Curiosity in Practice
jgamblin From time to time I have the need to test or verify a web application vulnerability through the TOR network using BurpSuite. The easiest way to do this to use the pre-bundled TOR Browser. Configuration is fairly easy: Download, Install and Start the TOR Browser: Verify that the SOCKS proxy is started on 127.0.0.1:9150 Configure Burp (Options > … Read more
Last month I got a new iPhone. This month I realized I forgot my Xbox One password when I tried to log in to download some Games With Gold. I didnt think this would be a problem. I forget and rest passwords all the time. So I go through the normal steps and have it send me … Read more
On Wednesday night I tweeted this: If you are using TrueCrypt you should stop. Hashcat is now optimized to crack TrueCrypt volumes. https://t.co/voBdtKuuHW — Jerry Gamblin (@JGamblin) December 10, 2015 I started getting retweets and replies like this on Friday from people I respect (and a bunch from people I don’t know): https://twitter.com/kylemaxwell/status/675420596025585664 https://twitter.com/averagesecguy/status/674768017864134657 So people … Read more
HID proximity cards encode a facility code and internal card number in hex on most cards. Decoding it is extremely easy and should take less than a minute. Equipent Needed: Omnikey Reader (I like the 5025CL) RFIDIOT BRIVO Card Calculator Steps: Run isotype.py from the RFIDIot tool kit and copy the ID: Past the ID … Read more
As part of my research into RFID security I came across the “EM4100 RFID Cloner kit” by KBEmbedded which outside of having a terrible name is an amazing low-frequency (125 kHz) self-contained RFID cloner that can store and replay 16 cards. I was lucky enough to be in the Portland area this week and be able to … Read more
I have recently started investigating RFID security and picked up a Chameleon Mini. It is an amazing project with a ton of potential. In these quick demo videos I will show how to clone the UID of both a Mifare 1K 4B card and a Mifare 1K 7B card using the Chameleon. Cloning the Mifare 1K UID (Aria … Read more
How the conversation goes when someone tells me they want to get into “hacking”:
Yesterday Randy Westergren wrote this blog post: United Airlines Bug Bounty: An experience in reporting a serious vulnerability. I do not know Randy and do not think he did anything wrong but his post is a perfect example of why companies I talk to are afraid of implementing bug bounty programs. He hit the trinity of why … Read more
I love Thanksgiving dinner. I hate the omnipresent canned shaped cranberry sauce: Especially since making your own is this easy: Ingredients 1 cup sugar 1 cup Orange Juice. 1/2 Teaspoon Ground Cinnamon One 12-ounce bag cranberries Directions Combine the sugar, orange juice, cinnamon, and cranberries in a medium saucepan. Bring up to a simmer over … Read more
I was invited to attend the 2015 Digicert Security Summit this week in Las Vegas. For a one day conference it had some really amazing talks by some of the smartest people in the industry. Gary McGraw gave an amazing talk on security software development life cycle and the Building Security in Maturity Model (BSIMM). Emily Stark … Read more