Tracking A Stolen Laptop Triggers A Drug Bust

September 1, 2012 by Caleb Kraft 52 Comments

When then folks from the MakerShed had a laptop and iPad stolen from their vehicle in Detroit, they found out several important things.

The Detroit police have more important things to pursue.
Tracking services are awesome.
You never know how your adventure will end.

Luckily they were using an online backup system that offered location services as well. While many may disable these prying eyes as a matter of principle when they join, this is one scenario where you’d be happy you had it.

As it turns out, the Detroit police were fairly busy with other things and left the laptop owners to their own devices tracking the stolen goods via the internet. Some fun and interesting detective work involving Google maps, craigslist, and backed up images ended up leading them to the stolen goods.

Once they had a physical address, the police were available to check things out… well, a few days later. When they went to the address with a search warrant… and a battering ram, they found the house lacking tenants, but containing several forms of ID, a stolen laptop, and some Marijuana meant for distribution.

The entire story is interesting, especially the fact that the amateur detective work was capable of providing enough information for a search warrant. This actually makes me wonder how easily one could fabricate all of this information falsely to cause trouble to an innocent person. It looks like it would only take about 15 minutes and some photoshop. Maybe that’s a conversation best left for another time.

Knock Lock Balks Knock, Uses CapSense Without Shock

August 6, 2012 by Brian Benchoff 42 Comments

[Rob Hemsley] sent in an update to an RFID-based door lock. Previously, if you wanted to enter the MIT media lab, a RFID-enabled card was required to get in. Now, with [Rob]’s update, you only need to tap the door handle in a ‘secret’ pattern.

The earlier RFID-enabled build used about $80 in hardware, not a very economical solution. The new touch-based solution only uses an Arduino and servo, making the build much cheaper.

The touch sensitive lock uses the CapSense Arduino library. By turning the door handle into a touch sensor, [Rob] allowed a secret code to be saved in the EEPROM. Repeating this sequence when the door is locked sends power to the servo, unlocking the door.

A very cool build that’s also a little more secure than the traditional, audible knock lock. Check out the video after the break.

Continue reading “Knock Lock Balks Knock, Uses CapSense Without Shock” →

Home Security Anyone Can Build And Install

August 2, 2012 by Mike Szczys 9 Comments

We’ve been seeing quite a few home security hacks around here lately and we think they’re a lot of fun. This is one that we missed a few weeks ago. [Sharpk] used his existing home security system as inspiration for a completely DIY security system. Above you can see the tiny models he used to help visualize how the system would be installed.

The board at the center is a JeeNode, a development board that pairs an ATmega328 with a wireless module. There are three magnetic door sensors which you can easily find at the home, hardware, or electronics store around the corner. They’re basically a reed switch and a magnet; one mounts on the door, the other on the jamb. There is also a panic button and a PIR motion sensor. [Sharpk] has even been working on a UI for the system. He crafted a 3D model of his home’s floor plan in SketchUp and uses it to indicate which part of the system has been triggered.

Now he just needs to add a keypad for arming and disarming the system.

Getting Connected With Your Home Security System

July 30, 2012 by Mike Szczys 24 Comments

This simple device, paired with some creating code will let you become your own home security monitoring service. It’s called the PhantomLink and [Adam] started the project as a commercial venture. He recently decided to go open source with the hardware and will soon be posting a guide on how to program your own web interface too.

We just looked in on a project which takes control of a security panel using an Arduino. The PhantomLink is focused on not just reusing the input hardware, but monitoring the whole system. It sounds like several different protocols are supported.

The DB9 jack is intended for use with an adapter you can wire yourself. Basically just tap into the terminal block on the alarm controller for your house, then route those connections to the proper pins. A PIC 12F683 monitors the alarm system, pushing data via the WiFi module mounted on the board. With that web connection you can do anything you want by catching and formatting the data.

Bending A Home Security Control Panel To Your Will

July 27, 2012 by Mike Szczys 35 Comments

Does your home have a security system but you don’t subscribe to the monitoring service to make it work? Rip that baby off of the wall and do something with it, or just build your own system around it. If you have a DSC PC1500RK control panel [CaitSith2] shows us how easy it is to control the buttons, LEDs, and buzzer. If you’ve got a different model this is still a good jumping off point to start your own reverse engineering.

There are only four connections that need to be made. [CaitSith2] is using an Arduino for the demonstration. He connected the red wire to voltage, the black wire to ground, the yellow wire (clock) to digital pin 3 and the green wire (data) to digital pin 2. A communication cycle starts by setting the data line high, then clocking out eight bits to capture keypresses. 16-bits are then clocked in to set the LEDs and drive the buzzer. This is shown in the video after the break as well as documented in his sample code. We’ve embedded the sketch after the break to preserve it in case the pastebin code goes missing in the future.

Continue reading “Bending A Home Security Control Panel To Your Will” →

Arduino, Resistor, And Barrel Plug Lay Waste To Millions Of Hotel Locks

July 25, 2012 by Mike Szczys 63 Comments

The security flaws on this common hotel keycard lock are nothing short of face-palmingly stupid. Look closely at the picture above. This is a hotel room door swinging open. The device he holds in his hand is an Arduino connected to the OUTSIDE portion of the door lock. It takes approximately 200 milliseconds from the time an attacker plugs the device in, until the door can be opened. Yes, in less than 1/4 of one second an Arduino can open any of the millions of these locks in service.

The exploit in Onity programmable keycard locks was revealed by [Cody Brocious] at the Blackhat conference. Apparently the DC barrel jack on the outside of the lock serves as a one-wire protocol interface. Once communications are established a 32-bit sitecode can be read from any of the locks and immediately used to open the door. There is no authentication or encryption used to obfuscate this kind of attack. To make matters worse, you can even read out master key and skeleton key codes. These codes facilitate ‘magic’ keys used to open a variety of different doors through the system.

We’re no strangers to easy hotel beak-ins. But how can a digital lock possibly be sold with this type of vulnerability present? Really!?

Here’s the white paper on the exploit as well as the slides from his talk (PDF).

[via Reddit]

Power Pwn’s Price Tag Is As Dangerous As It’s Black-hat Uses

July 22, 2012 by Mike Szczys 45 Comments

This rather normal-looking power strip hides a secret inside. It’s called the Power Pwn, and it conceals hardware which facilitates remote penetration testing of a network. It really is the ultimate in drop hardware as you can quickly swap it with existing power strip. Who’s going to question it?

It’s got almost all the bells and whistles. There’s dual Ethernet ports, Bluetooth with 1000′ range, and WiFi with a high gain antenna. The SoC inside comes with Debian 6 and all the exploit tools you might want pre-loaded. There’s even a 3G adapter, but it’s external and not pictured above. The thing is, for a pre-order price-tag of $1,295 we think that 3G should have been internalized and come with a lifetime unlimited data plan! That could be a bit overboard… our heads are still spinning from the sticker shock.

This isn’t the first time we’ve seen hardware from this company. Their Pwn Plug was used in this project. We just didn’t catch the $595 price tag for that device until now.

[via Reddit via Zdnet]