Career, Hacking, Security

Often in my job I am given spreadsheets of IP addresses that look like this:

Screen Shot 2016-04-03 at 4.16.11 PM

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

One of the first things I always want to do is find if they have a FQDN.   Sadly Google keeps forgetting to build a reversedns function into sheets so with the help of a  HackerTarget API I hacked this together today:

Screen Shot 2016-04-04 at 6.45.21 AM

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

The configuration is pretty easy (although this took me way longer than I want to admit.)

The cells are setup like this:
A2: IP Address
B2: =“http://api.hackertarget.com/reversedns/?q=”&(A2)
C2: =IMPORTDATA(B2)
D2: =SPLIT(C2,” “)
E2: FQDN (Finally

Here is a link to the sheet so you can copy it and play with it. Hopefully this can help someone else out in the future as I know I have spent way too much time manually looking this information up.

Here is a gif of it in action:

Hacking, Security

This weekend the infamous hacker and troll Weev decided it would be hilarious if he printed fascist flyers  on open printers around the united states using this top secret APT string:

cat payload.ps |netcat -q 0 ipadreess 9100

A lot of Colleges and Universities seem to have a problem with this.   While I strongly disagree with the content that Weev printed I was interested in how many printers were “vulnerable”  to this attack.

Using Censys.io (my favorite internet host search tool) to search for the following string “location.country_code:US AND telnet AND HP Jetdirect” I found 15,237 printers in the US that are “weev-able”.

Screen Shot 2016-03-28 at 6.56.52 AM
While 15,237 printers on the public internet is ridculous searching for “location.country_code:US AND “HP JetDirect Password is not set”” displays 5,683 printers that have no passwords set at all.
This is so ridiculous this is the only way I know how to end this post:
giphy (1)
Hacking

My friend Scott pointed out the towels in most hotels now have RFID tags to help with inventory control:

Screen Shot 2016-03-01 at 10.21.06 AM

I also knew that my RSA Conference  badge would have an RFID tag in it so it could be scanned on the expo floor:

2016-03-01 09.47.14

Since I never leave home without my Proxmark3 in my assault pack it was time to get to work:

2016-03-01 09.48.25

What I found out next is something I wasn’t expecting that made this whole thing a lot more interesting.

Using the Proxmark I was able to tell the hotel towel and my RSA tag uses the same MIFARE Ultralight C  tags: 

Screen Shot 2016-03-01 at 10.08.41 AM

So from there I was able to clone my RSA pass to my hotel towel since the towel had a re-writeable tag.

I will be demoing the walkthrough of this at  First  in Amsterdam in April. 

So now I am at the point where you can scan my towel and get the same UID.  Which will allow me to have people scan my towel and get the same information they would have gotten off my badge.

Which allows me to quote one of my favorite lines from the Hitchhikers Guide.

towel

 

*No hotel towels have been permanently harmed and  will be returned to my room with the correct UID rewritten to them. 

Hacking, Security

The FBI has recently sued Apple to make them unlock the iphone of the San Bernardino Shooter (Here is Apple’s response.).

The reason Apple needs help is because the phone has “Erase All Data After 10 Failed Passcode Attempts” turned on.   Without that feature the government would have just built this robot to brute force the password and this wouldnt have been an issue:

ku-xlarge

What this means for the general public is that we now know that the FBI can not bypass this setting so if you care about your privacy you should enable it.

Doing so is fairly easy:

Settings > Touch ID & Passcodes > Erase Data > Enable.
IMG_0407 IMG_0409 IMG_0410

While this is a “dangerous” setting getting the phone to actually erase the data is actually pretty hard.  You have to wait through the following timeouts so that your toddler (or a malicious jerk) will not accidently erase your phone:

Screen Shot 2016-02-17 at 9.04.10 AM

 

You get used to seeing this screen a lot:

2016-02-17 08.01.04

After the 10th attempt this happens:

 

Hacking, Security

I have been meaning to pick up a Proxmark3 for the last couple of months to round out my RFID testing kit (while waiting for the chameleon mini to be released this summer).

The problem is that most of the known suppliers are selling the Proxmark3 for around $420.  I then found that Elechouse has their internal version of the Proxmark3 V2 for only $200 ($220 with a battery to make it truly portable).

So of course I ordered and built one: 2016-02-10 19.28.28 2016-02-10 20.30.32

Building it was fairly simple and Chris Merrett has an awesome github package put together to make installing it on OSX painless.

Once built and tested cloning HID Prox Cards (which open most corporate doors) is this easy:

proxmark

I am really looking forward to getting this out into the wild and showing people why they shouldn’t trust their door locks at their business or in their hotel room.

Hacking

Crashsafari.com is a website that overloads the browser with a self-generating text string which populates the address bar. After about 20 seconds or so it will force an iPhone to reboot, while significantly heating it up as the smartphone tries to handle the code of the site.

The code of the website appears to generate an ever-increasing string of characters, which becomes harder and harder for the browser to load, likely resulting in a memory issue and forcing the reboot of the device.

I pulled the source of the website broke it down to its smallest operable part and put it here (dont be a jerk).

 

Hacking

I have been to Top Golf for 3 different events this year and was always amazed by their RFID technology and have always left wondering “What is in a Top Golf golfball?”.

So when I saw a few “Top Golf” golf balls in the $1 ball bin at a golf store I bought them and decided to answer that question.

2016-01-23 17.54.22 2016-01-23 17.56.28 2016-01-23 18.12.01 2016-01-23 18.26.23 2016-01-23 18.32.08
That little “passive EPC Gen 2 ultrahigh-frequency (UHF) RFID” tag is what makes TopGolf so awesome.  Now all I need to do is invest in a UHF RFID reader to see what is actually on the tag.

Protip: Sawing a golf ball in half is a lot harder than it sounds.