This week Darren is joined in San Francisco by his wonderful co-host Shannon! I know, right? We’re talking about open source software that will save the day if your laptop is ever stolen, following up on your password tips, and finishing up the homebrew router build with Untangle!

Download HD Download MP4 Download XviD Download WMV

Your Password Tips

Shannon and Darren share your password generation tips and tricks:

Ankaku writes: Here is the modified version of my gmail password.
ub012531oa932010ot980245xs601359gc201845ac296987. 48 chars. I’ve been using this format since a school I went to used it. It’s actually pretty easy to remember, and anything can be used ex. initials + section of ip address, phone number etc.

Teemu writes: another simple tool to create secure passwords fast is the apg (Automated Password Generator), compileable on most Unix-ish systems I suppose.

For instance:

#!/bin/sh
/sw/bin/apg -a 1 -m 64 -c cl_seed

Would spew out 6 passwords with 64 random characters.
Project home page: http://www.adel.nursat.kz/apg/

Nathan writes: The technique I find most useful in creating my passwords, aside from the ones you guys mentioned in the last episode, is to follow a spatial pattern on the keyboard itself. (i.e. qwerty, asdf, qweasdzxc; *I know those are terrible passwords, but example of spatial pattern) If you mix this technique with a passphrase that has been 1337speaked, you have a fairly long and seemingly random password string. However, spatial patterns offer the distinct advantage of usually being fairly easy to type quickly, making the physical breach of your password security a bit more of a challenge.

Eugene writes: http://howsecureismypassword.net/ — It’s based on a jQuery JavaScript library that estimates how long it would take an average computer to brute force a password. It even checks it against a list of 500 commonly used passwords (like pass, password, etc), and points out if you’re using a common password. It’s pretty nifty, and interesting how much extra time it would take to brute force by just adding an extra character to the end might make.

Extofer writes:I use a similar schema as Shannon regarding changing the password a bit depending on the site. But I also use a phrase, much like Darren mentioned too… I top it off by replacing certain letters with numbers. and of course, special characters. For instance…

say I take a phrase like: code monkey

replace o = 0 and e = 3 like

c00d3m0nkey

that alone could be hard to hack… it’s 11 alpha numeric characters. Now I tack in special characters and unique identifiers for each site like for Facebook, i will tack uppercase FB, gmail, maybe GM or GE, Hotmail, HM, etc…. you can also distinguish by color of the site or the initials of their mascot, etc.

c00d3m0nkeyFB

finally, tack in at least 2 special chatacter, you can put them perhaps one at the beginning, and one at the end, or on in the middle and one at the end…. which ever.

c00d3*m0nkeyFB+
c00d3+m0nkeyFB>

Jaryth writes: One of the passwords I’ve always been tempted to use, but never really ended up using… ‘http://www.google.com/?’

But you say “thats a URL not a password?” but you see… its both . Every single password checker I’ve run it though says its secure, its easy to remember, and even if someone DID have a key-logger on a machine, they’d think you where just typing in a URL.

So… if you wana mess with people, set your password to the URL of the site. Even if someone manages to crack it, they will ASUME that the user is stupid and typed their password into the wrong box .

pcdoctor writes:For years I have used RoboForm 5.7.6 which was the last free one to support 30 passwords per group and unlimited groups. It will not create
new passcards in ie7 or 8. It will work in those browsers if the passcard is created in IE6 ahead of time…

So, anywho, I had to find a replacement and this is my story…

I tried KeePass, but got a virus popup when I loaded the browser plugin,
so that was the end of that.

I like lastpass.com, but no matter how well written and secure it is,
the fact that it runs code in the browser and gets the data and updates
from the web is a big red flag to me.

So, I wanted to use Password Safe which was originally designed by Bruce
Schneier, but it was clunky and a big step down in functionality from
roboform (but it was safe)

So, I Hak ed it. Well, kinda. Here’s how to make it work great:

Download it at http://sourceforge.net/projects/passwordsafe/files/

or follow the links from here http://www.schneier.com/passsafe.html

Install it and click the add new icon, enter the url, usrename, password
Then click the additional tab and uncheck use default and change that to Run
Command put this in the Run Command box “${appdir}passsafe.exe” $url $u $p then I used http://www.autohotkey.com/ to compile a script I called passsafe.exe that I put in Password Safes install folder

The script is as follows

Run, "iexplore.exe" %1%
KeyWait, LButton, D
KeyWait, LButton, U
Sleep, 100
SendInput, %2%{TAB}%3%{ENTER}

now when I double click something in the safe, it feeds $url $u $p to my
program which uses iexplore (or any browser you want) to go to the url
then it waits for you to click in the username box (and highlight an
existing username if need be) and then it types username, TAB, password, ENTER

you can write custom scripts for websites that need other combinations
(like newegg).

I even wrote a script that runs from my hosts quick launch to fill in my
Password Safe password in my virtual machine.

and that’s my story and I’m sticking to it

Lyle writes: One great technique for long passwords is to pick a book from your bookshelf. Then go to a predetermined page [42, 69, 100]. Something you will remember. The first line of text on the page is your password. Need to change your password? Change the page number or change the book.

Patrick writes: Darren and Snubs were talking about passwords. I haven’t upgraded to the 2.x series yet, but for websites I use http://supergenpass.com It is just a little Javascript you save as a bookmark (or bookmarklet), it asks you for a “Master Password”, and it takes that, combines it with the domain name, and through some hash comes up with a totally random password. It’s pretty portable in that as long as you can add a bookmark to the browser you’re using, you can use SuperGenPass. There is an online “mobile” version, but I’ve never used it — don’t want my “Master Password” sent over the internet.

Adam writes: My suggestion for passwords is to use an application to centrally store the password in a secure database (of course then using a complex password for that database). This way, every password for every site can be unique + crazy complex so I don’t have to worry that if one site is hacked they will get access to the rest of my stuff. The program I use is Password Safe: http://passwordsafe.sourceforge.net/ It is free, open source, and (originally) written by a very reputable source, Bruce Schneier. Once the password is entered, the app offers some neat features, including: Easy copy/paste of usernames and passwords. The ability to paste in fields that don’t support the clipboard (like KVMs) using (I think) a virtual HID device. Built in password generator. All the data is stored in a single encrypted file, making it easy to copy to a second computer.

—

Domain.com

I like Domain.com’s Deluxe web hosting plan that’s only $8.75/mo. One click install of all the popular open source programs like WordPress, Joomla, and Drupal, and more! Unlimited traffic

Free website builder with unlimited pages, Easy and affordable to get your sites online with Domain.com.

Domain.com offers blistering fast DNS and hosting infrastructure, the lowest prices on the web AND the highest quality. Thanks to Hak5 fans, Domain.com is one of the fastest growing domain and hosting companies in the world. Got a great idea? It all starts with a great domain. Domain.com! Don’t forget to use coupon code HAK5 at checkout to get 15% off your order.

—

Snubs Report: Stolen Laptop Recovery

Say you’re hanging out in the city one day and you leave your computer at the table while you go grab your coffee. There is always the small chance that, if you leave your laptop unattended, someone could up and swipe it. Usually when this happens you can go to local authorities and hopefully they’ll find the thief. But to make matters a lot better for you, you can use a program like Prey, which will track all sorts of valuable information and even take a picture of the thief, hopefully helping you and authorities find your computer.

There are tons of features in Prey:

• Uses Wifi hotspots or GPS embedded in the device to accurately pinpoint where the laptop is.
• If Wifi isn’t in use, Prey will try to auto connect to an open hotspot to send you info.
• Prey is written in Bash and very lightweight. It’s also Portable!
• You can edit Prey as you like, adding or removing specific tasks, because each task uses a different module.
• Prey will list running programs and any files that were modified, as well as take a picture of the person if you have an integrated webcam.
• Messages can be sent to the device to be read on the screen, and even heard by anyone nearby.
• Last but not least, Prey is open source and FREE for up to three devices, and will run on any laptop.

First, download Prey onto the computer that you wish to track. Click on download and go thru the installation wizard. The download takes barely any time at all and at the end, if you havent configured the tool, it will prompt you to do so.

First thing I need to choose is setting up my reporting method. You have two options- you can either use a control panel interface, or a standalone interface. The difference is, the control panel can be accessed thru the prey website, and is quick and powerful- everything get sent directly to you as the reports come in. The standalone version will send you updates in your email, but to activate Prey to start reporting you need to activate and delete a URL and setup your mail server settings by hand.
Choose the control panel version. You need to create a new user account so type in your name, email address, and password. Change the name and device type. Click Create.

You’ll need to activate your email address, so log into your email, click the link and log in then add devices. Go back to the install and click OK and it tells you congrats now your devices are being tracked!
Now add a device by clicking the orange button. Fill in the name and it generates all your information about the device. Click create and it’s created. It gives you a device key and you can click on the name to configure all your settings. All of these choices are pretty self explanatory and if you don’t know what you’re choosing, hover over the exclamation point and it’ll explain the setting for you.

Now, if your computer gets stolen, log into prey project.com and change the status to missing. Now, updates will be recorded on your prey project page for you to view every 20 minutes (or however many minutes you choose).
I <3 it do you? Email me at feedback@hak5.org.

—
GoToAssist Express
Anyone expecting a long wait for your technical expertise is in for a BIG surprise. With Go To Assist Express brought to you by Citrix, you can provide immediate support by easily viewing and controlling your customers’ computers online! Provide instant remote one-to-one support to clients located ANYWHERE in the world. Handle more requests in less time. Assist up to 8 customers at once. Support both Mac and PC users! Try GoToAssist Express FREE for 30 days! For this special offer, you must visit GoToAssist.com/Hak5 for a FREE trial.

—

Homebrew Router Part 2

You’ll remember from episode 718 that we built a homebrew router based on a mini-itx motherboard running an Intel Atom. This week we’re replacing Smoothwall with Untangle, a free, full featured open source router.

We also cover the basics of QoS in the context of a home network. Getting in fights with your roommates about bandwidth hogging or online game performance? Take a look at Untangle’s easy to manage built in features. Not to mention the app store. Yes, of course it has an app store.

I’m looking for your feedback on these home LAN and IT segments to be sure to hit me up at feedback@hak5.org

—

Netflix
Netflix delivers movies directly to your home saving you time, money and hassle. As a Netflix unlimited member you get DVDs by mail in about 1 business day. Plus, you can instantly watch thousands of TV episodes and movies streamed directly to your PC, Mac or right to your TV via a Netflix ready device like the Xbox 360, PS3, and Nintendo Wii console. Watch as many movies as you want! Shipping is FREE and there are never any late fees or no due dates. Keep the movies as long as you like. DVDs by mail – Plus, instantly right to your TV.
Get unlimited movies 2 ways for only $8.99 a month. As a new member and a Hak5 viewer, you can get a FREE Trial membership. Go to www.netflix.com/Hak5 and sign up NOW! . . Be sure to use this URL so that they know we sent you!

—

If you want to know the latest on Hak5 be sure to follow us on Twitter or Facebook.

Also, now is also a great time to grab some swag from the HakShop – including the new airport friendly WiFi Pineapple with free world-wide shipping.

And finally if you’d like to suggest a topic for a future show feel free to hit up feedback@hak5.org

]]> http://Hak5.org/episodes/episode-720/feed 22 http://Hak5.org/episodes/episode-402-spicy-reverse-engineering http://Hak5.org/episodes/episode-402-spicy-reverse-engineering#comments Wed, 10 Sep 2008 14:20:49 +0000 Darren Kitchen http://www.hak5.org/?p=291 ]]>




In this episode of Hak5 Matt shows us how to map our networks with Spiceworks, an open source infrastructure mapping tool. Chris Gerling breaks down reverse engineering, Shannon talks about OpenDNS, and Christine has a Windows utility for everyone running multiple monitors.
[ MP4 | XviD | WMV ]


Production Note

This episode was plagued by the cabling mistake that made episode 4×01 dark and fuzzy. On a brighter note I’m happy to say episodes 4×03 and on look sharp and prettier.

Watch

Show Notes

Matt reviews SpiceWorks, a full featured open source infrastructure mapping suite. Grab a copy at spiceworks.com or check out Matt’s full review at MattLestock.com.

Chris Gerling dives into Reverse Engineering basics

In part 1 of Reverse Engineering I go over some basic theory and demo some tools associated with the Crackme scene of reverse engineering. This is not hardcore reverse engineering that will get you on the RELOADED team, but it’s a nice peek into things.

Tools of the trade (there are MANY MANY more):

WINDASM (W32DASM): I cannot link you to anything official as it’s no longer obtainable from the original vendor, so you’ll have to google for it. Be wary of any copy you download, virus scan it, and run it in a VM or on an isolated machine first. No guarantees.

IDA Pro: Industry standard. Extremely useful for almost any kind of file. We demo the older free version for lack of $500.
OllyDbg: Debugger similar to IDA Pro
PEiD: Detects packers, cryptors, and compilers.
.NET Reflector: Typically used for disassembling .NET applications.

Big Endian is akin to SONAR being sent as SON AR
Little Endian is akin to SONAR being sent as AR SON

Registers = Variables
32 bit = e
16 bit = different size, ax, bx, cx, dx, di, si, sp, bp
8 bit: al, ah, bl, bh, cl, ch, dl, dh. l means lower 8 bits of 16 bit reg, h means higher
Flags = boolean values, 1 or 0. Zero flag can get 0 or non zero (1) values.

The idea is to debug and disassemble to find out exactly how a program works, thereby enabling you to modify characteristics of that program to suit your needs.

In Part 2 we finish these notes and actually show you how to navigate through code.

Shannon talks about OpenDNS, a more secure and featureful alternative to your ISP provided DNS available at OpenDNS.com

Christine‘s software pick this week is Calibrize, a nifty tool for simple color calibration.

]]> http://Hak5.org/episodes/episode-402-spicy-reverse-engineering/feed 20 http://Hak5.org/episodes/season-3-episode-9 http://Hak5.org/episodes/season-3-episode-9#comments Sat, 05 Apr 2008 21:12:46 +0000 Darren Kitchen http://www.hak5.org/archives/237 PowerGUI, Yahoo Pipes, Helix - Open source forensics toolkit, router passwords, uninterrupted file copying, password strength auditing, firefox tips.]]>



In this episode Matt uses PowerGUI to command the new Windows PowerShell, Chris Gerling demonstrates Helix, an open source forensics toolkit and Darren builds a simple web mashup using Yahoo Pipes. Plus haksnacks including router passwords, uninterrupted file copying, password strength auditing, and Firefox keyword shortcuts.

Oh yeah and some bloopers. A lot of bloopers. Actually, pretty much most of the episode is one ongoing blooper. We’re kicking it oldschool Hak5 style. Call it senioritis if you will .


PS: Hak5 and trust your technolust stickers available for a limited time.

Download Download MP4 Download Xvid Download WMV Watch on Youtube Running time: 40:00

Production Notes

The new scan converter (device that takes the VGA output from our computers and inputs them into the video mixer) had great resolution and clarity however that isn’t seen in this episode. Unfortunately the video signal was a bit borked and everything captured was slightly pink. I’ve done my best to balance the color in post. Better luck next time I guess

Sponsors

It used to cost a fortune to protect your site with an SSL Cert. Thankfully, GoDaddy.com changed all that. You can get a standard SSL cert from Go Daddy for just $29.99 a year. They have the same basic specs you’d find on other certs – 256-bit encryption, 99% browser recognition, all that – but for about 80% less than the competition. Now you’ve got no reason to leave your data exposed. Grab an SSL cert from GoDaddy.com now for just $29.99. And save 10% on Domains and SSL certs with coupon code HAK.

Get awesome web hosting from the pros at Dreamhost and receive $25 off your order when you enter coupon code HAK5! Plans start at $7.95/mo including 500 GB storage, 5 TB bandwidth, and one-click installs of popular software like WordPress, phpBB, and MediaWiki.

]]> http://Hak5.org/episodes/season-3-episode-9/feed 19 http://Hak5.org/episodes/episode-2x09-release http://Hak5.org/episodes/episode-2x09-release#comments Sun, 08 Apr 2007 02:02:54 +0000 Darren Kitchen http://www.hak5.org/archives/169




In this special episode of Hak5 the crew heads to Washington DC for ShmooCon, the only annual security conference with complementary foam balls. We start by talk to Bruce Potter, one of the conferences organizers, about all things Shmoo. We also speak to Billy Hoffman about Jikto, JavaScript and XSS. Eoin Miller and Adair Collins tell us all about Cachedump and the dangers of cached domain credentials. Ken Caruso gives us a tour of the Shmoocon NOC and we see how network security is done at a hacker con. Jordan and Wes give us the details on the Hack or Halo competition while Paul tries his luck with the sniper rifle. Scott Moulton talks to us about recovering dead hard drives and Babak tells us about lock picking and the TOOOL organization. We even run into some Hak5 fans, Ryan and David, who built a rockin� Wii duck hunt box at the Hacker Arcade. Plus all of the usual fixings including the details on this months trivia, poll, LAN party, and a special web 1.0 contest sure to bring back the blink tag.


Download Download MP4 Download Xvid Download WMV Watch on Youtube

Sponsors

Get awesome web hosting from the pros at Dreamhost and receive $25 off your order when you enter coupon code HAK5! Plans start at $7.95/mo including 500 GB storage, 5 TB bandwidth, and one-click installs of popular software like WordPress, phpBB, and MediaWiki.

Keep your personal information away from spammers, hackers and your crazy ex-evilserver. Private Domain Registration from GoDaddy.com protects your privacy by keeping your address, phone number and more out of the public database. Get an additional 10% on your order when you enter coupon code HAK.

]]> http://Hak5.org/episodes/episode-2x09-release/feed 24 http://Hak5.org/episodes/season2-episode8 http://Hak5.org/episodes/season2-episode8#comments Thu, 08 Mar 2007 01:07:22 +0000 Darren Kitchen http://www.hak5.org/archives/165




In this “breakin’ in the new place” edition of Hak5 we take a look at some spiffy open-source goodies for your data and network. Paul checks out DD-WRT, a free & open firmware replacement for the oh so hackable Linksys WRT54G. Mubix teaches us why we should all be using TrueCrypt for our sensitive data. Darren gets packets flowing with Smoothwall Express, a firewall distribution of Linux. And Paul demos a sweet burning app for OS X.Plus all the deets on this month’s LAN party, Poll, Trivia, upcoming events, and plenty of Technolust with Wess, Alli & Nikki.


Download Download MP4 Download Xvid Download WMV Watch on Youtube Watch Veoh

Sponsors

Get awesome web hosting from the pros at Dreamhost and receive $25 off your order when you enter coupon code HAK5! Plans start at $7.95/mo including 500 GB storage, 5 TB bandwidth, and one-click installs of popular software like WordPress, phpBB, and MediaWiki.

Keep your personal information away from spammers, hackers and your crazy ex-evilserver. Private Domain Registration from GoDaddy.com protects your privacy by keeping your address, phone number and more out of the public database. Get an additional 10% on your order when you enter coupon code HAK.

]]> http://Hak5.org/episodes/season2-episode8/feed 29 http://Hak5.org/episodes/hak5-episode-7-released http://Hak5.org/episodes/hak5-episode-7-released#comments Sun, 05 Feb 2006 03:11:04 +0000 Darren Kitchen http://www.hak5.org/archives/70




In this episode of Hak.5 the gang hacks the CVS disposable digital camera, secure VNC traffic using SSH tunneling, take viewer questions and even check out some video submissions. Plus some special announcements and more commercials worth watching. Guest intro by Kevin Mitnick and music by Ashley Witt.
 
 


Download Download MP4 Download Xvid Watch on Youtube Watch on Veoh Running time: 39:12

Sponsors

Get awesome web hosting from the pros at Dreamhost and receive $25 off your order when you enter coupon code HAK5! Plans start at $7.95/mo including 500 GB storage, 5 TB bandwidth, and one-click installs of popular software like WordPress, phpBB, and MediaWiki.

Keep your personal information away from spammers, hackers and your crazy ex-evilserver. Private Domain Registration from GoDaddy.com protects your privacy by keeping your address, phone number and more out of the public database. Get an additional 10% on your order when you enter coupon code HAK.

]]> http://Hak5.org/episodes/hak5-episode-7-released/feed 28 http://Hak5.org/episodes/hak5-episode-5-released-2 http://Hak5.org/episodes/hak5-episode-5-released-2#comments Thu, 05 Jan 2006 19:22:16 +0000 Darren Kitchen http://www.hak5.org/archives/64




In this episode of Hak.5 Jon brings us a coding challenge, Wess builds a laser audio transmitter for his iPod, Harrison shows us why we should get to know our network neighbors better, and Darren remotely installs VNC with a command line gem. Plus the conclusion to last month’s chilling cliff-hanger and guest appearances by Leo Laporte, Amber MacArthur, Mike Lazazzera, and Frank Linhares.
 


Download Download MP4 Download Xvid Watch on Youtube Watch on Veoh Running time: 39:12

Sponsors

Get awesome web hosting from the pros at Dreamhost and receive $25 off your order when you enter coupon code HAK5! Plans start at $7.95/mo including 500 GB storage, 5 TB bandwidth, and one-click installs of popular software like WordPress, phpBB, and MediaWiki.

Keep your personal information away from spammers, hackers and your crazy ex-evilserver. Private Domain Registration from GoDaddy.com protects your privacy by keeping your address, phone number and more out of the public database. Get an additional 10% on your order when you enter coupon code HAK.

]]> http://Hak5.org/episodes/hak5-episode-5-released-2/feed 10