Stripping DRM From OverDrive Media Console EBooks

June 7, 2011 by Mike Nathan 18 Comments

stripping_drm_from_overdrive_media_center_ebooks

[Armin Tamzarian’s] local library recently started lending eBooks via the OverDrive Media Console system. He checked out a couple of books, which got him thinking about how the copy protection scheme was implemented. He wondered what recourse users had if they wanted to view a book they have already checked out on a different, or unsupported piece of hardware.

His research centers around Adobe’s ADEPT digital rights management scheme, which is used to protect the books offered on loan by OverDrive. The topic is broken down into three parts, starting with an introduction to the EPUB file structure, the OverDrive Media Console, as well as the aforementioned ADEPT DRM scheme.

The second part takes a close look at the OverDrive Media Console itself, where he uses the ineptkey and ineptepub utilities written by [I♥CABBAGES] to pull the RSA cipher keys from the EPUB data he uncovered. When he then tries to strip the ADEPT DRM layer from his books however, he discovers that OverDrive is using a non-compliant version of the ADEPT standard, which renders existing tools useless.

The final part of [Armin’s] discussion digs even deeper into the OverDrive Console’s inner workings, where he finds that the OverDrive Media Console stores quite a bit of information in an SQLite database. After a bit of digging, he finds all the data he needs to strip the DRM from his books. [Armin] also took the time to wrap all of his findings up into a neat little tool called OMCStrip, which as you may have guessed, strips the DRM from ADEPT-protected eBooks with ease.

GPU Password Cracking Made Easy

June 1, 2011 by Mike Szczys 37 Comments

The power that a Graphics Processing Unit presents can be harnessed to do some dirty work when trying to crack passwords. [Vijay] took a look at some of the options out there for cracking passwords and found that utilizing the GPU produces the correct password in a fraction of the time. On a Windows machine he pitted the Cain password recovery tool which uses the CPU for its calculations against ighashgpu which uses ATI or Nvidia graphics cards to do the deed. Hands down ighashgpu is the fastest; with Cain taking about one year to crack an eight character password while ighashgpu can do it in under nineteen hours.

We were very interested to see how easy it is to use this package. We looked in on GPU cracking in September but didn’t focus on the software packages that are out there. Now that you know how easily your password can be unearthed perhaps you will get some use out of this article discussing the usability and security of longer passwords which we ran across over on Reddit.

A Keygen For The Real World

May 31, 2011 by Mike Nathan 39 Comments

key_generator

[Nirav] found that he rarely printed anything useful with his RepRap, so to shake things up, he decided he needed to work on a project that didn’t involve printing yet more RepRap parts.

The goal of his project was to create working replicas of house keys by simply using the code imprinted at the factory. He purchased a handful of used lock sets from eBay, then carefully measured the keys with a ruler and calipers to get the blank dimensions just right. After that was done, he looked around online and was eventually able to create an OpenSCAD model using a chart of pin depth specifications he located. By changing the last line in the model’s code he can print any coded key. For keys lacking a code, he can manually measure the height of each bit and print replicas that way as well. Once printed, he says that they keys are strong enough to turn most locks he has come across, including deadbolts.

This is undoubtedly a neat project in its own right, though we would be interested to see if someone could get it paired with a program like SNEAKEY to generate bit measurements by sight alone.

Reverse Engineering Embedded Device Firmware

May 30, 2011 by Mike Nathan 17 Comments

While not necessarily an easy thing to learn, the ability to reverse engineer embedded device firmware is an incredibly useful skill. Reverse engineering firmware allows you to analyze a device for bugs and vulnerabilities, as well as gives you the opportunity to add features if you happen to be so inclined. When it comes to things such as jailbroken iPhones, Android phones, and Nooks, you can guarantee that a close look at the firmware helped to move the process along.

[Craig] works with embedded systems quite frequently and put together a detailed walkthrough demonstrating how he reverse engineers device firmware. The subject of his hacking was a new firmware package he obtained for a Linksys WWAG120 Wireless-N router.

His tutorial walks through some of the most common reverse engineering methods and tools, which allow him to slowly unravel the firmware’s secrets. When finished, he had a working copy of the router’s boot loader, kernel, and file system – all ready to be further analyzed. His writeup includes tons of additional details, so be sure to swing by his site if reverse engineering is something you are interested in.

RSA SecurID Breach Leads To Intrusion At Lockheed Martin

May 28, 2011 by Mike Nathan 45 Comments

rsa_securid

It looks like Lockheed Martin is the latest victim in what seems to be an endless string of security breaches. This time however, it does not look like a lack of security measures led to the breach. In fact, it seems that Lockheed’s implementation of a widely-trusted security tool was the attack vector this time around.

Last month we reported on the apparent compromise of RSA’s SecurID product, and while many speculated that this intrusion could lead to subsequent attacks, the firm downplayed the breach. They stated that the stolen data was unlikely to affect their customers, but as usual, the problem appears to be far larger than originally estimated.

The breadth of the intrusion is currently unknown, and with both RSA and Lockheed officials keeping mum, it may be some time before anyone knows how serious it is. When military secrets are in question however, you know it can’t be good!

Extracting Secured Firmware From Freescale Zigbee Radios

May 25, 2011 by Mike Nathan 17 Comments

decapped_MC13224

[Travis Goodspeed] recently tore down the Freescale MC13224 wireless radio chip in an effort to demonstrate how the device’s firmware could be read, even when locked down in “secure” mode. While you might not recognize the Freescale MC13224 radio by name alone, you are certainly familiar with some of its practical applications. Found in the QuahogCon and Ninja Party badges among other consumer goods, the popular Zigbee radio turned out to be a fairly easy conquest.

[Travis] first used acid to decap one of the microcontrollers to see what was going on under the plastic casing. Inside, he discovered a discrete flash memory chip, which he removed and repackaged using a wedge wire bonder. He was easily able to extract the firmware, however decapping and repackaging a flash chip isn’t necessarily the most user-friendly process.

After digging further, he discovered that holding one of the chip’s pins low during boot would allow him to run custom code that recovers the firmware image once the pin is pulled high once again. This far more practical means of firmware recovery can be easily facilitated via a circuit board revision, as [Travis] mentions in his blog.

Send Email, Receive Surveilance Picture

May 20, 2011 by Caleb Kraft 31 Comments

This deathstar like ball is actually an autonomous surveillance camera. [Basil] wrote in to tell us about it. The body is custom designed for the project, then 3d printed. It can be dropped anywhere, as it is battery powered for up to a month, and communicates via cellar networks. It checks an email folder once an hour and responds to any requests with a snapshot of what is going on. In the video, which you can see after the break, he gets an immediate response. You can download the sourcecode as well as the files for the enclosure here.

If you wanted to reduce costs, that case could be done away with, but we suspect it helps with some moderate weather conditioning. We would also love to see a version that rotated around that equator on command for better pictures. Great job [Basil].

Continue reading “Send Email, Receive Surveilance Picture” →