3 ms·

[video] Four fake filesystems\! by Omar Rizwan (\!\!Con 2018)

2 points by yesenadam 7y ago

yesenadam 7y ago
I was reading about WikipediaFS, couldn't find mention of it on HN, and remembered it was mentioned in this talk, alongside other similar cool things. What are some other ideas using system features for unintended purposes? Using our familiarity with one domain in another, in a surprising way? I guess a lot of computer UI things are real-world metaphors, like windows, files, buttons etc, but these are metaphors between two computer domains, like a folder representing a youtube search, or a text file representing a wikipedia page etc. p.s. Can't put exclamation marks in HN titles? They're removed automatically.
ksaj 7y ago
There is a very fine line between file system and any old tree structure or database (which could arguably also be a file system, depending only on the agent implementation), so it's great that the video gives a Unixy understanding of what a file is. In that sense, many of the infosec "hacker" scanners, you can traverse the results in the same way as you would a file system-- sometimes like a web-based file system, and sometimes a CLI-- allowing you file-like access to either the affected file/service/etc or a file containing the analysis info for that particular file/service/etc. These usually contain separate files in the same virtual directories (eg: a link to the port/service, a text capture of the connect header, a text explaining the associated vulnerability, etc), that exist nowhere together outside of the application's logical structure. This also goes for a lot of the traffic capturing or editing proxies. Look at Wireshark, for example. If you think of the initial capture as a virtual file system, and everything captured as files, then the magical result you get by "follow stream" (which essentially re-assembles a file that was split into several network fragments) makes full sense. You can of course simply copy that followed stream to your local FS, completing the filesystem-like behaviour. Another example is the Linux loop driver. It isn't specifically, but can be used for creating "fake" file systems. It's usual purpose is to mount encrypted file system images, so it can be argued that the unencrypted file system only effectively exists in memory and gets physically populated only as required, in the same manner as gitfs and ytfs. And then that reminds me of a really common example: zip utils, and everything that uses them. For example, Midnight Commander (mc), and many other file managers. You can click on a zip file, and traverse it like a file system, even though that file system is only virtual and lives only in the application's memory space and whatever OS handling is needed to facilitate the filesystem-like access. An Aside: I very much prefer the term "virtual file system" over "fake." The reason is, even with the given examples in the video, at least 2 of them are based on actual file systems, and their corresponding agent is acting more as a direct proxy between them. Youtube is a directory structure of files retrieved by html queries. Github is exactly the same in that regard, except that the file system hierarchy is more transparent. So those aren't fake, but to your mount point, they are virtual. By referring to all of these FS drivers as "fake" you end up including all remote file system accesses (including SMB and every website ever) as fakes when they clearly aren't.

2 points by yesenadam 7y ago

I was reading about WikipediaFS, couldn't find mention of it on HN, and remembered it was mentioned in this talk, alongside other similar cool things. What are some other ideas using system features for unintended purposes? Using our familiarity with one domain in another, in a surprising way? I guess a lot of computer UI things are real-world metaphors, like windows, files, buttons etc, but these are metaphors between two computer domains, like a folder representing a youtube search, or a text file representing a wikipedia page etc. p.s. Can't put exclamation marks in HN titles? They're removed automatically.

ksaj 7y ago

There is a very fine line between file system and any old tree structure or database (which could arguably also be a file system, depending only on the agent implementation), so it's great that the video gives a Unixy understanding of what a file is. In that sense, many of the infosec "hacker" scanners, you can traverse the results in the same way as you would a file system-- sometimes like a web-based file system, and sometimes a CLI-- allowing you file-like access to either the affected file/service/etc or a file containing the analysis info for that particular file/service/etc. These usually contain separate files in the same virtual directories (eg: a link to the port/service, a text capture of the connect header, a text explaining the associated vulnerability, etc), that exist nowhere together outside of the application's logical structure. This also goes for a lot of the traffic capturing or editing proxies. Look at Wireshark, for example. If you think of the initial capture as a virtual file system, and everything captured as files, then the magical result you get by "follow stream" (which essentially re-assembles a file that was split into several network fragments) makes full sense. You can of course simply copy that followed stream to your local FS, completing the filesystem-like behaviour. Another example is the Linux loop driver. It isn't specifically, but can be used for creating "fake" file systems. It's usual purpose is to mount encrypted file system images, so it can be argued that the unencrypted file system only effectively exists in memory and gets physically populated only as required, in the same manner as gitfs and ytfs. And then that reminds me of a really common example: zip utils, and everything that uses them. For example, Midnight Commander (mc), and many other file managers. You can click on a zip file, and traverse it like a file system, even though that file system is only virtual and lives only in the application's memory space and whatever OS handling is needed to facilitate the filesystem-like access. An Aside: I very much prefer the term "virtual file system" over "fake." The reason is, even with the given examples in the video, at least 2 of them are based on actual file systems, and their corresponding agent is acting more as a direct proxy between them. Youtube is a directory structure of files retrieved by html queries. Github is exactly the same in that regard, except that the file system hierarchy is more transparent. So those aren't fake, but to your mount point, they are virtual. By referring to all of these FS drivers as "fake" you end up including all remote file system accesses (including SMB and every website ever) as fakes when they clearly aren't.