Major DNS Issue Causes Multivendor Patch Day

July 8, 2008 by 5 Comments


Earlier this year, our friend [Dan Kaminsky] discovered a major DNS issue that could allow hackers to compromise name servers and clients easily. The vulnerability involves cache poisoning, and [Kaminsky] plans to publish the full details of the vulnerability on August 6th. However, he has already begun his work to control it, alerting major authorities early on of the vulnerability.

As a result, engineers from many major technology vendors quickly began working on coordinated patches for DNS servers. The patches were all released today; vendors and a CERT advisory urge organizations to apply them today, before the vulnerability becomes common knowledge. More details on the DNS issue can be found in the executive overview (PDF file). [Rich Mogull] interviewed [Dan] for the Network Security Podcast. It doesn’t detail the attack but points out that services that use port randomization like OpenDNS are unaffected and that Bind8 is being deprecated.

UPDATE: Here’s the audio from this morning’s press conference.

[image: Flickr / d70focus ]

Pedal Powered Panzer Tank Built For Crashing Parties

July 8, 2008 by 6 Comments


A group from Philadelphia PA calling themselves Team pzkpfw decided to recreate a Panzerkampfwagen III, but not entirely according to the original specs. Instead of treads and an engine, they used a system of pedals, gears and chains powered by up to six riders. The team of roughly nine men spent eleven days welding beams and plates, drilling and shaping sprockets, and painting the tank a fearsome pink camouflage. They were planning on crashing the 2nd annual Kensington Kinetic Sculpture Derby with it, which they crashed last year in a pirate ship, but they ended up being too tired from their tooling around to actually do it. There’s always next year. Get a look at their promotional video after the break, or if you’ll be in the Philly area soon, “visit the tank on Frankford Ave, just north of Norris St in Philadelphia.”

Continue reading “Pedal Powered Panzer Tank Built For Crashing Parties” →

Aurora Open Source Hardware Mixer

July 8, 2008 by 11 Comments


We’ve seen some fairly impressive mixer projects this year, and the Aurora mixer is no exception. It is a dual channel USB-powered mixer with two linear faders, one crossfader, eight backlit buttons and 24 potentiometers, all built around a PIC 18LF4525 microcontroller. That’s all pretty typical for a mixer, but this one is very visually attractive, featuring a clean and stylish form factor and controllable lighting both under the board and in the LEDs backlighting the buttons and knobs.

Whether you want to buy one now or build one yourself, the Aurora team has made both possible. You can contact them for pricing if you are ready to buy. If you prefer to build, this is an open source project with full assembly instructions, schematics, drivers, patches and all other source code and information you should need available here. See more photos of the Aurora mixer here, or see it in action after the break.

Continue reading “Aurora Open Source Hardware Mixer” →

Grizzly Suit Up For Auction

July 7, 2008 by 5 Comments

Do you have a burning desire to fight grizzly bears? If you do, We can’t guarantee that the first bear you face will win, but we really can’t imagine another outcome unless you use [Troy Hurtubise]’s Mk IV suit, which is currently up for auction. We have discussed the suit before along with several other high-tech power suits, but this is the only one with bear-resistance in mind. The suit features several safety features, including layers of chainmail and titanium.The suit was also featured in the film “Project Grizzly.” [Hurtubise] is hoping to sell the suit for $40,000 or more to offset his personal costs, and judging by the current price, he may well make it.

[via Engadget]

Wii Nunchuck Used For Mocap On 3D Studio Max

July 7, 2008 by 6 Comments


If you’ve been looking for a cheap way to do motion capture on 3D Studio Max, [melka] has devised an ingenious way to do mocap using a Wii nunchuck. As shown in his Vimeo video, the nunchuck is connected to an Arduino that feeds MIDI data to a computer running the MIDI app Ableton Live. Ableton Live feeds that data to 3D Studio Max via MIDI Yoke.

The video below the break shows that the motion of the nunchuck can be seen in real time in the 3D Studio Max Window. We’re really hoping [melka] will post a writeup of this project soon, as we are hungry for more details.

Continue reading “Wii Nunchuck Used For Mocap On 3D Studio Max” →

Black Hat Hackers Face Off In Iron Chef Style Competition

July 7, 2008 by 1 Comment


Which is a better method for finding vulnerabilities, fuzzing or static-code analysis? The question will be put to the test at next month’s Black Hat USA conference, where two experienced hackers security researchers will be given a piece of mystery code and one hour to find all the vulnerabilities they can using one of the two methods. [Charlie Miller] from Independent Security Evaluators will use fuzzing and [Sean Fay] from Fortify Software will use static-code analysis to detect the vulnerabilities in the code. We reported on [Miller]’s fuzzing talk while at Toorcon 9.

The pair will be allowed to use their own equipment, but they won’t see the code until the moment the showdown begins. For an added bit of fun, conference attendees are welcome to join in the contest. The audience member who finds the most exploits within the hour wins a free dinner at a new Las Vegas restaurant. But you don’t have to wait until then to weigh in; go ahead and post your thoughts on fuzzing vs. static-code analysis in the comments, just be ready to back up your claims.