Recent content on Infosec scribbles
Since I had to migrate my work machine to Windows, it became impossible to use the TPM of my Precision 5520 as a secure key store. The open source tpm2-software stack does not work on Windows, and there is no alternative software stack provided by Microsoft. So I figured, might as well switch to a crypto stick . This post contains my notes from that process.
Ubuntu 20.04 LTS is on the horizon and while we’re all hyped about the new set of wallpapers, here is my small wish list of technical improvements to have out of the box in the next LTS:
I was pretty impressed with two new pieces of technology recently: Being able to run Quake Champions on Linux using Proton External GPUs seeing just a 20% performance hit on external displays and being compatible with Linux Below are results of my experiments.
There has been somewhat of a hiatus to my ARM crackme series. There are two reasons for this: r2con 2019 and 44CON 2019 . Both had CTF challenges and that’s what I’ve been busy with. First item on the list is the 500 points binary challenge from 44CON: ┌─────┐ ┌─────┐ │ BIN │ │ WEB │ │ ├─┐ ┌>│ ├┐ │ ¥10 │ │ │ │ ¥30 ││ └─────┘ │ │ └─────┘│ ┌─────┐ │ ┌──────┐ │ │ ┌──────┐ ┌──────┐…
Recently, I decided to put my reversing skills to a test by solving some of the public crackmes and writing down my solutions. This is the second post of the series. For work, I do some very basic Android, TEE, RASP and IoT reversing, but most of those tasks are too shallow and repetitive. You can’t get much depth when reversing is an “if there’s time to waste” part of an…
Recently, I decided to put my reversing skills to a test by solving some of the public crackmes and writing down my solutions. This is the first of many to come. For work, I do some very basic Android, TEE, RASP and IoT reversing, but most of those tasks are too shallow and repetitive. You can’t get much depth when reversing is an “if there’s time to waste” part of an…
Preamble As it turns out, font rendering is a highly controversial topic. If you don’t see anything wrong with Linux font rendering, please disregard this as a shitpost. Thanks. I spent the first 25 years of my life on Windows and therefore I am biased towards Windows font rendering with ClearType. I also agree with research which suggests that this rendering approach makes reading easier on…
Say you have a homelab and, like me, you don’t have the space for a 42U rack and an enterprise vSphere license. Your options are Hyper-V, Xen, Proxmox or… a standalone ESXi machine on a free license. Every now and then VMware releases updates for it, but there is no way to get them automatically on a standalone ESXi host. Thankfully, it’s not too hard to do by hand and here is a…
It turns out Intel GuC and HuC bits of the i915 driver don’t get loaded by default on Linux . Ubuntu kernel changes make it extra difficult to get them to load manually, so I wrote it down. This is how you get it to work.
One thing I really wanted to have on my server was the ability for system packages to send mail externally. This is useful for upgrade notifications or any kind of monitoring alerts that systems may emit. One the other hand, I have better things to do than worry about a private mail server . The solution I came up with is setting up postfix to act as an SMTP-relay, using an SMTP account at a…
This is a continuation to my series of migrating to Linux posts . If you try to pair Bose QC35 with an Ubuntu 16.04 LTS box, you will notice that it always pairs in headset mode, acts as if a call has just started and then disconnects. If you try to manually select A2DP Sink in sound settings, it will fail without any warning message displayed. Next time you open sound settings you will find that…
Being more happy than not with the experience I had at work with a Dell Precision 5520 running Ubuntu , I looked closer at Project Sputnik when time came to replace my beaten up Inspiron 17R. I decided to get myself an XPS 15 based on Intel’s 7th gen platform. Of course, given the opportunity to pick, I decided against a 4K UHD screen, against a touchscreen and picked a matte cover too…
Note: this post has now been updated for 18.04 LTS. Recently I got a new Dell Precision 5520 and a TB16 dock. It came with Windows 10, and as I was quick to learn, “10” is the number of minutes it took me to decide that I would rather use anything else. This is coming from someone who has been using Windows on all non-server machines since age 7. Given the available options, I went for…
Had to pop open my Logitech Z506 speaker the other day because reasons. Thought that this may come in handy to someone looking for which wire goes to which pin on the 10-pin connector aka connector pinout. On the picture below I marked every pin with the color of the corresponding wire. It may be hard to see on the preview but the black one is ground. Happy tinkering!
I was sitting in the lab the other day ~socializing~ with other students and we all agreed it was sad that there was no shellcode out there that would open a RickRoll . Making one seemed like a good way to procrastinate from preparing a talk on privacy while learning how to write shellcodes and the challenge was accepted. The application to have fun with was Chasys Media Player 1.1 on Windows XP…
Ever met MBRLockers ? Yes, those nasty pieces of malware which replace your Master Boot Record with malicious code and ransom you. Good news here, most of them just backup your original MBR somewhere and put one asking for ransom in its place. Today I’m going to tell you how to debug these things easily for ehmm, scientific purposes.
Here comes a little addition to the TG789vn article : this time we will see how to open ST780WL . This is required if you want to JTAG your router or replace the antenna with something more powerful.
So I recently got a box full of Thomson TG789vn routers with half of them not working properly. Say “Hello” to lightnings hitting the power lines in Estonia. With nothing to lose it was decided to pop one open to see if there is any obvious damage that can be repaired. Surprisingly, there were no guides on the internet on how to open TG789vn without breaking anything, so here is one.…
This was my second time at B-Sides London and 3rd time at a huge hacking conference. But considering countless tech meetups, Abertay Ethical Hacking Society meetings and stuff like that one could say I am a frequent goer to such events. Anyway,
Once you start using Sublime Text, you will begin putting together a collection of plugins to simplify your life. The amount of keys on your keyboard is rather limited and Sublime is a key mapping heavy editor. Lots of comfy hot keys are used even by default. Every once in a while you will get a plugin that wants to use one of the keys that is already in use. At this point you will end up…
Since I had automatic updates in Skype enabled, yesterday it updated to version 6.3. As it is very common these days, the interface was “improved” to match other Microsoft’s products in their UI style, Metro UI of Windows 8. I personally can’t stand it, but in previous versions there was a switch in options to use system theme. I decided it was time to down grade. If you…
UPDATE: This feature has been completely removed from Firefox with release of version 26. If you would like to use a functional downloads manager, you can try DownThemAll! . Today was the day when I finally decided to upgrade to the latest versions of everything. Which of course included Firefox. What I instantly noticed after starting up a new version was this tiny new button for opening the…
Me and my friends really enjoy Skype conferences. And even though it belongs to the corporation of evil these days, there does not seem to be a good alternative. So lets try our best and make our Skype more comfy.
For the better part of the last decade I have been involved in software security. I graduated from Abertay University with a BSc (Hons) in Ethical Hacking and Countermeasures. In parallel with my studies, I started out my professional career as a web developer with some joint security responsibilities at an amazing Scottish web design studio, MTC Media. Upon my graduation, I moved to London to…
You can find links to all my past posts here.
This is a “note to self” type of page. It spawned from my research on Linux font rendering after realizing how unfortunate the situation was. Desktop Linux in general cannot boast great software craftsmanship and is a bit of a cesspit, but font rendering in particular is easy enough to fix. Get subpixel positioning enabled in Chrome. Chromium team is not interested in fixing it, but…
Due to corporate IP clauses in employment contracts most of the code I write never ends up being publicly available. These are the things that were either started prior to those clauses affecting me or that got cleared for publishing by my employer: (2020) Android Biometric Crypto Testbench, an app that lets you play with parameters of BiometricPrompt on Android and queries some under the hood…