Security • Exploits • News

Feeds

1626 items (1418 unread) in 4 feeds

• Darknet (32 unread)
• milw0rm (359 unread)
• Hack a Day (383 unread)
• Security Focus (644 unread)

Unread items (100)

• July 24, 2008
• 1:36

  Bugtraq: [ MDVSA-2008:153 ] - Updated emacs packages fix vulnerability

   » ‎ Security Focus
  [ MDVSA-2008:153 ] - Updated emacs packages fix vulnerability
• 0:00

  Bugtraq: [SECURITY] [DSA 1615-1] New xulrunner packages fix several vulnerabilities

   » ‎ Security Focus
  [SECURITY] [DSA 1615-1] New xulrunner packages fix several vulnerabilities
• 0:00

  Bugtraq: [SECURITY] [DSA 1614-1] New iceweasel packages fix several vulnerabilities

   » ‎ Security Focus
  [SECURITY] [DSA 1614-1] New iceweasel packages fix several vulnerabilities
• 0:00

  Bugtraq: Re: Wordpress Malicious File Execution Vulnerability

   » ‎ Security Focus
  Re: Wordpress Malicious File Execution Vulnerability
• 0:00

  Bugtraq: [USN-628-1] PHP vulnerabilities

   » ‎ Security Focus
  [USN-628-1] PHP vulnerabilities

• July 23, 2008
• 21:00

  DNS exploit in the wild

   » ‎ Hack a Day

  Filed under: news, security hacks

  
  We've been tracking Metasploit commits since Matasano's premature publication of [Dan Kaminsky]'s DNS cache poisoning flaw on Monday knowing full well that a functional exploit would be coming soon. Only two hours ago [HD Moore] and [I)ruid] added a module to the Metasploit Project that will let anyone test the vulnerability (with comment: "ZOMG. What is this? >:-)"). [HD] told Threat Level that it doesn't work yet for domains that are already cached by the DNS server, but it will automatically wait for the cached entry to expire and then complete the attack. You can read more about the bailiwicked_host.rb module in CAU's advisory. For a more detailed description of how the attack works, see this mirror of Matason's post.
  
  [photo: mattdork]Read | Permalink | Email this | Linking Blogs | Comments
  
• 16:15

  Simple tracking in 3D space

   » ‎ Hack a Day

  Filed under: misc hacks, peripherals hacks

  
  [kylemcdonald] has posted this how to build a simple 3D tracking interface. Using 6 resisters, some wire, aluminum foil, an Arduino, and a cardboard box, he was able to do 3D capacitive sensing. Coupling that with Processing, he was able to overlay an interface using augmented reality. The video above shows a 3D tic tac toe application. While it seems less than perfect, its pretty amazing for how simple it is.
  
  Seen anything similar to this out there? What applications would be fun with this?Read | Permalink | Email this | Linking Blogs | Comments
  
• 15:45

  Shih Chieh Huang's recycled bots

   » ‎ Hack a Day

  Filed under: robots hacks, news

  
  We're really sorry to have missed GLOW. It was a unique all-night art and music event that took place the evening of July 19, 2008, in Santa Monica, and lasted until dawn. We were most intrigued by [Shih Chieh Huang]'s haunting robotic sculptures. They were eerily beautiful, and appeared to be alive and "breathing". He took some unusual materials - plastic bags and bottles, computer fans and circuit boards, among others, and combined them all to give the creatures otherworldly auras. Simultaneously familiar and strange, the sculptures are designed to evoke marine life, yet they're completely different, in both materials and structure. More coverage and pictures of the event can be found at LAist, NOTCOT, and on Flickr.Read | Permalink | Email this | Linking Blogs | Comments
  

• 12:42

  San Fransisco Mayor Regains Control of the Network

   » ‎ Darknet
  In the story we recently covered where Terry Childs had locked San Fransisco officials out of their own network, there is a new development. He’s handed over the passcode to the Mayor, Gavin Newsom. It seems he came to his senses and he also seems to have VERY little faith in the IT administration for the [...]SHARETHIS.addEntry({ title:...
  
  Read the full post at darknet.org.uk

  

  

• 9:47

  Modding the Oppo 980 for better audio output

   » ‎ Hack a Day

  Filed under: daily, digital audio hacks

  
  There's an interesting thread discussing mods to improve the inexpensive Oppo 980 DVD player for better performance. The power supply, capacitors and opamps can benefit from some higher end components. [Occam] suggests several replacement opamps options for upgrading the audio output. The realatively low cost of Oppo gear makes it a better risk than modding a multi-thousand dollar DVD player.Read | Permalink | Email this | Linking Blogs | Comments
  

• 8:00

  Bugtraq: RE: Windows Vista Power Management & Local Security Policy

   » ‎ Security Focus
  RE: Windows Vista Power Management & Local Security Policy
• 8:00

  Bugtraq: Outpost Security Suite Pro ver. 2009 Multiple vulnerabilities

   » ‎ Security Focus
  Outpost Security Suite Pro ver. 2009 Multiple vulnerabilities
• 8:00

  Bugtraq: [USN-627-1] Dnsmasq vulnerability

   » ‎ Security Focus
  [USN-627-1] Dnsmasq vulnerability
• 8:00

  Bugtraq: PR08-16: CSRF (Cross-site Request Forgery) on Moodle edit profile page

   » ‎ Security Focus
  PR08-16: CSRF (Cross-site Request Forgery) on Moodle edit profile page

• 2:00

  IntelliTamper 2.0.7 (html parser) Remote Buffer Overflow Exploit (c)

   » ‎ milw0rm
  IntelliTamper 2.0.7 (html parser) Remote Buffer Overflow Exploit (c)
• 2:00

  minix 3.1.2a tty panic Local Denial of Service Vulnerability

   » ‎ milw0rm
  minix 3.1.2a tty panic Local Denial of Service Vulnerability

• 0:00

  Vuln: Arctic Issue Tracker 'filter' Parameter SQL Injection Vulnerability

   » ‎ Security Focus
  Arctic Issue Tracker 'filter' Parameter SQL Injection Vulnerability
• 0:00

  Vuln: Asterisk IAX 'POKE' Requests Remote Denial of Service Vulnerability

   » ‎ Security Focus
  Asterisk IAX 'POKE' Requests Remote Denial of Service Vulnerability
• 0:00

  Vuln: Snort Time To Live Fragment Reassembly Security Bypass Weakness

   » ‎ Security Focus
  Snort Time To Live Fragment Reassembly Security Bypass Weakness
• 0:00

  Vuln: bzip2 Unspecified File Handling Vulnerability

   » ‎ Security Focus
  bzip2 Unspecified File Handling Vulnerability
• 0:00

  Vuln: Claroline Prior to 1.8.11 Multiple Cross-Site Scripting Vulnerabilities

   » ‎ Security Focus
  Claroline Prior to 1.8.11 Multiple Cross-Site Scripting Vulnerabilities
• 0:00

  Vuln: YouTube Blog Multiple Input Validation Vulnerabilities

   » ‎ Security Focus
  YouTube Blog Multiple Input Validation Vulnerabilities
• 0:00

  Vuln: Multiple Century System XR Routers Cross-Site Request Forgery Vulnerability

   » ‎ Security Focus
  Multiple Century System XR Routers Cross-Site Request Forgery Vulnerability
• 0:00

  Vuln: IntelliTamper HTML 'href' Parsing Buffer Overflow Vulnerability

   » ‎ Security Focus
  IntelliTamper HTML 'href' Parsing Buffer Overflow Vulnerability
• 0:00

  Vuln: PHP cURL 'safe mode' Security Bypass Vulnerability

   » ‎ Security Focus
  PHP cURL 'safe mode' Security Bypass Vulnerability
• 0:00

  Vuln: PHP 5.2.4 and Prior Versions Multiple Vulnerabilities

   » ‎ Security Focus
  PHP 5.2.4 and Prior Versions Multiple Vulnerabilities
• 0:00

  Vuln: Mozilla Firefox CSSValue Array Data Structure Remote Code Execution Vulnerability

   » ‎ Security Focus
  Mozilla Firefox CSSValue Array Data Structure Remote Code Execution Vulnerability
• 0:00

  Vuln: Mozilla Firefox URI Splitting Security Bypass Vulnerability

   » ‎ Security Focus
  Mozilla Firefox URI Splitting Security Bypass Vulnerability

• July 22, 2008
• 23:00

  Hacking At Random 2009

   » ‎ Hack a Day

  Filed under: cons, news

  
  Hacking At Random 2009 has recently been announced. It's brought to you by the same people who held the outdoor hacking event What The Hack, which we covered in 2005. Date, location, and many other details are still up in the air. They're looking to host 3000 attendees and we're guessing it will be similar in nature to last Fall's incredible Chaos Communication Camp near Berlin. 2009 will also feature the beta run of outdoor hacker event ToorCamp near Seattle. Two great events we're certainly looking forward to.
  
  [photo: mark]Read | Permalink | Email this | Linking Blogs | Comments
  
• 21:00

  Name that Ware

   » ‎ Hack a Day

  Filed under: contests, misc hacks

  
  Last month we mentioned [bunnie]'s Name that Ware competition where participants try to guess the functionality of a random bit of hardware. We thought you might want to see another example; pictured above is the June 2008 ware provided by [xobs]. You can see a high res version here and an image of the daughter card as well. Be forewarned that someone has already posted the solution in the comments. At first glance there are quite a few interesting bits: board is copyright 1991, the 8-bit ISA connector doesn't have any data lines connected, just power, and it's got a lot of analog circuitry. Take a guess and then check out the comments on [bunnie]'s site to see the solution.Read | Permalink | Email this | Linking Blogs | Comments
  
• 18:30

  Home made PCB drill press

   » ‎ Hack a Day

  Filed under: misc hacks, tool-hacks

  
  [yellowduck] took some fantastic initiative with this home made PCB drill press. Many people have a rotary tool already. Just add some scrap wood and four hinges. The drill press isn't perfect; it pivots a little as it lowers. This shouldn't be a problem for drilling printed circuit boards though. The PCB should be thin enough for the pivot to have little effect. After some test runs, he added a lamp for better lighting and intends to add a return spring and foot switch. It's definitely a better solution than drilling multiple holes with a hand drill.Read | Permalink | Email this | Linking Blogs | Comments
  
• 18:00

  Annoy your friends with high pitched noise

   » ‎ Hack a Day

  Filed under: misc hacks, news

  
  [Hungry_Myst] has put together this fantastic device to annoy your friends. It randomly emits high pitched sounds, then stops for a while to make it very hard to locate. She has added an extra level of annoyance by putting the noise in vicinity of 17KHz thus making it almost undetectable by people over the age of 30. The fact that not everyone in the room can hear it makes people go even crazier trying to find it.
  
  The parts list is fairly short, and the directions concise. One thing that is fantastic about this article is that she encourages people to improve it. That alone is not a huge deal, but she mentions in several areas specific additions that would make it more user friendly: on/off, pitch control, and delay control.
  
  Related: [jay]'s Picaxe based Brain AssailantRead | Permalink | Email this | Linking Blogs | Comments
  

• 11:14

  TSGrinder - Brute Force Terminal Services Server

   » ‎ Darknet
  This is a tool that has been around quite some time too, it’s still very useful though and it’s a very niche tool specifically for brute forcing Windows Terminal Server. TSGrinder is the first production Terminal Server brute force tool, and is now in release 2. The main idea here is that the Administrator account, since...
  
  Read the full post at darknet.org.uk

  

  

• 9:46

  1-wire barometer

   » ‎ Hack a Day

  Filed under: misc hacks, daily

  
  [David] put together this rather nice 1-wire barometer. An MPX4115 measures the pressure while an SMD DS2438 mounted to an 8 pin DIP socket provides the 1-wire interface. The writeup includes a nice description of the board layout and wiring, making this project accessible to just about anyone with a decent tip on their soldering iron.Read | Permalink | Email this | Linking Blogs | Comments
  

• 2:00

  YouTube Blog 0.1 (RFI/SQL/XSS) Multiple Remote Vulnerabilities

   » ‎ milw0rm
  YouTube Blog 0.1 (RFI/SQL/XSS) Multiple Remote Vulnerabilities
• 2:00

  IntelliTamper 2.0.7 (html parser) Remote Buffer Overflow Exploit

   » ‎ milw0rm
  IntelliTamper 2.0.7 (html parser) Remote Buffer Overflow Exploit
• 2:00

  Pre Survey Poll (default.asp catid) SQL Injection Vulnerability

   » ‎ milw0rm
  Pre Survey Poll (default.asp catid) SQL Injection Vulnerability
• 2:00

  IntelliTamper 2.07 (server header) Remote Code Execution Exploit

   » ‎ milw0rm
  IntelliTamper 2.07 (server header) Remote Code Execution Exploit

• 0:00

  Bugtraq: [ GLSA 200807-10 ] Bacula: Information disclosure

   » ‎ Security Focus
  [ GLSA 200807-10 ] Bacula: Information disclosure
• 0:00

  Bugtraq: E-Mail header Injection in HiFriend

   » ‎ Security Focus
  E-Mail header Injection in HiFriend
• 0:00

  Bugtraq: [SECURITY] [DSA 1612-1] New ruby1.8 packages fix several vulnerabilities

   » ‎ Security Focus
  [SECURITY] [DSA 1612-1] New ruby1.8 packages fix several vulnerabilities
• 0:00

  Bugtraq: [ GLSA 200807-11 ] PeerCast: Buffer overflow

   » ‎ Security Focus
  [ GLSA 200807-11 ] PeerCast: Buffer overflow
• 0:00

  Vuln: Vim Vim Script Multiple Command Execution Vulnerabilities

   » ‎ Security Focus
  Vim Vim Script Multiple Command Execution Vulnerabilities
• 0:00

  Vuln: PHP 5.2.3 and Prior Versions Multiple Vulnerabilities

   » ‎ Security Focus
  PHP 5.2.3 and Prior Versions Multiple Vulnerabilities
• 0:00

  Vuln: GD Graphics Library Multiple Vulnerabilities

   » ‎ Security Focus
  GD Graphics Library Multiple Vulnerabilities
• 0:00

  Vuln: Libpng Library Remote Denial of Service Vulnerability

   » ‎ Security Focus
  Libpng Library Remote Denial of Service Vulnerability
• 0:00

  Vuln: SocialEngine Multiple SQL Injection Vulnerabilities

   » ‎ Security Focus
  SocialEngine Multiple SQL Injection Vulnerabilities
• 0:00

  Vuln: PowerDVD '.m3u' and '.pls' File Multiple Buffer Overflow Vulnerabilities

   » ‎ Security Focus
  PowerDVD '.m3u' and '.pls' File Multiple Buffer Overflow Vulnerabilities
• 0:00

  Vuln: Asterisk IAX 'POKE' Requests Remote Denial of Service Vulnerability

   » ‎ Security Focus
  Asterisk IAX 'POKE' Requests Remote Denial of Service Vulnerability

• July 21, 2008
• 20:50

  ReWalk suit for paraplegics

   » ‎ Hack a Day

  Filed under: news

  
  We here at Hack a Day are really interested in power suits, so the ReWalk suit for paraplegics immediately caught our attention. By using unique robotic control algorithms, the suit works with the user rather than for the user. This allows the user to experience the sensation of walking autonomously and a chance at a normal life. Argo, the design company, also claims that a suit like this will end up saving the user money considering the high price of medical and transportation equipment. The core design is not entirely new. It has a batterypack and DC motors placed at the joints. The wearer uses crutches and the sensors and software monitor upper body movement to predict when and where the user wants to move their leg.
  
  [via Medgadget]Read | Permalink | Email this | Linking Blogs | Comments
  
• 20:00

  Hackit: Designing a web tablet for $200

   » ‎ Hack a Day

  Filed under: HackIt

  
  TechCrunch is asking its readers to help them design a web tablet costing just under $200. They claim that there does not yet exist a cheap and usable web tablet designed for things like browsing, web conferencing, mail, chat, and VoIP. Here are some of the specs they are asking for:
  

  • thin as possible
  • touch screen (except for power button)
  • WiFi
  • video camera and low-end speakers
  • 4 Gigabyte hard drive
  • 1/2 Gigabyte of RAM
  • Linux and Firefox (in kiosk mode)
  • no desktop interface

  We are not completely sure that this device does not exist in some form. Tablets have been around for a while and many cover most of these features. Consider the Nokia N800 or the Pepper Pad.
  
  We also think the TechCrunch readers, who generally concern themselves with what they can buy rather than what they can make, are not really the best crowd for this job. Considering our reader's abilities to do things on the cheap, we thought we would pose the question ourselves with our own spin. What old and cheap hardware could you re-purpose to create this product?Read | Permalink | Email this | Linking Blogs | Comments
  
• 16:30

  NES crammed into a light gun

   » ‎ Hack a Day

  Filed under: handhelds hacks, home entertainment hacks

  
  [GonzoMPM-1] Has gutted an NES knock off called Super Joy III and crammed it inside of a light gun. Inspired by a daughter that loves duck hunt, he wanted to consolidate the package and make it more portable. He's managed to pull off some nice finish, it look almost professional in the picture above. The unit is powered by 3 AAA batteries in the handle. The game system works just fine, and he claims that the controls are actually more responsive now. The light gun works as well if you have a CRT television around.
  
  You many notice that there is no cartridge slot. There really isn't a need for one in this mod. The Super Joy III comes equipped with 76 games on the board. He notes that he can make an external cart at some point, but may leave it off in favor of the compact design.
  
  While he acknowledges that this is not a completely self contained gaming device, we feel it earns honorable mention for being cool.
  
  [via technabob]Read | Permalink | Email this | Linking Blogs | Comments
  
• 15:10

  Fun with Radiohead's data from 'House of Cards'

   » ‎ Hack a Day

  Filed under: laser hacks, misc hacks

  
  Radiohead recently released the 3D data that was used to create the video for their song 'House of Cards'. You can see the original video and grab the data from here. [Micheal_z] sent in some of the results of his groups playtime with the data. The first effort involved some data translation. Then they created an atomizer of the head and put it up on their ungodly huge 8160x4000 pixel multi-touch display. The video above was created by tracking the background image to orient and overlay the projection.Read | Permalink | Email this | Linking Blogs | Comments
  

• 10:57

  San Fransisco Officials Locked Out of Their Own Network

   » ‎ Darknet
  Another disgruntled IT worked causing mayhem, remember the guy that destroyed all the medical records? He got a pretty hefty sentence, now we have another who has locked everyone out of the new ’state of the art’ computer network in San Fransisco - he’s on a $5 million dollar bail so I’d say he’s in big...
  
  Read the full post at darknet.org.uk

  

  

• 10:52

  PIC based boiler controller

   » ‎ Hack a Day

  Filed under: misc hacks, home hacks, daily

  
  We're used to central A/C, so we were surprised by this PIC controller based heater controller. It's based around a pump controlled boiler/radiator system. A PIC 16F84 is used to input the set point and control a pump to circulate the heated water as needed. You can grab full schematics on the project page.Read | Permalink | Email this | Linking Blogs | Comments
  

• 2:00

  Arctic Issue Tracker 2.0.0 (index.php filter) SQL Injection Exploit

   » ‎ milw0rm
  Arctic Issue Tracker 2.0.0 (index.php filter) SQL Injection Exploit
• 2:00

  EZWebAlbum (dlfilename) Remote File Disclosure Vulnerability

   » ‎ milw0rm
  EZWebAlbum (dlfilename) Remote File Disclosure Vulnerability
• 2:00

  MojoAuto (mojoAuto.cgi mojo) Blind SQL Injection Exploit

   » ‎ milw0rm
  MojoAuto (mojoAuto.cgi mojo) Blind SQL Injection Exploit
• 2:00

  MojoJobs (mojoJobs.cgi mojo) Blind SQL Injection Exploit

   » ‎ milw0rm
  MojoJobs (mojoJobs.cgi mojo) Blind SQL Injection Exploit
• 2:00

  MojoPersonals (mojoClassified.cgi mojo) Blind SQL Injection Exploit

   » ‎ milw0rm
  MojoPersonals (mojoClassified.cgi mojo) Blind SQL Injection Exploit
• 2:00

  MojoClassifieds 2.0 Remote Blind SQL Injection Exploit

   » ‎ milw0rm
  MojoClassifieds 2.0 Remote Blind SQL Injection Exploit
• 2:00

  Interact E-Learning System 2.4.1 (help.php) LFI Vulnerabilities

   » ‎ milw0rm
  Interact E-Learning System 2.4.1 (help.php) LFI Vulnerabilities
• 2:00

  IntelliTamper 2.07 (map file) Local Arbitrary Code Execution Exploit (pl)

   » ‎ milw0rm
  IntelliTamper 2.07 (map file) Local Arbitrary Code Execution Exploit (pl)
• 2:00

  HRS Multi (picture_pic_bv.asp key) Blind SQL Injection Exploit

   » ‎ milw0rm
  HRS Multi (picture_pic_bv.asp key) Blind SQL Injection Exploit
• 2:00

  DigiLeave 1.2 (info_book.asp book_id) Blind SQL Injection Exploit

   » ‎ milw0rm
  DigiLeave 1.2 (info_book.asp book_id) Blind SQL Injection Exploit
• 2:00

  EZWebAlbum Insecure Cookie Handling Vulnerability

   » ‎ milw0rm
  EZWebAlbum Insecure Cookie Handling Vulnerability
• 2:00

  ShopCartDx 4.30 (pid) Remote SQL Injection Vulnerability

   » ‎ milw0rm
  ShopCartDx 4.30 (pid) Remote SQL Injection Vulnerability

• 0:00

  The Next HOPE announced

   » ‎ Hack a Day

  Filed under: cons, news

  
  Against all previous indications-including being called The Last HOPE-the conference will not only be returning in 2010, it will be at the Hotel Pennsylvania. We're looking forward to The Next HOPE, which will probably followed by The Last HYPE, which in turn will be followed by: We're Super Serious This Is The Last HOPE.Read | Permalink | Email this | Linking Blogs | Comments
  

• 0:00

  Vuln: Deterministic Network Enhancer 'dne2000.sys' Local Privilege Escalation Vulnerability

   » ‎ Security Focus
  Deterministic Network Enhancer 'dne2000.sys' Local Privilege Escalation Vulnerability
• 0:00

  Vuln: SmbClientParser Perl Module Remote Command Execution Vulnerability

   » ‎ Security Focus
  SmbClientParser Perl Module Remote Command Execution Vulnerability
• 0:00

  Vuln: Def_Blog 'article' Parameter Multiple SQL Injection Vulnerabilities

   » ‎ Security Focus
  Def_Blog 'article' Parameter Multiple SQL Injection Vulnerabilities
• 0:00

  Vuln: CreaCMS Multiple Remote File Include Vulnerabilities

   » ‎ Security Focus
  CreaCMS Multiple Remote File Include Vulnerabilities
• 0:00

  Vuln: Stash Cookie Authentication Bypass Vulnerability

   » ‎ Security Focus
  Stash Cookie Authentication Bypass Vulnerability
• 0:00

  Vuln: Mozilla Firefox URI Splitting Security Bypass Vulnerability

   » ‎ Security Focus
  Mozilla Firefox URI Splitting Security Bypass Vulnerability
• 0:00

  Vuln: Arctic Issue Tracker 'filter' Parameter SQL Injection Vulnerability

   » ‎ Security Focus
  Arctic Issue Tracker 'filter' Parameter SQL Injection Vulnerability
• 0:00

  Vuln: Jobbex JobSite 'search_result.cfm' Multiple SQL Injection and Cross-Site Scripting Vulnerabilities

   » ‎ Security Focus
  Jobbex JobSite 'search_result.cfm' Multiple SQL Injection and Cross-Site Scripting Vulnerabilities

• July 20, 2008
• 9:28

  Simple fish feeder

   » ‎ Hack a Day

  Filed under: home hacks, daily

  
  [BahaTanju] sent in this oh so simple fish feeder. It's a mechanical light timer with a simple dispensing bottle mounted to the rotating time wheel. As the timer rotates, food is dispensed and the aquarium light is activated. If you have bigger fish, you could adapt this to work on a solenoid and use a timer with multiple on/off settings.Read | Permalink | Email this | Linking Blogs | Comments
  

• 2:00

  PHPFootball 1.6 (show.php) Remote SQL Injection Vulnerability

   » ‎ milw0rm
  PHPFootball 1.6 (show.php) Remote SQL Injection Vulnerability

• 1:43

  iPhone Pwnage Tool 2.0 released

   » ‎ Hack a Day

  Filed under: cellphones hacks

  
  Earlier today, the iPhone Dev Team teased that they wouldn't release their latest Pwnage Tool until Sunday. Since this was yet another in a week long bit of teasing, we were somewhat surprised when a few hours later they posted a rather relaxed Thanks for waiting :) post announcing that Pwnage Tool 2.0 is available. Here's a direct link to the tool and a mirror courtesy of [_BigBoss_].
  
  According to TUAW, Pwnage Tool 2.0 will activate, jailbreak, and unlock first generation iPhones running any firmware up to and including version 2.0. Unfortunately, it will not unlock an iPhone 3G (at least, not yet). iPhone 3G owners can still use the tool for activation and jailbreaking (so you can run 3rd party apps not supported by Apple and the new iPhone App Store).
  
  So far, skimming through the 1322 comments on their announcement post, I've not seen any complaints or death threats about the tool bricking iPhones, but one should still proceed with caution. According to one update to the post, some people either get an error 1600 from iTunes or they notice a "failure to prepare x12220000_4_Recovery.ipsw" in the log. They've provided a workaround, however. If this happens to you, simply mkdir ~/Library/iTunes/Device Support or alternately nuke all the files in that already extant folder and re-run Pwnage Tool.Read | Permalink | Email this | Linking Blogs | Comments
  

• 0:00

  Bugtraq: Oracle Database Local Untrusted Library Path Vulnerability

   » ‎ Security Focus
  Oracle Database Local Untrusted Library Path Vulnerability
• 0:00

  Bugtraq: rPSA-2008-0231-1 bind bind-utils

   » ‎ Security Focus
  rPSA-2008-0231-1 bind bind-utils
• 0:00

  Bugtraq: [security bulletin] HPSBUX02351 SSRT080058 rev.2 - HP-UX Running BIND, Remote DNS Cache Poisoning

   » ‎ Security Focus
  [security bulletin] HPSBUX02351 SSRT080058 rev.2 - HP-UX Running BIND, Remote DNS Cache Poisoning
• 0:00

  Bugtraq: RE: Windows Vista Power Management & Local Security Policy

   » ‎ Security Focus
  RE: Windows Vista Power Management & Local Security Policy
• 0:00

  Vuln: SWAT 4 Multiple Denial Of Service Vulnerabilities

   » ‎ Security Focus
  SWAT 4 Multiple Denial Of Service Vulnerabilities
• 0:00

  Vuln: Zoph Multiple SQL Injection Vulnerabilities

   » ‎ Security Focus
  Zoph Multiple SQL Injection Vulnerabilities
• 0:00

  Vuln: MoinMoin 'AdvancedSearch.py' Multiple Cross-Site Scripting Vulnerabilities

   » ‎ Security Focus
  MoinMoin 'AdvancedSearch.py' Multiple Cross-Site Scripting Vulnerabilities

• July 19, 2008
• 22:50

  Creating web applications for the iPhone

   » ‎ Hack a Day

  Filed under: cellphones hacks

  
  [Dominiek ter Heid] wanted to prototype an application for the iPhone that incorporated GPS. He experimented, and came up with a step-by-step tutorial on how to create a web application that would push GPS information to his iPhone through the use of JavaScript and AJAX. This tutorial will save web hackers who want to play with the iPhone 3G a lot of grief. Using Cocoa Touch, and a CSS/JavaScript pack called IUI, he successfully created a web application that looks native to the iPhone and is able to grab GPS information. The application integrates the GoogleMaps API with the GeoNames database. We look forward to seeing the types of creative applications that this prototype will inspire. What sort of web application would you want to create for the iPhone?
  
  [via digg]Read | Permalink | Email this | Linking Blogs | Comments
  
• 19:10

  HOPE 2008: Community Fabrication

   » ‎ Hack a Day

  Filed under: misc hacks, cons

  
  Today at The Last HOPE, [Far McKon] from Philadelphia's Hacktory presented on community fabrication. Over the last few years we've seen a lot of different accessible rapid prototyping machines created. There's the RepRap, a fabrication machine that has achieved self replication; our friends at Metalab have gotten their own version of the machine running too. The Hacktory has recently acquired a Fab@home machine. Fab@home hopes to make manufacturing using multiple materials accessible to home users. Multiple materials means people have constructed objects that vary from embedded circuits to hors d'oeuvres. We can't talk about edible prototyping without bringing up the CandyFab machine, which fuses sugar. The Hacktory has enjoyed their machine so far, but have found the learning curve fairly difficult. While it's great to see the cost of rapid prototyping dropping, we'll be much happier when the ease of use improves.Permalink | Email this | Linking Blogs | Comments
  
• 18:20

  OpenMoko usability review

   » ‎ Hack a Day

  Filed under: cellphones hacks, news

  
  [Dave Fayram] has put out two videos covering the interface of the FreeRunner from OpenMoko. For those unfamiliar, we've covered it a few times before. It is an opensource mobile platform that includes a full X server. They encourage people to make their own software and even release the CAD files for chassis modification.
  
  He points out some glaring faults and compares it to his iPhone. Some of the major faults he has listed and shown are:
  

  • Bezel around screen makes input difficult.
  • Extremely slow interface
  • Can't play mp3s.
  • On screen keyboard is tiny.

  It is marketed at around $400 so the comparison to an iPhone seems legitimate. We do need to keep in mind, however, that the FreeRunner is opensource. The more support we show to them, the better it will get. The thought of an opensource handheld platform, comparable to an iPhone is quite enticing. At this point though, the comparison is pretty one sided. Hopefully more software development and support from the community will make this device something to get very excited about.
  
  [via Daring Fireball]Read | Permalink | Email this | Linking Blogs | Comments
  
• 14:00

  SIM card reader

   » ‎ Hack a Day

  Filed under: cellphones hacks

  
  Adafruit Industries just announced their next kit: a SIM card reader. Using the kit, you can read or write any SIM card. You could use this for fun things like recovering deleted contacts and SMS messages. The kit looks like a very straight forward design (based on [Dejan]'s work); the only chip is a hex inverter and the board is powered by a regulated 9V battery. With all through-hole components, it should be easy to assemble. You can talk to it using the board mounted serial port or connect to the extra pin header using an FTDI USB cable just like the Boarduino. The FTDI option is bus powered, so you won't need the battery. [ladyada] has collected some resources in case you want to learn more about smart cards.Read | Permalink | Email this | Linking Blogs | Comments
  
• 9:46

  USB NES controller plus

   » ‎ Hack a Day

  Filed under: home entertainment hacks, daily

  
  USB NES controllers are old school these days, but [Jay] put together a nice new take on the project. He shoehorned a USB interface adapter, USB hub and a USB memory stick to store his collection of NES roms and emulators right on the controller. He even dug up a black USB cable to keep the original look of the controller. Now he can just plug in and load his game selection directly from the controller.Read | Permalink | Email this | Linking Blogs | Comments
  

• 2:00

  Oracle Internet Directory 10.1.4 Remote Preauth DoS Exploit

   » ‎ milw0rm
  Oracle Internet Directory 10.1.4 Remote Preauth DoS Exploit

• 0:00

  Bugtraq: [DSECRG-08-030] Claroline 1.8.9 Multiple Security Vulnerabilities

   » ‎ Security Focus
  [DSECRG-08-030] Claroline 1.8.9 Multiple Security Vulnerabilities
• 0:00

  Bugtraq: Lateral SQL Injection Revisited - No Special Privs Required

   » ‎ Security Focus
  Lateral SQL Injection Revisited - No Special Privs Required
• 0:00

  Bugtraq: [ISecAuditors Security Advisories] SmbClientParser Perl module allows remote command execution

   » ‎ Security Focus
  [ISecAuditors Security Advisories] SmbClientParser Perl module allows remote command execution
• 0:00

  Bugtraq: Re: Lateral SQL Injection Revisited - No Special Privs Required

   » ‎ Security Focus
  Re: Lateral SQL Injection Revisited - No Special Privs Required
• 0:00

  Vuln: Apache Tomcat Mod_JK.SO Arbitrary Code Execution Vulnerability

   » ‎ Security Focus
  Apache Tomcat Mod_JK.SO Arbitrary Code Execution Vulnerability
• 0:00

  Vuln: Oracle July 2008 Critical Patch Update Multiple Vulnerabilities

   » ‎ Security Focus
  Oracle July 2008 Critical Patch Update Multiple Vulnerabilities
• 0:00

  Vuln: Aprox CMS Engine 'index.php' SQL Injection Vulnerability

   » ‎ Security Focus
  Aprox CMS Engine 'index.php' SQL Injection Vulnerability
• 0:00

  Vuln: MySQL MyISAM Table Privileges Secuity Bypass Vulnerability

   » ‎ Security Focus
  MySQL MyISAM Table Privileges Secuity Bypass Vulnerability