Share This

Thursday, July 29, 2010

Armed with exploits, ATM hacker hits the jackpot

Game over' vulns spew cash on demand

Black Hat A startling percentage of the world's automated teller machines are vulnerable to physical and remote attacks that can steal administrative passwords and personal identification numbers to say nothing of huge amounts of cash, a security researcher said Wednesday.

At the Black Hat security conference in Las Vegas, Barnaby Jack, a security researcher with IOActive, demonstrated attacks against two unpatched models from two of the world's biggest ATM makers. One exploited software that uses the internet or phone lines to remotely administer a machine made by Tranax Technologies. Once Jack was in, he was able to install a rootkit that allowed him to view administrative passwords and account PINs and to force the machine to spit out a steady stream of dollar bills, something the researcher called “jackpotting.”

“It's time to give these devices an overhaul,” Jack told a standing room-only audience during day one of the two-day conference. “There hasn't been a secure development methodology from the get go. The simple fact is companies who manufacture the devices aren't Microsoft. They haven't had 10 years of continued attacks against them.”

In a second attack against a machine from Triton Systems, Jack used a key available for sale over the internet to access the model's internal components. He was then able to use a install his rootkit by inserting a USB drive that was preloaded with the malicious program.

Both Triton and Tranax have patched the vulnerabilities that were exploited in the demos. But in a press conference immediately following his talk, Jack said he was confident he could find similarly devastating flaws – including in machines made by other manufacturers as well.

Jack said he wasn't aware of real-world attacks that used his exploits, but this foiled attack from earlier this year appears to involve many of the same techniques.

“Every ATM I've looked at, I've found a game-over vulnerability that allows me to get cash from the machine,” he said.

To streamline his work, Jack developed an exploit kit he calls Dillinger, named after the 1930s bank robber. It can be used to access ATMs that are connected to the internet or the telephone system, which Jack said is true of most machines. The researcher has developed a rootkit dubbed Scrooge, which is installed once Dillinger has successfully penetrated a machine.

Jack said vulnerable ATMs can be located by war-dialing large numbers of phone numbers or sending specific queries to IP addresses. Those connected to ATMs will send responses that hackers can easily recognize.

Jack called on manufacturers to do a better job securing their machines. Upgrades for physical locks, executable signing at the operating system kernel level and more rigorous code reviews should all be implemented, he said.

The talk came one year after a similar one was pulled last year. Jack said the cancellation came because there weren't patches in place for the vulnerabilities he planned to demonstrate.
He said he was grateful for the extra year to research the vulnerabilities.


By Dan Goodin in Las Vegas MT
Newscribe : get free news in real time

No ordinary Jho Low

World Exclusive!

Mystery man jetsets with Arabs and parties with celebs

KUALA LUMPUR: International Man of Mystery Jho Low, who parties with Paris Hilton and is reputed to chalk up hefty bills for champagne, has finally come out to talk about himself and the life he lives.

In an exclusive interview with The Star, this 28-year-old multilingual Penangite, whose full name is Low Taek Jho, reveals for the first time:


> His Arab childhood friends and investors are actually the spenders, not him;

> How he made his first million when he was just 20 and the billions in deals he had strung together so far;

> The importance of going to the right schools;

> Setting up a portfolio worth billions that will go public in October;

> He parties with Hilton, Megan Fox, Jamie Foxx, Lindsay Lohan and Usher but claims that news reports about the parties are exaggerated.

> How he grew up in Penang and his present globe-trotting life covering Los Angeles, New York, London, St Tropez, Abu Dhabi and Kuala Lumpur.

Related Stories:

A millionaire before graduating
Right place, right time, right people
Paris just part of the group
No website and no Twitter
Low dispels talk he received RM500mil airbase job

Exclusive Source: The Star, By WONG CHUN WAI, WONG SAI WAN and LESTER KONG  







Wednesday, July 28, 2010

Courts and the Constitution

REFLECTING ON THE LAW

By Prof SHAD SALEEM FARUDI

 Our basic charter needs to be interpreted creatively and dynamically. Judges should be receptive to the felt necessities of the times and their interpretations should show suppleness of adaptation to changing circumstances. 

AT the Bar Council’s Biannual Law Conference this weekend, one of the topics slotted for discussion is “Constitutional Interpretation”.

As one of the invited speakers, it is my intention to point out that interpretation is an art and not a science. Legal words do not have a self-evident meaning and the “golden rule” of interpretation is that there are no golden rules.

This is especially so when the clauses of the Constitution are deliberated. A Constitution is not just a lawyer’s document. It is the vehicle of the community’s legal, political and social life. It is the repository of the nation’s dreams and demands and its values and vulnerabilities.

It is a generic law which provides the foundation on which the superstructure of the state rests. It protects fundamental freedoms. It seeks to reconcile the irreconcilable conflict between the might of the state and the rights of the citizens.

The glittering generalities of our basic charter need to be interpreted creatively and dynamically because the Constitution was not made merely for the generation that existed at the time of drafting but for all posterity.

Being a living piece of legislation, its spirit should always be the spirit of the age. Judges should be receptive to the felt necessities of the times and their interpretations should show suppleness of adaptation to changing circumstances.

How have our judges handled our document of destiny? How have they performed their solemn duty to “preserve, protect and defend” the basic charter? Regrettably, the record is not very laudable. In many areas of social life, Malaysians can proudly count many blessings but as to the contribution of the superior courts to constitutionalism, there is not much to celebrate as we approach 53 years of independence.

Despite the principle of constitutional supremacy in Articles 4(1) and 162(6), our courts have shown extreme reluctance to invalidate parliamentary legislation or state enactments on constitutional grounds.


There have been 20 or so cases in 53 years where constitutional review succeeded at some stage of the proceedings. Sadly, eight of these rulings were reversed on appeal. Two were set aside by constitutional amendments. That leaves 10 decisions in 53 years where judicial review of a legislative measure left an impact.

However, in a host of other situations, the courts have refused opportunities to import principles of constitutionalism from abroad that would have limited unrestrained legislative or executive power.

For example, in Eng Keock Cheng, the issue was whether a law-making authority can delegate its powers to another body so broadly as to constitute abdication. The doctrine against excessive delegation, usefully employed abroad, was, however, rejected by our courts.

On the issue of constitutional amendments, the scintillating idea that the amendment process cannot be abused to destroy the “basic structure” (or core principles) of the Constitution was turned down.

A bold High Court ruling, based on Indian precedents, that the Emergency Proclamation issued in 1969 cannot last for ever and can come to an end by efflux of time was brushed aside.

The notion of implied, un-enumerated, non-textual rights has been rejected. In the Aliran case, legislation like the Printing Presses & Publications Act with blatantly unconstitutional provisions was allowed to stand.

It defies constitutional imagination how in a country with a supreme Constitution and a chapter on fundamental liberties a law can confer “absolute discretion” to grant or refuse a printing permit or “to impose any condition the Minister deems fit”.

The reasonableness, justice or morality of any legislation is not the concern of our courts. As long as a law was passed by the competent authority in the proper manner, it is valid irrespective of its content.

This is in contrast with the jurisprudence of many countries that Parliament’s power to enact “law” is circumscribed by the understanding that the term “law” does not refer to harsh or oppressive measures but to rules that are fair and just.

Obviously, the British doctrine of parliamentary sovereignty continues to command loyalty in many judicial minds even though Malaysia is blessed with a written and supreme Constitution.

In its relationship with the executive, the courts have a similar mixed record. There are some extremely bold decisions. For example, in the ISA cases of Tan Sri Raja Khalid, Jamaluddin Othman, Abdul Ghani Haroon, Abd Malek Hussin v Borhan Hj Daud and Thamilvanen a/l Kandasamy the courts issued the writ (order) of habeas corpus to free the detainees unlawfully detained.

Civil servants, workers in the private sector and detainees under various drugs legislation have a very good fighting chance of winning their gladiatorial contests in the courts.

Ouster clauses in industrial relations legislation seek to exclude any judicial scrutiny. Our courts disregard these clauses, as indeed they should, and do justice suitable to the case.

Regrettably, however, denial or delay of the right to legal representation under Article 5(3) has generally aroused indifference. We have a remarkable decision that a detainee’s right to legal representation commences from the time of arrest but cannot be exercised till police have completed their investigation.

The courts seem to have graded human rights. The right to property, protection against double jeopardy and protection against backdated criminal laws are given adequate protection. However, personal liberty, freedom of speech and equality are almost always subjected to wide executive power to restrict on grounds of public order, etc.

Freedom of religion was one of our best protected rights. In a sad reversal in the last 15 years, the courts have turned a blind eye towards many painful and tragic issues surrounding this right.

In many areas of executive power, the courts generally refrain from treading in, and the decision by the state is declared to be non-reviewable. Examples of such areas of absolute power are the subjective satisfaction of the Minister in preventive detention cases; the issuance and continuance of emergency declarations under Article 150; the power to grant mercy and the Attorney-General’s powers under Article 145 to commence or discontinue criminal proceedings or to transfer a criminal case vertically or horizontally to another court.
In many other countries, a rich jurisprudence has evolved to surround these executive domains with humanising principles of openness and accountability.

On issues of apostasy and Islamic law in general, our superior courts are happy to hand the matter over to Syariah Courts even though momentous issues of constitutionality may be at stake. We have an instance of a non-Muslim woman being advised by a superior court judge to submit herself to the jurisdiction of the Syariah Court despite the fact that Schedule 9 List II Para 1 clearly provides that Syariah Courts shall have jurisdiction only over persons professing the religion of Islam.

Despite 53 years, the Constitution has not become the chart and compass, the sail and anchor of our legal life. Its imperatives have not been transformed by the courts into the aspirations of the people.

But there is still hope. Malaysian constitutional jurisprudence has many seeds for growth. Under the leadership of Justice Datuk Seri Gopal Sri Ram and a number of other dynamic judges, public law issues are often seen in the context of constitutional safeguards.

In some cases, issues of natural justice and unreasonableness are linked with the Constitution. This elevation of administrative law issues to the pedestal of constitutional law holds much promise. But we have to wait and see. There are currents and cross currents to keep hope alive.

Prof Datuk Dr Shad Saleem Faruqi is Professor Emeritus at UITM and Visiting Professor at USM.

Tuesday, July 27, 2010

Everybody can be a game developer with Kodu

GAME ON: Some students who participated in the Microsoft's Kodu Kup competition showing off their skills at the company's launch event in Kuala Lumpur.
 
KUALA LUMPUR: Software giant Microsoft Malaysia wants to nurture fledgling game developers from as young as nine through its game design competition, known as the Kodu Kup.

According to its education director Farad Alhusaini, computer games are no longer just for entertainment; they are now also an important educational tool that can spark a culture of creativity and innovation in our youngsters.

For this reason, Microsoft is putting its resources firmly behind the Kodu Kup competition. "Kodu is a fantastic avenue to inspire students to understand the fundamentals and principles of computing and software development," Farad said.

The inaugural competition, which kicked off yesterday, pits students from six schools - Tunku Kurshiah College, SK Taman Putra Perdana, SMK Taman Bukit Maluri, SMK USJ 12, SJK (C) Ladang Harcroft and SJK (C) Chio Nan - against each other.

Participants must develop a computer game using Kodu Game Lab - a simple and visual programming language develop by Microsoft Research.

The program offers a straightforward, fun and easy to use a visual interface, where the users only need to click and string together intuitive icons that define the rules of their game world.

Then, they use a mouse and keyboard - or even better, a gamepad - to navigate the program. No complex programming language to learn and absolutely zero lines of code needed, explained Farad.

"The result is that anyone aged from seven to 70 can create a game in minutes," he said.

Connected

The Kodu Kup competition is a preliminary step to the bigger event that is Microsoft's Imagine Cup. The Imagine Cup is a global competition sponsored by the software giant to encourage university students to develop technology that helps solve the world's problems.

This year, the Imagine Cup final was held in Warsaw, Poland. The Malaysian team did the country proud by beating more than 60 other international teams to make it to the final, in the Software Design category.

"Malaysia needs to start looking among its younger generations to find talented students who will succeed even more in such competitions in the future," Farad said.

"This is where the Kodu Kup competition comes in, he said. "The primary target of most computer games are youngsters, so why not give them the chance to be in the driver's seat - i.e. to create such games, instead of merely playing them."

The Kodu Kup competition will run till Aug 20 and is also open to teachers. Student participants will be judged on creativity, game design, and the fun factor of their games.

Teachers who enter the contest, must showcase how Kodu Game Lab can be used effectively in the classroom, not only to stimulate critical thinking but also how it can help develop problem-solving and logic skills in students.

The aim here is to let teachers inspire and excite their students to learn and experiment, as well as to bring back the "cool" factor in education, according to Farad.

The prizes

Results of the Kodu Cup competition will be announced on Aug 27. The winning student and teacher will each receive a trophy, a notebook PC, an XBox 360 gaming console, as well as various Microsoft software and hardware.

The competition is supported by Yayasan Inovasi Malaysia (YIM), a foundation under the Ministry of Science, Technology and Innovation.

Prior to the launch of the competition, the participating teachers and students had to undergo two-day training sessions with Kodu Game Lab specialists from Microsoft and ideaslab. ideaslab is an organisation based in Victoria, Australia, which serves as a hub for national and international research into learning and teaching technology.

++++
www.kodukup.com

Social networks posing security threat




 
IMMINENT DANGER: According to a Sophos survey in December 2009, 60% of the respondents believed that Facebook presents the biggest security risk compared to other social networking sites - way ahead of MySpace, Twitter and LinkedIn. - AP

THE Internet is a lot more than just a means of staying informed. It has evolved into something much more than what it was originally intended to be.

For some, it is an avenue to avoid the long queues at banks and service counters. For others, it is a place where you can work collaboratively.

But for most, the Web is a communication tool that connects them with family and friends via the many social networking tools.

Most Internet security experts conclude that cyberattacks on social networking sites will increase over the years. Since 2008, Facebook, Twitter, MySpace, LinkedIn, and other such sites have been in the limelight as social networking grew and grew.

These services compete with each other to increase their user base by coming up with mobile tie-ups, applications and games.

All these efforts are worthwhile because social networking sites are the biggest thing on the Internet at the moment, and perhaps for many more years to come. Unfortunately, this trend has also been attracting all sorts of security threats.

New year, new threats

In its 2010 Threat Predictions report, McAfee Labs said it anticipates an increase in threats related to social networking sites such as Facebook.

It also said that criminal tool kits will be evolving rapidly this year to capitalise on new technologies that increase the sophistication of the attack on unsuspecting users.

And, as a result, there is a good chance of an increase in rogue services that exploit Internet users' eagerness to download and install the various and freely available Web 2.0 applications.

According to a Sophos survey in December 2009, 60% of the respondents believed that Facebook presents the biggest security risk compared to other social networking sites - way ahead of MySpace, Twitter and LinkedIn.

Cisco Systems' 2009 Annual Security Report mentioned that the Facebook user base has tripled from 100 million users in 2008 to 350 million in 2009.

There is no doubt that such a huge increase in the number of users within a year's time is phenomenal, and it is attracting cybercriminals from all over the world to migrate their attacks to Facebook
.
Mitigating threats

In order to stay safe while using social networking tools (or in fact, other Internet-based applications), users are urged to observe the following practices:

1. Never click on any URL links in unsolicited e-mail (i.e. e-mail that you are not expecting nor asked for);

2. Never log in your online credentials through pages opened up by the URL links you get from any e-mail. In order to be safe, type the URL yourself in the browser. If you have been using shared PCs, be sure not to click on the links provided by the browser bookmarks;

3. Never jot down your online login credentials in an e-mail, even if you think of it as a note to yourself. e-Mail is not the proper place to store your online login credentials. This is to minimise the risks should your e-mail system be compromised;

4. Always verify the validity of the services or links you get via e-mail, even if it appears to be sent by a social networking tool you subscribe to. Google it or better yet, e-mail the service administrators and ask them. Pay extra attention to the given URL as a slight difference would mean a different site altogether;

5. Change the passwords of your online credentials from time to time and do not use the same password for all of them. For a secure password, use a combination of uppercase and lowercase alphabets and numbers, and try to use words that do not exist in any dictionary; and

6. Do not arbitrarily download any updates for your applications. If you really need them, visit the official website and get more information.

Conclusion

It is imperative that Internet users understand that the threats and security issues which come with social networking tools aren't necessarily caused by vulnerabilities in the software or the user's PC … at least, not all the time.

Software vulnerabilities are reported from time to time and they will always be the cornerstone of cybercriminal activities. But for them to work, they have to be initiated by the users themselves in one way or another.

(Syahrir Mat Ali is senior executive of the cybermedia research department at CyberSecurity Malaysia - the national cybersecurity specialist under the Ministry of Science, Technology and Innovation. These are his personal views expressed here.)



Ideas for positive energy,Tips on harmonising bad vibes, Spiritual activity heightens





 Spiritual healer gives talk on home decoration

SPIRITS are everywhere so even if your home is next to a cemetery, you should be able to sell it if the price is not too high, said spiritual healer Master Ong Q Leng.

She was speaking during the question and answer session after her talk themed ‘Protecting Your Property From Bad Energy’ at the Star Property Fair 2010.

Master Ong giving feng shui tips to the crowd
.
“Spirits are everywhere all the time, day or night, you just can’t see them.

“There are people who are not superstitious and they will be willing to buy the property, especially if they can make a profit from it,” she said, when asked if it was okay to leave an apartment empty if there were cemetery plots on both sides of the property.

“If a property does not sell, it is not necessarily because of bad feng shui. You may be asking too high a price. A buyer will already have scouted the area for the right price. Try lowering the price, and you might be able to sell it off.”

To a question on colour schemes, Ong said certain people suited certain colours and people should observe how they felt or how things fared when they chose a certain colour to wear.

Asked if it was really suay (unlucky) to wear all black or black and white, Ong said that it was true that the colours did not suit many people:

“Try it for one or two days, if it does not feel good or things go wrong, then the colours are probably not suited to you,” she said.

Speaking in Hokkien and Mandarin, with English translation provided by master of ceremonies Por Joo Tee, Ong also advised the crowd to try not to wear red or use too much red.

A couple then told how they fell in love with a painting of a tiger and bought it for their home only to be told by a medium that the tiger would “eat up” all their fortune.

Ong said paintings of animals had no bearing on people but reminded them to place them only in the hall and not in the bedrooms, and that the paintings had to face another wall and not the main door or balcony.
“It is only a painting, and cannot harm us. But if you feel unhappy after putting up any decoration, then just take it down,” she said.

Asked on the best stance or image to choose when buying idols of deities, Ong said what mattered more was the idol’s condition.

“If after some time praying to the idol, you feel that things are going well, then it should be fine. If you feel that things are falling apart, then it’s probably not right,” she said.

Asked if the idols of Hok Lok Siu (three Chinese deities representing good luck, status and longevity) could be placed inside the house, Ong said they could only be placed as decorative pieces but not as idols to pray to because they were only supposed to reside at temples and not at houses.

She also told the audience to pray from the heart and not out loud and face the sky with eyes closed and hands clasped together, preferably between 6am and 11am, and to say please when praying.

“Don’t be too greedy but remember to pray for your own health and strength first before praying for your loved ones,” she added.

Ong’s talk received a great response from the large crowd.

Source: Starmetro

Tips on harmonising bad vibes

By PRISCILLA DIELENBERG
prisdberg@thestar.com.my

TECHNICALLY, there is no house with bad feng shui, according to spiritual healer Master Ong Q Leng.

“Even houses with the worst chi (vital energy) can be corrected,” claimed Ong, 34, who offers healing, spiritual cleansing, feng shui tips and general consultation services.

Ong: Her talk will be in Hokkien and Mandarin.
She said some old houses had bad chi because of spirits that co-habited the space over the years.

“There are three types of spirits - those that are wandering as they could not move on after death, those that chose not to move on though they could, and the bad ones that go around causing trouble,” she said.

Ong added that proper cleansing had to be done to appease the spirits that caused distress or unrest to those who occupied the house.

“When I enter a premises with bad chi, I use my sixth sense to get a clear picture of the situation and instructions from my spiritual master, and take it from there,” said Ong.

She will share her thoughts on a combination of feng shui and paranormal phenomena during her talk on ‘Protecting Your Property From Bad Energy’ at 4.30pm on Sunday at the Star Property Fair 2010.

Her talk will be in Hokkien and Mandarin, with a smattering of Bahasa Malaysia and English. There will be a translator on standby to help with the question-and-answer session. The talk is for non-Muslims only, and admission is free.

Ong will also be giving tips on auspicious locations within a house, choosing colour schemes and how best to arrange certain furniture.

The talk will be among the highlights of the three-day fair to be held at G Hotel and Gurney Plaza from 10am to 10pm starting today until Sunday.

More than 20 major developers, including some from Kuala Lumpur and Ipoh, will offer an array of property launches, special packages and attractive rebates during the event, organised by Star Publications (M) Bhd in collaboration with Henry Butcher Malaysia Penang.



Spiritual activity heightens

By PRISCILLA DIELENBERG
prisdberg@thestar.com.my, 10/9/2010

THE seriously ill are more susceptible to death during the Phor Thor or Hungry Ghost month, according to spiritual healer Master Ong Q Leng.

Ong, 34, said in the recently concluded seventh lunar month, a few of her patients, who were on the road to recovery, simply gave up and succumbed to their illnesses rather than burden their loved ones who had to care for them.

“One patient was progressing well. The colour had returned to her cheeks but she had a change of heart and told her daughter who was bathing her one morning to hurry up as ‘they’ were waiting for her.

“She suddenly passed on in the middle of her bath,” said Ong, who also noted that there had been many cases of murder and suicide during the period.

She said those, who had seriously ill loved ones, should provide them with more love and care during the seventh month.

“You can tell that it is time for them to depart if they can no longer eat and sleep, the face has turned pale and yellowish, and the eyes are lifeless,” she added.

The Hungry Ghost month had always been a busy time for Ong, who offers services of healing, spiritual cleansing, feng shui tips and general consultation.

“One client sought my services after friends spotted two young children in the back seat of her car. It turned out that she had two previous abortions and the boy and girl spirits were her two children.”

Ong said spirits were at their most powerful during the seventh month but those released from the gates of hell were not harmful.

“The harmful spirits are the wandering ghosts that roam the earth freely throughout the year.”
During the Hungry Ghost month, she said it was best that children, aged below five, stayed indoors after 7pm, and adults low on luck did the same after 9pm.

She also advised people not to consume too much alcohol or speak nonsense during the seventh month, and not to quarrel or fight at home as that would attract an “audience” to watch the drama.

“Don’t scold but be more loving to your spouse and children, and smile more to avoid misfortune,” she said.

Ong also advised those who observed the Hungry Ghost festival to burn smaller offerings for their departed loved ones during that month.

“When you burn too many things, it will attract greedy evil spirits who come and snatch the offerings from your loved ones.

“Smaller amounts attract less attention and that means more chances that your loved ones will receive them.

“You only need to burn offerings for someone once a year and it should be done during the day, that is between 8.30am and 7.30pm,” she said

Monday, July 26, 2010

Cosy auditors

GOVERNANCE MATTERS

By SHIREEN MUHIUDEEN

ONE of the big questions we faced in the recent spate of annual general meetings (AGMs) is that whether companies should renew the contract or replace the audit firms. And, how does a company decide when appointing an auditor?

An auditor is supposed to be the company’s best friend, the sort that tells it what it needs – not wants – to hear, especially when the chips are down. But when listed companies in South-East Asia recently held their AGMs, these meetings exposed the annoying reality that the auditors of some of these companies have been unreliable friends.

To be sure, an auditor is in an unenviable position from the start. He is the company’s disciplinarian and so is there not only to ensure that the company complies with financial reporting standards and other best practices, but also to forewarn it of anything risky that might suddenly blow up.

These responsibilities have become even more complex in recent years, as there are now so many different industries and companies with complex structures; an audit firm needs to have sector specialists to manage the audit function effectively. One would presume that gone are the days when auditors should be able to just rubber-stamp a company’s finances.

Even so, we wonder how many auditors tell their client companies hard truths as well as red-flag their transgressions? Will they lose their clients if they push them too hard on tough issues? How far can they push their clients? Should they resign if clients stop taking their advice? From our experience, one thing is very clear: “There are auditors, and then, there are auditors.”

Recently, we reviewed a company that was supposedly recovering. We noted in our review that this company and all its subsidiaries after 10 years were still in the red as at Dec 31, 2009, and the board and management didn’t seem to know how to reverse that. We dug further and found that its share premium rose significantly over the decade because its fixed assets - primarily land for development - had been revalued.

What was very clear is that each time the land was developed and the properties sold, there were writedowns on the value of the assets. This suggested that the existing assets on its balance sheet were overvalued.

These seedy activities raise obvious questions:
● Where were its auditor’s red flags?;
● What was the auditor’s advise before the writedowns?; and
● Did the auditor assess the risk sufficiently before the company revalued the land or did he just bow to its wishes?

This company also cut deals with related parties, and every year for the last seven years wrote these transactions off, which cost it millions of dollars. These losses were too large and too often to be dismissed as occasional business risks.

To get some answers, we reviewed the composition of the company’s board of directors and audit committee. We zoomed in on the audit committee as the obvious source of the oversight. It has three members, or so-called independent directors, two of whom are in their 70s, and have been on it since 2000.

The third is an ex-politician who is well-connected.

While all three have had fairly successful careers, they seem to no longer be able to insist that the company desist its loss-making moves. That’s because these audit committee members must have been aware of all the company’s related-party transactions and write-offs for almost seven years.

We also compared the total audit fees paid. This company paid audit fees which were considerably lower than the average fees paid in the same sector. One wonders if the choice of the auditor was based primarily on fees and not on the best practices that the firm abides by.

We also wondered whether the audit committee discussed any of its real concerns with the external auditors. After all, the company’s annual report states that its board of directors and audit committee will meet every quarter “to acknowledge and monitor” its performance outcome, with “the counterbalance and revision” of the independent directors.

In the same report, this company also stated that it “believes in a good management system” and avowing that its directors and executives had “vision”, were responsible and had a “balance of power mechanism to ensure and monitor transparent management and equitable treatment for its shareholders.”

How can a company state all these when it is consistently losing money, does not have a single subsidiary that is profitable, indulges habitually in related-party transactions and then, consistently writes them off?

We can only wonder how its audit committee members and its other independent directors discharge their duties amid all of the above activities. For now, their profiles and records of attendance at meetings give us neither relief nor belief that they really are, as the annual report puts it, “adhering to the principles of the stock exchange for the optimal benefit of the Company”.

What is very clear to us is that the investment community should stand up and question companies that vote in auditors purely based on fees and cosy friendships.

Shireen Muhiudeen is managing director of Corston-Smith Asset Management in Malaysia, a fund management company that makes investment decisions based on corporate governance.

Balancing an accounting problem; Get set for new rules

Balancing an accounting problem

By GOH KEAN HOE

LATELY, IFRIC 15 has become a hot topic among accountants and leading property developers in Malaysia. Developers here have been using the percentage method for decades to report revenue from projects sold under the sell-and-build system. Naturally, they were shocked when ‘told’ to change to the completed method.

(IFRIC 15 is an interpretation issued in July 2008 by the International Financial Reporting Interpretations Committee to cover agreements for the construction of real estate. The document is meant to standardise accounting practice across jurisdictions for the recognition of revenue among real estate developers for sales of units before construction is complete.)

The message to the marketplace from the Malaysian Accounting Standards Board (MASB) and Malaysian Institute of Accountants (MIA) is that under IFRIC 15, property developers can only recognise the revenue when the construction is completed and the completed units are handed over to the purchasers. The top audit firms have also indicated to their clients to prepare for this fundamental change.

The developers are perplexed. Some ask: “Does that mean we were wrong to use the percentage method all this while?”

A general explanation is that property developers are selling goods and not providing construction services.
Hence, revenue can only be recognised when the goods are delivered to the purchasers.

Which paragraph?

That may be true, but to be exact, IFRIC 15 lists three categories of agreements:

(a) The agreement is a construction contract;
(b) The agreement is for rendering of services (only); and
(c) The agreement is for sale of goods (services plus materials)

For types (a) and (b), IFRIC 15 says the appropriate method is the percentage method. For type (c), the applicable method depends on whether the agreement meets the criterion set out in paragraph 17 or paragraph 18 of IFRIC 15.

Paragraph 17 says: “The entity may transfer to the buyer control and significant risks and rewards of ownership of the work in progress in its current state as construction progresses. In this case, ....”
Paragraph 18 says: “The entity may transfer to the buyer control and significant risks and rewards of ownership of the real estate in its entirety at a single point of time (e.g. at completion, upon or after delivery). In this case, ...”

So which paragraph should apply to the Malaysian property development industry? Whose WIP (work in progress) is it?

But the answer is more than just about the legal ownership of the properties or WIP.

In accounting, substance is more important than form. In fact, the concept of “continuous transfer of control, risk and reward” introduced in IFRIC 15 is rather new and obviously, not well or easily understood even by accountants. IFRIC 15 acknowledges that circumstances that meet the criterion of paragraph 17 may not exist frequently.

In addition, IFRIC 15 requires an entity to disclose how it determines which agreements meet that criterion. It seems that the International Accounting Standards Board (IASB) is biased towards the completed method by making it tougher to apply paragraph 17.

Noting that the draft of IFRIC 15 (issued in 2007) might not have addressed the industry practice in Malaysia, I included a suggestion in my letter for IASB/IFRIC “to examine various typical sales agreements on uncompleted real estate and categorise them as much as possible (or by way of examples)”.

IASB did take into consideration many of the comments and concerns raised, and yet, did it fall short of addressing adequately our unique circumstances?

Percentage vs completed

Can the circumstances in Malaysia be differentiated from those in other countries to justify the use of the percentage method?

Based on my observation, the general view is that there are either equally strong arguments for both methods and any difference could be just a fine line, or there is no a clear answer due to lack of specific guidance in IFRIC 15 for our unique circumstances.

Since the MASB and MIA have taken the view that the completed method is the way to go under IFRIC 15, it will be useful if they issue a formal document putting forward their views, with the basis and arguments, so as to convince the property developers and the doubters that this is the correct way.

To conclude that we do not meet paragraph 17 and hence, the completed method shall apply, is an easier task, but the important consideration is if the financial statements will still provide a true and fair view of the financial position and performance of the developers.

It is understood that the Real Estate and Housing Developers’ Association (Rehda) recently submitted a memorandum to the MIA and other relevant bodies about their view, which is biased towards the percentage method.

The objective of IFRIC 15 is to clarify existing standards and to standardise the accounting practice worldwide. Singapore converged to IFRS (international financial reporting standards) in 2005.

However, it has yet to adopted IFRIC 15 and is still trying to find ways and means to interpret it correctly and in such a way that it can be accepted by all stakeholders. Meanwhile, the percentage method continues to be used there.

Hong Kong, on the other hand, has switched to the completed method since its convergence to IFRS in 2005. In my view, for Malaysia to solve this issue and to make sure we get it right, we must go through a due process as follows:

● To understand thoroughly IFRIC 15 and also related accounting standards – IAS 18 and IAS 11 as well as the upcoming new standard on revenue recognition. This may necessitate consulting the IASB on unclear areas.
● To understand exactly the property development business and to critically review the industry practices, laws and the terms of the typical sale and purchase agreements in order to understand completely the relationship between the developers and their customers. The relevant substance must be identified and given due consideration.
● To compare with other countries such as Singapore, Hong Kong, Australia, Britain and the United States on the industry practices and laws and the accounting treatments.

Remember the objective of financial statements

We must consider two more factors. First, we cannot totally ignore the unique characteristics of this industry – that real estate is an immovable asset and that the construction element can be undertaken by another engineering firm so long as the design and specifications are available.

Second, the ultimate objective of financial statements is to provide useful and relevant information for users to make economic decisions.

Hence, it must be true and fair, and reflect the economic and business activities and events that happened during the reporting period, including any value added or destroyed.

Another point is that many may not be aware that our Companies Act and the FRS 101 (on presentation of financial statements) actually provide that if applying an accounting standard or interpretation will not result in true and fair financial statements, the directors should not apply it.

I suspect many companies may consider making use of this provision.

Finding a good solution to this issue is by no means an easy task. It is important that the MASB, MIA and Rehda pool their resources to resolve this. Since the real estate laws and practices in Singapore and Malaysia are quite similar, it may not be a bad idea for the two countries to cooperate on this matter. Will accountants in Malaysia, and perhaps in Singapore as well, have the same opinion on an accounting issue for once?

Goh Kean Hoe is a partner of TKNP International and a trainer consultant with Globalacc Research & Training Sdn Bhd. This article is an abridged version. For feedback and requests for the full article, email him at gkh2001@tm.net.my.

Get set for new accounting rules

By Adrian Lee

THE International Accounting Standards Board’s (IASB) new thinking on financial instruments accounting represents a big departure from the current FRS139/IAS39. Many entities may need to undertake another round of changes in systems and reporting to comply with the new IFRS9 requirements.

Most entities in Malaysia would have already adopted FRS139 Financial Instruments: Recognition & Measurement, which became effective on Jan 1, 2010. FRS139 is a standard dealing with financial instruments accounting and represents a major change from how financial instruments were accounted for in Malaysia before.

Derivatives (e.g. foreign exchange contracts, options) and many financial assets such as investments in shares and debt securities are now required to be stated at fair value. The standard also introduces complex hedge accounting and impairment rules.

Whilst entities in Malaysia are familiarising themselves with the new FRS139 requirements, they need to also be mindful that another major revamp to financial instruments accounting is currently ongoing at the international level.

FRS139 is largely based on IAS39, first issued in 1999 by the International Accounting Standards Committee (IASC), the predecessor to the IASB.

The IASB is, however, currently undertaking a comprehensive review of financial instruments accounting and aims to replace IAS39 with a new financial instruments standard referred to as IFRS9 Financial Instruments.
The IFRS9 project is partly driven by requests for reform from the Group of 20 and other constituents. The IFRS9 project is divided into three main phases: classification and measurement, impairment, and hedge accounting.

The IASB aims to complete all phases by the second quarter of 2011. To date, the classification and measurement phase has been completed and draft proposals arising from the impairment phase have been issued.

Under the classification and measurement phase, the four categories for financial assets under IAS39 (namely held to maturity, loans and receivables, fair value through profit or loss, and available for sale) are replaced by just two categories i.e. amortised cost and fair value.

An entity’s “business model” condition is introduced to determine the appropriate classification for financial assets. If an entity’s business model’s objective is to hold assets to collect the contractual cashflows, then the financial assets are measured at amortised cost.

This change is intended to make it easier for entities to measure their financial assets (particularly quoted debt securities) at amortised cost rather than fair value. Hence, unlike previously, an entity does not have to hold all debt securities to maturity to qualify for amortised cost measurement.

Other key changes

There are also key changes in the accounting for investments in equity investments (shares).

Equity investments are generally measured at fair value and gains/losses on fair value changes are recognised in profit or loss. However, an entity may elect to present the fair value changes to other comprehensive income (OCI) instead. The election is irrevocable and can be made on an individual share-by-share basis.
The OCI route is somewhat similar to the “available for sale” category in the current IAS39.

However, there is no longer the need to test these equity investments for impairment. Hence, any fair value losses can remain in OCI without considering the need to recognise the losses in the profit or loss.

The “drawback” is that the amounts in OCI (gains or losses) are not recycled to profit or loss, even when they are realised, i.e. when investments are sold.

Under the impairment phase, the IASB is proposing some fundamental changes in respect of the recognition and measurement of losses associated with loans and other receivables.

One of the key criticisms of the current “incurred loss” model for loan loss provisioning is that it is “too little, too late”. The current model only allows loan-loss provisions to be made when there is objective evidence of impairment. A loss event – for example, default by borrower – must happen.

The problem with this approach is that there is no build up loan-loss provisions prior to the loss event, even though it is expected that some loans will default over the life of the loan portfolio.

‘Expected cashflow’ model

The IASB attempts to address this by proposing the “expected cashflow” model for loan-loss provisioning.
An entity would now estimate the expected credit losses from a loan portfolio. The loan-loss provision will then be built up, via an adjustment to the interest income recognised, over the life of the loan portfolio. This has an effect of smoothing out the expected loan-loss provisions over the life of the loan portfolio.

However, any subsequent changes to expectations in the credit loss or cashflows will be immediately recognised in the profit or loss. This could potentially introduce some level of volatility to the profit or loss arising from changes in expectations.

The proposed impairment changes also impact the measurement of revenue and trade receivables of non-banks.

Similar to banks, corporates are also required to estimate the expected credit losses arising from their trade receivables. However, these losses are then immediately deducted from the revenue. Revenue would now be stated at net of expected credit losses.

Though the MASB has indicated that it is unlikely to adopt IFRS9 until the IASB has completed all three phases of the project, corporates should familiarise themselves with the standard and take cognisance of the potential impact of the requirements of IFRS9 on their operations.

·Adrian Lee is an audit partner at KPMG.