Adeona - Open source laptop tracking

Adeona blipped across my radar earlier this week and I've had it running on my MacBook ever since. Adeona is a free, Open Source (GPL 2.0) laptop tracking tool designed to aid you in recovery should your precious ever get stolen.

In its current version, it's not difficult to remove or disable, but on MacOS X, the fact that it's installed and running is not obvious to the user. On OS X, it can capture a snapshot from the iSight if equipped. This means that periodically, the iSight's LED comes on for a moment. This captured image is uploaded along with the location information.

One thing that males Adeona stick out from the competition (aside from its price tag) is that the location update information is securely stored on the OpenDHT network, a free, distributed hash table service. This means that no one can use Adeona or the data it generates to track you surreptitiously without having the retrieval file and the password you chose. Centralized commercial services often have the ability to track you, or their centralized information may become compromised. Adeona has no such risks.

You COULD potentially install Adeona on someone else's laptop, but if you're looking for software to help you spy on someone, there are a lot more efficient and feasible options out there. Adeona will get you an IP address and traceroute output. With the help of an ISP, this will help with a police investigation. If you have iSight photographs enabled, you might even get a clear photo of whomever is using your laptop to really seal the deal.

Once you install Adeona and select your password, a periodic schedule is started to gather and upload information to OpenDHT. It's that simple. Install and go. Whenever the laptop has Internet access, it will send periodic updates. You should copy the configuration file to a USB Key or have it backed up in a place that doesn't travel with the laptop, as this file is needed to get the location data from OpenDHT once you believe your laptop has been stolen.

If you wish to retrieve those updates, download Adeona to another computer and use the Adeona-retrieve tool. You can use the retrieval tool on the laptop Adeona's installed on, but if it's stolen you won't have that luxury. Load the configuration file and enter your Adeona password. It's that simple.

Adeona will grind for a while, as locating and retrieving data from OpenDHT can take a while. Once it's done, though, you'll get a text file and optionally a graphic from the iSight camera. Here's my fugly mug and a pixelized Adeona status file (click to enlarge)

H.D. Moore: Punk't, not pwned.

Oh, how we love drama, and there's plenty of drama in the world of information security.

As you've probably figured out by now, Dan Kaminsky's report of a DNS static source port bug (and the simple exploitation of the same) has fueled a considerable source of recent controversy and drama. Shortly after details hit the security blogs, H.D. Moore (author of Metasploit) and |)ruid put together some checks for the vulnerability. Even yesterday, he released a third Metasploit plugin to check between two different DNS servers in an attempt to detect poisoning.

A few days ago, HD stumbled across a DNS server "in the wild" which had been poisoned to redirect all Google traffic to a batch of rogue sites meant to monetize google ads by automatically clicking them in hidden iframes. After discussing this DNS server in the wild with a reporter for IDG News Service, the reporter went on to write a piece (which is not worth linking to) blatantly stating that BreakingPoint Systems (where H.D. serves as Director of Security Research) was "owned", when there was no such pwnage.

A second article was published which clarified some points, but the original article is being linked to like mad on some social news sites, and it hasn't been edited yet as of the time of writing here.

For H.D.'s side of the story, check out his post on the Metasploit Blog.

HiR Reading Room: No Tech Hacking

Johnny Long has been around as an info-sec writer and presenter for a while. In No Tech Hacking, he takes the reader through some of his twisted adventures, flippantly poking fun at some of the "security" he's encountered along the way.

When it comes to penetration testing and security awareness in general, there's a pretty massive human element that's simply ripe for the picking. There's also a lot of low-tech stuff that can be leveraged to your advantage. For many, the obvious first move on taking over a network is enumerating your target with ping sweeps and port scanners. If you want to get into a building, you might brush up on your lock-picking skills or reach for a brick to throw into a window. While these techniques have some kind of merit (not always good), it's often more effective to go low-tech (or No Tech!) as much as you can.

Johnny covers his low-tech tricks in detail and often with photos and screen shots. It's more than just social engineering and tailgating to get your mark. It's about thinking through info-sec problems with a different mindset than you're probably used to. Profile your targets and pay attention to seemingly useless details.

From bypassing locks to using exposed information via the Internet, people watching to vehicle profiling: there's a lot of low-tech information contained in this book, and you're almost guaranteed to learn something you hadn't thought of before.

No Tech Hacking closes with some sage advice to would-be no-tech victims. It was an entertaining and informative read. I hope I can see Johnny speak one of these days. He won't be talking at DefCon this year, but maybe he'll be there.

Friday Geek-Out: July 25, 2008 and upcoming KC gatherings

I showed up a bit early to the Geek-Out. So did (jeff)isageek. We've been gabbing about podcasting, blogging and random geekery. I don't know how long Jeff's hanging out, but I'll be here probably until well after midnight. If you see this before then (and if you're near Overland Park, KS), come on out! We're at Daily Dose!

I'm pondering the usefulness of a full-on laptop while I'm at DefCon. I may try making do with only the Jornada 720 and jLime Linux. I probably won't have my digital camera with me (I loaned it out to a good friend who is currently on a road trip) but I can mobile blog with my cell phone and its camera. For the essentials, the Jornada should do everything else I really need. Here, I have BrightKite and GMail up on Minimo in the background and the Hak.5 IRC channel in a terminal window with irssi. It's surprisingly responsive and dare I say peppy. Peppy enough that I might not need a real laptop on the convention floor.



Next Friday is 2600 Night. We meet in the food court at Oak Park Mall in Overland Park, KS and then afterwards get a bite to eat. We wrap things up with a late-night Geek-Out at the Dose where you can pick your poison of uppers (caffeine) or downers (get your beer and cocktails on!).

No Friday Geek-Out on the 8th, because we'll all be at DefCon, hopefully!

See you around!

Black Hat USA 2008 Briefings and Training

Looks like HiR will be present at Black Hat USA 2008 Briefings and Training. Asmodian X will be there getting a brain full of knowledge. I, on the other hand, will be crack-a-lacking in my cubicle then packing my bags for Vegas.

Looks like August will be a great month. Hopefully we come away with lots of fun stuff to share!

Held at Caesar's Palace in Las Vegas, NV.
Training: August 2-3 (Weekend) & August 4-5 (Weekday)
Briefings: August 6-7

HiR at DefCon 16 and IT Security World 2008

DefCon 16: Las Vegas, NV Aug 8-10, 2008 At The Riviera.
I'm pretty sure at least two of the HiR crew will be there. Also, make sure to swing by skybox 208 on Saturday and say hi to our buddies at i-Hacked.

It should come as no surprise that you'll probably find me in quite a few of the Physical Security tracks, but I'm looking forward to Nathan Hamiel and Shawn Moyer's talk on social networks and seeing what in the world Dan Kaminsky has to say now that his uber-l33t DNS exploit is old news.

e-mail ax0n (at) h-i-r (dot) net if you want my contact info to meet up. Asmodian X will likely be around as well. There'll be thousands of people in attendance, so we probably won't be easy to spot. I think it goes without saying, but protect your laptop or wireless PDA before you come. Be prepared to VPN or Tunnel out if you plan on using the Internet. This is seriously one of the most hostile networks you'll ever connect to. You might be better off with a notepad and some paper.


I'll be at IT Security World 2008 as well. Not quite as exciting as DefCon, but legitimate enough you might be able to get your boss to pay your way. Check it out, look at the agenda, and see if there's anything even remotely relevant to your job.

HiR Reading Room: Beyond Fear

Beyond Fear: Thinking Sensibly About Security In An Uncertain World by Bruce Schneier is a Post-9/11 look at security for normal people. It arms the reader with the knowledge and understanding to distinguish FUD (Fear, Uncertainty and Doubt) and "Security Theater" from things that really do improve security.

While Schneier overly simplifies or dilutes certain security concepts that have well-established definitions in the industry, I feel that the book itself was a worthwhile read for anyone because the concepts are presented in a clear, easy-to-understand manner.

The book itself starts off by describing what security entails, and what elements are at play. From there, it starts giving examples of various scenarios and explains why certain countermeasures would work or fail. Security, versus Security Theater.

For those of us who are already working in or have an understanding of security and how it works, this book will be a little bit repititious at some spots. Conversely, it's entertaining enough to read through from beginning to end. If you often find yourself critical of the effectiveness of so-called "security" protocols, this might be the book for you. If you already have a firm grasp of the security mindset but want to be able to explain security in simple terms that anyone can understand, this book is packed with anecdotes and verbiage that simply make sense.

Overall, I enjoyed Beyond Fear quite a bit. I wouldn't dare cite it as a serious reference in a research paper on security, but I'd most certainly recommend it to technical and non-technical people alike who seem to have succumbed to FUD from a lack of understanding.