Archive

Archive for December, 2022

U2FsdGVkX1 and #AES – Why you should never use #CryptoJS

If you’re googling the term “U2FsdGVkX1” then you’re looking at some Base64 encoded AES encrypted text? How do I know that, becuase it decodes to “Salted__” – It’s the default value of the first few bytes in a block cypher.

AES (Advanced Encryption Standard) is a symmetric encryption algorithm that is widely used to secure data transmitted over the internet and to store data in encrypted form. One common way to use AES is to encrypt a message with a secret key, which can then be decrypted using the same key.

The “Salted__” prefix that sometimes appears at the beginning of AES-encrypted text is related to a technique called salting, which is used to make it more difficult to attack the encrypted data.

When a message is salted, a random sequence of bits (called a salt) is generated and appended to the message before it is encrypted. The salt is then stored along with the encrypted message, so that it can be used to reconstruct the original message when it is decrypted.

The purpose of salting is to add an extra layer of security to the encryption process by making it more difficult for an attacker to use precomputed tables or other techniques to try to break the encryption. For example, if an attacker knows that a particular message is encrypted with AES, they may be able to use a precomputed table of common words and phrases to try to guess the key and decrypt the message. However, if the message has been salted, the attacker will not be able to use the same precomputed table, because the salt will have changed the encrypted message in a way that is not predictable.

The “Salted__” prefix is added to the beginning of the encrypted message to indicate that the message has been salted, and to provide a place to store the salt. The prefix is followed by the salt itself, which is typically 8 bytes (64 bits) long. The rest of the encrypted message follows the salt.

In summary, the “Salted__” prefix is added to AES-encrypted text to indicate that the message has been salted, and to store the salt used in the salting process. Salting is used to add an extra layer of security to the encryption process by making it more difficult for an attacker to use precomputed tables or other techniques to try to break the encryption.

Beyond the theory, the text U2FsdGVkX1 can indicate the cypher mechanism used, which points an attacker towards AES. AES by itelf is very secure, but implementations of it can be very weak. I would immediately point the finger at CryptoJS. If you are using this in your webpage, you have just added a speedbump to a would-be attacker, nothing more than a paperclip holding your door closed. AES is secure, but it’s symetric, so therefore the client needs to know the key in order to encrypt the data. If you share your key on the page, and your browser can read it, then so can an attacker.

In fact, CryptoJS is such a bad idea, it gives a false sense of security. Is a padlock secure, yes. Is a Padlock with the key left in it still secure? Absolutely not.

Categories: Uncategorized

Poland Vehicle License plate search now available via #API

Today, we have just launched our Vehicle License plate lookup API for poland, available here: https://www.tablicarejestracyjnaapi.pl/

The license plate lookup API for Poland is a tool that enables users to retrieve vehicle information from the Polish vehicle registry by providing the license plate number. This API allows users to access accurate and up-to-date information about vehicles registered in Poland, including details such as the make and model of the vehicle, the year it was manufactured, and the vehicle identification number (VIN).

The license plate lookup API for Poland is easy to use and can be integrated into a wide variety of applications. For example, it can be used by insurance companies to verify the details of a vehicle, or by car rental companies to ensure that the vehicles they are renting out are properly registered. Additionally, the API can be used by law enforcement agencies to quickly and easily obtain information about vehicles that may be involved in a crime.

Overall, the license plate lookup API for Poland is a valuable tool for anyone who needs to access vehicle information in Poland. It is fast, accurate, and easy to use, and can help users save time and improve the accuracy of their vehicle-related operations.

Poland support


Car registration plates in Poland use the /CheckPoland endpoint and return the following information:

  • Make / Model
  • Year
  • VIN
  • Engine Size
  • Power
  • Fuel
  • Weight
  • Region
  • Representative image

Sample Registration Number: 

EL6574U

Sample Json:

{
  "Description": "SAAB 9-3",
  "RegistrationDate": "2002-06-04",
  "RegistrationYear": 2002,
  "CarMake": {
    "CurrentTextValue": "SAAB"
  },
  "CarModel": {
    "CurrentTextValue": "9-3"
  },
  "MakeDescription": {
    "CurrentTextValue": "SAAB"
  },
  "ModelDescription": {
    "CurrentTextValue": "9-3"
  },
  "VehicleIdentificationNumber": "YS3DD55C622039715",
  "EngineSize": 1985,
  "Power": 110,
  "FuelType": "Petrol",
  "IsPlugIn": "False",
  "SteeringWheelSide": "L",
  "ManufacturingYear": 2002,
  "Mileage": 175102,
  "Weight": "1.9",
  "Region": "Łódź",
  "ImageUrl": "http://tablicarejestracyjnaapi.pl/image.aspx/@U0FBQiA5LTM="
}
Categories: Uncategorized