Movies 'n' Laser Graffiti With CCCKC

Movie night was a blast! There are tons of people to thank:

• The CCCKC Guys for setting this up
• My pastor for letting me borrow our high-power video projector for this project!
  
• All the awesome people who came out and helped us raise some funds

People watching the movie


A home-built laser persistence-of-vision pattern machine (not using the LaserTag setup we brought out)


Getting things started on the AT&T Building downtown


w00t!


Watch out, there's a cop down there!  Surprisingly, the police left us alone all night.


Some videos of the Laser Graffiti in action (projected onto the brick wall at Harry's)

A game of Tic-Tac-Toe

Introduction to Proximity Cards

Introduction to Proximity Cards

Sections:

1. Summary
2. Description
3. Hacking Projects involving proximity cards
4. Conclusion
5. Informative Resources

This article is intended for basic familiarization on Proximity identification cards.

Proximity cards are one of the more popular ways to lock buildings from undesired guests while avoiding dealing with physical keys. Just stuff the card in your wallet and swipe it against a proximity card reader pad, which beeps cheerfully, flashes a green light and the door opens. Or it politely rejects you by beeping and flashing a stern red light. Or if you are like a few of my friends it blinks a light , and beeps in a cheerful manor and either lets you in or it doesn't. But securing buildings isn't the only thing that proximity technology is used for. Proximity technology is used in: Pay cards, transit cards, key cards, RFID tags and more.

1. Summary
A Proximity Card is a small credit card sized passive electronic device which Is typically used for physical access control. Simple cards return a code when activated, more complex cards are basically a wireless smart card which issues an encrypted challenge response along with stored personal information.

2. Description
So here's an explanation on how a proximity card works:

The card itself consists of a physical plastic card which contains a special wire with a coil and an IC. This is similar in concept to a smart card except instead of electrode pads the wire and coil take care of communication. What happens is that when the card is passed in the general proximity of a reader (roughly 1 to 3 inches usually) the reader transmits a signal which is intercepted by the special circuit in the card which then reacts and passes and reflects back a changed signal back to the reader. The reader then transmits the results back to a central control computer which either accepts or rejects the transaction and allows or denies entry (Westhues 2008)(Wikipedia 2008).

This process is called the Wiegand Effect. The special wire is made out of a mixture of cobalt, iron and Vandium, and is also known as Vicalloy. This is then cold-worked into a wire known as a Wiegand Wire. The wire reacts to a magnetic field by causing a small burst of power which is detected by a coil wrapped around the wire. This burst of power is called a Barkhausen jump or Barkhausen Effect. (Wikipedia 2008)

Simple RFI cards are configured with a id number, part of this number is a company id, the other part is a unique number. Each person is given a uniquely numbered card which the card transmits when it encounters a carrier field from a card reader. If the user tries the card at another company, the card will transmit its code but will be rejected because the card has a different company code (wikipedia, 2008).

ISO 14443 specifies that this signal exchanged may contain data which can be cryptographically signed. For instance US Department of defense badges are smart cards which contain information about that person along with cryptographic keys for authentication and encryption and decryption of data (Wikipedia 2008).

There are other standards like ISO 15693 which is the Vicinity card standard. It is functionally similar however uses a different wireless handshaking process with different radio frequencies.

3. Hacking projects involving Proximity cards

Eliot Phillips on Hack-a-day posted an article by Jonathan Westhues which detailed how to build a proximity card reader/spoofer (Westhues, 2008). Multiple Metropolitan transportation cards have gone to a proximity card to increase efficiency. Once again this is using a form of wireless smart-card. The most recent of these methods was slated to be discussed at Defcon in 2008. However the group was sued by the transit authority before they could do so. The MiFare hack allowed for cloning of pay cards(Anderson, Ryan and Alessandro, 2008).

The Olin College Prox Card team designed a USB 1.0 proximity card reader capable of reading 125 khz proximity cards and reading the response information.
This device used a pc micro-controller to read and relay the Proximity card information to a computer as a USB device (Olin College Prox Card Team, 2004).

4. Conclusion
Proximity cards are the entry method of choice, it allows keys to be given out in mass, combined with a computerized building entry system keys can be activated or de-activated with a minimum amount of physical effort. They cards themselves are convenient to the user because they can walk up to a door and either hold the card with in 3 inches of the pad and the door will open as opposed to fishing through a large key chain.

Because the old style proximity card systems rely on a static analog signal for identification, the basic installations have a serious flaw which makes the system as effective as an old style physical lock. The new standards including cryptographic handshaking are much more effective for security. Though as the MiFare hack demonstrates that even newer system are not immune to issues caused by improper design and implementation.

5. Informative Resources

Anderson , Zack, Ryan , RJ and Chiesa , Alessandro. "The Anatomy of a Subway Hack." Presentation Materials from Defcon 16 (2008). www.defcon.org

The Olin College USB prox card team. (Accessed Sept 2008) "The USB Proximity Card Reader." (2004)
http://pe.ece.olin.edu/projects/proxcard/prox.html

Westhues, Jonathan. (Accessed Sept 2008) "Proximity Cards"
http://cq.cx/prox.pl

Wikipedia. (Accessed Sept 2008) "Wiegand Effect."
http://en.wikipedia.org/wiki/Wiegand_effect

Wikipedia. (Accessed Sept 2008) "Access Badge"
http://en.wikipedia.org/wiki/Access_badge

Wikipedia. (Accessed Sept 2008) "ISO/IEC 14443."
http://en.wikipedia.org/wiki/ISO_14443

Social Engineering: Avoiding Storefront Solicitors

Social Engineering isn't always used for malice. In its purest form, "Social Engineering" is simply taking advantage of predictable social behavior and habits. More advanced social engineering exploits revolve around the human tendency to trust and help others whose plight sounds remotely convincing. Millions of people use some form of social engineering without knowing it. While that doesn't make them good social engineers, it does mean that pretty much anyone can do it.

A simple example is avoiding solicitors who position themselves between you and somewhere you wish to go. This can be people pushing samples on you at the grocery store, people trying to sell merchandise as you leave from concerts, and even charity fundraisers operating in front of businesses.

Your objective is simple: Get in. Get what you need. Get out. If you see someone waiting to pounce on you with a survey, goods for sale, or something else you really don't have the time for, just whip out your cell phone and act like you're having a conversation. It won't stop you from looking like a self-important jerk, but it will save you and your would-be solicitor a few seconds of your lives. Okay, the solicitor's not going to be saved any time, really, but maybe they'll find someone else to talk to who would be more responsive anyways.

Obviously, this works because in most advanced civilizations, we've been trained not to interrupt someone who is talking on their phone. In taking advantage of this habit, you can get in and out quickly (remember to whip out the phone again as you exit!) without the hassle of solicitors.

Having said that, there are some great charity organizations I believe in who position themselves in front of stores. There are also a lot of scumbag scalpers and shrewd salespeople who force their wares on you at social events. Pick your social engineering adventures wisely.

UNIX Tips: MAC Address Spoofing/Changing

I don't advocate using MAC Address spoofing for evil purposes such as:

• Using a MAC-Address Filtered wireless Access Point
• Deception
• Cloning an ethernet card already in use to confuse a network
• In order to mess with ethernet switches
• ... Plenty of other malevolent uses ...

MAC Spoofing has several constructive troubleshooting uses:

• Get a new IP Address from your DHCP server
• Testing Ethernet switch port security rules
• Troubleshooting issues with ARP
• ... plenty of other great uses ...

The Technique to temporarily change your MAC address is pretty similar across the board.  I'll go over some. In any of these examples, replace IFace with the name of the ethernet/wireless interface name such as "eth0", "en1", "rausb0" etc.  Obviously, you can make the ethernet address whatever you want.  The addresses I provide are arbitrary. It just has to be six pairs of hexadecimal (0-9 or A-F) digits separated by colons.  Obviously, these commands must be run with sudo or otherwise with root privileges.  Also, it helps if the ethernet interface is "down" first:

ifconfig IFace down

Mac OS X: 

ifconfig IFace ether 00:12:34:56:78:90

OpenBSD:

ifconfig IFace lladdr 00:11:22:33:44:55

Linux:

ifconfig IFace hw ether 00:de:ad:c0:ed:ba:be

FreeBSD:

ifconfig IFace link 10:00:ca:b0:05:e5

Adding a favicon to your hosted blog (New HiR Logo)

I thought it was about time for a logo and a favicon.

I'm no graphics designer, so it's pretty simple. Just not as simple as a block of text. 

Just because you've got a blog hosted at Blogger or even Wordpress, it doesn't mean you can't have a custom favicon logo as pictured left.  Simply make a 16x16 pixel image then use GIMP or another image tool to save it in Windows ICON format (with a .ico extension) and then find a place to host the image. Flickr works, for example.  Then, in the blog HTML template, add the following block of code near the top of the template, after <head>  and before </head> , replacing the URL to the HiR favicon to the URL of your image hosted elsewhere. 

<link rel="shortcut icon" type="image/ico" href="http://stuff.h-i-r.net/favicon.ico">

HiR Reading Room: Into The Breach

"Missing: 25 million child benefit records..."

"South Korean police on Sunday arrested four people over the theft of data on 11 million customers of a local oil refiner in what is being called the country's largest-ever data leak..."

Data Loss Headlines like these are enough to leave many consumers dumbfounded. Now, imagine being the director of the team tasked with protecting the data.  

Michael J. Santarcangelo, II (a.k.a. Security Catalyst) takes us Into The Breach to expose how these things happen. Usually, human error, ignorance and apathy is to blame. In both of the above headlines, data had been stored on media, then that media was later misplaced or discarded improperly. Catalyst asks "What happens when breach is only a symptom?"

The industry has responded to breach threats with Data Loss Prevention suites that disable external media and ports on computers, Network Access Control schemes that ensure only authorized computers can get on the network, and network content analysis tools.

None of these can protect all of the data all of the time. It's not because technology fails. It's because humans and business processes fail. Throwing more technology at this problem is not the only answer. Santarcangelo asserts that technology is best used to support information security in an environment where people think and act responsibly and are held accountable for information under their care. 

Furthermore, what with all the compliance buzz about electronic data, "sensitive information" has become synonymous with "data" whereas the truth is that sensitive information is everywhere: it lies within stacks of papers and as facts rattling around within peoples' heads. Breach encompasses any and all leaks, whether from attackers, a misplaced laptop or DVD, phone conversations or casual discussions in a public place. Folks, all the software in the world won't help you so long as the people who need that information lack understanding and/or accountability.

Into The Breach's sub-title is Protect your business by managing people, information and risk and that's exactly what's covered. From understanding peoples' justification for their behavior patterns and implementing The Strategy and beyond, the end result is a surprisingly concise angle on covering your ass while maximizing the effectiveness of your security budget... After all, your money goes a lot further with awareness than it does with six- and seven-figure software suites that will only serve to further mask the symptoms of a much larger systemic problem in your organization...

I got my hands on a pre-release copy of this book directly from Catalyst himself at DefCon. I'd like to personally thank him for handing over a few copies for me to pass around to colleagues and giving me a chance to get an advance peek at his work. I'm looking forward to flipping through the finished product, which likely has a little more information than the copy I've got in my hands right now.

The electronic edition of the final version is already available for the Kindle with the hardcover book hitting shelves (and Amazon) soon.

CCCKC: Hacker Super Fun Time (Beer + Movies + Lasers)

Updated info on Friday's Movie Night. This is going to take the place of anything resembling a Geek-Out night at Daily Dose.

I've written about this before, but it seems to be set in stone at a new location.

The idea is this: We're going to try to get more people together to understand what a hackerspace is, what "hackers" really do, and try to get some new recruits for Cowtown Computer Congress, a Not-For-Profit organization that is providing a space to work on your geeky projects.

Again, They're showing Hackers are People, Too and some stuff from Graffiti Research Lab... then we'll all go out and have some fun playing with a real Laser Graffiti rig if weather permits.

By the way, I had nothing to do with the naming of this party or the creation of the poster. I'm just getting the word out. :P

September 29th, 8:00pm

Harry's Country Club 

112 E Missouri Ave.
(Click for interactive map)