The Luxembourg based syn2cat hackerspace has a system in place to provide members with information on the open/closed status of the space online or via an Android app. They call it OpenDuino, and it is more than a web based status monitor. OpenDuino also operates as a security system, allowing members to open and secure […]
Category Archives: security
Pen testers build a better mousetrap
Netragard is a security company that provides anti-hacking services (penetration testing, vulnerability assessments, web application security testing, etc) to its customers via the realistic reproduction of threats. In a recent assignment the client specified that the test could not use social engineering or physically access client facilities. With their work cut out for them, Netragard […]
Breaking copy protection in MCUs: then and now
When you decide to copy protect the firmware on your MCU, how effective are efforts such as setting a lock bit or enabling chip erase modes? Sergei P. Skorobogatov’s article provides an overview of the methods he’s tried against MCUs from various manufacturers. He outlines both invasive and non-invasive techniques such as chip depackaging, microprobing […]
App Note: wireless home security implementing KEELOQ® and PIC®
KEELOQ® is an authentication system designed by Microchip. It’s based on a proprietary, non-linear encryption algorithm that creates a unique transmission on every use, supposedly rendering RF replay attacks useless. The algorithm uses a programmable 64-bit encryption key unique to each device to generate 32-bit hopping code. In this new app note, Microchip presents a […]
Practical MC13224 firmware extraction
Travis Goodspeed wrote this article on his blog detailing his extraction of firmware from the MC13224 that had been read protected. This is the same MCU used in the Defcon 18 badge and the Redwire Econotag. He presents two methods. In one he decaps the SPI flash memory chip using nitric acid, then removes and […]
CNET free PC Lock™ software today only
OK, so it isn’t open source… but it is free (today only)! CNET is making available FREE downloads of PC Lock™ privacy encryption software for your PC. Just visit this link and follow the instructions. It will provide you with a free download and registration key. You will not be asked for credit card information. […]
Verizon 2011 data breach report
Verizon has released their 2011 Data Breach Investigations Report, a 74 page PDF cataloging the various type of cyber attacks they encountered in 2010. It resulted from a study conducted by the Verizon RISK Team with cooperation from the U.S. Secret Service and the Dutch High Tech Crime Unit. Despite the cool cover, it’s mostly […]
opendlp: data loss prevention suite
OpenDLP is a free and open source, agent-based, centrally-managed, massively distributable data loss prevention tool released under the GPL. Given appropriate Windows domain credentials, OpenDLP can simultaneously identify sensitive data at rest on hundreds or thousands of Microsoft Windows systems from a centralized web application. OpenDLP has two components: a web application and an agent. […]
Pentest-bookmark collection
The Open Penetration Testing Bookmarks Collections is a collection of handy bookmarks to aid in your day to day work or in the course of research. Founder J.Haddi writes, They are not all inclusive and some sections need to be parsed but they are all good reference materials. I find having this Hackery folder in […]
Shmoocon 2011: Exploring ZigBee Security
At the Shmoocon 2011 conference which recently concluded in Washington, DC, Ryan Speers and Ricky Melgares presented ZigBee Security: Find, Fix, Finish. ZigBee is a low-power, low-data rate wireless protocol based on IEEE 802.15.4. It connects lightweight embedded technology like HVAC, smart energy, security, and process automation systems, and is an attractive target as it […]
Secure usb time stamp
Simon Inns created a secure USB time stamp device. This project implements a USB device which provides a real-time clock for the purpose of time-stamping events in an non-networked embedded computer environment. For embedded applications where a periodic time-stamp is required (such as entry-system logs, configuration audit logs, etc.) it is necessary to have a […]
Amazon cloud + 20 minutes = WPA cracked
According to thelocal.de a German hacker says he cracked the wireless LAN password of his neighbor in 20 minutes – using the cloud computing power available on Amazon in a demonstration which he says should sensitize people and businesses to security issues.
Breaking SSL on embedded devices
Developers use embedded devices all the time, often without implementing security measures. When they do, they often rely on SSL. As revealed by the LittleBlackBox project there exists a collection of thousands of private SSL keys extracted from various embedded devices. These private keys are stored in a database where they are correlated with their […]
Free laundry hack highlights lack of security
cam0 pried open a laundry smartcard and found an unprotected SPI EEPROM chip. He googled the part number and found a datasheet that describes the chip protocol, then dumped the data with a Bus Pirate. He found the card balance by comparing the contents before and after a load of laundry, the value was stored […]