#export fonts in Base64 encoding

[dcpwebdesigners-blog]

Best Helper Sites for Web Designers

Web designers constantly seek ways to improve their workflows, enhance creativity, and accelerate the design process. Thankfully, there are countless online tools and resources available that make the job easier, whether you’re a seasoned professional or just starting your website design journey.

Download Infographic

In this post, we’ll explore some of the best helper sites for web designers, covering tools for design inspiration, code generation, asset creation, and productivity.

Get Waves

Get Waves is a fantastic resource for creating beautiful, customisable SVG wave patterns. These waves are perfect for adding a dynamic visual element to your website backgrounds or section dividers. The site offers a simple, intuitive interface that allows you to adjust wave height, colour, and smoothness before exporting the final SVG file. This makes it a favourite among web designers looking to add a touch of fluid design to their projects.

Key Features:

Generate unique, customisable SVG wave designs

Easy export options

No design skills required

Wordmark

Wordmark is a powerful tool for previewing and selecting the perfect font for your design projects. Simply type in a word or phrase, and Wordmark will display it in every font installed on your computer. This is a huge time-saver for designers who want to quickly compare different font styles without manually cycling through each option in their design software.

Key Features:

Preview text in all installed fonts

Filter by font style and weight

Supports Google Fonts and Adobe Fonts

Omatsuri

Omatsuri is a collection of simple, open-source tools for everyday web design tasks. It includes utilities for generating CSS gradients, SVG shapes, base64 encoders, and even lorem ipsum text. This all-in-one toolkit is a must-have for web designers looking to streamline their daily tasks without switching between multiple apps.

Key Features:

Wide range of design tools

Free and open-source

Clean, ad-free interface

Haikei

Haikei is a creative generator for unique, high-quality SVG backgrounds, patterns, and abstract shapes. It’s perfect for designers looking to add visually engaging elements to their projects. With its wide range of patterns, textures, and gradients, Haikei offers endless design possibilities.

Key Features:

Generate complex SVG designs

High-quality exports

Real-time design adjustments

Playbook

Playbook is a collaborative design platform that helps teams organise, share, and review design assets in one place. It’s ideal for agencies and freelance designers who need to manage multiple projects and clients. Playbook also offers powerful search and tagging features, making it easy to find exactly what you need when you need it.

Key Features:

Centralised asset management

Collaboration tools for teams

Powerful search and tagging

Tiny Helpers

Tiny Helper is a curated collection of small, free, and incredibly useful tools for developers and designers. It covers a wide range of utilities, including CSS generators, favicon creators, colour pickers, and accessibility checkers. Tiny Helper is perfect for quickly solving small design and development problems without the need for bulky software.

Key Features:

Huge collection of bite-sized tools

Free to use and regularly updated

Ideal for quick design and development tasks

Conclusion

Whether you’re creating custom wave backgrounds, selecting the perfect font, or managing your design assets, these helper sites can significantly improve your workflow as a web developer.

By integrating these tools into your daily routine, you can streamline your creative process, reduce time spent on repetitive tasks, and deliver polished, professional results to your clients.

Give these tools a try and take your web design projects to the next level.

Article first published on: https://dcpweb.co.uk/blog/best-helper-sites-for-web-designers

[file-formats-programming]

Automatic Tracking of Changes in Word Documents & Getting/Setting Locale of Field inside Cloud Apps

What's New in this Release?

Aspose team is pleased to announce the release of Aspose.Words for Cloud 17.3.0. Aspose team is pleased to announce the release of Aspose.Words for Cloud 17.3.0. This release contains a couple of new features and three enhancements to Aspose.Words for Cloud. Aspose.Words core library has also been updated to version 17.3. It has provided functionality similar to Document.StartTrackRevisions and Document.StopTrackRevisions Methods in Aspose.Words for .NET. The Document.StartTrackRevisions method starts automatically marking all further changes you make to the document programmatically as revision changes. And the Document.StopTrackRevisions method Stops automatic marking of document changes as revisions. Aspose team has added following two new “common request parameters” in Aspose.Words for Cloud API. If usesrs set this parameter and then make some changes to the document programmatically, save the document and later open the document in MS Word you will see these changes as revisions. The date and time to use for revisions. It has  added “ExportFontsAsBase64, ResourceFolder and ResourceFolderAlias” to the HtmlSaveOptions class. It is used to specify whether fonts resources should be embedded to HTML in Base64 encoding. it also supports to specify whether fonts resources should be embedded to HTML in Base64 encoding. It is used to specify a physical folder where all resources like images, fonts, and external CSS are saved when a document is exported to HTML. It can be used to specify the name of the folder used to construct URIs of all resources written into an HTML document. Default is an empty string. Aspose team has added a property that allows to get/set field’s locale. You can use it to get or set the LCID of the field. It has added new properties “OfficeMathDisplayType”, “OfficeMathJustification” and “MathObjectType” to the OfficeMath object. It also supports get/set Office Math display format type which represents whether an equation is displayed inline with the text or displayed on its own line. The list of new and enhanced features added in this release are given below

Add HtmlSaveOptions "ExportFontsAsBase64,ResourceFolder,ResourceFolderAlias"

Add a property that allows to get/set field's locale:

Add new properties to OfficeMathObject

Provide functionality similar to Document.StartTrackRevisions and Document.StopTrackRevisions Methods

Add "render page" resource

Start a free trial today – all users need is to sign up with the Aspose for Cloud service. Once signed up, users are ready to try the powerful file processing features offered by Aspose for Cloud.

Overview: Aspose for Cloud

Aspose for Cloud is a cloud-based document generation, conversion and automation platform for developers that offer a unique suite of APIs to work with Word documents, Excel spreadsheets, PowerPoint presentations, PDFs, and email formats and protocols. It supports all features for file processing, document scanning, barcodes creation and recognition, and allows extracting text or images too. Users can also work with SaaSpose APIs using REST SDKs that can be called from .NET, Java, PHP and Ruby etc.

More about Aspose for Cloud

Learn More about Aspose.Words for Cloud

Download latest release of Aspose.Words for Cloud

Online Documentation for Aspose.Words for Cloud

[shakib-posts]

Getting Started with SVG

Scalable Vector Graphics (SVG) is an image format whose specification is defined by the W3C. SVG describes two-dimensional vector graphics using XML markup. You can think of it as the HTML equivalent for images.

Instead of defining images with columns and lines of pixels, SVG uses geometric primitives such as points, lines, curves and polygons to represent the image. This is what we call vector graphics. The difference is in the way these images work when we increase their size. Since vector images use mathematical expressions to resize the graph, we have no loss in defining the image.

Focusing on SVG, we have other advantages:

As they are text files, we can serve the images with gzip, which has an excellent compression factor.

Works great on high-density screens such as those on the iPhone and MacBook Pro Retina.

It may be manipulated through JavaScript.

But not everything is beautiful. Depending on the browsers you need to support, you might have to fallback to raster images, such as PNG. Internet Explorer only started supporting SVGs from version 9 and in Android 2.3, for example, it is not supported. SVG performance can also be a problem if you need to animate many images simultaneously. This is not the case with raster images.

Creating SVG Files

Although SVG files are only XML, you are much more likely to use a vector image editor to create your graphics. The most common alternatives are Adobe Illustrator and Inkscape, but on the Mac there is another very good alternative called Sketch.

SVG works best when the image is not that complex. This is because its size can increase a lot depending on what you are going to do; solid colors are much smaller than gradients, for example. This does not mean that you cannot have complex graphics but keep the file size issue in mind if you are going to use this SVG on a website.

If you use Adobe Illustrator, there are some things you can do to reduce this complexity when exporting SVG. Other applications may have similar functionality, but I don't know how each of them works.

The first thing to do is to expand the graphics, modifying the attributes that define its appearance and other properties of elements that are within it. This will also help with things like opacity and gradients, although it doesn't always work well.

Select the graph, go to the Object > Expand menu. If the chart has defined appearance attributes, you will need to select Object > Expand Appearance first.

Expanding Graphics in Illustrator

Another thing you can do is put the different parts of the chart together. Display the Pathfinder options panel at Window > Pathfinder and choose the "Merge" option. Sometimes the graph changes (things like opacity stop working) and we undo that option.

Always set the artboard close to the graphic. This can be done easily through the Object > Artboards > Fit to Artwork Bounds option.

Finally, when exporting, there are also some things to do.

Choose the SVG 1.1 profile, which has the greatest compatibility between browsers. The SVG Tiny 1.1 profiles and variations are aimed at mobile devices but do not yet have good support.

If you don't need to manipulate text dynamically, convert all fonts to objects. This will make the text retain the characteristics you have defined, without increasing the final file size, since for all intents and purposes the texts will only be objects.

Files exported by editors can be optimized. The files generated by Illustrator, for example, always have elements that can be removed, in addition to redundant attributes. You can use a tool like SVGO to automate this optimization process.

To install it, you will need Node.js.

npm install -g svgo

Now, run the following command to optimize the SVG:

svgo logo.svg logo.min.svg

Ready! Now just add SVG to your HTML document.

Adding SVG to HTML

There are a few different ways to add SVG to HTML. The simplest way is to use the <img> tag to do this.

<img src="logo.svg" alt="My logo">

The <object> tag also works very well.

<object type="image/svg+xml" data="logo.svg"></object>

Finally, you can add the <svg> tag directly to your document. Just open the file and copy the <svg> element.

This method has advantages and disadvantages. The main advantage is that you can manipulate the background color and borders of SVG elements with CSS, for example.

circle { fill: blue; }

The disadvantage, however, is that you can no longer rely on the browser cache since the element will be added directly to the document.

You can also use SVG as background images. To do this, just reference the file as you already do with PNGs, for example.

.logo { background: url(logo.svg) no-repeat; height: 356px; width: 408px; }

A very common technique is to encode the SVG in Base64 and add it directly to the CSS file. You can do this using the base64 command, available on * nix systems. Sorry, Windows users, I have no idea how that works in Windows.

$ base64 sample.svg | pbcopy

With this content in hand, we can now add this directly to the CSS, using data URIs.

.logo { width: 20px; height: 20px; background: url(data:image/svg+xml;base64,PHN2ZyBpZD0iQ2FwYV8xIiBlbmFibGUtYmFja2dyb3VuZD0ibmV3IDAgMCA1MTIgNTEyIiBoZWlnaHQ9IjUxMiIgdmlld0JveD0iMCAwIDUxMiA1MTIiIHdpZHRoPSI1MTIiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyI+PGc+PHBhdGggZD0ibTEyMCAyNTZjMC0yNS4zNjcgNi45ODktNDkuMTMgMTkuMTMxLTY5LjQ3N3YtODYuMzA4aC04Ni4zMDhjLTM0LjI1NSA0NC40ODgtNTIuODIzIDk4LjcwNy01Mi44MjMgMTU1Ljc4NXMxOC41NjggMTExLjI5NyA1Mi44MjMgMTU1Ljc4NWg4Ni4zMDh2LTg2LjMwOGMtMTIuMTQyLTIwLjM0Ny0xOS4xMzEtNDQuMTEtMTkuMTMxLTY5LjQ3N3oiIGZpbGw9IiNmYmJkMDAiLz48cGF0aCBkPSJtMjU2IDM5Mi02MCA2MCA2MCA2MGM1Ny4wNzkgMCAxMTEuMjk3LTE4LjU2OCAxNTUuNzg1LTUyLjgyM3YtODYuMjE2aC04Ni4yMTZjLTIwLjUyNSAxMi4xODYtNDQuMzg4IDE5LjAzOS02OS41NjkgMTkuMDM5eiIgZmlsbD0iIzBmOWQ1OCIvPjxwYXRoIGQ9Im0xMzkuMTMxIDMyNS40NzctODYuMzA4IDg2LjMwOGM2Ljc4MiA4LjgwOCAxNC4xNjcgMTcuMjQzIDIyLjE1OCAyNS4yMzUgNDguMzUyIDQ4LjM1MSAxMTIuNjM5IDc0Ljk4IDE4MS4wMTkgNzQuOTh2LTEyMGMtNDkuNjI0IDAtOTMuMTE3LTI2LjcyLTExNi44NjktNjYuNTIzeiIgZmlsbD0iIzMxYWE1MiIvPjxwYXRoIGQ9Im01MTIgMjU2YzAtMTUuNTc1LTEuNDEtMzEuMTc5LTQuMTkyLTQ2LjM3N2wtMi4yNTEtMTIuMjk5aC0yNDkuNTU3djEyMGgxMjEuNDUyYy0xMS43OTQgMjMuNDYxLTI5LjkyOCA0Mi42MDItNTEuODg0IDU1LjYzOGw4Ni4yMTYgODYuMjE2YzguODA4LTYuNzgyIDE3LjI0My0xNC4xNjcgMjUuMjM1LTIyLjE1OCA0OC4zNTItNDguMzUzIDc0Ljk4MS0xMTIuNjQgNzQuOTgxLTE4MS4wMnoiIGZpbGw9IiMzYzc5ZTYiLz48cGF0aCBkPSJtMzUyLjE2NyAxNTkuODMzIDEwLjYwNiAxMC42MDYgODQuODUzLTg0Ljg1Mi0xMC42MDYtMTAuNjA2Yy00OC4zNTItNDguMzUyLTExMi42MzktNzQuOTgxLTE4MS4wMi03NC45ODFsLTYwIDYwIDYwIDYwYzM2LjMyNiAwIDcwLjQ3OSAxNC4xNDYgOTYuMTY3IDM5LjgzM3oiIGZpbGw9IiNjZjJkNDgiLz48cGF0aCBkPSJtMjU2IDEyMHYtMTIwYy02OC4zOCAwLTEzMi42NjcgMjYuNjI5LTE4MS4wMiA3NC45OC03Ljk5MSA3Ljk5MS0xNS4zNzYgMTYuNDI2LTIyLjE1OCAyNS4yMzVsODYuMzA4IDg2LjMwOGMyMy43NTMtMzkuODAzIDY3LjI0Ni02Ni41MjMgMTE2Ljg3LTY2LjUyM3oiIGZpbGw9IiNlYjQxMzIiLz48L2c+PC9zdmc+) }

With this technique we can count on the browser's cache and load the graphics in a single request — but keep an eye on the file size as it can easily get too big.

Compression

Because it is a text-based file, SVG has an excellent compression factor. A 10KB file, for example, drops to 3.2KB when served with gzip.

If you use the Data URI technique, a file containing 13KB drops to 4.9KB when served with gzip.

Fallback

The drawback is that if you need to support IE8, you will need to fallback to PNGs, for example. A simple way to do this is to use the images' onerror event, which is launched when an SVG tries to load. Just add the function below to <head> and define the event in the images.

<script> function toPNG(image) { image.onerror = null; image.src = image.src.replace(/\.svg$/, ".png"); } </script> <img src="logo.svg" alt="Logo" onerror="toPNG(this);">

Another technique that can be used is with the <object> tag. It is possible to define content that will be rendered if the browser does not support SVG. One problem with this technique is that the PNG image is always loaded, even when the browser supports SVG.

<object data="logo.svg" type="image/svg+xml"> <img src="logo.png" alt="Logo"> </object>

In the case of background images, I use Modernizr. When a browser that does not support SVG is detected, a no-svg class is added to the <html> tag, allowing you to display the PNG conditionally.

.logo { background-image: url(logo.svg); } .no-svg .logo { background-image: url(logo.png); } In Conclusion

SVGs are almost always small, do not need a larger version for Hi-DPI screens and they have an excellent compression factor.

The sprite issue may not be that simple, but it is possible. Alternatively, you can use Data URIs, which will also be served with gzip.

Take a test. The chances of you wanting to use it for everything are great!

About the Author

Diogo Souza works as a Java Developer at PagSeguro and has worked for companies such as Indra Company, Atlantic Institute and Ebix LA. He is also an Android trainer, speaker at events on Java and mobile world.

Visit our website here 

svg cut files

[lbcybersecurity]

Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations

Cyber espionage actors, now designated by FireEye as APT32 (OceanLotus Group), are carrying out intrusions into private sector companies across multiple industries and have also targeted foreign governments, dissidents, and journalists. FireEye assesses that APT32 leverages a unique suite of fully-featured malware, in conjunction with commercially-available tools, to conduct targeted operations that are aligned with Vietnamese state interests.

APT32 and FireEye’s Community Response

In the course of investigations into intrusions at several corporations with business interests in Vietnam, FireEye’s Mandiant incident response consultants uncovered activity and attacker-controlled infrastructure indicative of a significant intrusion campaign. In March 2017, in response to active targeting of FireEye clients, the team launched a Community Protection Event (CPE) – a coordinated effort between Mandiant incident responders, FireEye as a Service (FaaS), FireEye iSight Intelligence, and FireEye product engineering – to protect all clients from APT32 activity.

In the following weeks, FireEye released threat intelligence products and updated malware profiles to customers while developing new detection techniques for APT32’s tools and phishing lures. This focused intelligence and detection effort led to new external victim identifications as well as providing sufficient technical evidence to link twelve prior intrusions, consolidating four previously unrelated clusters of threat actor activity into FireEye’s newest named advanced persistent threat group: APT32.

APT32 Targeting of Private Sector Company Operations in Southeast Asia

Since at least 2014, FireEye has observed APT32 targeting foreign corporations with a vested interest in Vietnam’s manufacturing, consumer products, and hospitality sectors. Furthermore, there are indications that APT32 actors are targeting peripheral network security and technology infrastructure corporations, as well as consulting firms that may have connections with foreign investors.

Here is an overview of intrusions investigated by FireEye that are attributed to APT32:

In 2014, a European corporation was compromised prior to constructing a manufacturing facility in Vietnam.

In 2016, Vietnamese and foreign-owned corporations working in network security, technology infrastructure, banking, and media industries were targeted. 

In mid-2016, malware that FireEye believes to be unique to APT32 was detected on the networks of a global hospitality industry developer with plans to expand operations into Vietnam.

From 2016 through 2017, two subsidiaries of U.S. and Philippine consumer products corporations, located inside Vietnam, were the target of APT32 intrusion operations.

In 2017, APT32 compromised the Vietnamese offices of a global consulting firm.

Table 1 shows a breakdown of APT32 activity, including the malware families used in each.

Year

Country

Industry

Malware

2014

Vietnam

Network Security

WINDSHIELD

2014

Germany

Manufacturing

WINDSHIELD

2015

Vietnam

Media

WINDSHIELD

2016

Philippines

Consumer products

KOMPROGO WINDSHIELD SOUNDBITE BEACON

2016

Vietnam

Banking

WINDSHIELD

2016

Philippines

Technology Infrastructure

WINDSHIELD

2016

China

Hospitality

WINDSHIELD

2016

Vietnam

Media

WINDSHIELD

2016

United States

Consumer Products

WINDSHIELD PHOREAL BEACON SOUNDBITE

2017

United Kingdom

Consulting

SOUNDBITE

Table 1: APT32 Private Sector Targeting Identified by FireEye

APT32 Interest in Political Influence and Foreign Governments

In addition to focused targeting of the private sector with ties to Vietnam, APT32 has also targeted foreign governments, as well as Vietnamese dissidents and journalists since at least 2013. Here is an overview of this activity:

A public blog published by the Electronic Frontier Foundation indicated that journalists, activists, dissidents, and bloggers were targeted in 2013 by malware and tactics consistent with APT32 operations.

In 2014, APT32 leveraged a spear-phishing attachment titled “Plans to crackdown on protesters at the Embassy of Vietnam.exe," which targeted dissident activity among the Vietnamese diaspora in Southeast Asia. Also in 2014, APT32 carried out an intrusion against a Western country’s national legislature.

In 2015, SkyEye Labs, the security research division of the Chinese firm Qihoo 360, released a report detailing threat actors that were targeting Chinese public and private entities including government agencies, research institutes, maritime agencies, sea construction, and shipping enterprises. The information included in the report indicated that the perpetrators used the same malware, overlapping infrastructure, and similar targets as APT32.

In 2015 and 2016, two Vietnamese media outlets were targeted with malware that FireEye assesses to be unique to APT32.

In 2017, social engineering content in lures used by the actor provided evidence that they were likely used to target members of the Vietnam diaspora in Australia as well as government employees in the Philippines.

APT32 Tactics

In their current campaign, APT32 has leveraged ActiveMime files that employ social engineering methods to entice the victim into enabling macros. Upon execution, the initialized file downloads multiple malicious payloads from remote servers. APT32 actors continue to deliver the malicious attachments via spear-phishing emails.

APT32 actors designed multilingual lure documents which were tailored to specific victims. Although the files had “.doc” file extensions, the recovered phishing lures were ActiveMime “.mht” web page archives that contained text and images. These files were likely created by exporting Word documents into single file web pages.

Table 2 contains a sample of recovered APT32 multilingual lure files.

ActiveMime Lure Files

MD5

2017年员工工资性津贴额统计报告.doc (2017 Statistical Report on Staff Salary and Allowances)

5458a2e4d784abb1a1127263bd5006b5

Thong tin.doc (Information)

ce50e544430e7265a45fab5a1f31e529

Phan Vu Tutn CV.doc

4f761095ca51bfbbf4496a4964e41d4f

Ke hoach cuu tro nam 2017.doc (2017 Bailout Plan)

e9abe54162ba4572c770ab043f576784

Instructions to GSIS.doc

fba089444c769700e47c6b44c362f96b

Hoi thao truyen thong doc lap.doc (Traditional Games)

f6ee4b72d6d42d0c7be9172be2b817c1 

Giấy yêu cầu bồi thường mới 2016 - hằng.doc (New 2016 Claim Form)

aa1f85de3e4d33f31b4f78968b29f175

Hoa don chi tiet tien no.doc (Debt Details)

5180a8d9325a417f2d8066f9226a5154

Thu moi tham du Hoi luan.doc (Collection of Participants)

f6ee4b72d6d42d0c7be9172be2b817c1

Danh sach nhan vien vi pham ky luat.doc (List of Employee Violations)

6baafffa7bf960dec821b627f9653e44

  Nội-dung-quảng-cáo.doc (Internal Content Advertising)

471a2e7341f2614b715dc89e803ffcac

HĐ DVPM-VTC 31.03.17.doc

f1af6bb36cdf3cff768faee7919f0733

Table 2: Sampling of APT32 Lure Files

The Base64 encoded ActiveMime data also contained an OLE file with malicious macros. When opened, many lure files displayed fake error messages in an attempt to trick users into launching the malicious macros. Figure 1 shows a fake Gmail-theme paired with a hexadecimal error code that encourages the recipient to enable content to resolve the error. Figure 2 displays another APT32 lure that used a convincing image of a fake Windows error message instructing the recipient to enable content to properly display document font characters.

Figure 1: Example APT32 Phishing Lure – Fake Gmail Error Message

Figure 2: Example APT32 Phishing Lure – Fake Text Encoding Error Message

APT32 operators implemented several novel techniques to track the efficacy of their phishing, monitor the distribution of their malicious documents, and establish persistence mechanisms to dynamically update backdoors injected into memory.

In order to track who opened the phishing emails, viewed the links, and downloaded the attachments in real-time, APT32 used cloud-based email analytics software designed for sales organizations. In some instances, APT32 abandoned direct email attachments altogether and relied exclusively on this tracking technique with links to their ActiveMime lures hosted externally on legitimate cloud storage services.

To enhance visibility into the further distribution of their phishing lures, APT32 utilized the native web page functionality of their ActiveMime documents to link to external images hosted on APT32 monitored infrastructure.

Figure 3 contains an example phishing lure with HTML image tags used for additional tracking by APT32.

Figure 3: Phishing Lure Containing HTML Image Tags for Additional Tracking

When a document with this feature is opened, Microsoft Word will attempt to download the external image, even if macros were disabled. In all phishing lures analyzed, the external images did not exist. Mandiant consultants suspect that APT32 was monitoring web logs to track the public IP address used to request remote images. When combined with email tracking software, APT32 was able to closely track phishing delivery, success rate, and conduct further analysis about victim organizations while monitoring the interest of security firms.

Once macros were enabled on the target system, the malicious macros created two named scheduled tasks as persistence mechanisms for two backdoors on the infected system. The first named scheduled task launched an application whitelisting script protection bypass to execute a COM scriptlet that dynamically downloaded the first backdoor from APT32’s infrastructure and injected it into memory. The second named scheduled task, loaded as an XML file to falsify task attributes, ran a JavaScript code block that downloaded and launched a secondary backdoor, delivered as a multi-stage PowerShell script. In most lures, one scheduled task persisted an APT32-specific backdoor and the other scheduled task initialized a commercially-available backdoor as backup.

To illustrate the complexity of these lures, Figure 4 shows the creation of persistence mechanisms for recovered APT32 lure “2017年员工工资性津贴额统计报告.doc”.

Figure 4: APT32 ActiveMime Lures Create Two Named Scheduled Tasks

In this example, a scheduled task named “Microsoft Scheduled Maintenance” was created to run Casey Smith’s “Squiblydoo” App Whitelisting bypass every 30 minutes. While all payloads can be dynamically updated, at the time of delivery, this task launched a COM scriptlet (“.sct” file extension) that downloaded and executed Meterpreter hosted on images.chinabytes[.]info. Meterpreter then loaded Cobalt Strike BEACON, configured to communicate with 80.255.3[.]87 using the Safebrowsing malleable C2 profile to further blend in with network traffic. A second scheduled task named “Scheduled Defrags” was created by loading the raw task XML with a backdated task creation timestamp of June 2, 2016. This second task ran “mshta.exe” every 50 minutes which launched an APT32-specific backdoor delivered as shellcode in a PowerShell script, configured to communicate with the domains blog.panggin[.]org, share.codehao[.]net, and yii.yiihao126[.]net.

Figure 5 illustrates the chain of events for a single successful APT32 phishing lure that dynamically injects two multi-stage malware frameworks into memory.

Figure 5: APT32 Phishing Chain of Events

The impressive APT32 operations did not stop after they established a foothold in victim environments. Several Mandiant investigations revealed that, after gaining access, APT32 regularly cleared select event log entries and heavily obfuscated their PowerShell-based tools and shellcode loaders with Daniel Bohannon’s Invoke-Obfuscation framework.

APT32 regularly used stealthy techniques to blend in with legitimate user activity:

During one investigation, APT32 was observed using a privilege escalation exploit (CVE-2016-7255) masquerading as a Windows hotfix.

In another investigation, APT32 compromised the McAfee ePO infrastructure to distribute their malware as a software deployment task in which all systems pulled the payload from the ePO server using the proprietary SPIPE protocol.

APT32 also used hidden or non-printing characters to help visually camouflage their malware on a system. For example, APT32 installed one backdoor as a persistent service with a legitimate service name that had a Unicode no-break space character appended to it. Another backdoor used an otherwise legitimate DLL filename padded with a non-printing OS command control code.

APT32 Malware and Infrastructure

APT32 appears to have a well-resourced development capability and uses a custom suite of backdoors spanning multiple protocols. APT32 operations are characterized through deployment of signature malware payloads including WINDSHIELD, KOMPROGO, SOUNDBITE, and PHOREAL. APT32 often deploys these backdoors along with the commercially-available Cobalt Strike BEACON backdoor. APT32 may also possess backdoor development capabilities for macOS.

The capabilities for this unique suite of malware is shown in Table 3.

Malware

Capabilities

WINDSHIELD

Command and control (C2) communications via TCP raw sockets

Four configured C2s and six configured ports – randomly-chosen C2/port for communications

Registry manipulation

Get the current module's file name

Gather system information including registry values, user name, computer name, and current code page

File system interaction including directory creation, file deletion, reading, and writing files

Load additional modules and execute code

Terminate processes

Anti-disassembly

KOMPROGO

Fully-featured backdoor capable of process, file, and registry management

Creating a reverse shell

File transfers

Running WMI queries

Retrieving information about the infected system

SOUNDBITE

C2 communications via DNS

Process creation

File upload

Shell command execution

File and directory enumeration/manipulation

Window enumeration

Registry manipulation

System information gathering

PHOREAL

C2 communications via ICMP

Reverse shell creation

Filesystem manipulation

Registry manipulation

Process creation

File upload

BEACON (Cobalt Strike)

Publicly available payload that can inject and execute arbitrary code into processes

Impersonating the security context of users

Importing Kerberos tickets

Uploading and downloading files

Executing shell commands

Configured with malleable C2 profiles to blend in with normal network traffic

Co-deployment and interoperability with Metasploit framework

SMB Named Pipe in-memory backdoor payload that enables peer-to-peer C2 and pivoting over SMB

Table 3: APT32 Malware and Capabilities

APT32 operators appear to be well-resourced and supported as they use a large set of domains and IP addresses as command and control infrastructure. The FireEye iSIGHT Intelligence MySIGHT Portal contains additional information on these backdoor families based on Mandiant investigations of APT32 intrusions.

Figure 6 provides a summary of APT32 tools and techniques mapped to each stage of the attack lifecycle.

Figure 6: APT32 Attack Lifecycle

Outlook and Implications

Based on incident response investigations, product detections, and intelligence observations along with additional publications on the same operators, FireEye assesses that APT32 is a cyber espionage group aligned with Vietnamese government interests. The targeting of private sector interests by APT32 is notable and FireEye believes the actor poses significant risk to companies doing business in, or preparing to invest in, the country. While the motivation for each APT32 private sector compromise varied – and in some cases was unknown – the unauthorized access could serve as a platform for law enforcement, intellectual property theft, or anticorruption measures that could ultimately erode the competitive advantage of targeted organizations. Furthermore, APT32 continues to threaten political activism and free speech in Southeast Asia and the public sector worldwide. Governments, journalists, and members of the Vietnam diaspora may continue to be targeted.

While actors from China, Iran, Russia, and North Korea remain the most active cyber espionage threats tracked and responded to by FireEye, APT32 reflects a growing host of new countries that have adopted this dynamic capability. APT32 demonstrates how accessible and impactful offensive capabilities can be with the proper investment and the flexibility to embrace newly-available tools and techniques. As more countries utilize inexpensive and efficient cyber operations, there is a need for public awareness of these threats and renewed dialogue around emerging nation-state intrusions that go beyond public sector and intelligence targets.

APT32 Detection

Figure 7 contains a Yara rule can be used to identify malicious macros associated with APT32’s phishing lures:

Figure 7: Yara Rule for APT32 Malicious Macros

Table 4 contains a sampling of the infrastructure that FireEye has associated with APT32 C2.

C2 Infrastructure

103.53.197.202

104.237.218.70

104.237.218.72

185.157.79.3

193.169.245.78

193.169.245.137

23.227.196.210

24.datatimes.org

80.255.3.87

blog.docksugs.org

blog.panggin.org

contay.deaftone.com

check.paidprefund.org

datatimes.org

docksugs.org

economy.bloghop.org

emp.gapte.name

facebook-cdn.net

gap-facebook.com

gl-appspot.org

help.checkonl.org

high.expbas.net

high.vphelp.net

icon.torrentart.com

images.chinabytes.info

imaps.qki6.com

img.fanspeed.net

job.supperpow.com

lighpress.info

menmin.strezf.com

mobile.pagmobiles.info

news.lighpress.info

notificeva.com

nsquery.net

pagmobiles.info

paidprefund.org

push.relasign.org

relasign.org

share.codehao.net

seri.volveri.net

ssl.zin0.com

static.jg7.org

syn.timeizu.net

teriava.com

timeizu.net

tonholding.com

tulationeva.com

untitled.po9z.com

update-flashs.com

vieweva.com

volveri.net

vphelp.net

yii.yiihao126.net

zone.apize.net

Table 4: Sampling of APT32 C2 Infrastructure

from Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations

[mbaljeetsingh]

Ionic 2 and Angular 2: Using the Native Camera, Take Multiple Photos with Delete Action.

Are you searching for easy camera access for taking multiple pictures in your mobile application? Then here is the post explaining on how to access camera and take pictures. In most recent days, this is achieved easily with the combination of Ionic framework and AngularJS. We have already discussed in my (previous article link on ionic),how easy it is to use pre-built it in components of Ionic with AngularJS and build awesome mobile apps. Today’s article explains Cordova plugin provided by Ionic framework to access camera , take picture and see the output. The most exciting thing about this article is, it explains you to upload multiple images you take in camera. Let’s follow the article and also the video tutorial on this.

Video Tutorial - Ionic 2 Using the Native Camera, Take Multiple Photos with Delete Action

Install NodeJS You need node.js to create a development server, download and install the latest version. Installing Ionic and Cordova You will find these instructions in Ionic Framework installation document..

$ npm install -g cordova ionic $ ionic start --v2 YourAppName tabs $ cd YourAppName $ npm install $ ionic serve

Open your web browser and launch your application at http://localhost:8100.

Take Photo Delete Photo Launch Camera Use Photo & Retake

Ionic Native Camera API Install Ionic native plugin, you will find more information here

$ ionic plugin add cordova-plugin-camera $ npm install --save @ionic-native/camera

app.module.ts Now go to src/app/app.module.ts and import Ionic camera module.

import { NgModule, ErrorHandler } from '@angular/core'; import {Camera} from '@ionic-native/camera'; import { IonicApp, IonicModule, IonicErrorHandler } from 'ionic-angular'; import { MyApp } from './app.component'; import { AboutPage } from '../pages/about/about'; import { ContactPage } from '../pages/contact/contact'; import { HomePage } from '../pages/home/home'; import { CameraPage } from '../pages/camera/camera'; import { TabsPage } from '../pages/tabs/tabs'; import { StatusBar } from '@ionic-native/status-bar'; import { SplashScreen } from '@ionic-native/splash-screen'; @NgModule({   declarations: [     MyApp,     AboutPage,     ContactPage,     HomePage,     CameraPage,     TabsPage   ],   imports: [     IonicModule.forRoot(MyApp)   ],   bootstrap: [IonicApp],   entryComponents: [     MyApp,     AboutPage,     ContactPage,     HomePage,     CameraPage,     TabsPage   ],   providers: [     StatusBar,     SplashScreen,Camera,     {provide: ErrorHandler, useClass: IonicErrorHandler}   ] }) export class AppModule {}

home.html Now include your design in src/pages/home/home.html

<ion-header>   <ion-navbar>     <ion-title>       Home     </ion-title>   </ion-navbar> </ion-header> <ion-content padding class="card-background-page">   <button ion-button full >   <ion-icon name="camera"></ion-icon>Take Photo   </button>   <ion-grid>     <ion-row>       <ion-col col-6 >         <ion-card class="block">         <ion-icon  name="trash" class="deleteIcon"></ion-icon>         <img src="someimage.png" />         </ion-card>       </ion-col>     </ion-row>   </ion-grid> </ion-content>

home.scss SASS nested styles for home.html page.

page-home { .block {   position: relative   .deleteIcon {     position: absolute !important;     color: #ffffff !important;     margin-left: 80% !important;   }   .deleteIcon:before {     font-size: 30px !important;   }   } }

home.ts Now modify home module, here imported ionic camera module. Include functions for takePhoto and deletePhoto.

import { Component } from '@angular/core'; import { NavController } from 'ionic-angular'; import {Camera, CameraOptions} from '@ionic-native/camera'; @Component({   selector: 'page-home',   templateUrl: 'home.html' }) export class HomePage {   public photos : any;   public base64Image : string;   constructor(public navCtrl: NavController) {   }   ngOnInit() {     this.photos = [];   }   deletePhoto(index) {    console.log("Delete Photo");   }   takePhoto(){   console.log("Take Photo");   } }

Modify Home Constructor Call camera module in constructor.

constructor(public navCtrl : NavController, private camera : Camera) { }

Take Photo This function will help you to capture mobile camera snap, image response will be in base64 encoding format.

takePhoto() {     const options : CameraOptions = {       quality: 50, // picture quality       destinationType: this.camera.DestinationType.DATA_URL,       encodingType: this.camera.EncodingType.JPEG,       mediaType: this.camera.MediaType.PICTURE     }     this.camera.getPicture(options) .then((imageData) => {         this.base64Image = "data:image/jpeg;base64," + imageData;         this.photos.push(this.base64Image);         this.photos.reverse();       }, (err) => {         console.log(err);       });   }

home.html Now loop your HTML design with photos data.

<ion-col col-6 *ngFor="let photo of photos; let id = index">         <ion-card class="block">           <ion-icon name="trash" class="deleteIcon" (click)="deletePhoto(id)"></ion-icon>           <img [src]="photo" *ngIf="photo" />         </ion-card> </ion-col>

Delete Photo Simple javascript function for photos array value based on index value.

deletePhoto(index){    this.photos.splice(index, 1); }

Ionic Delete Confirmation Make following changes to import ionic alert confirmation module. home.ts

import {NavController, AlertController} from 'ionic-angular'; constructor(public navCtrl : NavController, private camera : Camera, private alertCtrl : AlertController) { }

Delete Photo Final code for deleting photo with alert confirmation.

deletePhoto(index) {     let confirm = this.alertCtrl.create({         title: 'Sure you want to delete this photo? There is NO undo!',         message: '',         buttons: [           {             text: 'No',             handler: () => {               console.log('Disagree clicked');             }           }, {             text: 'Yes',             handler: () => {               console.log('Agree clicked');               this.photos.splice(index, 1);             }           }         ]       });     confirm.present();   }

Build iOS App Following commands for executing Xcode build, watch the video tutorial you will understand more.

$ cordova add platform ios $ ionic build ios

Build Android App Open Android build using Android SDK>

$ cordova add platform android $ ionic build android

Video Tutorial - Ionic 2 Using the Native Camera, Take Multiple Photos with Delete Action

via 9lessons Programming Blog http://ift.tt/2oL9N1k

[twobeemag]

Easy Gradle Integration & Export Fonts to HTML in Base64 Encoding Inside Android Apps

Easy Gradle Integration & Export Fonts to HTML in Base64 Encoding Inside Android Apps

Easy Gradle Integration & Export Fonts to HTML in Base64 Encoding Inside Android Apps It contains over 22 useful new features, enhancements and bug fixes. Here are some important features & enhancements included in this release, improvements to DrawingML shadow, Words for Android is delivered as a single JAR file, size of the file is reduced, easy Gradle integration, full support of digital…

[file-formats-programming]

Easy Gradle Integration & Export Fonts to HTML in Base64 Encoding inside Android Apps

What's New in this Release?

Aspose development team is happy to announce the monthly release of Aspose.Words for Android 17.2.0.  This month’s release contains 22 useful new features, enhancements and bug fixes. Some important one includes Improvements to DrawingML shadow, Words for Android is delivered as a single JAR file, the size of the file is reduced, Easy Gradle integration, Full support of digital signatures, Performance improvements and Support of Metered License. Starting from this release, Aspose.Words for Android provides the functionality to use metered licensing mechanism. Aspose.Words for Android now allows developers to apply metered key. It is a new licensing mechanism. The new licensing mechanism will be used along with existing licensing method. Those customers who want to be billed based on the usage of the API features can use the metered licensing. Previous Versions 1.11 and 1.12 were manually divided into two parts: jar and apk in order to limit the number of methods in DEX file. In these versions, Aspose team has provided own apk loader to initiate the correct loading of the additional classes.dex file.  Now starting from this release Aspose.Words for Android is delivered as a single JAR file, Aspose team has started to reduce the size of Aspose.Words for Android library. The major concern now is to reduce the number of methods without loss of functionality. Aspose team constantly working on improving the quality and usability of Aspose.Words for Android. The list of new and improved features added in this release are given below

Rebuild Aspose.Words for Android and ship it in one piece (remove .apk)

Provide configuration to integrate in Gradle based build system     

Bullet disappeared

Pict images cannot be rendered

Text disappears in Android 4th and 5th

TestDataTableReader.testReadDataSet: ColumnOrdinal has different values

ItalicBold text disappears

Provider com.bea.xml.stream.MXParserFactory not found

Unable to convert a DrawingML to PDF

Thai text is rendering as boxes in output Pdf

Docx to Pdf conversion issue with table rendering

Chinese/English text font rendering issue in Pdf

TestDigitalSignature.testSignDocxInplace NullPointerException: Attempt to invoke interface method

WDigital Signatures: assertions fail

testDigitalSignaturesDoc: Verification fails

Reporting module fails with VerifyError

Some documents were canonicalized by XOM differently

Text missing from converted PDF on Nexus 7 & 9

TestRtfTokenizer: AssertionFailedError

java.nio.bufferunderflowexception occurs during rendering to PDF

java.nio.BufferUnderflowException is thrown while using Aspose.Words.Layout API

IllegalStateException: Certificate must contain private key.

Other most recent bug fixes are also included in this release

Newly added documentation pages and articles

Some new tips and articles have now been added into Aspose.Words for Android documentation that may guide you briefly how to use Aspose.Words for performing different tasks like the followings.

Working with Document

Extract Text from and Replace Text in a Table

Overview: Aspose.Words

Aspose.Words is a word processing component that enables Android applications to read, write and modify Word documents without using Microsoft Word. Other useful features include document creation, content and formatting manipulation, mail merge abilities, reporting features, TOC updated/rebuilt, Embedded OOXML, Footnotes rendering and support of DOCX, DOC, WordprocessingML, HTML, XHTML, TXT and PDF formats (requires Aspose.Pdf). It supports both 32-bit and 64-bit operating systems. Users can even use Aspose.Words for .NET to build applications with Mono.

More about Aspose.Words

Homepage Aspose.Words for Android

Download Aspose.Words for Android

[file-formats-programming]

Metered License Support & Export Fonts to HTML in Base64 Encoding in Java Apps

What's New in this Release?

Aspose development team is happy to announce the monthly release of Aspose.Words for Java 17.2.0. This month’s release contains over 51 useful new features, enhancements and bug fixes.Here is a look at just a few of the biggest features and API changes in this month’s release. Support of Metered License, Export fonts to HTML in Base64 encoding, Added HtmlSaveOptions.ResourceFolder and HtmlSaveOptions.ResourceFolderAlias public Properties, Exposed access to Height/Width of Text Frames, Improved control over BiDi text direction elements and Non-bidi fields that contain hided bidi whitespaces are properly resolved. Starting from this version, Aspose.Words for Java provides the functionality to use metered licensing mechanism. Aspose.Words allows developers to apply metered key. It is a new licensing mechanism. The new licensing mechanism will be used along with existing licensing method. Those customers who want to be billed based on the usage of the API features can use the metered licensing. It has introduced new property HtmlSaveOptions.ExportFontsAsBase64. This property allows user to embed fonts resources to HTML in Base64 encoding. This release has introduced new property HtmlSaveOptions.ResourceFolder. This property is used to Specify a physical folder where all resources like images, fonts, and external CSS are saved when a document is exported to HTML. The default value of this property is an empty string. This release has also introduced new property HtmlSaveOptions.ResourceFolderAlias. This property is used to specify the name of the folder used to construct URIs of all resources written into an HTML document. The default value of this property is an empty string.  The list of new and improved features added in this release are given below

Support of Metered License

Export fonts to HTML in Base64 encoding

Added HtmlSaveOptions.ResourceFolder and HtmlSaveOptions.ResourceFolderAlias public properties

Exposed access to Height/Width of Text Frames

Improved control over BiDi text direction elements

Non-bidi fields that contain hided bidi whitespaces are properly resolved

Support the dir and the bdo elements

Date Field with mixed bidi/non-bidi formatting.

Add CssFolder property to HtmlSaveOptions

Discrepancy between HtmlSaveOptions and HtmlFixedSaveOptions regarding ImagesFolder and FontsFolder properties.

More horizontal spacing between paragraphs of the same style when exporting to HTML

Review when Word ignores strokes with weight less that 1 pt

Document.UpdateFields updates the INDEX field incorrectly.

List numbering resets when rendering Aspose.Words generated DOCX to PDF with Adlib

Dash symbol is rendered as unknown while saving SVG to PNG.

System.OverflowException while open html document

Metered License

Math equation's alignment is changed in output Pdf

Document.Compare returns incorrect revisions

Left indentation of list items is incorrect in generated ODT

pic:pic element is not written during RTF to DOCX conversion

Cell's background-colors is not correct in output Html/Docx/Pdf

Footnote line renders higher in PDF

/hidden cell break/ When Converted To PDF, text in output file is not on same page like in original Word document.

Page break is lost after re-saving WordML document

Attributes related to FitText are improperly read into the model of the .DOC document.

Docx to Pdf conversion issue with TOC item rendering

Single Solid-line in word document converts double border for the images in HTML

Docx to HtmlFixed conversion issue with table's borders

StyleCollection.addCopy - Breaking the Multi Level List numbering for Heading styles

A text overlaps on top left logo image in PDF

Extra TOC entry is rendered in output Pdf

Bookmark missing after open and resave document using Aspose.Word

Header contents are lost after conversion from Docx to Pdf

Docx to Pdf conversion issue with hyperlinks

When DOCX is saved as PDF by using a FileStream or MemoryStream, then the output document is missing some elements.

Position of SmartArt elements are changed in output Pdf

Docx to Pdf conversion issue with hyperlinks

Document.Compare increases the Table's cells

List numberings changes from alphabets to numbers during rendering

UpdateFields truncates text in bookmark cross-reference

A formula errors to "divide by zero" when calling UpdateFields

Charts become invisible in output HtmlFixed

Word to PDF conversion create "double encodes" hyperlink

Some text content is repeated in rendered document

Rtf to Doc conversion issue with page numbers of TOC field.

When open document, a Aspose.Words.FileCorruptedException occurs.

HTML document has no <link> to external CSS file when callback is used

Horizontal Axis of chart does not render correctly in output PNG

Other most recent bug fixes are also included in this release

Newly added documentation pages and articles

Some new tips and articles have now been added into Aspose.Words for .NET documentation that may guide you briefly how to use Aspose.Words for performing different tasks like the followings.

Export Fonts to HTML in Base64 Encoding

Working with HtmlSaveOptions Properties

Overview: Aspose.Words

Aspose.Words is a word processing component that enables .NET, Java & Android applications to read, write and modify Word documents without using Microsoft Word. Other useful features include document creation, content and formatting manipulation, mail merge abilities, reporting features, TOC updated/rebuilt, Embedded OOXML, Footnotes rendering and support of DOCX, DOC, WordprocessingML, HTML, XHTML, TXT and PDF formats (requires Aspose.Pdf). It supports both 32-bit and 64-bit operating systems. You can even use Aspose.Words for .NET to build applications with Mono.

More about Aspose.Words

Homepage Java Word Library

Download Aspose.Words for Java

Online documentation of Aspose.Words