{
  "docId": "019dd923-622c-750b-8b96-2fbe642fbf78",
  "docSlug": "69cc18cfe079",
  "documentTitle": "NQ Mobile (NQ)",
  "authorId": "51_Muddy_Waters",
  "authorName": "Carson C. Block",
  "documentKindSlug": "research-note",
  "documentKindLabel": "Research note",
  "sourceTypeSlug": "short_seller",
  "sourceTypeLabel": "Short seller",
  "presentationDate": "2013-10-24 00:00:00",
  "orientation": "portrait",
  "aspectRatio": 0.77272725,
  "pageNumber": 78,
  "pageCount": 81,
  "prevPage": 77,
  "nextPage": 79,
  "slideType": "other",
  "function": "analyze_data",
  "density": "dense",
  "nDataPoints": 0,
  "notes": "The slide contains a screenshot of an XML response from a server, with specific fields highlighted (BOKU chargeId, Price, Currency).",
  "elementsJson": [
    "paragraph",
    "screenshot"
  ],
  "metadataConfidence": 0.9,
  "imagePath": null,
  "slideHref": "/slides/019dd923-622c-750b-8b96-2fbe642fbf78/78",
  "deckHref": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78",
  "deckJsonHref": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78.json",
  "deckAnchorHref": "/decks/019dd923-622c-750b-8b96-2fbe642fbf78#slide-78",
  "components": [
    {
      "bbox": null,
      "kind": "callout",
      "text": "The idea is to show that we got code execution on the device and so does NQ.",
      "attrs": null,
      "subkind": null,
      "toolName": "Visual emphasis",
      "toolSlug": "visual-emphasis",
      "confidence": null,
      "componentId": "019dd953-0936-7173-ab11-5f41bc96246a",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.505,
        "w": 0.764,
        "x": 0.118,
        "y": 0.186
      },
      "kind": "image",
      "text": "Python Shell window showing XML response data",
      "attrs": null,
      "subkind": "screenshot",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "88401503-97db-4bd6-b048-ed816a01289d",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.022,
        "w": 0.425,
        "x": 0.118,
        "y": 0.751
      },
      "kind": "paragraph",
      "text": "Goal: Determine if app allows remote code execution.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "7011111d-df43-4431-9c80-7e5df5462204",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.035,
        "w": 0.764,
        "x": 0.118,
        "y": 0.093
      },
      "kind": "paragraph",
      "text": "In response to this request, the server returns a response indicating the applications payment state. It indicates whether the user paid already for enabling some features.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "81b67b49-4d52-4b3a-935f-8b9605057fd9",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.065,
        "w": 0.764,
        "x": 0.118,
        "y": 0.781
      },
      "kind": "paragraph",
      "text": "Process: Research the software update, request update from the server, and get a response. In this response, we saw there’s a command value. We looked in the code and saw that there’s another special command that is being processed which directs the application to download a file from the server or any address!",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "96e3e89e-037c-4840-9a5a-dc1b0ae5efbc",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.035,
        "w": 0.764,
        "x": 0.118,
        "y": 0.143
      },
      "kind": "paragraph",
      "text": "It also specifies with which payment provider it should request payment from, and the amount of money. We saw Boku and Google wallet as providers.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "9d138de7-9b04-4318-b7c2-09f9d1dfa8a1",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.065,
        "w": 0.764,
        "x": 0.118,
        "y": 0.861
      },
      "kind": "paragraph",
      "text": "At that point of the research we set up an experiment where we did man-in-the-middle attack on the device, technically we edited the hosts file so the NQ server so that they will point to our HTTP server instead of NQ’s one. The idea is to show that we got code execution on the device and so does NQ.",
      "attrs": null,
      "subkind": "paragraph",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "fe551db5-b28b-4893-ab55-8212e4b67acd",
      "frameworkName": null,
      "frameworkSlug": null
    },
    {
      "bbox": {
        "h": 0.022,
        "w": 0.235,
        "x": 0.118,
        "y": 0.721
      },
      "kind": "title",
      "text": "Remote Code Execution",
      "attrs": null,
      "subkind": "headline",
      "toolName": null,
      "toolSlug": null,
      "confidence": null,
      "componentId": "141e4ec8-19ae-4fa4-a005-1367bf90a1f4",
      "frameworkName": null,
      "frameworkSlug": null
    }
  ],
  "metrics": [],
  "tools": [],
  "frameworks": [],
  "arcBeats": [
    {
      "to": 80,
      "from": 61,
      "beatId": "e4f2b8e1-7912-4f93-8c38-79d385cde878",
      "arcName": "Overcoming the Monster",
      "arcSlug": "overcoming-monster",
      "beatName": "Appendix Data",
      "beatSlug": null,
      "evidence": "The document provides extensive data and evidence to support its claims.",
      "position": 2,
      "confidence": 0.8,
      "parentBeatName": null,
      "parentBeatSlug": null
    }
  ],
  "loops": [],
  "imagePathAlt": null,
  "thumbSrc": null,
  "thumbSrcAlt": null,
  "locked": true
}