Tag: llm

Vibe coding: supply chain insights

My day job requires me to deal more with non-technical stuff and it is pretty interesting to see the change that is currently happening with the introduction of AI. So I decided to play around with some vibe coding and well the desire to also take vertex synapse for a spin.

I was mostly curious about how easy it could be to maintain an API for insights into the supply chain of a government. This is by no means complete, but it allowed me the chance to further experiment with vibe coding as well as the hypergraph solution from Vertex.

This blog is mainly about how easy it is nowadays to go from idea to proof-of-concept.

You might be wondering why I chose the government, well mostly cause they are IMHO more transparent with their data and insights. This is also one of those ideas that could be managed and maintained by the national entity for cybersecurity. Would be pretty cool if all kind of entities in a country would be incentivised to provide data and receive the opportunity to query their supply chain risk. This could also be used by threat actors, but they can do that now anyhow.

The idea is pretty simple, can we create a graph of how companies interact with each other in terms of being subsidiaries, vendors etc. Can we then add software to it, to understand which software is being shared amongst companies? The more detail that we add to this graph the more accurate you’d be able to determine the impact of a supply chain attack on an organisational level.

Vibe coding made it very easy to create a proof-of-concept, mind you this is not production worthy. Then again that wasn’t the goal since I mainly wanted to validate if the idea would provide insights.

You can find the code for this experiment here. I’ve also attempted to create an AI friendly start here if you want to make it yourself fully from scratch.

The overall web application looks like this:

The web application offers exploring the Vertex Data Model as well as manually entering organisational data and then analysing that data. The loading of the data happens with external scripts. For now I’ve only inserted a limited data set:

That’s the nice thing about government transparency, you can investigate stuff and well help them out if you so desire. Based on that overview of websites you can then:

  • Resolve all the domains to IPs
  • Understand the relationship between the different government entities
  • Analyse the websites for software used

This does not fully cover the supply chain risk, if you want to improve the data set you can use the new government code environment:

Go through all repositories link them to the right government entities and update the software used. Bonus, if they have generated SBOMs you can improve the accuracy of your data set and thus your analysis.

Since the Dutch NCSC is pretty awesome, I’m gonna use them as an example in this vibe coded application and some analysis snippets. Let’s start the organisation view:

This image provides us with a small overview of domains, parent organisation etc.

Sometime a table is just clearer, even though I am a big fan of graphs. We can also quickly view the software used by the NCSC, how many other organisations also use it?

Nothing scary, but does provide interesting insights, we can zoom in on the specific URLs and organisations that for example use react:

The graph based exploration is of course a must have :p

Lastly, let’s say we want to hack some CMS system and understand what our impact would be, this would be an interesting view to look further into:

Playing with the LANL ARCS Data Sets

The Los Alamos National Laboratory (LANL) has the Advanced Research in Cyber Systems (ARCS) group that provides an intereting data set for cybersecurity purposes.

Since cybersecurity datasets are difficult to come by, I decided to play a bit with this dataset. No particular purpose in mind besides just playing and maybe exploring some different technologies (duckdb, neo4j, llm). Basically a memo to self in playing with data sets.

The page from LANL provides a very nice overview per data set, including example data. This blog will focus on the Comprehensive, Multi-Source Cyber-Security Events data set.

Main take aways for me were:

Just throwing data together gets you nowhere.
Still lotsa fun to play with all kinds of technology
Maybe duckdb isn’t that bad of a format to exchange data

Continue reading “Playing with the LANL ARCS Data Sets”

Recon your patents with GenAI?

I recently came across MindYourPass.io and my curiosity was triggered on how it worked. So I read the website which sounded intruiging, but did not seem to contain a lot of nitty gritty technical details. The website does mention that the solution is based on patented technology.

Now this sounds like a nice opportunity to brush op on potential legal-speak as well as understanding a software solution by reading instead of going down the technical route. As an added bonus, we can take one of those fancy GenAI things for a spin and see if it helps to quickly digest patent text.

Do note that since a patent walks a fine line between claiming the idea and not giving away all the information, that my conclusions and interpretation may be incorrect. This risk is increased due to the use of GenAI. Which is used as an experiment to better understand the advantages or limitations of using GenAI for summarization and interpretation of patents.

After talking a bit with Gemini I was pretty amazed that it summarized the gist of the patent pretty well. I skimmed through the patent myself and without verifying all details it seems to make sense (yes I know the devil is in the details). It didn’t even take that many questions to obtain a general understanding of the key components of the patent. The following questions represent my entire conversation:

  • are you familiar with mindyourpass?
  • Do you have any sources for a whitepaper and corresponding patents?
    • yes, I would like to have a more technical summary
  • does the patent describe which factors are used exactly and in which order they are processed?
  • Would it be fair to summarize this invention as a Key Derivation Function, which retrieves the inputs from different places?
  • Can you represent the patent in a python function? Since after all, it concerns a KDF as the basis for the concept?

The code result for the last question can be seen below:

import hashlib

def calculate_mindyourpass_password(
    user_master_secret: str,     # Factor 1: The key known only by the user
    application_domain: str,     # Factor 2: Uniquely identifies the website (e.g., 'amazon.com')
    device_id_token: str,        # Factor 3: Unique key from the authorized device
    backend_static_salt: str,    # Factor 4: Key retrieved from the backend (distributed secret)
    password_policy: dict        # Factors 5/6: Formatting rules (min_len, special chars, etc.)
) -> str:
    """
    Conceptual implementation of the MindYourPass deterministic, distributed KDF.
    
    This function simulates the process described in US11947658B2:
    It takes distributed inputs, hashes them deterministically, and formats the output.
    """
    
    # --- Step 1: Combine Distributed Factors ---
    # The actual proprietary formula uses 6 factors combined in a specific, secret order.
    # We conceptually concatenate the primary inputs here.
    
    # We include the application's required length/policy to ensure the hash input 
    # changes if the requirements change (e.g., a site updates its minimum length).
    policy_str = f"len:{password_policy.get('min_length', 16)}_chars:{password_policy.get('charset_type', 'complex')}"
    
    # The factors are combined deterministically (order is crucial)
    combined_input = (
        user_master_secret + 
        application_domain + 
        device_id_token + 
        backend_static_salt + 
        policy_str
    )
    
    # Encode the input string to bytes for hashing
    input_bytes = combined_input.encode('utf-8')

    # --- Step 2: Cryptographic Hashing (SHA-512) ---
    # The patent specifies 512-bit SHA2 hashing.
    raw_hash_output = hashlib.sha512(input_bytes).hexdigest()

    # --- Step 3: Formatting & Post-Processing ---
    
    # The final password must conform to the target application's policy.
    # This example truncates and enforces a simple character set conversion.
    
    target_length = password_policy.get('min_length', 16)
    
    # Truncate and use as the deterministic password (e.g., first 16 chars)
    password = raw_hash_output[:target_length]
    
    # NOTE: The actual implementation involves sophisticated mapping 
    # to enforce capitalization and special characters dynamically. 
    # This step is highly complex in the real product.

    return password

# --- Example Usage ---

# 1. Define the distributed inputs (retrieved from different places)
USER_KEY = "MyEasyToRememberPhrase!"
SITE_ID = "MyBankingSite.com"
DEVICE_TOKEN = "ABCD-1234-EFGH-5678"  # Only this device can generate it
SERVER_SALT = "aHk57gJmT8pQ4zR"       # A distributed secret key

# 2. Define the application's policy rules
BANK_POLICY = {
    'min_length': 20,
    'charset_type': 'complex'
}

# 3. Calculate the password
derived_password = calculate_mindyourpass_password(
    USER_KEY, 
    SITE_ID, 
    DEVICE_TOKEN, 
    SERVER_SALT, 
    BANK_POLICY
)

print(f"Input: {USER_KEY}, {SITE_ID}, {SERVER_SALT[:5]}...")
print(f"Generated Password (Length {len(derived_password)}): {derived_password}")

Of course, this is an over simplification, since I’m assuming that the actual software uses more cryptography for individual steps to for example slow down potential attacks that might involve brute forcing parts of the process. However the core concepts does become pretty clear, pretty fast.

All in all, using patents as part of your reconnaissance into software was always a good idea. Now with GenAI it has become even more accessible and more important, it has become fast! You still need to manually revise the patent, to understand if GenAI makes sense, but the big picture can be obtained pretty darn fast.