Extracting Android Factory Images on macOS

Friday, April 13th 2018 Tutorials

There seem to be a plethora of tutorials for how to extract factory images on Linux and Windows without much crossover into macOS.

Thankfully, the method for extracting a factory image on macOS so we can peruse the filesystem is really similar to Linux. The problem is, we need some way to mount the extracted image to an extended filesystem. macOS doesn’t support this out of the box, so we’ll use OSXFuse to make it happen.

FUSE implements a mechanism that makes it possible to implement a fully functional file system in a user-space program on macOS.

Now, in order to access ext4, we’ll also need an ext4 implementation for macOS Fuse (aptly named, ext4fuse).

This is a read-only implementation of ext4 for FUSE. The main reason this exists is to be able to read linux partitions from OSX.

If you’re curious about ext4 vs ext3 vs ext2 Linux file systems, take a look at this handy summary.

Finally, in order to extract the image file (before mounting it with OSX Fuse), we’re going to use imgtool. In many Linux tutorials you’ll see references to simg2img; this replaces that for macOS (although a Linux binary exists as well).

Think of it as the inverse of mkbootimg (from the AOSP), coupled with simg2img (the sparse image extractor). Another bonus feature it provides is unpacking the Linux bzimage kernels.

It was developed by the legendary Jonathan Levin. He is brilliant.

WHAT TO DO

Download whatever image file you want to extract. Google makes theirs readily available here. I’ll be using “taimen” for Pixel2 XL for this tutorial. Unzip the downloaded image file, navigate within that unzipped directory, and unzip the inner directory (in this example, named image-taimen-opd1.170816.010.zip ) as well. We want to get to the system.img  file within that second zipped directory.Download imgtool and unpack the .tgz:

Then, navigate to the directory where imgtool was unzipped where you’ll see a bunch of fun C files.
We’re going to use imgtool on the image file downloaded from Google (or wherever yours is from). I like using a split-screen in iTerm so I don’t forget where my image lives. Extract the image file with imgtool:

You should now see a new directory within imgtool called “extracted”: imgtool/extracted/image.img Within this directory is a new image file. This is the image you’ll mount in order to access the filesystem. Install OSXFuse: brew cask install osxfuse

Restart your computer. Painful, I know.

Install ext4fuse: brew install ext4fuse

Create a directory to hold the mounted image: sudo mkdir /Volumes/Linux

Mount the extracted image to that directory:

Including the allow_other  option is really important here: it allows users other than the superuser account to access the filesystem. Navigate to /Volumes/Linux  and you should be able to see the system dump! 

When you’re done working with the mounted image, you won’t be able to just delete the directory you’ve created. You’ll have to unmount it:

Do you have another way of extracting image files in macOS? Would love to hear what your approach is! Leave a comment below.

The InfoSec Interviews > Andrea / @0xdr3a

Monday, February 26th 2018 Interviews

Andrea is a student who already has experience working in infosec. She also has a fascinating “origin story”. As with many who find their way into the industry, she didn’t follow a traditional tech education trajectory. Below, she shares her experience transitioning from business to IT.

/ The_Interview

> What’s your name/pseudonym?
Andrea Stehrer

> Where are you from/currently living?
Originally Austria, currently living in The Netherlands

> What infosec role are you in, currently?
Penetration testing and IT forensics intern at NFIR, as well as writing my thesis on cybercrime at Deloitte

> Have you ever worked in any other infosec or computer-related role?
At university, I participated in (and later led) a web development bootcamp organized by a student association – Turing Society Rotterdam. In addition, I was a teaching assistant for an introductory programming course.

Towards the end of my studies I did an internship at UL, researching the (in)security of IoT devices. After that, I was an intern at Deloitte’s security department, doing a variety of tasks such as pentesting web applications and working on a hacking demo.

> Did you pursue a post-secondary degree/diploma? If so, did you focus on something computer-related or specifically security?
BSc in International Business and currently finishing MSc in Information Management (neither IT/security related).

> How did you become interested in working in security?
Through coding, I slowly but surely became more interested in security. I started reading more about it, attended related events nearby, watched documentaries (Zero Days, Cyberwar by Vice)… It appealed to me for several reasons:

1) To me, hacking was like solving a puzzle, there will always be a way to exploit a system/network given enough time and effort.

2) I enjoyed figuring out how things work and how they may be used in unintended ways.

3) Aside from the fun of it, I believe that security is a vital field to be working in. We live in a digital world and are completely reliant on computers and mobile phones, but also (if not more) on industrial control systems and (soon) IoT devices. Similarly, crime and warfare are moving into the digital realm.

> How did you land your first job in the industry?
Attending companies’ recruitment events.

> Was there anything, in particular, that you really struggled with?
Getting started! Infosec is a very large and diverse field, and there are many courses and resources freely available online. In my case, I ended up starting with web application hacking (given a basic understanding of web development), and later looked further into fields like Malware Analysis.

> Do you have any favourite resources that helped you in your chosen infosec field?
Web Application Hacker’s Handbook and CS courses such as those on Open Source Society University (github.com/ossu/computer-science). What has also been very helpful is attending (and volunteering!) at conferences and other community events, as well as getting Twitter (yes, everyone in the industry appears to be an avid Twitter user and one can learn quite a bit through it :)).

You can find Andrea online at Twitter: @0xdr3a, Instagram: @andrea_infosec and LinkedIn: Andrea Stehrer.

The InfoSec Interviews > Ryan / @hackersclub

Friday, February 23rd 2018 Interviews

Many of you likely know Ryan by his handle @hackersclub on Instagram. He regularly shares incredibly educational code snippets with mini tutorials on getting started with hacking. Ryan’s feed is a goldmine of book recommendations, tech hardware shots and insight into the life of a security researcher. He was kind enough to answer some of your pressing questions about getting started as an InfoSec professional.

/ The_Interview

> What’s your name/pseudonym?
Ryan. Birth name is Ringo 🙂

> Where are you from/currently living?
Marina del Rey, California

> What infosec role are you in, currently?
Security Researcher/Exploit Engineer

> Have you ever worked in any other infosec or computer-related role?
Yes. I was doing platform security before. I was building automation tools for the security team.

> Did you pursue a post-secondary degree/diploma? If so, did you focus on something computer-related or specifically security?
After high school, I pursued my degree in computer engineering. Security was something I studied on since I was 13 years old.

> How did you become interested in working in security?
My mom got my brother and I a Windows 95 machine when we were very young. She was a data scientist, so everything she did really peaked my interest. I remember I tried to impress her but typing random commands into the CMD prompt, and then I realized I crashed my computer…. and enjoyed it. Haha from there forward it became like an addiction.

> How did you land your first job in the industry?
So I landed my job in a very unorthodox manor. I was actually in sales for awhile, just studying every single day while not actually selling anything lol then I found my first job as a QA Automation Engineer. After that company, I got my next role as a Software Engineer, and I started building war weapons for the security team even though I wasn’t even apart of that team. The CISO took great interest and then took me under his wing. Although I left that company to join my dream company… I’m still friends with him to his day.

> Was there anything, in particular, that you really struggled with?
Assembly was a bit complicated for me in the beginning. I remember specific type of overflows that needed the exact shellcode in order to return what needed to be returned from the stack was very foreign to me in the beginning of my research career.

> Do you have any favourite resources that helped you in your chosen infosec field?
I mean nothing beats experience in the end, like actually getting down and dirty into a work place BUT I am obsessed with reading. I read a book a week (in computer science) and if I decide not to read that day, I’ll a hackthebox sort of challenge.

You can find Ryan on Instagram at @hackersclub, and at his website hackersclub.io.

The Introvert’s Guide to Joining a Large Tech Company

Tuesday, February 20th 2018 Tech

I worked at a small agency for over 3 years. At its peak, it employed 15 people across 2 offices. As an introverted, relatively reserved individual, I excelled in this kind of “small pond” environment. I made close friends of my coworkers, played Euchre every day at lunch, and easily shared jokes IRL rather than over Slack with my peers.

In 2016, I was offered a position with a booming tech company. I was the 4th female engineer hired, and my onboarding “class” was comprised of myself and two guys from other teams. We’re (extremely) lucky to have catered lunches at the office, and on my first day I went from walking into a tiny lunch room of close friends to a dining hall of 150 people.

This, for me, inflicted the kind of fear most others experience when forced to do public speaking. My brain is wired a little differently. Hand me a microphone, a topic, and tell me to get on stage and present in front of a room of 200 people? No problem. Invite me to a party where I know literally no one else, and my heart rate jumps to 150 bpm. Social anxiety makes finding a dining partner in a room of 150 strangers an absolutely terrifying experience.

So, for my first week, I ate at my desk or in a meeting room and attempted to avoid looking like the awkward new girl.

 

it me.

 

Since then, I’ve found a number of ways to deal with moving to an organization that is currently hiring like gangbusters. I see at least 5 new faces at one of our offices literally every single day. In the past two years, the company has implemented several initiatives to help new employees onboard professionally as well as socially. But, if your organization doesn’t yet have this, keep reading to learn what’s helped me:

 

Join a “Club”

As much as TV shows and movies like Silicon Valley and The Circle poke fun at large tech companies, they’re not really that far off with the way they portray the company as this kind of mini-university campus. A lot of large companies have interest groups, lunchtime events, social events and many other ways to connect with coworkers and avoid feeling lost in a sea of people who all seem to already have their shit together. By forcing myself to get more involved with these groups, I was able to find others I genuinely connected with.

Reach Out Online

See someone post an interesting topic in a group Slack chat? DM that person and ask if they’d like to grab coffee. Rinse, repeat.

Tag Along with Your Office Friend’s Group Like the Good Introvert You Are

There’s some joke about introverts following their extroverted friend around at parties. I totally get it. I find knowing one person and connecting with their network helps you progressively connect with others outside of your immediate team. It’s like graph traversal. Kind of.

Rely on Your Team

The members of your team will quickly become the individuals with whom you communicate most frequently. If you feel uncomfortable walking up to a random table of strangers and sitting down, join your team for lunch. It gives you a good opportunity to get to know them all better on a personal and professional level. Note that the network-of-friends-graph-traversal algorithm can be applied to teammates as well.

 

These “tips” may be pretty obvious. But, if you’ve struggled with the transition to a big company (or are currently struggling), just remember: you’re not alone. The vast majority of us in the industry identify as introverted, so it’s almost guaranteed that someone else in the office has dealt (or is currently dealing) with the same issue.

How have you dealt with this kind of transition? Let me know in the comments below.

Darling, you can be both.

Friday, January 19th 2018 Tech, Women in Tech

For years, I struggled with my identity as a female software developer. I struggled with the notion of femininity in an industry that often feels anything but feminine.

At 19, I donated every floral, flowy piece of clothing I owned and replaced them with video game t-shirts, jeans and American Apparel hoodies. For some reason, I believed that my identity as a “super serious Computer Science major” and the more (stereotypically) feminine pieces in my wardrobe were incompatible. I needed to choose an identity, and ultra “feminine” didn’t seem to fit. After 18 years of dance training, I stopped cold-turkey, convinced that “super serious Computer Science students” didn’t waste time on contemporary dance when they could be building PCs instead. I stopped wearing make-up (something I had once loved, trained at part-time, and secretly ran a successful Youtube tutorial channel on) because I felt I would be perceived as superficial and flighty. In a classroom of 40 students, of which 37 were men, wearing eyeliner and a floral blouse made me acutely aware of my gender.

It wasn’t that I didn’t love the video game t-shirts I wore; I did. They were all games I was passionate about, that I had played (and beaten), and that I had stumbled across at either a Hot Topic or ThinkGeek. In retrospect, what concerns me was that I saw “femininity” and “tech” as mutually exclusive. It was as though every negative experience I had as a woman in this industry compounded into the fundamental belief that in order to be taken seriously, I needed to broadcast my knowledge of the subject matter across my chest. If I wasn’t wearing hoodies and nerdy t-shirts, would anyone actually know that I belonged?

Instead of feeling secure in my knowledge of my identity, I cared (far too much) that others also understood that identity. For months I wouldn’t enter a video game or computer store in anything other than a ThinkGeek t-shirt. I did this to avoid the dreaded, “Are you shopping for your boyfriend/brother/dad?”.

It worked. The t-shirt may as well have been a giant neon sign exclaiming, “Look! I belong here! I’m part of your world! I like the same things; I make the same jokes!”

I struggled with this throughout the 4 years of my Computer Science degree, and even into my mid-twenties while working full-time as a software developer. Unfortunately, I’ve realized that this isn’t uncommon for many women in our industry.

It wasn’t until I reached my late twenties — jaded and somewhat more indifferent to the opinions of strangers — that I stopped avoiding the lifestyle choices I perceived to be incongruent with my chosen career. I recognized that others’ misconceptions and false stereotypes of women in our industry shouldn’t be the primary motivator for my decisions. In fact, by bowing to that pressure and attempting to avoid their misjudgements I was contributing to the stereotype.

Recently, an incredibly well-respected and talented woman in the cybersecurity community (@malwareunicorn) started a website called “VanitySec“. This website, described as “the intersection of security and fashion” features a number of articles on beauty and fashion by women in the infosec industry.

I can’t help but recognize how a site like this (and role models like the authors of VanitySec) would have inspired and encouraged me to embrace my stereotypically feminine interests.

I likely would have realized much sooner that there is no “Software Engineer” persona; there are stereotypes and public misconceptions, but these aren’t fact and they shouldn’t limit your decisions. The more individuals we have with varied interests in this industry, the more likely we are to develop technical solutions to a larger variety of problems.

tldr;

“Recognize and embrace your uniqueness. I don’t think the ratios are going to change anytime soon. But, I don’t think it has to be a disadvantage. Being a Black woman, being a woman in general, on a team of all men, means that you are going to have a unique voice. It’s important to embrace that.”

– Erin Teague, Director of Product at Yahoo; quote from SkillCrush

 

Have you ever struggled with your identity as a woman in tech?

Painless VPN Set-up on Kali Linux

Wednesday, October 25th 2017 Kali Linux

If you follow me on Instagram or Twitter, you know that I love the command line and use a dedicated Thinkpad T420 as my “hacking machine”. While I’m new to Kali, I’ve been a Linux user for a while — dating back to my first-year of university in 2007. I have a pretty strong love-hate relationship with Linux. While I mostly love Linux distros and would gladly use one as my primary work OS, troubleshooting hardware issues between Ubuntu and Apple hardware has caused me some grief in the past.

But I digress.

For a network security course I’m taking, we needed to play around with Nmap and a lab network set-up by our professor at Ryerson. I’ve used many a VPN before, but not with Linux and certainly not with Kali. I kind of expected a GUI like I’ve had in the past with OSX or Windows, and while I’ve realized that you can access one:

sudo apt-get install network-manager-openvpn
sudo apt-get install network-manager-openvpn-gnome

the CLI is much easier to work with and likely already installed for you.

It’s a pretty painless process, but finding some kind of set-up tutorial online proved surprisingly difficult.

If you don’t have OpenVPN installed already, run

sudo apt-get install openvpn

Next, grab the config file you’d like to use. If you’re in a class, it’s probably provided by your professor or whoever’s providing you with a network to pen test. Otherwise, you can find other config files online to play around with.

You will likely have 2 files provided to you: a config file with the filetype “.opvn”, and a certificate file.

We’re going to add the certificate file and the config file to the equivalent of a Windows config folder in Kali.

mv config-file /etc/openvpn/config-file;
mv cert-file /etc/openvpn/cert-file

That’s basically it! To spin up the VPN, run:

openvpn —config /etc/openvpn/config-file;

You’ll likely be asked to authenticate with whatever username and password you’ve been given to access the network.

Note that the command above will start the VPN in the foreground and will terminate when the terminal is closed.

If you’d rather run the VPN in the background and not terminate when closing terminal, run:

sudo nohup openvpn —config /etc/openvpn/cert-file.ovpn &;

I read several SO posts and random tutorials to get to this point, but some didn’t quite work or were too dated. The most useful site was easily https://hide.me/en/, which is actually a VPN client.

Hopefully this saved someone out there some time,

-K

Dear Women in Tech: We Need You

Wednesday, March 8th 2017 Women in Tech

We need you.

Yes, you.

Yes, I know, public speaking can be some scary shit. Mentorship takes time, and maybe you think that you don’t have much to contribute. And I know you’re probably afraid of screwing up, or forgetting a slide in a presentation, or saying the wrong thing, or sounding dumb. You’re not. You need to tell your story.

We need more female role models in tech. We need to hear your experiences, your lessons, your failures and your successes. We need to hear them because you can never be sure who you’ll influence and whose life you’ll change.

I started coding when I was about 9. I made embarrassing Geocities websites first, with sparkly fairy gifs that I am now incredibly grateful weren’t archived anywhere. I quickly got bored of that — thank God — and moved onto programming little Javascript clocks, finding my own hosting space and building a tiny online presence. I was able to do this because I became friends with a couple of women online who were slightly older and already doing the work I found fascinating. They were building cool personal sites in PHP, they were coding little site add-ons and offering them for free on their websites, they were offering free hosting space to women who wanted a subdomain. They were the reason I was able to progress so quickly, and maybe the reason I even progressed at all. They inspired me, they helped me and they supported the community.

In high school, I enrolled in the only programming class offered in 2005. I learned Visual Basic. I built a couple of tiny, shitty apps and presented a PacMan clone as my final solo project. I was hooked.

The problem was, I didn’t really have any role models who were pursuing — or had pursued — engineering or Computer Science degrees. The women I had followed online had gone onto different professions. One became a math major. Adults told me that a Computer Science degree wouldn’t involve actual programming.

“It’s a glorified math degree,” they said. “You’ll be able to do research, but you won’t really be a programmer.”

I loved math. Hell, I was a frickin’ mathlete (it wasn’t entirely social suicide). I didn’t, however, want to pursue a career in research. I wanted to code.

A good friend and I were talking about wanting to become game developers at some point. Other adults told us that you’d need to go to a design college in California for that. Design wasn’t really my thing, either.

My parents encouraged my love of computers, but were in business and didn’t really know which direction to lead me toward programming. I don’t know why, but software engineering was never really presented to me as an option by guidance counsellors, and for some reason I never made the connection.

So, I went to university for English and Political Science and assumed I’d end up in law school. Really, I had no idea what I wanted to do.

In my first year of university at McGill, I was required to take a certain number of electives. There was an “Intro to Computing” class that fit my schedule and I figured, “Hey, I like math.”

Sigh.

Jade Raymond, a producer at Ubisoft and all around bad-ass, gave a lecture at McGill during the second or third week of that semester. She had a Computer Science degree, had worked as a game developer at Sony, and was — at that time — an executive producer at Ubisoft.

Her decision to speak at McGill changed my life. The following week I made an appointment with a university guidance counsellor, applied to change my program, and became a full-time computer science student.

On this International Women’s Day, I can’t help but reflect on how much my career and life have been shaped by women who have supported my growth and education. There have been plenty of supportive men along the way but in those early early days, a small community of female developers between the years of 1998 and 2003 helped me discover a passion that has now become a career I truly love.

Whatever you can do for the community, do it. Mentor. Teach. Talk. Even if it’s only for 15 minutes a week. Hell, even if it’s only for 15 minutes a month. You never know what impact your story and your contribution to the community may have.

From someone who owes her passion and career to former mentors and teachers: thank you.

instagram

follow along @chmodxx