{
  "docId": "019dd923-622c-750b-8b96-2fbe642fbf78",
  "docSlug": "69cc18cfe079",
  "documentTitle": "NQ Mobile (NQ)",
  "authorId": "51_Muddy_Waters",
  "authorName": "Carson C. Block",
  "documentKindSlug": "research-note",
  "documentKindLabel": "Research note",
  "sourceTypeSlug": "short_seller",
  "sourceTypeLabel": "Short seller",
  "presentationDate": "2013-10-24 00:00:00",
  "orientation": "portrait",
  "aspectRatio": 0.77272725,
  "pageNumber": 76,
  "pageCount": 81,
  "prevPage": 75,
  "nextPage": 77,
  "slideType": "other",
  "function": "analyze_data",
  "density": "balanced",
  "nDataPoints": 0,
  "notes": "Includes Python code snippet for decryption logic.",
  "elementsJson": [
    "paragraph",
    "bullet_list",
    "screenshot"
  ],
  "metadataConfidence": 1,
  "imagePath": null,
  "slideHref": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/76",
  "deckHref": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78",
  "deckJsonHref": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json",
  "deckAnchorHref": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-76",
  "components": [
    {
      "bbox": {
        "h": 0.075,
        "w": 0.535,
        "x": 0.118,
        "y": 0.313
      },
      "kind": "list",
      "text": "The data sent from the App to server: 10bytes 'newversion' XORed with 0x6e. 16bytes of encryption key XORed with 0x6e. Data encrypted with AES using the key just before it.",
      "attrs": null,
      "subkind": "bullet",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "388af703-b7a8-4f82-bdd1-b72fc653dfdd",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.045,
        "w": 0.535,
        "x": 0.118,
        "y": 0.415
      },
      "kind": "list",
      "text": "The data sent from the server to App: 16bytes of encryption key XORed with 0x6e. AES data following.",
      "attrs": null,
      "subkind": "bullet",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "eacf504c-905f-429f-bab7-343a91517caa",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.085,
        "w": 0.763,
        "x": 0.118,
        "y": 0.092
      },
      "kind": "other",
      "text": ">>> c = \"\"\n>>> a = \"75726c3d061a1a1e5441411919401a060b1d0b0d1c0b1a400d010341511e0f1d1d19011c0a535f5c5d5a\".decode(\"hex\")\n>>> for i in a[4:]:\n...     c += chr(ord(i)^0x6e)\n\n>>> c\n'http://www.thesecret.com/?password=1234'\n>>>",
      "attrs": null,
      "subkind": "unclassified",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "601c350b-c670-425b-a6a9-55d14dfdf86f",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.045,
        "w": 0.763,
        "x": 0.118,
        "y": 0.498
      },
      "kind": "paragraph",
      "text": "The content of the encrypted data is in XML format. It contains commands that look similar to the previously described XML in the plain-text communications. The command is an integer value that indicates the indicator \"type\" of command rather than a \"exec-command\".",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "907de1ec-3c14-43ec-8eb9-9348f6858a28",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.015,
        "w": 0.535,
        "x": 0.118,
        "y": 0.281
      },
      "kind": "paragraph",
      "text": "The request is an HTTP POST request to 'boss-cs-av-v4/app.htm.'",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "add048c1-7acb-4ec1-989a-c638ee2a9659",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.045,
        "w": 0.763,
        "x": 0.118,
        "y": 0.218
      },
      "kind": "paragraph",
      "text": "The most visible part of the app is the 'Update virus database' button, this button is in charge of asking the user for a payment. When clicked it makes the application communicate with a server owned by NQ at ms-cm.nqsecurity.com (211.151.59.57) and sends encrypted data.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "d17f541d-59c6-4fd1-8cff-01a51d0dc845",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.015,
        "w": 0.287,
        "x": 0.118,
        "y": 0.188
      },
      "kind": "title",
      "text": "Update virus database",
      "attrs": null,
      "subkind": "headline",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "6b87a354-0b3a-4425-b86f-9f84bcc8a472",
      "frameworkName": null,
      "frameworkSlug": null
    }
  ],
  "metrics": [],
  "tools": [],
  "frameworks": [],
  "arcBeats": [
    {
      "to": 80,
      "from": 61,
      "beatId": "e4f2b8e1-7912-4f93-8c38-79d385cde878",
      "arcName": "Overcoming the Monster",
      "arcSlug": "overcoming-monster",
      "beatName": "Appendix Data",
      "beatSlug": null,
      "evidence": "The document provides extensive data and evidence to support its claims.",
      "position": 2,
      "confidence": 0.8,
      "parentBeatName": null,
      "parentBeatSlug": null
    }
  ],
  "loops": [],
  "imagePathAlt": null,
  "thumbSrc": null,
  "thumbSrcAlt": null,
  "locked": true
}