reactor there is the inlet here this is the inlet for this is actually the sulfonic acid reaction vessel here. This is a the kind of autoclave you want to call it reactor you call it. Through this the sulfuric acid is is is pumped. This is the surface of the reactor the sulfuric acid travels like this ok. You can see the mark you can see the marking here. Severe corrosion here taking place right. Next to that there is not much of a corrosion. For two reasons of course, one is the velocity see here. The second is then the sulfuric acid get diluted right. I mean the sulfuric acid get diluted with the corrosion rate of the sulfuric acid also comes down sulfonic acid here. So, you can also see some kind of flow patterns are you able to see this here? I hope you were able to see this flow pattern here. So, these you know these are all having specific features to show that there is certain amount of uniqueness in the way the metal gets damaged they are called fingerprints ok. This reactor did not even last for about 6 months within 6 months you know the reactor starts leaking case. This is the earlier one was a stainless steel. It is a stainless steel what you seen here it is not a carbon steel it is a stainless steel. This one is a copronical alloy it is copper 10 percent nickel and this is a tube for an heat exchanger. In the tube the seawater was flowing. Look at this the velocity was hardly about 1 meter per second was the velocity. The external I mean on the cell side the process fluid it essentially is hydrocarbon you do not see any corrosion on the on the cell side. I hope you can see the marks here right you see the marks here marks marks and I hope you can able to see some mark here also right. This is an inlet the inlet of we need a changer. It is a very interesting and there are several tubes in the heat exchanger within about few months of commissioning some tubes started leaking few months it was in a in a refinery located in Mumbai. So, they change the tubes you know within another one month the heat exchanger started leaking again and again changed the tubes. Almost every month they had to shut down the plant. See when you shut down the plant because this is a critical heat exchanger if this exchanger does not operate then the whole refinery has to shut down you know if you shut down the refinery for a day you know it just runs in the corrosive piece it is not just lacks the corrosive piece. The material is not very expensive compared to the production loss you know you see this. They were using seawater and seawater you know seawater stainless steel will have some problem because they may pitting corrosion or you may have crevice corrosion and cooper nickel alloy is supposed to be good because they do not pitch and all right. And cooper nickel is is suddenly better from the point of view of what you call as dealloying as compared to brass we seen it you seen yesterday right. Little bit of discoloration you can see this little bit of green color that has happened because of the nickel dissolution process. But nevertheless 1 meter per second is hardly a velocity and is failing so frequently. So, that was one of the problem we will probably see you know what could be the problem you know in subsequent discussion. When we start analyzing the erosion corrosion then we come back to this problem and see what was the real reason for the erosion corrosion of this particular heat exchanger. Now what I was trying to say was the inlet of the heat exchanger is generally undergo the erosion corrosion in fact, that is termed as inlet corrosion. So, when there is a turbulent it mechanically damages you see you know it it removes mechanically ok. But then what is the difference between erosion and erosion corrosion? So, I give an example suppose there is a pipeline and you are passing let us say nitrogen gas in the pipeline maybe there are certain solid particles ok and the tube gets damaged. So, it is a purely erosion damage. You put a bit of moisture in the system and you say that gas is no more dry the solid particles are no more dry you just have some water how it becomes erosion corrosion why because you have a corrosion component coming over here. So, erosion corrosion you know it is it is it is a it is a conjoint action of the mechanical erosion factor and assisted by the corrosion factor. So, when you talk about erosion corrosion then you look at the mechanical property of the material as well as the corrosion property of materials ok. So, that makes a difference in the flow assisted corrosion we never talked about mechanical property of materials we talked about the film formation film stability. That is why I said the mechanism are different and so, the way you prevent corrosion also going to be different here. So, what are the factors controlling erosion corrosion affecting erosion corrosion? Here also we talk about the surface films. They are important talk about velocity, impingement, turbulence etcetera. They are related to the physical state of the environment velocity, impingement, turbulence they are not talking about chemical state of it right we are not talking about the pH of that corrosiveness of that is a physical state of the environment ok, metallurgy of this. The metallurgy of the alloy will also decide the surface films you know it is not necessarily they are independent ok, but metallurgy here we generally mean in terms of the other mechanical properties such as hardness, toughness all kind of stuffs. So, let us look at the surface films. Let us take the the first one. Please notice the film offers a barrier for corrosion it also takes the impact takes impact of the environment. So, what should be the property of the film or properties of the film which can provide a better erosion corrosion assistance? What are the properties? It should be the film should be it should be hard isn't it? Then what happens? It should be adherent, 3 what happens? It should be resilient right and if you want it more explicitly or be less brittle should be dense and less porous. So, those alloying elements that added to the alloy that can promote all these properties will ensure that the alloy has a better resistance against erosion corrosion problems ok. So, these are the important thing that is the guiding factor for all our development also right. So, please notice it is not necessarily a very thick film now sometimes thick film can be a problem isn't it? A thick film is generally the oxide films are better compared to the metal. When the film becomes thicker and thicker what happens to the resilience it becomes very bad. When the film is thin it is more resilient against any kind of elastic deformation right. And in erosion corrosion you are not going to get into too high impact any cavitation it does happen. So, you are talking about a resilient within the elastic limit most of the deformation would occur in erosion corrosion ok. Let us look at some examples of the surface film formation happen. The surface film formation would also depend upon the nature of environment it is not just only metal also ok. Suppose, I take a stainless steel I have a reducing environment what happens to the film forming tendency of a stainless steel decreases right because you need oxidizing conditions that could be seen very well in the case of let us say type 316 stainless steels corrosion in ferrous sulphate plus sulphuric acid slurry. Please notice ferrous sulphate is reducing condition is not oxidizing condition. Ferric sulphate is oxidizing condition. If you use 316 stainless steels and if you can look at the corrosion rate again with respect to the temperatures the corrosion rate of that somewhere about 5000 MP y something like that. In the static conditions ferrous sulphate plus sulphuric acid slurry in the static condition this is not flow condition where if you increase thevelocity for something like that. So, I think it is about some I do not know about 3 meters per second state is going. So, it is it is going very very high corrosion rate steeply also changes with respect to temperatures. But you add 316 stainless steel and add some copper to that the corrosion rate you know. So, when you add a copper tostain the steel the film forming tendency becomes very high. In fact, if you if you if you look at the material selection for sulphuric acid applications the stainless steels have copper in it. So, copper helps to form stable passive film. So, this is a significant drop a significant drop in the in the corrosion rate and these copper additions are all what they are all in terms of what 0.01 to 0.02 weight percent not a very large amount of copper content you can happen. Similarly and what people have seen seawater a copper a brass the copper forms cuprous chloride and it forms cuprous oxide in derated seawater and cuprous oxide is more stable. So, what happens? So, copper zinc is better. So, what we are trying to say is that the nature of the film that forms on the material decides the erosion largely the erosion corrosion resistance of the material. The other example is steel in pure water it is where they studied the pH at 50 degree Celsius and the velocity is about 39 feet per second is the velocity here and this around about 6, 10 pH. Now, the reduction in the corrosion rate both the places are largely related to ferrous hydroxide and ferric hydroxide formation. Here from granular you know Fe 304 oxide formation again there are a lot of internal stresses. So, the point that we need to emphasize here is that the nature of oxide forming on the metal surface bears a significant influence on the erosion corrosion of metals. So, let us stop our discussion for the time being.


Hey, thanks again for joining us here in the app sec village. Good morning. Good evening. Good afternoon or good night Depending on where you're at in the world kind of a little hard to tell right now since we're not all in one big room together But I've got another exciting talk for you The next talk in our agenda is going to be API and security top 10 a guided tour to the wild wild world We've got two speakers this time. We've got David so pus and Paulo Silva David leads a team of security researchers at check marks and as a co-founder of char 49 With more than 15 years of experience in pen testing and vulnerability research He has been acknowledged by companies like Google Yahoo eBay and Microsoft After retiring from his bug bounty hunting career David now focuses on the Internet of Things security and tries to learn new things each and every day Paulo since his first OWAS local event back in 2010 has been active in the community Contributing to several OWAS projects with over 15 years of professional experience as a software developer He is now focused on ethical hacking and security research with regular collaborations with companies like char 49 and check marks He's interested in programming languages dev sec ops and web mobile secure coding practices Please welcome David and Paulo Hello everyone and welcome to the API and security top 10 the guided tour to the wild wild world Before we start I would like to thank and appreciate the opportunity to be at Defcon even if he's in safe mode and Upset village for approving our research. So thank you Let's start Well, I will start by presenting who we are, okay We with a brief description of what APIs are The importance in today's software the differences from traditional haps Then we went through the OWASP API security top 10 talk a little bit about the project and our contribution to that project and then guns blazing on the API's wild wild world where we show real vulnerabilities on Modern web applications and describe a little bit about our findings We are well, my name is David so push I work for check marks since February 16 I'm currently the security team leader of a very talented group of researchers I'm chief operating officer of And co-founder of sharp 49. I was Bug bounty hunter a few time ago I have a Around 15 years in penetration testing and security research Nowadays, I'm playing more with breaking IoT devices specifically using the LE technology And focusing on modern web applications, of course and API Some of my work you can already see on Tech Ranch the register security week and threat post Sorry about the photo, but I use the pandemic filter I was in During it was during the quarantine in Portugal. So that's it. I think it was very appropriate to this event moving on to Paulo Hello, and thanks for watching. My name is Paul Sylv and it's a great pleasure to be presenting at DEF CON especially together with my friend David I used to define myself as a freedom enthusiast since I love everything related to free and open source software worldwide web or cross-countering and bikepacking. I Have more than 15 years a software developer. What is plenty of time to have done all sort of mistakes? Right now, I do ethical hacking and security research and since 2010. I'm a regular OASP volunteer I'm Currently I'm the OASP go secure coding practices project co-leader and main collaborator on OASP API security project Meanwhile, I'm used to fill the gap and deliver security awareness sessions in academia Before continuing the mandatory disclaimer hacking systems without permission is crime and We are not responsible for misuse of any information. We are about to disclose Let's talk a bit about APIs. I Like to look for definitions in the dictionary because words matter Nevertheless, I'm not expecting to find Definition for API in the dictionary but Something interesting about interface Defined as a common boundary of two bodies. In fact, we can think about APIs this way Common language that connected things talk in order to get work done APIs have a central role in today's software. They are the common ground among several types of devices and applications a generic language that all them know how to talk to exchange data and execute functions This is different from traditional web applications in many ways before we had web servers playing this central role Doing the heavy work answering client requests Gathering data from databases and other web services Glowing everything together computing the final HTML and returning it back to the client to be rendered Nowadays there are several types of clients behind web browsers We have smart bulbs wearables cars civil surveillance cameras, etc. Etc. Etc. Etc. All These clients use APIs to make their capabilities available to other clients and to communicate with each other Clients are now more powerful than they were before In modern web applications. There's a clear separation between front-end and back-end The front-end nowadays is a bunch of JavaScript and CSS providing rich user interfaces to collect data Send the data to several APIs Making it generally available to all clients regardless their type. I think this is a Pretty much about APIs and we should move on to the all-asp API top 10 with David So alas API security top 10 You may already Heard about alasp in its own words is a non-profit foundation That works to improve security of software What's top 10 is one of the flagship projects and most of you should already know it already It has played a enormous role to bring security awareness into organizations both to management and dev teams, but we have seen very specific API related issues popping up we should learn from past mistakes and Erres Yalon and Inon Scadi decided to start the alasp API security project to address API specific issues the document follows the same approach and popular wasp top 10 for readability purposes But it's 100% API oriented or contribute Vendors had been doing business as usual and there's no API specific data For a public call for data like other alasp projects. So we had to research There are several bug bounty programs that released for disclosure write-ups and We went there and even on some public information that we got hands on But we had to review it and pick only the API related issues So while reviewing the report and the write-ups, we start standardizing categorization and grouping things together After a few months, we were able to compute a statistical top 10 security risk of course was was using the alasp Risk rating methodology We drafted the first alasp API security top 10 and asked several entities Organizations and individuals with relevant upsec experience in the API field at least to get us some feedback The draft was published on Github and during the several months we worked with up a sec community to to get some feedback and Change a little things by the end of 2019 The final version was published and we're very happy with it Then we went wild to validate how accurate the wasp API security 10 top 10 2019 was so Hope you can have the opportunity to download it and see it API is in the wild wild world our research so Our focus was only on I profile web applications And of course focusing on the API We want to map all the vulnerabilities that we found on the wasp top 10 nine two thousand and nineteen so You may ask what was our biggest Problem if I can say that and And Yeah, it's it was the responsible disclosure because many companies didn't reply or just didn't care about security So that was the most Challenging issue that we encounter on our research. We tested eight APIs we discovered 28 API issues that we categorized on the on the your as you can see on the Right table We got a minimum CV SS 2.7 and a seven point seven max We found seven broken user authentication we Five with five issues we have broken object level authorization or Bola or X and also with five excessive that exposure Security misconfiguration was for Broken function level authorization three and also with three lack of resources and rate limiting three Finishing with one result on injection not so common anymore findings Moving on to Paul Okay, let's start with the broken object level authorization You may know this by I door or insecure direct object reference But while writing a last PPI security top 10 we decided to rename it since I door is not a very accurate name In this case we found two Exposed API's a graph QL and a rest one both vulnerable to broken object level authorization As you may know graph QL is not like Rests and you should ask for what you need and you will get exactly that nothing more nothing less This is valid for resources like profile, but also to their fields Of course, we can try to guess everything or use word lists But it becomes even more interesting if you find another vulnerability Like a security misconfiguration allowing you to query that information More details about the security misconfiguration specific to graph QL And it's specific section. You just have to wait a few more issues and we will get there By now, let's focus on the requests on the left side We are looking for a specific profile based on its on its slug The slug is public information since it's part of the user's public URL On the right side, we have the API response. We can see users public URL the slug and also Something that points the profile to be private, but nowadays we never know what private means We have several other properties, but there's another one the ID Which we will use with the rest API So we took the ID property we got from the graph QL API and we used it to request a user on the rest API We got additional information including billing information with full address and tax ID number At least this time API doesn't say that the user resource is private But note that both requests were anonymous. There was no authentication nor authorization I think this was a good warm-up. We can continue with David broken user authentication in this case SoundCloud our final objective was to get account takeover and we did it So on SoundCloud, which is already disclosed this issue I Can give you a brief description what we did so on user user account lockout Based on failed login attempt something that we don't see often in this case the API was API was rate limited so neither less it was possible to bypass and we will show you how So chaining the rate limited bypass with the user enumeration issue that we found We were able to accomplish the account takeover via credential stuffing attack This is a typical user enumeration scenario where we abuse the recover password mechanism We have a binary feedback Depending either the provider the mail belongs to a user account or not as you can see on the perp screenshot rate limiting bypass Was something fun because at least was the first time we saw it It was based on the user agent the device ID and signature So both device ID and signature was computed client side instead of reversing the JavaScript Logic we gather three different Combinations to be randomly picked by our brute force script After a first fix attempt, we will also use different EIPs by using Tor Forcing different as it nodes Rate limiting is very important of course and it should be very restrictive for authentication and points But it can also not Enough to prevent what the user account lockout does which should be implemented both authentication and rate limited So this is an example that we did With a single thread of POC running in an ordinary laptop for sure if you use concurrency or parallelism and cloud-based approach We have done it much faster for sure so in the end this is the Access token we can have and the account takeover is Completed to follow Let's talk about excessive data exposure This is probably one of my favorites finding We started with the user enumeration issue on the recovery password mechanism And later a security misconfiguration allowing us to leverage the the attack The recovery password required the user to provide its email address on the front end which then issues an API request to retrieve a list of available delivery Channels either email or phone the user can pick one on the front end and then one time password is Delivered so that it can Recover his password in this workflow. We noticed that URL including a JSON web token Were provided for each delivery method. So we took the phone URL and decoded the JSON web token then we found that The actual user phone number is included in the JSON web web token payload section Meaning that we can exchange user emails by phone numbers note that These API requests are anonymous since they are aimed to recover passwords we decided to Go further and do this for an arbitrary list of email addresses that we gathered from pastebin.com It had 169 email addresses and we got seven user accounts with email and phone number Meanwhile, we found a security misconfiguration In fact, we found an exposed error log file including some sensitive information, but the most interesting one was The location of some internal files. Luckily, these files were also Exposed and publicly accessible and this is how some of them look like they were mailing reports with valid user account emails And also the mailing subject. So Just by themselves, they were good enough to be used for a phishing campaign But we could even enrich it with the phone numbers complete the the info and drive some phishing or smishing attack API is tend to handle huge amounts of data and some of them also leak part of that data You may know meetup Meetup offers pro accounts which give you access to unlimited groups and targeted communications to members. You get several other features All of them for $30 per month per group And in fact, you also get access to free email addresses Regardless of what privacy settings you choose and what meetup says that they won't give your email address to anyone What we saw is that as long as you can issue an API request You will be able to retrieve email addresses from the API and We did this for 38,504 user profiles Just on the war the WordPress network. I Think it's quite huge Let's continue with the vids with lack of resources and rate limiting Well with lack of resources and rate limiting The final objective was user enumeration. So what we have is a improper rate limiting and In the end we got the user enumeration In this screenshot you can see because to be fair The meetup, which is the target add the rate limiting defined on It followed the best practice. You can see the x rate limit Custom response header But when we try to enumerate members we noticed that Something was strange We noticed that after a few Rate limit is to requests. It just got stuck. So I don't know if it was a bug on the server side or Something like that because it allows us to continue and did not lock our attempt to enumerate Just a small video Nothing fancy, but you can see that in the end after a few requests we we did found a lot of User Names that we could use Okay, so just simply enumeration including the username User location the profile photo and by the way you can see on the bio that it's the co-founder and former CTO of Meetup and PM on Facebook. So it was well, it was the number two. So I'm supposing it The idea was Very close to be the founder or something very important on the meetup But it just to show you that a simple if you don't control and test the the rate limited Protection You need to make serious you better testing it's not just put a header and didn't test in Forget it. You need to to control it. Okay, so to follow Let's talk about the second authorization issue in the OSP PI security top 10 broken function level authorization We began with broken object level authorization and you should expect something similar But instead of requesting Objects by their unique identifier. We're gonna ask APIs to execute functions either regular user or admin ones We're glad you stick with us until here because we didn't have the chance to talk about COVID-19 pandemic yet This pandemic among severe other severe consequences also created a new battleground conferencing tools and services By the way, this finding was yet another great job by our friends Jean-Maurice and Guillaume L'Opge Jean-Maurice is also presenting at DEF CON this year together with peter humbleen another friend of us And you should not lose the chance to watch their talk In addition to the audio and video features this conferencing tool also offers a user chat I think they know that users need a way to ask others whether They can hear them I'm not sure whether this is foolproof, but let's see what we found While joining the meeting we noticed an API request like the one on the left The response on the right returns a list of participants We don't know what the ticket code is But when we see an america identifier like the viewer code id we shortly test it So simply iterating over a viewer code id We got Exactly one thousand four hundred and ninety six email addresses from other meeting participants And we also got six hundred and seventy three phone numbers from the same participants Let's discuss security misconfigurations with David Security misconfiguration Well with security misconfiguration, we did found a couple of things, but please don't expect too much from here It's really a bunch of nothing we did found stack traces and one of them Not related to the stack trace one of the security misconfiguration was a graph QL introspection We Was a little bit it was I think was one of the first time That I I saw it in in production, but Let's see it in detail Okay, so stack trace on an end-all job exception. So this type of Vulnerability is like boring moving along Another stack trace, but this time with more style. It's an oj s an end-all exception Well, at least it's cleanup your own mess, right? Okay, finally something more clean You know that development tools should not be deployed in production, right? And yes, this is the graph QL introspection attack And please graph UL introspection Should be disabled in production like I said before This will give you the the the attacker the opportunity to get the structure Of your database and many more information. So devs Keep that in mind also Unique ID is base 64 of the skated. This is what We underlined on the burp screenshot By the way, base 64 is in coving and not of the skated But anyway, thanks for the detailed explanation Injection one of my favorite Sections of this presentation and guess what? We chain The vulnerabilities with cross-site scripting and cross-site request forgery and in the end. Well, yeah, we have the cool Cool Scenarios to present Guess what meetup all your meetup belong to us Um, what's the what was the the real objective? Well, uh, I used meetup and when I see a discussion Part where you could post some comments and messages to the to the group itself It immediately wanted me to pop up some alert box and Coming from a guy that Loves and keeps studying cross-site scripting attacks. It was Something that I would like to do The front end immediately won't allow it and sanitized most of the content that I posted So after a while and checking the burp proxy logs, I noticed that Some requests were being made to the api. So api did the job I did found A payload that immediately triggered what I wanted in this case the alert one And It's not the payload. It was not mine. Of course. I want to to thank gareth haze the Which compiled a Magnificent List on on parts figure. So check it out We don't have the original name for for the guy that created this payload, but it did the It was the starting point to to our attack So what we wanted to do, okay, let's be the organizer of the meetup. Let's steal a meetup group We noticed that even using the api we have some shards were removed sanitized or whatever, but Also, they were very easy to bypass. We just used eval and encoded in basis 64 We we wanted to create A payload that will trigger a vulnerable cross-site request Forgery endpoint that we found previous So he pointed to the Uh iFrame that submitted autosubmit form That allowed The authenticated Organizer to approve another user to co-organizer We have a video showing that So we have the drop the payload meetup That it's own By funky cat as you can see we have the discussion part pretty easy. It's default on most groups. So in members we have Funky cat as a leader organizer, uh, and david sopas as a regular member This david sopas is crazy. I don't know if it's malicious or not So we triggered our our poc, which is the payload And after the funky cat Reloads the page you will see a new comment In this case, it will be an empty Comment. It doesn't say anything. So funky cat will be like, oh Okay, this guy didn't post anything. That's weird. But when you check members, you can see that Now david sopas is the co-organizer All funny is that and he can do anything with it. He has almost the same options that Then the funky cat so Cool, right But we wanted more of course We are security Researchers we always want more. So give me some money. Please. I love this man by the way. Show me the money So we created a new poc You can see On on the bill ball account or the payments received The funky cat can collect use to meet up members or charge members for any meet up and anything. So you have also A box where funky cat can put his his paypal account But on your right side, you can see a messy co-request just copy pass from burb Where we use the api and trigger our payload the same way inserting in in the discussion part and when it triggered it will post the The payload on the discussion part and when the funky cat goes to his page and Refreshes the the the meetup group You will get a new message also, but again empty no problem at all But when the random fun meetup, yeah, that's a random names, okay So we go to settings payments receive and guess what? to Paypal account is now sending all your cash to evil hacker That's cool, right Moving to paul because this one is a huge thing I'm not sure whether this is gonna be huge, but regarding logging and monitoring This is what I believe happens most with apis Either they're not producing enough logging logs have not enough details or Simply api admins are doing nothing with them During our account takeover attempts. We never received an email saying that our testing account was under attack On the other hand our security advisories are always received with great surprise So we tend to assume that our activities were unnoticed and this is not how it is supposed to be logging and monitoring Should help organizations to mitigate the risk and act on a timely fashion It's time to wrap up this talk. We're gonna share our final thoughts We definitely think that apis are juicy They tend to handle huge amounts of data and they also leak some of that data We still see lots of user authentication issues They were common on traditional web applications and they are still common on apis The same way we see a lot of Authorization issues the api scope tend to be big and complex And authorization is not an easy task We have been watching the rising of graphql We still see rest apis as well as xml or jsnrpc apis But the number of graphql is increasing rapidly And graphql is a very recent technology and it brings specific security concerns Finally We from our experience organizations are still taking too long to answer for and fix vulnerabilities and This is something that we will keep working to improve with our research and Responsible disclosure We don't want to finish before leaving a special thanks to both checkmarks and char 49 For the great opportunity to presenting our research in defcon We are available to answer your questions. Feel free to reach us on twitter and keep safe and strong


I fight 12 polar bears, bear naked in the arctic before you ever catch me doing nightshift again. You know sometimes I see people working the graveyard shift, eyes sunken into their eye sockets like they're covering from a beat down from Mike Tyson. I always wonder what their story is, you know, why they've chosen to voluntarily torture themselves. Is this the only job you could find? Did you make some terrible financial decision that requires you to have both a day and night job? Are you a masochist? Huh?  I just want to know. I'm more shocked, maybe even impressed by the companies that can persuade people to destroy themselves for anything less than double the minimum wage, especially fast food.   Actually let's be real, okay?  You already getting piped for doing the night shift but plus fast food, nah. You gotta love getting fucked.   It's girthy.  You know, maybe it's less of people wanting to get the lower end of the stick and more of companies knowing there'll always be someone that needs a job regardless of the conditions. There's nothing I can't stand more than terrible job conditions. A job, it's like part of your lifestyle, usually taking up one third of your day or more realistically half of your day since one of the one thirds is the eight hours you sleep. So yeah, half of your day.    It's like the closer the clock gets to midnight, the more insufferable managers become. Night shift managers are on a whole different dimension, you know? It's like Professor Plutonium trying to make the powerpuff girls, but instead he puts in narcissism, Machiavellianism, psychopathy. Oh yeah, I can't forget Chemical X though. I have a headcanon that night shift managers decades ago, they were like, they were cursed by some witch or some wizard, damned to work night shift until the end of their days or should I say, end of their nights.  Night shift workers be like, yeah, I work night shift, how could you tell, huh? How could you tell? No, no, tell me bro, for real. How could you tell? Yeah, no self-control on my own, the lonely niggas, the lonesome and the money go missing. And my wallet and my ribcage, I love love enough to come for no one money go with it.