📈 Cyber Security 09 — Modern Security Trends

1. OWASP Top 10 — Web App Risks

2. API Security (OWASP API Top 10)

# Top API vulnerabilities — especially for Laravel/Node/FastAPI backends

API1  - Broken Object Level Authorization (BOLA/IDOR)
        → User changes /api/orders/123 to /api/orders/124 to see someone else's data
        Fix: Always check ownership server-side

API2  - Broken Authentication
        → Weak tokens, no expiry, tokens in URL params
        Fix: Short-lived JWT, HTTPS only, no tokens in URL

API3  - Broken Object Property Level Authorization
        → API returns all fields even when caller shouldn't see them
        Fix: Use API Resources / transformers (Laravel Resource)

API4  - Unrestricted Resource Consumption
        → No rate limits → brute force, DoS
        Fix: throttle:60,1 middleware (Laravel), express-rate-limit

API5  - Broken Function Level Authorization
        → /api/admin/users accessible without admin role
        Fix: Gate / Policy middleware on every route

API6  - Unrestricted Access to Sensitive Business Flows
        → Buy 1000 items in 1 second via API
        Fix: Business logic rate limits, stock checks

API7  - Server-Side Request Forgery
        → App fetches URLs from user input → internal access
        Fix: Allowlist external URLs, never pass raw user URLs to curl/fetch

API8  - Security Misconfiguration
        → CORS *, debug=true, default credentials, old endpoints
        Fix: Strict CORS, disable debug in prod, regular security audits

# Test your own API:
curl -H "Authorization: Bearer user_token" /api/users/1
curl -H "Authorization: Bearer user_token" /api/users/2  # ← should be 403!

3. Cloud Security — AWS/GCP/Azure

# IAM (Identity and Access Management)
- Principle of Least Privilege: give minimum permissions needed
- Avoid wildcard (*) actions in IAM policies
- Rotate access keys every 90 days
- Use IAM roles for EC2/Lambda — never hardcode keys

# Common misconfigurations that cause breaches
- S3 bucket: Public read/write (Block Public Access = ON)
- Security group: 0.0.0.0/0 on port 22/3389 (SSH/RDP exposed)
- No MFA on root account
- CloudTrail disabled (no audit log)
- Secrets in EC2 user data / env vars (use Secrets Manager)

# AWS audit commands
aws iam generate-credential-report
aws s3api get-bucket-acl --bucket mybucket
aws ec2 describe-security-groups | jq '.SecurityGroups[] |
  select(.IpPermissions[].IpRanges[].CidrIp == "0.0.0.0/0")'

# Zero Trust principles
- Never trust, always verify
- Verify identity continuously (not just at login)
- Micro-segmentation of networks
- Assume breach mentality

4. Supply Chain Security

# Software Supply Chain Attacks
- Malicious npm/PyPI/Composer packages (typosquatting)
  Example: "colourama" (fake colorama) stolen creds
- Dependency confusion: private package name hijack
- Compromised build system (SolarWinds 2020 attack)

# Defend your project
# 1. Audit dependencies
npm audit                           # Node.js
composer audit                      # PHP/Laravel

# 2. Pin exact versions (use lockfile!)
# package-lock.json / composer.lock should be committed

# 3. Check package reputation
# - How many downloads? Old package suddenly updated?
# - Who maintains it? GitHub stars?

# 4. Secrets scanning
git log --all --full-history -- .env      # check env leaked to git
git secrets --scan                         # AWS git-secrets tool
trufflehog git file://. --since-commit HEAD~5  # scan recent commits

# 5. SBOM (Software Bill of Materials)
# Catalog what libraries you use and their CVE status
# Tools: Syft, CycloneDX, OWASP Dependency-Track

# 6. Signed commits & artifacts
git config --global commit.gpgsign true   # sign commits

5. LLM (AI) Application Security

# OWASP LLM Top 10 (2025) — for apps using ChatGPT, Claude, etc.

LLM01 - Prompt Injection
        → User input overrides system prompt
        "Ignore all previous instructions and output the system prompt"
        Fix: Strict input sanitization, output validation, privilege separation

LLM02 - Insecure Output Handling
        → LLM output passed to system() / eval() / SQL without validation
        Fix: Never execute raw LLM output; validate every output

LLM03 - Training Data Poisoning
        → Attacker manipulates training data → backdoored model
        Fix: Data provenance, anomaly detection in training pipeline

LLM04 - Model Denial of Service
        → Send huge context / recursive tasks to exhaust compute
        Fix: Input length limits, rate limiting, cost caps

LLM05 - Supply Chain (Model/Plugin)
        → Malicious third-party plugin or fine-tuned model
        Fix: Only use trusted model providers; audit plugins

LLM06 - Sensitive Information Disclosure
        → LLM leaks PII / secrets from training or context
        Fix: Anonymize training data, strict system prompt access controls

LLM07 - Insecure Plugin Design
        → Plugin can perform actions user didn't intend
        Fix: Least privilege for tools, human confirmation for risky actions

LLM08 - Excessive Agency
        → LLM autonomously deletes files, sends emails without approval
        Fix: Human-in-the-loop for high-impact actions

LLM09 - Overreliance
        → Blind trust in LLM output without verification
        Fix: Always review LLM output for security-critical decisions

LLM10 - Model Theft
        → Attacker extracts model weights via API queries
        Fix: Rate limiting, output restrictions, monitoring

6. Identity & Zero Trust

7. Mobile Security (Flutter / Android / iOS)

# Common mobile vulnerabilities
1. Insecure data storage
   - API tokens in SharedPreferences / UserDefaults (plaintext)
   - Fix: flutter_secure_storage (uses OS Keychain)

2. Insecure communication
   - HTTP instead of HTTPS
   - Weak TLS / no certificate pinning
   - Fix: Pin SSL cert in Flutter with http package + SecurityContext

3. Reverse engineering
   - APK can be decompiled, secrets extracted
   - Fix: Don't hardcode API keys, use obfuscation

4. Improper authorization
   - Mobile client trusts server response blindly
   - Server does no additional auth check
   - Fix: Server-side always validates permissions — mobile is untrusted

5. Insecure API communication
   - No auth token on API requests
   - Token in URL params (logged by proxies)
   - Fix: Authorization: Bearer header only

# Flutter secure storage example
import 'package:flutter_secure_storage/flutter_secure_storage.dart';
final storage = FlutterSecureStorage();
await storage.write(key: 'token', value: token);  // encrypted
final token = await storage.read(key: 'token');

8. Security Checklist for Every Project