API Security Weekly: Issue 173

This week, we have news of the eye-opening vulnerability on the Coinbase platform which netted $250,000 in bug bounty. There’s also an excellent guide on best practices for authentication and authorization for REST APIs, an article on the growth of bad bots and how to mitigate against them, and a fun read from APIHandyman on how to hack the Elgato Key light API.

Vulnerability: Coinbase API Bug Allowed Unlimited Cryptocurrency Trading

This week’s major news story has been the disclosure of a major vulnerability in an API on Coinbase, a cryptocurrency trading platform. This vulnerability potentially allowed an attacker to make unlimited cryptocurrency trades between different currency accounts.

A Low-code Bitcoin Ticker Built With QuestDB and n8n.io

We've had many predictions of the emerging trends of 2020. Three that ended up ringing very true were the popularity of low-code platforms, the rise of time-series databases, and a digital currency boom. This tutorial combines these three topics into one example workflow automation that stores and analyzes Bitcoin market prices in QuestDB with a workflow template to get up and running quickly.

Prerequisites

This tutorial will use the docker images for both QuestDB and n8n.io, so users should ensure that they have the following installed and running on their system:

The Bitcoin Blockchain Explained

Bitcoin is the world’s first and most popular digital currency. It is decentralized and controlled by no one. How does it work, and why can you trust it? After all, if computers can copy any file, why can’t I just make copies of my bitcoins? And if it is not controlled by any one central party, what prevents me from making or forging transactions for bitcoins I don’t own? This article will explain in layman’s terms how Bitcoin works and provide information on how the technology backing Bitcoin can be used for business use cases beyond simply a digital currency.

Bitcoin works by solving three record-keeping challenges without the need for a central record keeper like a bank:

How to Build a Cryptocurrency Exchange Application and How Much It Would Cost

You probably heard of the most recent trend in the world of cryptocurrency. After all, just about everyone is “mining” these days. However, there aren’t enough GPUs to meet demand. 

Cryptocurrency is attainable even for those who aren’t tech-savvy. At some point, people discover Ethereum, Bitcoin, and Litecoin, all of which can be used just like the Euro and Dollar. Transactions are made with a cryptocurrency wallet. This form of cryptocurrency is alluring: the cost of transactions is minimal in comparison to national currencies.

Apache Kafka and Blockchain: Friends, Enemies, or Frenemies?

This blog post discusses the concepts, use cases, and architectures behind Event Streaming, Apache Kafka, Distributed Ledger (DLT), and Blockchain. A comparison of different technologies such as Confluent, AIBlockchain, Hyperledger, Ethereum, Ripple, IOTA, and Libra explores when to use Kafka, a Kafka-native blockchain, a dedicated blockchain, or Kafka in conjunction with another blockchain.

Use Cases for Secure and Tamper-Proof Data Processing With a Blockchain

Blockchain is a hype topic for many years. While many companies talk about the buzzword, it is tough to find use cases where Blockchain is the best solution. The following examples show the potential of Blockchain. Here it might make sense:

Impact of COVID-19 on Crypto and Blockchain Payments

Cryptocurrencies such as bitcoin are slowly making a transition from speculative investment instruments to payments. Special attention to payment habits and the financial life cycle as the COVID-19 pandemic leads to more calls for dematerialization of payments.

Overview

Impacts

  • Geographic location matters significantly when measuring awareness of cryptocurrencies and interest in making cryptocurrency payments for goods and services.
  • For customers, any transition from currency speculators to retail shoppers is not straightforward. 
  • And most consumers are not currency speculators. 
  • The acceptance cost for businesses will be significant, especially compared to alternative existing payment options.
  • Companies accepting cryptocurrencies as payment for goods and services may benefit from short-term public relations gains and be perceived as innovators, but the impact on payment acceptance is very likely to be short-lived.

Recommendations

Banks and investment CIOs driving financial services digital business strategy and innovation should:

Why Blockchain Is Essential to Your Test Project

Blockchain has revolutionized the way the company’s business is conducted. Today, Blockchain is more than digital currencies such as BitcoinAs per the World Economic Forum’s survey, by 2027, 10 percent of the global GDP will be dependent on Blockchain technology. The blockchain is exceptional as it removes the requirement for a middleman to physically manage actions in real-time while at the same time preventing fraud. Healthcare, supply chain, energy, etc. are verticals that present themselves to this technology splendidly.

With rising capabilities of deployment and integration, software testers must understand how to evaluate blockchain apps. These days, blockchain applications are not restricted to the financial world – its smart contract underpinning can be integrated into distinct areas like energy allocation to government services. All of the above bring several challenges that are critical to blockchain debugging. Blockchain applications differ from other types of traditional applications, requiring QA testers to approach precise needs and acceptance criteria.

Transaction Execution — Ethereum Yellow Paper Walkthrough (4/7)

In this post, we start looking into how the Ethereum platform executes transactions. We will learn transaction validity rules and why they exist. After that, we will deep-dive into transaction execution and understand the steps taken by nodes while processing a transaction.

This post is the fourth in the series Ethereum Yellow Paper Walkthrough. The goal of this series is to demystify the concepts in the paper, making it accessible to a broader audience. If you missed the previous posts, here they are!

Writing About Security [Prompts]

Ever struggle with what to write? No worries, we've got you covered. Here's a list of security prompts and article ideas to help cure even the worst cases of writer's block. So, take a moment, check out the prompts below, pick one (or more!), and get to writing.

Also, please feel free to comment on this post to bounce around ideas, ask questions, or share which prompt(s) you're working on. 

Top 5 Free Courses to Learn Blockchain Programming

Hello, all — hope you all are having a great time and are working towards your goals for this year. I have been sharing a lot of courses and tutorials recently about what to learn this year, starting from tools and frameworks to libraries and programming languages, but one of the most important technologies you can learn this year is blockchain development.

It's one of most talked about technologies at the moment and is considered to be the Next Big Thing after the invention of the Internet, as blockchain technology can provide a way to attain digital trust on via the Internet.

Blockchain Vs Tangle: Which Is Better?

Blockchain was a real technological breakthrough back in 2008. A new milestone in the world of money, security, e-commerce, and the Internet as a whole — it is literally everywhere now, and modern business utilizes it worldwide. The idea of recording the information without any ability to change it afterward was brilliant. Firstly, as you know, it was implemented in the first cryptocurrency, Bitcoin, but later, it came to banks, security providers, insurers, farmers, governments, etc.

Why were people so obsessed with the blockchain? Because this system guarantees that no one, no matter how powerful or rich this person is, can tamper with the information encoded within the public ledger. Yet, even the sun has dark spots. With time, people have realized that this system is not ideal, and there are problems to be solved. For example, the ledger gets heavier and slower with every new transaction, as the blockchain grows. Or, it cannot exist without miners, and thus — the fees are inevitable.

Another Major Crypto Exchange Breach Reminds Us NOTHING Is Unhackable

Binance, one of the world’s largest cryptocurrency exchanges, has reportedly lost around $40 million dollars worth of Bitcoin to hackers.

“Hackers were able to obtain a large number of user API keys, 2FA codes, and potentially other info,” said CEO Zhao Changpeng in a press release. “The hackers used a variety of techniques, including phishing, viruses and other attacks. We are still concluding all possible methods used. There may also be additional affected accounts that have not been identified yet.”

If Bitcoin Fails, Will Blockchain Technology Ultimately Follow?

A year ago, on December 17, 2017, Bitcoin price reached its all-time maximum — $19,783.21. Since then, it has steadily declined, just like the faith of investors in cryptocurrencies, and today, it is close to just $3,000.

Experts say this downfall is happening due to disheartening discoveries, like the one that nearly 85 percent of ICO’s in 2017 were a scam, or that more than 50 percent of Bitcoin startups stop functioning in four months after their ICOs.

Truster Vs. Trustless (Part 1): The Role of Trust in the Means of Exchange Operation

Trustless has become a rallying cry for Bitcoin evangelists, focusing public attention on the fact that Bitcoin enables P2P transactions without the participation of a trusted third party acting as an intermediary.

Bitcoin makes it possible to conduct money transfers without intermediaries — intermediaries who could, otherwise, gain control over funds in a transaction, censor transactions, or act as points of failure. Does this give grounds to assert that Bitcoin and other cryptocurrencies are a form of money that does not require trust? Is it possible to completely eliminate trust from monetary relations, and is there even a need to? This article is devoted to the study of the role of trust in monetary transactions, including cryptocurrencies, and its main conclusion is that this role is hard to overestimate.

Useful Programming Libraries to Create Your Own Cryptocurrency Wallet

Since 2009, and especially over the past few years, cryptocurrency development has become a skill in high demand. Whether you are looking to create a new currency or contribute to an existing project, creating a new user-friendly wallet is a necessary part of the process. This includes creating a front-end and a back-end to the client.

For inspiration, you should take a look at the source code of some of the top cryptocurrency wallets. If you wish to compete with what’s on the market, features like offline cold storage, paper wallet generation, or asset management would be well received.

Most Bitcoin Trades Are Fake, Study Concludes

While the price of Bitcoin has rallied quite a bit over the past month (up 36 percent to $5,243.72 as of April 8, noon EST), another recent headline is much less jubilant. According to a new study, almost 95 percent of all Bitcoin trades are actually fraudulent.

In their study, which looked at trading data across the top 81 exchanges (by volume) over four days in March, Bitwise Asset Management concluded that of the $6 billion in average daily Bitcoin trading they observed, only $273 million of this is real.