Monthly Archives: August 2016

Cell Phone (iPhone, Android, windows mobile), Network (Protocol, Topology & Standard)

The important thing is to never stop questioning (Albert Einstein)

870 Comments

http://img.photobucket.com/albums/v704/chanpicco/chanpicco071/sat-China_zpsfc8frkuz.jpg

The important thing is to never stop questioning, said Dr. Einstein. View the breaking news today.China has launched the world’s first quantum communications satellite into orbit. Watch TV News program noticed that a group of scientist find a way apply the quantum physics to traditional cryptography replacing RSA cryptosystem. The testing go to final stage in 2015. Competitions everywhere today including employees, business partners, countries. Life is not easy! World looks demanding now! Let’s review in short form in regards to RSA cryptosystem weakness.

RSA cryptosystem weakness:

  • The RSA cryptosystem can be very weak if you do not choose your primes carefully.
  • If the two corresponding ciphertexts are intercepted.
  • If you send the same message to more people with the same RSA encryption exponent e , then the plaintext can always be obtained easily from the intercepted ciphertexts.

Quantum Cryptography benefits:

  • Quantum entanglement – particles can share the same quantum state irrespective of their spatial distance from each other. The entanglement state discard when parameters change.
  • Quantum cryptography would be used in practice to produce one time pads that could be used to securely encrypt any message.

What is the key factors (built a quantum communications satellite):

Avoid eavesdropping – Being monitored

Cyber attack – Being attacked by hackers

Questioning about unknown factors?

In what Layer of the Earth’s Atmosphere install this satellite?

Answer: Exosphere – up to 10,000 km above the Earth

http://img.photobucket.com/albums/v704/chanpicco/chanpicco070/orbit-v4_zpsgkk97mbq.gif

Is there any external interfere to this layer? For instance, SUNSPOT & X-rays?

It was protected by atmosphere. Atoms are no longer gravitationally bound to the Earth and get knocked away by solar wind. As such, without interference caused by Sunspot suspend the network communications. (Remark: Satellite interfere by sunspot periodically. The result is that the satellite will lost electronic communications in short period of time.)

Does it compatible with mobile phone?

Yes, it is compatible with 4G mobile network and provides hack proof communication channel. I believed that it achieves independence from the use of fixed line or existing mobile networks through super fast Ka-band satellite backhaul.

The objective is that avoid eavesdropping on mobile phone. For instance, NSA tapped Angela Merkel’s mobile phone. The scandal expose to public in 2014.

Germany opens inquiry into claims NSA tapped Angela Merkel’s phone

https://www.theguardian.com/world/2014/jun/04/germany-inquiry-nsa-tapping-angela-merkel-phone

Interim summary:

The space of technology development is to infinite. But like Dr Einstein said, the important thing is to never stop questioning.

http://img.photobucket.com/albums/v704/chanpicco/chanpicco070/questioning_zpsyrbxvutm.jpg

Network (Protocol, Topology & Standard)

How to protect your IT premises? Found vulnerability sometimes isn’t a flaw.This is the original design!

42 Comments

http://img.photobucket.com/albums/v704/chanpicco/chanpicco071/SS7-ASN1-Flaw_zpslcpchclx.jpg

Preface

People might questions leonardo Da Vinci if he still alive. Why did he choose this woman became mona lisa? Since nobody could explain on behalf of him. But strongly believe that this is the original design.

Linux are everywhere today, in workstation, servers, mobile devices and IoT devices. On the other hand, the culture of modern world relies on electronic communications system. Therefore network communication protocol especially TCP/IP protocol and Signaling System 7 are the major elements in nowadays world.

Recall historical data of specific elements (quick & dirty)

1. ASN.1

Originally defined in 1984 as part of CCITT X.409:1984

Design objective:

i. Overcome how different computer systems transmit data
ii. Model parameters exchanged between application entities

 

2. Signalling System 7

It was developed in 1975

Design objective

i. SS7 controls telephone calls, both wired and wireless, through the use of a control signal that is separate from the actual voice circuit.

ii. It allows phone networks to exchange the information needed for passing calls and text messages between each other.

3. TCP/IP version 4

The first version of this predecessor of modern TCP was written in 1973

Design objective

i. A set of general design guidelines and implementations of specific networking protocols to enable computers to communicate over networks.

ii. TCP/IP provides end-to-end connectivity specifying how data should be formatted, addressed, transmitted, routed and received at the destination.

Flaws found as of today

TCP/IP version 4 (CVE-2016-5696)

The difficult part for hacker taking over TCP connection is to guess the source port of the client and the current sequence number. A group of researchers found that open a connection to the server and send with the source of the attacker as much “RST” handshake packets with the wrong sequence mixed with a few spoofed packets. By counting how much “challenge ACK” handshake packet get returned to the attacker side.  Attacker might knowing the rate limit one can infer how much of the spoofed packets resulted in a challenge ACK to the spoofed client and thus how many of the guesses where correct. This way can quickly narrow down which values of port and sequence are correct.

http://img.photobucket.com/albums/v704/chanpicco/chanpicco071/ninja-anima-ver2_zpsoonzpftm.gif

Interim solution apply to Linux environment

Linux are everywhere today, in workstation, servers, mobile devices and IoT devices. Append the following to /etc/sysctl.conf:

net.ipv4.tcp_challenge_ack_limit = 999999999

Use “sysctl -p” to activate this feature

Flaw found in ASN.1 compiler

For more details, please see below:

https://www.linkedin.com/pulse/flaw-found-communications-industry-yet-determined-1-picco

Interim solution: unavailable

Current status: The extent of the vulnerability has yet to be determined, IT folks this vulnerability looks critical. It is hard to imagine what’s the impact at this moment. We keep our eyes open see whether a remediation will be announced by the telecommunication providers?

SS7 Vulnerability

A proof of concept shown that attacker could use the telephone network to access the voice data of a mobile phone, find its location and collect other information. Hacker able to manipulating USSD commands to spoof financial transactions such as the authorization of purchases or the transfer of funds between accounts.

The hacks exploit the SS7 vulnerability by tricking the telecom network believing the attacker’s phone has the same number as the victim’s phone. We know that hackers can hijack whatsApp and telegram via ss7. A vulnerability found on 2008.

Interim solution

Mobile phone network services provider has employed security experts to perform analysis of the SS7 systems in use to try and prevent unauthorised access.

For additional information details, please refer below:

SS7 hack explained: what can you do about it?

http://img.photobucket.com/albums/v704/chanpicco/chanpicco071/OSI-vs-SS7_zpsk76izco4.gif

How to protect your IT premises in regards to above flaws?

For weakness of TCP/IP protocol, the IP version 6 able to resolve design limitation of sequence number. In the long run, it is recommend IT team get rid of IP version 4. However the truth is that v4 and v6 are mixed mode in nowadays IT world.

The most headache topics are the ANS.1 complier flaw and Signalling system 7 vulnerability. For SS7 vulnerability, since those item of works (remediation and mitigation) are relies on Telecommunication service providers. Mobile phone network services provider employing security experts to perform analysis of the SS7 systems in use to try and prevent unauthorised access. For text messages, avoiding using SMS. As far as we know, whatsapp communication is being encrypted today!

How’s the status of ASN.1 compiler right now?

About SS7 vulnerability information update:

Nokia safeguards network operations with new security features in Sep 2015. The features consisting of Signaling Guard and Security Assessment service, detects and prevents attacks that exploit vulnerabilities in the SS7 protocol. For more details. Please refer to url below:

http://company.nokia.com/en/news/press-releases/2015/09/03/nokia-networks-safeguards-network-operations-with-two-new-security-launches-networksperform

About  SS7 vulnerability incident found and reported by German newspaper media on May 2017:

German newspaper (Süddeutsche Zeitung) reported that that hackers relied on SS7 attacks flaw as a backdoor. The vulnerability allow bypass two-factor authentication (2FA) systems to conduct unauthorized wire transfers.

http://www.sueddeutsche.de/digital/it-sicherheit-schwachstelle-im-mobilfunknetz-kriminelle-hacker-raeumen-konten-leer-1.3486504

 

System

Possibility – scenario replay (implant Rootkit on BIOS causes ATM machine crazy)

676 Comments

http://img.photobucket.com/albums/v704/chanpicco/chanpicco071/ATM-incident-2016-2_zpsfsy7w6om.jpg

The troubleshooting concept ideally that bring up hypothesis boldly while prove it conscientiously and carefully. Similar concept can apply to cyber incident investigation. Found that a security vulnerability found by security researcher Christopher Domas. The Intel chips design limitation is that vulnerability exists in the Advanced Programmable Interrupt Controller (APIC), which could allow an attack against the System. The management mode (SMM) memory area used by the operating system to interface with the boot environment like BIOS, EFI, or UEFI. An attacker can exploit this vulnerability to utilize the most privileged of execution modes and potentially overwrite secure features in the boot environment. Christopher Domas exploit uses the UEFI code features to install a rootkit sucessful during his POC in Black Hat conference. From techincal point of view, this is indeed a design limitation in CPU, it looks that we are not able to using 0x06000832 memory address. Notice that a new microcode patch is going to remediate this design limitation. The hacker implant rootkit to ATM system through malware infection through CPU design bug is a possible. The remaining issue is that how to execute infection to hundreds of ATM machines. The headline news did not provide the detail, if the investigator confirm all the ATM machines are compromised. We can speculate that the malware source might hidden in their SNA server farm or internal network. The Mainframe connectivity methodology from traditional by hardware controller integrate to LU 6.2 (APPN). The Cisco network products and specifics technology DLSW (Data Link Switch) can cope with Mainframe switch major node architecture. Thereby it is hard to say that ATM machine infrastructure is running in isolate network nowadays.

For more detail about memory sinkhole attack, please refer to below URL

http://www8.hp.com/us/en/intel-processor-memory-sinkhole.html

For details about related articles, please refer to below URL for reference.

http://img.photobucket.com/albums/v704/chanpicco/chanpicco071/ATM-attack-2016_zpsfgixgzi9.jpg

Digital world – digital dinosaur attack Taiwan ATM machine (crooks stolen estimated T$70m (US $2.2m))

The most hottest cyber attack topics happened last week. Yes, a DDOS attack occurred on HSBC UK and US web portals. But the crooks jailbreak ATM machines in Taiwan looks more attractive. Sound amazing, traditional ATM machines communication link run on private network (Frame relay or ATM OC3). It is indeed real time transaction process working with back end Mainframe system. From security point of view, the media type of connection is restricted and such a way reduces the risks on cyber attack and virus infection. Recall ATM incident occured in 2009. Russian nationality hackers found the vulnerabilities on ATM vendor side (DIEBOLD). They develop malware form attack implant to ATM system DLL file (Dbddev.dll). It looks impossible that infect of the ATM machine with malicious program to steal credit card details and PINs. But the hackers looks great, they can hooks the ATM system process successfully and gain the privileges. ThisTrojans as Troj/Skimer-A.

How was today? The digital dinosaur attack Taiwan ATM machine, crooks stole an estimated T$70m (US $2.2m).

The ATM incident happened in Taiwan banking system not belongs to DIEBOLD. They were made by German manufacturer Wincor Nixdorf. The video playback shown that hackers steal the money from from ATM machines might relies on their smart phone. Sound strange! Right?

Virtual reality – Reflections:

1. Without insertion of ATM Card can draw the cash

Possible causes: ATM machine operation system from earlier generation of IBM OS/2 migrate to windows OS platform. Is there any vulnerabilities occurs on window OS side. A critical security flaw announced by Microsoft last week, a printer spooler bug causes privileges escalation or MS16-087 for short.

2. The video playback shown that hackers steal the money from from ATM machines might relies on their smart phone. 

All ATM machines will go through backbone SNA gateway connected to backend system (Mainframe). From IT architecture point of view, SNA gateway located in data center sever farm. There is possibilities encounter malware infection during windows update processes. For example, do the DNS cache poisoning to return an incorrect IP address, diverting traffic to the counterfeit web site.

3. Well known OS platform

Windows based OS platform not difficult to implant a root kit to gain the control of the system. Hacker can through many channel to achieve their goal. For example, they will find the target person and company by SCAM mail. They can jump into the internal network and compromise the system when target person (victim) fall into their trap (compromised web site).

For more details about this incident, please refer to below URL:

http://www.ibtimes.co.uk/banks-across-taiwan-high-alert-suspected-russian-criminals-use-atm-malware-steal-millions-1570185

Additional information:

Wincor-Nixdorf’s product catalog gives insight into the operating systems its ATMs currently support.

The ProCash 280 lists its compatible software as Windows XP Professional SP3, Windows POSReady 2009 and Windows 7.

Network (Protocol, Topology & Standard)

Are there any security weaknesses to 4G mobile network? Or it is trustworthy?

796 Comments

http://img.photobucket.com/albums/v704/chanpicco/chanpicco071/4G_zpsfq78cmqj.jpg

Let’s review how cellphones work? Quick & Dirty

1G – frequency-division multiple access (so called analogue cellphones)

It divide the frequency band available into little segments and let each person send and receive on a slightly different frequency.

2G – time-division multiple access (so called digital cellphones)

Phone calls were transmitted by sampling the sound of people’s voices and turning each little segment into a numeric code. As well as sharing phone calls between different frequency bands. The design concept is that giving each phone user a short “time share” of the band. The mobile telephony system splits up every calls into digital chunks and sends each chunk at a slightly different time down the same frequency channel.

3G – code-division multiple access (so called high speed digital cellphones)

The fundamental design of idea for code division multiple access are sharing the features of both TDMA and FDMA.  So a number of different callers can use the same radio frequencies at the same time. The 3G networks are a combination of IP and mobile signalling protocols (SS7).

4G – orthogonal frequency-division multiple access (so called high speed broadband cellphones)

A evolution of the three earlier generation of technologies (TDMA, FDMA, and CDMA). With OFDMA technology, signals are digitally coded, chopped into bits, and sent on separate sub-channels at different frequencies. Since signal has been coded and therefore they are not interfere with each other on the same frequency. But the 4G mobile networks are all IP based network. The 4G LTE networks typically include a number of security features that make communications secure.

4G mobile network – Is it trustworthy?

As we know hacker can hack WhatsApp and Telegram by fooling the network causes by Signalling system 7. SS7 is vulnerable since 2008. Mobile phone network services provider has employed security experts to perform analysis of the SS7 systems in use to try and prevent unauthorised access. In the long run, SS7 might going to obsolete in future because of modern technology fast growing trend. The 3G networks are a combination of IP and mobile signalling protocols (SS7). From cellphones users assurance view point, it is better to migrate their services to 4G mobile network instead of 3G.

Just how secure is 4G?

With 4G technology, encryption is only mandatory over the main Radio Access Network (RAN). The traditional crypto and side-channel attacks, 4G security features are able to addressed. The out of band management on 4G network has security considerations. Since the ‘backhaul’ portion of the network is unencrypted by default. For those company integrate their IT infrastructure to 4G network, they must setup a site to site VPN tunnel (IPsec) connect to other side end point. The primary weakness in 4G security is that its use of cryptography does not provide end-to-end security. It only encrypts the traffic between the phone and the base station, but there is no encryption while the data is communicated over the wired network. This means that there is no security against a malicious or compromised carrier.

Unforeseen attack vector due to speedy network

The 4G cellphones that have been infected with malware and are under the control of hackers could also become part of a ‘botnet’, and be used to conduct more advanced attacks, due to the increased bandwidth of 4G. The average download speed for 4G LTE is about 20Mbps. It is faster than traditional 3G network speed 6 times. The Multicast Video delivery scheme in OFDMA-based 4G wireless networks, to optimize multicast video traffic. On the other hand multicast video delivery, which is vulnerable to malicious video flooding attacks. The cyber attack has been changed. From traditional non mobile type network migrate to mobile computing network. The high network speed boost up DDOS power unintentionally. This is the major factor cause distributed denial-of-service (DDoS) attacks rapidly increase.

Theoretical mobile network bandwidth infographic:

http://img.photobucket.com/albums/v704/chanpicco/chanpicco071/4G-4_zpst1frchom.gif

Additional key factor :

4G mobile network lure hackers engage cyber attack. It is a jump board. A critical flaw was discovered in the ASN.1 compiler used by leading telecommunications and networking vendors. ASN.1 is an essential ingredient for achieving the lightning-fast mobile broadband networks of the 21st century. Protocols such as 4G: LTE RRC, LTE S1/X2 and IEEE 802.16m WiMAX are defined using ASN.1. Since the extent of the vulnerability of ASN.1 has yet to be determined. And such a way let the 4G mobile network inherent risk increases.

Short term conclusion:

The 4G mobile network looks not secure compared to other mobile network.

Reference: Flaw found ASN.1 & SS7

https://www.linkedin.com/pulse/how-protect-your-premises-found-vulnerability-isnt-picco

 

Cell Phone (iPhone, Android, windows mobile)

The crypto key change of modern technology world – Mobile computing devices (BYOD)

908 Comments

The scandal of NSA hacking tools and surveillance program. Who’s the hero protect world wide privacy? The the largest market research firm (MarketsandMarkets) forecasts the global BYOD market to grow from $71.93 billion in 2013 to $266.17 billion in 2019. You might have question? How to protect your personal data privacy? Even though law enforcement especially NSA couldn’t cracked under normal circumstance?

The trend of security technology

A cryptographic algorithm, or cipher, is a mathematical function used in the encryption and decryption process. A cryptographic algorithm works in combination with a key—a word, number, or phrase—to encrypt the plaintext. The same plaintext encrypts to different ciphertext with different keys. As times go by, the encryption algorithm becomes more complex. Many encryption algorithm (3DES, AES, AES 256) appears in the world.

Steal crypto Key

If the hacker engage a side-channel attack,he must through brute force or by exploiting a weakness in the underlying algorithm. Since the crypto key store on hard drive. The simple idea is that extract the key and certificate in the disk.

In order to avoid steal crypto keys and certificates, Apple establish defensive mechanism.

Apple secure key store in the chipset. The Apple processor contains an on-board, AES cryptograhic key called the Global ID (GID) that is believed to be shared across all the current ‘iDevices’. This GID key is used to un-wrap the keys that decrypt the corresponding boot firmware code stored in system non-volatile memory .

Chipset architecture shown as below:

http://img.photobucket.com/albums/v704/chanpicco/chanpicco071/Apple-A8_zpskwb6hxx4.jpg

Microsoft’s struggle for balance and control (windows OS includes windows phone)

If the encryption key is stored in the operating system itself rather than using a hardware. It’s possible for hacker extract the keys and certificates. BitLocker disk encryption requires a TPM. TPM stands for “Trusted Platform Module”. It’s a chip on your computer’s motherboard that helps enable tamper-resistant full-disk encryption.

BitLocker Drive Encryption is built into the Windows 10 operating system and uses … TPM v1.2 Chip

http://img.photobucket.com/albums/v704/chanpicco/chanpicco071/MS-TPM_zpsbdjwbvbn.jpg

TPM version 1.2 Chip – A very generic description of the TPM is that it performs RSA encryption, decryption, and signing in the hardware.

Atmel AT97SC3204T Trusted Platform Module

http://img.photobucket.com/albums/v704/chanpicco/chanpicco071/TPM-block_zpstyneydlm.jpg

 

 

Uncategorized

Meteor shower – Apple iPhone

944 Comments

It is hard to imagine that hacker can jailbreaks Apple iphone device over the air! Oh, a national level of action task can do anything! No need to mention this news too much. You can find out the details when you do a google search, right? OK, we discuss those vulnerabilities into a little bit details. There are total no. of three vulnerabilities found by security experts (CVE details shown as below):

CVE 2016-4657: WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

CVE 2016-4656: The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

CVE 2016-4655: The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app.

Surprise, it jailbreak the iPhone over the air!

Step 1. Hacker lure the victim execute a click on SMS, a automatic redirect action engaged and forward iPhone to web site (sms.webadv.co) and download the payload immediately.The objective is going to delivery WebKit applications vulnerability.

Attacking WebKit Applications by exploiting memory corruption bugs:

Design weakness:

Every WebKit object is RefCountedBase object

Mobile Safari and most of WebKit Apps leak address – Fill in another object and use the JS pointer of the old object to read information of the new object

http://img.photobucket.com/albums/v704/chanpicco/chanpicco071/Pegasus-memory-corrupt_zpsscfav0a4.jpg

 

 

Step 2.1:  CVE-2016-4656 (Kernel Information Leak Circumvents KASLR)

It is the most difficult part because Kernel Address Space Layout Randomization
(KASLR) mapping the kernel into different and unpredictable locations in memory. The attacker has found a way to locate the kernel by using a function call leaks the kernel’s actual memory location to be mapped. For instance, it is possible to leak information about memory layout using format string vulnerabilities.

Remark: format string exploits can be used to crash a program or to execute harmful code

Step 2.2: CVE 2016-4657 (Memory Corruption in Kernel leads to Jailbreak)

The JavaScript core of WebKit uses JIT, to do this it require an area of memory which is both writable and executable. With the reverse engineer software like malware. A function so called “allocateJIT” is the perpetrator. If a syscall instruction is executed from within JIT shared memory. The malicious software  can execute privilege escalation.  The last stage is deploys a number of files deployed in a standard unix tarball.

Observation – Why was apple only release the patch can fix this design bug?

Predict that Apple added their own privilege checks in the kernel; only processes which pass these checks are allowed to use JIT.

Is that mean the national security agency can export the data from iphone? There is no need to request escrow key from Apple?

Since above flaws let mobile phone compromised. Hacker can remote control the phone for recording voice call, take photo shot send to their end. The personal data inside iphone is available to export. From technical point of view, there is no need to request escrow key! See how important of the overall design? Although the crypto mechanism  integrate to hardware mitigate the risk, however a flaw such a way crack down the Apple protection wall!

http://img.photobucket.com/albums/v704/chanpicco/chanpicco071/Apple-A8_zpskwb6hxx4.jpg