FON hit the news recently because it acquired some venture capital from Google and Skype. Its goal is to create a global network of access points run by home users. The users can either offer access for free or resell their bandwidth. The actual FON software is based on DD-WRT, a Linux based firmware for the Linksys WRT54G wireless router and others. DD-WRT features a captive portal, QoS, and many additional features. FON is selling 3,000 routers with their software pre-installed for 25USD/EUR plus shipping. This is a great way to pick up a WRT without paying Linksys’s Linux penalty and it comes with a great firmware already installed. Oh, unless you have broadband from a friendly company like Speakeasy, becoming a fonero is probably a violation of your “terms of service”.

Continue reading “FON Or How To Get A Cheap Linksys WRT54G” →

Well, we’ve come to the end of my Shmoocon 2006 coverage. The conference wasn’t all presentations though, there were a lot of other fun activities:

The Hacker Arcade featured arcade games that had been modified to generate USB tokens that you could later redeem for prizes. The folks at 757.org modified a skill crane so that it could be controlled from the web. Of course, toys like this at a hacker convention spawned some creative solutions. David Rhodes scripted the skill crane’s web interface so that it would try every possible coordinate pair and ended up with an armful of prizes. Another attendee discovered that the USB tokens weren’t case sensitive and generated a couple hundred thousand prize tokens.

Hack or Halo was different from your standard tournament. You could take the other team on in either Halo 2 or drag race hacking. From what I heard it’s pretty easy to get up to speed and be competitive, just know your way around a sniffer, Metasploit, and an energy sword and you’ll be good to go.

Grey Frequency managed to find all twenty different conference badge outlines needed to make a fully interlocking set. Shmooballs were handed out to attendees so that they could physically manifest their disagreement with the speaker; speakers were given paddles. During the closing ceremony a t-shirt cannon was brought out to help distribute swag.

I’d like to thank The Shmoo Group for putting together an excellent conference, the boys from Midnight Research Labs for keeping things interesting when I wasn’t in talks, and atlas, RenderMan, Jason Scott, Abend and all the other speakers who have stopped by to leave comments on Hack-A-Day.

Continue reading “Shmoocon 2006: Wrap-up” →

David Hulton (h1kari) talked about the implications of cardbus bus-mastering. It goes pretty much hand-in-hand with David Maynor’s USB direct memory access work. The idea is using bus-mastering to take over other PCI devices, download passwords and keys from memory, unlock screensavers, and plant memory-based or firmware-based trojans. So, what kind of device could do all this? David works for Pico Computing which is developing cardbus based FPGAs. They’re pretty cool little devices and for dedicated tasks like brute force cracking they’re really efficient. Check out OpenCiphers for details on using FPGAs with modern cryptography. Unfortunately h1kari didn’t have a demo, but David Maynor was there to talk about his USB stuff. An interesting tidbit was what USB device he used for his exploration: a Motorola MPx200. It was released before the USB 2.0 spec was finalized so the phone was designed to have its USB firmware upgraded, handy for hacking.

Continue reading “Shmoocon 2006: Cardbus Bus-Mastering: 0wning The Laptop” →