Curiosity in Practice
On Wednesday night I tweeted this: If you are using TrueCrypt you should stop. Hashcat is now optimized to crack TrueCrypt volumes. https://t.co/voBdtKuuHW — Jerry Gamblin (@JGamblin) December 10, 2015 I started getting retweets and replies like this on Friday from people I respect (and a bunch from people I don’t know): https://twitter.com/kylemaxwell/status/675420596025585664 https://twitter.com/averagesecguy/status/674768017864134657 So people … Read more
HID proximity cards encode a facility code and internal card number in hex on most cards. Decoding it is extremely easy and should take less than a minute. Equipent Needed: Omnikey Reader (I like the 5025CL) RFIDIOT BRIVO Card Calculator Steps: Run isotype.py from the RFIDIot tool kit and copy the ID: Past the ID … Read more
As part of my research into RFID security I came across the “EM4100 RFID Cloner kit” by KBEmbedded which outside of having a terrible name is an amazing low-frequency (125 kHz) self-contained RFID cloner that can store and replay 16 cards. I was lucky enough to be in the Portland area this week and be able to … Read more
I have recently started investigating RFID security and picked up a Chameleon Mini. It is an amazing project with a ton of potential. In these quick demo videos I will show how to clone the UID of both a Mifare 1K 4B card and a Mifare 1K 7B card using the Chameleon. Cloning the Mifare 1K UID (Aria … Read more
How the conversation goes when someone tells me they want to get into “hacking”:
Yesterday Randy Westergren wrote this blog post: United Airlines Bug Bounty: An experience in reporting a serious vulnerability. I do not know Randy and do not think he did anything wrong but his post is a perfect example of why companies I talk to are afraid of implementing bug bounty programs. He hit the trinity of why … Read more
I love Thanksgiving dinner. I hate the omnipresent canned shaped cranberry sauce: Especially since making your own is this easy: Ingredients 1 cup sugar 1 cup Orange Juice. 1/2 Teaspoon Ground Cinnamon One 12-ounce bag cranberries Directions Combine the sugar, orange juice, cinnamon, and cranberries in a medium saucepan. Bring up to a simmer over … Read more
I was invited to attend the 2015 Digicert Security Summit this week in Las Vegas. For a one day conference it had some really amazing talks by some of the smartest people in the industry. Gary McGraw gave an amazing talk on security software development life cycle and the Building Security in Maturity Model (BSIMM). Emily Stark … Read more
I take a lot of screenshots in OSX (⌘+shift+4) to share and for the longest time I just lived with the 2003-era super cool shadow: I finally got tired of it and found the solution to turning it off is these two terminal commands: defaults write com.apple.screencapture disable-shadow -bool true killall SystemUIServer Now my screenshots … Read more
I have been using censys.io a lot lately to do network reconnaissance and noticed they just released a new API that didnt have a CLI frontend so I spent sometime writing a python based one. You can grab a copy here. Usage is: python censys.py -f (search term) It is still pretty rough and I will … Read more