UPDATE: Slides

Dan Kaminsky was wondering most of the weekend what I would post about Toorcon. If there’s one thing I learned it is this: Dan Kaminsky is nuts. The future projects and other theory that comes out of his mouth is awesome. I had a great time hanging out with him. His talk was similar to the one from this year’s Blackhat (slides here).

Dan started by discussing the breaking of MD5. In ’96 MD5 was theoretically broken and in ’04 two example “vectors” were released with the same MD5. Many denied that this was a problem since it was just a “toy” case so Dan set out to implement it. Once there is a collision anything appended to the vectors will also collide. Browsers are really good about attempting to render anything they’re given no matter how full of crap it is, this is the Geocities feature. Dan’s demo takes two web pages, appends a bunch of crap to both and uses Javascript to maintain the look of the original. The end result is two webpages with the same MD5.

He also covered fragmentation attacks to bypass IDS, his massive scanning project and visualizing the resulting data.

Continue reading “TC7 Day 2 – Black Ops 2005” →

UPDATE: Slides

Major Malfunction’s infrared hacking is considered a “must-see” talk. His interest in IR was piqued when he bought a new car and could no longer replay the IR remote code with his Palm III to unlock the doors. So he started investigating rolling code remotes and other IR based devices. Modern hotels usually have the room services system built into the tv. Maintenance and house keeping can use specialized remotes to perform administrative functions. There is no security so you just need to find the specialized codes. He read one code and found out it was 14bits. It would take nine hours to check all possible codes by hand. Of course not all 16,384 possible codes do something. Major took the “ON” code, started flipping bits and testing to see if the code still worked. If it still works it means the bit is ignored. It turned out that only 10bits were actually being used. Testing that many codes only takes 35 minutes. Once completed you can do things like modifying your room bill or someone else’s even view all of the pay-per-view movies. The “read” link goes to a recent Wired interview.

Continue reading “TC7 Day 2 – Old Skewl Hacking – Infrared” →

UPDATE: Slides

Sysmin & QuiGon of the Hacker Pimps presented their new FairuzaWRT firmware for the WRT54GS. They started with the OpenWRT firmware and added packages to make it useful as a penetration tester. Tools were added to mount NFS and Windows shares. Several exploits are included as well. The FairuzaUS shell script ties everything together by providing a simple frontend for changing NVRAM settings and launching the attack tools.

Continue reading “TC7 Day 2 – Hacking WRT54GS And Custom Firmware” →

UPDATE: Slides

This was probably my favorite talk at the conference and I hadn’t even planned on going till someone pointed out what bunnie’s previous work was. There are a couple reasons why bunnie enjoys reverse engineering silicon: It is constrained by physics, silicon is hard enough to design before thinking about security, and the chips have to be reverse engineered during the production process. He has a really interesting example on his blog of how he hacked the PIC18F1320 which will give you a good overview of the process.

Continue reading “TC7 Day 2 – Hacking Silicon: Secrets Behind The Epoxy Curtain” →

Apparently when Jason Spence isn’t reading Hack-A-Day he is reading manufacturer data sheets. He’s fun in real life; I swear. The talk started with an overview of motherboard architecture. By studying manufacturer data sheets you can figure out a pathway to attack the BIOS. A proof of concept BIOS backdoor has already been developed. This is a very scary situation since the OS isn’t even loaded yet and will be completely blind once it is up. Jason pointed out that smaller manufactures (VIA, SIS) don’t publish data sheets fearing patent infringement. This lack of information makes security a lot harder to pull off. Jason says he’ll be contributing a couple articles in the future.

UPDATE: Jason has posted his uncensored slides.
UPDATE: Slides on the Toorcon site.

Continue reading “TC7 Day 2 – Hiding Behind Antiquity” →

UPDATE: Slides

The Shmoo group (Beetle pictured, blurry in real life) presented phishing using rogue access points. The demo showed a rogue access point serving pages and gathering usernames and passwords as they came in. This could become a real problem in areas where there is heavy demand for wireless access like airports. With an EVDO card you could be the only AP in the area. They are developing user tools to watch the the local wireless infrastructure and warn you when things are going pear shaped and it is really unsafe to connect in that area.

Continue reading “TC7 Day 1 – 802.11 Bait: Badass Tackle For Wireless Phishing” →