security

460 Articles

Secret Listening To Elevator Music

May 24, 2016 by 24 Comments

While we don’t think this qualifies as a “fail”, it’s certainly not a triumph. But that’s what happens when you notice something funny and start to investigate: if you’re lucky, it ends with “Eureka!”, but most of the time it’s just “oh”. Still, it’s good to record the “ohs”.

Gökberk [gkbrk] Yaltıraklı was staying in a hotel long enough that he got bored and started snooping around the network, like you do. Breaking out Wireshark, he noticed a lot of UDP traffic on a nonstandard port, so he thought he’d have a look.

Continue reading “Secret Listening To Elevator Music” →

If You See Anything, Say Something? Math On A Plane

May 9, 2016 by 224 Comments

Remember September 2016 2015? That was the month that [Ahmed Mohamed] brought a modified clock to school and was accused of being a terrorist. The event divided people with some feeling like it was ignorance on the part of the school, some felt the school had to be cautious, some felt it was racial profiling, and others thought it was a deliberate provocation from his possibly politically active parents. In the end, [Ahmed] moved to Qatar.

Regardless of the truth behind the affair, this month we’ve seen something that is probably even less ambiguous. The Washington Post reports that a woman told an Air Wisconsin crew that she was too ill to fly. In reality, she was sitting next to a suspicious man and her illness was a ruse to report him to the crew.

Authorities questioned the man. What was his suspicious activity? Was he assembling a bomb? Carrying a weapon? Murmuring plans for destruction into a cell phone? No, he was writing math equations. University of Pennsylvania economics professor [Guido Menzio] was on his way to deliver a speech and was reviewing some differential equations related to his work.

[Menzio] says he was treated well, and the flight was only delayed two hours (which sounds better in a blog post then it does when you are flying). However, this–to me–highlights a very troubling indicator of the general public’s level of education about… well… everything. It is all too easy to imagine any Hackaday reader looking at a schematic or a hex dump or source code could have the same experience.

Some media has tried to tie the event to [Menzio’s] appearance (he’s Italian) but I was frankly surprised that someone would be afraid of an equation. The pen may be mightier than the sword, but a math equation won’t (by itself) down an aircraft. I’ve heard speculation that the woman might have thought the equations were Arabic. First of all, what? And secondly, what if it were? If a person is writing in Arabic on an airplane, that shouldn’t be cause for alarm.

It sounds like the airline (which is owned by American Airlines) and officials acted pretty reasonably if you took the threat as credible. The real problem is that the woman–and apparently, the pilot–either didn’t recognize the writing as equations or somehow feared equations?

Regardless of your personal feelings about the clock incident, you could at least make the argument that the school had a duty to act with caution. If they missed a real bomb, they would be highly criticized for not taking a threat seriously. However, it is hard to imagine how symbols on a piece of paper could be dangerous.

While the mainstream media will continue to focus on what this means for passenger safety and racial profiling, I see it as a barometer of the general public’s perception of science, math, and technology as dark arts.

Reverse Engineering An ATM Card Skimmer

May 3, 2016 by 47 Comments

While vacationing in Bali, [Matt South] walked into a nice, secure, air-conditioned cubicle housing an ATM. Knowing card skimmers are the bane of every traveller, [Matt] did the sensible thing and jiggled the card reader and the guard that hides your PIN when punching it into the numeric keypad. [Matt] found the PIN pad shield came off very easily and was soon the rightful owner of a block of injection molded plastic, a tiny camera, and a few bits of electronics.

The first thing that tipped [Matt] off to the existence of electronics in this brick of plastic was a single switch and a port with four contacts. These four pins could be anything, but guessing it was USB [Matt] eventually had access to a drive filled with 11GB of video taken from inside this PIN pad shield.

An investigation of the videos and the subsequent teardown of the device itself revealed exactly what you would expect. A tiny pinhole camera, probably taken from a ‘spy camera’ device, takes video whenever movement is detected. Oddly, there’s an audio track to these videos, but [Matt] says that makes sense; the scammers can hear the beeps made by the ATM with every keypress and correlate them to each button pressed.

Of course, the black hats behind this skimmer need two things: the card number, and the PIN. This tiny spy cam only gets the PIN, and there wasn’t a device over or in the card slot in the ATM. How did the scammers get the card number, then? Most likely, the thieves are getting the card number by sniffing the ATM’s connection to the outside world. It’s a bit more complex than sticking a magnetic card reader over the ATM’s card slot, but it’s harder to detect.

Small Experiments In DIY Home Security

April 24, 2016 by 34 Comments

[Dann Albright] writes about some small experiments he’s done in home security.

He starts with the simplest. Which is to purchase an off the shelf web camera, and hook it up to software built to do the task. The first software he uses is the free, iSpy open source software. This adds basic features like motion detection, time stamping, logging, and an interface. He also explores other commercial options.

Next he delves a bit deeper. He starts by making a simple motion detector. When the Arduino detects motion using a PIR sensor it gets a computer to text an alert. After the tutorial begins to veer a little and he adds his WiFi light bulbs to the mix. Now he can send an email and change the color of the lights.

We suppose, that from a security standpoint. It would really freak a burglar out if all the lights turned red when they walked into a room. Either way, there’s definitely a fun weekend project in playing around with all these systems.

Add Bluetooth To A Cheap Electronic Lock

April 19, 2016 by 24 Comments

[James] works from home. His office is filled with objects that can be described with adjectives such as, “expensive,” and, “breakable.” His home, however, is filled with professional object-breakers known as children. To keep these two worlds from colliding, he installed a keypad lock on his office door. The potential side-effect of accidentally training his children to be master safe-crackers aside, the system seems to work so far.

However, being a hacker, the tedium of entering a passcode soon grew too heavy for him. Refusing to be a techno-peasant, he set out to improve his lock. The first step was to reverse engineer the device. The lock is divided into two halves, one has a keypad and handle, the other actually operates the lock mechanism. They are connected with a few wires. He hooked an oscilloscope to the most likely looking candidates, and looked at the data. It was puzzling at first, until he realized one was a wake-up signal, and the other was the data. He then hooked the wires up to a Bluetooth-enabled Arduino, and pressed buttons until he had all the serial commands the door lock used.

After that it was a software game. He wrote code for his phone and the Arduino to try out different techniques and work out bugs. Once he had that sorted, he polished the app and code until he reached his goal. All of the code is available on his GitHub.

Finally, through his own hands, he elevated himself from techno-peasant to wizard. He need but wave his pocket oracle over the magic box in front of his wizard’s lair, and he will be permitted entry. His wizardly trinkets secure from the resident orcs, until they too begin their study of magic.

Remote Sensing Bombs Could Stem Terrorism

March 29, 2016 by 84 Comments

If you understand technology, there were a lot of things hard to explain on Star Trek. Transporters, doors that were smart enough to open unless you hit them during a fight, and the universal translator all defy easy explanation. But one of the hardest things to explain were Mr. Spock’s sensors. From the ship or with a tricorder, Spock could sense at a distance just about anything from chemical compositions, to energy, and even the presence of life (which, today, at least, is difficult to determine even what that means).

Remote sensing would have a very distinct use in today’s world: finding terrorist bombs earlier. A recent article published on New Scientist by [Debora MacKenzie] points out that stopping attacks like the recent one in Brussels is difficult without increasing congestion. For example, putting checkpoints at doors instead of inside transit stations is common in Asia, but causes lines and delays.

detecThe United States has used ion mobility spectrometry (IMS) to detect explosive traces on swabs (using machines like the one on the left). However in the early 2000’s they experimented with a version of the device that used puffs of air to determine if people had explosives while they passed by the machine. By 2010, officials decided the machines broke down too often and stopped using them.

Remote Sensing in Practice

According to an expert at Rand Corporation, remote sensing is likely to employ imaging or sniffers. However, imaging solutions are easy to fool since a bomb can take the shape of an ordinary object. Sniffers, including biological sniffers (known as dogs), are harder to fool. The problem is that deploying thousands of dogs to cover the world’s airports is difficult.

Continue reading “Remote Sensing Bombs Could Stem Terrorism” →

Password Extraction Via Front Doorbell

February 28, 2016 by 52 Comments

Not a day goes by without another IoT security hack. If you’re wondering why you don’t want your front doorbell connected to the Internet, this hack should convince you.

The hack is unfathomably stupid. You press the button on the back of the unit that pairs the doorbell with your home WiFi network, and it transmits the password in the clear. Sigh. It’s since been fixed, and we suppose that’s a good thing, but we can’t resist thinking for a moment about an alternative implementation.

Imagine, like all previous non-IoT wireless doorbells, that the doorbell transmitted a not-very coded signal over an open frequency like 433 MHz to a receiver inside your home. Do the same with the video stream. Now the receiver can be connected to the Internet, and can be significantly more secure because it’s behind your locked front door. The attack surface presented to the outside world by the doorbell itself is small, and limited to faking a doorbell press or showing you pictures you don’t want to see. Yawn.

But because the outside doorbell unit could be connected to a network, it was. Now the attack surface extends into your home’s network, and if you’re like most people, the WiFi router was your only real defense.

Now we love the IoT, in principle. There are tons of interesting applications that need the sort of bandwidth or remote availability that the Internet provides. We’re just not convinced yet that a doorbell, or a fridge for that matter, meet the criteria. But it does add a hundred bucks to the price tag, so that’s good, right? What do you think? When does the risk of IoT justify the reward?

Thanks [Dielectric] for the tip!