Siguza

@siguza@infosec.space
3.1K Followers
154 Following
7.2K Posts

iOS hacker, security researcher, 0day enthusiast.
Sometimes RE tools / jailbreak / write-up author.
And accidental maintainer of ever more things I didn't ask for.

Contact in English or German.
PGP: https://siguza.net/pgp.asc

webhttps://siguza.net
bloghttps://blog.siguza.net
githubhttps://github.com/Siguza
thinkingoutside the box

Finally got a chance to play around with @khaost's ExtensionKit sample project. Runs straight outta the box on iPad! Unfortunately not on Mac Catalyst (seems to need an entitlement?)

TL;DR, however — you can now build and use plugins in your iOS apps (🥳). Split your app up into separate, tightly-restricted sandboxes to process user-generated content or do anything potentially crashy that you don't want bringing down your app. And they can be shared between apps, too

https://github.com/KhaosT/UIExtensionExample

Old Voight-Kampff test: "Tell me about your mother."

Improved Voight-Kampff test: "Say a swear word, any swear word."

That'll catch AI nearly every time.

The biggest part of this so far has been that basically every other language I've learned since I learned C has let me basically write C in that language and Rust is just telling me to fuck off with that shit and I do admire that it's a language that has strong internalised boundaries

Did you know that new #Emoji can be proposed by anyone, simply by following some guidelines laid out by the #Unicode consortium? There's a time window each year where they accept proposals, and a select few might make it into future sets.

This year I turned one in: "Circuit Board", which I was surprised to find 1. didn't exist and 2. had not been proposed before (though CPU and Microchip have both been submitted and declined in the last 5 years)

You can read my proposal here:
https://storage.googleapis.com/greg-kennedy.com/Proposal%20for%20Emoji%20%E2%80%9CCircuit%20Board%E2%80%9D.pdf

and you can see the Unicode emoji proposal guidelines here:
https://www.unicode.org/emoji/proposals.html

Anyway, the odds aren't great of getting accepted, but if it IS then you can say "hey! I know the guy who submitted that one!"

Attached are the sample images I drew up for the proposal - which, incidentally, are now Public Domain as well. Enjoy!

OY MY FREAKIN GOD!!!
#Perifractic is the actual CEO of #Commodore! He really did it! This is awesome! 🤩

https://www.youtube.com/watch?v=ke-Ao-CpI7E

Wait… Who’s the New CEO of Commodore?! • Let's Buy Commodore Part 2

YouTube

me: the earth isn’t flat

fiat earther: correct

me: huh?

fiat earther: it’s the shape an italian car

me: what?

fiat earther: you read my name wrong didn’t you?

I swear all the fucking time... "oh this looks interesting" then you see its on substack... sorry, not sorry, but I'm absolutely not giving clicks to a site that proudly platforms nazis

Some random rambling about a Windows / AMD software bug:

Ever since I built my new PC, I always had the issue that sometimes at midnight, a blank "AMDAutoUpdate.exe" cmd window would open and do absolutely nothing. (See picture 1)

Googling it, I found a lot of people complaining about it. The exe is part of AMDs "Ryzen Master" utility that my motherboards "GCC" tool installed for me. The commonly accepted solution is to just disable the auto update service through the windows task scheduler. But that sounded too easy for me, tonight I actually went through the efforts of finding the root cause.

My first thought was: What is so broken about my hardware / setup that this random tool is just broken, it surely can't just be broken for everyone... right?

Right?....

Well... The tool in question is written in .net, this is very good because

A) .net is easy to decompile / reverse

B) I have written .net code a few years ago

So I went ahead and reversed what the tool does (or at least, what it is supposed to do).

The tool will attempt to download the file "VersionInfo.xml" from some URL that's stored within it's .exe.config file. Looking into that, hilariously enough there are two URLs, one being labeled "Production", the other being labeled "Develpment" (not a typo on my end), you can guess which of the two is commented out :P. However, this does not appear to be the issue, since both files appear to be the same in practice, let's dig deeper.

I noticed the downloaded file ends up being 0kb, so obviously something went wrong.

For downloading they use the "WebClient" class, they set a completion callback in which they call a different method to parse the file and display update option based on it's content. They also wrap the whole "WebClient" invocation into a try/except block, but since no error is being logged, it doesn't seem there is an exception happening. (See picture 2)

However, I noticed the callback is being fired with an object of the type "AsyncCompletedEventArgs" and looking at the documentation, this object has an "error" property that they unfortunately do not check for, nor log. Instead, if there is an error, the program will simply try to open the 0kb xml, fail and deadlock forever, with absolutely nothing being done in the background.

Using a .NET debugger, I was able to retrieve the error:

ERROR: The request was cancelled: A protected SSL/TLS channel could not be created

Long story short, it turns out that WebClient by default sends a TLS 1.0 request to the server and the server at some point was updated to only support TLS 1.2 and 1.3.

This also means, it is in fact, BROKEN FOR EVERYONE. IN PRODUCTION. FOR POSSIBLY YEARS...

Using a .net recompiler (man .net really has some fancy tooling...), I was able to add the line
ServicePointManager.SecurityProtocol = (SecurityProtocolType.Tls11 | SecurityProtocolType.Tls12);
which fixes the issue and I'm probably the first person in probably years to see the proper "update available" dialog (see picture 3), lmao.

So who's to blame here?
AMD? Microsoft?

I really don't know why this .net API doesn't try newer TLS versions if the older fail and instead requires an explicit flag to be set. On the other hand, AMDs tool is really shitty, doesn't do proper error checking and I would argue this cmd window should never open to begin with, which it wouldn't if they configured the task correctly.