Security Hacks

1537 Articles

Correct Horse Battery Staple: The Book

February 9, 2017 by 88 Comments

XKCD 936, the comic that introduced the phrase, ‘correct horse battery staple’ into both the lexicon and password dictionaries, is the best way to generate a password. Your passwords should be random phrases of random words, hopefully with a few random numbers or symbols sprinkled about. It’s the most entropy you can get that’s also easy to remember.

However, generating your own ‘correct horse’ password is generally a bad idea. Humans are terrible at coming up with random bits of information. Thankfully, the EFF has come up with a wordlist containing 7,776 random words (65, or five rolls of a six-sided die.) ready for the next time you reset a password.

[m145mcc] thought the EFF’s word list should be a book, so he made it a book. With the clever application of a laser printer, glue, thread, and some card stock, [m145mcc] has a handy password generator that fits in his pocket. All that’s needed to build a password is a single die, a pen, and some patience.

The EFF’s random passphrase list is based off [Arnold Reinhold]’s Diceware list from 1995, but has a few changes to make the list easier to use and more palatable for the audience they’re going for. Most significantly, vulgar words were removed from the Diceware list, as the netsec crowd doesn’t swear as a rule. Additionally, numbers were removed, along with rare and unusual words. The passwords generated by the EFF’s list are longer, but they are arguably more memorable.

Despite the idea of a random dice-based password list being around for two decades, there are few if any examples of this list in dead tree format. The idea of a bound version of this list is a great idea, and we’re glad [m145mcc] could bring it to the table.

Using SDR To Take Control Of Your Home Security System

February 6, 2017 by 5 Comments

[Dan Englender] was working on implementing a home automation and security system, and while his house was teeming with sensors, they used a proprietary protocol which was not supported by the open source system he was trying to implement. The problem with home automation and security systems is the lack of standardization – or rather, the large number of (often incompatible) standards used to ensure consumers get tied in to one specific system. He has shared the result of his efforts at getting the two to talk to each other via his project decode345.

The result enabled him to receive signals from Honeywell’s 5800 series of wireless products and interface them with OpenHAB — a vendor and technology agnostic open source automation software. OpenHAB offers “bindings” that allow a wide variety of systems and hardware to be integrated. Unfortunately for [Dan], this exhaustive list does not yet include support for the (not very popular) 345MHz protocol used by the Honeywell 5800 system, hence his project. Continue reading “Using SDR To Take Control Of Your Home Security System” →

Security camera detecting a human

Motion Detecting Camera Recognizes Humans Using The Cloud

February 6, 2017 by 33 Comments

[Mark West] and his wife had a problem, they’d been getting unwanted guests in their garden. Mark’s solution was to come up with a motion activated security camera system that emails him when a human moves in the garden. That’s right, only a human. And to make things more interesting from a technical standpoint, he does much of the processing in the cloud. He sends the cloud a photo with something moving in it, and he’s sent an email only if it has a human in it.

Continue reading “Motion Detecting Camera Recognizes Humans Using The Cloud” →

33C3: Memory Deduplication, The Hacker’s Friend

February 4, 2017 by 11 Comments

At the 33rd annual Chaos Communications Congress, [Antonio Barresi] and [Erik Bosman] presented not one, not two, but three (3!!) great hacks that were all based on exploiting memory de-duplication in virtual machines. If you’re interested in security, you should definitely watch the talk, embedded below. And grab the slides too. (PDF)

Memory de-duplication is the forbidden fruit for large VM setups — obviously dangerous but so tempting. Imagine that you’re hosting VMs and you notice that many of the machines have the same things in memory at the same time. Maybe we’re all watching the same cat videos. They can save on global memory across the machines by simply storing one copy of the cat video and pointing to the shared memory block from each of the machines that uses it. Notionally separate machines are sharing memory. What could go wrong?

Continue reading “33C3: Memory Deduplication, The Hacker’s Friend” →

Popular Printers Pwned In Prodigious Page Prank

February 4, 2017 by 40 Comments

A new day dawns, and we have another story involving insecure networked devices. This time it is printers of all makes and descriptions that are causing the panic, as people are finding mystery printouts bearing messages such as this:

“Stackoverflowin has returned to his glory, your printer is part of a botnet, the god has returned“

Well that’s it then, you can’t argue with a deity, especially one who has apparently created a botnet from the world’s printing devices. Printer owners the world over are naturally worried about their unexpected arrival, and have appeared on support forums and the like to express their concern.

We are of course used to taking everything our printers tell us at face value. Low on ink? I hear you, my inanimate reprographic friend! But when our printer tells us it’s part of a botnet perhaps it’s time to have a little think. It is entirely possible that someone could assemble a botnet of compromised printers, but in this case we smell a rat. Only in farcical crime dramas do crooks announce their crimes in such a theatrical fashion, you might say it’s the point of a botnet not to be detected by its host. Reading some of the reports it seems that many of the affected systems have port 9100 open to the world, that’s the standard TCP printer port, so it seems much more likely that someone has written a little script that looks for IP addresses with port 9100 open, and trolls them with this message.

The real message here is one with which we expect Hackaday readers will be very familiar, and which we’ve covered before. Many network connected appliances have scant regard for security, and are a relative push-over for an attacker. The solution is relatively straightforward to those of a technical inclination, be aware of which services the devices is exposing, lock down services such as uPNP and close any open ports on your router. Unfortunately these steps are probably beyond many home users, whose routers remain with their default manufacturer’s settings for their entire lives. It’s a shame our printer troll didn’t add a link to basic router security tips.

If you want to have a little fun, some of the printed pages include an email address for ‘the god’. It would be fun to figure out who this is, right?

Jamming WiFi By Jumping On The ACK

February 3, 2017 by 27 Comments

As we fill our airwaves with more and more wirelessly connected devices the question of what could disrupt this systems becomes more and more important. Here’s a particularly interesting example because the proof of concept shows that you don’t need specialized hardware to pull it off. [Bastian Bloessl] found an interesting tweak to previous research that allows an Atheros WiFi card to jam WiFi by obscuring ACK frames.

The WiFi protocol specifies an Acknowledgement Frame (ACK) which is sent by the receiving device after error correction has been performed. It basically says: “yep, I got that data frame and it checks out”. This error correcting process turns out to be the key to [Bastian’s] technique as it provides time for the attack hardware to decide if it’s going to jam the ACK or not.

The jamming technique presented by [Mathy Vanhoef] at the end 2014 outlined both constant and selective jamming. The selective part involved listening for data packets and analyzing them to determine if they are headed to a MAC the attacker wishes to jam. The problem is that by the time your commodity hardware has decoded that address it’s too late to jam the packet. [Bastian] isn’t trying to jam the data frame, he’s jamming the ACK that the receiver sends back. Without that acknowledgement, the sender will not transmit any new data frames as it assumes there is a problem on the receiving end.

Hacking The Aether: How Data Crosses The Air-Gap

February 2, 2017 by 35 Comments

It is incredibly interesting how many parts of a computer system are capable of leaking data in ways that is hard to imagine. Part of securing highly sensitive locations involves securing the computers and networks used in those facilities in order to prevent this. These IT security policies and practices have been evolving and tightening through the years, as malicious actors increasingly target vital infrastructure.

Sometimes, when implementing strong security measures on a vital computer system, a technique called air-gapping is used. Air-gapping is a measure or set of measures to ensure a secure computer is physically isolated from unsecured networks, such as the public Internet or an unsecured local area network. Sometimes it’s just ensuring the computer is off the Internet. But it may mean completely isolating for the computer: removing WiFi cards, cameras, microphones, speakers, CD-ROM drives, USB ports, or whatever can be used to exchange data. In this article I will dive into air-gapped computers, air-gap covert channels, and how attackers might be able to exfiltrate information from such isolated systems.

Continue reading “Hacking The Aether: How Data Crosses The Air-Gap” →