AppSec USA has announced a call for papers and trainers for their upcoming conference in NYC in November, 2013. AppSec USA is a software security conference for technologists, auditors, risk managers, and entrepreneurs. They invite all practitioners of application security and those who work or interact with all facets of application security to submit speaker […]
Category Archives: security
Door security logger with A13-OLinuXino-WIFI + OpenCV
Tsvetan and his crew at Olimex designed this simple project with A13-OLinuXino and OpenCV. “Now everytime somebody enter our lab A13-OLinuXino takes picture with timestamp and store on the SD-card, later we can view the captured images via the web on OLinuXino IP address.” The project sources are on GitHub. Via the contact form.
Shmoocon 2013: DIY: Using Trust To Secure Embedded Projects
At the recent Shmoocon conference in Washington, DC, Teddy Reed and David Anthony presented their DIY guide to using Trusted Computing on embedded devices. This is NOT an introduction or overview of Trusted Computing. We introduce a low-cost schematic using Atmel’s CryptoModule (AT97SC3204T) and CryptoAuthentication (AT88SA102S) ICs, and release drivers for UEFI, U-Boot, and the […]
Shmoocon 2013: Attacking Scada Wireless Systems
SCADA (Supervisory Control and Data Access) signals are commonly used to monitor and control utility and indusrial system. They use digital modulation and operate in the sub-1 GHz range of the RF spectrum. Atlas of D00M presesnted this talk at the recent 2013 Shmoocon conference in Washington, DC wherein he covered the current state of […]
A peek into the curious world of HDMI copy protection… with the Bus Pirate
Adam Laurie (a/k/a/ Major Malfunction) is a white hat hacker from London, UK, who has presented at a number of conferences worldwide. He’s also the Director at Aperature Labs, Ltd. Recently he explored the broken HDCP security mechanism used in HDMI. After building the HDMI breakout cable pictured above he examined the cable’s data lines […]
OpenSecurity training videos
OpenSecurityTraining has released a series of over 100 videos covering Introductory Intel x86: Architecture, Assembly, Applications, & Alliteration. The full YouTube playlist of the series can be found here. Trainer Xeno Kovah describes the course’s focus: “Intel processors have been a major force in personal computing for more than 30 years. An understanding of low […]
DEFCON 20: Hacking Measured Boot and UEFI
UEFI secure booting has been on the minds of many hackers and open sources advocates. Some believe that it will lock out certain operating systems in favor of vendor’s proprietary systems. (There have even been recent reports of bricking Samsung laptops just by trying to boot Linux.) In this video from last Summer’s DEFCON 20 […]
Raspberry Pi VPN
The Hoz directs our attention to this Lifehacker article explaining how to setup the R-Pi as your own personal VPN. The project hardware requires only standard R-Pi peripherals, including keyboard, mouse, monitor, SD card and Ethernet connection. You’ll also need a free account with LogMeIn. (They point out that OpenVPN may be a good alternative […]
RFID Multipass spoof using ATTiny85
Hudson from NYC Resistor was inspired by Beth’s avrfid.S project to try to build a replacement for the multiple HID Prox card he carried for work. Hudson notes that “Beth’s design is simultaneously a technical tour-de-force and an example of how badly we can abuse the Atmel chips.” The entire schematic consists of an ATTiny85 […]
DEFCON 20: SIGINT and traffic analysis for the rest of us
At last Summer’s DEFCON 20 conference Sandy Clark and Matt Blaze from the University of Pennsylvania discussed their research into the security of the P25 (APCO Project 25) digital radio protocol. Here they explain the basics of the P25 protocol and examine some of the problems and flaws they uncovered in its security. They highlight […]
OWASP AppSecUSA 2012: reverse engineering .NET applications
Last October the Open Web Application Security Project (OWASP) AppSecUSA 2012 conference was held in Austin, Texas. In this conference video Jon McCoy presents the practical information on reverse engineering .NET Framework Desktop Software. The presentation goes beyond basics to illustrate modification of security areas of apps. The speech is intended to give a security […]
DIY USB password generator
Benjamin Lunt writes to inform us of a small hardware HID project which for which he’s developed a PCB. The device design was created by Joonas Pihlajamaa (Jokkebk) and posted on CodeAndLife where it’s very popular. Joonas’ device is a small USB HID keyboard device that types a password stored in EEPROM every time it’s […]
Bus Pirate in DEFCON 20 presentation
S3c writes to inform us that the Bus Pirate got a mention in DEFCON 20 talk on reversing smart meters. From what we were able to ascertain from the video the Bus Pirate is used to read memory devices located on the smart meter boards. Via the contact form. Get your own Bus Pirate for […]
DEFCON 20: bypassing endpoint security with USB keys
In this talk from the DEFCON 20 conference, Phil Polsta, Computer Security Professor at the University of Dubuque discusses the relative insecurity of using USB “keys” as a way of restricting access to tech resources. He explains in detail how any USB mass storage (flash or hard) drive can be made to appear as an […]
Video: Android app insecurity and reversing
In this just released video from the Open Web App Security Project (OWASP) AppSecUSA 2011 conference held in Minneapolis, MN, Mike Park discusses the insecurity of Android “.apk” apps and covers the ease with which Android Apps can be reversed, the ability to store sensitive data locally, and how these apps can be trojaned to […]
AVR/V-USB combo tool hacks Win 7
András Veres-Szentkirályi, IT security expert, OSCP, GWAPT, writes, “I’ve built a device that acts as a USB HID keyboard, enters a script as a series of keystrokes into a PC, which can extract itself into an executable. This in turn can send files on the PC back to the device using the NUM/CAPS/SCROLL lock LED […]
DeepSec 2011: patching vehicle insecurities
In this talk from the DeepSec 2011 conference Constantinos Patsakis and Kleanthis Dellios discuss their theory for developing more effective automotive security anti-theft systems. They explain: “In order to patch known security breaches and create a more extensible in-vehicle computer system, we propose the use of a TTP (Time-Triggered Protocol) entity inside the vehicle, which […]
DakaRand 1.0: revisiting clock drift for entropy generation
In a recent post on his blog, security researcher Dan Kaminsky builds on the work of Matt Blaze and D.P. Mitchell’s TrueRand from 1996 while expanding on his Defcon 20 talk. In summary, any system with two clocks has a hardware number generator. The clocks’ tolerances lead to jitter, producing unmodelable noise in the system. […]
DeepSec 2011: hacking GSM packets using scapy
In this talk from the DeepSec 2011 security conference Laurent ‘Kabel’ Weber, co-founder of the Chaos Computer Club in Berlin, details the enhanced scapy software tool to attack GSM via packet manipulation. This presentation introduces a scapy-addon allowing users to create GSM layer 3 packets using simple Python syntax. His hardware setup includes a USRP1 […]
DEFCON 20: Hacking smart meters
At the recent DEFCON 20 conference in Las Vegas, Don C. Weber presented this talk on smart meter technology and security. The presentation deals with the optical port found on smart meters, and covers attacks from quick memory acquisition techniques to more complex hardware bus sniffing, as well as how authentication credentials are acquired. Finally, […]