The Withering Frost

Reviewing on legitimacy of some ICE tracking apps lingering after crackdown. (OWASP Saitama MTG #30, talk #1)

Transcript

1. THE WITHERING FROST 2.16.2026 OWASP SAITAMA MTG #30, TALK #1 “frost” by M.Gustave, CC BY-NC 2.0
2. TEXT SESSION FLAGS ▸ ࿥ըɾ࿥Իɾެ։: OK "Gay Traffic Lights" by Nico Kaiser, CC BY 2.0
3. TEXT BACKGROUND ▸ ICEʹΑΔ๫ߦɾҧ๏ݕڍ͕ԣߦ ·͞ʹݱ୅ͷήγϡλϙͱԽ͍ͯ͠Δ ▸ ICEͷ໨ܸ৘ใΛަ׵͢ΔΞϓϦ͕͕͋ͬͨ… DOJͷѹྗΛड͚Apple/Google͕ఫڈ →ICEBlock / Red Dots / DEICER / Eyes Up etc. ▸ ͜ΕΒ͸ετΞ͔Βఫڈ͞Ε͚ͨͩ →ಈ࡞͢ΔͷͰೖ͍ͬͯΔͳΒൈ͔ͳ͍͜ͱ ʢ˞ICEBlockͳͲʹ͓͚Δެࣜ௨ୡʣ “01/08/26 ICE Protest, Newark, NJ” by John Flores, CC BY-SA 4.0
4. TEXT BACKGROUND ▸ ઐ༻ΞϓϦͰల։͍ͯ͠Δ΋ͷ͕·ͩ͋Δ (2/7; Play Store) ▸ ِΞϓϦͳՄೳੑ͸ͳ͍ͷ͔ →ݕূͩ… “Blue Static” by get directly down, CC BY 2.0
5. TEXT WHO I AM ▸ Takahiro Yoshimura (@alterakey) https://orcid.org/0009-0005-4826-3832 ▸ Monolith Works Inc. Co-founder, CTO Security researcher
6. TEXT WHAT I DO ▸ Security research and development ▸ iOS/Android Apps →Financial, Games, IoT related, etc. (>200) →trueseeing: Non-decompiling Android Application Vulnerability Scanner [2017] ▸ Windows/Mac/Web/HTML5 Apps →POS, RAD tools etc. ▸ Network/Web penetration testing →PCI-DSS etc. ▸ Search engine reconnaissance (aka. Google Hacking) ▸ Whitebox testing ▸ Forensic analysis
7. TEXT WHAT I DO ▸ CTF ▸ Enemy10, Sutegoma2 ▸ METI CTFCJ 2012 Qual.: Won ▸ METI CTFCJ 2012: 3rd ▸ DEF CON 21 CTF: 6th ▸ DEF CON 22 OpenCTF: 4th ▸ ൃදɾߨԋͳͲ DEF CON 25 Demo Labs (2017) DEF CON 27 AI Village (2019) CODE BLUE (2017, 2019) CYDEF (2020) etc. “DEFCON 2016” by Wiyre Media, CC BY 2.0
8. TEXT SHARE ON THE EXISTING SNS? ▸ طଘͷϓϥοτϑΥʔϜͰ͸ ▸ ICEͷ໨ܸ৘ใ͸࡟আ͞ΕΔ͔౤ߘͰ͖ͳ͍ (metaܥ: facebook, instagram, threads, ...) ▸ TikTokͰ΋ಉ༷: ൓τϥϯϓ/൓ICEతͳ౤ߘ͕Ͱ͖ ͳ͍ͱͷ؍ଌ͕͋Δ (e.g. "Epstein"...) [1] →ઌ೔TikTokΛถࠃͰӡ༻͢ΔݖརΛ͓ങ্͍͛ ʹͳ͓ͬͯΓ·͢ͷͰ… ▸ [1] https://www.independent.co.uk/tech/tiktok- epstein-trump-censorship-ice-b2908309.html “Smartphone videoing” by Magnus Franklin, CC BY-NC 2.0
9. TEXT SHARE ON THE SERVICES ▸ ઐ༻௥੻αʔϏεཱ͕͖͍ͬͯͯΔ (Web) → ͔͜͜ΒదٓBlueskyͳͲͰשىͱ͍͏ྲྀΕ ▸ ICEOUT Map ▸ ICE Tracker (PWA) ▸ DEICER ▸ ICE watcher ͳͲ ▸ Ґஔ৘ใΛ౉͓͚ͯ͠͹ϦΞϧλΠϜ௨஌͕དྷΔ Α͏ͳ΋ͷ΋͋Δ
10. TEXT .. ▸ ҰํͰѪࠃతhacktivistͷଘࡏ΋ ▸ stopice: ৵ೖΛड͚100,000Ҏ্ͷϢʔβ৘ ใ͕FBI/ICE΁ྲྀग़ ▸ DEICER: ΞϓϦར༻ऀʹର͠ڴഭจͷ഑৴͕ ߦͳΘΕΔ(※) ▸ ※௨஌αʔϏε΁৵ೖ͞Ε͚ͨͩͱͷ͜ͱ; ·ͨ ݱࡏͰ͸ΞϓϦ͸ఫڈ͞Ε͍ͯΔ
11. TEXT THE TARGET ▸ ࠓճͷର৅͸Ͳ͜ʹ΋ଐ͞ͳ͍ ▸ ։ൃݩ΋ถࠃ಺Ͱ͸ͳ͍…ʁ ▸ ͲͷαʔϏεΛར༻͍ͯ͠Δʁ ▸ Ͳ͜ʹ৘ใΛू໿͍ͯ͠Δʁ ▸ ӡӦ฼ମ͸ʁ “People behind the Mask! Who are all these People?” by Günter Hentschel, CC BY-ND 2.0
12. TEXT TOOLCHAINS ▸ πʔϧνΣΠϯ ▸ Trueseeing: Non-decompiling iOS/Android app vulnerability scanner (alterakey et al.) ▸ Ghidra: Multi-arch Disassembler (NSA) “Brompton Toolkit - Open” by Diane A Banana, CC BY 2.0
13. TEXT REVERSING MISSING APP? ▸ ੩తղੳ ▸ libapp.so/lib fl utter.so: Flutterͷհࡏࣔࠦ ▸ ଞʹ͸͋·Γ໘ന͍ൃݟ͸ͳ͍ “#190a” by Yasmeen, CC BY-NC-ND 2.0
14. TEXT WHAT'S FLUTTER ▸ Flutterͱ͸ʁ ▸ Google͕։ൃͨ͠UI SDK ▸ Ϩϯμϥ͔Βࣗ਎Ͱ੍ޚ͢ΔͨΊग़ྗͷ౷੍͕ ͠΍͍͢ͱ͞ΕΔɺ͕… ▸ ϓϥοτϑΥʔϜ͝ͱந৅Խ͞ΕΔ͜ͱʹ஫ҙ →ͪΐ͏ͲUnity EngineΛݟΔΑ͏ͩ ▸ Android͸DartVM, iOS͸native code…
15. TEXT FLOWLESS BLOB ▸ ͕ͩDartVMͷόΠφϦ͸ͨͩͷϝϞϦΠϝʔδ →ߏ଄͕ଘࡏ͠ͳ͍ … ▸ ͳΜͰ͜Μͳ͜ͱΛ͍ͯ͠Δ͔ͱࢥ͑͹ىಈͷ ૉૣ͞ͱͷ͜ͱ ▸ ·͋…෼͔Βͳ͘͸ͳ͍͕͜Ε͸ →Play Protect΋ݟ͍͑ͯͳ͍Μ͡Όͳ͍͔ʁ →VMͩ͠ϝϞϦΠϝʔδͩ͠
16. TEXT DEDUCE THE WORLD ▸ ͜͏͍͏΋ͷΛղੳ͢Δํ๏ͱͯ֓͠Ͷ: ▸ DartVMͷόʔδϣϯΛϔομ͔Βਫ਼ີʹಛఆ ͠ɺVMΛߏஙɺΠϝʔδΛಡΈࠐ·ͤͨޙ introspectతʹ৘ใΛൈ͖औΓ࠶ߏங… ΋͘͠͸ ▸ lib fl utter͝ͱపఈతʹinstrument͠ɺ·Δ͝ͱى ಈͨ͠ࡍʹग़ͯ͘Δ৘ใΛฉ͖औΓ࠶ߏங ▸ ABI͕platformʹର͠constantͰ͋Δ͜ͱΛexploit (※iOS͚ͩ͸ผ) “2014.08.26 500pcs Hawksbill Sea Turtle (11)” by Grace Hwu, CC BY-NC 2.0
17. TEXT BLUTTER ▸ πʔϧνΣΠϯ ▸ Blutter: Flutter Mobile Application Reverse Engineering Tool (Worawit Wangwarunyoo et al.) ▸ લऀͷํ๏Λ΍ͬͯ͘ΕΔ΋ͷ… ▸ DartVMόʔδϣϯಛఆɾVMϥΠϒϥϦߏங ▸ ΠϝʔδͷಡΈऔΓ ▸ Ϋϥε৘ใͷҾ͖ग़͠ɾٯΞηϯϒϧ
18. TEXT BLUTTER ▸ πʔϧνΣΠϯ ▸ Blutter: Flutter Mobile Application Reverse Engineering Tool (Worawit Wangwarunyoo et al.) ▸ ࣮ߦʹ͸libapp.so ͱ lib fl utter.so ͷ2఺͕ඞ ཁ
19. TEXT EXTRACT THE NEEDED ▸ ੩తղੳ ▸ libapp.so/lib fl utter.so: Flutterͷհࡏࣔࠦ ▸ ͜Ε͚ͩఠग़ͯ͠blutter΁… trueseeing .. -qc 'aa;co .*lib.*so$ app' → */lib/*.so Λ app ҎԼʹఠग़ “Extracting DNA” by Jose Kevo, CC BY-SA 2.0
20. TEXT YOU'VE GOT B(L)UTTER IN CONTAINER? ▸ blutterͷ४උ͸ͳ͔ͳ͔େมͳͷͰίϯςφʹ ด͡ࠐΜͰ͠·͑ ▸ trixieΛ࢖ͬͯ… ͜Μͳײ͡ʹɻ FROM debian:trixie-slim RUN apt-get -y update && env DEBIAN_FRONTEND=noninteractive apt-get -y install python3-pyelftools python3-requests git cmake ninja-build build- essential pkg-con fi g libicu-dev libcapstone-dev ADD . /app RUN mkdir /out WORKDIR /out ENTRYPOINT ["python3", "/app/blutter.py"] ▸ ——— https://gist.github.com/alterakey/fc948321f6be750ecc14e63b081e1409 “Off to Bricks By the Bay!” by enigmabadger, CC BY-NC-ND 2.0
21. TEXT REVERSED ▸ done. ▸ docker run --rm -v $(pwd):/out blutter app disas ▸ disasҎԼʹϑΝΠϧ͕ੜ੒͞ΕΔ ▸ asm: DartVMΫϥεʹର͢ΔٯΞηϯϒϧ݁Ռ (※roundtrip͸Ͱ͖ͳ͍͜ͱʹ஫ҙ) pp.txt: constant pool objs.txt: object map blutter_frida.js: callΛϩά͢Δfrida script ida_script: IDAʹର͢Δղੳิॿ
22. TEXT FINDINGS ▸ ؍ଌ ▸ ೉ಡԽ͋Γ ▸ OpenStreetMapΛ࢖༻͍ͯ͠Δ ▸ NostrͰྲྀ͍ͯ͠Δ ▸ relay͸େखͷ3ͭ ▸ ׬શʹanonymous ʢΞϓϦΛॳճىಈͨ͠ࡍʹidΛ࡞੒ʣ ▸ ͋Δఔ౓ؤ݈ͳؾ͸͢Δ “Temple Colours in the Rain” by Piktour | Neville Wootton, CC BY 2.0
23. TEXT WHAT'S NOSTR? ▸ ෼ࢄܕϦΞϧλΠϜ௨৴ϓϥοτϑΥʔϜ ▸ User͸ΩʔϖΞͷΈΛ࣋ͪ ▸ MessageΛॺ໊ ▸ Relay͕ͦΕΛதܧ͢Δͱ͍͏ܗ ▸ Messageͷղऍ͸ΞϓϦ࣍ୈ →ͳΜͰ΋ૹΕΔ ▸ جຊతʹ͸JSON on WebSocketͳϓϩτίϧ
24. TEXT FINDINGS ▸ ؍ଌ ▸ UIϨΠϠʔΛ֎෦αΠτʹґଘ ▸ ࣗ͜͜ମ͸ΞΠεϥϯυͷاۀ͕͍࣋ͬͯ ΔΑ͏ͩ… ҰԠsovereignityతʹ͸… ▸ ͕ͨͩ͜͜։ൃݩͳͷ͔ʁҧ͏Α͏ͳ → ๭FLOSSΛ΋ͱʹ࡞ͬͨՄೳੑͷࣔࠦ ▸ SideloadingͰ΋഑৴͍ͯ͠Δͱ͋Δ “Blue Static” by get directly down, CC BY 2.0
25. TEXT FINDINGS ▸ ؍ଌ ▸ ಛʹѱҙ͸ײ͡ΒΕͳ͍͕ɺग़ॴ͸Ṗ “Sorting out” by Linda Hartley, CC BY 2.0
26. TEXT ATTACK SURFACES ▸ ※ެ։ʹ൐ͳ͍লུ “Looking menacing and careful...” by Tambako The Jaguar, CC BY-ND 2.0
27. TEXT TAKEAWAYS ▸ ੓ݖͷ๫ڍͱک͑Δॅຽͷࣗॿ౒ྗ ▸ Apple/Google͕ѹྗʹ۶͠ΞϓϦΛఫڈ →࢖͑ΔͷͰফ͢ͳͱݴ͍ͬͯΔ →WebαʔϏε+BlueskyͳͲͰ᭩Λ࡟͍ͬͯΔ ʢ˞metaܥ/TikTokͳͲͰ͸ॻ͚ͳ͍; XͰ͸…ʣ ▸ ݱঢ়ग़ճ͍ͬͯΔΞϓϦʹ͍ͭͯҰͭͷྑ৺Λݟ ͨ…ग़ॴ͸͍ͩͿո͍͕͠ɻ (2/7) →NostrʹΑΔؤ݈ԽɺsideloadingରԠ… “01/08/26 ICE Protest, Newark, NJ” by John Flores, CC BY-SA 4.0
28. TEXT TAKEAWAYS ▸ Flutter͸ϓϥοτϑΥʔϜ͝ͱந৅Խͯ͠͠·͏ ▸ Πϝʔδͷղੳ͸೉͍͠…͕ํ๏͸͋Δ ▸ ΋͔ͯ͠͠: Google Play Protect͸Flutterͷத· Ͱ͸े෼ʹݟΒΕ͍ͯͳ͍Մೳੑɻ
29. A FEW MORE THINGS.. Image by Chris Pirillo, CC BY-NC-ND 2.0
30. TEXT NOSTR AND BITCOIN? ▸ ౰ॳ͸ؔ܎͍ͯͨ͠Β͍͠ ▸ ͔͠͠ݱࡏͰ͸୯ʹ࢖͍ͬͯΔٕज़͕ࣅ͍ͯΔ/ ௌऺ͕͍ۙͱ͍͏͚ͩ… e.g. keypairͷੜ੒Ͱ secp256k1 ͱ͔ ▸ zap (౤͛મ) ͸͋͘·Ͱ΋ΫϥΠΞϯτͷػೳ nostrͷඞਢ࣮૷Ͱ͸ͳ͍ ▸ ಛʹ: blockchainʹه࿥͍ͯ͠ΔΘ͚Ͱ͸ͳ͍
31. TEXT ABOUT REVERSING FLUTTER ▸ ࠓճblutterͰ΍͕ͬͨ… ▸ ޙऀͷํ๏ʹ͍ۙ΋ͷʹreFlutter͕͋Δ →ͲͪΒʹͤΑDartVMͷมભ͕ૣ͍ͷͰ࠷৽Λ࢖͏ ▸ reFlutter + GhidraͰղੳ͢Δྫ https://github.com/Neoxs/reverse_ fl utter ▸ blutter + Ghidra͸… ·ͩͳ͍ɻ →࣮ࡍʹಈ͔ͤΔʴվ᜵ݕ஌తͳ΋ͷ͕ͳ͍Α͏ͳ ෺ͩͬͨΒreFlutterΛ࢖ͬͨํ͕ྑ͍Մೳੑ
32. STAY SAFE! Image by KaCey97078, CC BY-NC 2.0
33. FIN. 2.16.2026 TAKAHIRO YOSHIMURA (@ALTERAKEY) “Frost” by Wild Spirit Wolf Sanctuary, CC BY-NC-ND 2.0