In this segment Darren covers the beautification aspects of the case mod, tackling the tricky bits of cable management and accent lighting with cold cathodes.

Darren reviews some of the recent case mod feedback and looks forward to hearing your ideas for future mods.

Darren finishes off the photo frame case mod with a little cable beautification and accent lighting. Shannon’s getting into programming without touching a line of code using the Illumination Software Creator from Radical Breeze. Plus getting crafty with packets and the hping utility, open-source dropbox alternative based on OpenSSH and Rsync, and multi-threaded steganography bruter-forcers!

Download HD Download MP4 Download WMV

Hacker Headlines

Last week we reported on nearly 60 nasty trojans hitting the Android marketplace. Google responded by delisting the publisher and used their app remote kill switch on the over quarter-million affected users. Google also released a security tool to clean up the mess. Well, said security tool has been found on an unregulated third-party Chinese marketplace injected some delicious botnet code. This one sports the ability to send text messages from the zombie’d phone.

A ‘group of hackers’ has figured out a way to scam Microsoft’s XBox Live Points by producing working character strings like the ones you get on the back of the points cards. They released the scheme on a website that would generate the codes for you! Microsoft lost about 1.2 million dollars in points, but they have since blocked the site… though, they don’t have a way of knowing who did it and they’ll probably have to redo the entire algorithm.

Just when you thought your Linux box was safe, a router-rooting bit of malware has been discovered. Once run the malware, posing as an ELF file, brute forces network routers. If successful the malware even sets up an IRC backdoor on the system. This router-rooter comes months after the Chuck Norris botnet circulated, attacking routers with default passwords.

If you visited George Hotz’s website between January 2009 and now, Sony may know about it. In a decision last Thursday, Magistrate Joseph Spero granted Sony a subpoena of PS3 jailbreaker George Hotz’s web provider for logs. Sony also won subpoenas for data on Youtube and Google. GeoHot’s provider, Bluehost, has been asked to turn over server logs, IP address logs, and just about anything pertaining to geohot.com/jailbreak.zip

Whats more fun than Gary’s Mod? How about using the Kinect to play Gary’s Mod! John B used OpenNI to gather skeletal coordinate data from the Kinect and pass it through to Gary’s Mod so he can do all the physics fun while get an exercise. How about some Gary’s Mod music videos next? With baby kittens?

—

Crack the Code Challenge

Did you have what it took to compete in our Crack The Code Challenge, brought to you by GoToAssist Express? These fine Hak5 viewers did last Sunday. Mad props go to Paul, Sork, Richard, Raging Cake, Jenkins, John and Joey, as well as our returning champions Netshroud, Leo and Tristian.

A big thanks go out to all that participated, joined the live stream and chat, and of course GoToAssist Express for sponsoring our Hak5 Lab Network. We had an overwhelming reception with more participants than virtual machines, however we’ll be increasing our capacity this week as well as getting the Thunder Kitten Assault Force involved. Stay tuned for info on the next, even bigger Crack the Code Challenge.

And be sure to tune in next week as we’ll have a detailed walk through on how the challenge was completed.

—

Illumination Software Creator

I would love to have the ability to make my own software applications without having to know any kind of coding language. But it seems like even to do something as simple as a Hello World script you still have to know at least a few lines of script.
Well… not anymore! With Illumination Software Creator, from Radical Breeze, you can write software apps without the code, by using a unique easy interface.

Requirements:
Windows- Needs Python
Works on Windows, Linus, Ubuntu, Mac, Android, and Flex

Follow directions on the Requirements page at RadicalBreeze.com. For Windows, I have to download a few python installers before it’ll work. Then go to the download page and click on your desired OS. Run through the quick download and open the Software Creator.
Simply drag and drop boxes for what you want your application to do. Then connect the boxes by the ribbons to make a full application.
I’m gonna do a really simple one. It’s going to have a popup window that says Hak5 Rules!
First, click on new project and add your boxes. I want to set some text in a message box that will pop up.
So I add the set text box and add a variable that I can re-use for several commands. The variable is called Hak5 Rules, text, and the default text is Hak5 Rules!
Under Set Text I add the Hak5 Rules to the custom text line, then for the message box I add the Variable for Hak5 Rules.
After you make your application, click run to make sure it works. Ok, I need to add the variable to the Set Text box, and now I can click Run, save it, and in a few seconds, there we have a text box that says Hak5 Rules

At first it’s a little tough to get used to if you’ve never designed an app or used code. Once you get the hang of it it’s really easy.
Email me what you think at feedback@hak5.org.

—

HakTip: Crafting packets with HPING

We’ve been talking about screen, and packet sniffers, but today I’m putting ‘em together with a new tool to craft our own packets.

Hping3 is a TCP/IP packet assembler. It’s modeled after the unix ping command — but it can do so much more. It’ll craft TCP, UDP, ICMP or even RAW-IP packets.

So here in the top screen I have tcpdump running on eth0. If I issue a ping 66.11.227.169 I’ll see that traffic.

Now let’s say I want to not just ping the server, but figure out if there’s an HTTP daemon running. For this we’ll do what’s called a half-open SYN connection.

hping -c 1 -I eth0 -s 1234 -p 80 -S 66.11.227.169

In the top screen I can see my traffic. In the bottom I get the output from hping and I can see that we sent a SYN packet and received a SYN+ACK. Since we’re not completing the three-way-handshake we never complete the connection, thus leaving it as a half-open SYN connection.

Just as an example I’m going to run the command again but this time let’s change it to port 81.

hping -c 1 -I eth0 -s 1234 -p 80 -S 66.11.227.169

And in this instance there isn’t a daemon running to answer the SYN, thus we see 1 packet sent, 0 received.

Now this is just scratching the surface of what’s possible with a traffic generator like hping and a debug setup like tcpdump coupled with screen. And of course I’m looking forward hearing about your favorite packet assemblers.

So what tips are rocking your world? Send ‘em by tips@hak5.org

In this segment Darren covers the beautification aspects of the case mod, tackling the tricky bits of cable management and accent lighting with cold cathodes. Darren reviews some of the recent case mod feedback and looks forward to hearing your ideas for future mods. Send ‘em by feedback@hak5.org

—

Trivia!

Last week’s trivia question was:
In WarGames, this character gives his name to the first computer game Lightman finds. The answer is Stephen Falken.

This week’s trivia question is:
This composer of Blade Runner was an inspiration to the recently released OST by Daft Punk of Tron Legacy?

Answer at hak5.org/trivia for your chance to win some hak5 swag!

Emails: Cluster Specs, Dropbox Alternatives and Brute Force scripts

“Jamie writes:
PLEASE tell us all the parts you use for the cluster nodes in episode 823. Please??? Love the show.”

The exact specs are ASUS P8 H67-M series motherboard, Core i5 2500K CPU, 2.5″ Scorpio Blue 250GB hard drive, and the least expensive 4GB of RAM you can find.

“You guys should work on metatagging your episodes based on what is covered and then have a search function for that… I am having all sorts of issues finding a few older episode I remember on Android… as I just a working one I want to play with it now -initialhit”

We are! In fact Paul is even cataloging our archive of segments. You may have noticed the code, game, geek, hack and IT categories on hak5.org. Stay tuned as we get all of our content cataloged over the coming weeks.

“After the last CCC I realised that you could brute force stegfiles a
Lot faster if you created multiple concurrent threads to do the work.
So, I wrote my own script to do just that. It’s definitely faster than
cypherround’s script, though not as pretty. I don’t have a website or
blog, so I pastebinned it http://pastebin.com/nLSbbF17.
Oh, and I’m really looking forward to the next CCC! –Nevermore”

Wicked! Thanks Nevermore

Tim writes: “Hey guys, I have a question about a possible dropbox alternative.

I have been using dropbox for about a year now for my paranormal research group. It has worked great for sharing casefile paperwork, evidence collections, etc.

I would invest in the pro versions to hold more space, but due to a security concern, each member of our organization has their own account and each person depending on
their position in the company gets access to certain folders, if I got pro for each person I would end up spending thousands of dollars a year (we have 20 members)

My question is could there be a better way of sharing files and synchronizing file versions instantly between users. I tried Microsuck Skydrive but I am also using some linux
machines which counts that out.”

The short answer is rsync. The longer answer will be a future segment, but
here are some links to get you started:

http://philcryer.github.com/lipsync/, https://github.com/philcryer/lipsync#readme, http://fak3r.com/geek/howto-build-your-own-open-source-dropbox-clone/, http://code.google.com/p/s3fs/wiki/FuseOverAmazon, and http://www.tarsnap.com/.

—

Keep up with the latest on Hak5 by following us on Twitter or Facebook. Subscribe and get your weekly technolust delivered automatically. Or show your support and grab some swag from the HakShop – including the new airport friendly WiFi Pineapple and hoodie. Finally if you’d like to suggest a topic
for ask a question feel free to hit up feedback@hak5.org.

The first part of the photo frame case mod build.

Using two Ikea RIBBA series shadow-box photo frames to display a mounted and lighted motherboard for your admiration. Technology is a beautiful thing.

Jason continues the internet enabled garage door opener project by writing an Android app.

The Android app has a simple interface allow access to a home Apache server, hitting a PHP script that interfaces with a USB Teensy over serial, activating relays connected to a remote.

Code available here.

Darren and Jason dive into making an internet enabled garage door opener by setting a home Apache server, hitting a PHP script that interfaces with a USB Teensy over serial, activating relays connected to a remote.

Teensy code :

void setup()
{
Serial.begin(9600); // USB is always 12 Mbit/sec
pinMode(17,OUTPUT); //Door
pinMode(18,OUTPUT); //Gate
}

void openDoor(int pin,int d){
digitalWrite(pin, HIGH);
delay(d);
//stop opening doors
digitalWrite(pin, LOW);
}


This week we’re breaking out the breadboard for an oldschool Hak5 mod — the Internet enabled garage door opener. Because when it comes to garage entry, what could be easier than writing an Android app to access a home Apache server, hitting a PHP script that interfaces with a USB Teensy over serial, activating relays connected to a remote. Duh.

Download HD Download MP4 Download XviD Download WMV

Garage Door Opener

void setup()
{
  Serial.begin(9600); // USB is always 12 Mbit/sec
  pinMode(17,OUTPUT); //Door
  pinMode(18,OUTPUT); //Gate
}

void loop()
{
   char c = Serial.read();

  if(c == '0')
  {
    //open door
    Serial.println("Open Door and Gate");
    openDoor(18,1000);
    openDoor(17,1000);
  }
  if(c == '1')
  {
    //open door
    openDoor(17,1000);
  }
  if(c == '2')
  {
    //open gate
    openDoor(18,1000);
  }
}

void openDoor(int pin,int d){
  digitalWrite(pin, HIGH);
  delay(d);
  //stop opening doors
  digitalWrite(pin, LOW);
}

If you want to know the latest on Hak5 be sure to follow us on Twitter or Facebook.

Also, now is also a great time to grab some swag from the HakShop – including the new airport friendly WiFi Pineapple with free world-wide shipping.

And finally if you’d like to suggest a topic for a future show feel free to hit up feedback@hak5.org

Jason Appelbaum and Jenn Cutter bring us sights from the show floor at the Penny Arcade Expo East 2010. Table top dungeons & dragons on a multi-touch surface! A mod to turn any guitar into a game controller and killer gaming headphones. Plus, Shannon investigates secure delete utilities in this week’s Snusb Report. All that and more this time on Hak5.

Download HD Download MP4 Download XviD Download WMV

Guitar Game Controller Mod

Jason speaks to Alan Chatham of OpenChord.org about their mod that turns any regular guitar into a Rock Band or Guitar Hero controller!

LAN Party

Our next LAN Party, powered by the Varsity eSports League, is Counter-Strike Hide n’ Seek! We’ll be playing this Saturday at game.hak5.org.

Go To Assist Express

Their computer. Your brain. How do you get the two together without wasting time and money traveling? Use Go To Assist Express to view and control your customer’s computer ONLINE so you can fix the problem on the spot! Save time and money on travel. Satisfy customer quickly and efficiently. Then move on to other tasks! Try Go To Assist Express FREE for 30 days! For this special offer, you must visit GoToAssist.com/Hak5. That’s GoToAssist.com/Hak5 for a FREE trial.

Multi-touch Dungeons and Dragons

Jason talks to producer/designer Dyala Kattan-Wright and programmer Whitney Babcock-McConnell about Carnegie Mellon University project Surfacescapes — a mashup of Dungeons & Dragons and a Microsoft Surface.

Trivia

With a 1985 US launch, this 8-bit console sold 34 million units in North America before being discontinued in 1995. Enter for your chance to win Pronobozo’s NEW album Hackwave by submitting your answer at hak5.org/trivia

Squarespace
Squarespace is a publishing system for anyone looking to build a blog, portfolio or any kind of website…Squarespace offers a uniquely flexible tool for just about anyone (no coding experience required) to build high end, complex websites with that same functionality that you will find on some of the highest trafficked pages on the web. Squarespace’s newly launched site importer tool makes things so easy to move over. Get a 14 day free trial at Squarespace.com and use code HAK5 for 10% off the LIFETIME of your service.

Tritton Technologies Gaming Headphones

Jenn Cutter from OpenAlpha.tv speaks with Fred Schweer of Tritton Technologies about their cross-platform gaming headphones.

Snubs Report: Secure Delete Utilities

When you absolutely positively need a file to be gone from your system, never to come back from the grave again, you need a secure delete utility in your arsenal. Today Shannon investigates just that, in this week’s Snubs Report

First up, a command-line tool from Microsoft. Sdelete has all the switches and arguments to turn a file into a steaming pile of random bits. It’ll even nix NTFS compressed or encrypted files using the Windows defragmentation API. Minding our P’s and Q’s we learn that the -P option specifies how many times we would like to overwrite a file, and -Q keeps it quiet. Perfect for batch scripting. For example:

@echo off
sdelete.exe -p 4 -q -s %1

If you’re looking for something a little more graphical and user friendly have a look at INFERNO!. While this open-source Windows utility isn’t much to look at, and requires the Microsoft VB 6.0 runtime, it does get the job done. Sporting simple file overwrites, Department of Defense spec overwrites, and the sophisticated Gutmann method for cleaning your disk, this tool surely packs a punch.

Think we missed a gem? Hit us up at feedback@hak5.org.

Don’t forget you can subscribe to Hak5 on iTunes, Miro, Tivo, Zune and YouTube.

If you want to know the latest on Hak5 be sure to follow us on Twitter or Facebook.

Also, now is also a great time to grab some swag from the HakShop – including the new airport friendly WiFi Pineapple with free world-wide shipping.

Details on Darren’s journey across North America can be found at HackAcrossAmerica.com.

And finally if you’d like to suggest a topic for a future show feel free to hit up feedback@hak5.org

Adding a touch screen to a LCD is pretty straight forward and fairy inexpensive. There are a few different places to get the touch screen kit, we got ours from ebay for around 80 bucks + shipping. Dealextreme.com has a small selection of smaller touch screen kit perfect for netbooks, because they come with a controller made to connect internally instead of external usb. When buying a kit to make sure it comes with the matching controller to avoid any head aches.

This time on the show Jason Appelbaum joins with a touchscreen LCD mod that’s a lot easier than one might think. Then Darren and Matt pit their desktop virtualization platforms, Virtual Box and VMware Workstation, against eachother over a game of Halo.

Download HD Download MP4 Download XviD Download WMV

Adding a touch screen to a LCD is pretty straight forward and fairy inexpensive. There are a few different places to get the touch screen kit, we got ours from ebay for around 80 bucks + shipping. Dealextreme.com has a small selection of smaller touch screen kit perfect for netbooks, because they come with a controller made to connect internally instead of external usb. When buying a kit to make sure it comes with the matching controller to avoid any head aches.

When it comes to desktop virtualization Matt and I think very differently. While I agree that VMware’s ESX and (free) ESXi solutions are killer, I can’t seem to justify the price of target=”_blank”>VMware Workstation when Sun’s Virtual Box is free, open source, full featured, super speedy and rock solid. Matt doesn’t agree.

Matt wouldn’t agree with my assessment, but he doesn’t write the show notes so I’ll just go ahead and link to this totally unbiased comparison.

In this episode Matt uses PowerGUI to command the new Windows PowerShell, Chris Gerling demonstrates Helix, an open source forensics toolkit and Darren builds a simple web mashup using Yahoo Pipes. Plus haksnacks including router passwords, uninterrupted file copying, password strength auditing, and Firefox keyword shortcuts.

Oh yeah and some bloopers. A lot of bloopers. Actually, pretty much most of the episode is one ongoing blooper. We’re kicking it oldschool Hak5 style. Call it senioritis if you will .

PS: Hak5 and trust your technolust stickers available for a limited time.

Production Notes

The new scan converter (device that takes the VGA output from our computers and inputs them into the video mixer) had great resolution and clarity however that isn’t seen in this episode. Unfortunately the video signal was a bit borked and everything captured was slightly pink. I’ve done my best to balance the color in post. Better luck next time I guess

Sponsors

It used to cost a fortune to protect your site with an SSL Cert. Thankfully, GoDaddy.com changed all that. You can get a standard SSL cert from Go Daddy for just $29.99 a year. They have the same basic specs you’d find on other certs – 256-bit encryption, 99% browser recognition, all that – but for about 80% less than the competition. Now you’ve got no reason to leave your data exposed. Grab an SSL cert from GoDaddy.com now for just $29.99. And save 10% on Domains and SSL certs with coupon code HAK.

Get awesome web hosting from the pros at Dreamhost and receive $25 off your order when you enter coupon code HAK5! Plans start at $7.95/mo including 500 GB storage, 5 TB bandwidth, and one-click installs of popular software like WordPress, phpBB, and MediaWiki.

In this episode Chris Gerling shows us a little reverse engineering with Crackmes, Darren unlocks OpenWRT on the Fon router, Will Coppola demonstrates inprotect, a nessus/nmap web frontent, and Matt fixes the Rock Band guitar once and for all. Plus HakSnacks including installation package building with Iexpress, a Rock Band drum kit for your PC, converting flash videos to mobile media formats, and browsing the Internets with calculator. Grab some pwnj00z, the next hour is designated for technolust!

Production Notes

The white balance on our scan converter (little boxy thing that converts our laptop’s display into something the video mixer can use) was a bit off making some of the full screen video difficult to read. Thankfully (and thanks for MassiveH) we’ve got a new scan converter that should make everything look a lot more clear for next episode. Everything has been detailed in the Show Notes and feel free to post in the forums if you have questions.

Sponsors

Get awesome web hosting from the pros at Dreamhost and receive $25 off your order when you enter coupon code HAK5! Plans start at $7.95/mo including 500 GB storage, 5 TB bandwidth, and one-click installs of popular software like WordPress, phpBB, and MediaWiki.

Keep your personal information away from spammers, hackers and your crazy ex-evilserver. Private Domain Registration from GoDaddy.com protects your privacy by keeping your address, phone number and more out of the public database. Get an additional 10% on your order when you enter coupon code HAK.