Wiki released confidential document on 28th April, 2017, the details is exposed how government enforcement agency (CIA) counterfeit Russian and Chinese cyber activities. We receive the basic understanding of the Scribbles . To be honest, it is common that when government agency take the criminal action. However of this confidential information exposed. My reflections drive me to review my former written articles on other discussion forum during 16th April 2016. I was question that engage the investigation on Advanced Persistence threat (APT) might mislead the direction of the result. Their mechanism contains many shadow nodes. The shadow nodes located in different areas and countries. It can take this advantage and convert as political tool. The overall idea to me on this issue, I can do a scenario replay to assembly the story. Since this is only my speculation and imagination. As a matter of fact, it looks with high possibility. If you are interest, please go ahead to read more.

The story given out from my memories, it is talking about 4 years ago. The senior person (owner) of a consulting company email account was hacked. The security guru found that there is a Advanced Persistence threat (APT) activities given by China. A rumours were told that the people who found this so called Advanced Persistence threat (APT) is the anonymous group. This powerful under ground group found out this incident and intend to provides hints and finger print let the security consultant found out the truth. My personal opinion is that such incident might contained some shadow node. Also it is easy to counterfeit the attack. Today it looks that the secret information exposed by Wiki leak provides more possible factors. At the same time it make people queries the result in 2013. At least I am the one who question this result. Below is my speculation how CIA counterfeit the cyber activities let the APAC countries especially China bare unredressed injustice causes.

Latest WikiLeaks release shows how the CIA uses computer code to hide the origins of its hacking attacks and ‘disguise them as Russian or Chinese activity’

https://wikileaks.org/vault7/?marble#Marble

Recap my discussion details on 16th April 2016

An unauthorized person gains access to a network and stays there undetected for a long period of time. Cyber security terminology so called APT attack. APT style attack confused security experts. Their mechanism contains many shadow nodes. The shadow nodes located in different areas and countries. It can take this advantage and convert as political tool. It is a sword. Careerist can blame another country that they are dishonest using internet. Who’s cast a unrighted wrong, believed that attached diagram can provide an idea to you in this regard.

Happy Lunar New year 2017

Modern people daily habits looks different when we compared 10 years ago. My wallet has ATM card & Octopus. On my mobile phone there are few options allow pay online. The trend of cyber security addressed how important of end user computer today. Even though back end system protection looks like Royal castle or Pentagon. Who knows their electronic devices has been compromised by hacker. We all busy today, right!

Regarding to cyber attack historical records for financial institute environment , hacker compromised end user machines (customer end point) causes disaster level of outbreak. The statistic summary were told that the possibilities looks lower. Conversely, the most serious of injury was that a inside threat happened in their infrastructure instead of external threat.

Three Eastern European men were arrested in Taiwan in July, 2016 on suspicion of collecting cash stolen from ATMs owned by First Commercial Bank. Refer to the investigation summary of Europol, the specifics cyber attack machanism used spear-phishing emails containing malicious attachments to target bank employees and penetrate the bank’s internal networks.

Below articles is my prediction last year of this incident for reference.

Published on 31st Aug 2016

Possibility – scenario replay (implant Rootkit on BIOS causes ATM machine crazy)

Summary:

Since ATM thieves are all in jail. Can you tell me that bank ATM environments are safe now? Who knows?

More reference:

http://www.reuters.com/article/us-taiwan-cyber-atms-idUSKBN14P0CX

Happy Lunar New Year 2017

Did you read science fiction book? For instance Terminator, Matrix …etc. The overall idea of the story reminded that computer system is the governor of human being finally. Human being under their control. Can nightmare come true?

Computer technology growth rapidly after year 2000. Still remember that our team concerns thousand years worm interfere the computer clock during that day. But wake up next morning feeling that the technology go to new century.

This topic brings to my attention and the informations pulling myself go to science technology instead of IT technology. The digital DNA term I heard from HB Gary. Yes, he is the former malware hunter. Their services provides advance detection and prevention solutions to government sector and financial institution. But the nature of digital DNA here looks have difference. This element (digital DNA) is equivalent to human being component. As we know, the origin of human life through chemical evolution. Two important of points drawn to biological evolution shown as below:

1. Living things descended from a common ancestor and thus have common chemistry.
2. Living things adapt to their environment.

Without DNA, it would be impossible to pass on adaptations, and evolution would be virtually non-existent.

Genesis element – DNA or digital DNA

Genesis element – Quantum

Quantum theory distributed in major IT technology domains. They are network communications, encryption and quantum computing. The major component of quantum computing is quantum bits. One of the great challenges for scientists seeking to harness the power of quantum computing is controlling or removing quantum decoherence – the creation of errors in calculations caused by interference from factors such as heat, electromagnetic radiation, and material defects.

Read more at: http://phys.org/news/2015-04-scientists-critical-quantum.html#jCp

Genesis element – Adaptation

Adaptation: a characteristic that makes an organism to survive and reproduce in its environment. The adaptations are more likely to survive and procreate. Without DNA, it would be impossible to pass on adaptations, and evolution would be virtually nonexistent.

Up until now, artificial intelligence growth rapidly. 3 major elements has been established. In fact it is not mature today. However nobody know how fast developing in this area. Since some of the technologies are the intellectual proprietary. The simple we can say, …

who have privileges to governance in earth, all depends on intelligence.

Electronic technology especially Radar system far away from people common knowledge. May be you and me have chance read the scientific magazine or News learn the idea. It is a advanced technology of defence department for country. Still remember that learn VHF or UHF technologies in school. The frequency ranges are shown as below:

At that time I only focus of walkie talkie technology and did not care of radar system structure!

Bring to my attention till heard a military weapon AN/TPY-2 is going to install in APAC country. It looks that this news struggle especially China and neighbour countries.

Let’s have quick view of radar design types. Then go to discuss AN/TPY-2. Two basic radar types are pulse transmission and continuous wave. For differences between the design type, please refer to below chart.

How powerful is the AN/TPY-2 system

Refer to the picture of this subject matter, a quick overview of X-band and S-band technologies might bring an idea to you that the wave length (lambda λ) affects the precise level of hitting the target. The X-band wavelength is about 1/4 of S-band wavelength. The tolerable level of hitting to target error significantly improved. X band radar system working with military satellite. It can easily destroy the missiles on the land before it fire. The X-band frequency and narrow beam widths add the additional advantage targeting smaller objects.

Narrow beam widths benefits:

Question:

Know above details might have question to ask? It looks that whole bunch of benefits but what the reason we need this facilities. Is it for defence or other reasons?

If someone ask you a question. What is the enemy of cloud computing architecture? Yes, we believed that more details can be provided. For instance Distributed Denial Of Services, malware, virus, misconfiguration,…etc. But what do you think the influence of rootkit? Since Micro-segmentation architecture assists cloud computing services provider build their campus. From general point of view, system OS platform and application run on top of virtual environment are easy to manage. All system and users activities will be managed and monitored by hypervisor. What if unknown signature shell code attack to virtual machine? Is there any possibilities influence the neighbor system on same premises? Let’s do a quick review and then jump to discussion.

The fundamental of hypervisor

Bare-metal hypervisor

Provides partition isolation, reliability and higher security.It has no host OS layer to attack theoretically.The bare metal hypervisor base design products includes Oracle VM Server for SPARC, Oracle VM Server for x86, the Citrix XenServer, Microsoft Hyper-V and VMware ESX/ESXi.

Hosted hypervisor

Low cost, no additional drivers and ease of use and installation.The hosted hypervisor base design products includes VMware Workstation, VMware Player, VirtualBox, Parallels Desktop for Mac and QEMU.

Arm-based hypervisor

System virtualization for ARM is useful for mobile device and future ARM based server.Cell phones and Internet of Things are the arm-based hypervisor setup.

Types of Hypervisor – Informatic diagram:

This section we focus on bare metal hypervisor security outline. In the virtual machine world, linux system are everywhere. Even though the hypervisor is the linux based system or modified linux system built. The critical OS systems being relocated to Linux system platform last 5 years. Besides, the cell phones based on Linux OS become the main trend today. No matter it is Apple or Android, their core is the linux system. We relies on SSH connectivity today, it adopted by IT industry. A question might get in your mind, is it possible to re-engineer the SSH become a cyber weapon?Regarding to the cyber incident historical records, hacker start this idea earlier in 2015. We remember the XOR-DDOS attacks criteria , hackers cocktail the attack mechanism run in hybrid mode. Both SYN and DNS flood generated by the Xor.DDoS Malware. The attacker will send many SYN packs to victim host with multiple sources and launched on port 22 (ssh). Yes, the hacker take the popularity of SSH because it is a harmonized standards across the IT world.

Famous rootkit against linux environment

Phalanx: This rootkit uses /dev/mem/ interface to inject hostile code into kernel memory and hijack system calls. It has been designed for compromising the Linux 2.6 branch. Phanlanx design for harvest SSH keys and other credentials. Since Phalanx attack found on 2008 and file record by CERT. But this attack technology still valid today.

Phalanx characteristic:

Hooking lookup Tables, Code patching & Hooking CPU registers

Ebury SSH Rootkit: In February 2013, CERT-Bund started analyzing Ebury in depth and was able to identify thousands of systems around the world infected with the malware. Ebury is a SSH rootkit/backdoor trojan for Linux and Unix operating systems. The 1st attack phase is going to replacing SSH related binaries on a compromised hosts. The non genuine SSH program so called Ebury, the goal is going to steal SSH login credentials (username/password) from incoming and outgoing SSH connections. But taking about the privileges escalation feature, it was not included in Ebury feature. When it compared with Phalanx , Ebury is easy to detect.

What if hacker sojourn rootkit in kernel. Is there any possibilities influence the neighbor system on same premises?

The guest machine compromised,  however hacker might have difficulties drill down to low level system area. For instance, bare-metal hypervisor contain good isolation level. Is there any possibility engage a ring-0-attack, that is running malicious call in memory level.

Is that no way? But hacker will spend time on harvesting in memory side

When running a virtual system, it has allocated virtual memory of the host system that serves as a physical memory for the guest system, and the same process of address translation goes on also within the guest system. This increases the cost of memory access since the address translation needs to be performed twice – once inside the guest system (using software-emulated shadow page table), and once inside the host system (using hardware page table). Whereby a memory management technology (Second Level Address Translation (SLAT)) was born, his duty is going to enhance the usage of memory resources in the virtual world.

About (Second Level Address Translation (SLAT)) inherent risk

SLAT schemes such as Intel’s Extended Page Tables (EPT) and AMD’s Nested Page Tables (NPT) as shown below diagram are used to manage the virtualized memory directly from the processor. Using a larger Translation Lookaside Buffer (TLB) with additional logic circuitry inside the processor, these schemes provide faster virtual machine memory management by eliminating the intermediary step between the virtual memory address (VA) and the physical memory address (PA).

Refer to above diagram, the TLB table has the option that indicates if the received data is from a virtual machine or the native machine. Also, if the data is generated by a virtual machine, then it is tagged with that specific VM’s Address Space Identifier (ASID). Using this tag, the TLB can keep track of entries from different virtual machines in the physical machine. This method provides a significant performance improvement in VM memory management but also introduces a security risk by giving direct memory access to the guest VMs.

Remark:  Above inherent risk information details (security risk of SLAT) copy from technical article Fine grain Cross-VM Attacks on Xen and VMware are possible!
Gorka Irazoqui Apecechea, Mehmet Sinan Inci, Thomas Eisenbarth, Berk Sunar Worcester Polytechnic Institute {girazoki,msinci,teisenbarth,sunar}@wpi.edu

We stop here! It was too long and boring. I am afriad that reader might lose the interest, right? Will provide update soon!

http://img.photobucket.com/albums/v704/chanpicco/chanpicco070/SSL-bug_zpslno4rp1z.jpg

Background Story:

POODLE attack exploit SSL 3.0 vulnerability found in late 2014, such vulnerability proven that hacker can take this vulnerability advantages execute man-in-the middle attack.

The original POODLE attack is CVE-2014-3566.
F5 Networks files CVE-2014-8730 proof POODLE attack also apply to transport layer security. Since the poodle side effects looks widely spread out, Payment card industry authority alerts and announce that they gives 14 months to merchants fix this high risk SSL problem. That means the appropriate way is replacing the SSL function (see below statement).

SSL and early TLS are not considered strong cryptography and cannot
be used as a security control after 30th June, 2016.  Prior to this date, existing
implementations that use SSL and/or early TLS must have a formal Risk Mitigation  and Migration Plan in place.  
Effective immediately, new implementations must not use SSL or early TLS.  
POS POI terminals (and the SSL/TLS termination points to which they connect)
that can be verified as not being susceptible to any known exploit
s for SSL and early TLS may continue using these as a security control after 30th June, 2016.

About the subject matter ( Cisco ASA software IKEv1 and IKEv2 buffer overflow vulnerability (CVE 2016-1287)

CVE 2016-1287 was published Feb this year, the founding was that hacker can make use of IKEv1 and IKE v2 vulnerabilities execute a fragmentation heap buffer overflow. The traditional  heap overflow is a form of buffer overflow. It happens when a chunk of memory is allocated to the heap and data is written to this memory without any bound checking being done on the data. Regarding to the information provided by Cisco, such vulnerability affected to Cisco ASA Software running on the following products.

• Cisco ASA 5500 Series Adaptive Security Appliances
• Cisco ASA 5500-X Series Next-Generation Firewalls
• Cisco ASA Services Module for Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers
• Cisco ASA 1000V Cloud Firewall
• Cisco Adaptive Security Virtual Appliance (ASAv)
• Cisco Firepower 9300 ASA Security Module
• Cisco ISA 3000 Industrial Security Appliance

But information supplement posted by Cisco bring to my attention. See below:

Cisco ASA Software is not affected by this vulnerability if the system is configured to terminate only the following VPN connections:
Clientless SSL
AnyConnect SSL

My understanding is that you can avoid such vulnerability occurs on Cisco products if you are using SSL 3.0 solution. But how about the PODDLE attacks? Besides, this buffer overflow on IKEv1 and IKEv2 looks not limit to Cisco brand name. May be it does not proof or found in the moment. As far as we know, firewall appliances operartion system build by Linux normally. The vendor hardening the OS and add their proprietary applications on top. If attacker can send crafted UDP packets to the affected CISCO products. Is there any possibilities engage similar attacks to other similar OS platform firewall?

Expert analysis on weakness of design

The IKE protocol uses UDP packets, usually on port 500, and generally requires 4–6 packets with 2–3 turn-around times to create an SA on both sides. The negotiated key material is then given to the IPsec stack. If an attacker can send crafted UDP packets to the related firewall products. It looks that similar vulnerability might occurs? The side effects looks serious. The following areas are vulnerable.

• LAN-to-LAN IPsec VPN
• Remote access VPN using the IPsec VPN client
• Layer 2 Tunneling Protocol (L2TP)-over-IPsec VPN connections

• IKEv2 AnyConnect

Expert solution:

(薑越老越辣) The older you get the more experienced you are,Chinese mantra said. The potential damage of this vulnerability was that both two entities (access control and VPN functions) are seat in the same box. If we define separation of functions might mitigate this risk. That is relocate the VPN feature to another box. Do you still remember that the Father of firewall (Checkpoint). Their Firewall design framework was that access control and  policy server are running in different boxes. The designer foresee that a single point of failure causes compromise of whole defence system. The cyber world atmosphere has been changed after Unified Threat Management appears in the world. As times go by, maybe new generation of firewall coming soon. Hardware are cheap today. Multi layer functions setup is the fashion cope with advanced cyber threats.

Cisco technical article in regards to CVE 2016-1278

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160210-asa-ike

PCI – standard : SSL and early TLS are not considered strong cryptography and cannot be used as a security control after 30th June, 2016. Please refer to attached document (PCI requirement 2.3 on page 5).

https://www.pcisecuritystandards.org/documents/Prioritized_Approach_for_PCI_DSS_v3-1.pdf

http://img.photobucket.com/albums/v704/chanpicco/chanpicco070/xtunnel_zpssmkaww5r.jpg

The headline news this week focus 2016 election of US president scandal.Just heard email leakage by Mrs. Hillary Clinton. The election in political world is a War instead of competition. This articles focus on unexplored information in DNC hack incident.

Findings by Invincea

The technical report provided the analytic that DNC hack incident caused by Trojan. Hackers modified end-of-life software product. The hacker injects Trojans and Malware functions into software. The software developed by China application vendor (Xten), it aimed to enhance voice stability operations in firewall environment. The software such a way involved unredressed injustice. Regarding to the report, hackers relies on Remote Access Trojan (RAT) technique sojurn to workstations belongs to Mrs. Hillary Clinton. The finger print shown that the hack group might belongs to APT 28. Regarding to the virus incident track records, the source IP address of this Trojan (Malware) came from 85.117.47.0/24.

How was it infect?

The infection method was that unsuspecting users manually executing unknown programs. Distribution channels include e-mail, malicious or hacked Web pages, Internet Relay Chat (IRC), peer-to-peer networks, etc.

Wide Angle Lens – invaded DNC

1st version of Trojan (born before 2010):

Check repository of virus database. The anti-virus vendor Symantec found this virus in 2010. His naming convention is “Generic Trojan”. However this Trojan (malware) headache Symantec more than 2 years. The problem was that antivirus program quarantine the execution file of Generic Trojan. The sterilize step is going to rename the original file name DWHwizrd.exe to DWHxxx.tmp. However Symantec customers found that virus alert message pop-up after Trojan quarantined. Symantec technical support provides many solution to client. But unfortunately problem still persists. The customer report that virus alert displayed on screen even though you delete all the temp files. Heard that problem was fixed in mid of 2012.

Why does hacker reuse this Trojan (malware) ?

Since China software house (Xten) created a family of SIP products based on their XTunnel protocol and run on top of windows. The benefits is that the software establish voice IP tunnel might mislead the technical staff and security administrator. They think she is using soft-phone! As usual traffic encrypted and therefore firewall can’t monitor. Or this is her personal computer, no nobody know what is happen?

Hacker relies of the software vulnerabilities re-issue next generation of Trojan.

The Xten software is a windows base open source tool and it is end of product life cycle. I believed that it is a easy way for hacker design a Trojan in short time. Since MD5 checksum different for new generation of Trojan. Therefore antivirus vendor may not aware until user report. But personally, I suspected that hackers might know the weakness of anti virus program install on target machine and custom made virus or trojan (malware). Symantec found the Trojan file name in 2010 is DWHwizard.exe. Invincea found the malicious file on victim workstation with naming convention vmupgradehelper.exe. It looks that anti-virus programs are able to detect this Trojan after 11th July 2016 (Hillary email leaks scandal open to public).

Doubts:

1. Since Xtunnel establish site to site connection. Mrs. Hillary Clinton works with US government at that time. It was confused that the defense mechanism in US government did not alert the victim workstation connect to APT 28?

2. Even though Mrs. Hillary Clinton not working in office. Do you think there is only one cyber defense program (antivirus) install on such important person workstation?

Headline News status update on 31st Jul 2016

http://www.nytimes.com/2016/07/30/world/europe/dnc-hack-russia.html?_r=0

Expert findings – so called Russian Xtunnel

https://www.invincea.com/2016/07/tunnel-of-gov-dnc-hack-and-the-russian-xtunnel/

It is hard to imagine that hacker can jailbreaks Apple iphone device over the air! Oh, a national level of action task can do anything! No need to mention this news too much. You can find out the details when you do a google search, right? OK, we discuss those vulnerabilities into a little bit details. There are total no. of three vulnerabilities found by security experts (CVE details shown as below):

CVE 2016-4657: WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

CVE 2016-4656: The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

CVE 2016-4655: The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app.

Surprise, it jailbreak the iPhone over the air!

Step 1. Hacker lure the victim execute a click on SMS, a automatic redirect action engaged and forward iPhone to web site (sms.webadv.co) and download the payload immediately.The objective is going to delivery WebKit applications vulnerability.

Attacking WebKit Applications by exploiting memory corruption bugs:

Design weakness:

Every WebKit object is RefCountedBase object

Mobile Safari and most of WebKit Apps leak address – Fill in another object and use the JS pointer of the old object to read information of the new object

http://img.photobucket.com/albums/v704/chanpicco/chanpicco071/Pegasus-memory-corrupt_zpsscfav0a4.jpg

Step 2.1:  CVE-2016-4656 (Kernel Information Leak Circumvents KASLR)

It is the most difficult part because Kernel Address Space Layout Randomization
(KASLR) mapping the kernel into different and unpredictable locations in memory. The attacker has found a way to locate the kernel by using a function call leaks the kernel’s actual memory location to be mapped. For instance, it is possible to leak information about memory layout using format string vulnerabilities.

Remark: format string exploits can be used to crash a program or to execute harmful code

Step 2.2: CVE 2016-4657 (Memory Corruption in Kernel leads to Jailbreak)

The JavaScript core of WebKit uses JIT, to do this it require an area of memory which is both writable and executable. With the reverse engineer software like malware. A function so called “allocateJIT” is the perpetrator. If a syscall instruction is executed from within JIT shared memory. The malicious software  can execute privilege escalation.  The last stage is deploys a number of files deployed in a standard unix tarball.

Observation – Why was apple only release the patch can fix this design bug?

Predict that Apple added their own privilege checks in the kernel; only processes which pass these checks are allowed to use JIT.

Is that mean the national security agency can export the data from iphone? There is no need to request escrow key from Apple?

Since above flaws let mobile phone compromised. Hacker can remote control the phone for recording voice call, take photo shot send to their end. The personal data inside iphone is available to export. From technical point of view, there is no need to request escrow key! See how important of the overall design? Although the crypto mechanism  integrate to hardware mitigate the risk, however a flaw such a way crack down the Apple protection wall!

http://img.photobucket.com/albums/v704/chanpicco/chanpicco071/Apple-A8_zpskwb6hxx4.jpg