Wireless Sniffing And Jamming Of Chronos And Iclicker

January 25, 2011 by Joseph Thibodeau 1 Comment

The ubiquitous presence of wireless devices combined with easy access to powerful RF development platforms makes the everyday world around us a wireless hacker’s playground. Yesterday [Travis Goodspeed] posted an article showing how goodfet.cc can be used to sniff wireless traffic and also to jam a given frequency. We’ve previously covered the work of [Travis] in pulling raw data from the IM-ME spectrum analyzer, which also uses goodfet.cc.

The Texas Instruments Chronos watch dev platform contains a C1110 chip, which among other things can provide accelerometer data from the watch to an interested sniffer. The i>clicker classroom response device (which houses a XE1203F chip) is also wide open to this, yielding juicy info about your classmates’ voting behaviour. There is still some work to be done to improve goodfet.cc, and [Travis] pays in beer–not in advance, mind you.

With products like the Chronos representing a move towards personal-area wireless networks, this sort of security hole might eventually have implications to individual privacy of, for example, biometric data–although how that might be exploited is another topic. Related to this idea is that of sniffable RFID card data. How does the increasing adoption of short-range wireless technologies affects us, both for good and bad? We invite you to share your ideas in the comments.

Radio Controlled Hard Drive Security

December 7, 2010 by Caleb Kraft 46 Comments

[Samimy] has put together this really neat video tutorial on building a Radio Controlled secure hard drive. How can a hard drive be radio controlled? That’s the first thing we thought too. He has torn apart a remote-controlled car and is using the guts to remotely switch on power to the drive. This means that the drive is only active if you boot the computer after you put the fob in the hidden security system. It looks like it would be fairly effective. We’re curious though, if he is putting the entire drive assembly inside his PC, why rely on batteries for the circuit? Why not pull from the PC power supply? Another neat upgrade might be connecting to an internal USB connection on the motherboard so a reboot isn’t necessary.

Check out the entire video after the break.
Continue reading “Radio Controlled Hard Drive Security” →

Software Security Courtesy Of Child Labor

October 28, 2010 by Mike Szczys 34 Comments

We couldn’t help but poke a little fun in the headline. This is [Alex Miller], a twelve year old who claimed a $3000 bounty from Mozilla. See, [Alex] is a self-taught security guru. When Mozilla upped the reward for discovering and reporting critical security flaws in their software he went to work searching for one. He estimates that he spent an hour and a half a day for ten days to find the hole. Fifteen hours of work for $3000? That’s pretty good!

Is it good or bad to pay for these kind of submissions? The real question: Is the bounty high enough to get blackhats to report vulnerabilities, rather than selling software that exploits them? Let us know what you think in the comments.

[via Zero Day]

Security Flaw Bypasses IPhone Lock Screen

October 26, 2010 by Mike Szczys 53 Comments

It looks like the iPhone lock screen provides just a marginal level of protection. [Jordand321] discovered a key combination that opens the contact app on a locked iPhone. Just tap the emergency call button, enter the pound sign three times (###), then tap call and immediately tap the lock key on the top of the phone. If this is confusing just look at the video after the break to see how it’s done.

You don’t get access to everything on the device. But this does give an attacker access to all of your contact data and allows that person to make any calls they desire.

Continue reading “Security Flaw Bypasses IPhone Lock Screen” →

Arduino, RFID, And You

October 7, 2010 by Jakob Griffith 13 Comments

[Matt] has mixed up a batch of two RFID reading door lock systems. While the “door lock” part of the setup has yet to come into existence, the “RFID reading” section is up and running. By using the Parallax RFID readers (for cheap, remember?) and an Arduino, [Matt] is able to parse an RFID tag, look its number up in a database, and then have a computer announce “Access Denied” in a creamy “Douglas Adam’s sliding door of Hitchiker’s Guide” kind of way with Python.

Good books aside, catch a not as exciting as you’re thinking video after the jump.

Continue reading “Arduino, RFID, And You” →

Thieves, Armed With A Vacuum Cleaner, Still On The Run

September 24, 2010 by Caleb Kraft 32 Comments

Thieves in Paris have been stealing money with the clever use of a vacuum. Not just bits of change here and there, they’ve stolen over 500,000 euros. They noticed that Monoprix supermarkets use a pneumatic tube system to transport rolls of cash to and from the safe. Realizing this was the weakest point in the security, they simply drilled a big hole in the tube, hooked up a vacuum and sucked the cash out. Forget lock picking or safe cracking, this had to be ridiculously easy.

The thieves are still out there, sucking their way to riches. At this point, they’ve hit 15 locations. Their luck has to run out some time right?

[via Slashdot]

Now You See Me, Now You Don’t, Face Detection Scripts

June 27, 2010 by Jakob Griffith 19 Comments

Straight out of Ghost in the Shell, the Laughing Man makes his appearance in these security camera shots. [William Riggins] wrote us to let us know about his teams Famicam scripts. After taking a screen shot, faces are detected and counted, ‘anonymized’, and the final image is uploaded to Twitter.

The process is rather simple, and sure beats wearing a bunch of white reflective camouflage. All that’s left is detecting specific faces to make anonymous, and of course uploading the script to every camera in the world. Easy, right?