THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf ·...
Transcript of THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf ·...
![Page 1: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/1.jpg)
THE ANSWER TO THE QUESTION "WHO?" WAVES OF VICTIMS OF THE ATTACKS MORE THAN AN ANSWER TO THE QUESTION "HOW?"
![Page 2: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/2.jpg)
TRUE DETECTIVE FROM APT ARTIFACTS TO ONE FINGERPRINT
Denis Makrushin (@difezza), Maria Garnaeva Global Research and Analysis Team
![Page 3: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/3.jpg)
ARTEFACTS OF AN ATTACK
• Address of the sender
• Address of the servers
• Debug information
• Resources
• Comments
• C2s Content
• Communication
• Linguistics and spelling
![Page 4: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/4.jpg)
2012 – Gauss
![Page 5: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/5.jpg)
Gauss (debug info)
Вариант Path to project files
August 2011 d:\projects\gauss
October 2011 d:\projects\gauss_for_macis_2
Dec 2011-Jan 2012 c:\documents and
settings\flamer\desktop\gauss_white_1
![Page 6: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/6.jpg)
c:\documents and settings\flamer\desktop\gauss_white_1\utils\Exceptions.h .\main.cpp
.\Manager.cpp c:\documents and settings\flamer\desktop\gauss_white_1\utils\SmartPtr.h
.\Injector.cpp
c:\documents and settings\flamer\desktop\gauss_white_1
\gauss\../Utils/ComUtils.h
.\History.cpp
.\FirefoxPluginInstaller.cpp
.\Telemetry.cpp .\Storage.cpp .\OsUtils.cpp .\ProcessSnapshot.cpp .\Event.cpp
.\GaussThread.cpp .\Buffer.cpp .\RemoteMemoryBuffer.cpp .\File.cpp .\Mutex.cpp .\Waiter.cpp
.\EveryoneSecurityAttributes.cpp .\Catcher.cpp .\BrowserConnector.cpp
c:\documents and settings\flamer\desktop\gauss_white_1
\minime\../Utils/SmartPtr.h .\Assigner.cpp .\IEAbstractElements.cpp .\FormExtractor.cpp
.\COMAbstractDataTypes.cpp
Gauss (debug info)
![Page 7: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/7.jpg)
Gauss
![Page 8: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/8.jpg)
Gauss
![Page 9: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/9.jpg)
2012 – miniFlame “Elvis” and his friends
![Page 10: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/10.jpg)
miniFlame (resources) In all the 4.х versions, the developers used the same “version info” file.
![Page 11: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/11.jpg)
miniFlame (resources)
В Flame Gauss ы ENGLISH_US NEUTRAL
![Page 12: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/12.jpg)
В 5.x ы ENGLISH_US
miniFlame (resources)
![Page 13: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/13.jpg)
miniFlame (resources)
![Page 14: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/14.jpg)
miniFlame (debug)
4D629B52: 21/02/2011 17:05:22
C:\projects\e\SP4.2\general_vob\sp\Release\icsvnt32.pdb
![Page 15: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/15.jpg)
miniFlame (debug)
VOB (Versioned Object Base): A repository that stores versions of file elements, directory elements, derived objects,
and metadata associated with these objects. With MultiSite, a VOB can have multiple replicas, at different sites.
![Page 16: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/16.jpg)
Winnti
![Page 17: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/17.jpg)
Winnti (code)
Chinese Simplified GBK
The process is complete!!
![Page 18: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/18.jpg)
Winnti (resources)
Chinese locale in resource section of En.exe
![Page 19: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/19.jpg)
Winnti (network comm)
С ф ш ы – upload -> local path
Desktop
![Page 20: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/20.jpg)
Winnti (c2)
![Page 21: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/21.jpg)
Winnti (tool)
Ctrl+Alt+F Ctrl+Alt+K
Google “ydteam” or read securelist.com :)
![Page 22: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/22.jpg)
PROBABLY, THE FIRST FINGERPRINTING INCIDENT
![Page 23: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/23.jpg)
EXPLOITS…
![Page 24: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/24.jpg)
FLASH, HTML5…
![Page 25: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/25.jpg)
SO DIFFERENT COOKIES
![Page 26: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/26.jpg)
TELL ME, WHO ARE YOU?
![Page 27: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/27.jpg)
FINGERPRINT
Device fingerprinting
Tracking you after you delete your cookies.
Tracking you after you change your IP address.
Various measurements such as the User-Agent string, screen size, time
zone, fonts, browser plugins and….rendering!
![Page 28: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/28.jpg)
Source: https://www.cosic.esat.kuleuven.be/publications/article-2334.pdf
Year: 2013
Web-based fingerprint
![Page 29: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/29.jpg)
![Page 30: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/30.jpg)
MEANWHILE: GETIMAGEDATA()
var canvas = document.getElementById("canvas");
if (canvas.getContext)
{
var canvas = document.getElementById("canvas");
if (canvas.getContext) { var ctx = canvas.getContext("2d");
ctx.fillStyle = "rgb(0,127,0)";
ctx.fillRect(10,10,20,20);
var Pixel = ctx.getImageData(29,10,2,1);
![Page 31: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/31.jpg)
FIFTY SHADES OF FONT RENDERING
hinting/antialiasing
Calibri
Times New Roman
Arial
Georgia
![Page 32: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/32.jpg)
LET ME MEASURE YOUR TEXT
![Page 33: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/33.jpg)
FONT VALUE
Impact 3409372
Georgia 3344049
Courier New 3430809
Consolas 3392005
MS Gothic 3383290
GetClientBoundingRect()
![Page 34: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/34.jpg)
• The <span> tag is used to group inline-elements in a document.
• The <span> tag provides no visual change by itself.
• The <span> tag provides a way to add a hook to a part of a text or a part of a document.
<span>fingerprint</span>
for (var j = 0; j < STYLES.length; j++)
{
var style = STYLES[j];var div = DIVS[style];var span = SPANS[style];
// This is where the measurment occurs.
span.textContent = c;var w = span.offsetWidth;var h = div.offsetHeight;
// Add to checksum.
checksum = addsum(checksum, w);checksum = addsum(checksum, h);
}
![Page 35: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/35.jpg)
PROOF-OF-CONCEPT: HOW I FINGERPRINT MYSELF
![Page 36: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/36.jpg)
PROOF-OF-CONCEPT: INJECT IT!
![Page 37: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/37.jpg)
PROOF-OF-CONCEPT: ANALYZE IT!
![Page 38: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/38.jpg)
PROOF-OF-CONCEPT: PEACE OF… DUMP
{"Times New Roman":"c2c91d5b3c4fecd9109afe0e",
"Arial":"4917211a76ddf69db033e125", "Courier
New":"eb211de3b75234ea90a50c3f",
"Symbol":"709ab9f882b1808b323e7d09", "Droid
Sans":"fbc25f5e038a28b94454fa13", "DejaVu
Sans":"c0bf2bce71e4313758d1aba8",
"serif":{"d":"5daa940a38e3b137916aadcb", "fonts":["Impact","Bookman
Old Style","Consolas", "MS
Gothic","Constantia","Calibri","Cambria","Wingdings", "Webdings","Ubuntu
Mono","Inconsolata","Inconsolata LGC", "Source Code Pro","Lucida
Handwriting","Georgia","System","vgaoem"]}, "sans-
serif":{"d":"46a9a2d351881662502ed793","fonts":[]}}
![Page 39: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/39.jpg)
VECTOR OF ATTACK
![Page 40: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/40.jpg)
XSS IS A PAIN OF WEB
45%
29%
17%
9%
26%
Medium
Low
XSS
Others
![Page 41: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/41.jpg)
FINGERPRINT BY THE FONT
![Page 42: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/42.jpg)
SCANNING OF C&C ADMIN’S PANEL
59%
36%
05% Online
Offline
Seized
30%
70%
JS
05%
95%
Canvas
![Page 43: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/43.jpg)
ALTERNATIVES
• Math routines with floating point?
• Measuring time of calculations?
• Mouse/pointing events?
• Battery Status API?
• Unique keystrokes traits?
• Other gaps…
![Page 44: THE ANSWER TO THE QUESTION W H O ? WAVES OF …powerofcommunity.net/poc2015/maria.pdf · Îîñüýôô .x í÷ôóøñùñùùì ENGLISH_US ... INJECT IT! PROOF- OF -CONCEPT ...](https://reader030.fdocuments.us/reader030/viewer/2022041123/5d2009b888c993ec448c273c/html5/thumbnails/44.jpg)
THANK YOU! QUESTIONS?
44 Mobile World Congress 2013