You’ve no doubt heard that the site hosting Metasploit, the exploit framework, was hacked earlier this week, but what you may not have heard is that it was done using a layer 2 attack. Though Metasploit.com was not actually cracked, a server on the same VLAN was compromised and used to ARP poison the gateway. ARP poisoning is a method of sniffing data by sending a false ARP message to an Ethernet router to associate the hacker’s MAC address with a valid IP address from a genuine network node. From there the hackers were able to mount their MITM attack and show the image above instead of Metasploit’s website. This problem could have been avoided if the ISP was using fixed ARP entries, which is what [HD Moore] had to do to get the site back online. [Richard Bejtlich] points out that even though most people have been focusing on application security lately, fundamental attacks like this still happen. If you’re doing a good job protecting yourself, you can still be at the mercy of the security of 3rd parties when operating in shared hosting environments.
News3729 Articles
Using Multiple Browsers For Security
[Rich] over at Securosis takes us through some of his browser paranoia exercises. He uses different browser profiles for different types of web activities. Based on potential risk, various tasks are separated to protect from CSRF attacks and more. Everyday browsing with low risk passwords is done in one. RSS reading with no passwords is done in another. He runs his personal blog in a browser dedicated just to that.
For high risk research, he uses virtual machines to further minimize any potential nasty code getting through. Very high risk sites are browsed through a non-persistent read-only Linux virtual machine. While these techniques can be less effective if the entire OS is comprised, they can still provide a few layers of additional security.
Fellow browser paranoia sufferers may want to consider Firefox plug-ins like NoScript and memory protection from Diehard.
Creeping Wave Antenna
Monitoring medical patients remotely 24 hours a day has always proven to be a difficult proposition due the size of the wireless sensors attached to the patient’s body to relay vital signs. A team from Queen’s University Belfast has come up with a solution that utilizes the creeping wave effect. The effect applies to electromagnetic waves as they come into contact with solid objects. While the majority of the waves are absorbed by the object, a small amount move along the surface of the object before they continue their path.
Since most of the signal sent by conventional biosensors is absorbed by the patient’s body, the signal must be strong enough to compensate. The antennas designed by the Queen’s University team, though, focus their broadcast laterally instead of inward and outward, maximizing the amount of waves that will travel along patients’ bodies via the creeping wave effect and minimizing the amount that are absorbed. These antennas are up to 50 times as efficient as conventional antennas of the same size, broadcasting a stronger signal with less power.
The applications to the wireless body area networking, attaching multiple biosensors to patients’ bodies, field are obvious, but this technology could be used in other ways. Since the creeping wave antenna is small and wearable, it could conceivably be used to boost low power communication to PDAs, cellphones, or any other portable wireless product.
[via Medgadget]
Flying Manta Ray Blimp
German engineering firm Festo has created this flying manta ray. Dubbed the Air_ray, it’s a balloon made of an aluminum-vaporised “PET foil”. Inflated with helium, the Air_ray’s propulsion system is a flapping wing drive. Each wing has alternating pressure and tension flanks that are attached to an internal set of ribs. The flanks are connected to a remotely controlled servo motor. When pressure is applied to either of the flanks, the wing bends in the opposite direction. By alternating pressure on the flanks, the wings beat. The servos are powered by two 8V LiPo accumulator cells.
The total weight of the Air_ray including the balloon, propulsion system, power supply, and helium is 1.6Kg. Festo has more specs in this PDF.
[via Neatorama]
Recent News Followup
Last week we talked about a single rumored arrest over the OiNK torrent tracker. Since then, there’s been a confirmed report of 6 arrests. The arrests appear to be the result of users uploading pre-release music to the now defunct site. For some time, police have had access to the OiNK user records minus the passwords which are thought to be stored as a salted MD5 hash. It seems British authorities can force these individuals to reveal passwords under something called the Regulation of Investigatory Powers Act.
The Phoenix Mars Lander (pictured above) has found what might be a large piece of ice directly underneath it. This week the lander will scoop up a sample, melt its contents and test the various gases it releases. Twitter users can watch the mission’s progress in semi real time by following the MarsPhonix account. Lastly it looks like the official website for this mission was defaced through a SQL injection attack.
We already reported the world’s largest GPS drawing as a hoax. It has however inspired a few to look closer at the concept of position based art and others have already created authentic works. Our friends over at BoingBoing even made a little flash application to create your own “Unimpressive GPS Art“. Upon hearing of the hoax we were quick to draw up a brand new proposal for DHL using Google maps.
This Week In (our) History
Time to look way back into the Hackaday archives, well back to 2005 at least. This is a new feature to follow up and revisit some of our favorite projects of the past. Our first installment includes the week of May 24-31 2005.
Pictured above we see one of the amazing cable braiding machines from UK based Cobra Machinery. This link was found on a post about creating your own high end speaker wires from cat5 cable. At the time we hoped to find a DIY braiding machine. No such luck today but we did come across and interesting site in the process. diyAudoProjects has a ton of great how to guides for all things audio. They even have a few walkthroughs for creating your own speaker wires.
We looked at the robotic dexterous hand from The Shadow Robot Company. Browsing through their high rez image gallery its pretty clear to see the product has been progressing nicely: 24 degrees of freedom complete with force feedback and a GPL based software package.
Three years ago we covered the Nokia 770 internet appliance and it’s upcoming SDK. The device has now been replaced by the Nokia N810 (pictured on the right). However, open source support from Nokia has continued to develop. We found a blog from software developer Ari Jaaksi where he talks about Nokia’s involvement in the community. Recently he discussed the latest news from MAEMO, the platform used for open source development of Nokia internet tablets and other Linux-based devices.
Nanobot Nanosoccer
Medgadget recently published a post about a soccer competition for nanobots at RoboCup. The nanobots compete on a field that measures 1500 by 2500 micrometers with goals on the long sides jutting 500 micrometers out. Like normal soccer athletes, the nanobot teams attempt to push the ball – in this case, a silicon dioxide disc with a 50 micrometer diameter – into the goal. The nanobot competitors are monitored by an optical microscope and are remotely controlled by magnetic signals sent across the arena.
The National Institute of Standards and Technology (NIST) and RoboCup have already held two nanobot competitions in the last year. Nanobots made by different teams from various universities compete to test various abilities that will be critical for their practical applications in medicine, manufacturing, and other industries.
Though it is referred to as nanosoccer, the competition is actually a triathlon. The bots must sprint to the goal with the ball in one event, then maneuver the ball around stationary “defenders” and into the goal in the next event, and finally score as many goals as possible within 3 minutes. NIST and RoboCup hope to show the practical potential of nanobots with this competition and have a little fun in the process.
[via Medgadget]
