In this HakTip from DEFCON 19 Darren is joined by Mark Wuergler of Immunity to demo Silica, a wireless security assessment tool he has been developing.

Download HD Download MP4 Download WMV

In the demo Wuergler uses Silica to launch a client side attack on an Android phone.

What programs or commands are rocking your world? What technologies are tickling your technolust? Hit me up — tips@hak5.org or leave a comment.

And be sure to check out our sister show, Hak5 for more great stuff just like this.

I want to take a minute to tell you about BustedTees. It doesn’t matter if you’re into video games, movies, science-fiction or just wrapping your torso with something weird, BustedTees literally has you covered. You may have seen a BustedTee or two pop up in movies and TV shows. Now you can grab one for yourself. Head on over to BustedTees dot com to find the shirt of your dreams — your bizarre, hilarious dreams. Enter the promo code “HAK5” and receive 20% off your order

Today we’re continuing our discussion on wireless management frames with probe requests and responses.

Download HD Download MP4 Download WMV

Probes come in two flavors; requests and responses. Let’s begin with the request.

A probe request is a special frame sent by a client station requesting information from either a specific access point, specified by SSID, or all access points in the area, specified with the broadcast SSID.

The information being requested in a probe includes the supported data rates, which are also included in the beacon frames typically broadcast from an access point.

The difference here being that by sending a probe request your wireless card is making an active scan of either a specific network or all networks in the area, where as simply listening for beacon frames in considered a passive scan

Today we’ll demonstrate an active scan and we’ll disect the probe requests and responses.

So this brings us to the responses. Typically when an access point hears a probe request frame, either directed at the specific access point or to all stations in the area using the broadcast SSID, it will send out a probe response.

Similar to a beacon frame, we’ll find that these probe responses contain much of the same information required for two stations to begin communicating.

To begin our demo we’ll start by once again bringing up our fake access point with airbase-ng. Start by bringing up the interface ifconfig wlan0 up and starting a monitor mode interface on channel 11 airmon-ng start wlan0 11. Now we’ll issue airbase-ng -c 11 -e haktip mon0

So to recap our configuration we have our first radio in monitor mode as interface mon0 and it is acting as an access point or base station with Airbase-ng

We’ll bring up our second wireless card in monitor mode with airmon-ng start wlan4 11 and that will create the new interface mon1 — this will be acting as our client or station.

Now if we start up wireshark& and begin sniffing our client, mon1, we’ll see all of the packets or frames going in and out of this card. 

Immediately we’ll see there are plenty of beacons in the air, which we’ve discussed in previous sessions, so let’s filter those out. And while we’re at it lets also filter our any frame that isn’t address to or from our interface with the filter wlan.addr == 00:0f:04:b2:48:68 && wlan.fc.type_subtype != 0×08

Now in the terminal let’s tell our client card to do a passive scan of the area looking for available access points. Issue iw dev wlan4 scan passive | grep SSID and we should see plenty of SSIDs. If we go back to Wireshark we’ll see there aren’t any probes or reponses. This is because our client card here is reporting all of the nearby wireless networks based on a passive scan, meaning no data was sent out. Our card was completely silent and the data compiled was done so only using what was freely available in the air — in this case beacon frames. We can, and probably will get more sophistocated with this type of silent site-survey using the tool Kismet, but for now this will suffice in demonstrating what is available without transmitting a single frame.

So finally let’s go ahead and generate some Probes. In a terminal we’ll tell our client card to make an active scan of the area using the command iwlist wlan4 scan | grep ESSID.

If we come back over to Wireshark we’ll see plenty of probe requests and probe responses. Let’s take a look at the first probe request frame.

We can tell it’s a probe request as its subtype is 0×04. The source is our NICs MAC address and the destination address is Broadcast or ff:ff:ff:ff:ff:ff, meaning this probe request is meant for everyone who can hear it.

Wireshark already knows it is a management frame and under tagged paramaters we can see our supported data rates as well as the channel. Our first probe is set to channel 1. If we add to the filter && wlan.fc.type_subtype == 0×04 we’ll see that the next probe request was on channel 2, then 3, and so on.

Now if we flip our last filter from subtype 0×04, or Probe Request, to 0×05 we’ll see all of the probe responses. And much like the beacons we’ve seen before, these frames indicate the same capability information necessary for our stations to begin communicating.

What programs or commands are rocking your world? What technologies are tickling your technolust? Hit me up — tips@hak5.org or leave a comment.

And be sure to check out our sister show, Hak5 for more great stuff just like this.

Thrillist sifts through the crap to find the best your city has to offer every day. Wanna know about a Star Wars Burlesque show, a beer garden that screens 80s flicks, or a new restaurant with a Sushi robot? Then sign up for Thrillists free daily emall at Thrillist.com/hak5

Soldering 101: Shannon builds a network tap. Perl and GraphViz for mapping twitter connections. Chrome tips and deauthing WiFi. All that and more this time on Hak5.

Download HD Download MP4 Download WMV

Perl and GraphViz for mapping twitter connections.

As you know I’m a huge fan of programming as a hobby. Picking up BASIC was one of the first major steps that led to me becoming the huge computer geek I am today. So when I saw an email from Hak5 fan Jason Cooper about his latest creation I just had to take a look.

Jason has developed a really nifty perl script that maps links between people on twitter. His first version outputs a file ready to be converted by GraphViz into a beautiful image.

I’ll demonstrate how to get started here in Linux, but this will work on any OS that supports Perl and GraphViz which is pretty much all the major platforms.

I’ve wget’d and unzip’d the twittermap code from HeckrothIndustries.co.uk

Running ./twitterMap we’re presented with the arguments. Running more on twitterMap reveals an explination of the options.

As a test I’m going to run twitterMap with –breadth-search –limit=3 –max-pages=3 –output-file=hak5darren1.map –twitterid=hak5darren

This is going to take a moment while the script combs through the last three pages of my tweets and follows back 3 levels deep through messages sent to and from the specified account.

Jason hopes to add the option to map followers in addition to messages and the option to produce word lists from tweets.

Once twitterMap finishes I’ll be left with the output file specified. If I less the output file I can see a list of twitter IDs and their relationships. The colors correspond to relationship. Red is the origin while blue represents neighbors, black third parties and orange IDs that haven’t been looked at.

Using GraphViz the output file can be converted into an image with the syntax “”fdp -o hak5darren1.png -Tpng hak5darren1.map”"

This may take a bit so while GraphViz is processing you may want to pop back over to Jason’s site and take a peek at some of his other creations – like sssDetect, which detects when you’ve been a victim of Moxie’s sslStrip tool, or a nifty catch game for the GP2X.

Once complete you’ll find a PNG file in your source directory and honestly, it looks fantastic.

This is a great example of the spring model image GraphViz is able to produce from a simple conversion file.

Thanks so much for sending this in Jason. I wasn’t even aware of GraphViz and playing with the code made my day.

So what are you hacking away at? Got any code to send my way? Hit me up — feedback@hak5.org, maybe we’ll have your program on the show.

Kerby’s I Can Haz Cheezburger Kitty of the week

halp! i not cheezburger!

Packet sniffing with a LAN Tap

Today we’re packet sniffing — and no it’s not a black hat man in the middle attack. If you’re a network administrator or anyone who has to troubleshoot network issues you should have a passive network tap in your toolkit.

A network tap is basically a piece of hardware that lets you see the data flowing across a network. In a lot of cases you can use a computer to monitor the traffic between two points on the network, say between your router and switch.

Suffice it to say, if the network between points A and B are of the physical ethernet cable variety, a “”network tap”" is the best way to take a look at the traffic. A tap has at least three ports: an A port, a B port, and a monitor port.

For example the A port could be connected to the switch providing Internet access and the B port could be connected to the computer you’d like to monitor. And the monitor port is just that- a port that lets you monitor what’s in between.

Network taps are commonly used for network intrusion detection systems, VoIP recording, network probes, and packet sniffing, along with several other uses. Taps are used in security applications because they are non-obtrusive, in most cases aren’t detectable on the network, and can deal with full-duplex connections.

In our case, this network tap will work indefinitely since it doesn’t even need power. Passive network taps are almost the same thing as a general network tap, except these do not need power, there is no built-in computer or moving parts, and it’s just a few wires and connectors that will move data from one point to another.

You can build a passive network tap for under 20 bucks from parts at your local hardware store. A while back our friend Mike Ossmann built a 5-in-1 network admin cable that could do all sorts of stuff like Serial Console, Cross-Over and part of that was a passive network tap in a sort of throwing star design. Since then the Throwing Star LAN Tap has born under the Great Scott Gadgets brand.

This little guy is a small, simple device for monitoring Ethernet communications. To the target network, the Throwing Star LAN Tap looks just like a section of cable, but the wires in the cable extend to the monitoring ports in addition to connecting one target port to the other. You can use the Star along with tcpdump or Wireshark to collect data.

Now the throwing-star comes as a kit so you’ll have to solder it together yourself, which is half the fun. The tap comes in 7 pieces, the printed circuit board, four modular connectors and two capacitors.
Normal gigabit signals travel in both directions and it’s impossible to build a completely passive tap. There are gigabit taps but they’re like 1000 bucks, so yeah – no thanks. To overcome this limitation though, the throwing star gracefully degrades the signal with these two supplied capacitors that force the connection down to 100 Mbits by adding a slight noise to the line. Unless you’re using a really really long cable this shouldn’t become an issue and in most cases the tapped device will just drop down to 100mbit without trouble.
You will also need a soldering iron, some electrical solder (i’m using rosin core solder with flux build in), and a pair of wire cutters. Insert the four connectors into the circuit board. Be careful that each of the leads extends through the circuit board before snapping the connector fully into place. Insert the two capacitors through the circuit board. Once the iron is hot, place just a bit of solder on the tip. This is called tinning, which prevents the tip from oxidizing. Oxidization is bad because the solder wont adhere to oxidized surfaces. Solder both the 8 leads on the connectors and the leads of each capacitor and clip off the excess with wire cutters. There are 36 solder points on this board, which should take just a few minutes once you get going… Ok, with the board soldered it’s time to start using it. For this part I’ve asked Darren to play the victim here and we’ll start tapping his connection.

Connect the computer to the network through the throwing star in line on ports J1 and J2. Connect another ethernet cord to J3 and/ or J4 and plug it into your computer that you’ll be sniffing packets on. One monitor port is send, the other is receive.

Next on your computer, set your ethernet adaptor to promiscious mode. To do so in Linux, type ifconfig eth0 promisc where eth0 is your ethernet adaptor. You can check that the adapter went into promiscuous mode by typing ifconfig eth0 and looking for PROMISC. Now fire up your fav packet sniffer, I’m going to use Wireshark because its built into BT5 already. Click applications> backtrack> information gathering> network analysis> net traffic analysis> wireshark. Then to start viewing traffic, click on eth0 or choose interfaces under capture and click start next to eth0. If all works you should start seeing packets being sniffed. If I want to filter say IRC, I’ll type IRC up in the filter box, click apply, and I should start seeing whatever Darren is sending.

To tap both transmit and and receive you’ll need a second ethernet adapter, like this little USB guy here. Either fire up a second instance of Wireshark or TCP Dump to tap eth0 and eth1 or bridge the connections together.

This is a must for any network geek so head over to ossmann.com for the plans on build your own, or pop by the hakshop to have one delivered right to your door.
”

Nibble: Chrome task manager

I love Chrome. You love Chrome. Well, maybe you love Opera — nothin’ wrong with that. But if a page is harshin’ on your Chrome vibe go ahead and kill it with this keyboard combo. SHIFT+ESC brings up Chrome’s built-in task manager, cluing you into all sorts of details about every tabs memory, CPU and network usage. Right-click to get even more nitty gritty, or just kill the tabs process. There’s even a “”stats for nerds”" link that’ll bring you to about:memory for more than you ever wanted to know about how that flash game’s robbing your resources. Sorry Adobe — just sayin’

You know the deal, hak5.org/nibble — keep ‘em under 8 bits.

If you’re into Hak5 you’ll love our new show by hosts Darren Kitchen and Shannon Morse. Check out HakTip!

Whether you’re a beginner or a pro, HakTip is essential viewing for current and aspiring hackers, computer enthusiasts, and IT professionals. With a how-to approach to all things Information Technology, HakTip breaks down the core concepts, tools, and techniques of Linux, Wireless Networks, Systems Administration, and more

And let’s not forget to mention that you can follow us on Twitter and Facebook, Subscribe to the show and get all your Hak5 goodies, including the infamous WiFi Pineapple over at HakShop.com. If you have any questions or suggestions please feel free to contact us at feedback@hak5.org.

Join modding wizard Ben Heck and friends as they build and modify a host of amazing community-inspired creations. Be sure to watch the most recent episode of The Ben Heck Show where Ben builds an Arduino-powered, exterior-mounted camera system for an off-road vehicle. The setup enables the driver to control the cameras from inside the cabin to get a better view of obstacles while driving on rugged, off-road terrain. This show about building, modding and electronics culture is brought to you exclusively by element14. Be sure to visit element14.com/tbhs for a chance to win one of Ben’s latest builds!

I’m here to tell you about a tool that will help you save time and money and make you look like a hero to clients or colleagues GoToAssist Express – by Citrix. Lets you easily resolve computer issues in real time OR after hours. Even work while your customers are away from their computers, dramatically boosting your productivity. In fact, on average, Go To Assist Express users report a 40% increase in productivity – that’s like getting 2 extra work days back a week! Try GoToAssist Express FREE for 30 Days. For this special offer visit
GoToAssist.com/hak5.

.TV is the best domain name for websites with video. If you want to build a video site or if your website has a play button, I recommend getting a .TV domain. A .TV website lets you showcase your original content and create a unique site, not just another YouTube channel. Just go to Domain.com and search for the perfect .TV domain for your new idea. Then use coupon code Hak5 at checkout to save an extra 15%. If you need to host your .TV website, don’t forget about Domain.com’s web hosting plans. They’re less than six bucks a month and have everything you need to build, maintain, and promote your site. Remember – when you think domain names, think Domain dot com. Got a great idea? It all starts with a great domain. Domain.com

Hping3 is a TCP/IP packet assembler. It’s modeled after the unix ping command

Now this is just scratching the surface of what’s possible with a traffic generator like hping and a debug setup like tcpdump coupled with screen.

Darren finishes off the photo frame case mod with a little cable beautification and accent lighting. Shannon’s getting into programming without touching a line of code using the Illumination Software Creator from Radical Breeze. Plus getting crafty with packets and the hping utility, open-source dropbox alternative based on OpenSSH and Rsync, and multi-threaded steganography bruter-forcers!

Download HD Download MP4 Download WMV

Hacker Headlines

Last week we reported on nearly 60 nasty trojans hitting the Android marketplace. Google responded by delisting the publisher and used their app remote kill switch on the over quarter-million affected users. Google also released a security tool to clean up the mess. Well, said security tool has been found on an unregulated third-party Chinese marketplace injected some delicious botnet code. This one sports the ability to send text messages from the zombie’d phone.

A ‘group of hackers’ has figured out a way to scam Microsoft’s XBox Live Points by producing working character strings like the ones you get on the back of the points cards. They released the scheme on a website that would generate the codes for you! Microsoft lost about 1.2 million dollars in points, but they have since blocked the site… though, they don’t have a way of knowing who did it and they’ll probably have to redo the entire algorithm.

Just when you thought your Linux box was safe, a router-rooting bit of malware has been discovered. Once run the malware, posing as an ELF file, brute forces network routers. If successful the malware even sets up an IRC backdoor on the system. This router-rooter comes months after the Chuck Norris botnet circulated, attacking routers with default passwords.

If you visited George Hotz’s website between January 2009 and now, Sony may know about it. In a decision last Thursday, Magistrate Joseph Spero granted Sony a subpoena of PS3 jailbreaker George Hotz’s web provider for logs. Sony also won subpoenas for data on Youtube and Google. GeoHot’s provider, Bluehost, has been asked to turn over server logs, IP address logs, and just about anything pertaining to geohot.com/jailbreak.zip

Whats more fun than Gary’s Mod? How about using the Kinect to play Gary’s Mod! John B used OpenNI to gather skeletal coordinate data from the Kinect and pass it through to Gary’s Mod so he can do all the physics fun while get an exercise. How about some Gary’s Mod music videos next? With baby kittens?

—

Crack the Code Challenge

Did you have what it took to compete in our Crack The Code Challenge, brought to you by GoToAssist Express? These fine Hak5 viewers did last Sunday. Mad props go to Paul, Sork, Richard, Raging Cake, Jenkins, John and Joey, as well as our returning champions Netshroud, Leo and Tristian.

A big thanks go out to all that participated, joined the live stream and chat, and of course GoToAssist Express for sponsoring our Hak5 Lab Network. We had an overwhelming reception with more participants than virtual machines, however we’ll be increasing our capacity this week as well as getting the Thunder Kitten Assault Force involved. Stay tuned for info on the next, even bigger Crack the Code Challenge.

And be sure to tune in next week as we’ll have a detailed walk through on how the challenge was completed.

—

Illumination Software Creator

I would love to have the ability to make my own software applications without having to know any kind of coding language. But it seems like even to do something as simple as a Hello World script you still have to know at least a few lines of script.
Well… not anymore! With Illumination Software Creator, from Radical Breeze, you can write software apps without the code, by using a unique easy interface.

Requirements:
Windows- Needs Python
Works on Windows, Linus, Ubuntu, Mac, Android, and Flex

Follow directions on the Requirements page at RadicalBreeze.com. For Windows, I have to download a few python installers before it’ll work. Then go to the download page and click on your desired OS. Run through the quick download and open the Software Creator.
Simply drag and drop boxes for what you want your application to do. Then connect the boxes by the ribbons to make a full application.
I’m gonna do a really simple one. It’s going to have a popup window that says Hak5 Rules!
First, click on new project and add your boxes. I want to set some text in a message box that will pop up.
So I add the set text box and add a variable that I can re-use for several commands. The variable is called Hak5 Rules, text, and the default text is Hak5 Rules!
Under Set Text I add the Hak5 Rules to the custom text line, then for the message box I add the Variable for Hak5 Rules.
After you make your application, click run to make sure it works. Ok, I need to add the variable to the Set Text box, and now I can click Run, save it, and in a few seconds, there we have a text box that says Hak5 Rules

At first it’s a little tough to get used to if you’ve never designed an app or used code. Once you get the hang of it it’s really easy.
Email me what you think at feedback@hak5.org.

—

HakTip: Crafting packets with HPING

We’ve been talking about screen, and packet sniffers, but today I’m putting ‘em together with a new tool to craft our own packets.

Hping3 is a TCP/IP packet assembler. It’s modeled after the unix ping command — but it can do so much more. It’ll craft TCP, UDP, ICMP or even RAW-IP packets.

So here in the top screen I have tcpdump running on eth0. If I issue a ping 66.11.227.169 I’ll see that traffic.

Now let’s say I want to not just ping the server, but figure out if there’s an HTTP daemon running. For this we’ll do what’s called a half-open SYN connection.

hping -c 1 -I eth0 -s 1234 -p 80 -S 66.11.227.169

In the top screen I can see my traffic. In the bottom I get the output from hping and I can see that we sent a SYN packet and received a SYN+ACK. Since we’re not completing the three-way-handshake we never complete the connection, thus leaving it as a half-open SYN connection.

Just as an example I’m going to run the command again but this time let’s change it to port 81.

hping -c 1 -I eth0 -s 1234 -p 80 -S 66.11.227.169

And in this instance there isn’t a daemon running to answer the SYN, thus we see 1 packet sent, 0 received.

Now this is just scratching the surface of what’s possible with a traffic generator like hping and a debug setup like tcpdump coupled with screen. And of course I’m looking forward hearing about your favorite packet assemblers.

So what tips are rocking your world? Send ‘em by tips@hak5.org

In this segment Darren covers the beautification aspects of the case mod, tackling the tricky bits of cable management and accent lighting with cold cathodes. Darren reviews some of the recent case mod feedback and looks forward to hearing your ideas for future mods. Send ‘em by feedback@hak5.org

—

Trivia!

Last week’s trivia question was:
In WarGames, this character gives his name to the first computer game Lightman finds. The answer is Stephen Falken.

This week’s trivia question is:
This composer of Blade Runner was an inspiration to the recently released OST by Daft Punk of Tron Legacy?

Answer at hak5.org/trivia for your chance to win some hak5 swag!

Emails: Cluster Specs, Dropbox Alternatives and Brute Force scripts

“Jamie writes:
PLEASE tell us all the parts you use for the cluster nodes in episode 823. Please??? Love the show.”

The exact specs are ASUS P8 H67-M series motherboard, Core i5 2500K CPU, 2.5″ Scorpio Blue 250GB hard drive, and the least expensive 4GB of RAM you can find.

“You guys should work on metatagging your episodes based on what is covered and then have a search function for that… I am having all sorts of issues finding a few older episode I remember on Android… as I just a working one I want to play with it now -initialhit”

We are! In fact Paul is even cataloging our archive of segments. You may have noticed the code, game, geek, hack and IT categories on hak5.org. Stay tuned as we get all of our content cataloged over the coming weeks.

“After the last CCC I realised that you could brute force stegfiles a
Lot faster if you created multiple concurrent threads to do the work.
So, I wrote my own script to do just that. It’s definitely faster than
cypherround’s script, though not as pretty. I don’t have a website or
blog, so I pastebinned it http://pastebin.com/nLSbbF17.
Oh, and I’m really looking forward to the next CCC! –Nevermore”

Wicked! Thanks Nevermore

Tim writes: “Hey guys, I have a question about a possible dropbox alternative.

I have been using dropbox for about a year now for my paranormal research group. It has worked great for sharing casefile paperwork, evidence collections, etc.

I would invest in the pro versions to hold more space, but due to a security concern, each member of our organization has their own account and each person depending on
their position in the company gets access to certain folders, if I got pro for each person I would end up spending thousands of dollars a year (we have 20 members)

My question is could there be a better way of sharing files and synchronizing file versions instantly between users. I tried Microsuck Skydrive but I am also using some linux
machines which counts that out.”

The short answer is rsync. The longer answer will be a future segment, but
here are some links to get you started:

http://philcryer.github.com/lipsync/, https://github.com/philcryer/lipsync#readme, http://fak3r.com/geek/howto-build-your-own-open-source-dropbox-clone/, http://code.google.com/p/s3fs/wiki/FuseOverAmazon, and http://www.tarsnap.com/.

—

Keep up with the latest on Hak5 by following us on Twitter or Facebook. Subscribe and get your weekly technolust delivered automatically. Or show your support and grab some swag from the HakShop – including the new airport friendly WiFi Pineapple and hoodie. Finally if you’d like to suggest a topic
for ask a question feel free to hit up feedback@hak5.org.

Someone let Darren at the power tools again! Forget the case window, his latest creation includes a set of shadow box photo frames modded into a computer case perfect for showing off that sexy hardware. Shannon has rounded up your picks for webcam motion detection and iOS jailbroken apps. Plus answers to your questions regarding multi-monitor PC setups and much more!

Download HD Download MP4 Download WMV

Hacker Headlines
04:30

Watch out Ruby and Django, you may not be the only scripting languages in town to sport your own web server. This week Moriyoshi Koizumi of PHP.net posted an RFC for a built-in web server in the PHP binary. While this wouldn’t replace Apache as the web server of choice for major deployments, coders wanting to get a development environment up and running quickly would benefit from not having to write an HTTPD conf file.

Be careful what you download. 21 popular free apps in the market have been injected with root-kits and republished, AndroidPolice.com reports. “Guitar Solo Lite”, for example, was republished as “Super Guitar Solo” with the added functionality of secretly publishing your IMEI and userID, among other data, to a server in Fremont. Google has pulled the publisher from the marketplace and used its remote kill switch on the apps, but that doesn’t cover additional payloads which may have been downloaded from the 200,000-some zombie’d phones.

TorrentFreak reports that 70 percent of respondants to a Danish poll, say that they find piracy socially acceptable. 7 out of 10 said it’s acceptable, about 20 percent saying it’s completely acceptable, and 30 percent replied that it’s completely NOT acceptable. Although most that took the poll said piracy is ok, they mostly agreed that selling those downloaded goods for profit are completely not ok. I’m a little surprised to see how so many people think it’s alright.

Is Asus a fan of the Hak5 motherboard box case mods from weeks back? Possibly. The Taiwanese manufacturer showed off a concept shipping box that doubles as case for Mini-ATX motherboards. The box holds the motherboard and allows for additional components including hard disk and optical drives to be installed. I’ll go ahead and predict wall-mounted computer cases from Thermaltake next.

Thanks Lifehacker for the shoutout on our recent motherboard box case mod. Insert In-Soviet-Russia joke here.

Last year a 40-year-old computer specialist hacked into an advertising server and made a large plasma screen off a highway in Moscow play 20 minutes of porn (video). He faces up to 5 years in jail. This week the man plead guilty, to hacking into an advertising server and having a large plasma screen in Moscow to play 20 minutes of porn.

HakTip: Webcam motion detection round-up
7:04

I love those little tools that help out with everyday tasks. I have talked about motion detecting webcams in the past, but here are a few user picks:

Gary writes: If you want something sophisticated that runs in Linux try Zoneminder. Zoneminder is a professional quality, free, motion detection program for webcams and other cameras. It does everything Yawcam does plus more. In Ubuntu there are install instructions, and everything is in the repositories. Note, to prevent false triggers due to clouds passing the sun during daylight set up an exclusion zone. Another note, this program uses Mysql, Apache, Php and may be difficult to set up initially but is well worth the effort.

Ubuntu install guides and Zoneminder.com

Another viewer writes: Thought I’d let you know that Vitamin D is THE best webcam-software that there is. The ability to recognise motion between humans and animals, seriously!

What little gems are rocking your world? Hit us up, we’ll share ‘em! tips@hak5.org

User picks- Top Jailbroken Iphone Apps
10:14

Lots of new apps for me to check out. Here’s a quick overview of my favorites that you sent in:

Max Gamer uses JavaScript Anywhere when he needs something to do on his Iphone. This lets you hone HTML skills and play with web design. It’s a simple application for Web Development and Programming that lets you work on programming JavaScript, HTML, or CSS whenever you want. It’s free and downloadable from the iphone app store.

PkgBackup- backs up repo sources and Cydia apps and saves them as an info file in contacts. Have to restore? No problem. Go to Cydia, download the app again, sync contacts from ITunes, and press restore in the PkgBackup App. This redownloads all your sources and apps. Its good if you have a lot of apps installed and no time to keep track of them. It’s $4.99, available through Cydia.

Mike- VNC’s- Veency- Little faster, quick toggle in SBSettings. Free in Cydia.

MCleaner- Lets you annonomously block calls and create a blacklist or whitelist. You have choice to have phone keep ringing, go straight to voicemail, hang up or accept. You phone wont ring while blocking call. There’s a 15-day trial or it’s around $12 total through Cydia.
iFile is a very useful file manager and viewer. It gives you fast navigation through the iphone system to view files. You can view movies, sound, text, html, pdf’s, even ZIP files. Files can be sent as email attachments straight from your phone or edited and bookmarked as well as uploaded straight from the iFile built in web server. $4 plus free trial.

Pirni Pro- Network sniffer, native ARP spoofer. This can be used to sniff usernames, passwords and data traffic running over your wireless network. This new version with a graphical interface is very user friendly. $1.99 in Cydia.
Wifi Sync- Wirelessly sync with iTunes from wherever whenever. Wi-Fi Sync enables wireless syncing with iTunes at the touch of a button. Never go looking for that USB cable again. It’s $9.99 and available in the Cydia store.
From Ed-

iBluever- iBluever is an iOS application which enables Bluetooth Dial-up networking support (client mode) for your iPad, iPhone and iPod Touch. iBluever has its own Bluetooth and network stacks, you can connect your iPad/iPod Touch/iPhone to a Bluetooth Dial-up networking enabled phone, and then access the mobile network via the phone’s connection. So you can share your phone’s data plan to your iPad/iPod Touch/iPad, and save your money to buy an iPad 3G, make your iPod Touch to be more like an iPhone. $5.00 in Cydia.
iNet- non jailbroken app- $3.99, a network scanner. Great tool to find out what devices are connected to your network… or the hotels open wi-fi network…

Nick-
Just following up to your jailbroken iPhone apps segment. I found this site called CodeThemed which makes it really easy to make your own WinterBoard themes.. you should check it out.

Send em in! We got plenty more, I just dont have time to review all of them!
feedback@hak5.org

Crack The Code Challenge
17:16

Do you have what it takes to compete in our Crack The Code Challenge — brought to you by GoToAssist Express? Test your skills in our private lab network and bid for the title supreme leet hax0r. Winners will be featured on a future episode of Hak5!

Our next event will be this Sunday, March 13th at 3pm Pacific. Visit Hak5.org/challenge for all of the details. We’ll be live streaming at hak5.org/live throughout the day. See you there!

Modding a photo frame into a computer case
18:50

It’s time to break out the power tools and start building again. This week I’m pleased to bring you the first part of the photo frame case mod build. I’m using two Ikea RIBBA series shadow-box photo frames to display a mounted and lighted motherboard for your admiration. Technology is a beautiful thing.

Trivia!
38:29

Last Week: In Tron, characters that are depicted battling in the digital world are called what?

Answer: Programs

This Week: In WarGames, this character gives his name to the first computer game Lightman finds.

Answer at hak5.org/trivia for your chance to win some hak5 swag!

Email: Email: Multi-monitor PC setups
40:55

Gehric writes:

Hiya Darren and the team, Can you do a segment on how you did the multiple
screen setup, i would like to do a 4 monitor setup and show a snake or cube
scrolling, so that i can show it off at my next house party

Darren recommends multiple PCI-e graphics cards in a compatible motherboard from the same manufacturer. He has had plug-and-play experience in Windows and Debian variants of Linux.

There are also plenty of USB VGA adapters available.

Email: Email: Packet sniffing with tcpick
42:47

MyssT writes:

Good show, can’t wait to see what you do with the cluster! Anyway reason I’m mailing is…
This is a cool packet sniffer.. tcpick
For example, sniff irc on your network:
tcpick -i eth0 ‘port 6667′ -e 1000 -yR
Lots of other cool stuff too and has curses support on linux, I’m using it on debian 6.0

Thanks MyssT! Always good to have another packet sniffer in our arsenal.

Keep up with the latest on Hak5 by following us on Twitter or Facebook. Subscribe and get your weekly technolust delivered automatically. Or show your support and grab some swag from the HakShop – including the new airport friendly WiFi Pineapple and hoodie. Finally if you’d like to suggest a topic
for ask a question feel free to hit up feedback@hak5.org.

Season 9 continues with the results from last weekend’s Crack the Code Challenge as well as a walkthrough on how participants were able to complete the challenge using packet analysis, file reconstruction, stenagrophy and brute force. Plus encrypted USB drives with centralized management and more from the RSA 2011 conference.

Download HD Download MP4 Download WMV

Hacker Headlines

Bummed you didn’t get your hands on one of Google’s CR-48 Chrome notebooks? The alternative Instant-On OS Splashtop Linux is now available for download. Splashtop has been previously available as a pre-installed second OS on notebooks from Acer, ASUS, Dell and others. This 1.0 release makes the trim down Linux 2.6 and X11 based OS available to the public.

Samsung has made a ROM based on Android 2.3.2 Gingerbread for the i9000 that just leaked to the net. All of the changes haven’t yet been determined, and if you don’t have an i9000 model, you still have to wait for the update on your Galaxy S devices. I’m looking forward to seeing what the users can do with the ROM now that it’s available.

Sony isn’t taking recent PlayStation3 hacks lightly, as German hacker Graf Chokolo found out when authorities raided his house earlier in the week. In a post on his Hypervisor reverse engineering blog Chokolo wrote “Sony was today at my home with police and got all my stuff and accounts.” Hours later the “Hypervisor Bible” as Chokolo puts it was released. Links have been removed to comply with legal notices, but you know nothing is ever erased from the web.

The Nintendo 3DS has been out for a day in Japan… and it’s already been hacked. The Tech-On! Group has already gotten their hands on the 3DS and torn it apart to look at all the delicious insides, including the 3D display. Along with the hardware, Ayasuke2 on Youtube has already hacked the 3DS to run R4 Cards and play unauthorized Nintendo DS games.

Getting encased in carbonite isn’t exclusive to Han Solo anymore. Attendees at the Tangible, Embedded and Embodied Interactive Conference got to scan themselves in 3D with a hacked Microsoft Kinect and print the resulting STL file using a Stratasys 3D printer.

Crack the Code Challenge

Did you have what it took to compete in our Crack The Code Challenge, brought to you by GoToAssist Express? 6 Hak5 viewers did this Sunday. Mad props go to Netshroud for being the first to crack the code, as well as Jellyfish, Jon, Alex, Leo and Tristan.

A big thanks go out to all that participated, joined the live stream and chat, and of course GoToAssist Express for sponsoring our Hak5 Lab Network. We’ll have details on the next challenge on next weeks show so be sure to tune in.

Cracking the code: PCAP file recovery and stenography

Shannon demonstrates techniques for completing the Crack the Code Challenge using Network Miner and steghide.

HakTip: Command line packet captures using Tshark

Last week we were asked about command-line packet sniffers and I recommended tcpdump and ngrep for filtering. Steve Z was quick to point out TShark, the command-line counterpart to Wireshark. With rules and filtering built in, it is quickly becoming a favorite for my packet sniffing needs. For example, issuing:

tshark -R “!(udp.port==53) and udp and ip.addr==10.73.31.55″ -i eth0

will show me just UDP packets that aren’t on port 53 to or from the address specified.

What little gems are rocking your world? Hit us up, we’ll share ‘em on the show. tips@hak5.org

Encrypted USB drives with centralized management

Darren meets with Kingston and Blockmaster to talk about their new USB management security applications.

Email: USB Passthrough

Toby writes in:

Now that I’m adhering to the “Trust Your Technolust” way of life, I figure your my best chance for a quality fix… I have an issue that I would love to see how you would resolve. I work at a non-profit food producer that provides millions of servings to feeding programs world wide every year. Were running as much open source goodness as we possibly can so that we can direct as much revenue to the feeding programs as possible. I have a VM “When-doze” terminal server running a software package that requires a usb software key. I need a (cheap or free) way (hak or bypass) to overcome the lack of ability to have non-storage USB passthrough

Darren recommends USB Redirector, a product he learned about when researching Proxmox VE.

Keep up with the latest on Hak5 by following us on Twitter or Facebook. Subscribe and get your weekly technolust delivered automatically. Or show your support and grab some swag from the HakShop – including the new airport friendly WiFi Pineapple and hoodie. Finally if you’d like to suggest a topic
for ask a question feel free to hit up feedback@hak5.org.

Season 9 Premieres with the return of Shannon “Snubs” Morse and Paul “the camera guy” Tobias. We kick around the hacker headlines, get the low-down on Nexpose from Rapid7 at RSA, automate file mangement in windows, multiplex some screen sessions, capture packets from the command line and a lot more.

Download HD Download MP4 Download WMV

Hacker Headlines

Kinect hackers rejoice! Microsoft confirms that a Kinect SDK is coming for PC and Mac this spring, allowing developers to deal with the motion and voice sensor at a higher level than the informal Kinect hacks. The SDK will be free for personal use with a commercial version expected to follow.

Sony is threatening to permanently disconnect jail broken PlayStation 3 consoles from the PlayStation Network. Jeff Rubenstein, Sony’s Social-Media Manager wrote in his blog “To avoid this, customers must immediately cease use and remove all circumvention devices and delete all unauthorized or pirated software from their PlayStation 3 systems”

Donations have closed for the legal defense fund of George Hotz, notable iPhone jailbreaker and PS3 hacker. Sony has tied the hacker up in San Francisco federal since January court facing unspecified damages on DMCA violations. Hotz writes on his blog “I have enough to cover my legal fees for the time being.” and “For now, the best you can do is spread the word”

The latest VirtualBox 4.0.4 update adds support for Ubuntu 11.04 alpha guests. The Ubuntu Alpha, code named Natty Narwhal, introduces Unity as the default desktop session. Gnome can still be accessed as a “Ubuntu Classic Session”

Urban SQL Injection — full of win.

Crack the Code Challenge

Do you have what it takes to compete in the Crack The Code Challenge? Test your skills in our private lab network and bid for the title supreme leet hax0r. Winners will be featured on future episodes of Hak5!

Our next event will be this Sunday, February 27th at 3pm Pacific. Visit Hak5.org/challenge for all of the details. We’ll be live streaming at hak5.org/live throughout the day. We’d like to thank Citrix and GoToAssist Express for sponsoring the Crack the Code Challenge.

Rapid7′s Nexpose at RSA 2011

Darren meets with Chris Kirsch of Rapid7 to find out what’s new in Nexpose

Trivia!

Our last question was “In the Millennium Trilogy, what is the name of the hacker community?” and the answer is: “Hacker Republic”

Our new question is: “From March 5, 1975 to December 1986, this club of computer hoppyists would meet in the Silicon Valley Area.”

Participate at hak5.org/trivia

Hak5 finally goes HTTPS

Thanks to Domain.com our very own Hak5.org is finally sporting a shiny new SSL certificate. Darren recaps some of the nifty things you can do with one and recommends thawte SSL 123. Thanks Domain.com for hosting Hak5.org and sponsoring for over a year!

Automating Windows File Managment

Belvedere

What it does:
Automating file management and scripting on Windows: Belvedere.

Belvedere lets you organize any folders on your harddrive. You can create rules to move, copy, delete, rename, or open files based on name, extension, size, creation, date, and even more. So basically it’s a self-cleaner tool for Windows Only. There’s also a Mac cleaner called Hazel that you might want to check out if you are an Apple user.

It was created by Adam Pash back in ’08, and you can check out the source of this tool over at GitHub.

It’s a .exe so just install it from the download link. You can make Belvedere startup when Windows starts, but you’ll have to add it manually.

How you use it:
Belvedere is really easy to use, it’s just simple point and clicks. You create a folder, then name your rule from one of the choices, and build conditions with the drop down menus.

Belvedere gives me the ability to multitask and not worry so much about how clean my PC is.

Do you have another tool that works like Belve? Let me know at feedback@hak5.org.

HakTip: Multiplexing Screen Sessions

What’s more wicked than a screen session? Two screen sessions! As we’ve talked about recently the unix command Screen is a great way to maintain bash sessions from multiple SSH clients without losing your work. My favorite shortcut after invoking the “screen” command is CTRL+a followed by “S”, which splits the screen horizontally in two. Use CTRL+a then Tab to switch between the views. Debian users get the added sexyness of vertical split by hitting CTRL+a then Pipe.

What little gems are rocking your world? Hit us up, we’ll share ‘em with the world. tips@hak5.org

Email: Command Line Packet Sniffers

Hey, I’m in dire need of a command line linux packet sniffer. My servers are 3 hours away, and none have X11 installed. I used to use sniffit a long time ago, but it looks like they’ve added a GUI to it. Just wondering if you had any ideas off the top of your head.

Darren recommends TCPDUMP and NGREP

Have others to share? feedback@hak5.org

Sketching with the Harmony Project

Sparkleface writes in to share the Harmony Project — a nifty sketching program in HTML5. Check out the source code and more info

Keep up with the latest on Hak5 by following us on Twitter or Facebook. Subscribe and get your weekly technolust delivered automatically. Or show your support and grab some swag from the HakShop – including the new airport friendly WiFi Pineapple and hoodie. Finally if you’d like to suggest a topic
for ask a question feel free to hit up feedback@hak5.org.

In this episode Darren sits down with Joe Klein at Toorcon San Diego 2010 to talk IPv6, good and evil. Its more than just a big address space. We discuss the demise of IPv4, the differences between IPv6 and IPv6, Neighbor discovery, self-forming networks, global multicasting, address discovery and more.

Download HD Download MP4 Download XviD Download WMV

Links generously provided by Joe Klein

• Hurricane Electric Free IPv6 Certification
• Self Certified
• IPv6 Ready – IPv6 Forum
• DOD JITC
• What is my IPv6 Address?
• Test my system/network support for IPv6?
• What sites support IPv6 and to what level?
• What is my speed on IPv?
• Joe Klein’s IPv6 security presentation

Keep up with the latest on Hak5 by follow us on Twitter or Facebook. Subscribe and get your weekly technolust delivered automatically. Or show your support and grab some swag from the HakShop – including the new airport friendly WiFi Pineapple and hoodie. Finally if you’d like to suggest a topic for ask a question feel free to hit up feedback@hak5.org.

]]> http://Hak5.org/episodes/episode-812/feed 16 http://Hak5.org/episodes/episode-724 http://Hak5.org/episodes/episode-724#comments Fri, 30 Jul 2010 02:14:32 +0000 Jason http://www.Hak5.org/?p=2254 ]]>



This week Shannon is bypassing NSFW filters while Darren goes sniffing for packets in all the wrong places.

Download HD Download MP4 Download XviD Download WMV

Darren takes Android WiFi Tether and Shark for a spin and ends up learning an important geography lesson.

Shannon is demonstrating a few techniques to detecting NSFW links and bypassing potential work filters with a few web tools, including: LongURL.com, PDFmyURL.com, Aviary.com and Variably Safe For Work.

—

You’re Invited to Hak5’s Birthday!

Join us to celebrate 5 years of technolust at the Hotsy Totsy Club – an Albany institution since 1939! Come for drinks, pool, shuffleboard and a live performance from nerdcore sensation, Eighty of Dual Core! 21+. No cover. Street parking. 7 blocks from El Cerrito BART. WiFi. Taco’s Autlense Taco Truck parked in lot. Need we say more?



Saturday, August 14th at 7:00 PM
Hotsy Totsy Club
601 San Pablo Ave.
Albany, CA 94706

RSVP now via Facebook – can’t wait to celebrate the grand years of old school hacking with you!

If you want to know the latest on Hak5 be sure to follow us on Twitter or Facebook.

Also, now is also a great time to grab some swag from the HakShop – including the new airport friendly WiFi Pineapple with free world-wide shipping.

And finally if you’d like to suggest a topic for a future show feel free to hit up feedback@hak5.org

]]> http://Hak5.org/episodes/episode-724/feed 10 http://Hak5.org/episodes/episode-703 http://Hak5.org/episodes/episode-703#comments Wed, 03 Mar 2010 14:45:54 +0000 Darren Kitchen http://www.hak5.org/?p=1723 ]]>



Back from Britain and bouncing off the walls Darren pits three ancient Internet Explorers against each other to see which free application sandbox can save you from yourself. Shannon joins us from Missouri for her take on the top “ultra” Windows software, and Paul… Well, Paul’s tearing down the set.

Download HD Download MP4 Download XviD Download WMV

Rogue DHCP Server Detection

Following up with last week’s discussion on Rogue DHCP Servers I found it fitting to mention Tim Ashley’s Rogue DHCP Server Detector as found on the Hak5 forums.

Free Application Sandbox Challenge

In an effort to discover whether free application sandboxing solutions from Comodo and Sandboxie can save a (L)user from themselves, Darren takes three Internet Explorer 6 Virtual Machines around the Internets famous red light district in a set of challenges put forth by the fine folks at irc.hak5.org.

The Top “Ultra” Windows Warez

Perplexed by software titles claiming to be the most elite thing since ascii art Shannon set off to round up the top “Ultra” software for Windows and see there is any merit fo their titles. The round up includes:

• #5 Ultra Screensaver Maker
• #4 Pong Ultra
• #3 Ultra Network Analyzer
• #2 UltraVNC
• #1 Ultra Defrag
]]> http://Hak5.org/episodes/episode-703/feed 42