Zero Day posted a list of tools and applications that were released at Defcon 16. The applications run the gamut, from Beholder, an open source wireless IDS tool, to CollabREate, a reverse-engineering plugin that allows multiple people to share a single project. The list covers a lot of ground, and there's a lot for hackers to play around with and explore. It's nice to see someone bothering to maintain a list since the majority of conference tools just get lost in the shuffle and are never seen again.

Pitchfork.tv is showing the documentary Blip Festival: Reformat the Planet for one week only. The Blip Festival is an annual chiptune event in New York City featuring musicians who use video game consoles as part of their production. The documentary has a ton of artist interviews and music from all across the spectrum. Most of the initial featured artists are using the Game Boy LSDJ tracker cartridge. [Nullsleep] has put together a tutorial for the device. You'll see a lot of other old hardware and hear discussions of coveted mods like adding backlights as well. [Mark Denardo] is shown using a PSP as part of his performance. Other people are using software like Fruity Loops to build tracks with Nintendo samples. Honestly, our favorite part was a clip of the loud objects doing a live soldering circuit bending performance on top of an overhead projector at the Bent Festival. Although not musical, Element Labs' Versa TILE makes a fairly mesmerizing backdrop throughout the film too. You can find links to all the featured artists on last year's festival page.

Blip Festival 2008 happens December 4-6 in Brooklyn, NY.

[via Waxy]

[photo: ziggy fresh]

It looks like it's time to update our event list. Here are some hacking related events happening through the rest of the year.

• ToorCon September 26-28 San Diego, CA - In its tenth year, ToorCon has always been one of our favorites. The conference is fairly small, but features great content like last year's fuzzing talk.
• Arse Elektronika (NSFW) September 25-28 San Francisco, CA - Happening the same time as ToorCon, this conference covers the sexual side of human and machine interaction. The device list has gems like The Seismic Dildo, which only turns on if there is seismic activity in the world.
• Maker Faire October 18-19 Austin, TX - It's Maker Faire! In Texas!
• Roboexotica December 4-7 Vienna, Austria - The premier festival for cocktail robotics is also back for the tenth time. They're always looking for more exhibitors. Check out our Hackit for ideas.
• 25C3 December 27-30 Berlin, Germany I think we pretty much covered all the bases on this incredible conference yesterday.

Did we miss anything?

Germany's Chaos Computer Club has announced the theme for their annual Chaos Communication Congress: "Nothing to hide". Like last year's "Full steam ahead!", it's open to many interpretations. People striking down privacy laws often say citizens shouldn't mind since they have "Nothing to hide". The phrase is also connected to the inability to hide data, as the CCC demonstrated this year by publishing the German Home Secretary's fingerprint. On a more positive side, "Nothing to hide" is also about the free exchange of information that happens at hacker conventions. The Congress is in its 25th year and promises to be as good as ever. At last year's 24C3, we saw great talks like [Drew Endy]'s biohacking talk and the original MiFare crypto presentation. 25C3 will be held in Berlin December 27th to 30th. The wiki is already up and they've published a call for participation, if you're interested.

While Black Hat and Defcon have both concluded, we're going to post a few more talks that we think deserve attention. [Sherri Sparks] and [Shawn Embleton] from Clear Hat presented Deeper Door, exploiting the NIC chipset. Windows machines use NDIS, the Network Driver Interface Specification, to communicate between the OS and the actual NIC. NDIS is an API that lets programmers talk to network hardware in a general fashion. Most firewalls and intrusion detection systems monitor packets at the NDIS level. The team took a novel approach to bypassing machine security by hooking directly to the network card, below the NDIS level.

The team targeted the Intel 8255x chipset because of its open documentation and availability of compatible cards like the Intel PRO/100B. They found that sending data was very easy: Write a UDP packet to a specific memory address, check to make sure the card is idle, and then tell it to send. The receive side was slightly more difficult, because you have to intercept all inbound traffic and filter out the replies you want from the legitimate packets. Even though they were writing low level chipset specific code, they said it was much easier to implement than writing an NDIS driver. While a certainly a clever way to implement a covert channel, it will only bypass an IDS or firewall on the same host and not one on the network.

[photo: Big Fat Rat]

Wired's Threat Level takes us on a photo tour of the Defcon Network Operations Center, giving a unique behind-the-scenes perspective of one of the largest computer security conventions. The Defcon Network Operations Center is run by a volunteer group named the "Goons". They keep operations running smoothly and securely with both high and low-tech resources, like a Cisco fiber switch and an armed guard, to protect the router and firewall.

Since last month, when the Defcon warballooning event was announced, [Rick Hill] finished building his rig and even got FAA approval for the flight. Just when everything seemed set, the Riviera Hotel management decided not to allow the takeoff from their property. So, naturally, [Rick] and his team rented a moving truck and covertly inflated the balloon inside. They launched it in an abandoned parking lot and drove through the Vegas strip. They were surprised to find that about one third of the 370 wireless networks they scanned were unencrypted.

[photo: JoergHL]

[via /.]

A collaboration of various medical researchers in the academic field has led to proof that pacemakers can be remotely hacked with simple and accessible equipment. [Kevin Fu], an associate professor at the University of Massachusetts at Amherst, led the team. [Kevin] first tried to get documentation from the manufacturers, believing they would support the effort, but they were not interested in helping. They were forced to get access to an old pacemaker and reverse engineer it. They found that the communication protocol used to remotely program the device was unencrypted. They then used a GNU radio system to find access to some of the machine's reprogrammable functions, including accessing patient data and even turning it off.

Although this was only done with one particular pacemaker, it proves the concept and should be taken seriously by the medical companies who produce these devices. If you are interested in the technical aspects, check out the paper the team released in May disclosing the methods.

[Peter Edwards] at Casper Electronics built a modular synth and integrated it with the Barbie karaoke machines we saw at Notacon last April. The complete unit consists of 25 modules which are wired together using banana cables. He's using this homebrew step sequencer to control the bent karaoke machines which then feed into the rest of the synthesizer. If you'd like to bend your own barbie karaoke machine, [Peter] was kind enough to post schematics and instructions for his bends.

[Zack Anderson], [RJ Ryan], and [Alessandro Chiesa] were sued by the Massachusetts Bay Transit Authority for an alleged violation of the Computer Fraud and Abuse Act after copies of their presentation slides were circulated at Defcon 16. The slides give an eye widening glimpse into the massive security holes present in the Boston subway system. There are at least 4 major security flaws in the subway, which allowed them to get free subway rides by finding unlocked, back door routes into the subway, spoofing magnetic and RFID cards, and attacking the MTBA's network. Judge Douglas P. Woodlock has issued a gag order, stopping the trio from giving the presentation at Defcon or disclosing sensitive information for ten days. However, the MIT school newspaper, The Tech, has published a PDF of the slides online. The research culminated in the trio warcarting the MTBA's headquarters and being driven off by police.

The first night of Black Hat briefings concluded with the Pwnie Award Ceremony. The awards reward achievements in security... but mostly failures. Notably, this was the first year anyone accepted an award in person. Hack a Day took home an early victory by producing a MacBook mini-DVI to VGA adapter (pictured above). The ceremony was fairly straight forward after that. Best Server-Side Bug went to the Windows IGMP kernel vulnerability. It was a remote kernel code execution exploit in the default Windows firewall. The Best Client-Side Bug went to Multiple URL protocol handling flaws like this URI exploit. Mass 0wnage went to Wordpress for many many vulnerabilities. Most Innovative Research went to the Cold Boot Attack team. Lamest Vendor Response was won by McAfee for saying XSS can't be used to hack a server. The Most Overhyped Bug went to [Dan Kaminsky] for his DNS vulnerability. Most Epic FAIL was won by the team behind Debian for shipping the OpenSSL bug for two solid years. Lifetime Achievement Award was won by [Tim Newsham]. Finally, the Best Song was by Kaspersky Labs for Packin' The K!, which you can find embedded below.

FasTrak is the electronic toll collection system used by the state of California. Motorists can purchase a toll transponder for ~$26 and link the serial number with a debit account to have their tolls deducted automatically. Today at Black Hat in Las Vegas, security researcher [Nate Lawson] presented not just the privacy problems with FasTrak, but why absolutely no transaction from the tag should be trusted.

[Dan Kaminsky]'s much anticipated talk on his DNS findings finally happened at Black Hat 2008 in Las Vegas today. [Dan] has already uploaded the complete slides from his talk as well as posted a short summary to his site. New information in the slides since our previous coverage includes "Forgot My Password" attacks and new attacks on internal network vulnerabilities as a side of effect of DNS cache poisoning. [Dan]'s talk today was over capacity; our shot of the conference room overflow is shown above.

Defcon will once again be one-upping the sophistication of the conference attendee badges. Wired has just published a preview of this year's badge. The core is a Freescale Flexis MC9S08JM60 processor. The badge has an IR transmitter and receiver on the front plus eight status LEDs. On the back (pictured below), there is a mode select button, CR123A battery, Data Matrix barcode, and an SD card slot. You can add a USB port to the badge and upload code to it using the built in USB bootloader. All the dev tools needed will be included on the conference CD or you can download the IDE in advance. The low barrier to entry should lead to some interesting hacks. In previous years, you needed a special dongle to program the hardware. There is no indication as to what the badge does out of the box. Releasing the badge early is a first for Defcon and the one pictured isn't the attendee color, but we're sure someone will still come up with a clone.

Now comes the fun part: What do you think the best use of this badge will be? Would Defcon be so cavalier as to equip everyone in the conference with a TV-B-Gone? I think our favorite possibility is if someone finds a security hole and manages to write an IR based worm to take over all the badges.

Defcon 14 introduced the first electronic badge which blinked in different patterns. Defcon 15 had a 95 LED scrolling marquee. [Joe Grand] will be posting more specific Defcon 16 badge details to his site after the opening ceremony. Check out more high resolution photos on Wired.

Researchers at NGS Software have come up with a method to embed malicious code into a picture. When viewed, the picture could send the attacker the credentials of the viewer. Social sites like Facebook and Myspace are particularly at risk, but the researchers say that any site which includes log ins and user uploaded pictures could be vulnerable. This even includes some bank sites.

The attack is simply a mashup of a GIF picture and a JAR (Java applet). The malicious JAR is compiled and then combined with information from a GIF. The GIF part fools the browser into opening it as a picture and trusting the content. The reality is, the Java VM recognizes the JAR part and automatically runs it.

The researchers claim that there are multiple ways to deal with this vulnerability. Sun could restrict their Virtual Machine or web applications could continually check and filter these hybrid files, but they say it really needs to be addressed as an issue of browser security. They think that it is not only pictures at risk, but nearly all browser content.
More details on how to create these GIFARs will be presented at this week's Black Hat conference in Las Vegas.