Robot’s Actions And Our Reactions

January 12, 2019 by Brian McEvoy 9 Comments

If you walk into a dog owner’s home that dog is probably going to make a beeline to see if you are a threat. If you walk into a cat owner’s home, you may see the cat wandering around, if it even chooses to grace you with its presence. For some people, a dog’s direct approach can be nerve-wracking, or even scary depending on their history and relative size of the dog. Still, these domestic animals are easy to empathize with especially if you or your family have a pet. They have faces which can convey curiosity or smug indifference but what if you were asked to judge the intent of something with no analogs to our own physical features like a face or limbs? That is what researchers at the IDC Herzliya in Israel and Cornell University in the US asked when they made the Greeting Machine to move a moon-like sphere around a planet-like sphere.

Participants were asked to gauge their feelings about the robot after watching the robot move in different patterns. It turns out that something as simple as a sphere tracing across the surface of another sphere can stir consistent and predictable emotions in people even though the shapes do not resemble a human, domestic pet, or anything but a snowman’s abdomen. This makes us think about how our own robots must be perceived by people who are not mired in circuits all day. Certainly, a robot jellyfish lazing about in the Atlantic must feel less threatening than a laser pointer with a taste for human eyeballs.

Continue reading “Robot’s Actions And Our Reactions” →

You Can Learn A Lot About Social Engineering From A Repo Man

October 13, 2015 by Adam Fabio 121 Comments

The most vulnerable part of any secure information system is the human at the controls. Secure passwords, strong encryption, and stringent protocols are all worthless if that human can be coerced to give away the keys to the kingdom. The techniques of attacking a system through the human are collectively known as social engineering. While most of us don’t use social engineering in our day-to-day jobs, anyone can fall victim to it, so it’s always good to see this stuff in action. Some of the best examples of social engineering come from unlikely places. One of those is [Matthew Pitman].

[Matt] is one of those people we all hope we never to meet in real life. He’s a repo man. For those not familiar with the term, [Matt] is the guy who comes to pick up your car, boat or other asset when you fall behind on your loan payments. Generally, these repossession agents are contractors, working for the bank or loan agency who holds the loan on the collateral. As you might expect, no one is happy to see them coming.

[Matt] uses plenty of high-tech gadgetry in his line of work, everything from GPS tracking devices to drones. He calls his tow truck the Repo Ninja, and the interior is decked out with an internet connection, laptop, and tons of cameras. Even so, his greatest asset is social engineering. His 26 years of experience have taught him how to work people to get what he needs: their cars.

Continue reading “You Can Learn A Lot About Social Engineering From A Repo Man” →

Great Scott! A Flux Capacitor Notification Light

February 17, 2015 by Rick Osgood 9 Comments

If you are into your social media, then you probably like to stay updated with your notifications. [Gamaral] feels this way but he wasn’t happy with the standard way of checking the website or waiting for his phone to alert him. He wanted something a little more flashy. Something like a flux capacitor notification light. This device won’t send his messages back in time, but it does look cool.

He started with an off-the-shelf flux capacitor USB charger. Normally this device just looks cool when charging your USB devices. [Gamaral] wanted to give himself more control of it. He started by opening up the case and replacing a single surface mount resistor. The replacement component is actually a 3.3V regulator that happens to be a similar form factor as the original resistor. This regulator can now provide steady power to the device itself, as well as a ESP8266 module.

The ESP8266 module has built-in WiFi capabilities for a low price. The board itself is also quite small, making it suitable for this project. [Gamaral] used just two GPIO pins. The first one toggles the flux circuit on and off, and the second keeps track of the current state of the circuit. To actually trigger the change, [gamaral] just connects to the module via TCP and issues a “TIME CIRCUIT ON/OFF” command. The simplicity makes the unit more versatile because an application running on a PC can actually track various social media and flash the unit accordingly.

Yik Yak MITM Hack (Give The Dog A Bone)

December 10, 2014 by Rick Osgood 24 Comments

Yik Yak is growing in popularity lately. If you are unfamiliar with Yik Yak, here’s the run down. It’s kind of like Twitter, but your messages are only shared with people who are currently within a few miles of you. Also, your account is supposed to be totally anonymous. When you combine anonymity and location, you get some interesting results. The app seems to be most popular in schools. The anonymity allows users to post their honest thoughts without fear of scrutiny.

[Sanford Moskowitz] decided to do some digging into Yik Yak’s authentication system. He wanted to see just how secure this “anonymous” app really is. As it turns out, not as much as one would hope. The primary vulnerability is that Yik Yak authenticates users based solely on a user ID. There are no passwords. If you know the user’s ID number, it’s game over.

The first thing [Sanford] looked for was an encrypted connection to try to sniff out User ID’s. It turned out that Yik Yak does actually encrypt the connection to its own servers, at least for the iPhone app. Not to worry, mobile apps always connect to other services for things like ad networks, user tracking, etc. Yik Yak happens to make a call to an analytics tool called Flurry every time the app is fired. Flurry needs a way to track the users for Yik Yak, so of course the Yik Yak App tells Flurry the user’s ID. What other information would the anonymous app have to send?

Unfortunately, Flurry disables HTTPS by default, so this initial communication is in plain text. That means that even though Yik Yak’s own communications are protected, the User ID is still exposed and vulnerable. [Sanford] has published a shell script to make it easy to sniff out these user ID’s if you are on the same network as the user.

Once you have the user ID, you can take complete control over the account. [Sanford] has also published scripts to make this part simple. The scripts will allow you to print out every single message a user has posted. He also describes a method to alter the Yik Yak installation on a rooted iPhone so that the app runs under the victim’s user ID. This gives you full access as if you owned the account yourself.

Oh, there’s another problem too. The Android app is programmed to ignore bad SSL certificates. This means that any script kiddie can perform a simple man in the middle attack with a fake SSL certificate and the app will still function. It doesn’t even throw a warning to the user. This just allows for another method to steal a user ID.

So now you have control over some poor user’s account but at least they are still anonymous, right? That depends. The Yik Yak app itself appears to keep anonymity, but by analyzing the traffic coming from the client IP address can make it trivial to identify a person. First of all, [Sanford] mentions that a host name can be a dead giveaway. A host named “Joe’s iPhone” might be a pretty big clue. Other than that, looking out for user names and information from other unencrypted sites is easy enough, and that would likely give you everything you need to identify someone. Keep this in mind the next time you post something “anonymously” to the Internet.

[via Reddit]

SpoofedMe Attack Steals Accounts By Exploiting Social Login Mechanisms

December 5, 2014 by Rick Osgood 34 Comments

We’ve all seen the social logon pop up boxes. You try to log into some website only to be presented with that pop up box that says, “Log in with Facebook/Twitter/Google”. It’s a nice idea in theory. You can log into many websites by using just one credential. It sounds convenient, but IBM X-Force researchers have recently shown how this can be bad for the security of your accounts. And what’s worse is you are more vulnerable if the service is offered and you are NOT using it. The researcher’s have called their new exploit SpoofedMe. It’s aptly named, considering it allows an attacker to spoof a user of a vulnerable website and log in under that user’s account.

So how does it work? The exploit relies on vulnerabilities in both the identity provider (Facebook/Twitter/etc) and the “relying website”. The relying website is whatever website the user is trying to log into using their social media account. The easiest way to describe the vulnerability is to walk through an example. Here we go.

Let’s imagine you are an attacker and you want to get into some victim’s Slashdot account. Slashdot allows you to create a local account within their system if you like, or you can log in using your LinkedIn account. Your victim doesn’t actually have a LinkedIn account, they use a local Slashdot account.

The first step of your attack would be to create a LinkedIn account using your victim’s email address. This needs to be the same address the victim is using for their local Slashdot account. This is where the first vulnerability comes in. LinkedIn needs to allow the creation of the account without verifying that the email address belongs to you.

The second step of the attack is now to attempt to log into Slashdot using your newly created LinkedIn account. This is where the second vulnerability comes in. Some social media services will authenticate you to websites like Slashdot by sending Slashdot your user information. In this case, the key piece of information is your email address. Here’s the third vulnerability. Slashdot sees that your LinkedIn account has the same email address as one of their local users. Slashdot assumes that LinkedIn has verified the account and permits you, the attacker, to log in as that user. You now have access to your victim’s Slashdot account. In another scenario, Slashdot might actually merge the two credentials together into one account.

What’s really interesting about this hack is that it isn’t even very technical. Anyone can do this. All you need is the victim’s email address and you can try this on various social media sites to see if it works. It’s even more interesting that you are actually more vulnerable if you are not using the social logons. Some real world examples of this vulnerability are with LinkedIn’s social logon service, Amazon’s service, and MYDIGIPASS.com’s service. Check out the demonstration video below. Continue reading “SpoofedMe Attack Steals Accounts By Exploiting Social Login Mechanisms” →

Using Facebook Ads To Prank Your Friends

September 19, 2014 by Rick Osgood 38 Comments

Most tech savvy individuals are well aware of the vast amounts of data that social networking companies collect on us. Some take steps to avoid this data collection, others consider it a trade-off for using free tools to stay in touch with friends and family. Sometimes these ads can get a bit… creepy. Have you ever noticed an ad in the sidebar and thought to yourself, “I just searched for that…” It can be rather unsettling.

[Brian] was looking for ways to get back at his new roommate in retaliation of prank that was pulled at [Brian’s] expense. [Brian] is no novice to Internet marketing. One day, he realized that he could create a Facebook ad group with only one member. Playing off of his roommate’s natural paranoia, he decided to serve up some of the most eerily targeted Facebook ads ever seen.

Creating extremely targeted ads without giving away the prank is trickier than you might think. The ad can’t be targeted solely for one person. It needs to be targeted to something that seems like a legitimate niche market, albeit a strange one. [Brian’s] roommate happens to be a professional sword swallower (seriously). He also happens to ironically have a difficult time swallowing pills. naturally, [Brian] created an ad directed specifically towards that market.

The roommate thought this was a bit creepy, but mostly humorous. Slowly over the course of three weeks, [Brian] served more and more ads. Each one was more targeted than the last. He almost gave himself away at one point, but he managed to salvage the prank. Meanwhile, the roommate grew more and more paranoid. He started to think that perhaps Facebook was actually listening in on his phone calls. How else could they have received some of this information? As a happy coincidence, all of this happened at the same time as the [Edward Snowden] leaks. Not only was the roommate now concerned about Facebook’s snooping, but he also had the NSA to worry about.

Eventually, [Brian] turned himself in using another custom Facebook ad as the reveal. The jig was up and no permanent damage was done. You might be wondering how much it cost [Brian] for this elaborate prank? The total cost came to $1.70. Facebook has since changed their ad system so you can only target a minimum of 20 users. [Brian] provides an example of how you can get around the limitation, though. If you want to target a male friend, you can simply add 19 females to the group and then target only males within your group of 20 users. A pretty simple workaround

This prank brings up some interesting social questions. [Brian’s] roommate seemed to actually start believing that Facebook might be listening in on his personal calls for the purposes of better ad targeting. How many other people would believe the same thing? Is it really that far-fetched to think that these companies might move in this direction? If we found out they were already doing this type of snooping, would it really come as a shock to us?

Hacking Facebook To Remove The Social Value Facade

October 23, 2012 by Mike Szczys 20 Comments

We see [Ben Grosser’s] point that all the metrics found on the Facebook user interface make the experience somewhat of a game to see if you can better your high score. He thinks this detracts from the mission of having social interactions that themselves have a value. So he set out to remove the ‘scores’ from all Facebook pages with a project he calls the Facebook Demetricator.

You can see two UI blocks above. The upper offering is what a normal user will see. The lower is the page seen through the lens of the Demetricator. [Ben’s] feels it doesn’t matter how many people like something or share something, but only that you are genuinely interested in it. With the numbers removed you’re unlikely to follow the herd mentality of only clicking through to things that are liked by a huge number of people. He explains this himself in the clip after the break.

The Demetricator works much like the Reddit Enhancement Suite. It’s a browser add-on for Chrome, Firefox, and Safari that selectively strips out the metrics as the page renders.