Now, on the eve of Hack a Day’s fifth anniversary, seems like an appropriate time to announce my resignation. Site founder [Phillip Torrone] published the first post, a red box, on September 5th, 2004. On May 7th, 2005 I took over editorial duties at Hack a Day by publishing one of my favorite projects: [Jonathan Westhues]‘ proximity card spoofer. Since then, I’ve run Hack a Day with a number of great contributors over the last four years: [Fabienne Serriere], [Will O'Brien], [Ian Lesnet], and current senior editor [Caleb Kraft] just to name a few. I’ve enjoyed watching the site grow, powered by the constant stream of tips from readers. Whether we were turning hard drives into molten goo or putting our hardware designs into production, it’s been a lot of fun. With all the new talent we’ve brought on recently, I have confidence that Hack a Day will continue to be a great resource in the future.

You’ll be able to find me online running my personal blog RobotSkirts.com and on Twitter as @sweetums. In real life, I’ll still be attending hacker conferences, like the upcoming ToorCon in San Diego, and local Los Angeles tech events like Mindshare and the weekly Hacker Drinkup.

In closing, I’d like to thank you, the readers, for all the support you’ve given us over the years. If it weren’t for all the tips, personal projects, and ideas you’ve sent us, we’d never have made it this far. Thank you.

[photo: Viss]

There are myriad file transfer services on the web. Streamfile tries to set itself apart by providing a unique secure service. Their file upload system is all JavaScript and doesn’t rely on Flash. It uses SSL to secure the file transport. As soon as you start uploading the file, you can hand the link off to your recipient and they can start downloading without waiting for the upload to complete. The free limit is 150MB, but their PRO service allows 2GB files.

[via Download Squad]

In the last few days, rooting the T-Mobile G1 and myTouch 3G has become much easier. [Zinx] released FlashRec which lets you flash a new recovery image onto your Android phone. It takes advantage of Linux kernel vulnerability CVE-2009-2692. The app lets you backup your current image and then flashes Cyanogen’s Recovery Image 1.4. Once that’s done, you can use any custom Android build you want. Android and Me has documented the entire process on their site and points out the ridiculously large number of custom ROMs that are out there. Embedded below is a video from [unknownkwita] showing the rooting process.

i have no idea why sites focused around diy electronics have such aggressive comments – Hack a Day applicant

That is weird. What do you think? Comments go!

The Big Picture is Boston.com’s daily news photo blog. Each day they pick a particular story and feature some of the best news photography around. Today they chose robots and have 36 photos highlighting current robot research. This is a followup to a similar post from March. It’s interesting to see all the different forms and tasks robots are taking.

In 2006, Defcon 14 premiered a unique electronic badge. All it did was blink, but it raised the bar for what was expected from a hacker conference badge. In 2007, they went from 2 LEDs to 95 in a scrolling marquee. Along with a POV mode, the badge had two capacitive switches to let the user edit the displayed text. Defcon 16’s badge featured an IR transmitter and receiver for transferring files from an SD card. It worked as a TV-B-Gone and had pads to access a USB bootloader. That was the same year that The Last Hope debuted their RFID tracking badges.

This year the official Defcon badge reacted to sound, but they were no longer the only game in town. Ninja Networks brought their 10 character party badges with a built in debugger. The Arduino compatible HackTheBadge 1.0 also made an appearance. With these new entrants into the field, we wondered what you’d want to see in your ideal badge. What badge would you want to see at next year’s Defcon? Leave you comments below and keep in mind that it should be an idea that is easy to cheaply mass produce.

UPDATED: Forgot to mention the Neighborcon 2 badge based on the GoodFET20.

[Photo: Ninja Networks]

We’ve added a handful of contributors in the last couple months, but we’re still looking for more people to contribute daily posts and help expand the site.

This is a paid, freelancing position that requires professionalism, consistency, and reliability. We want to hear from people that are passionate about software/hardware hacking and growing Hack a Day. To apply, send the following to jobs@hackaday.com

• A short bio about yourself
• 3 example daily posts written in the style of Hack a Day
• 3 software or hardware how-tos you’d like to see. For examples of work we’ve done in the past, look here, here, here, and here.
• A couple sentences on how you would improve the site either through features or content
• Any additional reasons why you would make a good fit for Hack a Day

Do not send any attachments. Having your own blog you can show off is a definite plus.

[photo:fbz]

UPDATE: The director’s cut of the story

While coverage of the official Defcon badge has been pretty heavy, there was a badge that was far more exclusive and talked about way more. For the last ten years at Defcon a group of hackers known as Ninja Networks hosted an invitation-only party for selected attendees. For the 2009 event, [cstone] and [w0z] created an electronic badge which acted as the ticket to the party. The badge is based around an 8-bit Freescale microcontroller (MC9S08QE8) which drives 10 individual 16-segment HIOX-format LED displays.

The custom PCBs were manufactured by 4pcb, but all other assembly was done by hand with a huge team of volunteers in Boston, Los Angeles, and Las Vegas. Assembly space for this effort was provided by Redwire and Angel Valley Media. More than 500 badges were created. To help fund the effort, the Ninjas took on internet privacy company XeroBank as an event sponsor.

The assembly process is detailed in the video below which highlights a few interesting DIY techniques including using a $30 Target hotplate as a reflow oven.

Once assembled, the default mode for the badge is to randomly cycle each display through a list of characters locking in each one to finally display “NINJA PARTY”, in the same manner seen in the film “WarGames”. The badge also has a “Simon” game mode, the ability to view the badge’s unique identifier and sponsor URL, and a fully functional debugger.

Using the debugger a user can reprogram the badge to display different messages, or change it’s functionality with no computer required. This is demoed in the video below.

While all the badges were distributed at Defcon 17, [cstone] has provided the schematics and gerbers, public domain source code, and the BOM in case you wish to create your own. We were some of the many people to help hand assemble these badges, which you can find listed on his site.

[Photo: vissago]

[Pocket Lucho], the builder of mini arcade cabinets, is back with another build. This time it’s a miniature Neo Geo arcade machine (translated). The build is very compact and neat. He attached the control panel and the PS one display using magnets to make the wiring more accessible. It has video out and second player input too. You’ll find an assembly video embedded below along with a trial run.

The folks at SparkFun were startled by how small USB bluetooth adapters had become so they split one open. They noted a few interesting design features. It has a small folded trace antenna on the board edge. The metal USB housing acts as the RF shield. The bluetooth IC is an AS3620QA. Now we wonder what those tiny Buffalo drives look like inside.

Related: Eye-Fi teardown, storage/WiFi in an SD card

The latest Inventgeek project is a 12 outlet control box. They decided to demo it using a giant bulb based VU meter. The control box has 12 individual outlets hooked up to two layers of six solid state relays. [Jared] notes that SSRs can be very expensive, but he purchased his on eBay for ~$10 each. Wiring and installation on this project is incredibly clean and they plan on using the control box for future how-tos. The simple audio circuit used for the VU is based on the LM3915. You’ll find full plans on the site or you can watch the overview video embedded below.

[Shachar Geiger] sent in an interesting project that he worked on with [Tal Avivi] at the Bezalel academy in Jerusalem. They were given the task of designing a 1-person electrical urban vehicle. They took some cues from MIT’s Transology and designed the OmniDirectional Research Platform (ODRi). There’s a video of it embedded above. It can be driven using three different input styles: an accelerometer joystick, a traditional gamepad, or body mass shift. They started with an Arduino, but needed more I/O and had to switch to a Wiring board (this was before the Mega). The platform is built mostly from scrap. The accelerometers were placed in an old Microsoft Sidwinder. The standard joystick is from a Sega Mega Drive. The weight sensors are out of cheap home scales.

A little over a year ago [Ian Lesnet] joined our hacking team and began cranking out some of the best original how-tos Hack a Day has ever offered. You may remember our popular web server on a business card from last fall and we’re sure everyone is familiar with the Bus Pirate (yes, they’re still on schedule).

It’s a year later and he’s found himself with less time to contribute. [Ian] is stepping down from blogging at Hack a Day, but you’ll find him right where he started: in the comments. You can also reach him directly on whereisian.com. [Ian] will be continuing to develop the Bus Pirate. You’ll find the latest info on the Bus Pirate’s Google Code page. He’s also posted a guide to the on-board pull-up resistors as well as a self-test guide that uses the new v2.0 firmware to confirm your Bus Pirate is working.

[Ian]’s contributions will be greatly missed. We’re always excited when we add contributors of his caliber to our crew.

For day two of Black Hat, we sat in on on [Joe Grand], [Jacob Appelbaum], and [Chris Tarnovsky]’s study of the electronic parking meter industry. They decided to study parking meters because they are available everywhere, but rarely considered from a security perspective.

They focused on the San Francisco’s MTA implementation of electronic smart card meters. To start they purchased several meters on eBay just to see the different styles. SF MTA lets you purchase disposable payment cards with values of $20 or $50. They decided to sniff the interaction between the meter and the smartcard using a shim. With that first capture they were able to easily replay the transaction. This didn’t require a smartcard reader, just an oscilloscope. They then took the attack a little further.

[Joe] built a smartcard emulator using a PIC16F648A. They used it to capture multiple transactions and then decoded the interactions by hand. Luckily, the card was using the IEC 7816 standard so they had some insight into the protocol. They found that the card has a stored maximum value and only writes how many times the value has been decremented. As a proof of concept, they change the maximum value, which you can see on the meter above. They could also have just changed the acknowledgement so that the card never writes any deductions.

The PIC16F648A was a good choice because it’s available in a smart card format called a ‘silver card‘. You can find the emulator code and slides from the talk on [Joe]’s site about the project.

Update: The video of [Moxie]’s presentation is now online.

[Moxie Marlinspike] appeared on our radar back in February when he showed sslstrip at Black Hat DC. It was an amazing piece of software that could hijack and rewrite all SSL connections. The differences between a legitimate site and the hijacked ones were very hard to notice. He recently stumbled across something thing that makes the attack even more effective.

If you apply for a certificate, the certificate authority looks at the common name on the form and contacts the domain owner. The CA ignores the subdomain. The trick is to drop in a null character in the subdomain. If you register, www.paypal.com[null character].thoughtcrime.org, the CA will contact the owner of thoughtcrime.org and issue the cert. When clients like Firefox use NSS to verify the cert, the null character causes them to think the certficate is valid for www.paypal.com because they stop at the null character. Even if the person examines the cert in their browser, it will show www.paypal.com.

Wildcards work as well. You could get a certificate for *[null character].thoughtcrime.org and appear as any site you want. [Moxie] has worked out ways to prevent certificate revocation and browser updates too. This new code will be part of sslsniff 0.6.

[Apologies for the odd notation. WordPress apparently strips null characters...]