Custom Screensaver On The Non-touch Kindle 4

January 5, 2012 by Mike Szczys 98 Comments

[Kubbur87] put together a guide to replacing the Non-touch Kindle 4 screensavers with your own images. We’ve already seen a way to remove the Special Offers banners from the newest version of Kindle Hardware, this hack lets you use your own 600×800 Portable Network Graphics (.png) file instead of the images pushed to the device by Amazon.

Frankly, we’re shocked at how easy this hack is. [Kubbur87] puts the device into developer mode, enables SSH, and then goes to work on the Linux shell within. It seems the only line of protection is the root password which he somehow acquired.

After the break you’ll find his videos which show how to enable developer mode and how to perform this hack. By putting a file named “ENABLE_DIAGS” with no extension on the device when it is recognized as a USB storage device you’ll gain access to the diagnostic menu system. From there it’s just a matter of cruising that menu to get SSH access. Like we said, you’ll need the root password, that that’s as easy as naming your favorite video game character from the 1980’s.

Continue reading “Custom Screensaver On The Non-touch Kindle 4” →

A Chink In The Armor Of WPA/WPA2 WiFi Security

December 29, 2011 by Mike Szczys 59 Comments

Looks like your WiFi might not be quite as secure as you thought it was. A paper recently published by [Stefan Viehböck] details a security flaw in the supposedly robust WPA/WPA2 WiFi security protocol. It’s not actually that protocol which is the culprit, but an in-built feature called Wi-Fi Protected Setup. This is an additional security protocol that allows you to easily setup network devices like printers without the need to give them the WPA passphrase. [Stephan’s] proof-of-concept allows him to get the WPS pin in 4-10 hours using brute force. Once an attacker has that pin, they can immediately get the WPA passphrase with it. This works even if the passphrase is frequently changed.

Apparently, most WiFi access points not only offer WPS, but have it enabled by default. To further muck up the situation, some hardware settings dashboards offer a disable switch that doesn’t actually do anything!

It looks like [Stephan] wasn’t the only one working on this exploit. [Craig] wrote in to let us know he’s already released software to exploit the hole.

Rooting A Motorola Actv (Android Wristwatch)

December 27, 2011 by Mike Szczys 22 Comments

[Chris’] family made the mistake of giving him a hackable Christmas gift. We’d bet they didn’t see much of him for the rest of the day as he set about rooting this Android wristwatch.

This thing has some pretty powerful hardware under the hood. It’s sporting an OMAP3 processor running at 600 MHz along with 256 MB of RAM. [Chris] needed to get his hands on a firmware image in order to look for security holes. He found a way to spoof the update application in order to intercept an upgrade image from the Internet.

He dumped the firmware locations and got to work searching for a way to exploit the device. Details are a bit scarce about want exactly he did, but you can download his modified image, letting you root your own Motorola Actv using the Android Debug Bridge.

We’ve embedded a demo video after the break. The OS is pretty snappy on the tiny device. We’re not sure what will come of this functionality, but we assume [Chris] was really only interested in the challenge of rooting process itself.

Continue reading “Rooting A Motorola Actv (Android Wristwatch)” →

EFF On Securing Digital Information When Crossing The Border

December 21, 2011 by Mike Szczys 47 Comments

The Electronic Frontier Foundation, long-time defenders of the common man’s rights in the electronic realm, has published a guide to keeping your digital devices private when entering the United States. It seems the defenders of freedom and liberty (ICE, DHS, TSA, and CBP) are able to take a few freedoms with your liberty at a border crossing by seizing your devices and copies of the data they store for up to five days. This requires no suspicion of wrongdoing, and copies of this data may be shared with other agencies thereby negating the five day limit.

Do you have a reason to protect your digital property? This is discussed in the paper. It may be confidential information, by way of a business contract or professional relationship (Doctors, Lawyers, Journalists, etc.). Or you may just want to keep your privacy on principle. No matter what your stance, the EFF has covered all the bases in this intriguing read. We think the best advice they give is to make an encrypted backup of your data on the internet, blank your computer before the border crossing, and restore it when you get to your destination. If you don’t have the data with you, it can’t be compromised. It that’s not an option, they have plenty of guidelines on cryptographic techniques.

Continue reading “EFF On Securing Digital Information When Crossing The Border” →

Keep Others From Snooping In Your Digital Life

December 20, 2011 by Mike Szczys 21 Comments

In our digital age prying eyes are everywhere. The sad thing is that they may even belong to your own government. But no matter who it is, there are some things you can do to keep your private digital devices and content as secure as possible.

The link above goes to [Jerry Whiting’s] discussion on the topic. He’s certainly an interesting speaker, but make sure you’re using headphones at work as the language can be a bit sultry once in a while. He aims the lesson at the Occupy movement, but it’s a fun listen for any conspiracy theorist out there. The topics run the gamut, starting with the specter of physical access, then moving on to protecting your network through traffic analysis and using key pairs. This Security 101 segment comes in two parts (the first one is embedded after the break), each a bit more than thirty minutes. He’s planning to post a second lesson covering hashes and encryption. Continue reading “Keep Others From Snooping In Your Digital Life” →

Hack Removes Ads From Kindle ‘Special Offers’ Hardware

December 20, 2011 by Mike Szczys 52 Comments

We figured it wouldn’t be long before someone figured out how to remove the ads from the ‘Special Offers’ versions of the Amazon Kindle hardware. There are two things that made this obvious to us, the huge flaw that lets code be easily run as root, and the MP3 tag forming that makes it possible to unlock the device.

[Pat Hartl] knows his way around a *nix shell, so once he gained SSH access to the device he started a search for the ad images that make up the special offers feature. He found them in a few different places, making backups of the files in an alternate location, then removing them with some simple commands. He even rolled the process into a one-click installer like the Jailbreak package. It makes us wonder if Amazon has a way to tell if your device is not longer pulling down content for these offers?

At risk of sounding preachy, Amazon does offer this hardware without ads for a one-time fee. Circumventing the unobtrusive ads may lead to higher hardware prices in the future, and [Pat] mentions that. He pulled off this hack to show the holes in Amazon’s security, and hitting them in the pocketbook is a powerful way to do it.

Hackaday itself is ad-supported. We run advertisements that do not use sound, popups, or flashing video effects. Remember to turn off your ad-block for our site in order to show your support. Thanks!

Xbee Remote Sensors Tell You When Someone Enters Your Home

December 18, 2011 by Mike Szczys 13 Comments

[Bill Porter] is helping a friend out by designing a simple security system for her home. It relies on Xbee modules to alert a base station when doors are opened, or a pressure mat is stepped on.

The door sensors are quite simple, and you’re probably already familiar with them. One part mounts to the door and has a magnet in it, the mating part mounts to the jamb and has a reed switch that closes a contact when the magnet is in place. The floor mat uses two sheets of conductive material separated by bits of foam. When it is stepped on a circuit is completed and can be sensed by the Xbee as a button press.

These sensors report back to an Arduino base station that has a buzzer and three 8×8 LED modules to scroll a message saying which sensor was tripped. [Bill] does a good job of showing what goes into configuring an Xbee network if you’ve never worked with the hardware before.

You’ll find his demo video after the break.

Continue reading “Xbee Remote Sensors Tell You When Someone Enters Your Home” →