Hack a Day http://www.hackaday.com Hack a Day http://www.hackaday.com/media/feedlogo.gif Hack a Day http://www.hackaday.com en-us Copyright 2008 Weblogs, Inc. The contents of this feed are available for non-commercial use only. Blogsmith http://www.blogsmith.com/http://podcasts.hackaday.com/rss.xmlNetgear open source routerhttp://www.hackaday.com/2008/06/29/netgear-open-source-router/http://www.hackaday.com/2008/06/29/netgear-open-source-router/http://www.hackaday.com/2008/06/29/netgear-open-source-router/#commentsFiled under:


Netgear recently launched the WGR614L wireless router targeted specifically at open source firmware enthusiasts. It can use Tomato, DD-WRT, and soon OpenWRT. The core is a 240MHz MIPS processor with 16MB of flash and 4MB of RAM. You'll probably remember when Linksys decided to dump Linux from their iconic WRT54G line in favor of VxWorks; they released the similarly speced WRT54GL for enthusiasts. Netgear seems to be arriving pretty late in the game, but they've set up a community specifically for this router. Time will tell whether community support is enough to make this the router of choice for hackers. We wish someone would release an x86 based router in the same price range just to make porting stupidly simple.

[via Slashdot]
Read | Permalink | Email this | Linking Blogs | Comments
]]>linksyslinuxnetgearrouterwgr614lwifiwirelesswrtwrt54glEliot Phillips2008-06-29T02:45:00+00:00In car WiFihttp://www.hackaday.com/2008/06/26/in-car-wifi/http://www.hackaday.com/2008/06/26/in-car-wifi/http://www.hackaday.com/2008/06/26/in-car-wifi/#commentsFiled under:


You may have already heard that Chrysler is planning to provide in-car wireless internet access to its vehicles. If not, expect to hear more about it later this year when the requisite hardware becomes a sales-floor option, or next year when it becomes factory standard for some cars.

We can't say it's a bad idea, it's just not a new one. Plenty of commercial portable routers are available, but they still need a modem and data plan to provide internet access. For internet access and wireless routing, look to [Nate True]'s cellphone-router combo, which uses a spare Nokia cellphone and a highly modded Wi-Fi router running OpenWRT. [True] has made it easy by providing the instructions and necessary custom code, but it seems like a lot of effort for a relatively slow connection. We think the original Stompbox is still the most fun since it has the speed of commercial devices and an open x86 OS to modify.
Read | Permalink | Email this | Linking Blogs | Comments
]]>chryslernatetrueportablewi-fiportablewifirouterroutersstompboxwi-fiwifiJuan Aguilar2008-06-26T19:30:00+00:00Receipt FAILhttp://www.hackaday.com/2008/06/21/receipt-fail/http://www.hackaday.com/2008/06/21/receipt-fail/http://www.hackaday.com/2008/06/21/receipt-fail/#commentsFiled under:


Today's fail comes courtesy of GNUCITIZEN's [pdp]. This would have made that TJX WEP crack much easier.
Read | Permalink | Email this | Linking Blogs | Comments
]]>failgnucitizenreceiptsecuritywepwifiwirelessEliot Phillips2008-06-21T00:00:00+00:00WiFi telescopehttp://www.hackaday.com/2008/06/10/wifi-telescope/http://www.hackaday.com/2008/06/10/wifi-telescope/http://www.hackaday.com/2008/06/10/wifi-telescope/#commentsFiled under:


We Make Money Not Art recently visited the LABoral Art and Industrial Creation Centre in Gijón, Spain. The installation that left the strongest impression on [Regine] was the WiFi sightseeing telescope built by Clara Boj and Diego Diaz. Spain is in a situation similar to the USA: A few years ago many municipal WiFi projects launched only to be squashed because of theoretical unfair competition with local utilities. Now commercial projects like WeFi, Whisher, and FON encourage people to "share" their WiFi. Observatorio (Observatory) is designed to provide insight into the current state of local WiFi. It uses a highly directional Yagi antenna to collect wireless access data from the local area. The antenna has a 30deg aperture which is matched to a camera with an identical field of view. The observer sees the camera's viewpoint with the WiFi data overlaid showing where accesspoints are and whether the AP is open. WMMNA also recommends you check out the WiFi Camera which photographs electromagnetic space.
Read | Permalink | Email this | Linking Blogs | Comments
]]>antennafonmunicipalwifispaintelescopewefiwemakemoneynotartwhisherwifiwmmnayagiEliot Phillips2008-06-10T16:30:00+00:00RFID reader denial of servicehttp://www.hackaday.com/2008/06/09/rfid-reader-denial-of-service/http://www.hackaday.com/2008/06/09/rfid-reader-denial-of-service/http://www.hackaday.com/2008/06/09/rfid-reader-denial-of-service/#commentsFiled under: ,


While in Vancouver, Canada for CanSecWest we had a chance to catch up with [Marc]. He showed off a very simple Denial-of-Service attack that works for most commercial RFID reader systems. He worked out this physical DoS with [Adam Laurie], whose RFID work we featured last year.
Permalink | Email this | Linking Blogs | Comments
]]>denial of serviceDenialOfServicedosrfidrfid readerRfidReaderFabienne Serriere2008-06-09T19:20:00+00:00Flipstart HSDPA modhttp://www.hackaday.com/2008/06/06/flipstart-hsdpa-mod/http://www.hackaday.com/2008/06/06/flipstart-hsdpa-mod/http://www.hackaday.com/2008/06/06/flipstart-hsdpa-mod/#commentsFiled under:


Our friend [tnkgrl] has successfully added HSDPA to a Vulcan Flipstart. The Flipstart is a palmtop Windows machine with 1.1GHz Pentium M, 512MB RAM, 30GB hard drive, and an EVDO option. Before starting, you need to come up with a mini-PCI Express HSDPA card. Instead of trying for a random bare mini-PCIe card on eBay, she purchased an unlocked AT&T Sierra Wireless Aircard 875U USB dongle. Inside of the dongle is a battery, SIM slot, and a mini-PCI Express card. The Flipstart lid comes off with just a few screws and the card drops into place. Even though the antenna isn't tuned for all the possible bands you should still get good signal most of the time. The best part of this mod is that it doesn't require any obvious modification, so your warranty will be intact... as far as anyone can tell. Embedded below is the video of the easy swap. In the past, she added HSDPA to the OQO 02, which definitely takes a lot more work.
Read | Permalink | Email this | Linking Blogs | Comments
]]>3gevdoflipstarthsdpaoqooqo02tnkgrlvulcanflipstartEliot Phillips2008-06-06T14:00:00+00:00Wireless hacking with the OLPC XOhttp://www.hackaday.com/2008/05/27/wireless-hacking-with-the-olpc-xo/http://www.hackaday.com/2008/05/27/wireless-hacking-with-the-olpc-xo/http://www.hackaday.com/2008/05/27/wireless-hacking-with-the-olpc-xo/#commentsFiled under:


Not even a week ago we asked what we should do with our OLPC XO. InformIT's [Seth Fogie] has written a great two part article that covers turning it into a hacker toolkit. Part one is an overview of the OLPC, how to upgrade it, and do some usability tweaks. Part two covers installing Nessus, Metasploit, and doing some wireless sniffing. We'll be building our own little green monster based on this and let you know how it goes.

[via Slashdot]
Read | Permalink | Email this | Linking Blogs | Comments
]]>metasploitnessusolpcolpcxoslashdotxoEliot Phillips2008-05-27T16:45:00+00:00GPL vs. Skype back in courthttp://www.hackaday.com/2008/05/07/gpl-vs-skype-back-in-court/http://www.hackaday.com/2008/05/07/gpl-vs-skype-back-in-court/http://www.hackaday.com/2008/05/07/gpl-vs-skype-back-in-court/#commentsFiled under:


UPDATE: Skype has withdrawn their appeal and accepted the original judgment.

Tomorrow the High District Court of Munich will hear Skype argue against the validity of the GPL. Last June, the court issued an injunction against Skype for selling the SMC WSKP 100, a Linux-based WiFi VoIP phone. After the initial GPL violation, a flier with the URL for the source was added to the package. The GPL wasn't provided and the court found this insufficient for fulfilling the requirements of the GPL. Skype is appealing and claims that the GPL as a whole violates anti-trust regulation. The case against Skype was brought by OpenMoko's original system architect, Harald Welte, as part of his work for gpl-violations.org.
Read | Permalink | Email this | Linking Blogs | Comments
]]>gplharaldweltemunichopenmokoskypesmcviolationweltewifiEliot Phillips2008-05-07T20:15:00+00:00Cat-5 Ethernet/Serial/PoE to your wireless routerhttp://www.hackaday.com/2008/03/26/cat-5-ethernet-serial-poe-to-your-wireless-router/http://www.hackaday.com/2008/03/26/cat-5-ethernet-serial-poe-to-your-wireless-router/http://www.hackaday.com/2008/03/26/cat-5-ethernet-serial-poe-to-your-wireless-router/#commentsFiled under: ,


Adding PoE(Power over Ethernet) just wasn't good enough for [steve]. Not only does he have power running over his Cat-5, he shared the ground wire and used the remaining pair to add a serial console to his rooftop mounted wireless router. Nice.
Read | Permalink | Email this | Linking Blogs | Comments
]]>cat5ethernetPoErouterwirelessWill O'Brien2008-03-26T16:04:00+00:00DIY 2.4ghz Spectrum Analyserhttp://www.hackaday.com/2008/02/14/diy-2-4ghz-spectrum-analyser/http://www.hackaday.com/2008/02/14/diy-2-4ghz-spectrum-analyser/http://www.hackaday.com/2008/02/14/diy-2-4ghz-spectrum-analyser/#commentsFiled under:


This project got some blog love last year, but it slipped past my radar. [jhecker] built a parallel port interfaced device based on a Cypress 2.4ghz transceiver module. The module is pretty complete, so as long as you can wield a soldering iron, you can pull this one off. The module is pretty cheap, so it could be just the thing for building your own signal detector.
Read | Permalink | Email this | Linking Blogs | Comments
]]>Will O'Brien2008-02-14T23:02:00+00:0024C3 Mifare crypto1 RFID completely brokenhttp://www.hackaday.com/2008/01/01/24c3-mifare-crypto1-rfid-completely-broken/http://www.hackaday.com/2008/01/01/24c3-mifare-crypto1-rfid-completely-broken/http://www.hackaday.com/2008/01/01/24c3-mifare-crypto1-rfid-completely-broken/#commentsFiled under:


Another highlight for us at CCC was [Karsten Nohl] and [Henryk Plötz] presenting how they reversed Philips crypto-1 "classic" Mifare RFID chips which are used in car keys, among other things. They analyzed both the silicon and the actual handshaking over RF. Looking at the silicon they found about 10K gates. Analyzing with Matlab turned up 70 unique functions. Then they started looking "crypto-like" parts: long strings of flip-flops used for registers, XORs, things near the edge that were heavily interconnected. Only 10% of the gates ended up being crypto. They now know the crypto algorithm based on this analysis and will be releasing later in the year.

The random number generator ended up being only 16-bit. It generates this number based on how long since the card has been powered up. They controlled the reader (an OpenPCD) which lets them generate the same "random" seed number over and over again. This was actually happening on accident before they discovered the flaw.

One more broken security-through-obscurity system to add to the list. For more fun, watch the video of the presentation.
Read | Permalink | Email this | Linking Blogs | Comments
]]>24c3ccccryptomifarerfidEliot Phillips2008-01-01T09:56:00+00:00ToorCon 9: Retrieving WEP keys from road warriorshttp://www.hackaday.com/2007/10/23/toorcon-9-retrieving-wep-keys-from-road-warriors/http://www.hackaday.com/2007/10/23/toorcon-9-retrieving-wep-keys-from-road-warriors/http://www.hackaday.com/2007/10/23/toorcon-9-retrieving-wep-keys-from-road-warriors/#commentsFiled under:


[Vivek Ramachandran]'s Cafe Latte attack was one of the last talks we caught at ToorCon. I've found quite a few articles about it, but none really get it right. It's fairly simple and deals with cracking WEP keys from unassociated laptops. First your WEP honeypot tells the client that it has successfully associated. The next thing the client does is broadcast a WEP encrypted ARP packet. By flipping the bits in the ARP packet you can replay the WEP packet and it will appear to the client to be coming from an IP MAC combo of another host on the network. All of the replies will have unique IVs and once you get ~60K you can crack it using PTW. The bit flipping is the same technique used in the fragmentation attack we covered earlier, but Cafe Latte requires generation of far fewer packets. You can read about the Cafe Latte attack on AirTight Networks.
Read | Permalink | Email this | Linking Blogs | Comments
]]>toorcontoorcon9wepwifiEliot Phillips2007-10-23T20:45:00+00:00Drive bay PoE adapterhttp://www.hackaday.com/2007/10/20/drive-bay-poe-adapter/http://www.hackaday.com/2007/10/20/drive-bay-poe-adapter/http://www.hackaday.com/2007/10/20/drive-bay-poe-adapter/#commentsFiled under: , ,


Sure, we've seen Power over Ethernet before - I even whipped up a simple adapter for my modded wrt54gs. This is a nice clean setup, and it'll save you from yet another power brick. (I've got a power strip dedicated to the things in my tiny home data center.)
Read | Permalink | Email this | Linking Blogs | Comments
]]>Will O'Brien2007-10-20T22:12:00+00:00Build your own GPS and GLONASS Receiverhttp://www.hackaday.com/2007/10/04/build-your-own-gps-and-glonass-receiver/http://www.hackaday.com/2007/10/04/build-your-own-gps-and-glonass-receiver/http://www.hackaday.com/2007/10/04/build-your-own-gps-and-glonass-receiver/#commentsFiled under: , ,



[superlopez] sent in this detailed article (mirrored here and here) which describes how to build a GPS and GLONASS (the Russian version of GPS) receiver. The resulting device is gigantic compared to one of those tiny bluetooth USB GPS units, but the ability to build one's own receiver is one of those post-apocalyptic skills I sure would like to have. The creator of the article [Matjaz Vidmar] aka [S53MV] also has pages on Packet-Radio (PKT) transceiver improvements (PKT gets my vote for the best post-apocalyptic technology, and the only believable technology featured in the Transformers movie), and a more sophisticated homemade frequency counter than the one featured earlier this summer.

In 2005 we featured a from-scratch GPS receiver as well, thought the project site seems to be down. If your GPS unit just needs a better antenna, check out [Will]'s how-to from last year.
Read | Permalink | Email this | Linking Blogs | Comments
]]>analogglonassgpshamradiopacketradiopktradioreceiverFabienne Serriere2007-10-04T14:37:00+00:00Automatic JTAG Pinout Detectionhttp://www.hackaday.com/2007/09/29/automatic-jtag-pinout-detection/http://www.hackaday.com/2007/09/29/automatic-jtag-pinout-detection/http://www.hackaday.com/2007/09/29/automatic-jtag-pinout-detection/#commentsFiled under: , , ,



Figuring out the JTAG pinout on a device turns out to be the most time consuming hardware portion of many hacks. [hunz] started a project called JTAG Finder to automatically detect the JTAG pinouts on arbitrary devices using an 8bit AVR ATmega16/32L microcontroller. Check out the slides (PDF) from the talk as they break down how one finds JTAG ports on an arbitrary device, with or without a pinout detection tool. [hunz] is looking for people to pick up the project where he left off.

Once you determine the correct pinout, you will need a JTAG cable: there are two main types, buffered and unbuffered, both of which I have soldered up and tested from these circuit diagrams (image of completed buffered cable here). The software most hardware people use today are the openwince JTAG Tools. To get the JTAG Tools to compile, grab the latest source directly from their CVS repository.

The last time we featured JTAG was with regards to Linksys devices, but the tools listed above can be applied to any device with JTAG.
Read | Permalink | Email this | Linking Blogs | Comments
]]>automaticfirmwarejtagjtag finderjtag toolsJtagFinderJtagToolspinoutFabienne Serriere2007-09-29T11:39:00+00:00FON mp3 streaming routerhttp://www.hackaday.com/2007/09/23/fon-mp3-streaming-router/http://www.hackaday.com/2007/09/23/fon-mp3-streaming-router/http://www.hackaday.com/2007/09/23/fon-mp3-streaming-router/#commentsFiled under:


I was looking for streaming solutions the other day. Little did I know that [John] would be sending in a hack for adding an mp3 decoder board to the La Fonera. The final device has both a web and command line interface which let you connect to any shoutcast/icecast streaming server. John has even gone so far as to provide the Openwrt image for the router with all of the software components you need.
Read | Permalink | Email this | Linking Blogs | Comments
]]>fonfonerarouterwirelessEliot Phillips2007-09-23T22:43:00+00:00Electric screwdriver antenna tuninghttp://www.hackaday.com/2007/09/14/electric-screwdriver-antenna-tuning/http://www.hackaday.com/2007/09/14/electric-screwdriver-antenna-tuning/http://www.hackaday.com/2007/09/14/electric-screwdriver-antenna-tuning/#commentsFiled under: ,


I just realized that we'd never covered the classic amateur radio antenna hack - known as the mobile electric screwdriver antenna. I was looking for a decent writeup, and ran across this interesting tunable indoor antenna. [W2BRI] put together a 5 foot cube loop antenna built from copper pipe. The tuning mechanism uses an electric screwdriver to tune his giant PC Board tuning capacitor. Looks like a nice solution if you're into radio and have pesky neighbors.
Read | Permalink | Email this | Linking Blogs | Comments
]]>Will O'Brien2007-09-14T23:39:00+00:00Old Intel VPN to wireless routerhttp://www.hackaday.com/2007/08/12/old-intel-vpn-to-wireless-router/http://www.hackaday.com/2007/08/12/old-intel-vpn-to-wireless-router/http://www.hackaday.com/2007/08/12/old-intel-vpn-to-wireless-router/#commentsFiled under: ,


Slapping a wifi card into a pc isn't very ground breaking, but [Darkside] had to add a PCI header and trace the board just to hook up a keyboard before he could do much with his old intel vpn gateway. In the end, he added m0n0wall and a wireless card to turn it into a nice wireless router.
Read | Permalink | Email this | Linking Blogs | Comments
]]>Will O'Brien2007-08-12T23:03:00+00:00Defcon 15: WiCrawl from Midnight Research Labshttp://www.hackaday.com/2007/08/04/defcon-15-wicrawl-from-midnight-research-labs/http://www.hackaday.com/2007/08/04/defcon-15-wicrawl-from-midnight-research-labs/http://www.hackaday.com/2007/08/04/defcon-15-wicrawl-from-midnight-research-labs/#commentsFiled under: ,


[Aaron] gave the latest on WiCrawl. The focus has been on the UI and usefulness for penetration testing. It's got support for [David]s coWPAtty FPGA WPA cracking accelerator and some UI improvements. Even better, you can grab the WiCrawl module to put on a BackTrack Slax livecd from the project page. [Aaron] passed out some CD's at the talk - I'll update if the ISO gets posted.

And yes, I think I finally recovered from playing Hacker Jeopardy on team MRL. We held our own, but lost on the (LAME) final jeopardy question.
Read | Permalink | Email this | Linking Blogs | Comments
]]>penetration testingPenetrationTestingwicrawlwpa crackingWpaCrackingWill O'Brien2007-08-04T15:23:00+00:00SIP for the SMC WSKP100http://www.hackaday.com/2007/07/31/sip-for-the-smc-wskp100/http://www.hackaday.com/2007/07/31/sip-for-the-smc-wskp100/http://www.hackaday.com/2007/07/31/sip-for-the-smc-wskp100/#commentsFiled under: , , ,


[sprite_tm] made my morning by sending in his latest work. After opening up his new SMC WSKP100 (Skype wifi phone) to identify the hardware differences, he managed to shrink a flash image from the SMCWSP100 to fit on his new toy. Then he spent some time hacking the kernel from the former to work on his phone. The result? A SIP operational phone that'll connect to his asterix server at half the price of SMC's official SIP phone.
Read | Permalink | Email this | Linking Blogs | Comments
]]>Will O'Brien2007-07-31T13:01:00+00:00