[Armin Tamzarian’s] local library recently started lending eBooks via the OverDrive Media Console system. He checked out a couple of books, which got him thinking about how the copy protection scheme was implemented. He wondered what recourse users had if they wanted to view a book they have already checked out on a different, or unsupported piece of hardware.

His research centers around Adobe’s ADEPT digital rights management scheme, which is used to protect the books offered on loan by OverDrive. The topic is broken down into three parts, starting with an introduction to the EPUB file structure, the OverDrive Media Console, as well as the aforementioned ADEPT DRM scheme.

The second part takes a close look at the OverDrive Media Console itself, where he uses the ineptkey and ineptepub utilities written by [I♥CABBAGES] to pull the RSA cipher keys from the EPUB data he uncovered. When he then tries to strip the ADEPT DRM layer from his books however, he discovers that OverDrive is using a non-compliant version of the ADEPT standard, which renders existing tools useless.

The final part of [Armin’s] discussion digs even deeper into the OverDrive Console’s inner workings, where he finds that the OverDrive Media Console stores quite a bit of information in an SQLite database. After a bit of digging, he finds all the data he needs to strip the DRM from his books. [Armin] also took the time to wrap all of his findings up into a neat little tool called OMCStrip, which as you may have guessed, strips the DRM from ADEPT-protected eBooks with ease.

Indeed, the gizmo above is meant to be used as a gas pedal. [Grant Skinner] came up with the idea to control slot cars using an Android phone as a gas pedal. He coded the software for the handset and a computer using Adobe AIR. Once connected, the computer is sent the accelerometer data from the phone, relaying the speed control to the slot car track with the aid of a Phidgets motor controller. See it ‘go’ after the break.

We’ve seen the Phidgets board used in several projects like the augmented vending machine and the plotter white board. What we haven’t seen is hacks that make use of AIR, a framework we looked at two years ago. If you’ve got hacks that make use of AIR we want to hear about them.

[Thanks Mike]

A new open source package called Lightning Rod will help to close security exploits in Adobe’s dirty Flash code. A presentation made at the 26th Chaos Communication Congress showed that the package does its job by reviewing incoming code before the browser executes it. Heise Online is reporting that this method can block over 20 different known attacks and can even be used to filter out malicious JPG attacks. As more vulnerabilities are discovered they can be added to Lightning Rod to close the breach. This amounts to a virus scanner for Flash code. It’s great to have this type of protection but why can’t Adobe handle its security problems?

[Photo Credit]

[Thanks das_coach]

Facebook’s internal valuation was revealed this week thanks to shoddy PDF redaction. Court documents from a settlement between Facebook and ConnectU showed that Facebook values itself at $3.7 billion, much less than the $15 billion that was speculated during the Microsoft investment. The AP uncovered this by cutting and pasting from the redacted court document. It’s the same thing we showed in our PDF redaction screencast last summer… and it will never cease to be funny.

[photo: Bryan Veloso]

[Jeremiah Grossman] and [Eric Lawrence] will be presenting on clickjacking and browser security in an online seminar tomorrow. Clickjacking allows an attacker to transparently place links exactly where a user would be clicking, essentially forcing the user to perform actions without their knowledge. This method of attack has been known for a few years, but researchers have focused their attention on it lately because they feel the threat has been underestimated. Recently, Adobe patched a vulnerability specifically because of this issue. Tune in tomorrow for more info on the attack.