Monthly Archives: April 2017

System

Are 64-bit OS malware proof?

42 Comments

 

Preface:

As we known, computer process direct work with Kernel (Ring 0) is quite dangerous. More realistic to say is that Real mode, also called real address mode, is an operating mode of all x86-compatible CPUs. Real mode provides no support for memory protection, multitasking, or code privilege levels. Windows 95 executes drivers and process switching in ring 0, while applications, including API DLL such as kernel32.dll and krnl386.exe are executed in ring 3.

We found trick on Windows 10. For instance,  you are allow to run 16 bit application on 32 bit (Window 10) operating system. But not allow to run 16 bit application on 64 bit (Windows 10) OS.

Why? A processor limitation of 64 bit OS to execute (non-protected mode) 16-bit code. The 64-bit versions of Windows include 32-bit protected mode runtime libraries, but do not include any 16-bit protected mode runtime libraries. But how’s the mystery allow execute a Dos command prompt on 64-bit (Windows 10)OS? The Dos emulator make the magic.

The kernel of windows 10 is located at top of memory. The 64 bit OS of memory support 3.5GB RAM above, hacker have difficulties to find out the kernel process finger print in memory. Apart from that, the 64 bit operating system Kernel executable not direct reachable! Since it can’t communicate with kernel directly. Therefore a common criteria consensus 64 bits OS is malware proof.

Have you heard the weakness of superman? Kryptonite are able to reduce his power?

The origin story of Superman relates that he was born on the planet Krypton. Kryptonite is a radioactive mineral from Krypton. It was produced during explosion of Krypton. Kryptonite are able to reduce superman power. A similar scenario of 64 bit OS system. Since Kernel executable not reachable. However PAGE TABLE is loaded below 4GB. So it is possible to do the follow concept to unlock windows 10.

Viewing and Editing Registers in WinDbg

Solution: Self-ref entry technique

Reference: In 32 bits, this entry is usually located in the PAGE DIRECTORY, even with PAE enabled.
In 64 bits, this entry is located in the PML4

  • CPU CR3 register point to physical address (PA) of PML4
  • PML4(entry) point to PA of PDPT
  • PDPT(entry) point to PA of PD
  • PD(entry) point to PA of PT
  • PT contains Page Table Entries

As a result a re-used entry in the four paging levels, which means that this is used by the CPU as PML4 entry, PDPT entry, Page Directory entry and Page Table entry at the same time.

Busy this week, allow for me to complete the remaining part next week, Sorry!

IoT

IT cup noodles – fast step detect IoT devices on your network

825 Comments

Preface:

The world has been changed. Modern people all unforgotable a key word on mouth. What’s is this? The word efficiency. No matter you wait for dinner, buy lunch, queue in cinema buy the ticket.  We all looking for the final expectation is quick! Right?  Since our standard life without computation is hard to survival. How about cyber security. The headlines news alerts you daily of cyber incidents. Whereby manufacturer and business man satisfy your  expectation. For the food, we have ready to eat noodle. But how about the cyber security solution. Any Quick and done solution available in the market?  Yes, it is available. Regarding to the subject matter, below solution is the quick and dirty solution to figure out the IoT devices inside your network! Sounds like a Japan food product (Cup Noodle). Be my guest. Enjoy!

Requirement:

As of today, firm install the SIEM product is the major component to compliance standard. No matter PCI, SOX & ISO 27001 compliance standard they are all require a central log management system. The technical term so all SIEM (Security information and event management). The SIEM system carry a major powerful feature so call correlation rule.  The scenario is that SIEM system will identify and filter the specifics log event of the device on custom setup. Then provide a status update (send the notification email) alert on duty IT staff what is the current situation.

Since the function is ready. We can g to next step.

What is the theory?

As we know, the ethernet mac address contains vendor ID name field (see below diagram for reference) to determine the corresponding vendor. Since this vendor ID is unique and therefore we can make use of this vendor ID to figure out the target.

Criteria (specifications):

The SIEM system default function come with parser function to identify the MAC address of each device. Since most of the log event format are compliance to common standard. The most popular one of the standardization is the common event format (CEF).
The format called Common Event Format (CEF) can be readily adopted by vendors of both security and non-security devices. This format contains the most relevant event information, making it easy for event consumers to parse and use them.

 

Procedure:

Define rogue device detection on SIEM system.  SIEM system is able to use the first few octets of a mac address to identify a rogue device. If so, then you could then use the vendor part of mac address to enforce your company IT policy. Avoid the IoT devices hide inside your network and reduce the insider threat. Below breakdown list is the vendor MAC address for your reference. Since my vendor ID on hand more than 100 pages and therefore not going to post here.

F8A45F	Xiaomi Communications Co Ltd
8CBEBE	Xiaomi Communications Co Ltd
640980	Xiaomi Communications Co Ltd
98FAE3	Xiaomi Communications Co Ltd
185936	Xiaomi Communications Co Ltd
9C99A0	Xiaomi Communications Co Ltd

84742A	zte corporation
BC3AEA	GUANGDONG OPPO MOBILE TELECOMMUNICATIONS CORP.,LTD
E8BBA8	GUANGDONG OPPO MOBILE TELECOMMUNICATIONS CORP.,LTD
8C0EE3	GUANGDONG OPPO MOBILE TELECOMMUNICATIONS CORP.,LTD
006B8E	Shanghai Feixun Communication Co.,Ltd.

C81479	Samsung Electronics Co.,Ltd
54FB58	WISEWARE, Lda
A42940	Shenzhen YOUHUA Technology Co., Ltd
B00594	Liteon Technology Corporation
C0A0BB	D-Link International
28A1EB	ETEK TECHNOLOGY (SHENZHEN) CO.,LTD
4CCBF5	zte corporation
F0F5AE	Adaptrum Inc.
F42896	SPECTO PAINEIS ELETRONICOS LTDA
5C36B8	TCL King Electrical Appliances (Huizhou) Ltd.
90F3B7	Kirisun Communications Co., Ltd.
DCAD9E	GreenPriz
B4827B	AKG Acoustics GmbH
3C18A0	Luxshare Precision Industry Co.,Ltd.
186472	Aruba Networks
4CB81C	SAM Electronics GmbH
2C3731	ShenZhen Yifang Digital Technology Co.,LTD
041A04	WaveIP
94E98C	Alcatel-Lucent
50206B	Emerson Climate Technologies Transportation Solutions
C8EE75	Pishion International Co. Ltd
CC3429	TP-LINK TECHNOLOGIES CO.,LTD.
1C7B21	Sony Mobile Communications AB
BC9680	Shenzhen Gongjin Electronics Co.,Ltd
9C2840	Discovery Technology,LTD..
F89FB8	YAZAKI Energy System Corporation
709E29	Sony Computer Entertainment Inc.
E0B2F1	FN-LINK TECHNOLOGY LIMITED
F037A1	Huike Electronics (SHENZHEN) CO., LTD.

Conclusion:

As said, this is a fast food solution. If the above solution not suitable to your shop. The better idea is that invite your SIEM vendor to develop the appropriate solution fit for your requirement. It is now reach my lunch hour. Ok, we are stop the discussion here.

Cup Noodle please!

Application Development, Network (Protocol, Topology & Standard), System

Conduct self assessment enhance your cyber security setup

789 Comments

Preface:

Although your in house IT setup has SIEM, IDS, IPS, ..etc. But you may have questions? What is the defense criteria. Yes, we fully understand that install full scope of defense mechanism might mitigate the risk, right? Implement the IT strategic outsourcing.  Enforce the follow the Sun policy. Deploy the management security service.  But think it over, those defense mechanisms are involve human operation.  Perhaps the SLA agreement of your services provider promises 99.99 % response time. But cyber security incident handling method far away with normal IT operation framework. For instance, engage the forensic investigation sometimes consume time to isolate the problem. As a matter of fact, SLA looks like a value. The quicker you receive email reply or return phone call did not imply it boots up the value of cyber incident management.

Objective:

Now we look back the cyber incident history. The security experts and security analysis Guru are summarized the key factors of the weakness of IT infrastructure today. No matter how was the size of your firm. Below key elements can guide you to the appropriate approach.

Weaknesses of IT domain – Key elements

  1. Unauthenticated protocols
  2. Outdated hardware
  3. Weak user authentication
  4. Weak file integrity checks
  5. Vulnerable Windows operating systems
  6. Undocumented third-party relationships

If your firm is able to compliance above 6 items of key elements. I was say congratulation to you. But for the realistic point of view, I believed that it is not easy to archive. For instance, you application development team is going to enhance the application. However the application integrate with a legacy product. Furthermore the legacy product is retired of their product life cycle. You know what is the weakness and the vulnerabilities. As a matter of fact, it is not possible to inform your management team suspend the project process since this is a business objective. Similar fashion of  scenario you might encountered or familiar.  Any idea or resolution to resolve such business habit forming manner. Since all the final decision will be decide by CSO, CIO or coporate management team. But at least following hints can give more space to you for thinking of this subject matter.

Definition:

Use a security controls matrix to justify controls and identify the weakness of the specifics area. The design goal is that take the benefit of matrix table for simplification terms. Thus provide a straight forward path which can apply to the key objective area. Since we all tech guy and no need to mention in depth. For more details, please see below:

Base on the 6 key elements of weakness in overall IT Infrastructure. Below assessment tool can provides an overall idea to you which area of weakness encountered in your shop.

 

authenticated protocols Availability SSL or VPN (Ipsec) Change control policy
Router (GUI access) Yes(1)/No(0) Yes(1)/No(0)
Switch (GUI access) Yes(1)/No(0) Yes(1)/No(0)
Firewall (GUI access) Yes(1)/No(0) Yes(1)/No(0)
Managed security service (GUI access) Yes(1)/No(0) Yes(1)/No(0)
Cloud Farm (GUI access) Yes(1)/No(0) Yes(1)/No(0)
Total score Full score (5) Full score (5)
Outdated Hardware Still operate In-House hardware lifecycle policy
Router (OS obsoleted) Yes(0)/No(1) Yes(1)/No(0)
Switch (OS obsoleted) Yes(0)/No(1) Yes(1)/No(0)
Firewall (OS obsoleted) Yes(0)/No(1) Yes(1)/No(0)
Sever (Vendor support – End of Life) Yes(0)/No(1) Yes(1)/No(0)
PABX (CTI server) Yes(0)/No(1) Yes(1)/No(0)
Total score Full score (5) Full score (5)
user authentication ID asset management Single sign-on feature
Router Logon access Yes(1)/No(0) Yes(0)/No(1)
Switch Logon access Yes(1)/No(0) Yes(0)/No(1)
Firewall Logon access Yes(1)/No(0) Yes(0)/No(1)
Privileges ID Yes(1)/No(0) Yes(0)/No(1)
Application program service ID Yes(1)/No(0) Yes(0)/No(1)
Total score Full score (5) Full Score (5)
File integrity check Top Secret / Confidential Data Data classification Policy
Server Yes(1)/No(0) Yes(1)/No(0)
Web Application (External) Yes(1)/No(0) Yes(1)/No(0)
Web Application (Internal) Yes(1)/No(0) Yes(1)/No(0)
Database (DB) Yes(1)/No(0) Yes(1)/No(0)
Cloud farm Yes(1)/No(0) Yes(1)/No(0)
Total score Full score (5) Full score (5)
Vulnerability management Zero day & critical patch Incident management procedure
Router Yes(1)/No(0) Yes(1)/No(0)
Switch Yes(1)/No(0) Yes(1)/No(0)
Firewall Yes(1)/No(0) Yes(1)/No(0)
Server Yes(1)/No(0) Yes(1)/No(0)
Application Yes(1)/No(0) Yes(1)/No(0)
Total score Full score (5) Full score (5)
3rd Party relationship Responsibilities (scope of works and support level of cyber security incident) Dedicated subject matter expert implement in this role
Management security services Yes(1)/No(0) Yes(1)/No(0)
Web Hosting Yes(1)/No(0) Yes(1)/No(0)
Application (Vendor service support token) Yes(1)/No(0) Yes(1)/No(0)
Hardware maintenance (services provider) Yes(1)/No(0) Yes(1)/No(0)
Network (MPLS, Frame-link, Internet line, Boardband..etc) Yes(1)/No(0) Yes(1)/No(0)
Total score Full score (5) Full score (5)

Achievement:

What is your over performance score on above matrix table?  If it is not suitable to your environment. No problem, please go ahead to modify the criteria and try to fit to your project scope. Even though external auditor engage the risk assessment they are using the same idea.  Good luck to all of you!

 

 

 

 

 

Application Development, Cell Phone (iPhone, Android, windows mobile), System

The silent of the Flash, Be aware of RTMFP protocol! He can exacerbate network attacks.

869 Comments

 

 

Flash Player has a wide user base, and is a common format for games, animations, and graphical user interfaces (GUIs) embedded in web pages. However the trend of HTML 5  is going to replace his duty on market. Google stop running Flash display advertisement on Jan 2017.  The e-newspaper (Digital journal) foreseen that the Adobe’s Flash expected to be dead and gone by 2018. However, the software vendor Adobe release Flash Player 25 on Mar 2017. Before the discussion starts, ,  lets go through the current market status of Flash player.  Below picture show the current market position of Flash. It looks that a significant drop of the market share today.

Market position 2017

A question you may ask? If the market share of the product dropped, it is not necessary to discuss a low popularity product.  But my concerns on Adobe Flash application still valid. The fact is that even though you are not going to use. However Flash Player installed on your machine have inherent risk.  Ok, make it simple. Let jump to our main topic now. It is the real-time media flow protocol from Adobe.

What is the Real-Time Media Flow Protocol (RTMFP)?

The Real-Time Media Flow Protocol (RTMFP) is a communication protocol from Adobe that enables direct end user to end user peering communication between multiple instances of the Adobe® Flash® Player client and applications built using the Adobe AIR® framework for the delivery of rich, live, real-time communication.

The evolution of Adobe system design

The IETF technical articles issued on Dec 2014 has following security consideration.

Cryptographic aspects of RTMFP architecture:
RTMFP architecture does not define or use a Public Key Infrastructure (PKI). Clients should use static Diffie-Hellman keys in their certificates. Clients MUST create a new certificate with a distinct fingerprint for each new NetConnection. These constraints make client identities ephemeral but unable to be forged. A man-in-the-middle cannot successfully interpose itself in a connection to a target client addressed by its fingerprint/peer ID if the target client uses a static Diffie-Hellman public key.

Servers can have long-lived RTMFP instances, so they SHOULD use
ephemeral Diffie-Hellman public keys for forward secrecy. This
allows server peer IDs to be forged; however, clients do not connect
to servers by peer ID, so this is irrelevant.

For more details on above matter, please visit IETF techincal articles https://tools.ietf.org/html/rfc7425#page-46

Our observation today

  1. Since RTMFP is based on UDP. UDP (User Datagram Protocol) connectionless state which decreased latency and overhead, and greater tolerance for dropped or missing packets. RTMFP supporting groups in Flash player support multicast feature. If hacker counterfeit a malicious swf format file and deploy with spear phishing hacking technique. Since it is a multicast structure and therefore it is hard to located the original source file.

2. CVE-2017-2997 exploits vulnerability in the Primetime TVSDK that supports customizing ad information. Successful exploitation could lead to arbitrary code execution. However a design weakness looks appear on TVSDK , an out-of-bound read vulnerability found by FireEye on May 2016.

3. Besides, The AVM (Action script virtual machine) implements certain core features of ActionScript, including garbage collection and exceptions, and also acts as a bridge between your code and Flash Player. The use-after-free memory feature in AVM is protect by  OS system. Even though implement Address space layout randomization (ASLR)  and Data Execution Prevention (DEP) but still have way by-pass by attacker. Windows 8.1 Update 3 Microsoft introduced a new exploit mitigation technology called Control Flow Guard (CFG). CFG injects a check before every indirect call in the code in order to verify if the destination address of that call is one of the locations identified as “safe” at compile time. However overwrite Guard CF Check Function Pointer with the address of a ret instruction will
let any address pass Guard CF Check Function, and thus bypass CFG.

Overall comments on above 3 items:

It looks that Flash contained fundamental design limitation, may be there are more hidden risks does not discover yet. As far as I know, law enforcement agency relies on Flash vulnerabilities to implement the surveillance program (Reference to vulnerability on 2012). My suggestion is that it is better uninstall the Flash on your web browser especially enterprise firm IT operation environment. Since Information security is a continuous program, so stay tuned,  update will be coming soon!

Flash Architecture

Remark: out-of-bounds definition – This typically occurs when the pointer or its index is incremented or decremented to a position beyond the bounds of the buffer or when pointer arithmetic results in a position outside of the valid memory location to name a few. This may result in corruption of sensitive information, a crash, or code execution among other things.

Application platform  – Language C and C++

The chronology of attack

2012: The malicious documents contain an embedded reference to a malicious Flash file hosted on a remote server. When the Flash file is acquired and opened, it sprays the heap with shellcode and triggers the CVE-2012-0779 exploit. Once the shellcode gains control, it looks for the payload in the original document, decrypts it, drops it to disk, and executes it. Symantec detects this payload as Trojan.Pasam. The malicious files we have observed so far are contacting servers hosted in China, Korea, and the United States to acquire the necessary data to complete the exploitation. This attack is targeting Adobe Flash Player on Internet Explorer for Windows only.

2015: SWF file is used to inject an invisible, malicious iFrame

2017: (CVE-2017-2997, CVE-2017-2998,CVE-2017-2999,CVE-2017-3000,CVE-2017-3001,CVE-2017-3002 & CVE-2017-3003)

A buffer overflow vulnerability that could lead to code execution (CVE-2017-2997).
Memory corruption vulnerabilities that could lead to code execution (CVE-2017-2998, CVE-2017-2999).
Random number generator vulnerability used for constant blinding that could lead to information disclosure (CVE-2017-3000).
unpatch vulnerabilities lead to code execution (CVE-2017-3001, CVE-2017-3002, CVE-2017-3003)

 


 

 

 

 

Application Development, Cell Phone (iPhone, Android, windows mobile), Network (Protocol, Topology & Standard), System

Part 2:Blockchain technology situation – Malware join to bitcoin mining

838 Comments 
A moment of silence, prayer for the dead (Terrorist attack on the streets attack near U.K. Parliament 22nd Mar 2017)

A moment of silence, prayer for the dead 
Tragedy in Russia - Explosion in the St. Petersburg metro 3rd Apr 2017

Part 2: Blockchain technology situation – Malware join to bitcoin mining

We continuous the discussion topic on blockchain technology situation.  Part 1:Blockchain technology situation – A Tales of Two Cities The discussion on part 2 mainly focus on malware threats to bitcoin industry.  We understand that Bitcoin was designed to be uncensorable digital cash that could operate outside the existing financial system. As mentioned last time, it looks that the blockchain technology contained weakness on end point device (bitcoin owner workstation or mobile phone). Even though you deploy a proprietary wallet, the overall setup will become weakness once malware compromise your end point device. Below picture diagram bring an idea to reader of bitcoin wallet architecture, see whether you have different idea in this regard?

Bitfinex incident wakes up concern on endpoint security

More than US$60m worth of bitcoin was stolen from one of the world’s largest digital currency exchanges (Bitfinex) on 2nd Aug 2017. Nearly 120,000 units of digital currency bitcoin worth about US$72 million was stolen from the exchange platform Bitfinex in Hong Kong, said Reuters Technology News. Director of Community & Product Development for Bitfinex stated that the bitcoin was stolen from users’ segregated wallets. The investigation has found no evidence of a breach to any BitGo servers, said the representative of BitGo.

Since no evidence proof that security breach happened in that place but what is the possible cause?

An announcement posted by official group (Bitfinex), the company informed that there are going to secure the environment and bring down the web site and the maintenance page will be left up. From technical point of view, if  API and signing keys reside on servers. Hacker might have access with legitemate credential once a bitcoin wallet user workstation compromised.As a matter of fact if the webservice is hacked, bitcoin owner will lost the money (see above bitcoin wallet architecture comparison diagram for reference).

Our Observation

The weakness of Node.J.S trading API Framework.

The java script contain security weakness. It benefits hacker to understand the operation path. For instance

Client send his payload, his key, and the hmac of his payload with his secret key. Server retrieve user with his pk, recompute the hmac with the retrieved sk and then check if the computed hmac is equal to the retrieved hmac. (see below program syntax for reference).

 

From technical point of view, malware which contains steal private key or digital certificate function, they have capability transform to bitcoin malware. As usual, the infection technique relies on Spear phishing. The emails contained a malicious attachment with the file which contained a zero-day exploit. The exploit attacked multimedia software platform used for production of animations especially Adobe Flash to install a malware onto the victim’s computer.

Then malware obtained bitfinex private key and one of the following item.

i) bitgo’s private key

ii) bitfinex bitgo’s username and password and authy’s credentials (that allows the hacker to create new api access tokens and remove daily limits)

iii) bitfinex bitgo’s api access token

Or apply new keys gave to bitgo as new 2-3 internal bitfinex address. signed tx with bfx key, and “new key” that was just given. Meanwhile bypassing bitgo’s security checks.

Summary:

Above information detail is one of the example. It looks that quote a real incident can increase the visibility of the understanding.  Apart from that, discussion looks never ending. I believed that part 3 will be coming soon.