Homeland Security Issues Policy On Laptop Seizures

August 7, 2008 by 40 Comments


The US Department of Homeland Security recently disclosed a new policy that allows agents to seize laptops, or anything capable of storing information, “for a reasonable period of time”. Okay, so this seems normal; A government agency is declaring they may confiscate personal property. However, the strange part of this story is that under this policy, federal agents can confiscate these things without any suspicion of wrong doing or any reason what so ever. So what happens to your personal data after they seize your laptop? Apparently they share the data with federal agencies, and in some cases the private sector, as additional services such as file decryption or translation are needed. While this may seem like a major violation of privacy, it is important to note that this policy only applies to people entering the United States. However given the direction that our federal government is moving in the area of security, it wouldn’t surprise me if this policy will soon apply for domestic flights as well.

[photo: postmodern sleaze]

[via eff.org]

Hacking Pleo For Face Recognition And Remote Control

August 7, 2008 by 4 Comments


GRIP, the Group for Interdisciplinary Psychology at the University of Bamberg have put together a couple tutorials on hacking the Pleo. For those unfamiliar, the Pleo is a small robot shaped like a dinosaur. Their goal was to make it cute and simulate emotion at a higher level than previously attained by consumer robots. Ugobe, the makers of Pleo encourage hacking of the unit and the controlling software. Look at the “developers” area of their site to download all kinds of tools to work on your Pleo.

The two tutorials released by GRIP cover adding wireless communication with a PC and adding a higher resolution camera to the unit. The goal was to make the platform capable of doing facial recognition.

Continue reading “Hacking Pleo For Face Recognition And Remote Control” →

Black Hat 2008: Pwnie Award Ceremony

August 6, 2008 by 9 Comments


The first night of Black Hat briefings concluded with the Pwnie Award Ceremony. The awards reward achievements in security… but mostly failures. Notably, this was the first year anyone accepted an award in person. Hack a Day took home an early victory by producing a MacBook mini-DVI to VGA adapter (pictured above). The ceremony was fairly straight forward after that. Best Server-Side Bug went to the Windows IGMP kernel vulnerability. It was a remote kernel code execution exploit in the default Windows firewall. The Best Client-Side Bug went to Multiple URL protocol handling flaws like this URI exploit. Mass 0wnage went to WordPress for many many vulnerabilities. Most Innovative Research went to the Cold Boot Attack team. Lamest Vendor Response was won by McAfee for saying XSS can’t be used to hack a server. The Most Overhyped Bug went to [Dan Kaminsky] for his DNS vulnerability. Most Epic FAIL was won by the team behind Debian for shipping the OpenSSL bug for two solid years. Lifetime Achievement Award was won by [Tim Newsham]. Finally, the Best Song was by Kaspersky Labs for Packin’ The K!, which you can find embedded below.

Continue reading “Black Hat 2008: Pwnie Award Ceremony” →

Black Hat 2008: FasTrak Toll System Completely Broken

August 6, 2008 by 35 Comments


FasTrak is the electronic toll collection system used by the state of California. Motorists can purchase a toll transponder for ~$26 and link the serial number with a debit account to have their tolls deducted automatically. Today at Black Hat in Las Vegas, security researcher [Nate Lawson] presented not just the privacy problems with FasTrak, but why absolutely no transaction from the tag should be trusted.

Continue reading “Black Hat 2008: FasTrak Toll System Completely Broken” →

Black Hat 2008: Dan Kaminsky Releases DNS Information

August 6, 2008 by No comments


[Dan Kaminsky]’s much anticipated talk on his DNS findings finally happened at Black Hat 2008 in Las Vegas today. [Dan] has already uploaded the complete slides from his talk as well as posted a short summary to his site. New information in the slides since our previous coverage includes “Forgot My Password” attacks and new attacks on internal network vulnerabilities as a side of effect of DNS cache poisoning. [Dan]’s talk today was over capacity; our shot of the conference room overflow is shown above.

Black Hat 2008: EFF Coders’ Rights Project Announced

August 6, 2008 by No comments

The EFF has just announce the creation of the Coders’ Rights Project website at the Black Hat conference. The sites’ main goal is to centralize legal information for coders, and to help protect important security work from legal actions that may be taken against them with the DMCA and other legal black holes. While this is in no way a fully comprehensive list of everything you need to know, it looks like a good place to start, and provides a few FAQs for suggestions on how to stay in the legal clear as much as possible. At numerous points the documents suggest you speak with a lawyer, if you have any deeper questions, which you absolutely should. This can be very helpful if a person or group finds a security risk, and wants to publish it, or just wants to start looking into possible security risks.

Hybrid Headphone Amplifier

August 6, 2008 by 4 Comments


[Rogers Gomez] has posted up this hybrid tube based headphone amplifier over at DIY Audio. Being a fan of tube amplifiers, but wanting something with lower voltage and lower cost, he put together this little system out of spare parts he had lying around. He wanted it to have as few parts as possible and be able to power his 32 ohm Grado headphones.

He states that he’d built several YAHA amps, and a Szekeres Mosfet follower and was curious how they’d sound together. He was pleasantly surprised with the resulting quality.

There are less than 30 individual components involved in the project. The complete parts list and schematics are available from the site. He notes at the very end, to unplug your headphones when powering up as there is a surge that could damage them. That might be good to know at the beginning just in case you get eager to test it out.

[Thanks, Gio]