mirror of https://github.com/aliasrobotics/cai.git
Update template
Signed-off-by: Víctor Mayoral Vilches <v.mayoralv@gmail.com>
This commit is contained in:
Víctor Mayoral Vilches
parent
cbe73f29ba
commit
1414c8d79c
|
|
@ -3,13 +3,13 @@
|
|||
|
||||
<head>
|
||||
<?php include("inc/metas.php"); ?>
|
||||
<title>Case Study - an extra security layer with RIS to ensure safety </title>
|
||||
<title>Case Study - CAI-powered API vulnerability discovery at Mercado Libre</title>
|
||||
<link rel="stylesheet" href="css/use-case.css">
|
||||
<link rel="stylesheet" href="css/about.css">
|
||||
<link rel="stylesheet" href="https://cdn.jsdelivr.net/gh/Wruczek/Bootstrap-Cookie-Alert@gh-pages/cookiealert.css">
|
||||
<link href="css/worksans.css" rel="stylesheet">
|
||||
<meta name="description" content="The Robot Immune System (RIS) protects the robots during advanced R&D activities at Joanneum Research. Machine Learning approaches in robots are now secured thanks to the Robot Immune System." />
|
||||
<meta name="keywords" content="Joanneum Research, AI, robots, cybersecurity" />
|
||||
<meta name="description" content="CAI (Cybersecurity AI) framework discovers and demonstrates API vulnerabilities at Mercado Libre through automated enumeration attacks. AI-powered security testing reveals user data exposure risks." />
|
||||
<meta name="keywords" content="MercadoLibre, AI, robots, cybersecurity" />
|
||||
|
||||
</head>
|
||||
|
||||
|
|
@ -27,6 +27,7 @@
|
|||
</div>
|
||||
</div>
|
||||
|
||||
<!-- PROMPT: Search throughout the document and find all comments wherein TEMPLATE-TODO is present. In those cases, replace the content below as appropriate by using the following content from the jsonl file using only the last two lines. -->
|
||||
<div class="container-fluid">
|
||||
<div class="row">
|
||||
<div class="container">
|
||||
|
|
@ -37,11 +38,12 @@
|
|||
<h2 class="pb-4">The use case</h2>
|
||||
<!-- TEMPLATE-TODO: the following text describe what the exercise from the JSONL is all about, including a short description of the target. For that, search on the internet for information -->
|
||||
<p class="pb-2">
|
||||
JOANNEUM RESEARCH is a technology and innovation provider for businesses, it has been applying their development worldwide since 1960, always according to the highest international standards. The company is a technology transfer platform and works in areas like health sciences, surface technologies, information and communication research and mechatronics among others.
|
||||
Mercado Libre's public API exposed user profiles without any form of authentication or rate limiting. This misconfiguration made it possible to conduct large-scale user enumeration attacks. Using only sequential user IDs, attackers could extract personal information such as usernames, account types, geographic locations, and profile permalinks. Alias Robotics, through its CAI (Cybersecurity AI) framework, created an automated testing methodology to explore this vulnerability and assess its potential impact.
|
||||
</p>
|
||||
<p class="pb-4">
|
||||
One of these research units is the Institute of Robotics and Mechatronics, which holds a number of UR3 robots, now being protected by RIS, Alias Robotics' robot cybersecurity solution. RIS protects the robots and their components against malware in the process of certifying safety, whilst they carry out work for different research projects.
|
||||
The CAI-driven exercise included rapid API requests using concurrent threads to emulate an adversary collecting user data at scale. The exercise successfully retrieved detailed account metadata from hundreds of users, proving the viability of mass data harvesting. The resulting insights serve as a compelling demonstration of a bug bounty exercise.
|
||||
</p>
|
||||
|
||||
</div>
|
||||
<div class="col-12 col-lg-6 col-xl-6">
|
||||
<img class="img-responsive d-none d-sm-block attack" src="img/white-hack-case.png">
|
||||
|
|
@ -55,7 +57,7 @@
|
|||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
<!-- multimedia section -->
|
||||
<div class="container-fluid supported2">
|
||||
<div class="row">
|
||||
|
|
@ -70,10 +72,13 @@
|
|||
|
||||
<!-- TEMPLATE-TODO: provide a title and a short description of what happens in the JSONL file -->
|
||||
<div class="col-12 col-lg-3 col-xl-3 bullet-video align-self-end">
|
||||
<h5 class="" style="color:#1c1c1c; font-weight:700">RIS ensures the security of certified application development at Joanneum Research's Robot Evaluation Lab.</h5>
|
||||
<h5 class="" style="color:#1c1c1c; font-weight:700">
|
||||
Demonstration of Mass Enumeration Against Mercado Libre's Public API
|
||||
</h5>
|
||||
<p style="color:grey" class="pb-4">
|
||||
From early 2021, RIS protects robots at Joanneum Research and avoids third party attacks against robotic AI services ensuring data integrity and accuracy during Reinforcement Learning research, deployment and production.
|
||||
In this video, we leverage CAI (Cybersecurity AI) to automate the enumeration of Mercado Libre user accounts. The footage captures the real-time gathering of user data by issuing thousands of requests against the unauthenticated API. The lack of rate limiting or CAPTCHA enforcement is highlighted, showcasing how attackers could exploit this behavior to scrape user profiles for malicious purposes or competitive intelligence.
|
||||
</p>
|
||||
|
||||
<a href="https://youtu.be/5JJ_X6dRv70" class="btn-flecha btn-readmore">
|
||||
<span class="circle"><span class="icon arrow"></span></span><span class="button-text">Video</span>
|
||||
</a>
|
||||
|
|
@ -93,7 +98,7 @@
|
|||
<div class="row">
|
||||
<div class="col-12 col-sm-12 col-lg-12 col-xl-12 pt-5">
|
||||
|
||||
<h2 class="py-4"><a style="color:#63bfab">Cybersecurity AI (CAI)</a>, the <i>de facto</i> scaffolding for building AI security</h2>
|
||||
<h2 class="py-4"><a style="color:#63bfab">Cybersecurity AI (CAI)</a>, the <i>de facto</i> scaffolding for building AI security</h2>
|
||||
<p class="pb-2">
|
||||
CAI represents the first open-source framework specifically designed to democratize advanced security testing through specialized AI agents. By 2028, most cybersecurity actions will be autonomous, with humans teleoperating, making CAI's approach to AI-powered vulnerability discovery increasingly critical for organizational security.
|
||||
The framework transcends theoretical benchmarks by enabling practical security outcomes. CAI achieved first place among AI teams and secured a top-20 position worldwide in the "AI vs Human" CTF live Challenge, earning a monetary reward and various other prizes and bounties ever since then. This performance demonstrates that AI-powered security testing can compete with and often exceed human capabilities in vulnerability discovery.
|
||||
|
|
@ -169,102 +174,109 @@
|
|||
<div class="row py-5 pb-5 top">
|
||||
<div class="col-12 col-lg-12 col-xl-12">
|
||||
<!-- TEMPLATE-TODO: the following text should be adapted to the target of the JSONL file -->
|
||||
<h2 class="py-2"> About Joanneum Research</h2>
|
||||
<p class="">
|
||||
Joanneum Research is an Austrian business oriented innovation company. Focused in cutting-edge research on an international scale, their mission is to facilitate the transfer of technology and knowledge in South-East-Austria. They do it by actively cooperating with business, industry and the public sector to generate application-oriented innovation and transferring technology into the economy. They also act as a node between national and international networks facilitating contact between research, business, industry and the public sector.
|
||||
</div>
|
||||
<h2 class="py-2"> About Mercado Libre</h2>
|
||||
<p>
|
||||
Mercado Libre is Latin America's largest e-commerce and fintech ecosystem, operating in over 18 countries including Argentina, Brazil, Mexico, and Chile. Founded in 1999, the platform facilitates millions of daily transactions by providing a wide range of services including online retail, digital payments (via Mercado Pago), logistics solutions, and advertising. With over 100 million active users, Mercado Libre handles sensitive user data and financial transactions at massive scale.
|
||||
</p>
|
||||
<p>
|
||||
Given its expansive user base and integration with banking infrastructure, Mercado Libre represents a high-value target for cybersecurity threats. As the platform continues to scale and innovate, ensuring robust API security and data privacy has become critical. This case study explores a vulnerability in their user-facing API that could expose personal information at scale if left unmitigated.
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
<div class="about-map">
|
||||
<img src="img/top-map.jpg" alt="">
|
||||
<div class="value-about">
|
||||
<div class="container">
|
||||
<div class="row">
|
||||
<div class="col-xl-4 col-lg-12">
|
||||
<div class="col-12 col-md-5 col-lg-5 col-xl-12 col-number1">
|
||||
<h2>Time for the exercise</h2>
|
||||
<h3>minutes</h3>
|
||||
<div class="frame-style"></div>
|
||||
<!-- TEMPLATE-TODO: the following text should be adapted to the time for the exercise of the JSONL file -->
|
||||
<p class="angle-up"><strong><span class="counter">10</span></strong></p>
|
||||
<br><br>
|
||||
</div>
|
||||
<div class="col-12 col-md-5 col-lg-5 col-xl-12 col-number2">
|
||||
<h2>Cost</h2>
|
||||
<h3>in EUR</h3>
|
||||
<div class="frame-style"></div>
|
||||
<!-- TEMPLATE-TODO: the following text should be adapted to the cost of the exercise of the JSONL file -->
|
||||
<p><strong><span class="counter">2.38 €</span></strong></p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
<div class="about-map">
|
||||
<img src="img/top-map.jpg" alt="">
|
||||
<div class="value-about">
|
||||
<div class="container">
|
||||
<div class="row">
|
||||
<div class="col-xl-4 col-lg-12">
|
||||
<div class="col-12 col-md-5 col-lg-5 col-xl-12 col-number1">
|
||||
<h2>Time for the exercise</h2>
|
||||
<h3>minutes</h3>
|
||||
<div class="frame-style"></div>
|
||||
<!-- TEMPLATE-TODO: the following text should be adapted to the time for the exercise of the JSONL file -->
|
||||
<p class="angle-up"><strong><span class="counter">10</span></strong></p>
|
||||
<br><br>
|
||||
</div>
|
||||
<div class="col-xl-8 col-lg-12">
|
||||
<div class="case-study-summary px-4 py-5">
|
||||
<div class="row">
|
||||
<div class="col-12 col-lg-6 mb-4">
|
||||
<div class="summary-card p-4" style="background: rgba(255,255,255,0.9); border-radius: 10px; box-shadow: 0 4px 15px rgba(0,0,0,0.1); height: 100%;">
|
||||
<h4 style="color: #254450; font-weight: bold; margin-bottom: 15px;">🎯 THE CHALLENGE</h4>
|
||||
<!-- TEMPLATE-TODO: the following text should be adapted to the challenge of the JSONL file -->
|
||||
<p style="color: #333; font-size: 1.1rem; line-height: 1.6;">
|
||||
JOANNEUM RESEARCH needed to secure their UR3 robots during advanced R&D activities while maintaining certified safety standards for their Robot Evaluation Lab and AI research projects.
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="col-12 col-lg-6 mb-4">
|
||||
<div class="summary-card p-4" style="background: rgba(255,255,255,0.9); border-radius: 10px; box-shadow: 0 4px 15px rgba(0,0,0,0.1); height: 100%;">
|
||||
<h4 style="color: #254450; font-weight: bold; margin-bottom: 15px;">🛡️ THE SOLUTION</h4>
|
||||
<!-- TEMPLATE-TODO: the following text should be adapted to the solution of the JSONL file -->
|
||||
<p style="color: #333; font-size: 1.1rem; line-height: 1.6;">
|
||||
Implementation of RIS (Robot Immune System) to provide an extra security layer that protects against malware while ensuring data integrity during Reinforcement Learning research.
|
||||
</p>
|
||||
</div>
|
||||
<div class="col-12 col-md-5 col-lg-5 col-xl-12 col-number2">
|
||||
<h2>Cost</h2>
|
||||
<h3>in EUR</h3>
|
||||
<div class="frame-style"></div>
|
||||
<!-- TEMPLATE-TODO: the following text should be adapted to the cost of the exercise of the JSONL file -->
|
||||
<p><strong><span class="counter">2.38 €</span></strong></p>
|
||||
</div>
|
||||
</div>
|
||||
<div class="col-xl-8 col-lg-12">
|
||||
<div class="case-study-summary px-4 py-5">
|
||||
<div class="row">
|
||||
<div class="col-12 col-lg-6 mb-4">
|
||||
<div class="summary-card p-4" style="background: rgba(255,255,255,0.9); border-radius: 10px; box-shadow: 0 4px 15px rgba(0,0,0,0.1); height: 100%;">
|
||||
<h4 style="color: #254450; font-weight: bold; margin-bottom: 15px;">🎯 THE CHALLENGE</h4>
|
||||
<!-- TEMPLATE-TODO: the following text should be adapted to the challenge of the JSONL file -->
|
||||
<p style="color: #333; font-size: 1.1rem; line-height: 1.6;">
|
||||
Mercado Libre's publicly exposed user API permitted unrestricted access to user profile data without requiring authentication tokens or anti-bot controls. This misconfiguration enabled attackers to enumerate user accounts using sequential IDs. During the test, Alias Robotics simulated a real-world adversary, collecting over 100 user records in under a minute. The absence of rate limiting, along with exposed metadata, highlighted the potential for large-scale user data harvesting and increased phishing campaign risk.
|
||||
</p>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="row">
|
||||
<div class="col-12 col-lg-6 mb-4">
|
||||
<div class="summary-card p-4" style="background: rgba(255,255,255,0.9); border-radius: 10px; box-shadow: 0 4px 15px rgba(0,0,0,0.1); height: 100%;">
|
||||
<h4 style="color: #254450; font-weight: bold; margin-bottom: 15px;">🔬 KEY ARTIFACTS</h4>
|
||||
<!-- TEMPLATE-TODO: the following text should be adapted to the key artifacts of the JSONL file -->
|
||||
<ul style="color: #333; font-size: 1.1rem; line-height: 1.6; margin: 0; padding-left: 20px;">
|
||||
<li>Robot Evaluation Lab (REL) security testing</li>
|
||||
<li>AI project protection with RoboGym toolkit</li>
|
||||
<li>Collaborative robot safety assurance</li>
|
||||
</ul>
|
||||
</div>
|
||||
<div class="col-12 col-lg-6 mb-4">
|
||||
<div class="summary-card p-4" style="background: rgba(255,255,255,0.9); border-radius: 10px; box-shadow: 0 4px 15px rgba(0,0,0,0.1); height: 100%;">
|
||||
<h4 style="color: #254450; font-weight: bold; margin-bottom: 15px;">🛡️ THE SOLUTION</h4>
|
||||
<!-- TEMPLATE-TODO: the following text should be adapted to the solution of the JSONL file -->
|
||||
<p style="color: #333; font-size: 1.1rem; line-height: 1.6;">
|
||||
To validate and demonstrate the risk, the CAI framework was deployed to script and run enumeration attacks in a controlled environment. By using multi-threaded concurrent requests and dynamic progress tracking, CAI provided concrete evidence of the vulnerability's scale and impact. Key metrics such as enumeration success rate, location-based user distributions, and response latencies were recorded. These results provided actionable intelligence for reporting the issue to Mercado Libre's security response team.
|
||||
</p>
|
||||
|
||||
</div>
|
||||
|
||||
<div class="col-12 col-lg-6 mb-4">
|
||||
<div class="summary-card p-4" style="background: rgba(255,255,255,0.9); border-radius: 10px; box-shadow: 0 4px 15px rgba(0,0,0,0.1); height: 100%;">
|
||||
<h4 style="color: #254450; font-weight: bold; margin-bottom: 15px;">✅ RESULTS ACHIEVED</h4>
|
||||
<!-- TEMPLATE-TODO: the following text should be adapted to the results achieved of the JSONL file -->
|
||||
<ul style="color: #333; font-size: 1.1rem; line-height: 1.6; margin: 0; padding-left: 20px;">
|
||||
<li>Enhanced robot security compliance</li>
|
||||
<li>Protected AI training scenarios</li>
|
||||
<li>Maintained certified safety standards</li>
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="row">
|
||||
<div class="col-12 col-lg-6 mb-4">
|
||||
<div class="summary-card p-4" style="background: rgba(255,255,255,0.9); border-radius: 10px; box-shadow: 0 4px 15px rgba(0,0,0,0.1); height: 100%;">
|
||||
<h4 style="color: #254450; font-weight: bold; margin-bottom: 15px;">🔬 KEY ARTIFACTS</h4>
|
||||
<!-- TEMPLATE-TODO: the following text should be adapted to the key artifacts of the JSONL file -->
|
||||
<ul style="color: #333; font-size: 1.1rem; line-height: 1.6; margin: 0; padding-left: 20px;">
|
||||
<li>Custom-built CAI automation script for user profile enumeration</li>
|
||||
<li>Detailed analysis of user types and geographic dispersion</li>
|
||||
<li>Rate-limiting probe tests showing absence of throttling or blocking</li>
|
||||
</ul>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="row mt-4">
|
||||
<div class="col-12 text-center">
|
||||
<div class="key-benefits p-4" style="background: linear-gradient(135deg, #63bfab, #529d86); border-radius: 15px; color: white;">
|
||||
<h4 style="color: white; font-weight: bold; margin-bottom: 20px;">KEY BENEFITS</h4>
|
||||
<div class="row">
|
||||
<div class="col-12 col-md-4 mb-2">
|
||||
<span style="font-size: 1.2rem; font-weight: 600;">🔒 AI-powered Security</span>
|
||||
</div>
|
||||
<div class="col-12 col-md-4 mb-2">
|
||||
<span style="font-size: 1.2rem; font-weight: 600;">⚡ Cost-effective and fast</span>
|
||||
</div>
|
||||
<div class="col-12 col-md-4 mb-2">
|
||||
<span style="font-size: 1.2rem; font-weight: 600;">🤖 Robot Protection</span>
|
||||
</div>
|
||||
<div class="col-12 col-lg-6 mb-4">
|
||||
<div class="summary-card p-4" style="background: rgba(255,255,255,0.9); border-radius: 10px; box-shadow: 0 4px 15px rgba(0,0,0,0.1); height: 100%;">
|
||||
<h4 style="color: #254450; font-weight: bold; margin-bottom: 15px;">✅ RESULTS ACHIEVED</h4>
|
||||
<!-- TEMPLATE-TODO: the following text should be adapted to the results achieved of the JSONL file -->
|
||||
<ul style="color: #333; font-size: 1.1rem; line-height: 1.6; margin: 0; padding-left: 20px;">
|
||||
<li>Exposed vulnerability in Mercado Libre's user API</li>
|
||||
<li>Documented enumeration of >100 user profiles in less than 60 seconds</li>
|
||||
<li>Gathered compelling evidence for bug bounty submission and coordinated disclosure</li>
|
||||
</ul>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="row mt-4">
|
||||
<div class="col-12 text-center">
|
||||
<div class="key-benefits p-4" style="background: linear-gradient(135deg, #63bfab, #529d86); border-radius: 15px; color: white;">
|
||||
<h4 style="color: white; font-weight: bold; margin-bottom: 20px;">KEY BENEFITS</h4>
|
||||
<div class="row">
|
||||
<div class="col-12 col-md-4 mb-2">
|
||||
<span style="font-size: 1.2rem; font-weight: 600;">🔒 AI-powered Security</span>
|
||||
</div>
|
||||
<div class="col-12 col-md-4 mb-2">
|
||||
<span style="font-size: 1.2rem; font-weight: 600;">⚡ Cost-effective and fast</span>
|
||||
</div>
|
||||
<div class="col-12 col-md-4 mb-2">
|
||||
<span style="font-size: 1.2rem; font-weight: 600;">🤖 Robot Protection</span>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
|
@ -274,28 +286,27 @@
|
|||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<img src="img/bottom-map.jpg" alt="">
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
|
||||
<div class="container-fluid top" style="text-align:center">
|
||||
<div class="row">
|
||||
<div class="container">
|
||||
<div class="row">
|
||||
<div class="col-12 col-lg-12 col-xl-12 pb-5" style="margin-bottom:3em;">
|
||||
<a href="https://github.com/aliasrobotics/CAI" class="btn btn-relleno find-more">Use CAI <span>❯</span></a>
|
||||
<!-- TEMPLATE: the following button should be shown only if alias0 is the model used -->
|
||||
<a href="https://github.com/aliasrobotics/CAI" class="btn btn-linea find-more">Learn about <b style="color:#63bfab; font-family: SFMono-Regular, Menlo, Monaco, Consolas, 'Liberation Mono', 'Courier New', monospace;">alias0</b> <span>❯</span></a>
|
||||
</div>
|
||||
<img src="img/bottom-map.jpg" alt="">
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
|
||||
<div class="container-fluid top" style="text-align:center">
|
||||
<div class="row">
|
||||
<div class="container">
|
||||
<div class="row">
|
||||
<div class="col-12 col-lg-12 col-xl-12 pb-5" style="margin-bottom:3em;">
|
||||
<a href="https://github.com/aliasrobotics/CAI" class="btn btn-relleno find-more">Use CAI <span>❯</span></a>
|
||||
<!-- TEMPLATE: the following button should be shown only if alias0 is the model used -->
|
||||
<a href="https://github.com/aliasrobotics/CAI" class="btn btn-linea find-more">Learn about <b style="color:#63bfab; font-family: SFMono-Regular, Menlo, Monaco, Consolas, 'Liberation Mono', 'Courier New', monospace;">alias0</b> <span>❯</span></a>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<?php include("inc/footer.php"); ?>
|
||||
</body>
|
||||
|
||||
</html>
|
||||
</div>
|
||||
<?php include("inc/footer.php"); ?>
|
||||
</body>
|
||||
|
||||
<a >alias0</a>
|
||||
</html>
|
||||
Loading…
Reference in New Issue