Groovedown – Grooveshark.com Downloader.
Groovedown – Grooveshark.com mp3 Downloader
Reply
Category Archives: Hacks
Nintendo DS hacking
This is done with an R4 chip:
buy one: http://www.ts-shops.eu/nintendo-dsi-xl/flash-cards
There’s a difference between the r4 and r4i
You then put a kernel on the chip:
http://www.r4i-sdhc.com/downloade.asp
Instructions for formatting your r4 card
http://www.r4dscards.com/R4i-DS-Card/
Download games to put on:
http://www.dgemu.com/
LulzSec cleartext accounts and passwords
On June 16, 2011, LulzSec released over 62,000 accounts containing emails and passwords in cleartext obtained from random sources. LulzSec announced the release in a Twitter post at https://twitter.com/#!/LulzSec/status/81327464156119040. The table below is the list of these accounts. Passwords have been partially masked to protect the users from further attacks.
European Council: Creating hacking tools should be criminal across EU. Idiots.
“The following new elements [should include] penalisation of the production and making available of tools eg, malicious software designed to create ‘botnets’ or unrightfully obtained computer passwords for committing the offences [of attacks against computer systems],” the Council of Ministers said in a statement pages 18-19 of 38-page/176KB PDF.
The real problem with this, is that it also makes penetration testing tools illegal. Which means we won’t be able to know if code others write in closed source is secure at all.
via European Council: Creating hacking tools should be criminal across EU • The Register.
Most Common Lockscreen PINs – 15% of all only 10 codes
1234, 0000, 2580, 1111, 5555, 5683 (spells LOVE), 0852, 2222, 1212, 1998
via These Are the Most Common Lockscreen PINs – Lifehacker.
Group Policy Settings Reference for Windows and Windows Server
gpedit.msc isn’t available for windows home versions. Because it’s basically just a frontend for the registry, you can download an excel spreadsheet with the gpedit settings next to the correct registry entry from Microsoft.
Download details: Group Policy Settings Reference for Windows and Windows Server.
Snorby – Snort frontend
This looks like an easy to install, comprehesive and easy to use frontend for your snort logs based on Ruby on Rails.
Snorby – All About Simplicity.
Goelocation to within 690 metres using new timing techniques
75 year old kills internet to Georgia and Armenia accidentally
The pensioner was digging for scrap metal when she hacked into a fibre-optic cable which runs through Georgia to Armenia, forcing many thousands of Internet users in both countries offline for several hours on March 28.
via 75 year old killed Georgia, Armenia internet – Times LIVE.
RSA breach leaks data for hacking SecurID tokens
Attackers breached the servers of RSA and stole information that could be used to compromise the security of two-factor authentication tokens used by 40 million employees to access sensitive corporate and government networks
via RSA breach leaks data for hacking SecurID tokens • The Register.
Safari/MacBook First To Fall At Pwn2Own 2011
Again… hahahaha – 5 seconds is all it took 🙂
Safari/MacBook First To Fall At Pwn2Own 2011 – Slashdot.
Cracking the Scratch Lottery Code
Using statistical analysis of the amount of times that numbers only appear once on a scratch lottery card, Mohan Srivastava can easily double his chances on the cards and has done way way better than that. The companies aren’t taking him very seriously, so here’s a hole which is still way open.
Cracking the Scratch Lottery Code | Magazine.
OV chipkaart hacked, software available
This forum has links to the sites which explain the hack and to the software itself, for as long as it’s up.
The hack comes down to filling up your anonymous chipcard once, then making a copy and restoring the copy every now and again. This is undetectable, especially during the week. Weekends are apparently trickier.
OV chipkaart software / hack downloaden – OV-chip is gekraakt – ovsaldo.exe.
Step by step instructions with link here
[edit 15/2/11]Kipje has gone and made OV Station, which allows you to check in and out on the card itself, making it totally undetectable. The sites are down, but you can still find the this proggie which is a GUI to only hack the important data, so it works in around 15 seconds. Unfortunately it looks like they’re detecting this hack and the NS (train services) are blocking hacked cards. Busses and trams still work.[/edit]
And here’s some guy who’s shared his practical experience with the Linux variant of the crack.
There’s another crack, where you prewrite the details of your trip at home, so when your card is checked you’re on a valid trip. You don’t have to use the check in/out points though, making the tampering completely invisible. Unfortunately the software for that is not available… yet…
Finally there’s a more involved method, where you skim the card data from nearby cards (hey, it’s NFC!) and then copy that to your own card.
Tunisia was busy stealing the whole country’s passwords over Christmas
It turns out that every Tunisian ISP was keylogging all login attempts to facebook and other sites from Christmas.
EU Emissions Trading System down after hack siphons off $38 million from Czech traders
The European Commission (EC) suspended trading in carbon credits on Wednseday after unknown hackers compromised the accounts of Czech traders and siphoned off around $38 million, according to published reports.
EU countries including Estonia, Austria, The Czech Republic, Poland and France began closing their carbon trading registries yesterday after learning that carbon allowances had been siphoned from the account of the Czech based register. A notice posted on the Web site of the Czech based registry said that it was “not accessible for technical reasons” on Thursday.
The EC followed suit: issuing a statement on Wednesday evening saying that the EC was suspending transactions for all EU Emissions Trading System (ETS) members until January 26 in light of “recurring security breaches in national registries over the last two months.”
via Carbon Trading Halted After Hack Of Exchange | threatpost.
ZAP Cane With Flashlight
This ZAP Stun Cane features an adjustable walking cane, an ultra-bright LED flashlight and a stun gun with an unheard of 1-million volt charge that will knock down any attacker. The cane has a weight capacity of 250 lbs and is adjustable from 32″ to 36″. They’ll think it is just a cane until it is too late! It is even rechargeable and includes a wall charger and carrying case.
Only $89,99
via ZAP Cane With Flashlight – BUDK.
DIY Decrypting GSM phone calls
Using GnuRadio you record the data from the air, Airporbe parses the data, Kraken cracks the A5/1 key and Airprobe decodes voice.
GSM is broken. Fortunately, UMTS isn’t.
Decrypting GSM phone calls | srl.
D0z.me — the Evil URL Shortener
Posing as a legitimate URL shortening service, it serves users the requested pages in an iFrame, while simultaneously participating in a DDoS attack in the background. No interaction is required beyond clicking the link and staying on the page. This makes it relatively trivial to quickly mount large-scale DDoS attacks, and affords willing participants plausible deniability in the assault
via D0z.me — the Evil URL Shortener – Slashdot.
The Top 50 Gawker Media Passwords
On Sunday night, hackers posted online a trove of data from Gawker Media’s servers, including the usernames, email addresses and passwords of more than one million registered users. The passwords were originally encrypted, but 188,279 of them were decoded and made public as part of the hack. Using that dataset, we found the 50 most-popular Gawker Media passwords
123456, password, 12345678, qwerty all to be expected, but monkey – really??!
via The Top 50 Gawker Media Passwords – Digits – WSJ.
Gov’t crackdown spurs initiatives to route around DNS
With the US Government suddenly having become a muscle-flexing player in the DNS root servers, many don’t trust DNS any more and are developing and using alternatives. This is a roundup of several possible contenders.
Gov’t crackdown spurs initiatives to route around DNS | ITworld.
How Google and MS load so quickly: they cheat on slow start
Basically they’re violating RFC-3390.
You’re supposed to check the speed the receiver can handle before sending another packet, and then up your speed if it’s good, or stabilise if it isn’t. What they do is instead of waiting for the return packet confirming or denying the uprate in speed is good (initial window / IW), they pump multiple packets into the reciever straight up.
Google pumps around 8 or 9, Microsoft pumps in around 43(!). They’re not the only ones doing this: Amazon, Facebook, Cisco, they all do this!
Ben Strong’s Blog: Google and Microsoft Cheat on Slow-Start. Should You?.
Rootkit on a NIC
Windows 7 Phone Jailbroken
Windows Phone 7 unlocker released
Today we have an exciting breakthrough for the Windows Phone 7 homebrew community – the ability for anyone to unlock a WP7 device without a Marketplace developer account.
Unlocking allows the sideloading of experimental applications that would otherwise can’t be published to the Marketplace, such as those which access private or native APIs.
We’ve taken the pain out of the process involved and put together a super simple executable that will allow anyone to unlock any WP7 device on the market using a USB cable and just a couple clicks.This tool is completely safe and reversible for the phone. The app even allows you to relock the phone.
via ChevronWP7.
Howto: hack the OV-chipkaart
Lees dit aandachtig door!
IK LEG NIET UIT HOE JE GRATIS REIST OF HOE JE EEN KAART MANIPULEERT, IK LEG ALLEEN UIT HOE JE DE SLEUTELS VAN DE MIFARE CLASSIC 1K EN 4K BEVEILIGING VERKRIJGT EN DE INHOUD VAN DE KAART NAAR EEN BESTAND OPSLAAT!!!
Alles geschreven een weergegeven op deze website is uitsluitend bedoeld om van te leren, ga niet reizen met een gemanipuleerde of gekopieerde ov-chipkaart, de kaart word geblokkeerd, of nog erger, je word gepakt…. het is legaal om je kaart te analyseren, het is illegaal om je kaart te kopiëren of te manipuleren.
IK BEN NIET VERANTWOORDELIJK VOOR DE GEVOLGEN VAN DEZE INSTRUCTIE EN/OF WEBSITE!
Genoeg rode tekst, laten we beginnen
Hardware en software
Hardware
Het begint allemaal met een RFID lezer, ondersteunt in libnfc (zie hun compatibiliteits matrix), Ik gebruik zelf de ACS ACR122U, deze lezer werkt goed samen met libnfc, je kunt ook een “Touchatag” lezer gerbuiken, beide kunnen lezen van en schrijven naar MIFARE kaarten en kosten rond de € 30.
ACR122U NFC reader
Deze instructie is gebaseerd op de ACR 122U, heb je een andere libnfc ondersteunde lezer, wees creatief.
Is je lezer niet ondersteunt in libnfc?, Sorry, de later gebruikte software is allemaal gebaseerd op libnfc…..
Drivers
Ten tweede hebben we l33t klik en ga Windows skiddie software Linux nodig.
Ik heb Ubuntu 10.10 gebruikt voor dit project, het werkt goed, als je de basis van Linux niet kent, draai dan nu om!
De driver installatie van de ACR122U is erg makkelijk, met apt-get install pcscd heb je de basis, libnfc doet de rest voor je.
Libnfc
Nu is het tijd om libnfc te installeren (ik heb versie 1.3.9 gebruikt), download de broncode hier.
Om libnfc te installeren voer de volgende commando’s uit (ik hoop dat je al weet hoe je programma’s van broncode compileert in Linux):
1. tar xvzf libnfc-1.3.9.tar.gz
2. cd libnfc-1.3.9
3. ./configure (als je foutmeldingen tegenkomt (meestal ontbrekende pakketten) los deze dan op)
4. make
5. make install
6. sluit de lezer aan
7. wacht op een rood licht (als het lampje uit blijft gaat er iets mis)
8. leg een kaart op de lezer (licht zal nu groen worden, als het goed is)
9. voer nfc-list uit
10. Als je de identificatiecode van de kaart ziet gaat het goed, dat ziet er ongeveer zo uit:
Valid nfc-list output
MFOC
Nu we libnfc en de lezer aan de gang hebben, hebben we een programma nodig om de sleutels te ontfutselen, voor deze complexe taak gebruiken we een programma genaamd MFOC. MFOC is een opensource programma om sleutels uit MIFARE classic kaarten te ontfutselen, het is niet erg stabiel, maar met veel tijd en moeite (ongeveer een uur) kun je alle 80 A en B sleutels vinden.
Download de MFOC broncode hier.
Om MFOC te installeren, voer de volgende commando’s uit:
1. tar xvzf mfoc-0.09.tar.gz
2. cd mfoc-0.09
3. ./configure (als je foutmeldingen tegenkomt (meestal ontbrekende pakketten) los deze dan op)
4. make
5. make install
Nu heb je alle tools om aan de slag te gaan, gebruik deze tools op een wijze manier!
Het echte werk
Het is belangrijk om iedere gevonden sleutel om te slaan in een bestandje, MFOC slaat de sleutels niet voor je op!
MFOC kan aangeroepen worden met diverse parameters, het is aanbevolen om het aantal pogingen te verhogen (-P option) en de afstand te verlagen (-T option), de afstand verlagen zorgt voor aanzienlijk minden crashes.
Start MFOC met het volgende commando:
mfoc -O mifarecard.dump -P 150 -T 4
MFOC begint met het testen van standaard sleutels, en zal daarna sector-voor-sector alle sleutels zoeken. Aan het eind worden de gegevens van de kaart opgeslagen in het bestand aangegeven met de -O optie.
[Gevorderde]Om de prestaties van MFOC significant te verbeteren raden we je aan om de gevonden sleutels mee te compileren met het programma. Dit zorgt ervoor dat MFOC na een crash begint op de plek waar je gebleven was, in plaats van opnieuw te beginnen met het testen van sleutels. Bijvoorbeeld: je hebt 20 van de 40 sleutels gevonden, MFOC crasht, sla de 20 gevonden sleutels op in het mfoc.c bestand, hercompileer het programma en start MFOC, nu zal MFCO beginnen bij sleutel nr. 21 in plaats van sleutel nr. 1.[/Gevorderde]
Dit proces ziet er ongeveer zo uit (in jouw scherm zie je misschien 1 [X……..], dit is een aangepaste versie van MFOC met wat sleutels erin gebakken):
MFOC trying default keys
Na deze initiële start zal MFOC verder naar sleutels graven, dit ziet er als volgt uit:
MFOC retrieving keys
Nu heb je alle sleutels ontfutseld van een miljarden triljoenen project met 30 euro aan apparatuur, dat noemen ze beveiliging…..
Nu kun je de dump gaan analyseren met een hex editor…. het makkelijkste om te vinden is je geboortedatum, zoek maar is naar jj jj mm dd (in hex uiteraard).
via Doe het zelf | OV-chipkaart.
