Simone Margaritelli (evilsocket), a security researcher, writes about hacking, reverse engineering, wireless attacks and offensive tooling.
HN links it for security research, notably the CUPS attack disclosure, and commenters recommend its Android reverse engineering guide.
> So, I really think we need to start shipping some kind of client side firewall with a good UX by default (something like little snitch?).
This is not a solution but makes it worse. Adding more vulnerable code widens the attack surface. The history of so called security software (aka snakeoil) has shown that it doesn’t protects but causes more harm.
A Linux system shall show with “# ss -lpn” [1] only ports and process which are known and reachable. It easy to use and that the functions people want - knowing who is doing what. And that’s the path Linux and BSD have taken successfully in the past.
Firewalls are a valid way for administrating networks itself. And while firewalls come lean and integrated on Linux, they should be used carefully. I think system-monitor tools should show open sockets and ports, like they show processes itself, in a list.
[1] https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/ -> The author use the old netstat. And recommends to just turn the service off. That ensures that CUPS doesn’t make other mistakes. A thing a firewall will not do.
PS: At least the Wiki of Archlinux recommends for quite some time not to install `cups-browsed` because it isn't usually need for printer discovery (IPP-Everywhere/AirPrint). At least since December 2022.
>, the title is incorrect.
Differing philosophies of how to interpret titles. Prescriptive vs Descriptive language.[0]
There can be different usages of "Unix":
#1: Unix is a UNIX(tm) System V descendent. In this strict definition, you get the common reminder that "Linux is not a Unix!"
#2: "Unix" as a loose generic term for a family of o/s that looks/feels like Unix. Sometimes deliberately styled as asterisk "*nix" or a suffix-qualifier "Unix-like" but often just a naked "Unix".
A Prescriptivist says the author's title is "incorrect". On the other hand, a Descriptivist looks at the whole content of the article -- notices the text has a lot of Linux specific info such as fcntl(,F_GETLEASE/F_SETLEASE), and every hyperlink to a man page url points to https://linux.die.net/man/ , etc -- and thus determines that the author is using "Unix" in the looser way that can include some Linux idiosyncrasies.
"Unix" instead of "*nix" as a generic term for Linux is not uncommon. Another example article where the authors use the so-called incorrect "Unix" in the title even though it's mostly discussing Linux CUPS instead of Solaris : https://www.evilsocket.net/2024/09/26/Attacking-UNIX-systems-via-CUPS-Part-I/
[0] https://en.wikipedia.org/wiki/Linguistic_prescription
The UAE really hates on activists, and appears to be hiring a bunch of people specifically to suppress activists/dissidents within the country. [1] Unfortunately, due to the amount of wealth the country has, it won't stop almost anybody from dealing with them unless Western sanctions are placed on the country, which are unlikely given the current geopolitical situation.
https://www.evilsocket.net/2016/07/27/How-The-United-Arab-Emirates-Intelligence-Tried-to-Hire-me-to-Spy-on-its-People/
I would be very surprised if EDR products didn't use some form of anomaly detection (e.g. autoencoders[1], ANN embeddings etc.)
I've gotten into trouble with employers over editing system configuration files and trying to start reverse shells, and I can't imagine execve() or connect()+dup2() are malicious either.
[1] https://www.evilsocket.net/2022/08/15/Process-behaviour-anomaly-detection-using-eBPF-and-unsupervised-learning-Autoencoders/
I liked this guide on reversing Android. https://www.evilsocket.net/2017/04/27/Android-Applications-Reversing-101/
CharlesProxy is a must-have whether you're a dev or reverse-engineering.
JADX is the best for reversing Android because it produces readable Android code which is fantastic for current Android developers who expect things to be organized like Android Studio.
No. For that, you'll want [0] (on HN a few days ago). This is mostly for making it easier to run your own legitimate GSM network, and of course the software has been available for a long time, it's just now available via the Debian repositories.
[0]: https://www.evilsocket.net/2016/03/31/how-to-build-your-own-rogue-gsm-bts-for-fun-and-profit/