Vulnerabilities in Maybank's online banking terminals

A few days back, I had to do some matters in Maybank's Kuching Selatan SSC branch.



It hasn't changed one bit since I was last there almost 3 years ago dealing with them on some financial matters. The layout is still as bewildering as ever, it is completely un-disabled-friendly (for a lack of a better word) and like most places in Malaysia, the air-conditioning is set to artic circle for no good reason. The condensation on the glass walls separating the ATM's from the food path is a testimony to that.

Amongst other things through, there is a computer terminal for one to do their online banking:


Now I applaud the move by banks to have computer terminals in their branches as to allow their customers to do online banking. Most Australian bank branches have this convenience, and this helps me to do some quick money transfers when I'm out.

Generally, the terminals provided by the banks should be the most secure computers to do your online banking with the financial institution. Except this particular one.

Problem no 1:

Internet Explorer 6.

It the web browser that gives web developers sleepless nights, is buggy as hell, and it is impossible to develop websites that render correctly on it without breaking on other browsers. Unfortunately, it is the default browser for Windows XP. The web developer in me cries out "If you're going to use Internet Explorer at least use Internet Explorer 7!"

Secondly, it is a full blown web browser, with an address bar, that one can enter URL's into.



And it has full access to the internet. I could load and surf any webpage. Granted, there is a notice stuck on the keyboard saying "This computer is for use of Maybank2u only" or words to that effect, and it would be really obvious if you camped out there for extended periods of time.

I also noticed that the copy of Windows XP that was running on it had full administrator rights, and it was not patched to Windows XP Service Pack 3.

It doesn't take much imagination to figure out how to exploit this. It is easy to knock up a website using the black and yellow colors of Maybank. There was nothing stopping me setting the default home page of IE6 to some phishing website.

With full access to the internet, I could also have downloaded any of the many keyloggers avaliable and installed on the machine because I had full administrator rights. Torpig anyone?

But I need not have had access to the internet. A quick glance down showed that the USB ports were for all to see:

with a floppy drive and a Aztech 605E ADSL modem.

Remember that it was not patched with Service Pack 3? I could have used any flash drive as a infection vector. A simple Autorun.inf file, a keylogger, connected to the control bot. It would take me less than 30 seconds to infect the machine and have access to anyone who accessed their bank account using that machine. Plugging in any (infected) flash drive would almost be undetectable.

Think using Maybank's TAC would keep you safe? Think again. Like most Two-factor authentication mechanisms, it is vulnerable to a replay attack. It takes me less than 15 seconds to empty a bank account by using your TAC that you used for another transaction. Not to mention in Bolehland, intercepting SMS'es is not that hard.

There was also no sign for any anti-malware protection on the terminal, a worrying sign considering that anyone had full administrative rights using the machine. I don't know about you, but personally that machine would be the last machine that I'd use to log on to any kind of internet banking.

The "fix" for this "problem" is glaringly simple. It doesn't cost much either. Blocking unused ports is easy. Patching Windows XP to SP3 and disabling autorun.inf is not that hard. The latter is one line of registry code.

Do we need to close the door after the horse has bolted?

Uptime, part 2

For a OS that is hitting the 8 year old mark (almost a lifetime in software development years), Windows XP is a really good operating system.

Voter Registration

A few weeks back, I decided to register myself as a voter to be eligible to vote in the coming elections.

A quick hop over to the Electoral Commissions website will highlight where you can register to vote. It includes any post office, excluding the mom-and-pop run "mini" post offices. The Kenyalang Post Office is the closest to me, so there I went.

I must say, their refurbishment looks very nice. The last time I was there 3 years ago it looked like the place had not changed since it was built in the 70's, with the mini tiles on the floor, no place to sit and a general air of malaise in the whole place. At least the place is now airconditioned (even if it is permanently set at artic circle), there is seating and instead of standing in line you get a number.

For those keeping count, the next Sarawak state election would have to be called by April 2011, while the next Federal elections would have to be called by February 2013. A mandate is for 5 years, through most of the time the political leaders will try and call an election when they have the most support before the 5 years is up.

An interesting quirk of Malaysian Federalism is while the state and Federal elections are held simultaneously in West Malaysia, in Sarawak they are held at different times, while Sabah has the right to hold them at different times, they now hold them at the same time as the Federal elections.

I decided to register to vote to avoid the usual last minute rush like most Malaysians. Also, it does take time for new additions to be registered into the Electoral Comissions database, which in Bolehland means 6 months at least. So signing up to vote during the electoral campaign does not mean that you can vote on election day.

It is simple to register to vote really. All you need is:

your identification card, and thats it!

Admittedly, most of the time is spent waiting in the post office waiting for your turn. But its really simple really. Just give them your MyKad, which will be scanned and the person in charge will ask you a few questions like "Have you ever voted?" and "Are you registered to vote in any other place?". Its all done reasonably quickly, and you should get a piece of paper documenting that you have been officially registered as a voter.

Voting is open to all Malaysian citizens aged 21 and above, so can't be too hard trotting over to the post office, amongst other places, to register to vote. Remember, if you want change, you need to exercise your power to do so.

Shout out to Bivian at the Kenyalang post office for processing my voter registration. She was very friendly and polite. Being quite cute doesn't hurt either. :D

Shugo Chara Party 12

I can think of 2 things that are wrong in these scenes:

Welcome back, Tokyo Toshokan

Its great to have you back.

Currently still hosted in the land of DCMA through:


Their alternate domain, tokyo-tosho.net is still pointing to their old server:

DNS propagation takes some time.

T-Mobile Kuching

Okay, first we have an illegitimate Engadget store in Malaysia, now T-Mobile of Kuching?!

Spotted at BDC Kuching. The also do cold drinks by the way.

10,000 medical students

I know illegitimate Perak menteri besar Dr Zambry Abdul Kadir has been accused of being drunk on power, but it was with a bit of an amusement I read this Bernama article that he thinks that a medical university can have an intake of 10,000 (yes, its not a typo, unless Bernama, NST and The Star have failed the check-and-balances test) medical students.

Whatever he's having, I'll have some.

On a related note, is Zambry allowed to use the "Dr" title in his name? He is not a medical doctor, nor has he ever done any academic achievement to warrant the use of the "Dr" title. The "Dr" title comes from his PhD at Temple University. Interestingly, his PhD dissertation is titled "Religion and politics : the search for political legitimacy of the Pan-Islamic party of Malaysia".

Disecting the Netgear WGR614

Almost 2 years ago, I said a sad farewell to 2 of the most loyal subjects in my family: the simultanenous demise of my Aztech 605EU and the Netgear WGR614.

Back then, I could not open it, because of what I called a "the weird and proprietary screw" that held it in place.



2 years later, more informed and educated, I learnt that it was simply a torx screw that was seperating me from the Netgear WGR614. A simple trot over to OneTJ to buy a torx screwdriver set was the trick. RM19, a hell lot cheaper than the A$15 that I would have to shell out in Australia.

The overview:


Back then, I wrote on how its life was cut short by people foolishly stacking it on top of the Aztech 305EU. in the Malaysian tropical heat. Opening it up showed how much damage the heat caused.

If you look at the top panel at the top of image above, they voltage regulator also gave up to the ghost, with some black scroch marks where the voltage regulator is on the circuit board. The brown discoloring on the plastic covers show the change caused by the heat.

Overview of the circuit board:


A simple piece of hardware really, but top notch components, which made it probably the best wireless router I ever had even to this day, in a age where 802.11g wireless networking is pratically ubiquitous.

The thing is controlled by a Marvell 88W8510 chipset :


At the top is the 88W8510 Access Point/Gateway Chip, and the shinny thing at the bottom of the image is the 88W8000G RF-Baseband Transceiver. Nice stuff. The block diagram for the 88W8510 is an interesting read to say the least.

The 88W8510 chipset holds a ARM9 processor, clock speed unknown. Interestingly it has support for 802.11 QoS, something I never noticed in the Netgear WGR614 or even used.



Storage is provided by two EtronTech EM636165 (left of above picture). DRAM flash memory provides storage for the router OS firmware, with the 2 chips run in parallel providing 2MB of flash memory.

On the right is a Macronix International MX29LV800TTC-70 that provides 1MB of CMOS ROM flash memory holding the OS, and where the original firmware is loaded when you do a hard reset on your router. The datasheet is also an interesting read, if a little dry. Looks like it it still reasonably popular through, even if Marconix has stopped making them.


Ethernet connectivity is provided by a Marvell 88E6060 switch. It is some high end stuff, designed for SOHO use. The specification sheet shows that it can support up to 6 ethernet ports, through Netgear only decided to provide 4 ports for the Netgear WGR614. I can't find the circuit that links the Ethernet switch to the LEDs through.

Interesting to read that the Marvell Technology Group is founded by a couple of Indonesians. I must say the particular chipsets used in the Netgear WGR614 is some good stuff. A bit of a shame they closed down their Penang plant through.

P1 coming to East Malaysia?

It was with some interest that I read a Bernama report timestamped 15 December 2009, 1531 hrs +0800, that Packet One Networks P1 is looking at a July launch in East Malaysia, specifically Sabah, by July 2010.

As far back as October there were announced plans by P1 to try and enter the East Malaysian broadband market "by mid-2010".

I have to ask through, how on earth are they going to do that? When the WiMax spectrum allocation were handed out in 2007 (after a last minute abort) only 1 operator, Redtone, was allowed to operate in East Malaysia.

If you look at the spectrum allocation for the 2.3GHz band in Malaysia, P1 is only allowed to use the bandwidth of 2.360Ghz to 2.690Ghz. Redtone is allocated the 2.375Ghz to 2.400Ghz bandwidth range. It doesn't take a genius to figure out that P1's allocated spectrum clashes with Redtone's allocation.

Unless Packet One gets a new Wimax license, I can't see it depolying in East Malaysia. Personally the MCMC should just give YTL's (Y-Max Networks Sdn Bhd) allocation to Packet One. At least the latter is doing something with it. A year after it "stared rolling out to selected businesses in Bukit Bintang" it is nowhere to be seen.

Malaysia Crime

Was randomly surfing the world's slowest LAN (read: Malaysia's Internet infrastructure) when I found myself on Amax's website:



What caught my attention through, was the rather graphic image bit at the top-right corner called "Malaysia Crime". A quick click revealed that it leads to a website, www.malaysiacrime.com



It is a very interesting website concept, with the use of the Google Maps API to produce a mashup, allowing people to put "pins" to indicate where a crime has been reported. It has a mix of Malaysian media reports, personal reports from victims and a mix between the two.

The About page and the Whois reveals that it is the effort of a person called Kegan Gan, who setup malaysiacrime.com after having a brush with the crumbling pieces of what is left of (civilised) Malaysian society.

I personally think it is interesting that while he recounts the horrible crime to his friend from March 2009, the whois data shows that Kegan Gan has held the malaysiacrime.com domain since 23 Jan 2008. Also, I find it sad that while Asiaspace, the parent company of Amax did throw its support behind malaysiacrime.com, the website is hosted on ThePlanet.com's servers.

As a human, I find it depressing that the map is filled with so many petty crimes, seemingly the bulk of them sponsored by Khairy Jamaluddin. As a Sarawakian, I find it insulting that the map centres on west Malaysia, as if there is no crime in Sarawak and Sabah.

10 green christmas trees

I wonder, why do I feel like going "10 green bottles" when I see this?

Spotted at Green Hights Mall. I must say it is quite a nice place. The poor (mini) post office there is a wee bit under-utilised through.

You know we're slow when....

Sarawak's Deputy Chief Minister's daughter is complaining about the lack of Internet speeds.

What does the (Malaysian) Chinese want exactly?

Was reading Sin Chew when I came upon this opinion piece. Go ahead and read it. I'll wait.

It is a sign of how important the issue of an extra subject in SPM is for the Chinese community, there is even a special category for it in Sin Chew's website.

It is an open secret that the "allowing" of SPM students to take another 2 subjects, a flip-flop reversal of the previous 10 subject cap to stop this "17 A1" madness (I'm not kidding), was racially motivated. The 教总 has been openly calling for it since the limit was introduced, a call that was bolstered with Muhyiddin's praise of Chinese vernacular schools.

I have to say 林明华's opinion piece reflects the ethnic Chinese in Malaysia: confused, with no sense or direction. He starts off by admonishing the Chinese community of Malaysia for not being happy with the "chance" to take 12 subjects in SPM 2010, and ends with a thinly veiled attack on what Rita Sim would call the "G2s" (mirror of link here) for not sending their "Chinese" children to support the Chinese vernacular schools.

As someone who came through the Chinese education system (albeit for only 6 years), and while I will concede that Chinese language vernacular schools have done a lot of good for Malaysia as a whole regardless of rage, religion and creed, the whole issue of being able to take an extra 2 subjects in SPM personally is moot, something that the Chinese radicals only know how to whip up.

Many students don't take Mandarin at SPM due to diminished chances of getting the government public service scholarship when you have a A2/B3 for Mandarin. On a more practical note, we could take a leaf from the UK A-Levels, where only the core subjects are taken into account into university admission. So go ahead, do 17 subjects, but only 10 of them will be considered when applying for university entrance/deciding to award the government public service scholarship.

The Chinese of Malaysia are probably their greatest enemy.

Of TLS digital certificates and cipher strength

Noticed something lately: browsers do not see the cipher of TLS/SSL certificates equally.

For instance, take paybillsmalaysia:

Seamonkey sees it as a 256-bit AES cipher:



Firefox sees it as a 256-bit AES cipher also:



But Google Chrome sees it differently:



I wonder why. Surely the days of are export phrobitions over already?

(ps. I thought Randall's take on cryptology and the (US) Second Amendment was brilliant)

Shugo Chara Doki ep 58

I don't know about you, but I thought Yoru's rap wasn't half bad.

Shugo Chara: The Musical

Is it just me, or does Tamura Meimi (田村芽実, born 30 Oct 1998 (Yes, I know I'm old), likes swimming, favorite food is an egg (was that a factor in selecting her for the musical?), not good in maths) make quite a good Yuiki Yaya?


Source.

Also, as if more proof was needed that Ikuto is awesome:

The reason I am ruined for life, part 2

Source.

In unrelated developments, I have no idea how anyone gets any work done in Malaysia. The internet is too slow.

Malaysian government websites

A few days ago, the "Malaysia Government Portals and Websites Assessment 2009" was released by the Multimedia Development Corporation (MDeC, formerly MSC).

It highlighted that only 7 government websites earned a 5 star rating.

While I do not dispute the list,

Malaysian Finance Ministry
The Prime Minister's Office
The Malaysian Administrative Modernisation and Management Planning Unit (Mampu)
The Minerals and Geoscience Department
The Housing and Local Government Ministry
The Selangor State Secretary's Office myGovernment Portal

I'd say there are 2 sites that deserve some credit, namely KSWP the Malaysian Meteorological Department's website. As a web developer I am impressed at how they did their bilingual website(s), even if KWSPs English version is a bit suspect grammatically.

Personally Mampu's website has too much flash. I hate flash and frankly the only time flash is needed is when some kind of video is needed, not for banners. Still, I can see at least consideration was taken for visually impaired and elderly people.

The Minerals and Geoscience Department's website is very nice, but:


was this really necessary?

"By the middle of next year, the broadband penetration will be awesome": Dr Rais Yatim

I had a chuckle at this Bernama article (mirror here in case it is taken down or corrected) which quotes Information, Communication and Culture Minister Datuk Seri Dr Rais Yatim during question time saying:

"By the middle of next year, the broadband penetration will be awesome with the speed of 4mbps increased to 10mbps, while some broadband centres will attain the speed of at least 4mbps," he said.

Now Shugo Chara is awesome. Attainable ADSL 2+ speeds is awesome. However, I'm not quite sure if broadband penetration can be awesome. Sure, having the highest broadband penetration rate in the world would be great. Having broadband on the same level as power, electricity and press freedom is a step forward. But "10mbps" being "awesome" broadband penetration?

The answer to this is actually a mis-translation. If you read the Malay version of the Bernama article (mirror here), and keep in mind that Malay is used as the medium of communication on the Malaysian parliament, it makes more sense:

“Pertengahan tahun depan, penembusan jalur lebar akan jadi lebih hebat dan dijangka kelajuan daripada 4mbps meningkat kepada 10mbps akan kita capai, jadi PJK(Pusat Jalur Lebar) ini akan dilengkapkan dengan kemudahan sekurang-kurangnya bagi mencapai tahap kelajuan 4mbps,” katanya.

Until the final Hansard of this session's (19 November 2009) Dewan Rakyat comes out, I can't really say, but interesting insights can be gleaned from the draft version of the Hansard (take a look at pages 22-23).

Then again, I suppose I shouldn't expect too much from a minister who once confused broadband quality with broadband penetration. (See here for context)

This is what I'm going back to

Seriously, my neighbors (note plural) back home aren't kidding. I can hear my brother practicing half-way across the world.

Admittedly, that is through international trunked circuits. But I feel their pain. And people wonder why I don't like music when the rest of my family is music literate. And don't get me started on K-ON! (yes, spelt with the exclamation mark; no I am not incapable of correct punctuation; blame Houbunsha and KyoAni for the horrors we have to go through)

via here.

When participatory media goes too far

Heard this on ABC Radio this afternoon. It is an indication when so-called "citizen journalism" goes too far.

The reason why I love Australia, part 2

Just a little bit more, and I'll be able to balance out my ratio.


Isn't it amazing that my actual upload speed (ADSL 2+) here is faster than the theoretical download speeds available to consumers in Malaysia?


Also,

Is that actually IPv6?

Netbooks

I've just noticed that Dell Malaysia has reduced their price of their Mini 10v netbook from RM1299 to RM1199.



That is not a bad price, to be honest. While Asus may be trailblased the netbook market with their Eee 701, I dare say the Dell Mini 9 is probably the perfect netbook: not too big, not too small, reasonably decent keyboard. I was a bit sad when Dell stopped making the Dell Mini 9.

It is cheaper than most netbooks on the market. Tempting, it is.

Shugo Chara Party 07 (or ep 109, depending on which index you use)

Nadeshiko (+ Temari) returns!


This is a trap......


This is a ....................who am I kidding?


This is priceless, not to mention wrong on so many grounds.


I don't know who comes up with these names, but seriously, Rimahiko anyone?


This is the reason why Shugo Chara is awesome. In the absence of Ikuto, this will do.

Yeah, there is a trap in Shugo Chara.

On a more serious note, the round 1 audition for the live-action Dia Chara was announced this week. I'm not entirely convinced that the live-action bits of Shugo Chara Party is necessary, to be honest.




As a Malaysian, I can't imagine parents allowing their children to audition for a spot like Shugo Chara. I just can't see it. Near complete lack of an Malaysian entertainment industry notwithstanding, our parents are too protective. I can't imagine a parent that will allow any child to be a child actor.

That, and the fact that there are only 4 jobs in Malaysia (Engineer, Medical Doctor, Accountant, Lawyer). I have no doubt that there are no lack of young Malaysians who wanted to be either on the big or small screen, but never got the chance, either from parental pressures or a system of post-secondary education that is designed to give applicants the course they did not want.

As for me, I'll be watching Maeda Yuuka to see how she ends up. Besides, I can't act anyway. Not to mention I'm getting old.

CLANNAD ~After Story~ fanbook

I am still peeved despite being forced to pay 2800 yen for EMS shipping, they still don't work on weekends, and my stuff gets stuck at the Sydney International Mail Handling Centre. And when it comes up to Brisbane, it still gets stuck.

At 2800 yen, I expect them to work on weekends!


Unboxing:


First look:



I must say I am quite pleased this time with the packaging. The book was all nicely wrapped up on plastic, and smelt very nice. While I still feel that the packaging of the box tends to be a bit excessive, it is well padded, and should last any hard knocks around without damaging the contents.

Still, I would have preferred bubble wrap over standard paper through.

First flickthrough:


Maybe its just me, and me aging (and unable to keep up with sieving through the chaff in moe.imouto to get to the gems), but there was a lot of artwork that I had never seen. I highly doubt it is exclusive to the fan-book; more likely I haven't been keeping up.

This is what age does to you kids.


OL Tomoyo! Oh God.

I'm still digesting all that CLANNAD goodness, but first impressions is that KyoAni has serious QC issues for the ~After Story~. This is what happens when the masses demand all that moe and Mio crap.

But in the meantime:

Its Misae's cat! Its such a cute cat. I want the cat. And it goes "meow", like a normal cat.