CategoryMalaysia

Malaysian Technology Issue from a Malaysian Tech Blog

Contact Tracing Apps: they’re OK.

C

I thought I’d write down my thoughts on contact tracing apps, especially since a recent BFM suggested 53% of Malaysians wouldn’t download a contact tracing app due to privacy concerns. It’s important for us to address this, as I firmly believe, that contact tracing is an important weapon in our arsenal against COVID-19, and having 54% of Malaysians dismiss outright is concerning...

The Malaysian Government isn’t watching your porn habits

T

Recently, there was a poorly written article in The New Straits Times, that suggested the Malaysian Police would know if you were watching porn online. Let me cut to the chase, the article is shit. The software in question, aptly named Internet Crime Against Children Child Online Protective Services (ICACCOPS) is used to detect Child Pornography, and Child Pornography only — as the name...

Security Headers for Gov-TLS-Audit

S

Gov-TLS-Audit got a brand new domain today. No longer is it sharing a crummy domain with sayakenahack (which is still blocked in Malaysia!), it now has a place to call it’s own. The domain cost me a whooping $18.00/yr on AWS, and involved a couple hours of registration and migration. So I felt that while migrating domains, I might as well implement proper security headers as well. Security...

The GREAT .my outage of 2018

T

Last week, MyNic suffered a massive outage taking out any website that had a .my domain, including local banks like maybank2u.com.my and even government websites hosted on .gov.my. Here’s a great report on what happened from IANIX. I’m no DNSSEC expert, but here’s my laymen reading of what happened: .my uses DNSSEC Up to 11-Jun,.my used a DNSKEY with key tag:25992 For some...

The Malaysian Ministry of Education Data Breach

T

Ok, I’ve been pretty involved in the latest data breach, so here’s my side of the story. At around 11pm last Friday, I got a query from Zurairi at The Malay Mail, asking for a second opinion on a strange email the newsdesk received from an ‘anonymous source’. The email was  regular vulnerability disclosure, but one that was full of details, attached with an enormous amount...

3 times GovTLS helped fixed government websites

3

Couple months back I started GovTLSAudit. A simple service that would scan  .gov.my domains, and report on their implementation of TLS. But the service seems to have benefits above and beyond that, specifically around having a list of a government sites that we can use to cross-check against other intel sources like Shodan (which we already do daily) and VirusTotal. So here’s 3 times...

Look ma, Open Redirect on Astro

L

If you’ve come here from a link on twitter — you’d see that the address bar still says login.astro.com.my, but the site is rendering this page from my blog. If not, click this link to see what I mean. You’ll get something like this: Somehow I’ve managed to serve content from my site on an astro domain. Rest assured, I haven’t ‘hacked’ astro servers...

Here’s one thing that’s already changed post GE14

H

In 2015, I was invited to a variety program on Astro to talk about cybersecurity. This was just after Malaysian Airlines (MAS) had their DNS hijacked, but I was specifically told by the producer that I could NOT talk about the MAS hack, because MAS was a government linked company, and they couldn’t talk bad about GLCs. Then half-way through the interview they asked me about government...

Gov TLS Audit : Architecture

G

Last Month, I embarked on a new project called GovTLS Audit, a simple(ish) program that would scan 1000+ government websites to check for their TLS implementation. The code would go through a list of hostnames, and scan each host for TLS implementation details like redirection properties, certificate details, http headers, even stiching together Shodan results into a single comprehensive data...