Skip to content

802.1X Protocol for Network Authentication

EAP

802.1X uses an Extensible Authentication Protocol (EAP) for a challenge and response-based authentication protocol that allows a conversation between a Supplicant (the wireless/wired client) and the RADIUS (the authentication server), via an Authenticator (a wired switch or wireless access point which acts as a proxy). EAP supports multiple authentication methods, some of them are secure and some of them are vulnerable (although old endpoints still support them).

802.1X authentication with Portnox CLEAR

DIAGRAM: An example of how EAP works with Portnox CLEAR.

EAP-TLS

With 802.1X authentication via EAP Transport Layer Security (or EAP-TLS), there is a mutual certificate authentication, as it relies on the Supplicant (endpoint) and RADIUS certificate’s “handshake.”

Advantages:

  • Mutual certificate authentication
  • The authentication process takes place inside a secure SSL tunnel
  • The user/machine certificate is linked to the relevant user/computer identity, which makes stealing attempts useless (in contrast to stolen credentials)

Disadvantages:

  • The identities are sent in a clear text before the certificates exchange process starts
  • Deployment and lifecycle maintenance of endpoint certificates might be costly in small environments

EAP-TTLS

By using 802.1X EAP Tunneled Transport Layer Security (or EAP-TTLS) is an extension of EAP-TLS. After the RADIUS is authenticated to the Supplicant by its certificate (including an optional TLS authentication of the Supplicant to the RADIUS), the Supplicant proves its identity via PAP or MSCHAPv2

Advantages:

  • The authentication process takes place inside a secure SSL tunnel
  • User identity is not exposed
  • Can use multiple methods to authenticate inside the tunnel – certificates / user identities
  • EAP-TTLS can be used for network authentication by Azure Identity when AD-DS is not enabled (MSCHAPv2 is not available)

Disadvantages:

  • It does not support MSCHCAPv2 without enabling Directory Services with Azure AD (a limitation of Azure AD itself)
  • Client-side certificate is not required, only optional

EAP-PEAP

With 802.1X authentication via EAP Protected Extensible Authentication Protocol (or EAP-PEAP), only the RADIUS needs a certificate. With that certificate, the endpoints create an encrypted TLS tunnel to pass the authentication details. The most common protocol used to authenticate the endpoints, when using PEAP, is MSCHAPv2 challenge and response, which is used to authenticate both the server (usually Active Directory / Azure AD) and the supplicant (endpoint). The process involves challenge – response where both share a random hash that’s computed with the identity’s credential without sending the password across the network.

  • The authentication process takes place inside a secured SSL tunnel
  • User identity is not exposed
  • Simple deployment – allow the usage of username and password which the end-user is already familiar wit,h such as Active Directory or local account credentials

Disadvantages:

  • This method requires a password changing policy to remain secure
  • If the endpoints are not hardened they are exposed to “evil twin” attacks

EAP-MD5

One of the legacy 802.1X approaches of EAP is Message Digest 5 (or EAP-MD5), the RADIUS server sends a random challenge to the Supplicant which generates an MD5 Hash of its credentials and the challenge, which is then sent back to the RADIUS for validation. By using this method of 802.1X authentication, however, the supplicants don’t send their passwords to the RADIUS for validation, but rather use hashes.

Advantages:

  • EAP-MD5 is compatible with legacy network equipment and older type of endpoints

Disadvantages:

  • It is exposed to dictionary attack – password “guessing”
  • Vulnerable to man-in-the-middle attacks since there is no mutual authentication

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

About Distology
Distology is a Market Enabler and offers true value for the distribution of disruptive IT Security solutions. The vendors we work with represent innovative and exciting technology that continues to excite and inspire their reseller network. Our ethos is based on trust, relationships, energy and drive and offers end to end support in the full sales cycle providing vendor quality technical and commercial resource.

What is 802.1X Extensible Authentication Protocol (EAP)?

EAP
802.1X uses an Extensible Authentication Protocol (EAP) for a challenge and response-based authentication protocol that allows a conversation between a Supplicant (the wireless/wired client) and the RADIUS (the authentication server), via an Authenticator (a wired switch or wireless access point which acts as a proxy). EAP supports multiple authentication methods, some of them are secure and some of them are vulnerable (although old endpoints still support them).

802.1X authentication with Portnox CLEAR
DIAGRAM: An example of how EAP works with Portnox CLEAR.

EAP-TLS
With 802.1X authentication via EAP Transport Layer Security (or EAP-TLS), there is a mutual certificate authentication, as it relies on the Supplicant (endpoint) and RADIUS certificate’s “handshake.”

Advantages:

Mutual certificate authentication
The authentication process takes place inside a secure SSL tunnel
The user/machine certificate is linked to the relevant user/computer identity, which makes stealing attempts useless (in contrast to stolen credentials)
Disadvantages:

The identities are sent in a clear text before the certificates exchange process starts
Deployment and lifecycle maintenance of endpoint certificates might be costly in small environments

EAP-TTLS
By using 802.1X EAP Tunneled Transport Layer Security (or EAP-TTLS) is an extension of EAP-TLS. After the RADIUS is authenticated to the Supplicant by its certificate (including an optional TLS authentication of the Supplicant to the RADIUS), the Supplicant proves its identity via PAP or MSCHAPv2

Advantages:

The authentication process takes place inside a secure SSL tunnel
User identity is not exposed
Can use multiple methods to authenticate inside the tunnel – certificates / user identities
EAP-TTLS can be used for network authentication by Azure Identity when AD-DS is not enabled (MSCHAPv2 is not available)
Disadvantages:

It does not support MSCHCAPv2 without enabling Directory Services with Azure AD (a limitation of Azure AD itself)
Client-side certificate is not required, only optional

EAP-PEAP
With 802.1X authentication via EAP Protected Extensible Authentication Protocol (or EAP-PEAP), only the RADIUS needs a certificate. With that certificate, the endpoints create an encrypted TLS tunnel to pass the authentication details. The most common protocol used to authenticate the endpoints, when using PEAP, is MSCHAPv2 challenge and response, which is used to authenticate both the server (usually Active Directory / Azure AD) and the supplicant (endpoint). The process involves challenge – response where both share a random hash that’s computed with the identity’s credential without sending the password across the network.

The authentication process takes place inside a secured SSL tunnel
User identity is not exposed
Simple deployment – allow the usage of username and password which the end-user is already familiar wit,h such as Active Directory or local account credentials
Disadvantages:

This method requires a password changing policy to remain secure
If the endpoints are not hardened they are exposed to “evil twin” attacks

EAP-MD5
One of the legacy 802.1X approaches of EAP is Message Digest 5 (or EAP-MD5), the RADIUS server sends a random challenge to the Supplicant which generates an MD5 Hash of its credentials and the challenge, which is then sent back to the RADIUS for validation. By using this method of 802.1X authentication, however, the supplicants don’t send their passwords to the RADIUS for validation, but rather use hashes.

Advantages:

EAP-MD5 is compatible with legacy network equipment and older type of endpoints
Disadvantages:

It is exposed to dictionary attack – password “guessing”
Vulnerable to man-in-the-middle attacks since there is no mutual authentication

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

ESET reaffirms ‘Champion’ position in global Cybersecurity Leadership Matrix 2020

BRATISLAVA – ESET, a global leader in cybersecurity, has achieved Champion status for the second year in a row in the latest Cybersecurity Leadership Matrix 2020 from Canalys, improving upon 2019’s Matrix position with a focus on vendor growth and momentum beyond Europe.

Canalys is a leading global technology market analyst firm with a distinct channel focus that strives to guide clients on the future of the technology industry and to think beyond the business models of the past.

The Canalys Cybersecurity Leadership Matrix assessed 17 cybersecurity vendors on their global channel and market performance over the last 12 months. The Matrix combines partner feedback from Canalys’ Vendor Benchmark tool with an independent analysis of each vendor’s momentum in the channel based on their investments, strategy, market performance and execution.

ESET achieved the highest score benchmarks in the categories of product availability and supply, and ease of doing business. ESET’s improved position in the Matrix is reflective of the launch of an MSP enablement module to drive growth through 7,000 MSPs, as well as incorporating feedback from local Partner Councils on product roadmaps, technologies and customer needs. This collaborative approach ensures that regions across the globe are operating innovatively and efficiently and are tuned in to the pulse of the global cybersecurity landscape.

ESET was one of only seven vendors to be awarded Champion status, and one of four to reaffirm said status, alongside Cisco, Palo Alto Networks, and Fortinet. Champions have the highest scores in the Canalys Vendor Benchmark and exhibit common characteristics, including making improvements to and simplifying channel processes, and demonstrating a commitment to growing partner-generated revenue. Champions must also show that they are making sustainable investments in the future of their channel models, including channel programs and initiatives.


Ignacio Sbampato, chief business officer at ESET, commented: “We have been a channel-focused company since the beginning of our existence and our channel partners know that, so this recognition of ESET as a ‘Champion’ two years in a row is a confirmation that we are doing a great work together based on an honest and straightforward approach towards building strong and long-lasting collaborations all over the world. We are constantly innovating and improving on our offerings, and it is extremely rewarding to know that our partners rate us highly, and our increased support for MSPs is valued. A safer internet experience for all is central to our core mission, the foundation of which is our strong relationships with our partners.”

To find out more about ESET’s offerings, visit our website.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

Ripple20: Mixed Results in SCADAfence’s Exploitability Lab Tests

As part of our mission to secure the world’s OT, IoT and Cyber Physical infrastructures, we invest resources into offensive research of vulnerabilities and attack techniques.

Ripple20 are 19 vulnerabilities revealed by Israeli firm JSOF that affect millions of OT and IOT devices. The vulnerabilities reside in a TCP/IP stack developed by Treck, Inc. The TCP/IP stack is widely used by manufacturers in the OT and IoT industries and thus affects a tremendous amount of devices.

Among the affected devices are Cisco Routers, HP Printers, Digi IoT devices, PLCs by Rockwell Automation and many more. Official advisories by companies who confirmed having affected devices can be found here, in the “More Information” section.

The most critical vulnerabilities are three that can cause a stable Remote Code Execution (CVE-2020-11896, CVE-2020-11897, CVE-2020-11901) and another that can cause the target device’s memory heap to be leaked (CVE-2020-11898).

On behalf of our customers, we set out to explore the real impact of these vulnerabilities, which we’re now sharing with the public.

The research has been conducted by researchers Maayan Fishelov and Dan Haim, and has been managed by SCADAfence’s Co-Founder and CTO, Ofer Shaked.

Exploitability Research
We set out to check the exploitability of these vulnerabilities, starting with CVE-2020-11898 (the heap memory leak vulnerability), one of the 19 published vulnerabilities.

We created a Python POC script that is based on JSOF official whitepaper for this vulnerability. According to JSOF, the implementation is very similar to CVE-2020-11896, which is an RCE vulnerability that is described in the whitepaper. Also mentioned about the RCE vulnerability: “Variants of this Issue can be triggered to cause a Denial of Service or a persistent Denial of Service, requiring a hard reset.”

Trial Results:
Test 1 target: Samsung ProXpress printer model SL-M4070FR firmware version V4.00.02.18 MAY-08-2017. This device is vulnerable according to the HP Advisory.

Test 1 result: The printer’s network crashed and required a hard reset to recover. We were unable to reproduce the heap memory leak as described, and this vulnerability would have been tagged as unauthenticated remote DoS instead, on this specific printer.

Test 2 target: HP printer model M130fw. This device is vulnerable according to the HP Advisory.

Test 2 result: Although reported as vulnerable by the manufacturer, we were unable to reproduce the vulnerability, and we believe that this device isn’t affected by this vulnerability. We believe that’s because the IPinIP feature isn’t enabled on this printer, which we’ve verified with a specially crafted packet.

Test 3 target: Undisclosed at this stage due to disclosure guidelines. We will reveal this finding in the near future.

Test 3 result: We found an unreported vendor and device, on which we can use CVE-2020-11898 to remotely leak 368 bytes from the device’s heap, disclosing sensitive information. No patch is available for this device. Due to our strict policy of using Google’s Responsible Disclosure, we’ve reported this to the manufacturer, to allow them to make a patch available prior to the publication date.

Key Takeaways
We’ve confirmed the exploitability vulnerabilities on our IoT lab devices.

On the negative side: The vulnerabilities exist on additional products that are unknown to the public. Attackers are likely to use this information gap to attack networks.
On the positive side: Some devices that are reported as affected by the manufacturers are actually not affected, or are affected by other vulnerabilities. It might require attackers to tailor their exploits to specific products, increasing the cost of exploitation, and prevent them from using the vulnerability on products that are reported as vulnerable.

SCADAfence Research Recommendations
Check your asset inventory and vulnerability assessment solutions for unpatched products affected by Ripple20.
The SCADAfence Platform creates an asset inventory with product and software versions passively and actively, and allows you to manage your CVEs across all embedded and Windows devices.
Prioritize patching or other mitigation measures based on: Exposure to the internet, exposure to insecure networks (business LAN and others), criticality of the asset.
This prioritization can automatically be obtained from tools such as the SCADAfence Platform.
Detect exploitation based on network traffic analysis.
The SCADAfence Platform detects usage of these exploits in network activity by searching for patterns that indicate usage of this vulnerability in the TCP/IP communications.
If you have any questions or concerns about Ripple20, please contact us and we’ll be happy to assist you and share our knowledge with you or with your security experts.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About SCADAfence
SCADAfence helps companies with large-scale operational technology (OT) networks embrace the benefits of industrial IoT by reducing cyber risks and mitigating operational threats. Our non-intrusive platform provides full coverage of large-scale networks, offering best-in-class detection accuracy, asset discovery and user experience. The platform seamlessly integrates OT security within existing security operations, bridging the IT/OT convergence gap. SCADAfence secures OT networks in manufacturing, building management and critical infrastructure industries. We deliver security and visibility for some of world’s most complex OT networks, including Europe’s largest manufacturing facility. With SCADAfence, companies can operate securely, reliably and efficiently as they go through the digital transformation journey.

企業建置Windows Server應具備安全準則

從四月份起迄今，台灣不少企業或官方單位遭受到駭客入侵，尤其是勒索病毒的破壞，讓企業端營運資訊系統受到嚴種破壞，讓企業營運產生許多的衝擊。在營運資訊系統上都是核心主機群以及資料庫主機。相關受害主機中Microsoft Server更佔一大部份。IT或資安部們在面對這樣衝擊時，確實需要更細膩的手法，來有效降低壞的風險。因自身累積實務經驗，與大家分享一份細膩的Windows伺服器建置維運安全準則。讓資訊部門在Windows Server建置或維護時，有一個較為安全的設計準則，來達成主機安全運作。當面對攻擊入侵、內部破壞、系統故障時，都有相對應處置對策，降低後續除錯或重建的各類成本。

 

安全規劃設計

安全項目

Windows Server設定安全準則

帳戶

  1. 不同使用者使用不同帳號，不可共用
    (e.g. Local\Administrator 為：系統管理者v.s. 建立專用系統帳號提供給特定資訊系統，例如：CRM, ERP)
  2. 主機群中不同主機，有共通使用者或專案，也不使用相同帳號
  3. 定期檢視、維護主機帳號
    檢查 (啟動> run > compmgmt.msc > 本機使用者和群組 > 使用者)
  4. 最少每半年review主機帳號及使用目的，不再需要之帳號刪除或停用
  5. 刪除或停用不再使用或過期帳號
    • Net user account/del
    • Net user account/active:no
  6. 用戶端
    • 不使用預設Administrator名稱，可從系統工具下本機使用者與群組更改名稱
    • 停用Guest帳號
    • 不顯示上次登入帳號
    • 啟用CTRL+ALT+DEL登入機制

Password

  1. 複雜性密碼長度8以上
  2. 90天或180天定期更換密碼
  3. 密碼輸入錯誤5次，鎖定30分鐘
  4. 輸入錯誤達7次，鎖定帳戶
  5. 密碼更換不再用近五期舊密碼
  6. 必要時得搭配OTP或多元安全驗證機制

權限

  1. 依業務需求限制帳號權限
  2. 以最小配置為原則
  3. 本機與遠端強制關機作業，限定指派給只有Administrator群組成員執行
  4. 非必要勿將主機加入AD，一旦AD管理者帳號權限被取得，將全面潰敗(方便與風險必須取得平衡)
  5. 本機安全設定(GPO用戶權利指派)，在取得文件或其他對象，將所有權指派給系統管理者
  6. 只允許本地授權帳戶進行本地遠端Access：本地登入此電腦與網路訪問此電腦，設定為指定授權用戶

漏洞修補

  1. 補丁需再測試環境進行可靠驗證，驗證通過後方可進行升級，最為保險
  2. 重大漏洞須即時修補升級
  3. 更新至最新補丁

日誌

  1. 啟用全部日誌記錄
  2. 對用戶使用者進行日誌記錄
  3. 啟用審核策略，便於日後追蹤分析，包含失敗與成功
  4. 設定日誌覆蓋週期、規則與進行日誌備份，不得大於90天

服務

  1. 關閉非必須服務
  2. 關閉PowerShell 程序與服務(僅適用在GUI安裝模式下作業系統)
  3. 伺服器端在運作常態後禁止機碼變更
  4. 關閉伺服器端Office軟體巨集功能
  5. 關閉RDP服務
  6. 修改Windows Terminal Server RDP Port (e.g. 3389 > 2289)
  7. 因維運需要啟用SNMP服務，必須將SNMP安全選項，將預設(public)修改為SNMP Community String
  8. 透過Msconfig，關閉無效非啟動項目
  9. 透過gpedit.msc (計算機>管理模板>系統)關閉自動撥放功能
  10. 關閉預設共享(C$, D$)
    HKLM\System\CurrentControlSet\Service\LanmanServer\Parameters
    新增一個REG_DWORD AutoShareServer 鍵值為0
  11. 共享文件夾設置，必須指定具權限使用者方擁有此文件夾，非必要不啟用everyone
  12. 將FAT轉換成NTFS，最好在安裝Server OS時就改成NTFS
  13. 禁止匿名者Access命名管道及共享 (將匿名訪問的共享設置刪除)
  14. 禁止遠端access註冊表(Registry)，刪除遠端訪問註冊表路徑以及子路徑

防護

  1. 啟用本機防火牆
  2. 依業務需要，允許放行特定「服務」通過防火牆Access主機
  3. 專案多部系統主機相互連線(e.g. Web server access DB server)，應建立IP對鎖放行機制
  4. 安裝適用的Server防毒系統
  5. 更新防毒系統，檢查更新版本
  6. 註冊表定期備份
  7. 在磁碟空間允許情況下，建立快照備份
  8. 安裝應用程式，需經過掃毒後進行

維運

  1. 檢查開機磁碟使用量
  2. 定期備份與清理軌跡機記錄
  3. 定期備份或快照系統
  4. 監視CPU / RAM / HDD 用量
  5. 注意主機硬體相關燈號

檔案備份

  1. 離線備份機制必須建立，無法搭建閘道式實體隔離機制，也可以手動以人的方式建立，在面對大規模入侵破壞時，才有最後一根救命的稻草
  2. 透過備份程式以及批次排程來建立「連線與離線」備份儲存裝置

遠端桌面安全管控

資訊部門不會整天在機房內觀看每部主機運作狀態，往往透過監控系統來達成有效率的管理，但遠端桌面成為資訊部門重要中介服務渠道，往往也帶來危機。在遠端桌面管理上，有以下建議：

  1. 在實體主機上，建議將3389 Port進行變更成其他內控熟知通訊埠，例如:2289
  2. 畢竟實體伺服器主機，不會不斷變動機碼與安裝程式，建議修改完RDP通訊埠後，建議鎖定機碼變更，讓駭客入侵後相關處置複雜度變高
  3. 在ESXi虛擬機上的Windows Server，不建議開啟RDP 遠端桌面，改由ESXi管理介面來管控虛擬主機
  4. 透過其他遠端桌面工具要注意其他第三方軟體漏洞風險
  5. 在機房內通常網段互通，建議有充足財力公司，可以在各伺服器群依部門搭建起敵我識別的管控機制，讓主機不會互相跨連登入。只放行IT部門或是依服務使用群進行區隔管理

 

孫子兵法中「善攻者 敵不知其所守 善守者 敵不知其所攻」善用管控手段，自然可以降低駭客或是惡意程式運行的機會，讓企業損失大幅降低。

About Version 2

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

關於精品科技
精品科技(FineArt Technology) 成立於1989年，由交大實驗室中，一群志同道合的學長學弟所組合而成的團隊，為一家專業的軟體研發公司。從國內第一套中文桌上排版系統開始，到投入手寫辨識領域，憑藉著程式最小、速度最快、辨識最準等優異特性，獲得許多國際大廠的合作與肯定。歷經二十個寒暑，精品科技所推出的產品，無不廣受客戶好評。

×

Hello!

Click one of our contacts below to chat on WhatsApp

Social Chat is free, download and try it now here!

×