Hulu and the BBC iPlayer everywhere with a little VPN action to bypass Geo IP filters. We’ll be setting up Network Manager in BackTrack5. Plus, Linux inside of Windows, graphing trace-routes in terminal and a whole lot more this time on Hak5!

Download HD Download MP4 Download WMV

VPN in BackTrack 5 with Network Manager

BackTrack 5 is rocking my world as of late. I’ve been running the gnome 32bit version as my primary os on one of my laptops since release and I so far it has been fantastic out of the box.

That is until I wanted to easily connect to a PPTP VPN. While BackTrack5 includes Wicd — the Wireless (and wired) Interface Connection Daemon I’m more familiar with Network Manager, which includes a VPN client. Two birds, one stone!

In this segment I setup Network Manager in BackTrack 5.

apt-get install network-manager-gnome

cp /etc/network/interfaces{,.backup}

echo “”auto lo”" > /etc/network/interfaces

echo “”iface lo inet loopback”" >> /etc/network/interfaces

service network-manager start

nm-applet&

reboot

Run Linux apps in Windows with AndLinux

If you want to run Ubuntu seamlessly inside a Windows box, perhaps you’ll be interested in this tool called andLinux. AndLinux is a complete Ubuntu system that runs in Windows (all except 64-bit 7) and uses a program called coLinux as it’s core. CoLinux is a port of the Linux kernel to Windows. It’s kind of like running linux in a VM, except with coLinux, andLinux merges itself with Windows and the Linux kernel instead of running through an emulated PC. andLinux is for fun and development and it can run almost any Linux applications without having to do any modifications.
So, with andLinux you get a fully functional Linux system, with no desktop interface. It gives you a second panel or start menu where you can load Linux apps. The apps can be run simultaneously with Windows apps and you can cut and paste text between them.

AndLinux comes in a couple of different versions- KDE version (which is a full version) or XFCE (minimal). When you go through the andLinux installation on Windows, there are a few important steps to keep in mind.
Choosing your start up type: I chose run andLinux automatically as a NT service because it is the most convenient choice. You don’t have to do any kind of configurations if you choose this option.
You’ll be asked to create a username and password for andLinux login.
For Windows file access, I chose COFS as it gives you easier configuration compared to Samba. Samba will, though, let you share files with special characters.
Also, if Windows starts freakin because it’s not Microsoft certified, just click continue anyway.

Once the installation has finished, just restart your computer and unblock any windows firewall settings that may occur from the installation. To start using andLinux, first run the NT console. This will open a command prompt that’ll ask you for your username and password. You can then close that window and start using any of the programs and applications that are available in the boot menu. It’s kind of like downloading all the Linux programs straight into Windows without using a Linux OS.

So I’m just going to try some of these programs out, and they all seem to work just fine. So andLinux looks to be a very handy way to use Linux applications indeed! If you like it, tell me so! feedback@hak5.org.

Nibble: MTR isn’t your fathers traceroute

MTR isn’t your father’s Traceroute. It’s the ultimate command line tool for finding out where those tasty little packets are getting lost. From bash issue mtr –report-wide –curses and your destination of choice.

mtr –report-wide –curses 8.8.8.8

MTR will bring up a curses terminal interface with a constantly updating report on hops and pings, complete with hostname, best and average latency, and percentage of packets lost at each link.

Thanks to Brian for sending this in and scoring some complimentary hak5 swag. Submit your 4-bits at hak5.org/nibble

If you’re into Hak5 you’ll love our new show by hosts Darren Kitchen and Shannon Morse. Check out HakTip!

Whether you’re a beginner or a pro, HakTip is essential viewing for current and aspiring hackers, computer enthusiasts, and IT professionals. With a how-to approach to all things Information Technology, HakTip breaks down the core concepts, tools, and techniques of Linux, Wireless Networks, Systems Administration, and more

And let’s not forget to mention that you can follow us on Twitter and Facebook, Subscribe to the show and get all your Hak5 goodies, including the infamous WiFi Pineapple over at HakShop.com. If you have any questions or suggestions please feel free to contact us at feedback@hak5.org.

If you’re an IT or software consultant, you’re always looking to compete with the big guys. Problem is you may be a one man show! You need a remote support tool – and the best is Go To Assist Express. The faster you can connect to a customer, the faster you can move on to the next challenge! Reduce your travel time and increase revenue by handling more support requests. Brought to you by Citrix, you KNOW Go To Assist Express is easy and secure. Try GoToAssist Express FREE for 30 Days. For this special offer visit GoToAssist.com/Hak5.

If you want to build a video site or if your website has a play button, I recommend getting a dot TV domain. A dot TV website lets you showcase your original content and create a unique site, not just another YouTube channel.
Just go to domain.com and search for the perfect dot TV domain for your new idea. Then use coupon code Hak5 at checkout to save an extra 15%.
If you need to host your dot TV website, don’t forget about Domain.com’s web hosting plans. They’re less than six bucks a month and have everything you need to build, maintain, and promote your site.
Remember – when you think domain names, think domain.com.
Got a great idea? It all starts with a great domain. domain.com

Audible.com is the leading provider of downloadable digital audiobooks and spoken word entertainment. Audible has over 75,000 titles to choose from, to be downloaded to your iPod/MP3 player and played back anywhere, anytime. Choose from books in every genre, science fiction, thrillers, drama, comedy, business, history and more. Go to audiblepodcast.com/ hak5 to get a FREE audiobook-download of your choice when you sign up today. Again go to Audiblepodcast.com/hak5 for your Free Audiobook!

Checking out an alternative to Virtual Box called VM Ware Player.

Download HD Download MP4 Download WMV

In episode 10 of HakTip we went over Virtual Machines- what they are, why you would use them, and what they are good for.But you don’t necessarily have to use VirtualBox to try out a VM. There are plenty of virtual machine programs on the market, but not all of them are free or easy to use. VMware Player is both of these with a whole bunch of awesome built in as well. This program, available at vmware.com, lets you run several operating systems virtually, as well as give you the comfort and safety of trying out new software in a VM. Because sometimes, software you might download is just downright janky crapware. Over 200 different operating systems are supported including various versions of Windows, Linux, and even Chrome OS.

When you first download VMware Player, you’ll need to register for a new VMware account. They ask for your name, a password, and some geographical data, but that’s about it. The installation wizard is your normal process of yes and next. Upon opening, the general layout is about the same as VirtualBox. On the right you can choose to create a new VM, open one, upgrade to the paid VMware account, or choose help.
Click on Create a new Virtual Machine and choose installer disc image file (iso). From here browse to your .iso for the operating system you want to try out. I’m going to create a Puppy Linux VM so I’ll choose my Puppy Linux iso and click next. Choose Linux and in the drop down menu choose Other Linux 2.6 kernel. If you chose a different Linux distro, find it in the list and click on it. You can then choose how much space is allotted for the VM, so I went with 8 GB.
Once done, you can boot up your VM and test it out.

Before I reveal which one was my favorite between VirtualBox and VMware Player, I’d like to take a moment and mention some extras.
VMware Player comes with some handy tools, such as this one called the VMware Browser Appliance. You download this zip file from the website and extract it, then in VMware Player, choose open a Virtual Machine and browse to the folder. The Browser Appliance allows you to securely browse the Internet using Firefox to protect against adware and spyware, and safeguard personal information- as it can be configured to reset itself each time it’s booted up, so no info is stored.

Also available is this wide array of Virtual Appliances found on VMware.com. These applications can help you with information in the cloud- storage, IT administration, networking, and much more.
So now that I’ve checked out both VirtualBox and VMware Player, I have to say I think I like VirtualBox more. While both are free to use and work with all sorts of VM’s, VirtualBox seems to be a little bit faster in the guest OS as well as the host OS. Also, VMware Player only lets you use on Virtual Machine at a time, while VirtualBox will let you open many at a time.

That’s it — Virtual Machines are actually pretty easy? Ok, so I want to hear your feedback. What program or command have you found? Hit me up — tips@hak5.org

And be sure to check out our sister show, Hak5 for more great stuff just like this. I’ll be there, reminding you to trust your technolust.

This time on the show I’m creating a virtual machine inside VirtualBox.

Download HD Download MP4 Download WMV

Now, way back on episode 4 of HakTip, I introduced a program called YUMI (aka Your Universal Multiboot Installer), and I demoed it inside a program called VirtualBox. I got tons of questions about VirtualBox, so I decided to dive in and show you guys how to use it. I’ve been a Windows fangirl ever since I was a kid and my dad was building computers in our living room, but I’ve toyed around with Ophcrack and Puppy Linux a few times. Being somewhat new to the Linux operating system, you may not be ready to dual boot your PC or switch over completely to a new OS, so you might want to just test it out in a Virtual Machine that runs inside your Windows machine.

Today we’ll be setting up our very own VirtualBox Machine, but first it’s time for a few terms.

A virtual machine (VM) is a software implementation of a machine (i.e. a computer) that executes programs like a physical machine. It can be used as an operating system that you can open and boot into on your normal computer. So, for example, I am currently running Windows 7 on my laptop, but I am also running this Linux Virtual Machine inside VirtualBox, a program installed in Windows 7. Using a Virtual Machine means I don’t need any hardware. I don’t have to build a second computer just for Linux, and I don’t have to reboot my laptop every time I want to dual boot into my Linux Operating System. All I have to do is open VirtualBox, choose my Linux VM, and start the OS.

VirtualBox is a handy open source program that you can install on your host computer (the one that is going to be running the VM’s), whether it be Windows, MAC, Linux, or Solaris. Inside VirtualBox, you can boot into a second operating system, whether that means you boot into Linux while still being logged into Windows, or you boot into a MAC while still being logged in on a Linux machine, etc; and it will run as if it’s just another application on your regular operating system. You can run as many virtual operating systems inside VirtualBox as you want, the only limit is your computers disk space and memory. All of these operating systems that you can boot into are called the Virtual Machines.

VirtualBox will interpret any operating system you install as a VMDK, which is a Virtual Disk Image. This image file is considered a hard drive by VirtualBox, which is why it can boot into the operating systems.

So lets get started in the program. When you first boot up, you won’t see any VM’s listed, because you haven’t created any yet. Click on the New button at the top. From here, you will go through a setup wizard. First you’ll need to choose a name for your first Virtual Machine. I’ll call this one Ubuntu 32 bit. Then choose your OS Type that you will install in a few minutes. This will be Linux Ubuntu for myself. Next you will choose how much memory you want to allocate. I would suggest anything higher than 512 MB. I chose 1 GB for mine.

Next you will need to create a new hard disk. Since I’ve never run Ubuntu on my machine in a VM, I’ll need to create a new hard disk, enabling VirtualBox to see and use the operating system I’ve downloaded as a .iso file. Next you need to choose whether you want to store data dynamically or fixed size. I recommend dynamic data storage because it takes up less space and will only use up more space as needed.

Click next and choose the location you want to store data. I’ve created a new folder called Ubuntu and chose 8 GB allotted space.

After this, you’ll see a summary of your choices; click finish.

Now you’re ready to start up your new VM for the first time! Click on your new VM and choose Start. First you’ll need to select your installation media. This is where the Ubuntu .iso we downloaded earlier takes place. Click on the folder icon and find your .iso, then click next and finish. If all goes well, you’ll see a little first-time popup about how your mouse will be captured inside the VM and you’ll have to press a host key to use it in your Host PC again, and the new Virtual Machine operating system should start. After waiting a few minutes it looks like mine worked! Now, you can see I’m running Ubuntu inside my Windows 7 laptop. It’s automatically connected to the internet, and I can tinker to my heart’s desire.

In addition to being able to use VirtualBox like I did previously, you can also choose to add Guest Additions. These are addons that enable you to use the mouse without the need for a host key to uncapture it, share folders and files between the host PC and the guest VM, give you better video support, and plenty of other features.

What program or command is giving you warm fuzzies? Hit me up — tips@hak5.org

And be sure to check out our sister show, Hak5 for more great stuff just like this.

This time on the show, Shannon demonstrates a novel password management technique. Darren’s explains Time Memory Trade-off and Rainbow Tables. Jason gets started programming for Windows Azure and it’s Linux in your web browser time! A PC Emulator in Javascript.

Download HD Download MP4 Download WMV

A novel approach to password management

I have about a million websites that I have to log onto day-to-day. Seriously. And with all the hype about website infiltration and stolen data, it makes me worry a bit about my own usernames and passwords. I have recently upgraded my Google Mail account to use 2-step verification, which I explained a few weeks ago in a Snubs Report, but what about my facebook? Twitter? My online banking?

These sites all say things like, ‘Password must be so-and-so characters long with at least one letter and number’, but some aren’t so secure. How will I know what sites will have a data breach? I don’t. So I use somewhat different passwords for all sites. But honestly, if someone had the balls and the time to figure out my pattern, they could probably do it. But I don’t want to download a password protection program to use on my home computer because I use several different computers and may not have access to the software or my saved encrypted passwords when I’m using a public PC.

Well, there are other options out there if you don’t want to use more software, you could use something a little less technical.

This is PasswordCard from passwordcard.org. It’s a card the size of a credit card that I can stick in my wallet and carry with me. What makes this unique is the series of random digits and letters that are included on it. The rows are different colors and the columns have a different symbol at the top. You can use this card to think up a very strong and tough password and use the colors and symbols to remember it.

Better yet, each code card is randomly generated and there are Android and iPhone apps.

So here is an example of how to use this tool:

First off, go to the website and print out your unique card. I have a laser black and white printer, but if you have a color printer I’d suggest printing in color to give you more options for remembering passwords.

You can then cut out your card and laminate it if needed. Keep the rest of the page, because it has your unique card number on it. More on that in just a bit.

Then you can choose your password. Choose a symbol and a color or row number and use the letters and numbers that are seen in that row or column.

All you have to do after that is go to your website and change your password. If you lost your PasswordCard, you can go back to the website, type in your unique card number and hit print, or pull it up on your mobile phone.
So for example, I printed out my card and I’m going to choose something I would remember. I’ll go with the music note, and number 7. So my password would be HAg8kgntQUG.

This tool is super simple to use and completely free. The website can be visited safely via HTTPS and the algorithm used to create the codes is available in case the website goes down and you need to reprint your card.

If you don’t feel safe printing a card, just download the free app off the Android Marketplace or the Apple App Store. This app will let you generate a random card or pull up your own card. It’ll also let you generate your own personal PasswordCard based on a series of random hexidecimal digits. For example, I can hit enter number, and type in a number that I have memorized. That number will always pull up my card for me to use.

If you’re worried that someone can get ahold of your unique card number, not to worry! They still wouldn’t have your actual passwords because those were created from the numbers and letters found on the card, and they could be thousands of different password combinations.

I think this is a pretty cool idea, and it’s easy enough that I could probably show my mom how to use this. So, enough of using crappy passwords!

This is just one of the tools available out there for password generation. Do you have one? Email it to me: feedback@hak5.org. Now for the haktip.”

Start programming in Windows Azure

Jason. begins a three-part mini-series on programming for Windows Azure. In this part Jason demonstrates how to get started. In coming parts Jason will develop an cloud-based application that maps Kismet KML data to a Bing map.

If you’re into Hak5 you’ll love our new show by hosts Darren Kitchen and Shannon Morse. Check out HakTip!

Whether you’re a beginner or a pro, HakTip is essential viewing for current and aspiring hackers, computer enthusiasts, and IT professionals. With a how-to approach to all things Information Technology, HakTip breaks down the core concepts, tools, and techniques of Linux, Wireless Networks, Systems Administration, and more

And let’s not forget to mention that you can follow us on Twitter and Facebook, Subscribe to the show and get all your Hak5 goodies, including the infamous WiFi Pineapple over at HakShop.com. If you have any questions or suggestions please feel free to contact us at feedback@hak5.org.

This time on an exciting brand-new-studio edition of Hak5 we’re getting hands on with the latest version of BackTrack-Linux, configuring virtual machines and wireless. Shannon’s flashing the firmware on a Dingoo Digital A320 and installing a custom distro of Linux and so much more.

Download HD Download MP4 Download WMV

Hacker Headlines

Oh Skype… They have another security problem. Skype on Mac OS X has a bit of a flaw. You can send a Skype message to another user and potentially get remote access to that other computer. Gordon Maddern, a security researcher, found the flaw and told Skype about it more than a month ago, but there was no fix until after the news started spreading that there was an issue. Skype has released a small term patch, but no full fix has been released, nor has users been notified to update.

Just days before Google I/O begins, French security firm Vupen demonstrates a zero-day vulnerability in Google Chrome allowing remote execution. The exploit, which hasn’t been released to the public, bypasses Chrome’s praised Sandbox as well as Address Space Layout Randomization and Data Execution Prevention. Google, busy introducing the Chromebook, has not verified VUPEN’s claims and says that if necessary an update will be pushed to users automatically.

The death of Osama Bin Laden has spurred several scams throughout the interwebz. Malware has shown up on certain websites, a Facebook scam popped up, and even the blog of the guy who accidentially live twittered the event has been compromised. Scammers are smart and they know what you’re looking for. People want to see the ‘Osama death video’, which doesn’t exist. So for anyone out there who was considering clicking that video on Facebook and sharing it with your friends, DON’T, and while you’re at it, delete it from your profile if someone else posted it.

Symantic security researchers are reporting that a flaw in the way application authentication works on Facebook, nearly 100,000 apps may have complete access to your account. Facebook now uses OAUTH 2.0 for authentication, however older authentication schemes are still in use. The firm advises users to change their passwords immediately — which essentually thwarts the access token bug.

Hot off the heals of Ubuntu’s 11.04 “Natty Narwhal” release — which has been getting mixed reviews due to the new Unity window manager, Backtrack Linux releases the much awaited version 5. In addition to native 64-bit and ARM processor support the security distribution now comes in both KDE and Gnome flavors. Are you excited? Have you checked it out? It’s available via torrents, has a stealth mode, comes with Metasploit, and sounds just plain awesome!

Kerby’s oldschool app of the week
Oregon Trail

Hacking the Dingoo Digital A320

This week I’m introducing this fun little device called the Dingoo Digital.

The Dingoo Digital A320 is a gaming handheld for open game development. It has modest hardware specs: 400MHz CPU, 32MB of RAM, 4GB internal storage, a miniSD reader, a 2.8″” LCD screen with a 320×240 resolution, and your normal jacks. The cool part is the software. You can playback several video and audio file types, there is a built in FM tuner for radio, you can record voice, and the SDK is available for free. My favorite part is it’s customization features and ability to play ROMs. Because who doesn’t like video games?

The device comes preinstalled with several arcade games like Centipede, Mine Sweeper, and has built in Emulators for your convenience as well. But if you want more with your new toy, what is better than installing Linux on it?

Enter Dingux, the Linux Distro for the Dingoo. You can get Dingux on the dingoo-scene website as well as really easy steps to follow if you want to check it out.

First off, you’ll need to download a couple of files. Booboo’s dual boot installer zip file for Windows, and the local-10 or local zip file. Charge your Dingoo so it doesn’t die during the reflashing process. We don’t want a bricked Dingoo!

Once your files are downloaded, unzip the Dual Boot file into a new folder wherever you want on your PC.

Turn on the Dingoo and go to the ‘System Setup’ menu, ‘About’, and press A. Press up-right-down-up-right-down and an easter egg diagnostics screen pops up. On the screen it should say ILI9331 or ILI9325 at the end of one of the lines. Mine says 9331. This is an LCD model and pertains to the flashing procedure.

Now, reset the Dingoo by holding B and pressing in the power button. The screen will stay dark so don’t panic!

Plug the Dingoo Digital into your PC. Choose cancel if any ‘new hardware found’ screens pop up. When your PC asks for a driver location choose your newly created Dual Boot folder. The driver should successfully install and you’re ready to flash your Dingoo!

Unplug the Dingoo, press the reset button, and let it boot into the normal firmware. You won’t need to hit the on button during this reset.

Hold the B button down and press POWER AGAIN. Plug the Dingoo back into your PC.

Open cmd, and go to the Dual Boot File directory. cd shannon\downloads\Dingoo Dual Boot and execute the usbtool-win file. We’re going to upload a file to a specified address, so we’ll type usbtool-win 1 hwinit.bin 0×80000000. This should start the flashing. Then type usbtool-win 1 zImage_dual_boot_installer_ILI9331 0×80600000 and press enter. A screen will appear on the Dingoo saying Dual Boot Flasher and press start to coninue.

Follow the on screen instructions. If done correctly, it’ll say Success at the end. You should see a Dingux startup screen when your Dingoo restarts. There is another step to getting Dingux to startup, so right now it’ll just boot to the original firmware.

Reset your Dingoo and plug it into the PC. Your PC should find it in a few seconds.

Next, plug in your mini SD card and format it to FAT32. Unzip everything from the second file you downloaded, local-10.zip, to the root of your mini SD card.

After unzipped, go to the mini SD card and rename your LCD screen file to zImage. So, mine is ‘zImage-20090707-ILI9331′, and I’ll change the name to ‘zImage’. Delete the other LCD image file if you want to.

Then, you’re done! Unplug and reset the Dingoo while holding down the Select key. It should boot into Dingux and launch the Dmenu. You should see a new menu on your screen.

Now that you have Dingux installed, go online and find some handy ROMs!

There is a ton of stuff you can do with this gaming device. The growing online community has tons of homebrew video games to try out, theme packs, and ROM’s available. I’ve linked a bunch of the websites in our shownotes. I’m thinking next week I’m going to try to stick Doom on here, because, why not? It’s DOOM!

Email me at feedback@hak5.org with questions and comments.

HakTip: BackTrack 5 first-boot

Darren is excited to be playing with the new BackTrack 5 linux. BackTrack is a fantastic distribution for security auditing. Version 5 is available in 32 and 64 bit flavors as well as ARM processor support and now comes in either Gnome or KDE.

Darren demonstrates how to setup either a USB drive to boot directly off, or a Virtualbox VM. Darren goes on to show off ethernet configuration and setting up a wireless adapter over USB.

Emails

Nick writes in:

http://hackertyper.net/
set type speed to 1 for a more realistic look.

Keep up with the latest on Hak5 by follow us on Twitter or Facebook. Subscribe and get your weekly technolust delivered automatically. Or show your support and grab some swag from the HakShop – including the new airport friendly WiFi Pineapple and hoodie. Finally if you’d like to suggest a topic
for ask a question feel free to hit up feedback@hak5.org.

This time on Hak5 we’re asking the question, can a three node Virtualization Cluster be built for under $1000? With the help of Proxmox, an open source virtualization environment, some cardboard boxes and a knife — we find out!

Download HD Download MP4 Download WMV

Hacker Challenge Recap
Darren reviews the recent Hacker Challenge and details improvements to this ongoing project.

Clustering with Proxmox
Darren demonstrates building virtualization clusters with proxmox. He also learns a very important lesson about the “any key” and pimps his cardboard case mod.

Virtio drivers and paravirtualization explained
Darren demos a live Proxmox cluster while building a Windows machine using the Virtio drivers.