tmp.0ut

                                                           ┌───────────────────────┐
                                                           ▄▄▄▄▄ ▄▄▄▄▄ ▄▄▄▄▄       │
                                                           │ █   █ █ █ █   █       │
                                                           │ █   █ █ █ █▀▀▀▀       │
                                                           │ █   █   █ █     ▄     │
                                                           │                 ▄▄▄▄▄ │
                                                           │                 █   █ │
                                                           │                 █   █ │
                                                           │                 █▄▄▄█ │
                                                           │                 ▄   ▄ │
                                                           │                 █   █ │
                                                           │                 █   █ │
                                                           │                 █▄▄▄█ │
                                                           │                 ▄▄▄▄▄ │
                                                           │                   █   │
    Interview: herm1t                                      │                   █   │
    ~ tmp.0ut Staff                                        └───────────────────█ ──┘

    t0:
      Talk to us about the evolution of Linux vx over the years - what was it like
      when there wasn't the wealth of documentation there is today, what discoveries
      in this area inspired you, and where do you see it going?

    herm1t:
      The articles by Silvio Cesare and grugq helped a lot, as well as Tracy Reed's
      mailing list. There were also a few encounters with Bliss and some other early
      viruses on production systems I was working at. As for documentation, I share
      the early OSS attitude "read the source, Luke", it's the best kind of
      documentation. Though the hacking scene of 90s and early 2000s captured my
      imagination I was shy and thought that nobody is interested in my little hobby
      and am was slowly progressing through technicalities until counterintelligence
      and police knocked at my door.

    t0:
      Were you in undernet #vir / #virus in the late 90's ?

    herm1t:
      I tried :-) But with my lousy language skills and being unable to explain why
      am I here, I got quickly banned from chans, just to return and quietly listen
      and being bored by endless and unrelated chit-chats.

    t0:
      Tell us about the evolution of your own ELF vx writing - what techniques did
      you use first, what did you do next, what was the hardest technique you did?
      or the one you are most proud of?

    herm1t:
      The most significant thing I learnt that you don't need assembly to get the
      things right (But you should learn asm anyway). As real-coderz-use-asm dude
      I reproduced Silvio's segment thing in asm and continued in the same way for
      years until I realized that low-level stuff is unnecessary. One can easily
      inject the code filelessly from memory, find imports and all such stuff
      without even bother about insns length and such, that makes a life much better
      :-)

    t0:
      Which methods of infections do you prefer, and which techniques do you like
      more? How you think, what we can expect in the future?

    herm1t:
      Classical file viruses are long time dead. And there are a lot of modern
      malware that exploits two glaring security holes in unix systems (LD_PRELOAD
      and ptrace), though, with ptrace restricted and possibility that LD_PRELOAD
      will be shut down as well, the old time infection techniques could be re-used
      again, eg by replacing libz.so in sshd by some lib-boring-something or adding
      a snippet to the binary :-) It's a shame that sshd backdors (like in ESET's
      "Darkside") or something like Darkleech still needs to be recompiled on target
      system. It seems that blackhats has missed their classes and trying to
      reinvent the wheel.

    t0:
      Do you think ELF virus writing has a future ? Are we staying in the past ?

    herm1t:
      With Linux in every phone, in IOTs and desktops I am sure that the arts of ELF
      infection and system's internals will be popular again.

    t0:
      Have you seen the new CET / -fcf-protection that is implemented on 95% of
      binaries in Ubuntu 20.04? Do you have thoughts on this, or have you messed
      around with it yet?

    herm1t:
      I am not familiar with CET yet, but there is a story I can tell you. Once I
      was after some guy and was I lacked (to complete the security check up) was
      his phone number. I tried to OSINT but to no avail. Then I just mailed him
      from some phony account and wrote "mail me your phone, ASAP" and what do you
      think? he did. One cannot guarantee security by pure technical means. there
      will be always a loophole.

    t0:
      What do you think about modern malware?

    herm1t:
      Most of the time it's extremely boring (but still effective)

    t0:
      Do you think the VX scene still has a chance? With everything that happened
      during more recent times, malware focused on monetization, etc. What happened
      with VXHeavens? Plans for the future? In which ways do you think malware
      writing has changed since the last decade?

    herm1t:
      The scene as we knew it is dead (I discussed it with LovinGod recently and he
      called VXH a "coffin of a scene"), but there could be a wider community, since
      both virus writing and hacking in general became more actual than ever. Back
      in 2018 I spotted the webshell (installed by anyone but me) on ministry of
      justice of ukraine and made some lulz on them on facebook. cyberpolice took it
      seriously and they decided to raid the messenger. i knew about the raid in
      advance and shout down the site (cause sharing of viruses in Ukraine is
      illegal in any form), may be I will restore it in some form again. With court
      hearing on "Greta case" four days ahead I find it hard to set a date :-)

      btw, with all these endbr64 stuff in .plt and elsewhere, if you modify the
      binary it will "protect" your virus from "unauthorized" rets :-)

    t0:
      Talk to us about your own linux viruses - Casher, Cavity, Pulpit, other?

    herm1t:
      Most of my viruses were focused on tricks with the ELF format, I just opened
      some random executable and looked through the sections with a few questions in
      mind - could it be moved or shrinked to make some space? could you get control
      from it to avoid touching entry point? So the viruses does exactly just that,
      "Coin" got more space from segment alignment requirements, "Caveat" put loader
      in PHT, "Arches" used functions padding, "Hasher" played with .hash, "PiLoT"
      with .plt; more recent ones is about stop using assembly, stop DOS-like
      patterns of using syscalls directly and switch to imports from libc which is
      always present in memory and go deeper to self-relocation (RELx) and
      metamorphism (Lacrimae). Since that time I am still interested in glibc/kernel
      internals at it helped me a lot with system programming and security (which I
      am doing for a living)

    t0:
      What do you think about metamorphism in script languages ? I'm thinking about
      "Metamorphism and Self-Compilation in JavaScript" written by SPTH

    herm1t:
      Getting back to technical stuff, you probably knew that I am a big fan of
      compilers related stuff and I am dead sure that stuff like DSL and compilers
      are the next big thing after metamorphism, being it scripts (which is less
      complicated) or machine code.

    t0:
      how did you learn these other skills - the social engineering - does it come
      naturally to you or did you study psychology, or read about social engineering
      others did?

    herm1t:
      Any large bureaucracy has inherent weaknesses, it's the system and it can be
      hacked, if you knew how legitimate request looks like you could forge it, by
      using interagency rivalry you could left them no choice but to proceed. Having
      access to hacked mails you can get virtually into the head of the target and
      manipulate person into doing something you need. I more like the process, that
      very moment when you find your way around the security. But the "message"
      phase, when you put the dumped info online and tip of the press is the same.
      You need to deliver your message both to the targets to make them sorrow and
      wide audience, to convince people that that was right thing to do, so it a bit
      like hacking but with people instead of machines.

    t0:
      What do you think about CTFs and other hacking competitions ?

    herm1t:
      I don't like CTFs cause I hate time pressure. I know how to do things quick
      and stay calm, but it ticks me off when I see clocks ticking.

    t0:
      Have you damaged your own system testing a virus? If yes can you talk a bit
      about the case?

    herm1t:
      Since none of my viruses has destructive payloads and usually they were
      intentionally limited to current directory it was safe to test them. May be
      one or two times they escape but it is easy to reinstall affected packages.

    t0:
      What would your dream virii look be like?

    herm1t:
      Complexity, irregularity. More complex, more better.

    t0:
      What other places outside technology do you look to get inspiration from?

    herm1t:
      It's hard for me to find something outside technology, surely I do usual
      things all the people do, but my favorites are math, cryptography and messing
      in politics.

    t0:
      Can you share some thoughts on ransomeware?

    herm1t:
      Ransomware is old as our field are. The AIDS trojan was written in 1989! Wide
      use of cryptocurrency and its less traceable nature made the proliferation of
      ransomware inevitable. From technical point of view it's boring (except for
      hilarious mistakes in cryptography some authors did, like generating the key
      by RNG seeded with time(NULL), and after public humiliation replacing it by
      something like md5(time(NULL))

    t0:
      This is your free space, herm1t. Here you can leave anything you want: greets
      or wishes for friends or someone else, etc.

    herm1t:
      Greetz to all hackers and vxers of past and future :)