The team over at the FireEye threat intelligence published a special report(pdf) detailing an long running (and still on-going) cyber-espionage operation that has targeted multiple entities in ASEAN countries, including Malaysia. The program was reported to be running for more than a decade, and the sustained period coupled with the list of targets the program had, led FireEye to believe it to be a state-sponsored activity, as no other other type of organization would be able to afford such a professionally run program, operated for such a long period of time with no discernible source of income.

The group were nicknamed APT30, an abbreviation for Advanced Persistent Threat number 30 (I'm guessing the 30 part, because FireEye have other APTs on their github page). APT is a cyber-security term coined to identify an attacker that has both the capability and persistence to target specific entities up until they eventually break, and then continue to suck information from their victims for a significant amount of time. Basically there are script kiddies, hackers and then the 'Advanced Persistent Threats', APTs are a class above the rest.

APT30 operated a suite of tools including back-doors, and command and control software that were given catchy names like Backspace, NetEagle, Flashflood and ShipShape. The tools demonstrated a fair amount of sophistication in the way the functioned, but what really impressed the FireEye team was the level of professionalism that the coders exhibited, the malware had a well defined version control system, automated tools to manage many of the operational task and even the functionality that allowed for the system to be operated 24/7 by a team working on shifts, with one window requesting the operator to enter their 'attendant code'. I wouldn't be surprised if the system even calculated yearly increments, and provided KPI reports in the background.

Last month, a company called MDSec released a video detailing how they manage to brute force hack an iPhone PIN lock. Pretty sweet piece of work, but I thought this would be a good example to understand how hacks work, and how hackers think.

What is a hacker

A hacker is someone who makes system work in an unintended way, because they know have a deep knowledge of the underlying mechanism of the system.

-Keith Rozario (wannabe tech blogger)

Fusion cooking is another example, Asian Sambal wasn’t meant to go with Chicken chops, but somehow chefs make it work (at least some of them do), but you can only do this if you understand things like flavor, taste, and texture work. Otherwise you end up with disgusting combinations like Nasi Jam Strawberry, or Black pepper goreng pisang.

Things in technology are designed to work in a specific way, like asking for username and passwords before granting access, but hackers get the technology to produce unintended results (like allowing access without the credentials)by passing certains steps and processes, because they know what those steps and processes are. For example the iPhone PIN hack I mentioned in the opening paragraph.

Earlier this week I attended a MDeC organized private meeting with Richard Stirling from the Open Data Institute (ODI).The ODI is an institution that hopes to promote the ‘open data’ culture, and founded by a giant of the Tech world, Sir Tim Berners-Lee, which you might remember for inventing a small little thing we call the world wide web.

The meeting was attended by just a handful of folks, some of whom I recognized from a previous Seatti conference I attended, with the audience and topic focus on Open Data (and Big Data) in Malaysia.

The conversation was really good, and broadly speaking touched on 3 key topics. Most of this post is a re-hash from my failing and aged memory, but there's a clearer version of the minutes here from the amazing people of Sinar Malaysia if you're interested in the specifics.

It’s now almost two years on, since that fateful day at the Mira Hotel in Hong Kong when Edward Snowden divulged secret NSA documents detailing unlawful and on-going spying programs carried out in the name of security.

Sure we knew the government had 'a' spying program, and we've all seen Hollywood movies with fictional technology that allowed governments to carry out un-restricted surveillance,  but no one in their wildest dreams would have imagined a government having access to ALL phone calls, ALL e-mails, ALL text messages and ALL transactions...and then storing that information for ALL time.

What we've learnt so far is that the NSA had executed bulk surveillance on the American people (and us poor non-Americans as well) across all channels of communications including phone calls, internet searches and e-mail without a proper court warrant, congressional approval or oversight of any kind. Particularly strange for a country whose own constitution protects the rights of citizens against illegal searches and seizures. I'm no lawyer, but even to layman like me, the bill of rights looks like a masterpiece, and the fourth amendment is a beautifully written piece of law:

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

-4th Amendment to the Constitution of the United States of America

In other words, if you want to search smartphones, computers or e-mail accounts, you'll need a warrant. And the law goes on to state, that warrants can only be issued, upon probable cause, that must be affirmed by a Judge providing the necessary oversight. Finally, even after a warrant is issued,it must state the place of the search and things to be seized. A warrant shall not act as a blanket approval for law enforcement to look through all aspects of the citizens life, but only that which is explicitly stated in the warrant.

[caption id=“attachment_4859” align=“alignleft” width=“256”]

Apache runs nearly 50% of all active websites[/caption]

Recently I moved the hosting for keithRozario.com from a regular hosted platform called WPWebhost to my own Virtual machine on digitalOcean. The results have been great, but the migration process was a bit tedious and took some effort.

I thought I’d share my Apache configurations, so that if you’re thinking of hosting your own WordPress site on an SSL server, you’ll at least have a solid base to start off from. I’m by no means an expert here, but this is what makes sense to me, and if you have any feedback please let me know in the comments.

So let’s start.

keithRozario.com has a new look, and I can hardly contain my excitement.

The blog still retains all its previous content and more glorious content will be on its way, for now take a moment to savour the brand new theme which hopefully is cleaner and easier on the eyes than my previous blogs design. Also enjoy my complementary TLS connection (notice the httpS connection instead of just http) which means you now have a fully encrypted tunnel from your browser all the way to my new server in Singapore, and to round things up, the blog should be much faster now that its hosted it's own dedicated server.

Today I read that our beloved Education Minister is ‘SHOCKED’ that Malaysian students are not on par with their foreign counterparts. 

Shocked? Really?

Just 2 years ago, the good Minister was proudly proclaiming that “The Malaysian education system is on track to becoming among the world’s best”, and this was backed up by a Government Transformation Project (GTP) report.

The US Government host a really cool website called “We the People”, that let’s users petition the US Government for various things. It’s a cool website, because you get really cool request on it.

For instance, in 2013, more than 34,000 people petitioned the US government to  “Secure resources and funding, and begin construction of a Death Star by 2016″, which triggered a response from the Government that was one part Star Wars Fanboy-ism, and one part Science lesson.

Those were exceptions though, the vast majority of petitions are political in nature, with the most popular petition requesting the US Government to formally press charges against 47 Members of Congress for their role in under-mining a nuclear agreement with Iran.

So it was natural that the former US Ambassador to Malaysia, John Malott create a petition to "make the release Anwar Ibrahim a top priority for US policy towards Malaysia". This Petition was then picked up by the likes of Lim Kit Siang and begun garnering significant attention from the Malaysian online community.

Last week was a pretty exciting week for me--it was my first time on TV.

A TV show called VBuzz that was hosted on a Astro Channel 231 called me to be a guest to talk about Cyber Security, obviously I make it point to try new things and let's be honest....how many of you would turn down a chance to be on TV? I mean this is Television, if you're on it you must be good right?! Even if it is a Tamil channel, and it's on at 9pm, I thought this would be exicting...and it was!

Anyway, they scheduled me in for a show on Tuesday, and I happily took some time off work to go down to their studio and all was really great. Until....

The first thing they told me was that I couldn't talk about the recent MAS hack, because they were afraid. The Obvious question I had was--afraid of what? Apparently, MAS was a Government Linked Company, and they couldn't talk bad about a GLC for fear of losing their license. Now I had no intention of talking bad about MAS, just trying to help people understand what happened in the hack, but they were still afraid. So OK, you can still have a 15 minute conversation about cyber security without talking about MAS...no problem.

So I got my 'HD' make-up on, because High Definition recording captures so much detail of your face, that they need special make-up for it. I found that quite amusing, plus I never knew so much effort and co-ordination went into making a production like this.

We started off with 'easy' topics like cyber criminals and hacking incidences, and the conversation was light and flowed pretty well, but then (according to plan) we veered into cyber warfare, which was a topic I was deeply into over the last few weeks. And out pop-ed a question like "What can governments do to ...." to which I responded that "Governments were the biggest perpretators of the crime". This didn't sit well with the producers or the writers, and at the end of the show we did a re-take of that bit, censoring out a my statement, which I maintained wasn't just true, but totally consistent with the entire show.

As the 1MDB fiasco begins to simmer over the political stove, I wanted to inject some technical information into this discussion, specifically around emails and how they’re almost useless pieces of evidence.

Just to make sure everyone’s on the same page, here’s some context.

In early March 2015, sarawakreport.org, a website run by investigative journalist Clare Rewcastle-Brown together with the London Sunday Times, published an article on controversial deal done by the 1MDB fund. At the centre of the deal was a man named Jho Low, who masterminded a sophisticated ‘wheeler-dealer’ that pocketed him $700 Million, all of which (at least according to sarawakreport.org) was siphoned from 1MDB, a Malaysian sovereign wealth fund.

Honestly, I don’t understand the financially complex deals that sarawakreport.org was trying to explain to lil ol’ me. So I’m just going to take her word here, that all the documentation that was produced leads to the conclusion that Jho Low masterminded the “Heist of the Century” by stealing $700 million through shady back door deals involving 1MDB and a company called PetroSaudi. But then of course, the question becomes, can you trust the documentation.

Reading the article you get the sense that the e-mail trail presented forms the backbone of the entire story, and if the emails themselves are not true then the entire story is untrue as well.

In either case though, let’s get straight to the point, and say that e-mails by themselves are quite useless.