Episode Eight of Mr. Robotic’s ultimate season was intense. We mentioned zip ties, cellphone restoring, location trackers, mixers, Elliot’s sloppy Python script, and the ultimate hack [SPOILERS, obvs]. (The chat transcript has been edited for brevity, readability, and chronology.)
This week’s workforce of consultants contains:
Yael: I need to begin out by saying that I agree Momofuku is nice.
Micah: Within the very first scene, in 1995, when younger Elliot is taking part in hide-and-seek and hiding one thing within the Queens Museum, I assumed it was cool that he was operating previous all this retro laptop tools from 1995.
Trammell: Attending to the Queens Museum from 2nd avenue is a protracted haul on the F to the 7. And is not Krista’s place someplace in higher Manhattan?
Yael: In the course of the cab trip, I could not imagine they have been nonetheless exhibiting movies of Tyrell after he is lifeless. However I assume I can not say I am shocked in the event that they put some huge cash into producing it. I imply, it IS Evil Corp. Additionally, shoutout to Krista. She bought KIDNAPPED and KILLED somebody and was nonetheless counseling Elliot in any case that. Speak about emotional labor. (Or do not, lol, Twitter is a large number.)
Micah: Yeah, Krista is sort of the badass. I additionally appreciated that after they bought to the police station and Elliot was like, “I can not go in there with you,” she was completely tremendous with it.
Dom and Darlene’s Kidnapping
Yael: So the Darlene/Dom kidnapping scene jogged my memory of a dialog we had in a earlier chat about duress, and how one can program stuff to lock you out, but when somebody’s gonna begin offing individuals, possibly you do not need to. Additionally, how do you get out of zip ties?
Harlo: A few week in the past, I did this kidnapping simulation, which was really fairly harrowing. Earlier than you go into the state of affairs, they attempt to put together you by educating you the right way to get out of zip ties, handcuffs, and duct tape. Transient detour: zip ties are enjoyable. When you can undoubtedly simply bust them by bringing them down with sufficient drive onto your hip bone, extra substantial ones require a protracted sufficient shoelace, which you loop by the cuffs, tether to your toes, then flop over and pedal such as you’re on a recumbent bike to slice by the plastic. Tremendous enjoyable. Nice parlor trick. However after I did the sim, it was tough to really feel assured and protected sufficient—and unsurveilled sufficient—to try the escape, even for those who knew the right way to do it.
Yael: Timing is absolutely vital. I feel Dom had the sustained coaching and doubtless expertise to essentially use it to her benefit, in a approach civilians most likely do not.
Harlo: Additionally, kidnapping sims that you just do after in the future of coaching DO NOT ever deliver within the “cuntstick” with a baggie full of various torture knives. That may completely dampen your spirit so far as escape is worried.
Micah: I simply wanna say that Dom is a fucking badass.
Harlo: Yeah, she fucking nailed it.
Micah: Pulling the knife out of your chest and stabbing another person with it, then taking pictures your captors.
Yael: That was superior. It was cool that Dom had a plan, too. I used to be fairly dissatisfied that she did not earlier than. And now the license plate factor is sensible whereas earlier than I used to be like, in fact Darkish Military is surveilling you; they personal you.
Harlo: I’ve a nitpick. Within the scene the place Janice calls her bang-bang-bois over Sign. Did not Sign on the time NOT play the common cellphone ringing tone? As an alternative, it was this kinda cool radar sound? It used to have this wonderful submarine radar sound. Additionally, Dom and Irish bastard are usually not utilizing Sign. They have been utilizing regular-ass cellphone. However whatevs. I really feel like a fucking strolling advert for Sign these days. I should be completely unbearable.
Yael: I heard one thing just lately about how Sign wasn’t safe for individuals in China who use an Android keyboard.
Harlo: It is as a result of typically your keyboard is a snitch. It isn’t a Sign downside per se, however by default, you would possibly end up typing secrets and techniques into Sign which are captured by your keyboard, after which, something goes.
Yael: Effectively, possibly Sign should not enable exterior keyboards, or not have them on by default, hmm…
Harlo: In settings: there may be “incognito keyboard,” and if that is in your menace mannequin, flip it on.
Yael: Do you suppose Darlene giving up her brother’s location was the fitting name? Or his cellphone’s location? She’s mainly buying and selling his life for (possibly) saving Dom’s members of the family’ lives.
Micah: I do not know… it is sort of inconceivable to determine between who ought to get murdered and who should not.
Jen: Mr. Robotic’s model of the trolley downside. I imply, a bunch of children have been gonna get killed. Unhappy, however an inexpensive name.
Yael: Janice may simply kill them anyway, although. It was exhausting to inform whether or not Dom thought Janice was gonna kill her household or knew they’d have escaped. However I can see why Darlene did it. I used to be shocked she did not do it after Dom bought stabbed. I need to know whether or not it is advisable to inform your armed kidnapper to eat shit, then die.
Micah: She will get my respect for it.
Yael: I’ve had a crush on Darlene since Season 1. Even when she is a assassin.
Jason: I feel it is exhausting to think about Janice a reputable particular person to barter with. She appears unreliable… why would Darlene count on to outlive, even when she does every little thing Janice needs?
Yael: Yeah, that is why I wasn’t certain it was a superb name.
Micah: Yeah, she’s terrifying as a result of she’s an unreliable psychopath.
Harlo: There are completely different classifications of kidnappings. What we noticed on Mr. Robotic was NOT probably the most prevalent one, which is nearly squeezing cash out of somebody whose household/family members might need it.
Micah: I feel when Darlene wiped her cellphone, she really wiped it for good and did not have a method to recuperate the information once more.
Trammel: The safe factor or TrustZone shops a key that’s inaccessible to the person. If it will get cleared, then the Flash reminiscence is nearly as good as erased. How did she recuperate it?
Micah: I do not suppose she may have restored it, not with out taking a backup of the cellphone first. However while you take an Android backup, the Sign app would not again something up, so she would have misplaced Elliot’s location even when she did restore a backup. I feel as a substitute she simply put in her hacked Sign consumer once more, and bought pinged from Elliot’s cellphone once more. That is the one approach I can see that working.
Harlo: I do not even suppose that Darlene would want her Sign mod; Elliot’s was modded solely to ping along with his latitude/longitude periodically. So all Darlene wants is Sign.
Micah: True. Her hacked Sign consumer should not care about security numbers—one thing we talked about final week. Elliot’s Sign consumer may determine to not belief Darlene’s quantity once more if her security numbers modified, nevertheless it seems to be like that wasn’t the case.
Harlo: Yeah, I assume there was no security measure like, “don’t ping if security quantity has modified” baked in; too unhealthy!
Yael: Darlene bought sloppy! Or possibly it was intentional, in case she needed to ditch her cellphone.
Micah: It takes loads of belief to place an app that tracks your location in your cellphone.
Yael: She grabbed Elliot’s cellphone from his hand and put it on for him.
Harlo: Sign wasn’t out there as a plain previous APK then… until you constructed it from the supply code. Nevertheless it did not appear to be Darlene had a pc together with her.
Micah: She had a shortened URL to obtain her modified APK. Additionally, it is doable she simply logged right into a Google account and downloaded from the Play retailer.
Harlo: Ah, then that may be most expeditious. What I am interested by is how she restored it. Like, if it is advisable use the Play retailer, you want a Gmail account. Or F-droid.
Yael: I assumed Janice had a superb level when she mentioned, “You did not give me your brother’s location; you gave me his cellphone’s location.” A number of drone operators ought to be taught the distinction.
They appeared like they have been exterior of Krista’s home. How good is that this geolocation monitoring? Is it only a normal location based mostly on the gadget’s proximity to mobile phone towers, or can it find the precise flooring within the precise residence?
Jason: Geolocation on telephones is flaky, particularly for those who’re in an “city canyon” like NYC the place you do not have good line of sight to satellites. Telephones additionally use Wi-Fi information and cell tower information to determine the place they’re, nevertheless it’s not good.
Yael: Corporations like Skyhook Wi-fi can present very particular location information based mostly on hotspot IP addresses. They’ve these enormous databases that correlate hotspot places with the IP addresses. They use a mixture of direct hotspot scanning and the cooperation of app “companions” who go alongside hotspot IP information from customers as they join. However I dunno if Darlene would subscribe to Skyhook; it is hella costly.
Jason: These location databases aren’t tremendous dependable. They will offer you a latitude and longitude that’s exact however not essentially correct.
Micah: Android has two location permissions, “coarse” and “tremendous.” I imagine “coarse” location works with out GPS and as a substitute depends on Wi-Fi entry factors the cellphone can see, mixed with Google’s huge database of Wi-Fi entry factors it is aware of about, and “tremendous” makes use of GPS. I feel she would use the cellphone’s built-in location companies.
Yael: How tremendous is okay?
Micah: I assume it depends upon the place you’re, however for those who take out your cellphone, open your maps app, and click on the button to zoom in to the place you’re—that is how tremendous.
Jen: Kashmir Hill has accomplished some good reporting on among the unlucky conditions that come up as a result of errors in these geo-IP location databases.
Yael: I used to be enthusiastic about this just lately with Protonmail. It has this new privateness function that is alleged to remind your cellphone to wipe native information for those who enter a sure space. Nevertheless it seems to be like it will solely work for those who have been proper within the heart of the nation, and it looks as if it’s exhausting to alter the radius exactly.
Harlo: Elliot’s harassed. Print twice?
Jen: Yeah, he had some syntax errors in that script. SyntaxError on line 16 (first line within the coinCoins() operate).
Trammell: The primary name is cleanCoins(), however his cleansing operate that passes them by the tumbler is called coinsCoins. And since Python would not test that when it compiles code, it’d trigger a runtime error. Hopefully Elliot doesn’t lose all his cash, like when Sonic hits an enemy.
Harlo: I used to be totes gonna drag him for that, however I gotta test the tape once more; maybe cleanCoins is above the fold and we do not see it.
Trammell: Sonic collects rings, not cash. Please disregard my try at a nerd reference and deduct one from my rating.
Micah: One of many print instructions was Python 2. The opposite was Python 3.
Harlo: In 2016, he was most likely not utilizing Python 3?
Yael: Elliot has been by so much. Or possibly there have been completely different personalities typing.
Jen: Mr. Robotic is Python 2, Elliot is Python 3.
Yael: What’s little Elliot?
Jen: He is that programming language for teenagers.
Yael: I realized the little Python I do know from the Python for Children guide, by the way in which. “A useful resource for the remainder of us”?
Micah: Additionally, why is he utilizing each os.system() and subprocess.check_output()… to name curl? You can also make HTTP requests straight from Python.
Jason: Yeah, he needs to be utilizing requests.
Jen: TFW your TV present doesn’t get permission to make use of requests, so that you gotta subprocess out to curve.
Harlo: lol, they can not afford the rights to point out requests. Additionally!
Did y’all discover the autofill? _main_ (one underscore). Any individual’s been writing some non-working code that they are hoping to deploy below duress… Additionally no pep 8, however hey, what are ya gonna do?
Micah: To be truthful, he was in the course of writing that script, and tremendous stressed, and clearly hasn’t tried operating it but. So possibly we’re not being truthful. I’ve typos and damaged stuff in my unfinished code on a regular basis.
Jen: Yeah, we’re simply being annoying. It seems to be hackery sufficient for the present. We’re simply giving the readers of this text what they need: line by line code suggestions. If I do know something about regular people, they love Python programming.
Yael: I don’t suppose he’s slept in lots of episodes, both.
Jason: If he was doing actual growth, he’d have Stack Overflow up, and he’d be copy/pasting from it.
Harlo: Anyhoos, okay, we have got some curl with a cookie; and what are these different flags? Don’t be concerned about SSL if it is not out there? I overlook…
Yael: I simply need Darlene to complete the hack as a result of she “occurs to be good and good at issues,” as she mentioned a number of seasons again. If this episode was Request Timeout, does that imply the subsequent one is Battle?
Oh, dumb query, however does Darlene really need to search out Elliot to complete his hack?
Micah: I am undecided… I am really a little bit unclear on the main points of the hack they’re in the course of doing, and the way it works.
Trammell: Seems to be just like the plan is to steal cryptocurrency and go it by a glass to launder it.
Yael: Can we do an ELI5 about tumblers and mixers?
Jen: A coin mixer is a service you’ll be able to transfer your cash by such that you may hopefully disassociate the cash with the place they got here from (which one would do if cash have been illegally acquired). Like cash laundering.
Trammell: The bottom64 would not decode to ASCII, sadly.
Harlo: What does it decode toooooooo? Shall I get out the CyberChef?
Yael: I do not perceive how any of this works, tbh. Like, I do know he is making an attempt to steal crypto. CryptoCURRENCY.
Micah: This Python script that Elliot’s writing is not really the total hack. It isn’t even exploiting something. It seems to be laundering cryptocurrency. I feel as soon as they steal the cash, that is how they are going to retrieve it with out getting caught. However this script is not really stealing the cash.
Jen: The opposite remark is legitimate. It seems to be like sooner or later he renamed a operate throughout growth and when the principle() operate runs, it will crash with a NameError.
Micah: It seems to be like the ultimate output of the script is an inventory of latest pockets addresses that the cash was in the end despatched to.
Jen: Presumably, he’d run this in take a look at earlier than transferring tens of millions of USD value of cash by a mixer.