Huawei launches own operating system to rival Android

Chinese telecom giant Huawei unveiled its own operating system on Friday, as it faces the threat of losing access to Android systems amid escalating US-China trade tensions.
Richard Yu, the head of Huawei's consumer business, told a press conference in the southern city of Dongguan that the new system, called HarmonyOS or HongMeng in Chinese, would “bring more harmony and convenience to the world”.
The highly-anticipated software is considered crucial for the tech group's survival as it confronts a looming White House ban on US companies selling technology products to Huawei which could remove its access to Google's Android operating system.

See: Huawei Vs Trump

Yu said the new system was a “future oriented OS” to be “more smooth and secure”, which he said was “completely different from Android and iOS”.
Huawei said the first version of the operating system would launch later this year in its smart screen products, before expanding across a range of smart devices including wearable technology over the next three years.
“If you're asking when will we apply this to the smartphone, we can do it at any time,” said Yu, adding that they gave priority to using Google's Android operating system, which is compatible with Harmony.
“However, if we cannot use it (Android) in the future, we can immediately switch to the Harmony OS,” he said.
In May the company was swept into the deepening trade war between Beijing and Washington which has seen punitive tariffs slapped on billions of dollars of two-way trade.
Huawei — considered the world leader in superfast fifth-generation or 5G equipment and the world's number two smartphone producer — has been blacklisted by US President Donald Trump amid suspicions it provides a backdoor for Chinese intelligence services, something the firm denies.
On Thursday, Beijing slammed US rules banning Huawei and other Chinese companies from government contracts, saying they amounted to an “abuse of state power”.

'Plan B'

As a result of US moves to blacklist Huawei, American companies are theoretically no longer allowed to sell technology products to the firm, but a three-month exemption period — which ends next week — was granted by Washington before the measure came into force.
That ban could prevent the Chinese tech firm from getting hold of key hardware and software including smartphone chips and elements of the Google Android operating system, which equips the vast majority of smartphones in the world, including those of Huawei.
Huawei has reportedly been working on its own operating system since 2012, but the group has always said publicly it didn't want to replace its Android phones with a home operating system.
Yu told German newspaper Die Welt in an interview published in March that creating their own operating system was “Plan B”.
Huawei will be able to “develop at a lower cost a brand new ecosystem” and “mitigate its dependence on US suppliers for its software needs”, Kenny Liew, technology analyst at Fitch Solutions, told AFP.
However, smartphones using the system would mainly be confined to the Chinese market, Liew said.
Developing an operating system and the entire ecosystem that accompanies it is a complex affair. Apart from Google's Android, the only other popular operating system is Apple's iOS, available exclusively on the iPhone.
Microsoft pulled the plug on its Windows Phone platform earlier this year, and Samsung's Tizen system is barely known compared with Android and iOS.
But without access to the full version of Android or the popular services of Google — not to mention the many applications available on the Google Play store — Huawei may have trouble convincing consumers outside China to buy its phones.

বিস্তারিত পড়ুন

• Share
• Tweet

Black Hat 2019 – WhatsApp Protocol Decryption for Chat Manipulation and More

esearch By:

 Dikla Barda, Roman Zaikin and Oded Vanunu

According to sources, WhatsApp, the Facebook-owned messaging application has over 1.5 billion users in over 180 countries. The average user checks WhatsA more than 23 times per day. And, the number of WhatsApp users in USA is predicted to grow to 25.6 million by 2021.

Given all the chatter, the potential for online scams, rumors and fake news is huge. Threat actors have an additional weapon in their arsenal to leverage the messaging platform for their malicious intentions.

Towards the end of 2018, Check Point Research notified WhatsApp about new vulnerabilities in the popular messaging application that would enable threat actors to intercept and manipulate messages sent in both private and group conversations, giving attackers the power to create and spread misinformation from what appear to be trusted sources.

The Check Point Research team observed three possible methods of attack exploiting this vulnerability – all of which involve social engineering tactics to fool end-users. A threat actor may:

1. Use the ‘quote’ feature in a group conversation to change the identity of the sender, even if that person is not a member of the group.
2. Alter the text of someone else’s reply, essentially putting words in their mouth.
3. Send a private message to another group participant that is disguised as a public message for all, so when the targeted individual responds, it is visible to everyone in the conversation.

WhatsApp fixed the 3rd vulnerability which enabled threat actors to send a private message to another group participant disguised as a public message for all. But, we found that it is still possible to manipulate quoted messages and spread misinformation from what appear to be trusted sources.

Following the process of Responsible Disclosure, Check Point Research informed WhatsApp of its findings. From Check Point Research’s perspective, we believe these vulnerabilities to be of the utmost importance and require attention.

To demonstrate the severity of this vulnerability in WhatsApp, we created a tool that allows us to decrypt WhatsApp communication and spoof the messages.

As is well-known, WhatsApp encrypts every message, picture, call, video or any other type of content you send so that only the recipient can see it. WhatsApp does not have the ability to view these messages.

Figure 1: WhatsApp Encrypted Chat

These encryption processes caught our attention, and we decided to try to reverse the WhatsApp’s algorithm to decrypt the data. Indeed, after decrypting the WhatsApp communication, we found that WhatsApp is using the “protobuf2 protocol” to do so.

By converting this protobuf2 data to Json we were able to see the actual parameters that are sent and manipulate them in order to check WhatsApp’s security.

The outcome of our research is a Burp Suit Extension and 3 Manipulation methods (the 3rd one was fixed our we disclosure the vulnerability to WhatsApp)

To start the manipulation, though, we first have to get the private and public key of our session and fill it in our burpsuit extension.

If you are interested in a detailed explanation about how the encryption actually works behind the scenes, please read the technical details from our blog at 2018:

https://research.checkpoint.com/fakesapp-a-vulnerability-in-whatsapp/

Accessing the Keys

The keys can be obtained from the key generation phase from WhatsApp Web before the QR code is generated:

Figure 2: Public and Private Key of the Communication

After we take these keys, we need to take the “secret” parameter which is sent by the mobile phone to WhatsApp Web while the user scans the QR code:

Figure 3: The Secret Key from the WebSocket

As a result of this, our extension will look like the below:

Figure 4: WhatsApp Decoder Burp Extension

After clicking on “Connect”, the extension connects to the extension’s local server, which performs all the tasks required for the extension.

Manipulating WhatsApp

By decrypting the WhatsApp communication, we were able to see all the parameters that are actually sent between the mobile version of WhatsApp and the Web version. This enabled us to then manipulate them and start looking for security issues.

This resulted in us to carry out a variety of attack types described below:

Attack 1: Change the Identity of a Sender in a Group Chat, Even If They Are Not a Member of the Group

In this attack, it is possible to spoof a reply message to impersonate another group member and even a non-existing group member, for example, ‘Mickey Mouse’.

To impersonate someone from the group, all the attacker need do is catch the encrypted traffic:

Figure 5: Encrypted WhatsApp Communication

Once the traffic is captured, he can simply send it to an extension which will then decrypt the traffic:

Figure 6: Decrypting the WhatsApp Message
By Using Our Extension

The interesting parameters to note here are:

• conversation – This is the actual content which is sent.
• participant – This is the participant that actually sent the content.
• fromMe – This parameter indicates if I sent the data or someone else in the group did.
• remoteJid – This parameter indicates to which group/contact the data is sent.
• id – The id of the data. The same id will appear in phone databases.

And this is the point where interesting things begin to happen…

For example, we can change the conversation to something else. The message with the content “Great!” sent by a member of a group, for instance, could be changed to something else like: “I’m going to die in a hospital right now” and the participant parameter could also be changed to someone else from the group:

Figure 7: A Spoofed Reply Message

Note that we have to change the id to something else because it is already sent and appears in the database.

In order to make everyone see the new spoofed message the attacker needs to reply to the message he spoofed, quoting and changing that message (“Great”) in order for it be sent to everyone in the group.

As you can see in the below screenshot, we created a new group where no previous messages were sent, and by using the method from above we were able to create a fake reply.

Figure 8: The Original Conversation

The ‘participant’ parameter can also be a text or a phone number of someone that is not in the group, which would cause everyone in the group to believe that it is actually sent from this participant.

For example:

Figure 9: Changing The Content Of The Message
By Using Our Debugging Tool

…and the result will look like this:

This would again be sent to everyone in the group as before.

Figure 10: Reply To a Message That Sent From
Someone Outside of the Group

Attack 2: Changing a Correspondent’s Reply To Put Words in Their Mouth

In this attack, the attacker is able to manipulate the chat by sending a message back to himself on behalf of the other person, as if it had come from them. By doing so, it would be possible to incriminate a person, or close a fraudulent deal, for example.

In order to spoof the messages, we have to manipulate the ‘fromMe’ parameter in the message, which indicates who sent the message in the personal chat.

This time we will capture the outgoing message from WhatsApp Web before it is even sent to our Burp Suite. In order to do that, we can put a break point on the aesCbcEncrypt function and take the data from the ‘a’ parameter:

Figure 11: OutGoing Message Manipulation

We will then copy this data to our Burp extension and select the outgoing direction. By pressing on “Decrypt”, our extension will decrypt the data:

Figure 12: Decryption of Outgoing Message

After changing it to false and encrypting it back we then get the below result:

Figure 13: Encryption of Outgoing Message

We have to then modify the ‘a’ parameter in our browser, and the result will be a push notification with the content. In this way, it is even possible to spoof the entire chat.

Figure 14: Sending Messages To Myself
on Behalf of Someone Else.

The whole conversation will then look like this:

Figure 15: Sending Messages To Myself
on Behalf of Someone Else

 Policy

বিস্তারিত পড়ুন

• Share
• Tweet

Daraz removes Odomos from website amid pricing backlash

Leading online marketplace Daraz has stopped the sales of Odomos in the face of severe criticism on social media over the high prices the mosquito repellent cream listed on its platform.

As dengue fever runs rife across Bangladesh, the prices of disease testing kits and mosquito repellent products have increased manifold.

Retailers were charging customers between Tk 300 and Tk 548 for the 50gm cream, which was being sold at Tk 125 until the onset of the ongoing bout of the mosquito-borne viral fever.

The Directorate of National Consumer Rights Protection recently fined some retailers and superstores for selling Odomos at higher-than-usual prices.

Earlier this week, the ostensible overpricing of Odomos on Daraz triggered a backlash on Facebook.

However, two days ago, the e-commerce company decided to remove the product from its website, said Sayontoni Tisha, a spokeswoman for Daraz.

"We’ve decided to remove the product only when we knew that there was no authorised distributor in the country for it," she told bdnews24.com. 

The product was last seen on the platform at 10:52am on Thursday.

Odomos, manufactured by the Indian firm Dabur, was being sold at Rs 92 for 100gm on Amazon.in. And on Thursday morning, the original price of the same product was listed at Tk 600 on Daraz with the product being sold for Tk 400, purportedly at a discount of 33 percent.

"Daraz doesn’t fix the price of the product, but the seller (distributor) does," said Tisha on the price of Odomos on the platform.

But the product was not advertised on the website after Tisha’s comments.

Regarding the price of Odomos on Daraz, Afroza Rahman, assistant director of Directorate of National Consumer Rights Protection Dhaka, said the authorities will look into the matter if they receive a complaint over it.

বিস্তারিত পড়ুন

• Share
• Tweet