Authenticating with NRIC numbers

I was recently asked to take a survey which authenticated users solely using IC numbers. According to guideline 6 of PDPC's advisory on the use of NRIC numbers, NRIC numbers are widely used for various business purposes and organisations that use NRIC numbers as user names or membership numbers ...

Security Theatre: Samsung Note 7

Go google for photos of 'exploding Note 7' and you will realise that in every single photo, the phone is still intact in a one piece. If the phone really exploded, you would be looking at fragments scattered over an area. The Note 7 caught fire. It didn't explode ...

National Vulnerability Reporting Programme

Recent incidents have convinced me of the need to have a single avenue where the public can responsibly disclose vulnerabilities found on both government as well as commercial systems in a secure and efficient manner. While using these systems on a day to day basis, we sometimes do chance upon ...

Analysing smali code

Mobile apps have become increasingly widespread compared to their desktop counterparts. In addition, many apps often have stricter security requirements since they incorporate micropayments. We also perform sensitive transactions through mobile apps. For example, there are no desktop internet banking applications, we use the browser to perform such transactions. But ...

DES key parity bit calculator

I was doing some reverse engineering and I could not find any tool which expands a 56 bit DES key into a 64 bit key with the parity bit included. Expanding the key is a pretty laborious process involving hex to bin conversions and plenty of manual counting. To add ...

Bangladesh bank heist

The media initially attributed the hack to a couple of cheap second-hand $10 switches. However, according to further reverse engineering, this is not a snatch and grab but a full scale bank heist perpetrated by determined adversaries with resources at their disposal. Even if the bank had purchased and properly ...