Hak5 - Technolust since 2005 » homebrew

Hak5 915 – Extracting browser passwords, EXIF data tools, Maker Faire and more

Jason — Wed, 01 Jun 2011 21:42:56 +0000

This time on the show, we’re cracking the code: EXIF Data tools, Windows login hash cracking, Extracting passwords from Firefox and other browsers, what’s in that P-CAP file and special report form Maker Faire 2011. All that and more, this time on Hak5.

Download HD Download MP4 Download WMV

FirePassword

You know how you can store and save all you login credentials in Firefox, Chrome, as well as other browsers? Well, maybe that’s not such a great idea. There are several portable (yes, portable!) tools that can instantly recover login credentials stored by Firefox, Chrome and others. Broswers store your username and password for every website you visit as long as you give them consent in the settings. The credentials are saved by Firefox, Chrome and others in a sign-on database that is securely encrypted. Today I’m focusing on Firefox.

FirePassword, the tool in question today, can instantly decrypt and recover the data even if there’s a master password protecting it.
Not only this, but FirePassword can even recover sign-on passwords for other profiles (on the same system) and info from other OS’s like Linux and Mac. This can obviously be used for malicious intent, or can be used for the greater good of forensic investigators who need to transmit data from the target PC to another machine without disrupting the original target machine.

FirePassword portable works from XP-7, and loads DLLs from the firefox executable location automatically. DLLs aren’t packaged with the tool, and the newest version presents an easy to use color based display so you can clearly view password details.

Lets get started on cracking my Firefox passwords!

To install, follow the on screen instructions from securityxploded.com. They have nice detailed instructions on how to use the program so you shouldn’t have a problem.

Once installed, open your command prompt and change directory to your FirePassword.exe folder, probably in your program files.
Mine is c:\ Program Files (x86)\SecurityXploded\FirePassword\. Once there, type in FirePassword.exe and hit enter. You should see a screen kind of like the one on my monitor.

It will list every website, username, and password you have saved into FireFox.
It’ll also show you any OLD passwords that you never deleted out of the FireFox settings.

If you have a master password set on FireFox, you will need that password to be able to see your other passwords. For example, I will go into the FireFox options, choose Master Password and set it.

Over in my CMD, I’ll type FirePassword.exe -m kerby and click enter. Now it’ll give me my other passwords. If you do this wrong, you’ll get this error code.

You can also copy the Firefox profile files from different operating system such as Linux or Mac to the Windows system locally and then specify that path with FirePassword to recover data from the offline profiles.

It’s pretty surprising how easy this really is for anyone to discover. To protect yourself, do what I do and DON’T save your passwords in FireFox! Make your machine log off every time you close it or leave it idle for more than a minute. Anything, but really, just don’t save your passwords.

It’s also worth mentioning the WebBrowserPassView tool from NirSoft. It’s a password recovery tool for Internet Explorer, Firefox, Chrome and Opera.

Now, if you’ve got another tool for me to check out, email feedback@hak5.org

If you’re into Hak5 you’ll love our new show by hosts Darren Kitchen and Shannon Morse. Check out HakTip!

Whether you’re a beginner or a pro, HakTip is essential viewing for current and aspiring hackers, computer enthusiasts, and IT professionals. With a how-to approach to all things Information Technology, HakTip breaks down the core concepts, tools, and techniques of Linux, Wireless Networks, Systems Administration, and more

And let’s not forget to mention that you can follow us on Twitter and Facebook, Subscribe to the show and get all your Hak5 goodies, including the infamous WiFi Pineapple over at HakShop.com. If you have any questions or suggestions please feel free to contact us at feedback@hak5.org.

Hak5 914 – Doom on the Dingoo and Mubix spoofs NetBIOS with Metasploit

Jason — Wed, 25 May 2011 16:00:47 +0000

This time on the show, NetBIOS Name Service spoofing in Metasplot with our friend Mubix, Playing Doom on a Dingoo Digital with the Dingux Linux distro and an alternative disc space reporter.
All that and more, this time on Hak5.

Download HD Download MP4 Download WMV

Hacker Headlines

I was going to report on how Android devices prior to version 2.3.4 were vulnerable to a sidejacking attack due to the fact that they authenticated via HTTP instead of HTTPS. Similar to a cookie, the AuthToken of the Calendar and Contacts syncing service is good for up to two weeks and is device agnostic. But just a day after security researchers broke the story Google plugged the hole. A Google spokeman said in a statement “This fix requires no action from users and will roll out globally over the next few days.” Poor unencrypted HTTP — the protocol isn’t getting as much love since Firesheep…

There’s been a bit of trouble brewing in the Android marketplace. 11 apps that were in the Android marketplace were embedded with some malicious code that triggered a text message to be sent to three premium-rate numbers in China. Those text messages sign up the mobile user for a paid subscription service without their knowledge or approval. Google has since taken down those apps but there could be more. Malware like this has been growing on the Android platform, 400% since last summer, and this is just another hiccup in the security of Android Apps.

Poor Sony, they’ve consistently topped out hacker headlines and while I’m happy to report that they’ve reopened the PlayStation Network it hasn’t been without setbacks. Just two days after the service reopened attackers went after the password reset function, which supposedly only required email and date of birth. While far from a full blown remote exploit the bug has caused Sony to disable the function on PlayStation.com and Qriocity.com. In the meantime you can still sign into the PSN via your PSP or PlayStation 3 devices.

In awesome sauce news, a twitter vigilante found a guy’s stolen laptop using a program we had discussed many episodes back called Prey. Sean Power’s laptop was stolen and after just a few days, he was able to score a webcam photo of the thief using the free tool. Cops wouldn’t help him, so he went to Twitter. A follower of Sean’s, and also a stranger, went to the bar where the laptop was last seen and confronted the thief. He got the laptop back and now all is good. Hooray for social networking and free programs!

This video just started making its round and I’m going to take the liberty of directly quoting Teravolt.org:

Electrolytic capacitors are constructed using an electrolyte-soaked piece of paper between two strips of aluminum foil. One piece of foil is oxidized and this ultra-thin coating of aluminum oxide becomes the capacitor’s dielectric. Because this layer is so thin and has a high dielectric constant a large amount of capacitance can be squeezed inside of a small space, even more so when the foil is rolled up tightly.

Electrolytics have one flaw though; they are polarized. When a reverse voltage greater than 1.5V hits the capacitor the aluminum oxide starts to reduce and its insulating properties are lost. This destroys the capacitive effect of the device and essentially the capacitor short circuits which allows a lot of current to flow. A lot of heat is generated, heat which boils the electrolyte and causes pressure to build inside the capacitor.

Then it goes boom!

Kerby’s Internet Protocol Star Trek Captain of the Week
Picard, duh

HakTip: JDiskReport

As an alternative to WinDerStat which I explained a few weeks ago, you can try out JDiskReport. This freeware tool enables you to understand what files on your drive take up what amount of space. This tool can help you figure out what files or folders are just sitting on your hard drive taking up space. JDiskReport features a Size Perspective pie chart for easy viewing, a size distribution tool, modified size distribution view, file extension type size distrubution, and a top 100 list of your largest files.

To use, go to jgoodies.com and download the tool. Java must be installed for this to work and it will run on Windows or Mac. Open JDiskReport and choose ‘Scan A File Tree’. This will scan all the files inside a chosen drive. After a few moments, JDiskReport will display an easy to navigate pie chart, showing you which files take up so much room on your computer. You can right click to open explorer and browse to those files to edit or delete them. You can also choose things such as excluding a directory for the scan under the preferences menu on the filter tab.

For more info on JDiskReport check out jgoodies.com, and tell me what you think!

Got an idea for a tip? Share them with us at tips@hak5.org. And now for our sponsor.

NetBIOS Name Service spoofing in Metasploit
Segment Descirption (HTML):

This week our friend Mubix returns to demonstrate an awesome Metaspoit module for spoofing NetBIOS Name Service.

Trivia!

Last weeks trivia: This popular project was a light installation in Berlin that transformed a building front into a giant low-resolution monochrome computer screen. What’s the projects name?

The Answer was: Project Blinkenlights

This week’s question is: Including icons for snow men, octopuses and alien faces, this specification is the Japanese term for emoticons.
Answer at hak5.org/trivia to win some sweet swag. And now a word from our sponsor.

Doom on the Dingo

Last week I showed you how to install Dingux, a version of Linux, onto your Dingoo Digital. Today, I’m digging a bit deeper into the world of the Dingoo by setting up a game and an emulator. Lets get started!

First, check out nongnu.org/freedom and download the Complete Iwad from the download page. Extract the file to your PC. Copy the doom2.wad file to your mini SD card that has Dingux on it. You’ll need to copy it to the local\games\prboom\ folder and make sure it is called Doom2.wad. Once copied, you can plug the SD card into your Dingoo Digital. Make sure it’s turned off any time you remove or put the SD card in the slot because it’ll freeze if you take it out while cut on.

If you don’t want the freedoom version of Doom, you can also try original Doom. To do so, go to doomarchive.com and download the Doom1.wad. Extract this zip file anywhere on your PC. Now, copy the doom1.wad to the local\games\prboom\ folder. Rename doom2.wad from the freedoom.com website. If you decide not to rename doom2.wad, when you boot up Doom on Dingux, it’ll default to the freedoom doom2.wad instead of doom1.wad.

Now that you have your two versions of doom installed and have chosen which one you want to boot, put the SD card into your Dingoo Digital and hold down select while pressing up on the power button. When Dingux boots, choose Doom. This will be the topmost game under the games icon.

Ok, now after defeating one of the best games of all time, shut off your Dingoo and take the SD card out to install an emulator.

I’ve chosen Super Mario World… because it’s awesomely epic.

Get a super mario world ROM from anywhere online. It should be called SuperMarioWorld.smc. Copy this file to the local\emulators\snes\9x folder. Now, plug the SD card back in the Dingoo Digital and boot up Dingux again, this time choose the Emulators Icon, scroll down to SNES, and choose Super Mario World. Tada! You now have Awesome games at your fingertips to play on your next subway ride.

For questions or comments, email me at feedback@hak5.org.

Emails

Conner writes:

Hey Hak5,
I know you get a lot of emails so i will keep this to the point. I am new to the computer / technology world and find it hard to follow parts of your show. I’m not asking you to change the script, but I’m simply asking where are the best resources or really the best way to break into this and get caught up. I have an interest in technology and I know that it might take some work but really any general direction would be much appreciated.
Thank you in advance.

Darren recommends picking up a programming language. He isn’t going to get into a religious debate about which is best but learning any moden language will give you a fundamental understanding of how programs operate. There is a fantastic forum thread at forums.hak5.org called Hacking: Where to begin which is a great resource for those new to hacking.

Aaron writes:

Dear Hak5
What is the best, free, open source, virtualization system for Linux?
Love Hak5!
Thanks

Darren’s current squeeze for servers is Proxmox VE, which is a wonderful open source implementation of OpenVZ and KVM — two of the most popular virtualization technologies on Linux. He also still loves VirtualBox for desktop virtualization.

If you’re into Hak5 you’ll love our new show by hosts Darren Kitchen and Shannon Morse. Check out HakTip!

Hak5 913 – BackTrack 5 VM with Wireless and Linux on a Dingoo Digital

Jason — Wed, 18 May 2011 21:25:02 +0000

This time on an exciting brand-new-studio edition of Hak5 we’re getting hands on with the latest version of BackTrack-Linux, configuring virtual machines and wireless. Shannon’s flashing the firmware on a Dingoo Digital A320 and installing a custom distro of Linux and so much more.

Download HD Download MP4 Download WMV

Hacker Headlines

Oh Skype… They have another security problem. Skype on Mac OS X has a bit of a flaw. You can send a Skype message to another user and potentially get remote access to that other computer. Gordon Maddern, a security researcher, found the flaw and told Skype about it more than a month ago, but there was no fix until after the news started spreading that there was an issue. Skype has released a small term patch, but no full fix has been released, nor has users been notified to update.

Just days before Google I/O begins, French security firm Vupen demonstrates a zero-day vulnerability in Google Chrome allowing remote execution. The exploit, which hasn’t been released to the public, bypasses Chrome’s praised Sandbox as well as Address Space Layout Randomization and Data Execution Prevention. Google, busy introducing the Chromebook, has not verified VUPEN’s claims and says that if necessary an update will be pushed to users automatically.

The death of Osama Bin Laden has spurred several scams throughout the interwebz. Malware has shown up on certain websites, a Facebook scam popped up, and even the blog of the guy who accidentially live twittered the event has been compromised. Scammers are smart and they know what you’re looking for. People want to see the ‘Osama death video’, which doesn’t exist. So for anyone out there who was considering clicking that video on Facebook and sharing it with your friends, DON’T, and while you’re at it, delete it from your profile if someone else posted it.

Symantic security researchers are reporting that a flaw in the way application authentication works on Facebook, nearly 100,000 apps may have complete access to your account. Facebook now uses OAUTH 2.0 for authentication, however older authentication schemes are still in use. The firm advises users to change their passwords immediately — which essentually thwarts the access token bug.

Hot off the heals of Ubuntu’s 11.04 “Natty Narwhal” release — which has been getting mixed reviews due to the new Unity window manager, Backtrack Linux releases the much awaited version 5. In addition to native 64-bit and ARM processor support the security distribution now comes in both KDE and Gnome flavors. Are you excited? Have you checked it out? It’s available via torrents, has a stealth mode, comes with Metasploit, and sounds just plain awesome!

Kerby’s oldschool app of the week
Oregon Trail

Hacking the Dingoo Digital A320

This week I’m introducing this fun little device called the Dingoo Digital.

The Dingoo Digital A320 is a gaming handheld for open game development. It has modest hardware specs: 400MHz CPU, 32MB of RAM, 4GB internal storage, a miniSD reader, a 2.8″” LCD screen with a 320×240 resolution, and your normal jacks. The cool part is the software. You can playback several video and audio file types, there is a built in FM tuner for radio, you can record voice, and the SDK is available for free. My favorite part is it’s customization features and ability to play ROMs. Because who doesn’t like video games?

The device comes preinstalled with several arcade games like Centipede, Mine Sweeper, and has built in Emulators for your convenience as well. But if you want more with your new toy, what is better than installing Linux on it?

Enter Dingux, the Linux Distro for the Dingoo. You can get Dingux on the dingoo-scene website as well as really easy steps to follow if you want to check it out.

First off, you’ll need to download a couple of files. Booboo’s dual boot installer zip file for Windows, and the local-10 or local zip file. Charge your Dingoo so it doesn’t die during the reflashing process. We don’t want a bricked Dingoo!

Once your files are downloaded, unzip the Dual Boot file into a new folder wherever you want on your PC.

Turn on the Dingoo and go to the ‘System Setup’ menu, ‘About’, and press A. Press up-right-down-up-right-down and an easter egg diagnostics screen pops up. On the screen it should say ILI9331 or ILI9325 at the end of one of the lines. Mine says 9331. This is an LCD model and pertains to the flashing procedure.

Now, reset the Dingoo by holding B and pressing in the power button. The screen will stay dark so don’t panic!

Plug the Dingoo Digital into your PC. Choose cancel if any ‘new hardware found’ screens pop up. When your PC asks for a driver location choose your newly created Dual Boot folder. The driver should successfully install and you’re ready to flash your Dingoo!

Unplug the Dingoo, press the reset button, and let it boot into the normal firmware. You won’t need to hit the on button during this reset.

Hold the B button down and press POWER AGAIN. Plug the Dingoo back into your PC.

Open cmd, and go to the Dual Boot File directory. cd shannon\downloads\Dingoo Dual Boot and execute the usbtool-win file. We’re going to upload a file to a specified address, so we’ll type usbtool-win 1 hwinit.bin 0×80000000. This should start the flashing. Then type usbtool-win 1 zImage_dual_boot_installer_ILI9331 0×80600000 and press enter. A screen will appear on the Dingoo saying Dual Boot Flasher and press start to coninue.

Follow the on screen instructions. If done correctly, it’ll say Success at the end. You should see a Dingux startup screen when your Dingoo restarts. There is another step to getting Dingux to startup, so right now it’ll just boot to the original firmware.

Reset your Dingoo and plug it into the PC. Your PC should find it in a few seconds.

Next, plug in your mini SD card and format it to FAT32. Unzip everything from the second file you downloaded, local-10.zip, to the root of your mini SD card.

After unzipped, go to the mini SD card and rename your LCD screen file to zImage. So, mine is ‘zImage-20090707-ILI9331′, and I’ll change the name to ‘zImage’. Delete the other LCD image file if you want to.

Then, you’re done! Unplug and reset the Dingoo while holding down the Select key. It should boot into Dingux and launch the Dmenu. You should see a new menu on your screen.

Now that you have Dingux installed, go online and find some handy ROMs!

There is a ton of stuff you can do with this gaming device. The growing online community has tons of homebrew video games to try out, theme packs, and ROM’s available. I’ve linked a bunch of the websites in our shownotes. I’m thinking next week I’m going to try to stick Doom on here, because, why not? It’s DOOM!

Email me at feedback@hak5.org with questions and comments.

HakTip: BackTrack 5 first-boot

Darren is excited to be playing with the new BackTrack 5 linux. BackTrack is a fantastic distribution for security auditing. Version 5 is available in 32 and 64 bit flavors as well as ARM processor support and now comes in either Gnome or KDE.

Darren demonstrates how to setup either a USB drive to boot directly off, or a Virtualbox VM. Darren goes on to show off ethernet configuration and setting up a wireless adapter over USB.

Emails

Nick writes in:

http://hackertyper.net/
set type speed to 1 for a more realistic look.

Keep up with the latest on Hak5 by follow us on Twitter or Facebook. Subscribe and get your weekly technolust delivered automatically. Or show your support and grab some swag from the HakShop – including the new airport friendly WiFi Pineapple and hoodie. Finally if you’d like to suggest a topic
for ask a question feel free to hit up feedback@hak5.org.

Hak5 902 – Extracting files from packet captures, brute forcing stenography, packet sniffing goodness and more from RSA 2011

Jason — Thu, 03 Mar 2011 07:09:35 +0000

Season 9 continues with the results from last weekend’s Crack the Code Challenge as well as a walkthrough on how participants were able to complete the challenge using packet analysis, file reconstruction, stenagrophy and brute force. Plus encrypted USB drives with centralized management and more from the RSA 2011 conference.

Download HD Download MP4 Download WMV

Hacker Headlines

Bummed you didn’t get your hands on one of Google’s CR-48 Chrome notebooks? The alternative Instant-On OS Splashtop Linux is now available for download. Splashtop has been previously available as a pre-installed second OS on notebooks from Acer, ASUS, Dell and others. This 1.0 release makes the trim down Linux 2.6 and X11 based OS available to the public.

Samsung has made a ROM based on Android 2.3.2 Gingerbread for the i9000 that just leaked to the net. All of the changes haven’t yet been determined, and if you don’t have an i9000 model, you still have to wait for the update on your Galaxy S devices. I’m looking forward to seeing what the users can do with the ROM now that it’s available.

Sony isn’t taking recent PlayStation3 hacks lightly, as German hacker Graf Chokolo found out when authorities raided his house earlier in the week. In a post on his Hypervisor reverse engineering blog Chokolo wrote “Sony was today at my home with police and got all my stuff and accounts.” Hours later the “Hypervisor Bible” as Chokolo puts it was released. Links have been removed to comply with legal notices, but you know nothing is ever erased from the web.

The Nintendo 3DS has been out for a day in Japan… and it’s already been hacked. The Tech-On! Group has already gotten their hands on the 3DS and torn it apart to look at all the delicious insides, including the 3D display. Along with the hardware, Ayasuke2 on Youtube has already hacked the 3DS to run R4 Cards and play unauthorized Nintendo DS games.

Getting encased in carbonite isn’t exclusive to Han Solo anymore. Attendees at the Tangible, Embedded and Embodied Interactive Conference got to scan themselves in 3D with a hacked Microsoft Kinect and print the resulting STL file using a Stratasys 3D printer.

Crack the Code Challenge

Did you have what it took to compete in our Crack The Code Challenge, brought to you by GoToAssist Express? 6 Hak5 viewers did this Sunday. Mad props go to Netshroud for being the first to crack the code, as well as Jellyfish, Jon, Alex, Leo and Tristan.

A big thanks go out to all that participated, joined the live stream and chat, and of course GoToAssist Express for sponsoring our Hak5 Lab Network. We’ll have details on the next challenge on next weeks show so be sure to tune in.

Cracking the code: PCAP file recovery and stenography

Shannon demonstrates techniques for completing the Crack the Code Challenge using Network Miner and steghide.

HakTip: Command line packet captures using Tshark

Last week we were asked about command-line packet sniffers and I recommended tcpdump and ngrep for filtering. Steve Z was quick to point out TShark, the command-line counterpart to Wireshark. With rules and filtering built in, it is quickly becoming a favorite for my packet sniffing needs. For example, issuing:

tshark -R “!(udp.port==53) and udp and ip.addr==10.73.31.55″ -i eth0

will show me just UDP packets that aren’t on port 53 to or from the address specified.

What little gems are rocking your world? Hit us up, we’ll share ‘em on the show. tips@hak5.org

Encrypted USB drives with centralized management

Darren meets with Kingston and Blockmaster to talk about their new USB management security applications.

Email: USB Passthrough

Toby writes in:

Now that I’m adhering to the “Trust Your Technolust” way of life, I figure your my best chance for a quality fix… I have an issue that I would love to see how you would resolve. I work at a non-profit food producer that provides millions of servings to feeding programs world wide every year. Were running as much open source goodness as we possibly can so that we can direct as much revenue to the feeding programs as possible. I have a VM “When-doze” terminal server running a software package that requires a usb software key. I need a (cheap or free) way (hak or bypass) to overcome the lack of ability to have non-storage USB passthrough

Darren recommends USB Redirector, a product he learned about when researching Proxmox VE.

Keep up with the latest on Hak5 by following us on Twitter or Facebook. Subscribe and get your weekly technolust delivered automatically. Or show your support and grab some swag from the HakShop – including the new airport friendly WiFi Pineapple and hoodie. Finally if you’d like to suggest a topic
for ask a question feel free to hit up feedback@hak5.org.

Episode 817 – The Nyquist-Shannon sampling theorem, Nintendo DS emulators and QT programming

Jason — Fri, 10 Dec 2010 00:49:11 +0000

This time on the show Shannon joins us “in studio” to go over a little signal sampling. Jenn has just the emulator for the Nintendo DS-less, and Jason kicks off a series on programming using the QT SDK.

Download HD Download MP4 Download XviD Download WMV

Nyquist-Shannon Sampling Theorem
Segment Descirption (HTML): Keith writes in asking about the Nyquist-Shannon Sampling Theorem and Darren gives a basic overview of human hearing, vocals, compact disc frequency and why the maximum frequency of an 8000Hz telephone signal is only 4000Hz. Get lost in mathematical goodness beginning with this article.
Segment Keywords (Comma separated): nyquist, nyquist-shannon, nyquist shannon, shannon, harry nyquist, claude shannon, information theory, telecommunications, telephony, signal processing, sampling, pulse code modulation, pulse amplitude modulation, bandlimit, sinusoidal, oversampling, fourier transform

Nintendo DS Emulation & Colors!
Jenn Cutter joins us to talk about the no$gba emulator and her favorite community rom – Colors.

QT Programming
Jason gets his hands on Nokia’s N8 and begins his programming series on QT using the QT Creator SDK.

Go To Assist

If you’re an IT or software consultant – you’re always looking for ways to be competitive. You need to grow your business – but can’t be in two places at once! That’s why I recommend remote support with the new GoToAssist Express. The faster you can connect to a customer, the faster you can move on to the next challenge! With GoToAssist Express, you will: Increase revenue by handling more support requests, reduce travel time and overhead costs. support clients even when they are not at their computer, rise above the competition by providing faster, more professional service. Hak5 viewers can try GoToAssist Express FREE for 30 Days. For this special offer visit GoToAssist.com/Hak5.

Nokia

Nokia and AT&T have launched the $10M 2010 Calling All Innovators North America contest, challenging mobile app and game developers to create the next level of apps for consumers in the U.S. and Canada for the new Nokia N8 and Ovi Store (apps can be written in Nokia Qt SDK, Web Runtime including Adobe Flash Lite 4, java or Open GL). Along with the new device, O/S, and Ovi Store, the new Nokia Qt SDK brings the popular Qt Creator IDE from the desktop and embedded worlds to mobile developers, enabling them to build native apps for Symbian^3 devices like the N8. Developers can submit their apps by January 28th to be involved. Complete contest info is available at www.callingallinnovators.com/10M.

Domain.com

I like Domain.com’s Deluxe web hosting plan that’s only $8.75/mo. One click install of all the popular open source programs like WordPress, Joomla, and Drupal, and more! Unlimited traffic Free website builder with unlimited pages, Easy and affordable to get your sites online with Domain.com. Domain.com offers blistering fast DNS and hosting infrastructure, the lowest prices on the web AND the highest quality. Thanks to Hak5 fans, Domain.com is one of the fastest growing domain and hosting companies in the world. Got a great idea? It all tarts with a great domain. Domain.com! Don’t forget to use coupon code HAK5 at checkout to get 15% off your order.

Keep up with the latest on Hak5 by follow us on Twitter or Facebook. Subscribe and get your weekly technolust delivered automatically. Or show your support and grab some swag from the HakShop – including the new airport friendly WiFi Pineapple and hoodie. Finally if you’d like to suggest a topic
for ask a question feel free to hit up feedback@hak5.org.

Nintendo DS Emulation & Colors!

paul — Thu, 09 Dec 2010 21:45:48 +0000

Jenn Cutter joins us to talk about the no$gba emulator and her favorite community rom – Colors.

Android App Inventor Continued

paul — Tue, 31 Aug 2010 05:05:58 +0000

Continuing his android app development Darren is diving deeper into the Android App Inventor.

App Inventor Part 2

From Hello World to accelerometer sensors, Darren attempts to make something more useful with app inventor.

Android App Inventor Introduction

paul — Thu, 26 Aug 2010 04:15:45 +0000

Darren demonstrates how to get started with Google’s new App Inventor by making a simple Hello World app… Then he over complicates its just because its so easy.

Google’s new App Inventor for Android – a spiffy new web based drag-and-drop WYSIWYG development environment, with which Darren makes a Hello World app as a demo in preparation for some further project down the road.

Episode 801 – Android App Inventor, Building a Boxee Box, Ubuntu 10.10

Darren Kitchen — Wed, 25 Aug 2010 23:58:26 +0000

Hak5 kicks off another season with a plethora of projects. Darren gets his code on with Google’s new App Inventor for Android – a spiffy new web based drag-and-drop WYSIWYG development environment. Jason joins us for a little homebrew Boxee machine building and app development, and Shannon’s around for a little Ubuntu 10.10 lovin’

Download HD Download MP4 Download XviD Download WMV

Android App Inventor

While Darren’s code makes duct tape look good, Google’s new App Inventor beta makes anyone look good. Darren investigates the setup on Ubuntu 10.04 and discovers what it is to be beta.

Domain.com

I like Domain.com‘s Deluxe web hosting plan that’s only $8.75/mo. One click install of all the popular open source programs like WordPress, Joomla, and Drupal, and more! Unlimited traffic Free website builder with unlimited pages, Easy and affordable to get your sites online with Domain.com. Domain.com offers blistering fast DNS and hosting infrastructure, the lowest prices on the web AND the highest quality. Thanks to Hak5 fans, Domain.com is one of the fastest growing domain and hosting companies in the world. Got a great idea? It all starts with a great domain. Domain.com! Don’t forget to use coupon code HAK5 at checkout to get 15% off your order.

Roundtable: Ubuntu 10.10

Darren is joined via GoToMeeting by Shannon Morse and Jason Appelbaum to discuss the latest Ubuntu Alpha — Maverick Meerkat

GoToMeeting

Face-to-face business meetings with clients & colleagues is always going to be important. But business travel is a hassle and is often a complete waste of money. You can just do more and travel less with GoToMeeting. Host sales presentations, training sessions or product demos – right from your desk! Work & meet from anywhere and be more productive, getting more done in less time. Try Go To Meeting FREE for 30 days! For this special offer, you must visit gotomeeting.com, click the try it free button and use promo code HAK for a free trial!

Homebrew Boxee Box

Jason Appelbaum kicks off his series on building and developing for our favorite media platform — Boxee

Squarespace

Squarespace is a publishing system for anyone looking to build a blog, portfolio or any kind of website. Squarespace offers a uniquely flexible tool for just about anyone (no coding experience required) to build high end, complex websites with that same functionality that you will find on some of the highest trafficked pages on the web. Squarespace’s newly launched site importer tool makes things so easy to move over. Be sure to use the promotion code HAK5 when placing your order at www.Squarespace.com

If you want to know the latest on Hak5 be sure to follow us on Twitter or Facebook.

Also, now is also a great time to grab some swag from the HakShop – including the new airport friendly WiFi Pineapple with free world-wide shipping.

And finally if you’d like to suggest a topic for a future show feel free to hit up feedback@hak5.org

Episode 720 – Stolen Laptop Recovery and Homebrew Router Part 2

Jason — Thu, 01 Jul 2010 03:15:56 +0000

This week Darren is joined in San Francisco by his wonderful co-host Shannon! I know, right? We’re talking about open source software that will save the day if your laptop is ever stolen, following up on your password tips, and finishing up the homebrew router build with Untangle!

Download HD Download MP4 Download XviD Download WMV

Your Password Tips

Shannon and Darren share your password generation tips and tricks:

Ankaku writes: Here is the modified version of my gmail password.
ub012531oa932010ot980245xs601359gc201845ac296987. 48 chars. I’ve been using this format since a school I went to used it. It’s actually pretty easy to remember, and anything can be used ex. initials + section of ip address, phone number etc.

Teemu writes: another simple tool to create secure passwords fast is the apg (Automated Password Generator), compileable on most Unix-ish systems I suppose.

For instance:

#!/bin/sh /sw/bin/apg -a 1 -m 64 -c cl_seed

Would spew out 6 passwords with 64 random characters.
Project home page: http://www.adel.nursat.kz/apg/

Nathan writes: The technique I find most useful in creating my passwords, aside from the ones you guys mentioned in the last episode, is to follow a spatial pattern on the keyboard itself. (i.e. qwerty, asdf, qweasdzxc; *I know those are terrible passwords, but example of spatial pattern) If you mix this technique with a passphrase that has been 1337speaked, you have a fairly long and seemingly random password string. However, spatial patterns offer the distinct advantage of usually being fairly easy to type quickly, making the physical breach of your password security a bit more of a challenge.

Eugene writes: http://howsecureismypassword.net/ — It’s based on a jQuery JavaScript library that estimates how long it would take an average computer to brute force a password. It even checks it against a list of 500 commonly used passwords (like pass, password, etc), and points out if you’re using a common password. It’s pretty nifty, and interesting how much extra time it would take to brute force by just adding an extra character to the end might make.

Extofer writes:I use a similar schema as Shannon regarding changing the password a bit depending on the site. But I also use a phrase, much like Darren mentioned too… I top it off by replacing certain letters with numbers. and of course, special characters. For instance…

say I take a phrase like: code monkey

replace o = 0 and e = 3 like

c00d3m0nkey

that alone could be hard to hack… it’s 11 alpha numeric characters. Now I tack in special characters and unique identifiers for each site like for Facebook, i will tack uppercase FB, gmail, maybe GM or GE, Hotmail, HM, etc…. you can also distinguish by color of the site or the initials of their mascot, etc.

c00d3m0nkeyFB

finally, tack in at least 2 special chatacter, you can put them perhaps one at the beginning, and one at the end, or on in the middle and one at the end…. which ever.

c00d3*m0nkeyFB+
c00d3+m0nkeyFB>

Jaryth writes: One of the passwords I’ve always been tempted to use, but never really ended up using… ‘http://www.google.com/?’

But you say “thats a URL not a password?” but you see… its both . Every single password checker I’ve run it though says its secure, its easy to remember, and even if someone DID have a key-logger on a machine, they’d think you where just typing in a URL.

So… if you wana mess with people, set your password to the URL of the site. Even if someone manages to crack it, they will ASUME that the user is stupid and typed their password into the wrong box .

pcdoctor writes:For years I have used RoboForm 5.7.6 which was the last free one to support 30 passwords per group and unlimited groups. It will not create
new passcards in ie7 or 8. It will work in those browsers if the passcard is created in IE6 ahead of time…

So, anywho, I had to find a replacement and this is my story…

I tried KeePass, but got a virus popup when I loaded the browser plugin,
so that was the end of that.

I like lastpass.com, but no matter how well written and secure it is,
the fact that it runs code in the browser and gets the data and updates
from the web is a big red flag to me.

So, I wanted to use Password Safe which was originally designed by Bruce
Schneier, but it was clunky and a big step down in functionality from
roboform (but it was safe)

So, I Hak ed it. Well, kinda. Here’s how to make it work great:

Download it at http://sourceforge.net/projects/passwordsafe/files/

or follow the links from here http://www.schneier.com/passsafe.html

Install it and click the add new icon, enter the url, usrename, password
Then click the additional tab and uncheck use default and change that to Run
Command put this in the Run Command box “${appdir}passsafe.exe” $url $u $p then I used http://www.autohotkey.com/ to compile a script I called passsafe.exe that I put in Password Safes install folder

The script is as follows

Run, "iexplore.exe" %1% KeyWait, LButton, D KeyWait, LButton, U Sleep, 100 SendInput, %2%{TAB}%3%{ENTER}

now when I double click something in the safe, it feeds $url $u $p to my
program which uses iexplore (or any browser you want) to go to the url
then it waits for you to click in the username box (and highlight an
existing username if need be) and then it types username, TAB, password, ENTER

you can write custom scripts for websites that need other combinations
(like newegg).

I even wrote a script that runs from my hosts quick launch to fill in my
Password Safe password in my virtual machine.

and that’s my story and I’m sticking to it

Lyle writes: One great technique for long passwords is to pick a book from your bookshelf. Then go to a predetermined page [42, 69, 100]. Something you will remember. The first line of text on the page is your password. Need to change your password? Change the page number or change the book.

Patrick writes: Darren and Snubs were talking about passwords. I haven’t upgraded to the 2.x series yet, but for websites I use http://supergenpass.com It is just a little Javascript you save as a bookmark (or bookmarklet), it asks you for a “Master Password”, and it takes that, combines it with the domain name, and through some hash comes up with a totally random password. It’s pretty portable in that as long as you can add a bookmark to the browser you’re using, you can use SuperGenPass. There is an online “mobile” version, but I’ve never used it — don’t want my “Master Password” sent over the internet.

Adam writes: My suggestion for passwords is to use an application to centrally store the password in a secure database (of course then using a complex password for that database). This way, every password for every site can be unique + crazy complex so I don’t have to worry that if one site is hacked they will get access to the rest of my stuff. The program I use is Password Safe: http://passwordsafe.sourceforge.net/ It is free, open source, and (originally) written by a very reputable source, Bruce Schneier. Once the password is entered, the app offers some neat features, including: Easy copy/paste of usernames and passwords. The ability to paste in fields that don’t support the clipboard (like KVMs) using (I think) a virtual HID device. Built in password generator. All the data is stored in a single encrypted file, making it easy to copy to a second computer.

—

Domain.com

I like Domain.com’s Deluxe web hosting plan that’s only $8.75/mo. One click install of all the popular open source programs like WordPress, Joomla, and Drupal, and more! Unlimited traffic

Free website builder with unlimited pages, Easy and affordable to get your sites online with Domain.com.

Domain.com offers blistering fast DNS and hosting infrastructure, the lowest prices on the web AND the highest quality. Thanks to Hak5 fans, Domain.com is one of the fastest growing domain and hosting companies in the world. Got a great idea? It all starts with a great domain. Domain.com! Don’t forget to use coupon code HAK5 at checkout to get 15% off your order.

—

Snubs Report: Stolen Laptop Recovery

Say you’re hanging out in the city one day and you leave your computer at the table while you go grab your coffee. There is always the small chance that, if you leave your laptop unattended, someone could up and swipe it. Usually when this happens you can go to local authorities and hopefully they’ll find the thief. But to make matters a lot better for you, you can use a program like Prey, which will track all sorts of valuable information and even take a picture of the thief, hopefully helping you and authorities find your computer.

There are tons of features in Prey:

Uses Wifi hotspots or GPS embedded in the device to accurately pinpoint where the laptop is.

If Wifi isn’t in use, Prey will try to auto connect to an open hotspot to send you info.

Prey is written in Bash and very lightweight. It’s also Portable!

You can edit Prey as you like, adding or removing specific tasks, because each task uses a different module.

Prey will list running programs and any files that were modified, as well as take a picture of the person if you have an integrated webcam.

Messages can be sent to the device to be read on the screen, and even heard by anyone nearby.

Last but not least, Prey is open source and FREE for up to three devices, and will run on any laptop.

First, download Prey onto the computer that you wish to track. Click on download and go thru the installation wizard. The download takes barely any time at all and at the end, if you havent configured the tool, it will prompt you to do so.

First thing I need to choose is setting up my reporting method. You have two options- you can either use a control panel interface, or a standalone interface. The difference is, the control panel can be accessed thru the prey website, and is quick and powerful- everything get sent directly to you as the reports come in. The standalone version will send you updates in your email, but to activate Prey to start reporting you need to activate and delete a URL and setup your mail server settings by hand.
Choose the control panel version. You need to create a new user account so type in your name, email address, and password. Change the name and device type. Click Create.

You’ll need to activate your email address, so log into your email, click the link and log in then add devices. Go back to the install and click OK and it tells you congrats now your devices are being tracked!
Now add a device by clicking the orange button. Fill in the name and it generates all your information about the device. Click create and it’s created. It gives you a device key and you can click on the name to configure all your settings. All of these choices are pretty self explanatory and if you don’t know what you’re choosing, hover over the exclamation point and it’ll explain the setting for you.

Now, if your computer gets stolen, log into prey project.com and change the status to missing. Now, updates will be recorded on your prey project page for you to view every 20 minutes (or however many minutes you choose).
I <3 it do you? Email me at feedback@hak5.org.

—
GoToAssist Express
Anyone expecting a long wait for your technical expertise is in for a BIG surprise. With Go To Assist Express brought to you by Citrix, you can provide immediate support by easily viewing and controlling your customers’ computers online! Provide instant remote one-to-one support to clients located ANYWHERE in the world. Handle more requests in less time. Assist up to 8 customers at once. Support both Mac and PC users! Try GoToAssist Express FREE for 30 days! For this special offer, you must visit GoToAssist.com/Hak5 for a FREE trial.

—

Homebrew Router Part 2

You’ll remember from episode 718 that we built a homebrew router based on a mini-itx motherboard running an Intel Atom. This week we’re replacing Smoothwall with Untangle, a free, full featured open source router.

We also cover the basics of QoS in the context of a home network. Getting in fights with your roommates about bandwidth hogging or online game performance? Take a look at Untangle’s easy to manage built in features. Not to mention the app store. Yes, of course it has an app store.

I’m looking for your feedback on these home LAN and IT segments to be sure to hit me up at feedback@hak5.org

—

Netflix
Netflix delivers movies directly to your home saving you time, money and hassle. As a Netflix unlimited member you get DVDs by mail in about 1 business day. Plus, you can instantly watch thousands of TV episodes and movies streamed directly to your PC, Mac or right to your TV via a Netflix ready device like the Xbox 360, PS3, and Nintendo Wii console. Watch as many movies as you want! Shipping is FREE and there are never any late fees or no due dates. Keep the movies as long as you like. DVDs by mail – Plus, instantly right to your TV.
Get unlimited movies 2 ways for only $8.99 a month. As a new member and a Hak5 viewer, you can get a FREE Trial membership. Go to www.netflix.com/Hak5 and sign up NOW! . . Be sure to use this URL so that they know we sent you!

—

If you want to know the latest on Hak5 be sure to follow us on Twitter or Facebook.

Also, now is also a great time to grab some swag from the HakShop – including the new airport friendly WiFi Pineapple with free world-wide shipping.

And finally if you’d like to suggest a topic for a future show feel free to hit up feedback@hak5.org

Episode 715 – The LateHak Show, HFS and DSiXL Mods

Jason — Wed, 26 May 2010 04:16:33 +0000

The Hack Across America series continues in week 4 with what can only be described as the LateHak Show thanks to the enthusiastic folks at the i3Detroit hackerspace. Jenn Cutter joins us from Toronto for a little Nintendo DSiXL homebrew and Shannon has the cure for HTTP file transfer woes in this weeks Snubs Report. Hang on to your plush primate, it’s time for technolust!

Download HD Download MP4 Download XviD Download WMV

Arriving at the i3Detroit hackerspace I was delighted to find a late-night set built in their podcast studio. They sure know how to roll out the red carpet. Delighted to a oblige we see in this segment what Hak5 might be if it were a late-night talk show, complete with band and guests. The experience was a joyful departure from the typical Hak5 A-Block format. Enjoy

Trivia

With a North American release of Marth 28th, 2010 the Nintendo DSi XL features a 93% larger screen and what percent higher screen resolution?

Enter for your chance to win a super sweet new Hak5 sticker pack set by submitting your answer at hak5.org/trivia

Domain.com

Domain.com offers easy and affordable web hosting plans with a free website builder and unlimited pages. Get a hosting account for only $5.75/month or opt for the Deluxe web hosting plan for $8.75/month that features unlimited traffic. Also get one click installation of all the popular open source programs like WordPress, Joomla, Drupal, and more! Thanks to Hak5 fans, Domain.com is one of the fastest growing domain and hosting companies in the world. Remember, don’t forget to use coupon code HAK5 at checkout to get 15% off your order. Got a great idea? It all starts with a great domain. Domain.com

i3Detroit Interview

Continuing the LateHak Show Darren interviews Nick Britsky of i3Detroit about Hackerspaces.

Snubs Report: HTTP File Transfer Servers

Raise your hand if you’ve ever needed to send a file to someone that was too big for email. I have! It’s an age old problem and there are a million and one ways to solve it. But today we’re looking specifically at hassle free options. No web services, no accounts and the easiest way for the person on the other end. But, before we get flooded with email let’s quickly roundup some obvious choices.

Dropbox is simple and elegant, and synchronizes folders between your Windows, Mac, Linux and mobile devices. It’ll even do web storage with some nifty new API’s. We actually use this one to share Hak5 videos in preproduction. Sugarsync is like Dropbox with a bit more functionality. Filezilla Server is for you FTP guys. FTP has been around since 1971 and if you really must use this inherently insecure protocol at least grab a decent open source server. Yousendit, RapidShare, MegaUpload, etc, etc are the ones everyone has probably heard of. You upload it. They download it. We all try to ignore the up-sells.

But why double your efforts uploading then downloading when you can share the file straight from your computer? Or, better yet, have them upload it directly to your hard drive. HFS File Server is a lightweight Windows file server for HTTP, so you access it right in your web browser, and it works right out of the box. It has highly customizable HTML templates if you want to spend the time to make it pretty. It features bandwidth control so it doesn’t slow down your capture-the-flag instagib matches and it’ll even update your Dynamic DNS service in case your public IP changes. Of course it’s free and open source so we love it.

I’ve connected to the Hak5 cloud lab via GoToAssist Express and transferred over hfs.exe. It’s a single executable; no installation required just double click! I love portable apps, did you know that?

Right-click and add a folder. For this example, I chose a real folder.
Our server is running on the default HTTP port 80 but our ISP is evil and blocks it so let’s change that to 8000 by clicking on the current port.
In the address bar you can see your Local Area Network IP address.
If you copy this into a browser you’ll see the files are ready to download, but that’s not going to work so well for our friends online.
So to find your public IP address click Menu, IP Address and Find External Address.
Now that your address has updated you just need to port forward from your router and share the URL.
If you want to make the folder writable so your friends can upload directly to your disk:
Right-click the folder, choose upload and upload for accounts and choose anyone or create an account.
One of my favorite features of HFS is that as a client you can use download tools like w-get or browser extensions like down-them-all to quickly grab files.
HFS will even TAR a folder for you.

Unfortunately HFS File Server is Windows only. It’ll work in Linux under Wine, but if you’re looking for something a little more cross-platform and don’t mind popping open an terminal, I can’t wrap this up without mentioning Droopy.
Droopy is a Python script that’ll run in Windows Mac or Linux and offers similar upload functionality to HFS. No, it won’t share out a directory of files, but it is good for offering up a quickie website where your friend can upload to you.
It’s also dead simple to use. Create a directory and run droopy. You can specify a message with -m (tack m) and a picture with -p (tack p).
Once it’s running head over to http://localhost:8000 and from there you can discover your public address to share it with a friend.

What do you think? Make sure to email me at feedback@hak5.org.

–Shannon Morse

GoToAssist Express

Have you ever tried to help someone through a technical issue over the phone – without access to their computer –it’s a NIGHTMARE! And the last thing you want to do is waste time driving to fix the problem in person. GoToAssist Express is the EASIEST way to remotely view and control another computer – PC or a Mac. With GoToAssist Express, you can instantly connect to a customer’s computer and fix technical issues right on the spot. Service more clients…. more efficiently…more affordably. And Citrix is allowing you to try GoToAssist Express FREE for 30 days! For this special offer, you must visit GoToAssist.com/Hak5 for a FREE trial.

DSiXL Homebrew with Jenn Cuter

This week we have the pleasure of talking to Jenn Cutter from OpenAlpha.tv on the Nintendo DSiXL. Specifically we’re interested in running homebrew on the new handheld. Jenn shares with us a few notes:

OLD STYLE CARTS:

If you didn’t flash your system, you had to use
http://eng.supercard.sc/manual/superkey_jj.htm as a slot one passkey
so that you could read roms from a slot two GBA cart like
http://eng.supercard.sc/manual/sd_jj.htm. You also had to run a program (http://eng.supercard.sc/manual/sd_ss.htm) to prep things on
the card before you could use them in your system. These eventually
got replaced by homebrew solutions that only required slot one cards
(a DS cart with either onboard space or a slot for microSD) but often
still required a PC-based program to use properly.

Now there’s a slot one all-in-one solution, just drag and drop:
http://www.acekard.com/ (However it MUST be the 2i for the DSi XL)

Akaio (Open Source Loader to use on it) http://www.normmatt.com/forum/ — can use http://akaio.gbatemp.net/ since it will redirect there anyway.

http://akaio.gbatemp.net/nloaders/ – to get the update to run on the DSi XL, MUST BE RUN ON A Lite or regular DS FIRST

http://www.acekard.com/skin.php – yay pretty skins.

Homebrew discussed include Shooting Watch and ScummVM DS.

Verizon Droid Apps

Verizon DROID Apps have access to every tool the phone has—including the compass, GPS, accelerometer, video player, image capture, etc. The power of the Android apps allows them to run in the background for multi-tasking, give background notifications and enhance each other’s performance. Verizon’s dominant Network and 3G coverage create an unparalleled mobile data solution to keep you connected to the Web and allow you to run heavy data-rich features anytime, anywhere. And with the ever-expanding Android Market you’ll always be able to quickly download the apps you need to get the most out of your DROID.

If you want to know the latest on Hak5 be sure to follow us on Twitter or Facebook.

Also, now is also a great time to grab some swag from the HakShop – including the new airport friendly WiFi Pineapple with free world-wide shipping.

Details on Darren’s journey across North America can be found at HackAcrossAmerica.com.

And finally if you’d like to suggest a topic for a future show feel free to hit up feedback@hak5.org