Owledge

owledge

If you own cryptocurrency, you are among an estimated 8% of the US population who does. Chances are that you keep your coins in a software wallet, either at an exchange like Coinbase or using one of the many open source options available like Ethereum Wallet or Core. Some of you may have taken the next step and bought a hardware wallet to secure your keys. Bitcoin The Trezor One, Ledger Nano S, and KeepKey are among the most popular hardware wallets on the market today. While they each have distinct advantages in terms of their architectures and the currencies they support, they all serve to store your private keys securely. Hardware wallets allow you to sign transactions directly on the device so that your keys are never exposed outside of the device. The advantage of this approach is that even if a hacker compromises your desktop system, they will not be able to get access to your crypto stash or interfere with your transactions. crypto I recently bought a Trezor One. After transferring some currency to the wallet, however, I quickly realized there was little fun to be had with these devices apart from the initial currency transfer. There’s no point in carrying these wallets around town with you, because cryptocurrency infrastructure is pretty much non-existent at this time. So, hardware wallets sit unused on shelves or in a safes, quietly protecting keys and coins from harm. But that’s boring. What else could we do with all these hardware wallets? How about some gaming! Given all that crypto has taken from the gaming community — driving up GPU prices by hoarding for mining rigs — it’s time crypto gave something back. Ladies and gentlemen, I present to you an ageless classic running on the Trezor One: Pong. While the display is rather small and there are only two buttons, The Trezor One is still a fun little device for learning how to program embedded devices. The processor is the , which has an ARM 32-bit Cortex-M3 CPU. There’s about 1MB of flash storage available and 128KB of RAM. The device has a 128x64 bit OLED display and two buttons. STMicro STM32F205 If you’d like to write your own firmware for the Trezor One, here are some instructions to get you started. Setting up the Build Environment These instructions assume you’re running Ubuntu 18.04 LTS, but with a little tweaking they’ll work on any box. These steps work against version v1.6.2 of the firmware. Get the Trezor Source Code First step is to download the . Trezor source code $ mkdir workspace$ cd workspace$ git clone https://github.com/trezor/trezor-mcu.git Install the Dependencies Next, you’ll need to install all the dependencies required to build. sudo apt install build-essential python python-pip libsdl2-dev Download and extract the . GNU ARM Embedded Toolchain $ cd workspace$ tar -xjf ~/Downloads/gcc-arm-none-eabi-7-2018-q2-update-linux.tar.bz2$ echo "export PATH=~/workspace/gcc-arm-none-eabi-7-2018-q2-update/bin:$PATH" >> ~/.bashrc$ source ~/.bashrc You’ll also need to install Google Protocol Buffers. Unfortunately, the packages provided by Ubuntu are too outdated, so you’ll need to get the latest version on your own . here $ cd workspace$ mkdir protoc$ cd protoc$ wget $ unzip $ echo "export PATH=~/workspace/protoc/bin:$PATH" >> ~/.bashrc$ source ~/.bashrc https://github.com/google/protobuf/releases/download/v3.6.0/protoc-3.6.0-linux-x86_64.zip protoc-3.6.0-linux-x86_64.zip Finally, install a few Python modules. $ pip install protobuf ecdsa Build the Firmware Now that you’ve got all the dependencies installed, you’re ready to build the firmware. To build the firmware: $ cd ~/workspace/trezor-mcu$ ./script/setup$ ./script/cibuild The freshly built image will be stored at firmware/trezor.bin. We’ll discuss what to do with that image a little later on. Trezor Emulator If you plan to create your own Trezor firmware, chances are that you won’t get it right the first time you try it out. To shorten the modify code/build/load cycle, you can use the Trezor emulator to test out your changes without having to actually load the firmware on the device. Here’s a screenshot of the emulator running. The 128x64 OLED display appears in its own window. The buttons are simulated by Left-Arrow and Right-Arrow key presses. Trezor One Emulator To build the emulator, you need to set some environment variables and run the setup script again to clear out any previous build artifacts. $ cd ~/workspace/trezor-mcu$ export EMULATOR=1 TREZOR_TRANSPORT_V1=1$ ./script/setup$ ./script/cibuild The emulator executable shows up in the firmware directory and can be run like this: $ ./firmware/trezor.elf Customizing the Firmware Okay, now you’re all setup to build the device firmware and the emulator, so you’re ready to create your own Trezor firmware! The entry point into the Trezor app firmware is found in the main function in firmware/trezor.c. You can simply delete everything after the initialization in that function and start writing your own code. Drawing to the Display One of the first things you’ll want to do is draw to the display. The Trezor display is a 128x64 OLED, where the pixel (0,0) is at the top left corner of the screen. The display chip hardware is accessible via the SPI bus (see oled.c), but you won’t need to interact directly with the hardware. The Trezor firmware provides a simple API in oled.h for drawing and printing to the display. The display API is contained in oled.h and is very straightforward. #define OLED_WIDTH   128#define OLED_HEIGHT  64#define OLED_BUFSIZE (OLED_WIDTH * OLED_HEIGHT / 8) void oledInit(void);void oledClear(void);void oledRefresh(void);void oledSetDebugLink(bool set);void oledInvertDebugLink(void);void oledSetBuffer(uint8_t *buf);const uint8_t *oledGetBuffer(void);void oledDrawPixel(int x, int y);void oledClearPixel(int x, int y);void oledInvertPixel(int x, int y);void oledDrawChar(int x, int y, char c, int zoom);int oledStringWidth(const char *text, int font);void oledDrawString(int x, int y, const char* text, int font);void oledDrawStringCenter(int y, const char* text, int font);void oledDrawStringRight(int x, int y, const char* text, int font);void oledDrawBitmap(int x, int y, const BITMAP *bmp);void oledInvert(int x1, int y1, int x2, int y2);void oledBox(int x1, int y1, int x2, int y2, bool set);void oledHLine(int y);void oledFrame(int x1, int y1, int x2, int y2);void oledSwipeLeft(void);void oledSwipeRight(void); For example, to draw a pixel at a certain position (x,y): oledDrawPixel(x,y); Drawing bitmaps is simple too once you understand the format of the data required. The oledDrawBitmap function takes a pointer to a BITMAP structure, which looks like this: typedef struct {uint8_t width, height;const uint8_t *data;} BITMAP; The “width” and “height” fields specify the dimensions of the image. The “data” array consists of the pixel data starting with the upper left corner of the image. Each byte represents 8 pixels with the least significant bit position corresponding to the leftmost pixel (i.e., little endian). The bit value 1 means white and 0 means black. If you want to display standard Windows bitmap files, you’ll have to do two things. First, you’ll need to scale the image down to the 128x64 size display. You can do that with an image editor like Gimp, or even more easily with the convert utility on Linux: convert title.bmp -resize 128x64 title_resize.bmp The second step is to convert the bitmap file to a C array usable by the Trezor display API. I wrote a script to convert standard Windows bitmap files to the C array format used by the Trezor API. The input bitmap must be in 24-bit mode, which means that each pixel is stored as three bytes, one byte for each color (red, green, and blue). The script converts the middle byte (green) to either 0 or 1 since the Trezor display is black and white. You can find the Python script called bmp2trz.py . here Converting Bitmap forTrezor API Reading Buttons The Trezor has two buttons which are referred to as “Yes” and “No”. The button API is exposed in buttons.h. There is a global variable holding the button state called “button”, and this structure has the following fields: struct buttonState {volatile bool YesUp;volatile int YesDown;volatile bool NoUp;volatile int NoDown;}; There are two ways to read the button state. You can either check to see if the button is currently held down, or you can check to see if the button was pressed and released. Before reading from the global button variable, first call “buttonUpdate” to update the state. Then you can simply test the global button variable fields directly. For example, here’s some example code to wait indefinitely for either button to be pressed: do{delay(100000);buttonUpdate();} while (!button.YesUp && !button.NoUp); Installing the Firmware To load your custom firmware onto the device, you first need to get the device into bootloader mode. Bootloader mode is entered by pressing and holding both buttons down as you plug in the Trezor to the USB port. When you’re in bootloader mode, the screen appears like this: Trezor One in Bootloader Mode With the Trezor in bootloader mode, you can upload your custom firmware image using the trezorctl utility. To install the trezorctl utility, you’ll need to install the following: $ sudo apt-get install python3-dev python3-pip cython3 libusb-1.0-0-dev libudev-dev$ pip3 install --upgrade setuptools$ pip3 install trezor[hidapi] Then you can install your firmware as shown below. Be careful at this step! This operation will completely erase the image along with any keys you have setup on the device. Do not proceed if you have significant value stored in your wallet and you are unsure of what you are doing. I recommend you double check that you have your seed words safely stored on paper before loading new firmware onto the device if you actually have any currency stored on your wallet. $ trezorctl firmware_update -f firmware/trezor.bin Firmware fingerprint: f5392f9b390b6381bfaa24a39a7ed0f7eba2e9cbfa21b9c224ce500b38918766 Please confirm action on device... You’ll have to acknowledge that you want to go ahead and erase the current image and load a new firmware image onto the device. Here’s a video showing the upgrade process. To be clear, during the upgrade process and on every subsequent boot thereafter, the bootloader detects that the upgrade image is not signed by Satoshi Labs and prompts the user if they would like to proceed with the unsigned firmware. If you would like to get Pong running on your Trezor, you don’t have to implement the game from scratch if you don’t want to. There’s a fairly simple implementation on github by user flightcrank which you can find . I already ported that version to the Trezor with minimal changes, so if you’d like to start with my port of flightcrank’s Pong implementation to the Trezor One, you can find that code . here here _trezor-pong - Porting Pong to the Trezor One_github.com syscall7/trezor-pong Pong Start Screen Happy coding!

Finally, a use for my crypto wallet!

This year, cryptocurrency has experienced a rough ride — the value of Bitcoin, Ethereum, and other digital currencies has plummeted by over 60%. Even though the crypto market has taken a downturn, the industry is still growing. And yet, it's unfortunate that people think of smart contracts as just an extension of finance (DeFi) or a generalization of the Web (Web3), whereas they are platforms for composable computation. Companies such as StarkWare are developing new methods for increasing blockchain scalability. For instance, s or ero nowledge calable ransparent rgument of nowledge is a trending innovation for financial privacy on the blockchain with the use of fast, scalable computations. zk-STARK Z K S T A K What are zk-Starks? The innovation behind zk-STARKs is in operating as a Layer2 network over the Ethereum blockchain, which is usually called Mainnet. Zero-Knowledge allows users and developers to use all benefits of security and composability of the Mainnet. Generally, this is the result of the cryptographic algorithms and hardcore mathematics lying within this algorithm. Those who are familiar with Ethereum know that Solidity is the main programming language for smart contracts. In the same way, StarkNet has its own native language for dApps called Cairo, which is designed to scale Ethereum. Its advantage is the provable computation in the same way that Solidity has enabled composable computation. In simpler terms, Solidity language interfaces are primarily developed for contract-to-contract interaction, which exactly means “composable” computation. In the Ethereum network, each validation requires a re-run of a transaction. In comparison, StarkNet offers much more economical operations, where transactions are validated by verifying that they have been executed with a certain outcome. It became possible with ZK Roll-ups, enabling a new paradigm called Provable Computation. What is Cairo lang? If you are looking for a cost-effective provable computation programming language, consider Cairo. It’s native to Provable Computation and includes low-level access to memory, underlying primitives, and functional-style programming. Listed below, are some of the benefits of Cairo: It is a specially designed, provable language for smart contracts It is not bounded by the EVM Its functions are imported rather than inherited It supports Solidity to Cairo transpiler It includes full low-level access to underlying primitives In its purest form, Cairo's source code looks similar to ASM code. The only values that may change over time are held within designated registers: - points to a yet-unused memory cell. ap (allocation pointer) - points to the frame of the current function. The addresses of all the function’s arguments and local variables are relative to the value of this register. When a function starts, it is equal to ap. But unlike ap, the value of fp remains the same throughout the scope of a function. fp (frame pointer) - points to the current instruction. pc (program counter) For example, if I want to calculate , using an allocation pointer, I can directly access the memory: x^4 + x [ap] = 3; ap++
[ap] = [ap - 1] * [ap - 1]; ap++
[ap] = [ap - 1] * [ap - 1]; ap++
[ap] = [ap - 1] + [ap - 3]; ap++ Here's one more interesting example of how loops are organized in Cairo. In the example below, you can see the Cairo function that computes the sum of the elements of an array: # Computes the sum of the memory elements at addresses:
# arr + 0, arr + 1, ..., arr + (size - 1)

func array_sum(arr:felt*, size) ->(sum:felt):
	if size == 0:
		return(sum=0)
	end

	# size is not zero
	let(sum_of_rest)= array_sum(arr=arr + 1, size=size - 1)
	return (sum=[arr] + sum_of_rest)
end is used in Cairo as a replacement for the loop structure. The main reason for this is that Cairo’s memory is immutable, so there is no chance to change a memory cell in the future.
For those who are not familiar with raw assembler source code, C-style programming languages, or functional programming languages such as Haskell or F#, it may be a bit scary at first. Yet, it is a strong advantage for developing memory-effective code. The recursion Jumping from the raw Cairo code to StarkNet, you open a syntax sugar straight out of the box: %builtins output
from starkware.cairo.common.serialize import serialize_word

func main{output_ptr : felt*}():
    tempvar x = 41
    serialize_word(x)
    return ()
end If you're interested in learning more about the Cairo syntax, I encourage you to read the and a nice repo . official documentation starknet-cairo-101 Top 10 resources to help you learn Cairo in 2022 Cairo is a modern programming language that was created in 2020 and started its rise to popularity in 2022, with the growth of the StarkNet ecosystem. Are you interested in learning Cairo in 2022? Here are 10 resources about Cairo programming and StarkWare for you to check out: –  a Q&A forum with payable bounties for questions and answers about Cairo which the promising “crypto StackOverflow” is launching this August. Narcissa –  a curated list of awesome Cairo-related resources, libraries, tools, and more. Cairo Resources List - a guide on how to install Cairo and StarkNet Setting up the environment – a must-read for all Web3 enthusiasts Starkware Cairo Whitepaper – the official list with documentation, playground, whitepaper, and other resources Cairo Resource Guide – a workshop for learning how to deploy and customize the ERC721 token on StarkNet. starknet-erc721 - a low-level explanation of Cairo's mechanics. How Cairo Works - tutorials for writing various simple Cairo contracts. Hello Cairo - an in-browser Cairo IDE, examples, and puzzles. Cairo Playground - helpful tips for new StarkNet/Cairo programmers. Practical StarkNet lessons learned Here are some notable GitHub and social communities related to Cairo: –  the Cairo Devs Telegram community. Cairo Gang –  a Twitter community for Cairo-related discussions and topics to follow. Cairo Lang Twitter – the StarkNet server, where all participants discuss and share. StarkNet Discord – the official list with documentation, playground, whitepaper, and many other resources. Cairo Resource Guide – a curated list of StarkNet projects. Awesome Starknet – a comprehensive, annotated list of repositories of the StarkNet ecosystem. Cairo Goldmine - a curated list of useful libraries to develop on StarkNet. starknet-libs What are your thoughts on Cairo? Let me know in the comments! About the author Aleksandr Malyshev is a software engineer and entrepreneur, who specializes in backend development and growth hacking. He is an experienced lead at Open Innovations who hosts and organizes well-known Eastern Europe software competitions. Aleksandr is the former Executive Officer at Steinbeis Consulting Center AI (STAI) in Stuttgart. Currently, he is working in Web3 and is involved in researching new technologies.

What is Cairo Lang? 10 Best Resources for Scaling dApps Using STARKs

“In a fight, your doubt is a target of enemy’s attack.” ― Toba Beta, Betelgeuse Incident: Insiden Bait Al-Jauza The Frameworks Seek to Set the Scene for Cyber Battlefield Recently significant innovations helping cybersecurity professionals to work under the same language on defense and a better way to share security info among internal and a standardized framework which also from them (ATT&CK). MITRE Engenuity announced This is an exciting moment for us from different backgrounds, including public/ private sectors, system integrators, or security products/ services providers. Since it is the first time, a non-profit organization . promotes a common framework — both attack and defense — for all of us ATT&CK Before discussing the latest update, it is essential to introduce the previous successful project from MITRE — ATT&CK Framework. Vendors use their framework to describe the same piece of malware. For example, if you search for malware on VirusTotal, you can see they use their naming methods and categories to distinguish the same malware. Before ATT&CK, we face the same problem in threat hunting. stands for “MITRE dversarial actics, echniques, and ommon nowledge.” This framework is a selected knowledge base and model for attack behavior. It also contains the attack lifecycle, attack phases, and the OS platforms they are known to target. MITRE ATT&CK® A T T C K | MITRE ATT&CK framework on-exclusive, royalty-free license The has already created a successful foundation for analyzing the red team’s TTP. Without this framework, there is no common language for cybersecurity professionals, researchers, and vendors for analyzing and discussing attackers’ methods. MITRE ATT&CK framework Moreover, ATT&CK can be adopted to build threat models and kill chains of actual incidents, including attackers’ behaviors and tactics, techniques, and procedures (TTP) since ATT&CK is based on real-world threats. Nowadays, all vendors would use the same language — the TTP of the same attack kill chain. With the wide adoption of the ATT&CK framework, users can compare the effectiveness of the detection methods/ tools with how many TTP the product can detect. But there are limitations — to put the ATT&CK framework to its full extend, users need a way to quickly spin up their local knowledge base to the framework and efficiently contribute to the community when necessary. That is why MITRE Engenuity™ introduce the easy-to-use tool — ATT&CK Workbench. ATT&CK Workbench ATT&CK Workbench is the tool for users of MITRE ATT&CK to integrate their organization’s local knowledge of attackers’ tactics, techniques, and procedures (TTP) with the public ATT&CK knowledge base. From their ’s blog post: MITRE-Engenuity Workbench allows users to , , , and extensions of the ATT&CK knowledge base. Organizations or individuals can initialize their own instances of the application to serve as the centerpiece to a customized variant of the ATT&CK knowledge base, attaching other tools and interfaces as desired. explore create annotate share The time and effort spent trying to integrate the publicly-reported behavior with internal knowledge of attack TTP would be significantly reduced. Open-source, API-driven platform to organize and manage all attack TTP-related threat intelligence makes this tool different. With ATT&CK Workbench, users can easily, according to one of the early adopters of the Workbench, : AttackIQ - create a local containerized instance of the ATT&CK knowledge base, and keep it updated automatically through the publicly maintained ATT&CK knowledge base; - create and annotate objects within the ATT&CK knowledge base; - submit enhancements efficiently to ATT&CK, as well as to other instances of the knowledge base; - enable information sharing centers (ISACs) and information sharing organizations (ISAOs) to share their ATT&CK knowledge base enhancements with members. Moreover, others with a similar situation would improve the overall security posture and time to respond. Workbench will help both the red and blue teams enhance defense mechanisms, threat hunting, and much more. it provides a way for users to share their extensions with the ATT&CK community globally; finding D3FEND It is the initial framework for setting the standard language for the blue team capabilities and technologies. , as it’s called, aims to complement the . While ATT&CK focuses on standardizing the offense TTP, . D3FEND MITRE ATT&CK framework D3FEND focuses on cyber defenses The National Security Agency funded this new D3FEND framework to define a structure for security artifacts for cybersecurity professionals and researchers. It can serve as a helpful guide for architecting, designing, and implementing cyber defenses. D3FEND is based, in part, , . Because it is so detailed, the framework can guide architecting, designing, and deploying cybersecurity defenses. on 500 countermeasure patents from the last two decades according to its website Screenshot of D3FEND framework | non-exclusive, royalty-free license D3FEND also establishes the language of cybersecurity defensive techniques and interprets previously unspecified relationships between defensive and offensive methods. There are five broad categories in the framework: harden, detect, isolate, deceive, and evict. While ATT&CK focuses on Tactics, Techniques, and Procedures to describe a kill chain, D3FEND focuses on defensive practices and products by their digital artifacts. With each security product having various digital artifacts and each digital artifact being included in different products. Rather than relying on vendors’ definition of the “Next Generation Firewall,” cybersecurity professionals would know what each product could and could not do. For example, when a firewall gets a feature update and gains additional security capabilities. The firewall can work with EDR tools to provide XDR contextual information for the customer environment. For example, using the D3FEND framework would provide an easy view of the additional coverage. Final Words With this information in place, users could use this framework to check whether a function is present in the product to address a specific or several TTP. We can expect the framework would grow, like the ATT&CK, and later we can use the Workbench to work with both attack and defense. Together, the frameworks provide cyber warriors with a shared understanding of cyber concepts and a standardized vocabulary to use when talking about them, facilitating more transparent communication for sharing information and coordinating defensive operations both in and between organizations. Thank you for reading. May InfoSec be with you🖖.

ATT&CK vs. D3FEND - Get Everyone On the Same Page

MITRE ATT&CK™ ( dversarial actics, echniques and ommon nowledge) is a framework for understanding attackers’ behaviors and actions. A T T C K We are pleased to announce that AlienVault USM Anywhere and now include MITRE ATT&CK™ information. By mapping alarms to their corresponding ATT&CK techniques, we are assisting in analysis work by understanding the context and scope of an attack. Open Threat Exchange (OTX) prioritizing Below we’ve outlined how this new capability can help you investigate two threats — and RevengeRat. TrickBot Mapping a Trickbot infection with ATT&CK Trickbot is a malware family that was discovered a few years ago targeting the banking industry, but following some , it is still active and evolving. The malware is usually delivered using attached Office documents via spear-phishing emails. investigations This particular sample works by running a PowerShell script via command line from the malicious Excel document. The script will load the code that needs to be executed in memory and run the payload. In order to run the payload without being detected, the malware will try to disable and evade anti-malware protection. Once that is done, it will copy itself to another location and will run from there. It also spawns instances of the svchost.exe process to perform several tasks such as downloading config files and injecting into browsers to steal user credentials. AlienVault USM Anywhere detects and tracks the previous malware behavior and maps all different behaviors to ATT&CK definitions. This provides a clean understanding of the attack’s stage and tactics, and makes the analysis work easier. Running the sample in our environment we can observe different alarms that USM Anywhere is automatically triggering once the malicious Office document is opened by the user: Suspicious Process Created by Microsoft Office Application Suspicious Powershell Encoded Command Executed Windows Defender Disabled Windows Unusual Process Parent Tor Malicious SSL Certificate Now it’s possible to see those alarms mapped to the ATT&CK matrix: As we can observe, the ATT&CK matrix provides visibility of the techniques and tactics that Trickbot uses. Starting with Execution tactics, Defense Evasion mechanisms and finishing with Command and Control activity. The first alarm in the kill chain is the . After opening the malicious document, the process EXCEL.EXE creates a new process to run a PowerShell command and load code in memory using the IO.MemoryStream class. We can see how the alarm detected the malicious activity and the encoded command trying to evade detection. Suspicious Process Created by Microsoft Office Application Suspicious Powershell Encoded Command Executed Before injecting into other processes, the malware tries to disable the anti-malware protection mechanism to evade endpoint detections. In this case, we detect how it tries to stop the Windows Defender service by triggering the alarm . Windows Defender Disabled The next step performed by Trickbot is to copy itself to another directory and run again. Some new instances of svchost.exe process are started, but as you can see, the parent of that process is not the one that Windows normally uses in the process tree. We can see another alarm for that behavior indicating that the masquerading technique is being used: T1036 In the last step of the kill chain, the Trickbot malware tries to contact a command and control server. Network signatures matched the SSL domain used by this family and alerted it as . Malicious SSL Certificate Network activity has also detected a DNS query for a domain, commonly used for anonymity and multi-hop proxy connections: TOR Revenge RAT The Revenge Remote Access Trojan is a popular publicly available remote access trojan. Revenge RAT allows attackers to capture personal information, monitor user behavior using keylogger and webcam functionalities, stealing data and even dropping new malware in the infected system. Malspam delivers Revenge RAT via malicious Office documents while the infrastructure uses blog-publishing services like blogpost.com to host the malicious scripts that will be executed by the Office document. Once the system is infected, this malware uses persistence mechanisms such as scheduled tasks to guarantee the continued execution and beacon functionality to command and control servers. The analyzed variant of Revenge RAT uses local scheduled tasks with code execution to download the content from remote services. The following USM Anywhere alarms are triggered when the Office document is opened by the user: Suspicious Process Created by Microsoft Office Application Suspicious Process Created by mshta.exe Network Activity From mshta Windows Scheduled Job Created Taskkill killing Antivirus process Malware Beaconing to C&C Remote Access Trojan And we can also see it with the ATT&CK matrix: As we can see above, the RAT behavior previously detailed has generated many alarms which are all mapped to the ATT&CK framework. Now, it is simple to recognize the attack pattern, from Execution to the Command and Control beaconing. First, the alarm detected that the EXCEL.EXE process was executing mshta.exe as a child process. Then we can see to in order to download malicious content: Suspicious Process Created by Microsoft Office Application Network Activity From mshta www.bitly.com As a result of that activity, two alarms of were triggered. One of them detects when the code is loaded in memory using the PowerShell class and the other one detects when the payload tries to kill the antivirus software which triggers alarm. Suspicious Process Created by mshta.exe Reflection. Assembly Taskkill killing Antivirus process The activity also generates an alarm for . If we inspect the event linked to the alarm we can see a detailed view of the scheduled task created in the system for execution and persistence and how it’s mapped as ATT&CK technique . Windows Scheduled Job Created T1053 Finally, after covering the Execution, Persistence and Defense Evasion tactics, it is also possible to review the command and control activity performed by the malware. Using network detections, we can easily recognize that the system was infected by a named Revenge-RAT and there is another alarm for the same malware family indicating the system is communicating with the attacker infrastructure. Remote Access Trojan Malware Beaconing to C&C

Mapping TrickBot and RevengeRAT with MITRE ATT&CK and AlienVault USM Anywhere

ZK-Starks or Z ero K nowledge S calable T ransparent Ar gument of K nowledge is the latest innovation to financial privacy on the blockchain with the use of fast, scalable computations. The creation of Bitcoin introduced a new secure means to transfer monetary value WITHOUT the need for a trusted third party, however, this has come at the cost of financial privacy with every transaction on the blockchain being recorded and made public to all. The value of privacy extends beyond just finances and goes into the realms of health, politics, religion and one’s own personal opinions. If you were robbed and your wallet address was made public due to carelessness. This one mistake could haunt you forever, because the public would be able to trace the movement of your assets as well as monitor your net worth in cryptocurrency, making you at risk of being attacked again (physically and digitally). Currently cryptocurrencies primarily handle financial transactions that are financial in nature, such as the transfer of value on Bitcoin’s network, or to settle “smart contracts” on Ethereum. The lack of privacy surrounding crypto transactions is a barrier to the wider spread adoption of cryptocurrencies and arguably hinders this revolutionary innovation from reaching its full potential. If sensitive data (which makes up the majority of data in today’s age) is to be stored on blockchains, this data will need to adhere to privacy standards from around the world. Thanks to and their development of zk-STARKS technology, a newer, more transparent and sexier Zero-Knowledge Proof, the issue of maintaining privacy whilst also providing scalability for blockchains is coming. Starkware Industries Problem Life is a journey of never-ending problems, hopefully most of us overcome the problems we face, and as we do, it’s only a matter of time before another problem is bestowed upon us. Well when it comes to crypto there no exceptions to a never-ending stream of problems! The introduction of Bitcoin provided a solution to transferring monetary value on a global scale the need for a trusted third party, however born out of this solution comes a new problem: WITHOUT Financial Privacy! Because the Bitcoin network is a peer to peer network, in order to prevent double spend attacks and fraudulent transactions from being made the solution involved making sure everyone has access to the current state of the public ledger. This essentially means that EVERYONE can publicly access a record of the transactions that have ever been made on the network including the total amount of Bitcoins each bitcoin wallet holds. ALL The transactions and wallets are pseudonymous by nature — meaning you can’t decipher who owns the wallet and who’s ultimately making or receiving the transactions, all you know is that a transaction has been made from one wallet address to another. (There are however groups that track the transactions of the largest percentage holders of a coin so even if they may not know exactly who owns the wallet, with enough observations, there may be a chance to narrow the owner of the wallet down to a few individuals — for example the following site that tracks the activity of the Mt. Gox cold wallets.) When you transact with someone on crypto however, this destroys any element of pseudonymity thus revealing a part of your identity and losing all sense of financial privacy. Anyone you transact with can deduce that you are the likely owner of the wallet you are sending or receiving cryptocurrencies from and because of the open transparent nature of blockchain, they can easily snoop around and see how much crypto you own, who else you’re transacting with, and where you’re sending your crypto. This is especially true for the ethereum blockchain and the ERC-20 tokens that reside within. This would be like having an acquaintance, neighbor, family member or friend sending you money into your bank account, the only difference here is that if they want to, they can then see who has sent you money, or who you’ve sent money to and all of the previous transactions you’ve made, and how much crypto you own! This lack of financial privacy would make many people uneasy and on the extreme end it could put people at risk of being targeted for . kidnapping and ransoms So The Big Problem We Now Face Is… How can we enable privacy on blockchains whilst still ensuring transactions are valid and that the underlying code maintains its “integrity”? In other words, how do we accomplish what is known as “ ” whilst still maintaining privacy? Computational Integrity As it stands, most cryptocurrencies are open book (see or ’s blockchain explorers) and this is why we can trust in the networks. Bitcoin Ethereum We can check EVERY transaction that has ever been made since the dawn of the first genesis block, and because of this we trust that the network is sound and that no one has been secretly printing cryptocurrencies out of thin air or cheating the system in another way thus ruining the integrity of the network. But if we introduce privacy into blockchains can we still trust that everything is working properly? The Story of Mr. MoonBag.. Mr. MoonBag made millions investing in cryptocurrencies and has decided to spend some of his newfound wealth on a Lamborghini. Ever since attending Consensus back in 2016 his dream goal was to rock up at a crypto event one day in his Lamborghini. own After calling up the local Lamborghini dealership to ask whether he could have a test drive before pulling the trigger the dealer scoffed at his request remarking that; “We don’t provide free joy rides around here, only serious buyers are allowed test drives. If you can prove you’re a serious buyer feel free to come in.” The salesman informed Mr. MoonBag he would need to supply proof of sufficient funds or pass a credit check in order to be considered a serious buyer. Mr. MoonBag knew that showing his Delta portfolio wouldn’t be enough for proof. He’d need to show the salesman his crypto wallets, prove that he owned them and that he had enough crypto to finalize the purchase. The only issue was that Mr. MoonBag was paranoid about others knowing about his newfound wealth… ( ) Yes, this is highly ironic as he is purchasing a Lamborghini but this is a fictional story so just play along okay! So how could Mr. MoonBag possibly prove to the salesman that he has enough cryptocurrencies to purchase a brand-spanking new Galardo without compromising his financial privacy? After hearing countless stories of people making millions in crypto becoming targets for hackers, scammers, and criminals, Mr. MoonBags would much rather be safe than sorry… Solution Current Solutions to Privacy Financial Before we continue with Mr. MoonBags Lamborghini adventures, let’s briefly cover some solutions currently enabling financial privacy on blockchains. and are arguably the two front runners when it comes to cryptocurrencies that have privacy enabled. Monero ZCash The general consensus seems to be that Monero is the superior alternative when it comes to ensuring privacy, however, faces its own challenges with scalability and usability of the token. ZCash is often touted as the most technologically advanced privacy coin, however it also comes with a few issues of its own, particularly: The technology behind the privacy features of ZCash are resistant to Quantum Computing; and NOT ZCash requires a “trusted” setup for its privacy features defeating the purpose of blockchains not requiring a trusted third party to handle transactions 1. QUANTUM COMPUTING Quantum computers can be thought of as highly supercharged computers — a Super Saiyan version of normal computers if you will. Currently quantum computers are still in a stage of infancy and are yet to be developed. In the future however it is expected that quantum computers will be able to perform computations at exponentially greater rates than what is currently possible and this might allow them to solve problems that are currently deemed unsolvable. What this means is that when quantum computers come about, the underlying technology known as zk-SNARKs ensuring privacy for ZCash might be cracked, rendering the ‘privacy’ of transactions made on ZCash useless. 2. “TRUSTED” SETUP OF ZCASH (ZK-SNARKS) zk-SNARKs, which is a type of “Zero Knowledge Proof” (more on this later when we get back to Mr. MoonBags!), powers the privacy for ZCash and because of how it works, it requires a setup phase specifying the public parameters for the zero knowledge proofs. The only issue with this setup phase is that if the setup is compromised than it is possible for whoever has compromised it to be able to forge ZCash out of thin air… Obviously this would not be good if it occurred as it would ruin the integrity of ZCash! The real problem here is that Bitcoin was created so that there would be no requirement for a trusted third party, however in ZCash’s case a trusted third party. there is The trusted third party being the six people who performed the initial setup phase. So in order for the public to have trust in ZCash’s network, they need to trust that these six people did not compromise the setup so that they are able to magically print ZCash out of thin air without anyone knowing! Back to Mr. MoonBag… To quickly recap on Mr. MoonBag’s dilemma he wants to purchase a Lamborghini with his new crypto wealth however needs to show the salesman that he’s a serious buyer by proving that he has sufficient funds. The issue here being that Mr. MoonBag wants to preserve his financial privacy and doesn’t want the salesman or any of the other workers there knowing how much crypto he owns, what the address of his wallets are, or even who he’s been transacting with. This is where “Zero Knowledge Proofs” come into play! Using a “zero knowledge proof”, it’s possible for Mr. MoonBag to prove to the Lamborghini salesman that he owns at least $500,000 USD worth of cryptocurrencies ( however he is able to prove this WITHOUT revealing any further details such as the address of his wallets, how much crypto he owns in total and other private matters. more than enough for a Lamborghini) One of the most widely used zero knowledge proofs in cryptocurrencies today is that of zk-SNARKs which is used by ZCash but as you may recall, there are a few problems with ZCash and that’s where the newer, better and more improved version by Starkware comes into town… zk-STARKs! Building on top of zk-SNARKs comes zk-STARKs, which is: calable with faster proofs for generation and verification S ransparent: so that NO external “trusted” setup phase is required like in zk-SNARKs T gument of nowledge — proves that the correct inputs and data has been used to calculate the output. (So in the case of Mr. MoonBag the proof will show that he has used his crypto wallet addresses, and not someone elses, to prove he owns at least $500,000 USD, which is the output) AR K own Post-quantum secure — the assumptions on which the privacy features for zk-STARKs are based upon are not known to be susceptible to attacks by large-scale quantum computers. Main Features — Tech Overview As mentioned earlier, Starkware will be building on top of the existing zk-SNARKs protocol, adding transparency to now become zk-STARKs An implementation of zk-Starks will provide for a highly scalable, faster computation and smaller proofs. This combination of features combined with “immunity” from large-scale quantum computers should drive a high-level of interest from the cryptocurrency world and beyond. To give you an idea of how this would likely stack up compared to the top privacy coins in the marketplace today we have provided this table below: Privacy Coin Comparison As you can see from the table above, a coin with the characteristics of the ZkStarks protocol would be the most advanced coin in the market. Roadmap Roadmap has not been published. Token Economics Starkware are currently not planning an ICO and have announced that they will be exploring the potential of where they invest their technology in exchange for tokens, hence becoming a “Venture Technologist” or “Tech Crypto Fund”. Tech4Tokens (T4T) Potential Considerations List of potential issues that the token/protocol/project will face or has possibly overlooked. In comparison to zk-SNARks, the size of a proof in zk-STARKs increases from 288 bytes to a few hundred kilobytes, further research and innovation will be required to bring the size of proofs down. Though it is easy to understand the significance of the technology and its potential application in the real world, there is not currently a MVP or use case that has been published. Team + Advisors Eli Ben Sasson — Co-Founder/Chief Scientist Eli completed PhD in Computer Science at Hebrew University in 2001. Majored in his passion — “Moon math” theory and realization of transparent computational integrity. He completed a Postdoctoral researcher at MIT university. He is also currently a Professor at Technion — Israel Institute of Technology since 2015. Where he has co-founded “ ” project. SCIPR Lab is a multi-institutional academic collaboration of researchers seeking to bring to practice cryptographic proof systems that provide succinct integrity and privacy. SIPR Lab He also is involved in a — Understanding Child Development Together, using Crowd Intelligence. phone app Also Co-invented Zerocash decentralized payment systems and foundering scientist of the . Zcash company Alessandro Chiesa — Co-Founder/Chief Scientist Alessandro is also currently an assistant Professor in Computer Science department at the University of California Berkeley. He is a co-author of , open-source for sccinct zero knowledge proofs libsnark He completed BSc, Masters of Engineering and PhD of Philosophy all in Computer Science at MIT. Co-founded “ ” project. SIPR Lab Co-invented Zerocash decentralized payment systems and foundering scientist of the . Zcash company Also involved as in the Algorand Project as an Cryptocurrency Advisor. Uri Kolodny — Co Founder/CEO Uri is a serial Entrepreneur he founded many technology companies in the last 13+ years. Companies include: — Software Company Modria Technologies LTD & ICV — Venture Capital & Private Equity Greylock Partners Timba — ultrasound-based therapeutic product for the cardiovascular market — Tech company providing products that enhance surgical accuracy, access, and control for minimally invasive surgery, laparoscopy, and robotic-assisted surgery. OminGuide He completed a Bsc in computer science from Hebrew University and an MBA from MIT sloan School of Management. Patents: Patent title Photonic crystal waveguides and systems using such waveguides Patent date Issued Nov 2004 Patent issuer and number us US 7,310,466 Michael Riabzev — Co Founder/Chief Architect Michael has 14+ years of software development experience, including Intel and IBM Labs. BSc in Math and MSc in Computer Science. PhD candidate in Computer Science at Technion Israel Institute for Technology, where is focused on the development of practical systems for computational integrity in zero-knowledge, culminating and the development and implemented of the zk-STARK system. Has also worked in hardware acceleration, cryptographic algorithms, GPGPU, SDN, web development, and more. Partners and Investors Sources: Butalin, Vitalik. “STARKs, Part I: Proofs with Polynomials“ Butalin, Vitalik. “STARKs, Part II: Thank Goodness It’s FRI-day” Weuse.Cash. “The Untrusted Setup — Why you shouldn’t trust ZCash” Get our free investment thesis Sign up to get our exact investing strategy, start to finish. It includes our philosophy at Coin Crunch, as well as our top long-term picks. For the best in news, reviews, and information for the blockchain and cryptocurrency visit or check us out on: | | | coincrunch.io Youtube Twitter Facebook Reddit

Stories, News & Mentions about OWLEDGE

Owledge’s Stories on HackerNoon