Decompile to C 的工具

昨天在 Hacker News 上看到「Decompiler Explorer (dogbolt.org)」這篇,裡面列出了很多 Decompile to C 的工具 (就不用直接硬看 assembly),包括了 open source 與商用軟體:

網站本身則是提供界面可以交叉比較,不過各家的結果看起來還是有侷限...

Avast 與 Jumpshot 販賣使用者瀏覽記錄與行為

過了一陣子了,可以整理一下資料記錄起來...

報導可以看 PCMag 的「The Cost of Avast's Free Antivirus: Companies Can Spy on Your Clicks」與 Motherboard (VICE) 的「Leaked Documents Expose the Secretive Market for Your Web Browsing Data」這兩篇,大綱先把重點列出來了,Avast 在賣使用者的瀏覽記錄與行為:

Avast is harvesting users' browser histories on the pretext that the data has been 'de-identified,' thus protecting your privacy. But the data, which is being sold to third parties, can be linked back to people's real identities, exposing every click and search they've made.

Avast 利用免費的防毒軟體,蒐集使用者的瀏覽記錄與行為,然後透過 Jumpshot 這家子公司販賣出去:

The Avast division charged with selling the data is Jumpshot, a company subsidiary that's been offering access to user traffic from 100 million devices, including PCs and phones.

算是「免費的最貴」的標準型。另外比較有趣的是「資料賣給了誰」這件事情:

Who else might have access to Jumpshot's data remains unclear. The company's website says it's worked with other brands, including IBM, Microsoft, and Google. However, Microsoft said it has no current relationship with Jumpshot. IBM, on the other hand, has "no record" of being a client of either Avast or Jumpshot. Google did not respond to a request for comment.

Microsoft 說「現在沒有關係」,IBM 說「沒有 client 的記錄」,Google 則是不回應。

然後配合解釋資料長什麼樣子,以及可以怎麼用:

For instance, a single click can theoretically look like this:

Device ID: abc123x Date: 2019/12/01 Hour Minute Second: 12:03:05 Domain: Amazon.com Product: Apple iPad Pro 10.5 - 2017 Model - 256GB, Rose Gold Behavior: Add to Cart

At first glance, the click looks harmless. You can't pin it to an exact user. That is, unless you're Amazon.com, which could easily figure out which Amazon user bought an iPad Pro at 12:03:05 on Dec. 1, 2019. Suddenly, device ID: 123abcx is a known user. And whatever else Jumpshot has on 123abcx's activity—from other e-commerce purchases to Google searches—is no longer anonymous.

所以,如果 Google 手上有這個資料,就可以交叉比對自家的記錄,然後得到使用者完整的記錄。

在消息一公開後沒多久後,Avast 就宣佈關閉 Jumpshot,感覺連被抓包後的反應動作都超流暢,一臉就是排練過:「A message from Avast CEO Ondrej Vlcek」。

看了一下,Avast 旗下還有 AVG,還有個 VPN 服務...

透過 Avast 防毒軟體蒐集資料的 Jumpshot

看到「Less than Half of Google Searches Now Result in a Click」這篇,在說明 Google 的搜尋結果頁面內的行為大幅偏頗 Google 自家服務的問題,這個問題最近幾個禮拜開始紅了起來...

但另外一點值得注意的是裡面提到 Jumpshot 這個服務可以分析使用者的頁面以及行為這件事情...

在 2013 年 Avast 買下 Jumpshot:「AVAST Software Acquires Jumpshot to Work Magic Against Slow PC Performance」,當時的目標是效能:

Having served as PC tech consultants to their friends and family, their goal was to build a product to help less tech-savvy PC users optimize and tune up their PC performance, cleaning it from unpleasant toolbars and junk software.

但在 2015 年的時候就可以看到 Avast 在他們自家的論壇上有說明,Avast 會收資料丟進 Jumpshot:「Avast and Jumpshot」。

These aggregated results are the only thing that Avast makes available to Jumpshot customers and end users.

而藉由這些資料而提供服務。

IDA 免費版

Update:被 comment 提醒,找了一下資料,看起來有段歷史了,所以說 RetDec 的影響就未必是這樣了。下面的文章內容就不修正了...:「IDA Support: Evaluation Version」。

IDA 居然也提供免費版了,雖然是比較舊的版本,而且不提供技術支援:「IDA Support: Freeware Version」。IDA 是個可以反組譯以及當 debugger 的工具:

IDA is a Windows, Linux or Mac OS X hosted multi-processor disassembler and debugger that offers so many features it is hard to describe them all. Just grab an evaluation version if you want a test drive.

我猜是 Avast 放出 MIT 授權版本的 RetDec 的關係 (參考「Avast 放出他們的 Decompiler,RetDec」這篇),導致 IDA 這邊要做一些動作推廣試用...

不過我覺得有了 open source 的工具後,會看到 open source 工具慢慢成長...

Avast 放出他們的 Decompiler,RetDec

AvastMIT License 放出他們的 Decompiler,叫做 RetDec:「Avast open-sources its machine-code decompiler」,專案在 GitHub 上的 avast-tl/retdec 這邊。

Decompiler,也就是直接把 machine code 試著轉回高階語言的程式碼:

這對於分析工作來說簡化很多,尤其是在資安產業的人... 以往比較常見是轉成 assembly 再用人工分析,現在這樣有機會讓大腦輕鬆一些。

雖然目前有些限制 (像是 32 bits only),不過 open source 出來後,可以預料會有不少人開始加功能進去:

  • Supported file formats: ELF, PE, Mach-O, COFF, AR (archive), Intel HEX, and raw machine code.
  • Supported architectures (32b only): Intel x86, ARM, MIPS, PIC32, and PowerPC.

Avast 買 AVG

AvastAVG,這兩家都不小:「Avast acquires rival AVG for $1.3 billion to create a security software giant」。

文章開頭提到的交易的形式與金額:

Security software giant Avast Software has acquired rival AVG Technologies. Avast will pay $25 cash for each of AVG’s outstanding ordinary shares in a deal amounting to around $1.3 billion.

兩家也都放了新聞稿:

avast 的人從網路上買了二十台智慧型手機...

然後從裡面拉出四萬張照片:「Tens of thousands of Americans sell themselves online every day」。

We purchased 20 used Android phones off eBay and used simple and easily available recovery software to restore deleted files.

雖然文章是在推銷 avastAndroid 清除軟體,但還是顯示出一般人對資安上的熟悉度不足。