EFF On Securing Digital Information When Crossing The Border

December 21, 2011 by Mike Szczys 47 Comments

The Electronic Frontier Foundation, long-time defenders of the common man’s rights in the electronic realm, has published a guide to keeping your digital devices private when entering the United States. It seems the defenders of freedom and liberty (ICE, DHS, TSA, and CBP) are able to take a few freedoms with your liberty at a border crossing by seizing your devices and copies of the data they store for up to five days. This requires no suspicion of wrongdoing, and copies of this data may be shared with other agencies thereby negating the five day limit.

Do you have a reason to protect your digital property? This is discussed in the paper. It may be confidential information, by way of a business contract or professional relationship (Doctors, Lawyers, Journalists, etc.). Or you may just want to keep your privacy on principle. No matter what your stance, the EFF has covered all the bases in this intriguing read. We think the best advice they give is to make an encrypted backup of your data on the internet, blank your computer before the border crossing, and restore it when you get to your destination. If you don’t have the data with you, it can’t be compromised. It that’s not an option, they have plenty of guidelines on cryptographic techniques.

Continue reading “EFF On Securing Digital Information When Crossing The Border” →

Keep Others From Snooping In Your Digital Life

December 20, 2011 by Mike Szczys 21 Comments

In our digital age prying eyes are everywhere. The sad thing is that they may even belong to your own government. But no matter who it is, there are some things you can do to keep your private digital devices and content as secure as possible.

The link above goes to [Jerry Whiting’s] discussion on the topic. He’s certainly an interesting speaker, but make sure you’re using headphones at work as the language can be a bit sultry once in a while. He aims the lesson at the Occupy movement, but it’s a fun listen for any conspiracy theorist out there. The topics run the gamut, starting with the specter of physical access, then moving on to protecting your network through traffic analysis and using key pairs. This Security 101 segment comes in two parts (the first one is embedded after the break), each a bit more than thirty minutes. He’s planning to post a second lesson covering hashes and encryption. Continue reading “Keep Others From Snooping In Your Digital Life” →

Hack Removes Ads From Kindle ‘Special Offers’ Hardware

December 20, 2011 by Mike Szczys 52 Comments

We figured it wouldn’t be long before someone figured out how to remove the ads from the ‘Special Offers’ versions of the Amazon Kindle hardware. There are two things that made this obvious to us, the huge flaw that lets code be easily run as root, and the MP3 tag forming that makes it possible to unlock the device.

[Pat Hartl] knows his way around a *nix shell, so once he gained SSH access to the device he started a search for the ad images that make up the special offers feature. He found them in a few different places, making backups of the files in an alternate location, then removing them with some simple commands. He even rolled the process into a one-click installer like the Jailbreak package. It makes us wonder if Amazon has a way to tell if your device is not longer pulling down content for these offers?

At risk of sounding preachy, Amazon does offer this hardware without ads for a one-time fee. Circumventing the unobtrusive ads may lead to higher hardware prices in the future, and [Pat] mentions that. He pulled off this hack to show the holes in Amazon’s security, and hitting them in the pocketbook is a powerful way to do it.

Hackaday itself is ad-supported. We run advertisements that do not use sound, popups, or flashing video effects. Remember to turn off your ad-block for our site in order to show your support. Thanks!

Xbee Remote Sensors Tell You When Someone Enters Your Home

December 18, 2011 by Mike Szczys 13 Comments

[Bill Porter] is helping a friend out by designing a simple security system for her home. It relies on Xbee modules to alert a base station when doors are opened, or a pressure mat is stepped on.

The door sensors are quite simple, and you’re probably already familiar with them. One part mounts to the door and has a magnet in it, the mating part mounts to the jamb and has a reed switch that closes a contact when the magnet is in place. The floor mat uses two sheets of conductive material separated by bits of foam. When it is stepped on a circuit is completed and can be sensed by the Xbee as a button press.

These sensors report back to an Arduino base station that has a buzzer and three 8×8 LED modules to scroll a message saying which sensor was tripped. [Bill] does a good job of showing what goes into configuring an Xbee network if you’ve never worked with the hardware before.

You’ll find his demo video after the break.

Continue reading “Xbee Remote Sensors Tell You When Someone Enters Your Home” →

How The Kindle Touch Jailbreak Was Discovered

December 14, 2011 by Mike Szczys 15 Comments

The Kindle Touch has been rooted! There’s a proof video embedded after the break, but the best part about this discovery is that [Yifan Lu] wrote in-depth about how he discovered and exploited a security hole in the device.

The process begins by getting a dump of the firmware. If you remove the case it’s not hard to find the serial port on the board, which he did. But by that time someone else had already dumped the image and uploaded it. We guess you could say that [Yifan] was shocked by what he found in the disassembly. This a ground-up rewrite compared to past Kindle devices and it seems there’s a lot to be hacked. The bootloader is not locked, but messing around with that is a good way to brick the device. The Javascript, which is the language used for the UI, is not obfuscated and Amazon included many hooks for later plugins. Long story short, hacks for previous Kindles won’t work here, but it should be easy to reverse engineer the software and write new ones.

Gaining access to the device is as easy as injecting some HTML code into the UI. It is then run by the device as root (no kidding!). [Yifan] grabbed an MP3 file, changed its tag information to the HTML attack code, then played the file on the device to exploit the flaw. How long before malicious data from illegally downloaded MP3 files ends up blanking the root file system on one of these?

Continue reading “How The Kindle Touch Jailbreak Was Discovered” →

HDCP Falls To FPGA-based Man-in-the-middle Attack

November 30, 2011 by Mike Nathan 49 Comments

fpga-hdcp-maninthemiddle-attack

It’s been a little while since we talked about HDCP around here, but recent developments in the area of digital content protection are proving very interesting.

You might remember that the Master Key for HDCP encryption was leaked last year, just a short while after Intel said that the protection had been cracked. While Intel admitted that HDCP had been broken, they shrugged off any suggestions that the information could be used to intercept HDCP data streams since they claimed a purpose-built processor would be required to do so. Citing that the process of creating such a component would be extremely cost-prohibitive, Intel hoped to quash interest in the subject, but things didn’t work out quite how they planned.

It seems that researchers in Germany have devised a way to build such a processor on an extremely reasonable budget. To achieve HDCP decryption on the fly, the researchers used a standard off the shelf Digilent Atlys Spartan-6 FPGA development board, which comes complete with HDMI input/output ports for easy access to the video stream in question. While not as cheap as this HDCP workaround we covered a few years ago, their solution should prove to be far more flexible than hard wiring an HDMI cable to your television’s mainboard.

The team claims that while their man-in-the-middle attack is effective and undetectable, it will be of little practical use to pirates. While we are aware that HDMI data streams generate a ton of data, this sort of talking in absolutes makes us laugh, as it often seems to backfire in the long run.

[via Tom’s Hardware]

Researchers Claim That HP Laser Printers Can Be Hijacked To Steal Data And Catch Fire

November 30, 2011 by Mike Nathan 36 Comments

hp-laserprinter-security-holes

The news was abuzz yesterday with coverage of a study released by Columbia University researchers warning consumers that HP laser printers are wide open to remote tampering and hacking. The researchers claim that the vast majority of printers from HP’s LaserJet line accept firmware updates without checking for any sort of digital authentication, allowing malicious users to abuse the machines remotely. The researchers go so far as to claim that modified firmware can be used to overheat the printer’s fuser, causing fires, to send sensitive documents to criminals, and even force the printers to become part of a botnet.

Officials at HP were quick to counter the claims, stating that all models built in 2009 and beyond require firmware to be digitally signed. Additionally, they say that all of the brand’s laser printers are armed with a thermal cutoff switch which would mitigate the fuser attack vector before any real fire risk would present itself. Despite HP’s statements, the researchers stand by their claims, asserting that vulnerable printers are still available for purchase at major office supply stores.

While most external attacks can easily be prevented with the use of a firewall, the fact that these printers accept unsigned firmware is undoubtedly an interesting one. We are curious to see if these revelations inspire anyone to create their own homebrew LaserJet firmware with advanced capabilities (and low toner warning overrides), or if this all simply fizzles out after a few weeks.