<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	xmlns:georss="http://www.georss.org/georss" xmlns:geo="http://www.w3.org/2003/01/geo/wgs84_pos#" xmlns:media="http://search.yahoo.com/mrss/"
	>

<channel>
	<title>Hack a Day &#187; checksum</title>
	<atom:link href="http://hackaday.com/tag/checksum/feed/" rel="self" type="application/rss+xml" />
	<link>http://hackaday.com</link>
	<description>Fresh hacks every day</description>
	<lastBuildDate>Sun, 12 Feb 2012 06:24:26 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.com/</generator>
<cloud domain='hackaday.com' port='80' path='/?rsscloud=notify' registerProcedure='' protocol='http-post' />
<image>
		<url>http://1.gravatar.com/blavatar/5560f98f805877b0e332f191cb9e0af3?s=96&#038;d=http%3A%2F%2Fs2.wp.com%2Fi%2Fbuttonw-com.png</url>
		<title>Hack a Day &#187; checksum</title>
		<link>http://hackaday.com</link>
	</image>
	<atom:link rel="search" type="application/opensearchdescription+xml" href="http://hackaday.com/osd.xml" title="Hack a Day" />
	<atom:link rel='hub' href='http://hackaday.com/?pushpress=hub'/>
		<item>
		<title>BIOS password cracking</title>
		<link>http://hackaday.com/2010/10/07/bios-password-cracking/</link>
		<comments>http://hackaday.com/2010/10/07/bios-password-cracking/#comments</comments>
		<pubDate>Thu, 07 Oct 2010 17:00:34 +0000</pubDate>
		<dc:creator>Mike Szczys</dc:creator>
				<category><![CDATA[security hacks]]></category>
		<category><![CDATA[bios]]></category>
		<category><![CDATA[bruteforce]]></category>
		<category><![CDATA[checksum]]></category>
		<category><![CDATA[laptop]]></category>
		<category><![CDATA[password]]></category>
		<category><![CDATA[python]]></category>

		<guid isPermaLink="false">http://hackaday.com/?p=29055</guid>
		<description><![CDATA[[Dogbert] took a look at the security that goes into BIOS passwords on many laptops. He starts off with a little background about how the systems work. People are bound to forget their passwords, so when you enter a wrong one three times in a row you get a message similar to the one above [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=hackaday.com&amp;blog=4779443&amp;post=29055&amp;subd=hackadaycom&amp;ref=&amp;feed=1" width="1" height="1" />]]></description>
			<content:encoded><![CDATA[<p><img class="alignnone size-full wp-image-29056" title="bios-password-bruteforce" src="http://hackadaycom.files.wordpress.com/2010/10/bios-password-bruteforce-e1286462689572.jpg" alt="" width="470" height="175" /></p>
<p>[Dogbert] took a look at <a href="http://dogber1.blogspot.com/2009/05/table-of-reverse-engineered-bios.html">the security that goes into BIOS passwords</a> on many laptops. He starts off with a little background about how the systems work. People are bound to forget their passwords, so when you enter a wrong one three times in a row you get a message similar to the one above that locks you out until all power is removed from the system (then you get three more tries). But check out that five-digit number in the picture. That&#8217;s a checksum of the password. Some BIOS versions display it automatically, some require you to hold down a certain key during POST, but it&#8217;s the pivotal data needed to crack the password.</p>
<p>[Dogbert's] post doesn&#8217;t go into verbose detail about the algorithms he uses to brute force the passwords. But he has posted the Python scripts he uses to do so. Learning how to generate the passwords based on the checksum is as simple as studying the code, which is often the best way to learn.</p>
<br />Filed under: <a href='http://hackaday.com/category/security-hacks/'>security hacks</a>  <a rel="nofollow" href="http://feeds.wordpress.com/1.0/gocomments/hackadaycom.wordpress.com/29055/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/comments/hackadaycom.wordpress.com/29055/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/godelicious/hackadaycom.wordpress.com/29055/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/delicious/hackadaycom.wordpress.com/29055/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/gofacebook/hackadaycom.wordpress.com/29055/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/facebook/hackadaycom.wordpress.com/29055/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/gotwitter/hackadaycom.wordpress.com/29055/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/twitter/hackadaycom.wordpress.com/29055/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/gostumble/hackadaycom.wordpress.com/29055/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/stumble/hackadaycom.wordpress.com/29055/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/godigg/hackadaycom.wordpress.com/29055/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/digg/hackadaycom.wordpress.com/29055/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/goreddit/hackadaycom.wordpress.com/29055/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/reddit/hackadaycom.wordpress.com/29055/" /></a> <img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=hackaday.com&amp;blog=4779443&amp;post=29055&amp;subd=hackadaycom&amp;ref=&amp;feed=1" width="1" height="1" />]]></content:encoded>
			<wfw:commentRss>http://hackaday.com/2010/10/07/bios-password-cracking/feed/</wfw:commentRss>
		<slash:comments>33</slash:comments>
	
		<media:content url="" medium="image">
			<media:title type="html">Mike Szczys</media:title>
		</media:content>

		<media:content url="http://hackadaycom.files.wordpress.com/2010/10/bios-password-bruteforce-e1286462689572.jpg" medium="image">
			<media:title type="html">bios-password-bruteforce</media:title>
		</media:content>
	</item>
		<item>
		<title>Subway hacker speaks</title>
		<link>http://hackaday.com/2008/08/24/subway-hacker-speaks/</link>
		<comments>http://hackaday.com/2008/08/24/subway-hacker-speaks/#comments</comments>
		<pubDate>Mon, 25 Aug 2008 04:30:00 +0000</pubDate>
		<dc:creator>Eliot</dc:creator>
				<category><![CDATA[cons]]></category>
		<category><![CDATA[security hacks]]></category>
		<category><![CDATA[checksum]]></category>
		<category><![CDATA[crypto]]></category>
		<category><![CDATA[defcon]]></category>
		<category><![CDATA[defcon16]]></category>
		<category><![CDATA[hacker]]></category>
		<category><![CDATA[interview]]></category>
		<category><![CDATA[mbta]]></category>
		<category><![CDATA[mifare]]></category>
		<category><![CDATA[mifareclassic]]></category>
		<category><![CDATA[nxp]]></category>
		<category><![CDATA[popularmechanics]]></category>
		<category><![CDATA[rfid]]></category>
		<category><![CDATA[subway]]></category>

		<guid isPermaLink="false">http://hackaday.iheartcashews.com:8181/2008/08/24/subway-hacker-speaks/</guid>
		<description><![CDATA[Popular Mechanics has an interview with [Zach Anderson], one of the MIT hackers that was temporarily gagged by the MBTA. The interview is essentially a timeline of the events that led up to the Defcon talk cancellation. [Zach] pointed out a great article by The Tech that covers the vulnerabilities. The mag stripe cards can [...]<img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=hackaday.com&amp;blog=4779443&amp;post=2493&amp;subd=hackadaycom&amp;ref=&amp;feed=1" width="1" height="1" />]]></description>
			<content:encoded><![CDATA[<p><img hspace="4" height="276" width="450" vspace="4" border="0" src="http://hackadaycom.files.wordpress.com/2008/08/had_tid.jpg?w=450&#038;h=276"  alt="" /><br />Popular Mechanics <a href="http://www.popularmechanics.com/technology/industry/4278892.html?page=1">has an interview with [Zach Anderson]</a>, one of the MIT hackers that was temporarily gagged by the MBTA. The interview is essentially a timeline of the events that led up to the <a href="http://www.hackaday.com/2008/08/09/defcon-16-mit-boston-transit-presentation-gagged/">Defcon talk cancellation</a>. [Zach] pointed out a great article by The Tech that <a href="http://www-tech.mit.edu/V128/N30/subwayvulnerabilities.html">covers the vulnerabilities</a>. The mag stripe cards can be easily cloned. The students we&#8217;re also able to increase the value of the card by brute forcing the checksum. There are only 64 possible checksum values, so they made a card for each one. It&#8217;s not graceful, but it works. The card values aren&#8217;t encrypted and there isn&#8217;t an auditing system to check what values should be on the card either. The RFID cards use Mifare classic, which <a href="http://www.hackaday.com/2008/01/01/24c3-mifare-crypto1-rfid-completely-broken/">we know is broken</a>. It was NXP, Mifare&#8217;s manufacturer, that tipped off the MBTA on the actual presentation.</p>
<br /><img alt="" border="0" src="http://feeds.wordpress.com/1.0/categories/hackadaycom.wordpress.com/2493/" /> <img alt="" border="0" src="http://feeds.wordpress.com/1.0/tags/hackadaycom.wordpress.com/2493/" /> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/gocomments/hackadaycom.wordpress.com/2493/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/comments/hackadaycom.wordpress.com/2493/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/godelicious/hackadaycom.wordpress.com/2493/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/delicious/hackadaycom.wordpress.com/2493/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/gofacebook/hackadaycom.wordpress.com/2493/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/facebook/hackadaycom.wordpress.com/2493/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/gotwitter/hackadaycom.wordpress.com/2493/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/twitter/hackadaycom.wordpress.com/2493/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/gostumble/hackadaycom.wordpress.com/2493/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/stumble/hackadaycom.wordpress.com/2493/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/godigg/hackadaycom.wordpress.com/2493/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/digg/hackadaycom.wordpress.com/2493/" /></a> <a rel="nofollow" href="http://feeds.wordpress.com/1.0/goreddit/hackadaycom.wordpress.com/2493/"><img alt="" border="0" src="http://feeds.wordpress.com/1.0/reddit/hackadaycom.wordpress.com/2493/" /></a> <img alt="" border="0" src="http://stats.wordpress.com/b.gif?host=hackaday.com&amp;blog=4779443&amp;post=2493&amp;subd=hackadaycom&amp;ref=&amp;feed=1" width="1" height="1" />]]></content:encoded>
			<wfw:commentRss>http://hackaday.com/2008/08/24/subway-hacker-speaks/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
	
		<media:content url="" medium="image">
			<media:title type="html">RobotSkirts</media:title>
		</media:content>

		<media:content url="http://hackadaycom.files.wordpress.com/2008/08/had_tid.jpg" medium="image" />
	</item>
	</channel>
</rss>
