Rotary dial authenticates sudo commands

[W1ndman] won’t win any security awards for this build, but it’s an interesting idea. On many Linux-based systems commands can be run with administrator privileges by prefacing them with the keyword ‘sudo’. Normally you’d be asked for a password but [W1ndman] used the Pluggable Authentication Modules (PAM) to authenticate via his own shell script. That script checks a code from this rotary dial for authentication. An Arduino takes care of listening for each digit that is entered and then sends the code via USB for comparison with a stored file. We’re not sure if that stored code is in a plain file or is otherwise protected, but at the very least this prevents you from using ‘sudo’ willy-nilly.

Read more...

Building infra red light sources with regular lights

[Oneironaut] sent us another IR hack. This time it is a writeup on the best ways to create IR light sources from regular lights. Since normal flashlight bulbs emit a broad enough spectrum to include visible light and IR light, this basically comes down to filtering. [Oneironaut] explores different light sources and different materials in depth, along with great pictures to show his results. This is a great resource if you’re needing to do some night vision for cheap.

Read more...

Kodak digital frame vulnerability

Kodak managed to release a product with a big fat security vulnerability. [Casey] figured out that the Kodak W820 WiFi capable digital frame can be hijacked for dubious purposes. The frame can add Internet content as widgets; things like Facebook status, tweets, and pictures. The problem is that the widgets are based on a feed from a website that was publicly accessible. The only difference in the different feed addresses is the last two characters of the frame’s MAC address. Feeds that are already setup can be viewed, but by brute-forcing the RSS link an attacker can take control of the feeds that haven’t been set up yet and preload them with photos you might not want to see when you boot up your factory-fresh frame.

It seems the hole has been closed now, but that doesn’t diminish the delight we get from reading about this foible. There’s a pretty interesting discussion going on in the thread running at Slashdot.

[Photo credit]

Read more...

Spy on your office

[Garagedeveloper] sent us his custom surveillance system, part 1, part 2, and part 3 after needing a way to find out why some cables at work were becoming unplugged (spoiler, the cleaners were messing up the wiring). At the base of the system is a web cam glued to a stepper motor. However, it gets much more in depth with a web front-end that allows the user to stream the feed and control the position of the stepper. We’re not particularly fond of how many different parts the project takes, while it all could be accomplished under C# with ASP.NET and parallel port library instead of including Arduino and excess code, but to each their own and the project turned out a success anyway.

Read more...

Arduino security with frickin’ laser

[over9k] used his Arduino to set up a laser trip wire. The laser is mounted along side the Arduino, reflects off of a mirror, and shines on a photoresistor that interfaces via a voltage divider. The signal from the voltage divider is monitored for a change when the laser beam is broken. [over9k] set things up so that a webcam snaps a picture of the intruder and Twitters the event for easy notification. Video after the break walks through each of these steps.

This build is a bit rough around the edges but unlike other laser trip wires this keeps all the electronics in one place. The laser interface could be a bit more eloquent, and we’re wondering just how much current it is pulling off of the Arduino pins. But if you’re bored and have this stuff on hand it will be fun to play around with it. Read the rest of this entry »

Read more...

Lightning Rod: keeps you safe from dirty Flashers

A new open source package called Lightning Rod will help to close security exploits in Adobe’s dirty Flash code. A presentation made at the 26th Chaos Communication Congress showed that the package does its job by reviewing incoming code before the browser executes it. Heise Online is reporting that this method can block over 20 different known attacks and can even be used to filter out malicious JPG attacks. As more vulnerabilities are discovered they can be added to Lightning Rod to close the breach. This amounts to a virus scanner for Flash code. It’s great to have this type of protection but why can’t Adobe handle its security problems?

[Photo Credit]

[Thanks das_coach]

Read more...

GSM Cracked

[Karsten Nohl], with a group of security researchers has broken the A5/1 Stream Cipher behind GSM. Their project web site discusses their work and provides slides(pdf) presented at 26C3. A5/1 has had known vulnerabilities for some time now and is scheduled to be phased out for the newer KASUMI or A5/3 block cipher. This should be an interesting time in the cell phone business.

Thanks to [Tyco] and [MashupMark] for pointing us to this story.

Read more...

Terminate RFID tags

This gun hunts only RFID tags.[mnt], who brought us laser gesture control, built this RFID Zapper but included so much more. Any good weapon has to sound mean, a feat he’s accomplished by incorporating an MP3 player into the rifle. The coil that zaps the RFID tag is powered by a photo-flash unit, but for visual feedback he’s got a second unit that flashes light to signal the demise of your German passport (see the video after the break).

It’s hard to believe we haven’t covered RFID Zappers yet. The concept came out of the Chaos Communication Congress a few years back. This method works by sending a very strong electromagnetic field through the RFID tag that causes it to burn out. There’s a wiki post on RFID Zappers but Firefox threw a certificate warning when we loaded it up; read at your own risk.

Read the rest of this entry »

Read more...

Hacking ZigBee chips: CC2430

[Travis Goodspeed] took an in-depth look at the debugging protocols for some ZigBee chips and posted his findings. In particular he’s looking at the CC2430 System-on-chip. These chips have a debugging protocol that is not hard to implement if you know what you’re doing. Certainly his tips make it easier for the rest of us. Don’t miss the info about reading from, writing to, and overcoming security of this hardware.

Read more...

How to root a Nook

Here’s the latest in rooted consumer devices, nookdevs.com has rooted the Barnes & Noble Nook eBook reader. The process is extremely easy, as the operating system is stored on a 2GB SD card inside the device. In fact, once you have the case open the hard part is over. From there, the card should be backed up for safe keeping. Now mount the card, enable the Android Debug Bridge and reassemble. The Android SDK can then be used to log into a shell on the Nook wirelessly.

We’re not sure there’s much that can be done past this point yet. It’s up to you to get Doom running!

Read more...

Recover borked HDD after Xbox 360 ban

[Incudie] tipped us off about a method to fix a borked HDD in your Xbox 360. Many of the one million consoles banned earlier in the month also had the hard disks scrambled making off-line gaming impossible as well. It turns out that this is caused by having a ban flag in the NAND chip on the motherboard. It has been discovered that because of wear levelling, the NAND will have two copies of the “secdata.bin” file which stores the ban flag. Please note, this will NOT allow the console to use Xbox Live, it just re-enables the HDD.

The quick and dirty of the fix is as follows: First the NAND is dumped from your Xbox 360 to a computer. After verifying the file, it can be opened in a HEX editor and the two copies of “secdata.bin” located. Once identified by date, the older version is injected on top of the newer to overwrite the ban flag.

Looks like this is not for the faint of heart, but if you got banned for modding in the first place this should be easy to pull off.

Update: Looks like xbox-scene now has a collection of apps to help you with this process. [Thanks CollinstheClown]

Read more...

Knock detecting lock

[Steve] shows us his version of the knock detecting lock system. The idea is pretty simple, knock in a certain pattern and the door unlocks. We’ve seen it before several times. This solution is somewhat cleaner than the others, not only in physical design, but also in how you reprogram it. Simply push the reprogram button and enter your new knock. We’re a bit surprised that the suction cups actually hold it on the door. Maybe it’s just us, but we can never seem to get those things to hold very well. There are lots of great pictures as well as the source code available on his site.

[via HacknMod]

Read more...

Two-factor authentication using a hardware token

We ran into a friend a while back who was logging into her employer’s Virtual Private Network on the weekend. She caught our attention by whipping out her keys and typing in some information from a key-fob. It turns out that her work uses an additional layer of protection for logging into the network. They have implemented a username, pin number, as well as a hardware token system called SecurID.

The hardware consists of a key-fob with an LCD screen on it. A code is displayed on the screen and changes frequently, usually every 60 seconds. The device is generating keys based on a 128-bit encryption seed. When this number is fed to a server that has a copy of that seed, it is used as an additional verification to the other login data.

This seems like a tech trickle-down of the code generating device from GoldenEye. It does get us thinking: with the problems free email services have been having with account theft, why aren’t they offering a fee-based service that includes a security fob? With the right pricing structure this could be a nice stream of income for the provider. We’re also wondering if this can be implemented with a microcontroller and used in our home network. As always, leave comments below and let us know if you’ve already built your own system using these principles.

Update: Thanks to Andre for his comment that tells us this type of security is available for Apache servers. The distribution includes a server side authentication system and a Java based token generator that can run on any handheld that supports Java.

Read more...

freeBOOT gives the Xbox 360 JTAG hack new life

There has been another development in the never-ending battle that is Microsoft trying to keep its gaming system closed to unauthorized use. Xbox-scene reports that a new hack called freeBOOT v0.01 allows the Xbox 360 to upgrade to the newer kernels, but allows the option of rebooting to an older kernel in order use the JTAG exploit and gain access to the hardware.

In case you missed it, the JTAG hack is a way to run homebrew code on an Xbox 360. Exploiting this hack makes it possible to boot a Linux kernel in about five seconds. We’ve long been fans of the homebrew work done with XBMC on the original Xbox and hope that advances like this will lead to that end. We want this because the older hardware cannot handle high definition content at full resolution but the Xbox 360 certainly can.

This exploit is still far from perfect. It currently requires that the Cygnos360 mod chip be installed on the system. A resistor also needs to be removed from the board to prevent accidental kernel updating. That being said, this is still progress. If you’re interested in step-by-step details, take a look at the text file instructions provided.

[Thanks wdfowty]

Read more...

See through walls via wireless network

Researchers at the University of Utah have been able to detect movement in a room based on variations in wireless signals. Accurate to about a meter, they are using a 34 node wireless network to do their sensing. As a person moves, they change the signals, and can therefore be detected. They state one possible application being rescue workers deploying multiple wireless nodes around a building to find people located inside.

[via Gizmodo]

Read more...

Garage door… packet sniffer

Some type of logger or sniffer exists for almost every form of electronic communication. Your keystrokes, phone conversations, and wireless networks could all be monitored. In this awesome proof-of-concept project, [James] expanded that array to include garage door openers. After receiving a piece of chain mail which stated that criminals have the technology to record any remote code and play it back, [James] wondered if he could build such a device that would work on at least his opener model. Read the rest of this entry »

Read more...

Homemade Bokode

We’ve recently been getting a lot of new comments on our Bokode post from a while back, and with good reason. [M@] has managed to find a way to replicate Bokode at home, using $0 worth of equipment (before the price of microprint). To accomplish Bokode at home, it seems all you need is and old webcam lens assembly and an LED. Of course the his version is not as thin as a regular barcode so it probably wont be replacing anything in the near future, but the concept of from MIT to home within such a short period of time is amazing.

Read more...

Batcave-style entrance (on a budget)

Want to enter your hidden lair in style? Well [Jimmy] simply wanted to create a cool prop for his school’s homecoming dance. This project includes some obvious inspiration from Wayne Manor. [Jimmy] wired up the automated entrance with a 12VDC motor. In order for it to be able to push the door , the motor had to be attached to a gearbox, which directly powered a wheel. Current consumption issues were solved by using a wall-wart. Because a real bookshelf would still be too heavy, [Jimmy] dressed up a regular door with some patterned wallpaper to give it the right look. Coupled with a Shakespearean bust concealing the button, and some other cosmetic touches, this project was sure to impress any student who knew its secret.

Read more...

Unhackable Netbooks given to students

Where would be the best place to test out an unhackable netbook? The NSW department of education in Australia thinks that college is perfect . They plan on distributing netbooks, preloaded with Windows 7,and iTunes. They also have bios level tracking and security, allowing them to be remotely shut down on command. With 20,000 of these in circulation, we would think that we’ll see someone proving the “unhackable” statement wrong. We can only hope.

[via slashdot]

Read more...

Steal the administrator password from an EEPROM

Did you forget your hardware-based password and now you’re locked out? If it’s an IBM ThinkPad you may be in luck but it involves a bit more than just removing the backup battery. SoDoItYourself has an article detailing the retrieval of password data from an EEPROM.

The process is a fun one. Disassemble your laptop. Build a serial interface and solder it to the EEPROM chip where the password is stored. Connect this interface to a second computer and use it to dump the data into a file. Download a special program to decipher the dump file and dig through the hex code looking for something that resembles the password. Reassemble your laptop and hope that it worked.

We know that most people won’t be in a position to need a ThinkPad administrator password, but there must be other situations in which reading data off of an EEPROM comes in handy. What have you used this method for?

Read more...