Turns out it was intentional. https://news.ycombinator.com/item?id=48550425
529 karma · joined July 22, 2013
The author has clearly put quite some investment in writing their book, it's a shame and hard to understand that someone would self sabotage by plagiarising the work of others - Especially to someone donating their own free time to initially help out.
> But I have only myself to blame for opensourcing the code of my books/website and thinking people would use it as intended.
Even if you had not, perhaps this scenario would have still eventuated.
Keep up the good work. Any new books planned on the horizon?
[EDIT] - I see in the Keen book's source git commit logs that you reviewed and assisted with proof reading beforehand, so may we assume that this is all above board and sanctioned by you?
If you didn't double check the author while skimming this Keen book, you may well be mistaken that it was written by Fabien.
I took a quick skim of the content, it looks great - tempted to purchase a copy to support the author for their efforts (and have it sit on the bookshelf next to two other very similar looking books...) but need to sit on this for a while.
Maybe I'm overthinking this. Would like to hear Fabien's take on the situation.
[EDIT] It looks that the Keen book author copied and pasted direct sections[1] out of Fabien's book's TeX[2].
[EDIT] The git commit history has comments that indicate that Fabien reviewed the book, e.g. "updated all chapters after feedback Fabien" and "Proofread Fabien Sanglard en hardcopy review", so perhaps this is all sanctioned.
[1] https://github.com/bsmits74/Keen_White_Papers/blob/master/sr...
[2] https://github.com/fabiensanglard/gebbdoom/blob/master/src/b...
Highly recommended listening.
As a neuroendocrinology researcher, much Robert Sapolsky’s life work revolves around the questions your pondering on. He has spent years studying wild baboons in Kenya, “ .. specifically, Sapolsky studies the cortisol levels between the alpha male and female and the subordinates to determine stress level.” [2]
[1] https://podcasts.apple.com/au/podcast/the-peter-attia-drive/...
Current approach is following “xrefs” in JADX and hooking methods with dynamic instrumentation with Frida (displaying backtraces etc). Got to be a quicker way while chipping away renaming classes and methods and mapping out source/sinks.
Alternatively, WordPerfect 6.2 for DOS running in Wine on Linux (or DOSbox) [2]
This word processor was pretty serious back in the day. I have distant memories of sitting in class and learning it in at school in the early 90s. It’s interesting how we retain such inconsequential memories that can resurface with very specific triggers (such as seeing the screenshots of ASCII text of an ancient word processor).
[1] https://lock.cmpxchg8b.com/wordperfect.html
[2] https://blog.cmpxchg8b.com/2020/09/finding-console-word-proc...
> planning a more mellow retreat
The objective here is to forcefully going to where internet is impossible (no phone reception, I don’t have starlink) with the objective of focused productive output with limited distractions.
The idea came to mind after reading about John Carmack doing this for a week, diving into AI using nothing but classic text books and papers as reference material to work off.
EDIT: here is the HN thread on Carmack’s week long retreat:
It’s noted that this editor supports offline - does this mean that the AI features also run offline? Or a limited version?
Highly recommended read for anyone who happens to spend their time plotting away in a terminal.
Perhaps there are opportunities for developing easy to use dynamic analysis tools for the general population.
A week ago I purchased a bluetooth device that takes some measurements. You require an Android or iOS application. The first thing the iOS app did was request permission for your location. Immediate fired up MITMproxy [1] running in transparent `--mode wireguard` and installed it's certificate in the iOS trust store. It was sending a whole bunch of data to China and HK. Since I don't have a jailbroken iPhone, it's off to Android.
For BLE scanning, Android does require permissions for location, but this application is using a Chinese branded tracking SDK and sending encrypted blobs (within already encrypted TLS). So it's time to start reversing and instrumenting the runtime.
Well - not so easy, they used a commercial packer that encrypts their compiled bytecode and decrypts and I think executes it within C++ library that might be an actual interpreter. I managed to pull the Dalvik bytecode out of memory using Frida[2] after the packer had decrypted the base application and converted it to java bytecode with dex2jar[3] then into decompiled java with jadx [4].
Since the developer relied on the packer to hide/obfuscate their software, it's quite easy to follow the deobsfucated code. The libraries that do the location tracking on the otherhand are obfuscated so now I'm at the stage of identifying where to hook before the encrypted blobs are sent to servers in China.
Here it would be nice to have a call flow graph generated based on the static decompiled java code - can anyone recommend anything?
I've sunk about 8 hours into this so far. The message here is that to understand what some applications on your phone does you need to really invest time and effort. The developers increase the cost to the consumer to know what their application is doing by obfuscation, encryption and packing. It's asymmetric. Also note: the play store and apple store state the app does not send data, which is demonstrably false.
I can also see that the tracking SDK has what looks like functionality to dynamically invoke code - which would break the terms and conditions of the app stores.
At some point I will reimplement it's primary BLE functionality and release it as opensource to the public and perhaps write a blog post.
[1] https://mitmproxy.org/posts/wireguard-mode/
[2] https://frida.re/docs/android/
As someone mentioned in another reply it's not banned in the OSCP. Automating enumeration is actually encouraged - after all enumeration is collecting information. It's up to you as the tester to interpret the results. On the other hand, tools like OpenVAS, Nessus etc. are not permitted as they go further then basic enumeration.
and well.. here we are.
My next go-to tool after Linpeas is pspy which "allows you to see commands run by other users, cron jobs, etc. as they execute" [1]
This doesn't protect your PII data though. This is not a good situation at all.
[1] https://support.ring.com/hc/en-us/articles/360054941511-Unde...
"HACKER NEWS - A DDoS made of finance-obsessed man-children and brogrammers"
Suppose will have to try again another time.
While this technical demonstration is a long way from replacing "real podcasts", it's just the very beginning.
What are the implications here?
Risky game indeed. It’s 1:24am here in Australia and I’ve finally stopped attempting to reverse a network protocol for an embedded device which I’m pentesting. Reading the article is a good reminder of what can happen if you push it too far. The challenge is with this type of work you often have to put in the hours, particularly if it’s a hard target..
If you lack the passion and drive you simply just won’t retain and develop the skills required to deliver. If seasoned pentesters disagree, then I’m all ears.
I recently went though some frustration to root a Samsung handset - it required sorting through endless blog posts linking random executables from megaupload or google drive. Fragmented instructions on various forums; many incomplete or incorrect.
Which Android handsets best support rooting/jailbreaking by the vendor which provides a supported way to both unlock the bootloader and provide root access?