Finding the Source: A tale of recreating fpipe and hiring overseas

Presented at Kernelcon 2022, April 1, 2022, 11:15 a.m. (20 minutes)

The tool fpipe was simple 10kB windows console application written by Robin Keir that could redirect network traffic from one port from one computer to another. You can find it's usage in many early hacker books. As a hacker, I find fpipe's beauty is truly in its simplicity, with fpipe you don't have to download a 5mB golang binary, you don't have to bring along a cygwin library for socat, you don't have to rely upon programming languages being on the host, there's no configuration, you just download this very small executable and run it from a command line. The fpipe program has been around since the early 2000's and it's source code never saw the light of day. Thanks to modern decompilers like ghidra the task of reverse engineering how it works has become a more manageable task. With pseudocode in hand I hired a team of developers around the world to rebuild what was lost. In this talk you will learn about cost, detailed interactions, and lessons learned. You will leave the talk with a better understanding of the freelance developer community and perhaps even the source code to fpipe.


Presenters:

  • Mike Kunz - Contrast Security
    Mike is a Senior Security Researcher for the Contrast Security Labs team. Prior to Contrast he worked 7 years for an FFRDC helping the government sector make more informed decisions. He is a past winner of the Kernelcon CTF and is an UNO alumni.

Similar Presentations: