Cell Phone (iPhone, Android, windows mobile)

The crypto key change of modern technology world – Mobile computing devices (BYOD)

285 Comments

The scandal of NSA hacking tools and surveillance program. Who’s the hero protect world wide privacy? The the largest market research firm (MarketsandMarkets) forecasts the global BYOD market to grow from $71.93 billion in 2013 to $266.17 billion in 2019. You might have question? How to protect your personal data privacy? Even though law enforcement especially NSA couldn’t cracked under normal circumstance?

The trend of security technology

A cryptographic algorithm, or cipher, is a mathematical function used in the encryption and decryption process. A cryptographic algorithm works in combination with a key—a word, number, or phrase—to encrypt the plaintext. The same plaintext encrypts to different ciphertext with different keys. As times go by, the encryption algorithm becomes more complex. Many encryption algorithm (3DES, AES, AES 256) appears in the world.

Steal crypto Key

If the hacker engage a side-channel attack,he must through brute force or by exploiting a weakness in the underlying algorithm. Since the crypto key store on hard drive. The simple idea is that extract the key and certificate in the disk.

In order to avoid steal crypto keys and certificates, Apple establish defensive mechanism.

Apple secure key store in the chipset. The Apple processor contains an on-board, AES cryptograhic key called the Global ID (GID) that is believed to be shared across all the current ‘iDevices’. This GID key is used to un-wrap the keys that decrypt the corresponding boot firmware code stored in system non-volatile memory .

Chipset architecture shown as below:

http://img.photobucket.com/albums/v704/chanpicco/chanpicco071/Apple-A8_zpskwb6hxx4.jpg

Microsoft’s struggle for balance and control (windows OS includes windows phone)

If the encryption key is stored in the operating system itself rather than using a hardware. It’s possible for hacker extract the keys and certificates. BitLocker disk encryption requires a TPM. TPM stands for “Trusted Platform Module”. It’s a chip on your computer’s motherboard that helps enable tamper-resistant full-disk encryption.

BitLocker Drive Encryption is built into the Windows 10 operating system and uses … TPM v1.2 Chip

http://img.photobucket.com/albums/v704/chanpicco/chanpicco071/MS-TPM_zpsbdjwbvbn.jpg

TPM version 1.2 Chip – A very generic description of the TPM is that it performs RSA encryption, decryption, and signing in the hardware.

Atmel AT97SC3204T Trusted Platform Module

http://img.photobucket.com/albums/v704/chanpicco/chanpicco071/TPM-block_zpstyneydlm.jpg

 

 

Uncategorized

Meteor shower – Apple iPhone

317 Comments

It is hard to imagine that hacker can jailbreaks Apple iphone device over the air! Oh, a national level of action task can do anything! No need to mention this news too much. You can find out the details when you do a google search, right? OK, we discuss those vulnerabilities into a little bit details. There are total no. of three vulnerabilities found by security experts (CVE details shown as below):

CVE 2016-4657: WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.

CVE 2016-4656: The kernel in Apple iOS before 9.3.5 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

CVE 2016-4655: The kernel in Apple iOS before 9.3.5 allows attackers to obtain sensitive information from memory via a crafted app.

Surprise, it jailbreak the iPhone over the air!

Step 1. Hacker lure the victim execute a click on SMS, a automatic redirect action engaged and forward iPhone to web site (sms.webadv.co) and download the payload immediately.The objective is going to delivery WebKit applications vulnerability.

Attacking WebKit Applications by exploiting memory corruption bugs:

Design weakness:

Every WebKit object is RefCountedBase object

Mobile Safari and most of WebKit Apps leak address – Fill in another object and use the JS pointer of the old object to read information of the new object

http://img.photobucket.com/albums/v704/chanpicco/chanpicco071/Pegasus-memory-corrupt_zpsscfav0a4.jpg

 

 

Step 2.1:  CVE-2016-4656 (Kernel Information Leak Circumvents KASLR)

It is the most difficult part because Kernel Address Space Layout Randomization
(KASLR) mapping the kernel into different and unpredictable locations in memory. The attacker has found a way to locate the kernel by using a function call leaks the kernel’s actual memory location to be mapped. For instance, it is possible to leak information about memory layout using format string vulnerabilities.

Remark: format string exploits can be used to crash a program or to execute harmful code

Step 2.2: CVE 2016-4657 (Memory Corruption in Kernel leads to Jailbreak)

The JavaScript core of WebKit uses JIT, to do this it require an area of memory which is both writable and executable. With the reverse engineer software like malware. A function so called “allocateJIT” is the perpetrator. If a syscall instruction is executed from within JIT shared memory. The malicious software  can execute privilege escalation.  The last stage is deploys a number of files deployed in a standard unix tarball.

Observation – Why was apple only release the patch can fix this design bug?

Predict that Apple added their own privilege checks in the kernel; only processes which pass these checks are allowed to use JIT.

Is that mean the national security agency can export the data from iphone? There is no need to request escrow key from Apple?

Since above flaws let mobile phone compromised. Hacker can remote control the phone for recording voice call, take photo shot send to their end. The personal data inside iphone is available to export. From technical point of view, there is no need to request escrow key! See how important of the overall design? Although the crypto mechanism  integrate to hardware mitigate the risk, however a flaw such a way crack down the Apple protection wall!

http://img.photobucket.com/albums/v704/chanpicco/chanpicco071/Apple-A8_zpskwb6hxx4.jpg

 

 

 

Network (Protocol, Topology & Standard)

About xor DDOS malware

270 Comments

http://img.photobucket.com/albums/v704/chanpicco/chanpicco071/Xor-pic_zpsmuqbdlvz.jpg

XOR DDOS – Tsunami SYN Flood ramping up to 140 Gbps attack against public network backbone.

XOR DDOS attack aggressive last year (2015). Xor DDOS attack triggers by Botnet. The attack capability able to reproduce 150Gbps attack vector. Since the coverage of mobile computing especially cellphone users on demand today. The OS kernel of mobile phone is linux. The architecture of XOR DDOS attack relies on botnet. And the attack target is Linux OS.
This type of attack growth rapidly today. The hackers through TCP 3502 port connect to victim device trigger attack.The objective of attacks are based on flood mechanism (Syn flood and DNS flood).

Historical changes of the MD-5 checksum values:

Oct 2015 – 238ee6c5dd9a9ad3914edd062722ee50

Oct 2015 – 2edd464a8a6b49f1082ac3cc92747ba2

Nov 2014 – fd3f2c810f4391be2e6b82429c53c318 (Attack target specify Linux OS)

Hackers custom cocktail attack mechanism:

SYN and DNS floods generated by the Xor.DDoS Malware have very specific characteristics. The payload consists of garbage memory data, this memory capable to store passwords and ssh private keys.

The attacker will send many SYN packs to victim host with multiple sources. The attack will be launched on port 22 (ssh). This attack is very effective if syn_cookies are turned off. Please be remind that syn_cookies turned off by default on Linux.SYN cookies are now a standard part of Linux and FreeBSD.

DNS floods are symmetrical DDoS attacks. These attacks attempt to exhaust server-side assets (e.g., memory or CPU) with a flood of UDP requests. Since DNS servers rely on the UDP protocol for name resolution, and is a Layer 3 attack. With UDP-based queries (unlike TCP queries), a full circuit is never established, and thus spoofing is more easily.

Design objective of XOR malware:

SYN Cookies is a simple DDoS defence today, and probably suitable for all Internet hosting including mail server and corporate web servers. 500 units of compromised mobile computing devices with an average 200 Kbs of bandwidth each launching an attack will fully utilize your 100Mbs network link.

Attack target:

From technical point of view, SYN Flood and DNS flood are effectively suspend the network connectivity and domain name lookup function. It clearly shown that engage this attack to ISP or Cloud services provider might bring a Tragedy to their business. As far as I know, ISP or Cloud services provider have mechanism to detect botnet in their network and monitor the malicious communications between bot and C&C server. But for victim hosts, since it is not run in the internal network. Even though you install malware detector, define Yara rule looks not help! I believed that this is one of the key topic which headache the ISP and cloud services provider.

For mitigation of the attack, a discussion will continuous on the next phase.

 

antihackingonline.com