Naavi.org

For the last few days, I am having a problem with the Word Press. It appears that a post above a particular size is not getting published or updated.

If I post a screenshot image this post also cannot be uploaded.

The error message says

Quote

Not Acceptable

An appropriate representation of the requested resource /wp/wp-admin/post.php could not be found on this server. Additionally, a 406 Not Acceptable error was encountered while trying to use an ErrorDocument to handle the request.

Unquote

Can anybody suggest how this can be rectified?

Help will be highly appreciated.

Naavi

P.S: The problem was identified as a Mod Security on the server. Has been set right now.

Here is a link to the interview of Naavi at ISMG.

http://www.inforisktoday.in/security-privacy-challenges-aadhaar-based-authentication-a-10051

Naavi

Recognizing the importance of GST in Indian economy and particularly for E Commerce, Naavi.org is launching an online education center for GST related information and discussion under the domain name www.gstlaw.ind.in.

I welcome contributions from others so that it can be developed over a period of time into an useful information center on GST Laws.

Naavi

Tomorrow is an important day in the life of the evolution of taxation system in India with the ushering in of the GST system which is termed “One Nation -One Tax” system. Unfortunately, the proposal has been diluted over the months because of the non cooperation of the opposition parties.

Nevertheless, it is a time to recognize the special nature of the occassion.

Naavi.org has been celebrating October 17 as the “Digital Society Day of India” since it was this day in 2000 that electronic documents were first recognized legally in India with the notification of ITA 2000. Similarly July 1, 2017 will in future be recognized as the day when India marched into an integrated tax regime with the introduction of the GST system. It needs to be commemorated despite the reservations one may have on whether it could have been made better than its present form.

Since the entire GST system runs on an IT back bone, IT stake holders are excited about the opportunities of various types that would be unleashed by this monumental change. It is like the UIDAI system in India and the HIPAA in USA which unleashed a whole lot of new business opportunities all round. It may take some time for everyone to recognize the ancillary business potential that a system like this would generate. But the beneficial impact on the IT sector will be seen sooner than we realize.

We have pointed out that there are some issues in “Security” that will emerge when such a huge system with a centralized IT control is established since it also represents a single point of vulnerability which if exploited, can spread across the country in no time. The fact that the recent Petya ransomware was spread through a tax related software in Ukraine should be an eye opener in this regard. At the same time, “GST Information Security Practitioners” who understand GST and its operational aspects along with the principles of Information Security will see a generation of a new service opportunity.

Just like the passing of ITA 2000 gave birth to “Techno Legal Behavioural Science experts”, GST will give rise to the birth of “Techno Tax System Security Experts”.

May the tribe flourish!

Since the entire GST platform runs on an IT backbone, most of the legal provisions related to GST acutally becomes an extension of the E Commerce related laws. As a result GST law is part of the larer canvas of Cyber Laws or Laws of usage of Electronic Documents for business.

Naavi.org will be separately discussing the GST related legal issues under the banner of “GST Knowledge Center” which will be online soon. In the meantime, in the context of the recent discussions we have been having on Bitcoins and Crypto Currencies, it would be interesting to reflect on how the Bitcoin community in India would be affected by GST and its penal provisions for non compliance.

The Central Goods and Services Act 2017 (CGST) envisages that under certain circumstances of non compliance, apart from the financial penalties imposed, there could be liability for imprisonment to the person who contravenes the Act. Hence all Bitcoin players need to take note that GST needs to be complied with.

We need to therefore appreciate how the Bitcoin or other Crypto Currency buyers and sellers as well as the Exchanges like ZebPay, UnoCoin, Coinsure, BTCxindia etc and the Bitcoin wallet service providers may get impacted by the GST.

First and foremost we need to understand that Bitcoin (and other Crypto Currencies) is not “Bank Notes” which come under the provisions of Section 22 (1) of RBI Act.

A “Bank Note” in India by definition is a “Promissory Note payable to bearer where the promise is made by the RBI Governor” and by practice it is issued on a specific format. “Promissory Note” is itself defined in Negotiable Instruments act 1881 as an “Instrument in writing (not being a Bank Note or  Currency Note) containing an unconditional undertaking signed by the maker to pay a certain sum of money only to or to the order of a certain person or to the bearer of the instrument”. A Promissory note is a document which requires compulsory payment of stamp duty under the Indian Stamp Act without which it is not valid. Bitcoin (and other Crypto Coins”) is obviously not “Bank Notes” nor “Promissory Notes”. It is an electronic document produced under a process and contains some information in electronic form.

Bitcoin cannot also be classified also as “Actionable Claim” since there is no contractual offer or acceptance within the Bitcoin document.

Bitcoin  is just a ledger entry and in return to recording an entry and broadcasting it, a person is rewarded with a “Certificate of Merit” which is treated as a saleable commodity.

The Bitcoin community has adopted a format in which this electronic document is created and some people seem to be willing to assign a financial value to it and prepared to trade in it. It has therefore become a “Perceived Currency” within the closed community of Bitcoin users who are now trying to make it an universally acceptable “Currency”.

Information Technology Act 2000 recognizes an electronic document as equivalent to “Paper” and hence Crypto Currencies like Bitcoin is recognized as equivalent to a piece of paper on which some thing is written on.

It may simply say “This is a part of the reward provided to xxx for having created a block number yyy… in the zzz system”… or some thing with a similar meaning.

This document is in electronic form and cannot be denied recognition whether it is digitally signed by the creator or not. In Indian legal system Bitcoin is an “Undigitally signed Electronic document” and has the legal recognition under Section 4 of ITA 2000.

Since Bitoin is only like a piece of paper, it is a “Commodity” which is in electronic form. May be it is similar to a digitally signed e-mail or a webpage where the source can be identified with an “attribution” though in a “Physical De-identified electronic  form”.

In case any person is trying to represent Bitcoin as a “Currency” in digital form, it may be considered as misrepresenting a fact and committing a fraud which is an offence both under the RBI Act and IPC carrying imprisonment of may be upto 7 years.

If however, Bitcoin is a “Commodity” and it is being bought and sold some times from within the country and some times from outside, then the trade would be equivalent to trading of any other commodity.

International transactions would amount to import or export of the commodity. Since our FEMA does not specifically permit import of Bitcoins, it would be necessary to seek the permission of RBI and every purchase of Bitcoin in exchange should be treated as an “Import” with necessary foreign exchange permissions through an “Authorized Dealer”. Every sale is like an Export and must be supported by declaration and recovery of proceeds through an Authorized Dealer. A registration under Import-Export regulations may also be required.

If any body is lucky enough to “Mine” a Bitcoin, it would be treated as a “Manufacture of a Commodity” and is subject to GST as a manufacturer of  goods could be.

Any services related to the Bitcoin would be subject to the Service Tax equivalent of GST. Any trading resulting in a revenue would be a “Business income” and may not be considered “Investment Gains such as Short term or long term capital gains”.

If some body is part of a “Pool” and gets a mining reward, he would be like an “Employee” on part time receiving an income and it would be part of his “Global Income” to be taxed.

Holding of Bitcoins either mined or bought has to be declared in the IT returns as “Inventory” and accounted as “Income from Business” Where the employee contracts donot permit part time employment elsewhere, or trading of commodities as a part time business, they need to seek permissions from their employers.

As regards the chain of trading activities, each purchaser has to pay GST and is entitled to take input credit if the seller provides an “Invoice” in the requisite format showing payment of GST at his end. There is of course an exemption from GST for traders, manufacturers and service providers below a specific limit and if the person exceeds these limits there will be need for GST registration.

Bitcoin exchanges who have not registered under GST and not implemented appropriate procedures need to stop trading from tomorrow as they would be in violation of the law once they exceed to limits specified. Exchanges and Wallet Service Providers who are “Registered” and deal with “Unregistered Bitcoin sellers and buyers” need to pay “Reverse Charge on one leg of the transaction and another normal GST on the other side”.

In the case of inter state transactions, the payment is made as IGST. If the Exchanges structure the transaction as a broking transaction and the seller raises an invoice directly on the buyer, the intermediary may escape with the taxation of his charges only as a “Service Tax”.

Additionally after the initial moratorium period there would be Tax deduction at Source and Tax collected at source in some cases. If contravened, there would be interest, penalty and other liabilities.

The first principle to be remembered in GST is that it is the supplier of Goods or service who would be liable to pay GST. The seller of Bitcoin is therefore liable along with the Exchange and Wallet service provider. If the seller is unregistered, the reverse charge is on the exchange.

Then the Exchange sells Bitcoins to the buyer. If the exchange is registered, then it has to charge GST to the buyer.

If both the buyer and the seller are unregistered (because their turnover is less than Rs 20 lakhs) then there may be exemption of GST. In some cases such as imports, liability can be on the recipient.

GST needs to be paid immediately (by 20th of each month) on sale  and returns need to be filed within a fortnight (deferred now for 2 months).  The Tax collected at source (TCS) in GST means that any E Commerce operator who makes a payment for a transaction needs to withhold a designated percentage from the payment and remit it to GST authorities before the 10th of next month.

Since Bitcoin is not specifically mentioned in the list of Goods and it cannot be treated as an “Essential commodity” which maybe exempted from GST, nor it suffers a tax like the STT applicable for stocks and CTT applicable to commodities traded through exchanges,  the rate of GST on Bitcoins may be treated as 28%.

If the intermediary is liable for GST at both ends he may pay a reverse tax in one case and perhaps be eligible to claim input tax benefit at the other end.

Since Bitcoin is taxed under GST as a normal commodity which is manufactured, imported or exported, bought and sold at each purchase point the buyer is entitled to claim input credit. Hence the exchanges and wallet owners need to incorporate necessary systems in place to enable claiming of such input credits along with payment of GST. It would be interesting how the companies respond to this new challenge.

Naavi

A day after the Petya attack, it is now recognized that those who pay ransom for Petya attack may not be able to get the decryption key and decrypt their system back to action.

The attack is now being dubbed as “Not a Ransomware but a Wiper”.

Experts are now realizing that the malware was by design not meant to restore data on payment of ransom. It could be a mistake that the creators of the malware have committed or it could be an attempt by a state actor who wanted to attack Ukraine and wanted to disguise and mislead the security world that it was in deed a ransomware.

For more details one can refer to this article

According to these experts, unlike other ransomware, this malware does not encrypt at the file level. It encrypts the Master Boot Record (MBR) and makes the computer not bootable. Then it scans through the local network and infects other machines using other exploits. The malware replaces MBR with its own version which displays the ransom message.

It is however observed that the current variant of the malware encrypts the Master Boot Record (MBR) but does not keep a copy of the original MBR. Hence on payment of the ransom, the system cannot be recovered.

It is reported that the first around 45 victims who paid the ransom of around US $10500 in Bitcoins have not received the decryption keys.

There is therefore no hope for Pipavav Port or Jawaharlal Nehru Port Trust (JNPT) or any other victim of Petya (also called NotPetya or GoldenEye) to recover the data. They need to dig into their back ups and re construct their lost data.

However, what we in India need to be concerned more about the future attacks of similar nature that may be more devastating than the WannaCry or Petya. We in India are now on the eve of GST implementation and the Aadhar Based Payment systems, both of which have a highly centralized system structure which if infected, can cause havoc across the country.

It is to be noted that the devastation that occurred in Ukraine by  Petya malware was because the malware first infected a program called MeDoc through an official update from the vendor. This was a tax accounting system perhaps widely used in the country and hence it spread like wild fire.

When our GST is in place, we will have a “One Country- One Tax” system and it could bring in many benefits of its own. But at the same time, it may also turn out to be a “One Malware infection Point” in place and God forbid, if this is infected the country’s economic infrastructure may come down.

In a recent press statement, the authorities in charge of GST have stated that due to lack of time, they were not able even to complete the “Functional Testing” fully after the changes that continued upto the last minute. It is therefore reasonable to expect that “Security Testing” has not been also completed.

It is hoped that nothing will go wrong as we function under the Amir Khan’s “Three idiot’s Principle” that “If you believe All is well, then everything will be fine”.

I am sure that enough Poojas have been conducted across the country to ensure that the system works fine. If not, we need to organize such poojas to coincide with the launching of the GST at the midnight hour tomorrow.

But the Murphy’s law says that “If anything can go wrong, it will” and security observers have more faith in this principle than the Three Idiot’s principle.

In a country like India which has a constant terror threat supported by countries like China, there is every possibility that what may normally not go wrong statistically may also go wrong since there are enemies working on destroying the country both from outside and also from within including the political parties like Congress, TMC, National Conference, Communists etc. Hence even if a small vulnerability is found in a system like GST, the possibilities of it being exploited are near certain.

Our response to Petya should therefore include how we face a situation where a Petya type of destructive malware spreads through the GST system.

The first thing the GST authorities as well as all individual assesses should do is to always keep a 100% back up of every document that is created and processed in the system and that such back ups should be maintained in an off the network system which is well protected with a good malware protection system. GST needs to maintain a robust DRP/BCP system to have a parellel system ready for switch over in case the main system comes under a Cyber Attack.

All businesses should ensure that they donot link their operational computers directly to the GST system but use a separate computer to upload and down load documents to GST. Any transfer of files from their current accounting computers and the GST connected computer should be done securely avoiding spread of any malware during the transfer process. Similarly, the main accounting system should be insulated from normal internet activities including e-mail and web surfing. SMEs may find this burdensome but if they need to avoid regretting later, this is a small investment they need to consider.

Since the GST system was built when WannaCry had not yet been recognized as a big threat, it is possible that it might have used all the vulnerabilities that the recent set of malwares have exploited.

I hope the security agencies will be upto the task to super impose ransomware protection on the current GST system and ensure that our national system is well protected.

Refer articles:

GST Network safe from global malware attack, says CEO Prakash Kumar

No time to test software now, says GSTNetwork chairman Navin Kumar

At the same time, for whatever it is worth, we need to declare the GST system as a “Protected System” under Section 70 of ITA 2008 and also make it public that any attack on the GST system will be considered as a “Cyber Terrorist” attack which can immediately invoke international treaties for both investigation and protection.

Naavi

Thanks to the recent WannaCry ransomware that attracted wide attention, security professionals seem to have moved fast and identified what is claimed as a “Vaccine” for the Petya (a new version which some have called NotPetya) ransomware which is on the prowl. So far a couple of Indian companies seem to have been affected. May be we are not aware of more.

This ransomware appears with the following note on the affected desktops.

Just before the encryption, the following screen shot will appear.

When this alert appears, if the machine is powered off, the encryption would be stopped and the files may be preserved.

It can then be recovered by connecting it as an external hard disk to a secure system under a forensic supervision without booting from the disk. It should however be taken care that there is no reverse infection from the affected disk to the healthy system.

It may be better if the observation computer is first vaccinated as suggested subsequently here and even prudent if it is a clean machine with no other data to avoid any adverse effect of reverse infection if it occurs.

Also since the ransomware first delets the files before encryption and the proccess has been stopped in between, if the files have already been deleted, one may need to use a deleted data recovery software before the sectors are over written.

It appears that  this cyberattack appears to be an “updated variant” of the Petya malware virus. It uses the SMB (Server Message Block) vulnerability that WannaCry did, however in the case of Petya it encrypts, among other files,the master boot file. These messages recommend conduct a system reboot, after which the system is inaccessible. This basically means the operating system won’t be able to locate files.

Also Bleeping computer.com has suggested a simple vaccine which is available here: 

The suggested kill switch is creating a file titled “perfc” as a read only file in the Windows folder for which step by step guideline is provided in the article available here: 

I hope with the vaccine, the damage will be contained.

A reminder however is due that the attack again under scores the need for proper back ups in an off Network system and employees being vigilant in not downloading the ransomware through attachments in e-mails etc.

One of the suggestions made by experts is to block an e-mail and several IP addresses and domains as listed below.

Actions to be taken:

1. Block source E-mail address
wowsmith123456@posteo.net

2. Block domains:
http://mischapuk6hyrn72.onion/
http://petya3jxfp2f7g3i.onion/
http://petya3sen7dyko2n.onion/
http://mischa5xyix2mrhd.onion/MZ2MMJ
http://mischapuk6hyrn72.onion/MZ2MMJ
http://petya3jxfp2f7g3i.onion/MZ2MMJ
http://petya3sen7dyko2n.onion/MZ2MMJ
http://benkow.cc/71b6a493388e7d0b40c83ce903bc6b04.bin
COFFEINOFFICE.XYZ
http://french-cooking.com/

3. Block IPs:
95.141.115.108
185.165.29.78
84.200.16.242
111.90.139.247

I urge ISPs and MSPs to accomplish this at their end so that individuals are not required to do it at their end.

Naavi

Reference:

Cert-In recommendation is available here

Bitdefender  vaccine is available here;

Also read:

Petya Ransomware Outbreak Originated in Ukraine via Tainted Accounting Software

Petya cyber attack: Everything to know about the global ransomware outbreak

WORLD CYBER ATTACK: How to unlock computers hacked by Petya virus

Kasparesky: Petya ransomware eats your hard drives

Update:

Posteo.net has blocked the email accounts used in the Petya attack.

……..The action initiated by Posteo.net needs to be appreciated.

Naavi