Security

A Reverse DNS Function for Google Sheets.

Often in my job I am given spreadsheets of IP addresses that look like this:                                         One of the first things I always want to do is find if they have a FQDN.   Sadly Google … Read more

Finding Weev-Able Printers.

This weekend the infamous hacker and troll Weev decided it would be hilarious if he printed fascist flyers  on open printers around the united states using this top secret APT string: cat payload.ps |netcat -q 0 ipadreess 9100 A lot of Colleges and Universities seem to have a problem with this.   While I strongly disagree with the content that … Read more

Make Your iPhone “FBI Proof”

The FBI has recently sued Apple to make them unlock the iphone of the San Bernardino Shooter (Here is Apple’s response.). The reason Apple needs help is because the phone has “Erase All Data After 10 Failed Passcode Attempts” turned on.   Without that feature the government would have just built this robot to brute force the password … Read more

Proxmark3 V2

I have been meaning to pick up a Proxmark3 for the last couple of months to round out my RFID testing kit (while waiting for the chameleon mini to be released this summer). The problem is that most of the known suppliers are selling the Proxmark3 for around $420.  I then found that Elechouse has their … Read more

Xbox Account Lockout

Last month I got a new iPhone. This month I realized I forgot my Xbox One password when I tried to log in to download some Games With Gold. I didnt think this would be a problem.  I forget and rest passwords all the time. So I go through the normal steps and have it send me … Read more

Decoding HID Proximity Cards

HID proximity cards encode a facility code and internal card number in hex on most cards.  Decoding it is extremely easy and should take less than a minute. Equipent Needed: Omnikey Reader (I like the 5025CL) RFIDIOT BRIVO Card Calculator Steps: Run isotype.py from the RFIDIot tool kit and copy the ID: Past the ID … Read more

$25 Handheld RFID Cloner

As part of my research into RFID security I came across the “EM4100 RFID Cloner kit” by KBEmbedded  which outside of having a terrible name is an amazing low-frequency (125 kHz) self-contained RFID cloner that can store  and replay 16 cards. I was lucky enough to be in the Portland area this week and be able to … Read more

Cloning UIDs with Chameleon

I have recently started investigating RFID security and picked up a Chameleon Mini.  It is an amazing project with a ton of potential. In these quick demo videos I will show how to clone the UID of both a Mifare 1K 4B card and a Mifare 1K 7B card using the Chameleon. Cloning the Mifare 1K UID (Aria … Read more

Why Companies Fear Bug Bounty Programs

Yesterday Randy Westergren wrote this blog post: United Airlines Bug Bounty: An experience in reporting a serious vulnerability.  I do not know Randy and do not think he did anything wrong but his post is a perfect example of why companies I talk to are afraid of implementing bug bounty programs. He hit the trinity of why … Read more