IPinside: Korea’s obligatory spyware and adware | Virtually Safe
Word: This text can also be out there in Korean.
On our tour of South Korea’s so-called security applications we’ve already took a look at TouchEn nxKey, an software meant to fight keyloggers by … checks notes … making keylogging simpler. At this time I need to shed some gentle on one other software that many individuals in South Korea needed to set up on their computer systems: IPinside LWS Agent by Interezen.
The acknowledged aim of the applying is retrieving your “actual” IP tackle to forestall on-line fraud. I discovered nevertheless that it collects far more information. And whereas it exposes this trove of knowledge to any web site asking politely, it doesn’t seem like it’s all too useful for combating precise fraud.
How does it work?
Equally to TouchEn nxKey, the IPinside LWS Agent software additionally communicates with web sites by way of an area net server. When a banking web site in South Korea desires to be taught extra about you, it should make a JSONP request to localhost:21300. If this request fails, the banking web site will deny entry and ask that you just set up IPinside LWS Agent first. So in South Korea operating this software isn’t non-obligatory.
Then again, if the applying is current the web site will obtain numerous items of knowledge within the wdata, ndata and udata fields. Fairly a bit of knowledge truly:
This information is meant to include your IP tackle. However even from the dimensions of it, it’s apparent that it can’t be solely that. In reality, there’s a complete lot extra information being transmitted.
What information is it?
wdata
Let’s begin with wdata which is essentially the most fascinating information construction right here. When decrypted, you get a substantial quantity of binary information:
As you’ll be able to see from the output, I’m operating IPinside in a digital machine. It even says VirtualBox on the finish of the output, though this explicit machine is not operating on VirtualBox.
One other apparent factor are the 2 laborious drives of my digital machine, one with the serial quantity QM00001 and one other with the serial quantity abcdef. That F0129A45 is the serial variety of the first laborious drive quantity. You too can see my two community playing cards, each listed as Intel(R) 82574L Gigabit Community Connection. There may be my keyboard mannequin (Normal PS/2 Keyboard) and keyboard structure (de-de).
And in the event you look carefully, you’ll even discover the byte sequences c0 a8 7a 01 (standing for my gateway’s IP tackle 192.168.122.1), c0 a8 7a 8c (192.168.122.140, the native IP tackle of the primary community card) and c0 a8 7a 0a (192.168.122.10, the native IP tackle of the second community card).
However there may be far more. For instance, that 65 (letter e) proper earlier than the laborious drive info is the results of calling GetProductInfo() function and signifies that I’m operating Home windows 10 Dwelling. And 74 (letter t) earlier than it encodes my precise Home windows model.
Details about operating processes
One piece of the information is especially fascinating. Don’t you marvel the place the firefox.exe comes from right here? It signifies that the Mozilla Firefox course of is operating within the background. This info is transmitted regardless of the lively software being Google Chrome.
See, web sites give IPinside agent quite a lot of parameters that decide the output produced. One such parameter is named winRemote. It’s mildly obfuscated, however after eradicating the obfuscation you get:
TeamViewer_Desktop.exe|rcsemgru.exe|rcengmgru.exe|teamviewer_Desktop.exe
So banking web sites are concerned about whether or not you might be operating distant entry instruments. If a course of is detected that matches certainly one of these strings, the match is added to the wdata response.
And naturally this performance isn’t restricted to looking for distant entry instruments. I changed the winRemote parameter by AGULAAAAAAtmaXJlZm94LmV4ZQA= and bought the data again whether or not Firefox is at the moment operating. So this may be abused to search for any functions of curiosity.
And even that isn’t the top of it. IPinside agent will match substrings as effectively! So it could let you know whether or not a course of with hearth in its identify is at the moment operating.
That’s sufficient for an internet site to start out looking your course of listing with out figuring out what these processes may very well be. I created a web page that will begin with the .exe suffix and do a depth-first search. The difficulty right here was largely IPinside response being so sluggish, every request taking half a second. I barely optimized the efficiency by testing a number of guesses with one request and bought a proof of idea web page that will flip up a course of identify each 40-50 seconds:
With adequate time, this web page might doubtlessly enumerate each course of operating on the system.
ndata
The ndata a part of the response is way less complicated. It seems to be like this:
��HDATAIP=▚▚▚.▚▚▚.▚▚▚.▚▚▚��VD1NATIP=▚▚▚.▚▚▚.▚▚▚.▚▚▚��VD1CLTIP=192.168.122.140��VD2NATIP=��VD2CLTIP=192.168.122.10��VPN=2��ETHTYPE=ETH1
No, I didn’t mess up decoding the information. Sure, � is de facto within the response. The thought right here was truly to make use of ∽ (reverse tilde image) as a separator. However since my working system isn’t Korean, the character encoding for non-Unicode functions (like IPinside LWS Agent) isn’t set to EUC-KR. The applying doesn’t anticipate this and botches the conversion to UTF-8.
▚▚▚.▚▚▚.▚▚▚.▚▚▚ alternatively was me censoring my public IP tackle. The applying will get it by two totally different means. VD1NATIP seems to return from my house router.
HDATAIP alternatively comes from an online server. Which net server? That’s decided by the host_info parameter that the web site offers to the applying. It’s also obfuscated, the precise worth is:
www.securetrueip.co.kr:80:/vbank_01.jsc:_INSIDE_AX_H=
Solely the primary two components seem for use, the applying makes a request to http://www.securetrueip.co.kr:80/androidagent.jsc. One of many response headers is RESPONSE_IP. You guessed it: that’s your IP tackle as this net server sees it.
The applying makes use of low-level WS2_32.DLL APIs right here, in all probability as an try to forestall this site visitors from being routed by some proxy server or VPN. In any case, the aim is deanonymizing you.
udata
Lastly, there may be udata the place “u” stands for “distinctive.” There are a number of totally different output varieties right here, that is sort 13:
[52-54-00-A7-44-B5:1:0:Intel(R) 82574L Gigabit Network Connection];[52-54-00-4A-FD-6E:0:0:Intel(R) 82574L Gigabit Network Connection #2];$[QM00001:QEMU HARDDISK:];[abcdef:QEMU HARDDISK:];[::];[::];[::];
As soon as once more an inventory of community playing cards and laborious drives, however this time MAC addresses of the community playing cards are listed as effectively. Different output varieties are largely the identical information in numerous codecs, apart from sort 30. This one incorporates a hexadecimal CPU identifier, representing 16 bytes generated by mashing collectively the outcomes of 15 totally different CPUID calls.
How is that this information protected?
So there’s a complete lot of knowledge which permits deanonymizing customers, studying in regards to the {hardware} and software program they use, doubtlessly facilitating additional assaults by exposing which vulnerabilities are current on their techniques. Certainly this sort of information is well-protected, proper? I imply: certain, each Korean on-line banking web site has entry to it. And Korean authorities web sites. And doubtless extra Interezen prospects. However no one else, proper?
Nicely, the server beneath localhost:21300 doesn’t care who it responds to. Any web site can request the information. However it nonetheless must know easy methods to decode it.
When speaking about wdata, there are three layers of safety being utilized: obfuscation, compression and encryption. Sure, obfuscating information by XOR’ing it with a single random byte in all probability isn’t including a lot safety. And compression doesn’t actually matter as safety both if folks can simply discover the well-known GPL-licensed supply code that Interezen used with out complying with the license phrases. However there may be encryption, and it’s even utilizing public-key cryptography!
So the applying solely incorporates the general public RSA key, that’s not adequate to decrypt the information. The personal secret’s solely identified to Interezen. And any of their quite a few prospects. Let’s hope that every one these prospects sufficiently defend this personal key and don’t leak it to some hackers.
In any other case RSA encryption may be thought of safe even with reasonably sized keys. Besides… we aren’t speaking a few reasonably sized key right here. We aren’t even speaking a few weak key. We’re speaking a few 320 bits key. That’s shorter than the very first key factored within the RSA Factoring Problem. And that was in April 1991, greater than three a long time in the past. Sane RSA libraries don’t even work with keys this brief.
I downloaded msieve and let it run on my laptop computer CPU, occupying a single core of it:
$ ./msieve 108709796755756429540066787499269637…
sieving in progress (press Ctrl-C to pause)
86308 relations (21012 full + 65296 mixed from 1300817 partial), want 85977
sieving full, commencing postprocessing
linear algebra accomplished 80307 of 82231 dimensions (97.7%, ETA 0h 0m)
elapsed time 02:36:55
Sure, it took me 2 hours and 36 minutes to calculate the personal key on very fundamental {hardware}. That’s how a lot safety this RSA encryption offers.
When speaking about ndata and udata, issues look much more dire. The one safety layer right here is encryption. No, not public-key cryptography however symmetric encryption by way of AES-256. And naturally the encryption secret’s hardcoded within the software, there is no such thing as a different approach.
So as to add insult to harm, the applying produces an identical ciphertext on every run. At first I believed this to be the results of the deprecated ECB block chaining mode getting used. However: no, the applying makes use of CBC block chaining mode. However it fails to go in an initialization vector, so the cryptography library in query at all times fills the initialization vector with zeroes.
Which is an extended and winded approach of claiming: the encryption can be damaged no matter whether or not one can retrieve the encryption key from the applying.
To sum up: no, this information isn’t actually protected. If the person has the IPinside LWS Agent put in, any web site can entry the information it collects. The encryption utilized is nugatory.
And the general safety of the applying?
That net server the applying runs on port 21300, what’s it? Seems, it’s their very own customized code doing it, constructed on low-level community sockets performance. That’s completely positive after all, who hasn’t constructed their very own rudimentary net server utilizing substring matches to parse requests and deployed it to tens of millions of customers?
Their net server nonetheless wants SSL help, so it depends on the OpenSSL library for that. Which library model? Why, OpenSSL 1.0.1j after all. Sure, it was launched greater than eight years in the past. Sure, finish of help for OpenSSL 1.0.1 was six years in the past. Sure, there have been 11 extra releases on the 1.0.1 department after 1.0.1j, with quite a few vulnerabilities mounted, and never even these fixes made it into IPinside LWS Agent.
Certain, that net server can also be single-threaded, why wouldn’t or not it’s? It’s not like folks will open two banking web sites in parallel. Sure, this makes it trivial for a malicious web site to lock up that server with long-running requests (denial-of-service assault). However that merely prevents folks from logging into on-line banking and authorities web sites, not an enormous deal.
Taking a look at how this server is carried out, there may be code that basically seems to be like this:
BYTE inputBuffer[8192];
char request[8192];
char debugString[8192];
memset(inputBuffer, 0, sizeof(inputBuffer));
memset(request, 0, sizeof(request));
int rely = ssl_read(ssl, inputBuffer, sizeof(inputBuffer));
if (rely <= 0)
{
…
}
memcpy(request, inputBuffer, rely);
memset(debugString, 0, sizeof(debugString));
sprintf(debugString, "Acquired information from SSL socket: %s", request);
log(debugString);
handle_request(request);
Can you notice the problems with this code?
…
Come on, I’m ready.
…
Sure, I’m dishonest. In contrast to you I truly debugged that code and noticed stay simply how badly issues went right here.
…
To start with, it could occur that ssl_read will produce precisely 8192 bytes and fill all the buffer. In that case, inputBuffer gained’t be null-terminated. And its copy in request gained’t be null-terminated both. So trying to make use of request as a null-terminated string in sprintf() or handle_request() will learn past the top of the buffer. In reality, with the reminiscence structure right here it should proceed into the an identical inputBuffer reminiscence space after which into no matter comes after it.
So the sprintf() name truly receives greater than 16384 bytes of knowledge, and its goal buffer gained’t be almost massive sufficient for that. However even when this information weren’t lacking the terminating zero: taking a 8192 byte string, including a bunch extra textual content to it and making an attempt to squeeze the consequence right into a 8192 byte buffer isn’t going to work.
This isn’t an remoted piece of unhealthy code. Whereas researching the performance of this software, I couldn’t fail noticing a number of extra stack buffer overflows and one other buffer over-read. To my (very restricted) data of binary exploitation, these vulnerabilities can’t be was Distant Code Execution because of StackGuard and SafeSEH safety mechanisms being lively and efficient. If anyone extra skilled finds a approach round that nevertheless, issues will get very ugly. The applying has neither ASLR nor DEP safety enabled.
A few of these vulnerabilities can undoubtedly crash the applying nevertheless. I created two proof of idea pages which did so repeatedly. And that’s one other denial-of-service assault, additionally successfully stopping folks from utilizing on-line banking in South Korea.
When will or not it’s mounted?
I submitted three vulnerability studies to KrCERT on October twenty first, 2022. By November 14th KrCERT confirmed forwarding all these studies to Interezen. I didn’t obtain any communication after that.
Previous to this disclosure, a Korean reporter requested Interezen to remark. They confirmed receiving my studies however claimed that they solely acquired certainly one of them on January sixth, 2023. Supposedly due to that they plan to launch their repair in February, at which level it will be as much as their prospects (which means: banks and such) to distribute the brand new model to the customers.
Like different related functions, this software program gained’t autoupdate. So customers might want to both obtain and set up an replace manually or carry out an replace by way of a administration software like Wizvera Veraport. Neither is especially probably until banks begin rejecting outdated IPinside variations and requiring customers to replace.
Does IPinside truly make banking safer?
Interezen isn’t merely offering the IPinside agent software. In line with their self-description, they’re an organization who focuses on BigData. They supply the service of collecting and analyzing data to quite a few banks, insurances and authorities companies.
On-line I might discover a manual from 2009 displaying screenshots from Interezen’s backend answer. One can see all web site guests being tracked together with their information. Again in 2009 the applying collected barely greater than the IP addresses, however it may be assumed that the present model of this backend makes all the information offered by the agent software accessible.
Along with displaying detailed info on every person, in 2009 this software was already able to producing statistical overviews based mostly e.g. on IP tackle, location, browser or working system.
The aim right here isn’t defending customers, it’s defending banks and different Interezen prospects. The thought is {that a} financial institution can have it simpler to detect and block fraud or assaults if it has extra info out there to it. Fraudsters gained’t merely have the ability to obfuscate their identities by utilizing proxies or VPNs, banks will have the ability to block them regardless.
In reality, Interezen filed a number of patents in Korea for his or her concepts. The primary one, patent 10-1005093 is named “Technique and Gadget for Shopper Identification.” Within the patent submitting, the rationale for the “invention” is the next (computerized translation):
The significance and worth of a technique for figuring out a consumer in an Web atmosphere concentrating on an unspecified majority is rising. Nonetheless, as a result of improvement of varied camouflage and concealment strategies and the restrictions of present identification applied sciences, correct identification and evaluation are very tough in actuality.
It goes on to clarify how cookies are inadequate and the person’s actual IP tackle must be retrieved.
The patent 10-1088084 titled “Technique and system for monitoring and reducing off unlawful electronic-commerce transaction” expands additional on the reasoning (computerized translation):
The current invention is a know-how that allows real-time processing, which was unimaginable with present safety techniques, within the detection/blocking of unlawful transactions associated to all e-commerce providers by the Web, and e-commerce unlawful transactions that can’t however be judged as regular transactions with present safety applied sciences.
This patent additionally introduces the thought of forcing the customers to put in the agent with the intention to use the web site.
However does the method even work? Is there something to cease fraudsters from organising their very own net server on localhost:21300 and feeding banking web sites bogus information?
Okay, somebody must reverse engineer the performance of the IPinside LWS Agent software and reproduce it. I imply, it’s not that straightforward. It took me … checks notes … one work week, proof of idea creation included. Fraudsters actually don’t have that type of time to take a position into deciphering all the varied obfuscation ranges right here.
However wait, why even go there? A replay attack is way less complicated, giving web sites pre-recorded legit responses will simply do. There isn’t any challenge-handshake scheme right here, no timestamp, nothing to forestall this assault. If something, web sites might acknowledge responses they’ve beforehand seen. However even that doesn’t actually work: ndata and udata obfuscation has no randomness in it, the information is predicted to be at all times an identical. And wdata has just one random byte in its obfuscation scheme, that’s not adequate to reliably distinguish legitimately an identical responses from replayed ones.
So it will seem that IPinside is massively invading folks’s privateness, exposing approach to a lot of their information to anyone asking, but failing in need of actually stopping unlawful transactions as they declare. Show me incorrect.