[{"data":1,"prerenderedAt":616},["ShallowReactive",2],{"i-lucide:menu":3,"i-lucide:arrow-up-right":8,"i-lucide:moon":10,"i-lucide:sun":12,"i-lucide:rss":14,"i-simple-icons:github":16,"i-simple-icons:linkedin":18,"post-\u002F2018\u002Fsecure-christmas":21,"surround-\u002F2018\u002Fsecure-christmas":603,"i-lucide:arrow-left":612,"i-lucide:arrow-right":614},{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":7},0,24,false,"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 5h16M4 12h16M4 19h16\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":9},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M7 7h10v10M7 17L17 7\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":11},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M20.985 12.486a9 9 0 1 1-9.473-9.472c.405-.022.617.46.402.803a6 6 0 0 0 8.268 8.268c.344-.215.825-.004.803.401\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":13},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Ccircle cx=\"12\" cy=\"12\" r=\"4\"\u002F>\u003Cpath d=\"M12 2v2m0 16v2M4.93 4.93l1.41 1.41m11.32 11.32l1.41 1.41M2 12h2m16 0h2M6.34 17.66l-1.41 1.41M19.07 4.93l-1.41 1.41\"\u002F>\u003C\u002Fg>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":15},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M4 11a9 9 0 0 1 9 9M4 4a16 16 0 0 1 16 16\"\u002F>\u003Ccircle cx=\"5\" cy=\"19\" r=\"1\"\u002F>\u003C\u002Fg>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":17},"\u003Cpath fill=\"currentColor\" d=\"M12 .297c-6.63 0-12 5.373-12 12c0 5.303 3.438 9.8 8.205 11.385c.6.113.82-.258.82-.577c0-.285-.01-1.04-.015-2.04c-3.338.724-4.042-1.61-4.042-1.61C4.422 18.07 3.633 17.7 3.633 17.7c-1.087-.744.084-.729.084-.729c1.205.084 1.838 1.236 1.838 1.236c1.07 1.835 2.809 1.305 3.495.998c.108-.776.417-1.305.76-1.605c-2.665-.3-5.466-1.332-5.466-5.93c0-1.31.465-2.38 1.235-3.22c-.135-.303-.54-1.523.105-3.176c0 0 1.005-.322 3.3 1.23c.96-.267 1.98-.399 3-.405c1.02.006 2.04.138 3 .405c2.28-1.552 3.285-1.23 3.285-1.23c.645 1.653.24 2.873.12 3.176c.765.84 1.23 1.91 1.23 3.22c0 4.61-2.805 5.625-5.475 5.92c.42.36.81 1.096.81 2.22c0 1.606-.015 2.896-.015 3.286c0 .315.21.69.825.57C20.565 22.092 24 17.592 24 12.297c0-6.627-5.373-12-12-12\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":19,"hidden":20},"\u003Cpath fill=\"currentColor\" d=\"M20.447 20.452h-3.554v-5.569c0-1.328-.027-3.037-1.852-3.037c-1.853 0-2.136 1.445-2.136 2.939v5.667H9.351V9h3.414v1.561h.046c.477-.9 1.637-1.85 3.37-1.85c3.601 0 4.267 2.37 4.267 5.455v6.286zM5.337 7.433a2.06 2.06 0 0 1-2.063-2.065a2.064 2.064 0 1 1 2.063 2.065m1.782 13.019H3.555V9h3.564zM22.225 0H1.771C.792 0 0 .774 0 1.729v20.542C0 23.227.792 24 1.771 24h20.451C23.2 24 24 23.227 24 22.271V1.729C24 .774 23.2 0 22.222 0z\"\u002F>",true,{"id":22,"title":23,"body":24,"category":589,"comments":590,"date":591,"description":592,"excerpt":590,"extension":593,"image":594,"meta":595,"navigation":20,"path":596,"readingTime":597,"seo":598,"stem":599,"subtitle":600,"tags":590,"wordCount":601,"__hash__":602},"posts\u002F2018\u002Fsecure-christmas.md","Secure Christmas",{"type":25,"value":26,"toc":585},"minimark",[27,39,42,65,72,77,95,352,363,369,372,386,404,411,441,447,464,469,472,477,488,491,495,498,504,510,529,532,539,546,552,555,560,563,569,572,575,578,581],[28,29,30,31,38],"p",{},"I received solstice greetings via snail-mail from fellow security engineers in ",[32,33,37],"a",{"href":34,"rel":35},"https:\u002F\u002Fbigbank.eu",[36],"nofollow","Bigbank",", guys I used to work with.\nOnly, when ethical hackers send messages, they send them... securely.",[28,40,41],{},"The outer envelope was marked as registered mail. Inside:",[43,44,45,49,57],"ul",{},[46,47,48],"li",{},"Security stickers, because, obviously",[46,50,51,52],{},"A merry fir tree card\n",[43,53,54],{},[46,55,56],{},"...but you had to enable macros to get it to show",[46,58,59,60],{},"Security envelope, properly sealed with a security seal\n",[43,61,62],{},[46,63,64],{},"Inside, an USB drive",[28,66,67],{},[68,69],"img",{"alt":70,"src":71},"Solstice package","\u002Fcontent\u002F2018\u002Fsecure-christmas\u002Fpackage.jpg",[73,74,76],"h2",{"id":75},"usb-teardown","USB teardown",[28,78,79,80,85,86,90,91,94],{},"The USB drive was named \"",[32,81,84],{"href":82,"rel":83},"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FNimda",[36],"nimda","\" (",[87,88,89],"code",{},"__\u003C\u003Cadmin"," - RTL override?) and contained ",[87,92,93],{},"insecurity.png",".",[96,97,102],"pre",{"className":98,"code":99,"language":100,"meta":101,"style":101},"language-bash shiki shiki-themes github-light github-dark","~\u002Ftmp » ls -lh\ntotal 867M\n-rw-r--r-- 1 ando ando 867M dets  17 12:34 insecurity.png\n\n~\u002Ftmp » stat insecurity.png \n  File: insecurity.png\n  Size: 908809605   Blocks: 1775032    IO Block: 4096   regular file\nDevice: fd00h\u002F64768d    Inode: 1447295     Links: 1\nAccess: (0644\u002F-rw-r--r--)  Uid: ( 1000\u002F    ando)   Gid: ( 1000\u002F    ando)\nAccess: 2018-12-20 18:28:02.900991000 +0200\nModify: 2018-12-17 12:34:24.000000000 +0200\nChange: 2018-12-20 18:28:02.202816787 +0200\n Birth: -\n\n~\u002Ftmp » file insecurity.png \ninsecurity.png: PNG image data, 300 x 300, 8-bit colormap, non-interlaced\n","bash","",[87,103,104,117,128,158,164,172,180,210,231,256,270,284,297,306,311,319],{"__ignoreMap":101},[105,106,109,113],"span",{"class":107,"line":108},"line",1,[105,110,112],{"class":111},"szBVR","~",[105,114,116],{"class":115},"sVt8B","\u002Ftmp » ls -lh\n",[105,118,120,124],{"class":107,"line":119},2,[105,121,123],{"class":122},"sScJk","total",[105,125,127],{"class":126},"sZZnC"," 867M\n",[105,129,131,134,138,141,143,146,149,152,155],{"class":107,"line":130},3,[105,132,133],{"class":122},"-rw-r--r--",[105,135,137],{"class":136},"sj4cs"," 1",[105,139,140],{"class":126}," ando",[105,142,140],{"class":126},[105,144,145],{"class":126}," 867M",[105,147,148],{"class":126}," dets",[105,150,151],{"class":136},"  17",[105,153,154],{"class":126}," 12:34",[105,156,157],{"class":126}," insecurity.png\n",[105,159,161],{"class":107,"line":160},4,[105,162,163],{"emptyLinePlaceholder":20},"\n",[105,165,167,169],{"class":107,"line":166},5,[105,168,112],{"class":111},[105,170,171],{"class":115},"\u002Ftmp » stat insecurity.png \n",[105,173,175,178],{"class":107,"line":174},6,[105,176,177],{"class":122},"  File:",[105,179,157],{"class":126},[105,181,183,186,189,192,195,198,201,204,207],{"class":107,"line":182},7,[105,184,185],{"class":122},"  Size:",[105,187,188],{"class":136}," 908809605",[105,190,191],{"class":126},"   Blocks:",[105,193,194],{"class":136}," 1775032",[105,196,197],{"class":126},"    IO",[105,199,200],{"class":126}," Block:",[105,202,203],{"class":136}," 4096",[105,205,206],{"class":126},"   regular",[105,208,209],{"class":126}," file\n",[105,211,213,216,219,222,225,228],{"class":107,"line":212},8,[105,214,215],{"class":122},"Device:",[105,217,218],{"class":126}," fd00h\u002F64768d",[105,220,221],{"class":126},"    Inode:",[105,223,224],{"class":136}," 1447295",[105,226,227],{"class":126},"     Links:",[105,229,230],{"class":136}," 1\n",[105,232,234,237,240,243,246,249,251,253],{"class":107,"line":233},9,[105,235,236],{"class":122},"Access:",[105,238,239],{"class":115}," (0644\u002F-rw-r--r--)  Uid: ( ",[105,241,242],{"class":122},"1000\u002F",[105,244,245],{"class":126},"    ando",[105,247,248],{"class":115},")   Gid: ( ",[105,250,242],{"class":122},[105,252,245],{"class":126},[105,254,255],{"class":115},")\n",[105,257,259,261,264,267],{"class":107,"line":258},10,[105,260,236],{"class":122},[105,262,263],{"class":126}," 2018-12-20",[105,265,266],{"class":126}," 18:28:02.900991000",[105,268,269],{"class":126}," +0200\n",[105,271,273,276,279,282],{"class":107,"line":272},11,[105,274,275],{"class":122},"Modify:",[105,277,278],{"class":126}," 2018-12-17",[105,280,281],{"class":126}," 12:34:24.000000000",[105,283,269],{"class":126},[105,285,287,290,292,295],{"class":107,"line":286},12,[105,288,289],{"class":122},"Change:",[105,291,263],{"class":126},[105,293,294],{"class":126}," 18:28:02.202816787",[105,296,269],{"class":126},[105,298,300,303],{"class":107,"line":299},13,[105,301,302],{"class":122}," Birth:",[105,304,305],{"class":126}," -\n",[105,307,309],{"class":107,"line":308},14,[105,310,163],{"emptyLinePlaceholder":20},[105,312,314,316],{"class":107,"line":313},15,[105,315,112],{"class":111},[105,317,318],{"class":115},"\u002Ftmp » file insecurity.png \n",[105,320,322,325,328,331,334,337,340,343,346,349],{"class":107,"line":321},16,[105,323,324],{"class":122},"insecurity.png:",[105,326,327],{"class":126}," PNG",[105,329,330],{"class":126}," image",[105,332,333],{"class":126}," data,",[105,335,336],{"class":136}," 300",[105,338,339],{"class":126}," x",[105,341,342],{"class":126}," 300,",[105,344,345],{"class":126}," 8-bit",[105,347,348],{"class":126}," colormap,",[105,350,351],{"class":126}," non-interlaced\n",[28,353,354,355,358,359,362],{},"So, it is (actually) a ",[87,356,357],{},"300x300px"," .PNG image. The obvious question though - WTF is up with the ",[87,360,361],{},"867M"," file size?\nInterestingly, Nautilus had no problems displaying the thumbnail.",[28,364,365],{},[68,366],{"alt":367,"src":368},"PNG thumbnail","\u002Fcontent\u002F2018\u002Fsecure-christmas\u002Fpng-thumb.png",[28,370,371],{},"It's my avatar.",[28,373,374,375,380,381,385],{},"Maybe the guys used ",[32,376,379],{"href":377,"rel":378},"https:\u002F\u002Fwww.w3.org\u002FTR\u002FPNG\u002F#11textinfo",[36],"PNG metadata"," to hide a hidden message or artificially\nenlarge the file size? ",[32,382,384],{"href":383},"\u002Fcontent\u002F2018\u002Fsecure-christmas\u002Fmetadata.txt","Let's inspect"," with",[96,387,389],{"className":98,"code":388,"language":100,"meta":101,"style":101},"$ identify -verbose insecurity.png\n",[87,390,391],{"__ignoreMap":101},[105,392,393,396,399,402],{"class":107,"line":108},[105,394,395],{"class":122},"$",[105,397,398],{"class":126}," identify",[105,400,401],{"class":136}," -verbose",[105,403,157],{"class":126},[28,405,406,407,410],{},"Seems like not. What about ",[87,408,409],{},"hexdump",", this should give an indication of what's actually there...",[96,412,414],{"className":98,"code":413,"language":100,"meta":101,"style":101},"$ hexdump -C insecurity.png -n 90000 | less\n",[87,415,416],{"__ignoreMap":101},[105,417,418,420,423,426,429,432,435,438],{"class":107,"line":108},[105,419,395],{"class":122},[105,421,422],{"class":126}," hexdump",[105,424,425],{"class":136}," -C",[105,427,428],{"class":126}," insecurity.png",[105,430,431],{"class":136}," -n",[105,433,434],{"class":136}," 90000",[105,436,437],{"class":111}," |",[105,439,440],{"class":122}," less\n",[28,442,443],{},[68,444],{"alt":445,"src":446},"PNG hexdump","\u002Fcontent\u002F2018\u002Fsecure-christmas\u002Fpng-hex1.png",[28,448,449,450,453,454,457,458,463],{},"The file starts with a ",[87,451,452],{},".png"," image, as expected. This is why Nautilus was able to render the thumbnail.\nHowever, scrolling down, we see that at one point not far into the file, the file ends with\n",[87,455,456],{},"IEND"," marker, which ",[32,459,462],{"href":460,"rel":461},"https:\u002F\u002Fwww.w3.org\u002FTR\u002FPNG\u002F#11IEND",[36],"according to .PNG specification",",\n\"marks the end of the PNG datastream\".",[28,465,466],{},[68,467],{"alt":445,"src":468},"\u002Fcontent\u002F2018\u002Fsecure-christmas\u002Fpng-hex2.png",[28,470,471],{},"What follows makes it clear why the file was so large.",[28,473,474],{},[68,475],{"alt":445,"src":476},"\u002Fcontent\u002F2018\u002Fsecure-christmas\u002Fpng-hex3.png",[28,478,479,480,483,484,487],{},"The guys have hidden the latest ",[87,481,482],{},".iso"," of Kali Linux into the ",[87,485,486],{},".PNG"," file.",[28,489,490],{},"Have you ever thought how to hide your hacking distros? An image* will do.",[73,492,494],{"id":493},"card-teardown","Card teardown",[28,496,497],{},"The printed-out card they sent had two sides: one Word document, directing the user to\nenable content, the other wishing merry Christmas.",[28,499,500],{},[68,501],{"alt":502,"src":503},"Enable macros","\u002Fcontent\u002F2018\u002Fsecure-christmas\u002Fmacros.jpg",[28,505,506],{},[68,507],{"alt":508,"src":509},"Solstice card","\u002Fcontent\u002F2018\u002Fsecure-christmas\u002Fcard.jpg",[28,511,512,513,518,523,524,94],{},"Most people don't know this, but whenever you print something with a color printer, the printer\n",[32,514,517],{"href":515,"rel":516},"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FMachine_Identification_Code",[36],"embeds tiny tracking",[32,519,522],{"href":520,"rel":521},"http:\u002F\u002Fseeingyellow.com\u002F",[36],"fingerprints in the paper",", in yellow color.\nYou won't be able to see it with a naked eye, but in case it's ever needed,\nthis marker will be able to identify from which printer a particular paper came from.\nThis is how they were able to ",[32,525,528],{"href":526,"rel":527},"https:\u002F\u002Fmashable.com\u002F2017\u002F06\u002F06\u002Fprinter-dots-nsa-leak",[36],"identify a whistleblower in NSA",[28,530,531],{},"Let's see if the markers (or any other hidden messages) are present in the card.",[28,533,534,535,538],{},"We'll start by taking a high-resolution scan (best quality possible ",[87,536,537],{},"\u003C600dpi",") of the paper.",[28,540,541,542,545],{},"The resulting ",[87,543,544],{},".PDF"," can be opened in Gimp.",[28,547,548],{},[68,549],{"alt":550,"src":551},"Card scan in Gimp","\u002Fcontent\u002F2018\u002Fsecure-christmas\u002Fgimp.png",[28,553,554],{},"Using the color Channels dialog, we'll hide the Red and Green color channels, leaving only the blue.\nAnd zoom in.",[28,556,557],{},[68,558],{"alt":550,"src":559},"\u002Fcontent\u002F2018\u002Fsecure-christmas\u002Fgimp2.png",[28,561,562],{},"Looking closely, we can see tiny black dots with the same pattern, distributed across the page.\nZooming in on one of them gives us the unique fingerprint of the printer in questions.",[28,564,565],{},[68,566],{"alt":567,"src":568},"Printer fingerprint","\u002Fcontent\u002F2018\u002Fsecure-christmas\u002Fprinter-fingerprint.png",[28,570,571],{},"So, if you ever receive printouts with the same fingerprint, you know it came from their printer.",[573,574],"hr",{},[28,576,577],{},"All-in-all, an excellent hackish solstice wish. Thanks, guys!",[28,579,580],{},"Bigbank Information Security Team (ISEC) is a blue team of hackers, who tries to keep the bank safe from\nexploitation and data breaches.",[582,583,584],"style",{},"html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":101,"searchDepth":119,"depth":119,"links":586},[587,588],{"id":75,"depth":119,"text":76},{"id":493,"depth":119,"text":494},"Security",null,"2018-12-20","I received solstice greetings via snail-mail from fellow security engineers in Bigbank, guys I used to work with.\nOnly, when ethical hackers send messages, they send them... securely.","md","\u002Fcontent\u002F2018\u002Fsecure-christmas\u002Fheader.jpg",{},"\u002F2018\u002Fsecure-christmas","about 3 minutes",{"title":23,"description":592},"2018\u002Fsecure-christmas","When security engineers send Christmas cards...",596,"buQYpSmSsXEaMC1uiJgxzBL1efeHJ8J4OuuoCOPCovg",[604,608],{"title":605,"path":606,"stem":607,"children":-1},"1u OpenHAB enclosure","\u002F2018\u002F1u-openhab-enclosure","2018\u002F1u-openhab-enclosure",{"title":609,"path":610,"stem":611,"children":-1},"Buspad kiosk breakout","\u002F2020\u002Fbuspad-kiosk-bypass","2020\u002Fbuspad-kiosk-bypass",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":613},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m12 19l-7-7l7-7m7 7H5\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":615},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M5 12h14m-7-7l7 7l-7 7\"\u002F>",1790886931245]