- cypherpunks - lists.cpunks.org

Belgacom Hack (EN translation)
by coderman 24 Sep '13

24 Sep '13

http://cryptome.org/2013/09/belgacom-hack-en.htm / http://blog.cyberwar.nl/2013/09/belgacom-on-brink-of-catastrophe.html """ On the brink of catastrophe (2013-09-21) Ping. It's Friday the 13th. Around 11 o'clock in the morning, the IT consultants that Belgacom employs at its largest customers in the private and public sector receive a message. The message doesn't say much, except for an urgent request to cancel all appointments of that forenoon. An "emergency conference call" will take place instead. The news that is brought in that call makes the IT consultants gasp for breath. A piece of malicious software has been found on the network of BICS, a daughter company of Belgacom. It is hard to grasp even for well-informed insiders. The BICS network is so wide and deep that it is promptly clear to everybody that this is not just a Belgian problem. This problem is at least of European proportions. Because whoever controls BICS, controls the communication of a large part of the world. "This could have been larger than 9/11", says one source who closely followed the case. Without a grain of irony. The pressure on the teams of the Dutch digital defender Fox-IT, that started cleaning up together with an army of Belgacom employees last weekend, was enormous. It was their second attempt, various sources confirm. A first attempt to remove the villainous software from the infected computers at Belgacom in the last weekend of August was cancelled. "At the time, not all conditions were met required to remove everything at once", it was said. Some computers turned out to run the alternative operating system Linux, known of the penguin logo, not Windows. "The risk was too big that we could not remove everything at once. In that case you should not touch it. Or the adversary will know that the virus has been found", states someone politically involved. Strict conditions The investigation of the hacking started on July 19th, when Belgacom went to court. During their work, investigators at the intelligence services, police and justice were very wary of a leak about the entire operation. In early September they informed the Belgian cabinet on strict conditions: the list of attendees of that meeting was kept closely. If a politician would have wanted to reveal the news before the malware was dealt with, the investigators would press charges for breach of confidentiality of the investigation. "We could not risk everything going wrong due to someone talking", it is said. Belgacom was not infected with some common viruses, but with very professional malware that costed lots of money to develop. "We had to re-invent ourselves to do this", an investigator said. "In other investigations there is a fixed idea of where you're going, but in in this case it was continuously starting over because it was so difficult to get a grasp of the malware". Gradually it became clear that the hackers are not only interested in the communications in the Middle-East, where BICS holds a solid position via South-African minority shareholder MTN. "They have been looking around and took what they could", state sources involved in the investigation. They are clear about one thing: the attack originated from the United States. "We determine that by the signature of the malware, but especially by where the trails lead. They partially run through the UK. We think the US is the main destination. And the past weeks at the US Embassy, you notice some embarrassment when you request exchange of information." Yesterday, the German weekly magazine Der Spiegel reported that the UK intelligence service GCHQ (Government Communications Headquartes) are responsible for the attacks. It based that claim on slides disclosed by whistleblower Edward Snowden. The news that GCHQ is behind the Belgacom attack is a surprise to at least the services working on the affair. The malware could do anything The malware at Belgacom actually consists of a complex system of complementary viruses. They are all connected. If a problem is imminent or if they are detected, they can signal each other. "It is somewhat like a human virus, which also mutates continuously", states someone involved who monitors the situation for his service. "For example, one part is responsible for searching and storing information, while another part is continuously looks for pathways to the internet to transfer information. Other pieces of code are responsible for circumventing firewalls, or carry out surveillance. If someone detects the hacking or attempts to remove a part of it, the virus that is acting as a guard promptly signals the other parts. Because you don't know what the malware is capable of, everything can go horribly wrong at the last step." The cost of the entire detection and cleaning operation is correspondingly high. Fox-IT, the Dutch cyber security/defence company that is commissioned by Belgacom to first make inventory of the problems and then solve them, is a familiar name. "For the first two weeks they estimated the costs to be one million euro", states a well-placed source. And then adds that the entire operation lasted ten weeks. Moreover, Fox-IT did not expect that, at a certain point, it had to allocate all of its employees to this case. A price tag of over five million euro, then? "It won't be far off." But what was so terrifying about this cyber attack? And why the panic that something would go wrong? Telephone data about conversations with countries such as Afghanistan, Yemen and Syria that disappear, how could that have such an impact? They are 'just' stolen phone data, right? The involved expert sitting opposite us, looks dead serious. There is drama in his voice, but considering the contents of what he says, that is not unjustified. "This was highly performing malware and it was present in the nerve centre of communications. Anything that a highly privileged network operator of Belgacom could do, this system could do as well. I don't have to make a drawing of it? It had all the keys, all the passwords and full control. We must dare to classify this as a big crisis. This could have been a catastrophe. And people don't seem to realize." Sensitive customers Perhaps it wouldn't hurt to make that drawing. BICS calls itself a "wholesale carrier". Two words, four syllables, but behind it is a network that spans the entire globe and the beating heart of which is located in our capital, Brussels. BICS provides the hardware infrastructure that carries internet traffic, phone conversations, text messages and mobile data of telecom companies and government institutions. And the more sensitive the customer, the more likely he is the end up at BICS. The daughter company of Belgacom markets itself with the argument that they never ever look at what travels over its cables. "We provide the cables for you, and you just send whatever you want over them", is what it basically boils down to. A glance at the list of BICS' customers makes one dizzy. The financial transport center Swift, Electrabel, bpost, Belgocontrol, they are all connected to BICS. The NATO in Evere, the European Commission and Parliament, SHAPE, the Supreme Headquerters Allied Powers Europe, in Bergen; BICS, BICS, BICS. Even the headquarters of the NATO Allied Air Command, in Ramstein, Germany, from where the 2011 air attacks on Libya where coordinated, depends on BICS. Among the military, it is pointed out that military communications has an extra layer of security; but that pointing-out happens with a degree of humility that is very unusual to the military. "Every organisation, not just the government, must now begin to wonder whether it is dependent of one single provider, of one single network. And specially how well it is secured itself", states someone who was at the front row of the affair. "Belgacom, that is critical infrastructure. How can Belgium keep running without it? Those are the questions that we must ask now. Because the organisation responsible for the attack has in fact the capability to completely disrupt Belgacom and BICS." A different source confirms, reluctantly, the doom scenarios: "You can't think of it. It would be larger than 9/11. The planes would pretty much fall out of the sky." As a figure of speech? "Hm, yeah." Lifeline A governmental source points out the consequences of even a limited disruption of phone communications and internet. "If a crisis occurs, what is the first thing a human does? Grasp their phone. Imagine that that lifeline is lost. Not just for you, but also for the emergency services, hospital, the fire department...? And for the police? At first glance it isn't, because they use the Astrid network [a Belgian national radio communications network intended for emergency services]. But that network only works apart from BICS for local communications. For interregional communications it is just as dependent on BICS as the rest. Hence, it is no coincidence that police chief Catherine De Bolle started looking for a backup for the communications system of the federal police on that Friday the 13th, just before the big cleaning operation would have started. How long would it take before Belgacom was up and running again after a destructive cyber attack, is unclear. "But it is clear that we are not prepared to counter this type of attacks right now", states a high-ranking source. "That awareness must finally start to grow. I am very apprehensive for the feeling of relief that I already observe in some people. 'Ah well, that has been nicely dealt with. It's over.' It's not, mind you. Whoever doesn't realise, this week, that it is urgent, will never get it. Playing things down now is dangerous." After De Standaard brought the news of large-scale hacking at Belgacom, it turned out that the Ministry of Foreign Affairs and the cabinet of the prime minister had been hacked. "And this is merely the top of the iceberg", states a source who was involved in the problems at Belgacom. Because telecom is one thing, but there are many other critical sectors that are the fundament of a country. Transportation, for example. Trains, trams, busses, highways, airplanes, everything involves computer networks and everywhere one should be cautious for cyber attacks. The energy supply is another critical fundament. And last but not least: the banking sector of a country. Luxembourg has already contacted the Belgian cyberservices [?] to obtain more information about the malware that hit Belgacom. Awareness Besides budgets and well-paid IT personnel, the remedy against the growing cyberthreat will be found in improved awareness. "Belgium wants to invest in knowledge and innovation, but if one sector is vulnerable to espionage, it is that one. Just as many computers of the global diplomatic network of Foreign Affairs have post-its one them with the passwords, many small companies are slacking in their security", a cyber specialist states. "And if you dare ask whether their Chinese interns are thoroughly screened, they look at you as if you're from another planet." Whether the gravity of the situation is apparent to everyone, is doubtful. In official communications, Belgacom states that it currently has no evidence of impact on its customers or their data. Understandly, the company does not want to trigger hysteria, but it sounds like down-playing nonetheless. "What should we write then?", states spokesman Jan Margot in his response. "The infection was at dozens of computers in our own system. They have been cleaned together with the entire network." BICS too doesn't say much about it. "There are no indications of an impact on the telecomnetwork of BICS", it states in a press release. "A number of our IT systems are integrated in the infrastructure of Belgacom and are affected in that way, but that remained outside the network that carries customer traffic." "That's all put rather euphemistically", according to the investigators involved. "But you cannot accuse them of lying. A lot of thought went into every comma of the communication." Joke Did Belgium become the joke of de European mainland as a result of the compromise of Belgacom? Intelligence services are continuously in contact with each other and exchange information. For the image of our country, the past week has been anything but stellar, but it is emphasised nonetheless that in such contacts it is often also about personal relations between people. "Moreover, all countries have problems and everyone tries to rise above them." What about ethics? Isn't it schizophrenic that our country, Belgium, receives information about threats that the US or others have stolen from us? "That is the eternal paradox", a recipient of such information states. Diplomatically it is the hardest. But if you receive information about a serious threat such as terrorism, you cannot ignore it. Then you have different things on your mind. """

1 0

interesting collisions for 9ec4c12949a4f31474f299058ce2b22a
by coderman 24 Sep '13

24 Sep '13

are there any?

3 2

Attack Driven Defense - infosec rant [was: What is Intel(R) Core™ vPro™ Technology Animation]
by coderman 23 Sep '13

23 Sep '13

i really can't emphasize this enough: robust defense is based on realistic threats, and realistic threats are identified via attackers' perspective. i've been diving down this rabbit hole since before i challenged covert FLTINFOWARCEN members* to "get as blackhat on this motherfucker as you can" during an ad hoc challenge at DEF CON 13. i started down this path when i realized that robust peer to peer systems must protect each node to the highest degree required by any participant. it's the opposite of pandering to the "lowest common denominator". on the plus side, once you have addressed security for the "most stringent requirement" all other systems and peers enjoy the benefit of this elevated level of protection. the bad news is that attacks continue to improve, and i'm no where near satisfied in my ability to protect my own systems against the capabilities myself and my peers have at their disposal. the vast majority of infosec is useless bullshit, the vast majority of infosec conferences are pandering crap; the whole industry (educational/professional/military) is shit, if we're being honest. there is a great talk, fuck you to thinkst.com for blocking it, which covers these failings at just a conference level, with parallels to the industry as a whole: http://207.198.103.187:8081/infosuck-talk_about_talks.pdf sha256: ce836410fdc638066bf6aedec0e1d6f2ce66fb46329c5f92336e42a671272e55 i've never taken an infosec position, for these reasons, among others, and i don't plan to start. quality (and by extension, information security) should be a given, a "built-in" feature of any product, with the investment necessary to achieve it. anything less is bullshit; infosec should not exist! my $0.02 best regards, * hacker friends and i ran a challenge: here's the root password. we're running unencrypted 802.11b wifi, there's a $100 bill in the case. get in - you get money and the hardware! everyone failed, despite two interesting 0day attacks. (we ran IPsec with custom out-of-band keying seeded by VIA C5P hardware entropy generators with our own custom rngd.) after being unable to compromise our setup, $fed handed me a card. i still remember the latin translation adorning his card, which seems particular appropos given revelations this year: "let them hate us, so long as they fear us." On Mon, Sep 23, 2013 at 3:36 PM, coderman <coderman(a)gmail.com> wrote: > On Mon, Sep 23, 2013 at 1:33 PM, Jeffrey Walton <noloader(a)gmail.com> wrote: >> ... >> Do you just snatch the source code and intellectual property, or do >> you use it as a springboard into other things? (I've never really >> thought about it). > > > for better or for worse (mostly better) these systems have made their > way into release package builds and production deployment processes. > > i'm speaking in generalities here, for various reasons, but common > trajectories include: > - obtaining the private keys or http auth passwords for access to > source code repositories. > - obtaining ssh private keys for access to other systems, e.g. remote > build hosts or even production hosts. > - obtaining kerberos/ldap/http/* auth credentials for bug reporting > systems, release code signing, or other facilities. > - obtaining access to datacenter or operations automation: cfengine, > chef, puppet, etc. these are really useful ;) > - obtaining test automation tools and other "QA" hooks with elevated > access and fewer controls. > - privilege escalation on the CI host which in turn is often > whitelisted and useful as further pivot. > - providing example usage for invocation of and command line > parameters for custom internal software. > - providing excellent watering hole "infection vector" for technical > staff in an org. e.g. taking over engineering workstations. > > > from here you've got everything you need to infiltrate an entire organization. > > the source code provides "hard coded" keys/passwords or pointers to > files where interesting bits lay, > > the conduit to engineering systems which grant access to public facing > services and data stores, > > the credentials and access for all operational concerns, > > the org is your oyster...

1 1

Re: [cryptography] [Cryptography] What is Intel(R) Core™ vPro™ Technology Animation
by coderman 23 Sep '13

23 Sep '13

On Mon, Sep 23, 2013 at 1:33 PM, Jeffrey Walton <noloader(a)gmail.com> wrote: > ... > Do you just snatch the source code and intellectual property, or do > you use it as a springboard into other things? (I've never really > thought about it). for better or for worse (mostly better) these systems have made their way into release package builds and production deployment processes. i'm speaking in generalities here, for various reasons, but common trajectories include: - obtaining the private keys or http auth passwords for access to source code repositories. - obtaining ssh private keys for access to other systems, e.g. remote build hosts or even production hosts. - obtaining kerberos/ldap/http/* auth credentials for bug reporting systems, release code signing, or other facilities. - obtaining access to datacenter or operations automation: cfengine, chef, puppet, etc. these are really useful ;) - obtaining test automation tools and other "QA" hooks with elevated access and fewer controls. - privilege escalation on the CI host which in turn is often whitelisted and useful as further pivot. - providing example usage for invocation of and command line parameters for custom internal software. - providing excellent watering hole "infection vector" for technical staff in an org. e.g. taking over engineering workstations. from here you've got everything you need to infiltrate an entire organization. the source code provides "hard coded" keys/passwords or pointers to files where interesting bits lay, the conduit to engineering systems which grant access to public facing services and data stores, the credentials and access for all operational concerns, the org is your oyster...

1 0

Charge for Pen Register Service? $600 per target per two months.
by Jim Bell 23 Sep '13

23 Sep '13

The url http://www.tdcaa.com/node/4813 includes the claim, "Additionally, telephone companies typically charge an average of $600 per target to conduct pens [registers]." (Didn't say for how long, but I suppose it's two months.) And, http://www.wired.com/threatlevel/2013/08/millions-paid-prism-compliance/ said, "For example, Cox Communications charges $2,500 for a pen register/trap-and-trace order for 60 days." Imagine how expensive it would be if the NSA got a bill for $600 per two months to conduct a 'pen register' (metadata) on your, and the same charge covering everyone else's, phone. I'd suggest to the phone co. that they charge that $600 per two months, then take $200 of that and give me the whizziest, unlimited-service around the world, the bestest service that I could possibly want, and make a $400 profit to boot! Myself, I'd be far more comfortable if my metadata was being sold to the NSA if my full cell-phone bill was paid-for by them! In fact, at those prices, I'd want a second phone, too! (Does this make me a sell-out?!?) Interesting guide to telecoms to comply with the law: http://www.kelleydrye.com/publications/client_advisories/0134/_res/id=Files… I wonder if anybody has implemented a 'metadata-killer': An app, perhaps, for a smartphone which accesses a 'telephone remailer': A (friendly) MITM (Man in the Middle) which can be called, and will automatically forward the call based on encrypted-number data, and maintain the connection to the target phone number. It would make collection of metadata much more difficult. Companies which do internet phone calls would be obvious candidates for that function. (Skype, Ooma, etc.) Jim Bell

2 1

Re: [cryptography] [Cryptography] What is Intel(R) Core™ vPro™ Technology Animation
by coderman 23 Sep '13

23 Sep '13

On Sun, Sep 22, 2013 at 9:21 PM, Jeffrey Walton <noloader(a)gmail.com> wrote: > ... > Painting with a broad brush, part of the solution is a remote > administration board that can''t be removed. Cf, Fujitsu LOM (Lights > Out Management), HP ILO (Integrated Lights Out) HP RILO (Remote > Integrated Lights Out), Compaq RIB (Remote Insight Board), and Dell > DRAC (Dell Remote Access Card). > > As for who has access, that depends on the quality of the > implementations. > https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4784. as an attacker, these are my favorite systems, second only to continuous integration servers. remote access subsystems are hard to upgrade, poorly maintained, and provide exceptional access to hosts and systems. (and in fact, abusing a DRAC to get to the CI to then get keys to the kingdom, is a standard approach once you've got a pivot in network) i cannot count the number of times i've seen insecure configurations deployed, either self signed certs, common passwords, insecure ACLs, or all of the above. i can count the number of times i've seen a properly configured RA system with legit PKI and password management: ZERO! the traditional enterprise network is a soft gooey core with a fig leaf perimeter defense. sad realities...

1 0

[tor-talk] Tor mini-hackathon at GNU 30th Anniversary Celebration on 28-29 Sep
by Eugen Leitl 23 Sep '13

23 Sep '13

----- Forwarded message from Nick Mathewson <nickm(a)freehaven.net> ----- Date: Fri, 20 Sep 2013 21:00:35 -0400 From: Nick Mathewson <nickm(a)freehaven.net> To: "tor-talk(a)lists.torproject.org" <tor-talk(a)lists.torproject.org> Subject: [tor-talk] Tor mini-hackathon at GNU 30th Anniversary Celebration on 28-29 Sep Reply-To: tor-talk(a)lists.torproject.org Hi, all! Tor will be one of several fine software projects featured in the featured in the GNU 30th Anniversary Celebration and Hackathon next weekend at MIT. If you like to program, and you're interested in helping with Tor, sign up on the webpage (https://gnu.org/gnu30/celebration) and come on by! I'll be there myself, hoping to spend my time coding and getting people excited about hacking on Tor. Other Tor people in the greater Boston area may come by as well-I hope we can get at least two or three. I don't currently expect to have all of our sub-projects represented, but we'll try to put you in contact with the right people if you want to hack on something else. I'll try to have a list of fun suggested projects for people to work on ahead of the event, ideally on a wiki somewhere. peace, -- Nick Mathewson -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

2 1

[tor-talk] Future changes to the legal code, in Russia.
by Eugen Leitl 23 Sep '13

23 Sep '13

----- Forwarded message from Nasuno <nasuno(a)riseup.net> ----- Date: Sun, 22 Sep 2013 16:51:25 -0700 From: Nasuno <nasuno(a)riseup.net> To: tor-talk(a)lists.torproject.org Subject: [tor-talk] Future changes to the legal code, in Russia. User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130704 Icedove/17.0.7 Reply-To: tor-talk(a)lists.torproject.org Thought this might be of interest. hxxp://rt.com/politics/russia-tor-anonymizer-ban-571/ a couple of snipets The head of the Federal Security Service (FSB) has personally ordered preparations for laws that would block the Tor anonymity network from the entire Russian sector of the Internet, a Russian newspaper reported. & The agency, however, informed the activists about possible future changes to the legal code. -- Subscribed to post this as I saw nowhere else appropriate on the website to relay this to anyone. Probably old news anyhow. Peace. Nasuno -- tor-talk mailing list - tor-talk(a)lists.torproject.org To unsusbscribe or change other settings go to https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

Re: [cryptography] Deleting data on a flash?
by Eugen Leitl 23 Sep '13

23 Sep '13

----- Forwarded message from Moritz <moritz(a)headstrong.de> ----- Date: Mon, 23 Sep 2013 10:26:42 +0200 From: Moritz <moritz(a)headstrong.de> To: cryptography(a)randombit.net Subject: Re: [cryptography] Deleting data on a flash? User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130827 Icedove/17.0.8 On 09/23/2013 10:02 AM, ianG wrote: >> The issue is that it's pretty much impossible to delete data securely >> from a flash device. > Why is that? The flash memory controller hides the real storage cells from you and spreads writes across all cells equally for wear-leveling. You cannot directly access the cells. Some SSDs have a secure erase option, but you never know if it is properly implemented, and you can only use it to wipe the complete drive. https://www.schneier.com/blog/archives/2011/03/erasing_data_fr.html [...] Our results lead to three conclusions: First, built-in commands are effective, but manufacturers sometimes implement them incorrectly. Second, overwriting the entire visible address space of an SSD twice is usually, but not always, sufficient to sanitize the drive. Third, none of the existing hard drive-oriented techniques for individual file sanitization are effective on SSDs. --Mo _______________________________________________ cryptography mailing list cryptography(a)randombit.net http://lists.randombit.net/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0

[Cryptography] RSA recommends against use of its own products.
by Eugen Leitl 23 Sep '13

23 Sep '13

----- Forwarded message from Ray Dillinger <bear(a)sonic.net> ----- Date: Fri, 20 Sep 2013 11:08:00 -0700 From: Ray Dillinger <bear(a)sonic.net> To: cryptography(a)metzdowd.com Subject: [Cryptography] RSA recommends against use of its own products. User-Agent: Mozilla/5.0 (X11; Linux i686; rv:17.0) Gecko/20130828 Icedove/17.0.8 More fuel for the fire... http://rt.com/usa/nsa-weak-cryptography-rsa-110/ RSA today declared its own BSAFE toolkit and all versions of its Data Protection Manager insecure, recommending that all customers immediately discontinue use of these products. The issue is apparently the Random Number Generator that these products use, the rather amusingly named "Dual Elliptic Curve Deterministic Random Bit Generator." *1 And according to more of the Snowden Files released to (or by) the New York Times last week, that pseudorandom generator is deliberately flawed in order to allow it to be sod... um, excuse me, I should have said, to permit backdoor penetration. RSA was truly between a rock and a hard place here as I see it. With the deliberate weakness now made public, they took a terrific blow to their business. But failure to follow up with a recommendation against their own products, no matter how much additional financial pain that action entails, would have destroyed all trust in their company and prospects for future business. As best I can tell, they have lost $Millions at least due to the tampering of their products, and American security and software companies taken as a whole are in the process of losing $Billions to foreign competitors for the same reasons. I wonder, would a class action suit seeking compensation for this wholesale sabotage be within the jurisdiction of the FISA court? Bear *1 "Anyone who attempts to generate random numbers by deterministic means is, of course, living in a state of sin." -- John Von Neumann _______________________________________________ The cryptography mailing list cryptography(a)metzdowd.com http://www.metzdowd.com/mailman/listinfo/cryptography ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://ativel.com http://postbiota.org AC894EC5: 38A5 5F46 A4FF 59B8 336B 47EE F46E 3489 AC89 4EC5

1 0