random image
status logout  
Register/Login/User Language

de  en 

     
Home
BBC
CCC
Debian
defcon
derstandard
FAZ
FreeBSD
Freshmeat
Gentoo
GNU
Golem
GrokLaw
Hackers
Heise
KernelTrap
kuro5hin
MySql
NewsForge
NewYork-Times
ORF
osnews
php
PostgreSQL
Reuters
Slashdot
Sourceforge
spiegel
symlink
Telepolis
Times
wired
ZEIT
Search:

2010
 
  • Hackers (107)
  • hackaday.gifNews from Hackers
     

    Filed under:


    While researching the CHDK How-To, we came across the team's instructions for porting the firmware to entirely new cameras. In theory, CHDK should work on any Canon running the DIGIC II or III processor since most of them are running the same VxWorks OS. A dump of the camera's firmware is required before porting work can begin. On some cameras, the firmware was retrieved using software, but others required a hardware route. Pictured above is a Canon A610 that's slowly flashing out every bit of its firmware using the built in LED. The photodiode is hooked up to a soundcard where the entire bitstream is recorded. It takes 1-7 hours to read the entire firmware. Once the sound file has been captured, it's reverted to the original bytes and can then be decompiled with something like IDApro.
    Read | Permalink | Email this | Linking Blogs | Comments

    Filed under:


    Since it happens to be the day after a nice holiday break, many of us are finding ourselves back in front of our desk once again. Perhaps some of you never left it the entire weekend. In any case, it seems fitting to take a look at a few interesting integrated desks we've come across lately. Follow through after the break to see our favorites.


    Cable management seems to be a constant struggle for many of us, do we have too many electronics? Probably, but how can one effectively manage the cable clutter? [Van Mardian] came up with a nice solution that only required about $30 in parts from a local hardware store. Using a pegboard mounted under the desk itself he was able to hide most of his wires and even some peripherals. The comments have a lot of other examples.


    For those who live in a closet or perhaps a New York apartment, available space can sometimes be an issue. Thankfully a Romanian design company called MTI Impex has created the cube PC desk. Unfortunately we couldn't find additional information such as plans, but it doesn't look like it would be too hard to construct.



    Similar to the previous example this normal looking trunk converts into a mini cubicle on wheels. From Japan, this melamine resin trunk comes complete with a fold out desk and several pre-drilled holes for cables. Ordering is available on the official site, but will set you back $2000US.


    Lastly, we have the desk that inspired this post as it made its way around the net today. This beauty is like a mullet, all business up front with a party in the back. From a 1947 edition of Popular Mechanics this "dream desk" is just aces with all the features a modern executive needs. Yes, it has a 6 tube radio, dictating equipment, and even an electrical convenience outlet. More importantly, the backside (or play side) is equipped to turn any office into party central with its fridge and other spirit related fineries. Toss in a safe and we can only imagine this desk weighed more than its short lifespan was worth.

    If you have come across an interesting desk hack, or have created one yourself, please let us know in the comments.
    Permalink | Email this | Linking Blogs | Comments

    Filed under:


    A new legal precedent may be set with the case of [Lori Drew], the St. Louis woman who posed as a teenage boy on MySpace and harassed 13-year-old [Megan Meier] until she committed suicide. Drew is being charged under the computer fraud and abuse act, on the grounds that she violated the terms of service agreement of MySpace. If she is convicted of these charges (she is also being charged with conspiracy), it may allow for the criminal prosecution of anyone who violates the terms of service agreement of a site under the same law.

    The ...
      2008-05-28 09:50:07
    Comments (0)DETAILS




    insec.gifNews from Hackers
     
    Posted by zdi-disclosures_at_3com.com on May 27

    ZDI-08-033: Motorola RAZR JPG Processing Stack Overflow Vulnerability
    http://www.zerodayinitiative.com/advisories/ZDI-08-033
    May 27, 2008

    -- Affected Vendors:
    Motorola

    -- Affected Products:
    Motorola RAZR

    -- Vulnerability Details:
    This vulnerability allows remote attackers to execute...


    Posted by iDefense Labs on May 27

    iDefense Security Advisory 05.27.08
    http://labs.idefense.com/intelligence/vulnerabilities/
    May 27, 2008

    I. BACKGROUND

    AlphaStor is a suite of applications used for disk management. For more
    information, please see the vendor's website found at the following
    link.

    ...


    Posted by iDefense Labs on May 27

    iDefense Security Advisory 05.27.08
    http://labs.idefense.com/intelligence/vulnerabilities/
    May 27, 2008

    I. BACKGROUND

    AlphaStor is a suite of applications used for disk management. For more
    information, please see the vendor's website at the following URL.

    ...


    Posted by Tobias Heinlein on May 27

    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Gentoo Linux Security Advisory GLSA 200805-21
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    ...


    Posted by Bruce Ediger on May 27

    On Tue, 27 May 2008, Anders B Jansson wrote:

    > Limiting the continued propagation of sql-slammer is both a worthy and
    > commendable deed.
    >
    > But I'm afraid that it's totally futile.

    How so? Code Red II and Nimda appear to have disappeared, albeit after many
    years.

    I suspect...


    Posted by Simon Smith on May 27

    Indeed, that is the IP address.

            That IP address appears to be bound to some sort of a VPN system for
    ford. Perhaps its infected VPN users?

    Michael Holstein wrote:
    >
    >> In response to them still being infected with sql slammer and it...


    Posted by Ray P on May 27

    When that stuff first showed up last year I emailed their ARIN contact and got a real person. They got back to me within a day and said the same thing. SQL Slammer is a single packet UDP attack so their response is 100% plausible.

    Ray

    >
    > > In response to them still being infected...


    Posted by Michael Holstein on May 27

    > In response to them still being infected with sql slammer and it probing
    > my networks regularly.
    >
    Let me guess .. it's 136.1.7.55 ?

    Here's what I get (from ford) every time that IP pops up in our
    automated abuse report ..

    --snip--

    Our investigation into this matter has...


    Posted by Anders B Jansson on May 27

    Simon Smith wrote:
    > In response to them still being infected with sql slammer and it probing
    > my networks regularly.

    Ah, them and a gazillion of others.

    I ran a little experiment some time ago.

    I had an unused ipadress (bog standard dynamic home issue cable feed) and just for fun I...


    Posted by Simon Smith on May 27

    In response to them still being infected with sql slammer and it probing
    my networks regularly.

    Nate McFeters wrote:
    > Is this in response to a vulnerability to report, or in response to some
    > other form of abuse, like spam?
    >
    > -Nate
    >
    >
    > On 5/27/08, *Gary...


    Posted by Nate McFeters on May 27

    Is this in response to a vulnerability to report, or in response to some
    other form of abuse, like spam?

    -Nate

    On 5/27/08, Gary Wilson <dragon_at_dragons.org.uk> wrote:
    >
    >
    > On Tue, May 27, 2008 16:46, Simon Smith wrote:
    > > Does anyone here have a contact for...


    Posted by dann frazier on May 27

    ----------------------------------------------------------------------
    Debian Security Advisory DSA-1588-1 security_at_debian.org
    http://www.debian.org/security/ dann frazier
    May 27, 2008 http://www.debian.org/security/faq
    ...


    Posted by Gary Wilson on May 27

    On Tue, May 27, 2008 16:46, Simon Smith wrote:
    > Does ...

      2008-05-28 09:49:59
    Comments (0)DETAILS




    hitb.gifNews from Hackers
      ...
      2008-05-28 09:49:33
    Comments (0)DETAILS




    hackaday.gifNews from Hackers
     

    Filed under:


    Had enough Nintendo homebrew action yet? We haven't either. Especially not now that the doors to the homebrew scene have been blown open by The Homebrew Channel. Up to this point, the only way you could run homebrew on an unmodded Wii was the Twilight Hack, which leveraged a flaw in Twilight Princess save games. The Homebrew Channel lets you launch various homebrew apps with a useful GUI instead of performing the hack every time you want to run them. It can access apps stored on an SD card, a computer on the same network, and even USB Gecko. There is no USB flash drive or DVD support at the moment.

    The Homebrew Channel can be loaded onto the Wii by running the Twilight Hack (don't worry, it'll probably be for the last time) with the Homebrew Channel Files in the root of your SD card. The Wii will reboot and then the channel will appear in the list. We tested it ourselves, and found that everything loaded properly from the SD card (we didn't try the other sources). We did run into a problem where it failed to load any of our homebrew apps or even reboot properly if a Gamecube memory card was in the slot, but it's an easy fix, just pull it out.

    The devteam behind this release wanted to make things as easy and accessible as possible, so they included download links to the Twilight Hack, The Homebrew Channel, and even a homebrew software bundle to get you started. If you want more homebrew apps, head to Wiibrew.

    [via everywhere]
    Permalink | Email this | Linking Blogs | Comments

    Filed under:


    It's Memorial Day in the US, so we thought we'd put together a collection of links we've covered in the past that might help you celebrate.

    The Apu 3000 is one of the finer examples of drug use leading to carpentry. It's a 4 gallon frozen margarita machine built out of a garbage disposal. A new garbage disposal. We don't have the time here to speculate on what sort chemical dangers you may expose yourself to by constructing this though.

    Continuing the trend of throwing horsepower at problems is the gas powered blender. It's good for people that love a refreshing beverage while inhaling the fumes of 2-stroke engines.

    We've covered a couple peltier based cooling projects in the past too. The first was a can cooler for the desktop. The second involved snaking a CAT5 cable across the yard to power a mug.

    Back in 2005, Hackaday regular [evan] sent in his BASIC Stamp controlled kegerator. It's very reliable and way cheaper than a commercial unit.

    We're closing on a sad note: It seems the instructions for making Guinness beersicles have fallen offline, again. From what we remember, you throw the can in the freezer till it reaches a thick slush stage. Then, release the gas so it forms a head in the can. Pierce the bottom of the can and insert the stick. Return the can to the freezer and let it freeze solid.
    Permalink | Email this | Linking Blogs | Comments

    Filed under: , ,


    [Marcus] sent in his work on making ECGs. His first one was inspired by [Jason]'s. Believe it or not, you can build this thing for under $5. After getting it semi-functional, he decided to pick up a cheap one and mod it for PC input via the sound card. (There are plenty of sound card oscilloscope projects that will work for this.) Remember kids, don't go sticking electrodes on anyone unless you know what you're doing: correctly placed electrical shocks (even low power ones) can be deadly.
    Read | Permalink | 
      2008-05-27 09:50:44
    Comments (0)DETAILS




    insec.gifNews from Hackers
     
    Posted by security curmudgeon on May 27

    CORE / SecurityFocus,

    The cross-references between BID, CVE and vulnerability seem to be wrong
    in both the advisory and BID database. From the advisory:

    : Multiple vulnerabilities in iCal
    :
    : Advisory ID: CORE-2008-0126
    : Advisory URL: http://www.coresecurity.com/?action=item&id=2219
    ...


    Posted by n3td3v on May 27

    ---------- Forwarded message ----------
    From: n3td3v <xploitable_at_gmail.com>
    Date: Tue, May 27, 2008 at 3:35 AM
    Subject: TJX staffer sacked after talking about security problems
    To: n3td3v <n3td3v_at_googlegroups.com>

    A low-level TJX employee has lost his job for...


    Posted by Aviram Jenik on May 26

    Subject: Advisory - Rsyncrypto maybe affected from Debian OpenSSL reduced
    entropy problem
    Date: Friday 23 May 2008
    From: Shachar Shemesh <shachar_at_lingnu.com>
    To: L-rsyncrypto <rsyncrypto-devel_at_lists.sourceforge.net>

    Background

    Rsyncrypto[1] is a file encryption...


    Posted by A. R. on May 26

    Hello fellow security enthusiasts,

    Fancy going from a SQL Injection to a full GUI access on the DB server?
    What about extracting password hashes on the fly? Take a few SQL
    Injection tricks, add a couple of remote shots in the registry to
    disable Data Execution Prevention, mix with a little...


    Posted by Alexander Klink on May 26

    > > That is indeed a problem. AFAIK IE 7 on Vista now does some CRL
    > checking
    > > by default, but I haven't tried it yet.
    >
    > I did some research on this recently, and the story for browser support
    > is actually much more complicated. In addition to CRLs there is a
    ...


    Posted by Larry Seltzer on May 26

    >>> No, CRLs don't work. Firefox for example does not check for CRLs
    >>> (default setting), making certificate revocation senseless. I
    assume,
    >>> other Browsers don't check CRLs either. And what about the german

    > That is indeed a problem. AFAIK IE 7 on Vista...


    Posted by Alexander Klink on May 26

    Hi Niclas,

    On Sun, May 25, 2008 at 09:15:55PM +0200, niclas wrote:
    > you recently wrote that you tested the CA-certificates - but you didn't
    > test the certificates which have been *signed* by the CAs.

    I actually tested a few of those and I also found one of a major bank
    in Germany to...


    Posted by Steve Kemp on May 26

    ------------------------------------------------------------------------
    Debian Security Advisory DSA-1587-1 security_at_debian.org
    http://www.debian.org/security/ Steve Kemp
    May 26, 2008 ...


    Posted by niclas on May 25

    Alex,

    you recently wrote that you tested the CA-certificates - but you didn't
    test the certificates which have been *signed* by the CAs.

    They are a serious problem. The attack described in your recent post can
    easily be avoided by exchanging vulnerable certificates, BUT:

    If somebody grabbed...


    Posted by n3td3v on May 25

    On Sun, May 25, 2008 at 11:37 AM, Gadi Evron <ge_at_linuxbox.org> wrote:
    > One thing we did not do in these threads is to thank Core Security and
    > Sebastian Muniz for the work, and releasing it to help make the world
    > safer.
    >
    > Gadi.

    No I don't think the...


    Posted by Security Objectives Inc. on May 25

    ======================================================================
    = Security Objectives Advisory (SECOBJADV-2008-01) =
    ======================================================================

    Lenovo SystemUpdate SSL Certificate Issuer Spoofing Vulnerability

    ... ...

      2008-05-27 09:50:18
    Comments (0)DETAILS




     

    All Sites in Hackers:
    1 - 2 - 3 - 4 - 5 - 6 - 7 - 8 - 9 - 10 - 11 - 12 - 13 - 14 - 15 - 16 - 17 - 18 - 19 - 20 - 21 - 22