<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	xmlns:georss="http://www.georss.org/georss" >

<channel>
	<title>evilgenius &#187; hacking</title>
	<atom:link href="http://www.evilgenius.de/category/hacking/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.evilgenius.de</link>
	<description>wired? no, weird wireless!</description>
	<lastBuildDate>Sun, 12 Jul 2009 15:50:11 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9.2</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>Chaos BBQ Weekend &#8211; New World Order</title>
		<link>http://www.evilgenius.de/2009/07/12/chaos-bbq-weekend-new-world-order/</link>
		<comments>http://www.evilgenius.de/2009/07/12/chaos-bbq-weekend-new-world-order/#comments</comments>
		<pubDate>Sun, 12 Jul 2009 13:26:35 +0000</pubDate>
		<dc:creator>hosh</dc:creator>
				<category><![CDATA[conference]]></category>
		<category><![CDATA[hacking]]></category>

		<guid isPermaLink="false">http://www.evilgenius.de/?p=119</guid>
		<description><![CDATA[During the upcoming weekend (17.07. &#8211; 19.07.2009) the Chaos BBQ Weekend will take place in Dortmund, Germany, old Europe (N51°31&#8242;39.4&#8243; E7°27&#8242;53.8&#8243;). There will be some Workshops and Lectures and of course there will be a lot of meat (vegi food as well).
In case you need a place for sleeping, don&#8217;t worry there will be room [...]]]></description>
			<content:encoded><![CDATA[<p>During the upcoming weekend (17.07. &#8211; 19.07.2009) the Chaos BBQ Weekend will take place in Dortmund, Germany, old Europe (N51°31&#8242;39.4&#8243; E7°27&#8242;53.8&#8243;). There will be some <a href="http://bbq.ctdo.de/wiki/info/program">Workshops and Lectures</a> and of course there will be a lot of meat (vegi food as well).<br />
In case you need a place for sleeping, don&#8217;t worry there will be room for everyone!</p>
<p>See you next weekend!</p>
]]></content:encoded>
			<wfw:commentRss>http://www.evilgenius.de/2009/07/12/chaos-bbq-weekend-new-world-order/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
	<georss:point>48.7771072 9.1807690</georss:point>	</item>
		<item>
		<title>25C3 &#8211; 25th Chaos Communication Congress, Berlin</title>
		<link>http://www.evilgenius.de/2008/12/25/25c3-25th-chaos-communication-congress-berlin/</link>
		<comments>http://www.evilgenius.de/2008/12/25/25c3-25th-chaos-communication-congress-berlin/#comments</comments>
		<pubDate>Thu, 25 Dec 2008 20:31:59 +0000</pubDate>
		<dc:creator>hosh</dc:creator>
				<category><![CDATA[GSM]]></category>
		<category><![CDATA[conference]]></category>
		<category><![CDATA[hacking]]></category>

		<guid isPermaLink="false">http://www.evilgenius.de/?p=112</guid>
		<description><![CDATA[Hi there, it is getting time for the annual Chaos Communication Congress in Berlin, Germany, Old Europe. This time there are many speeches about mobile device security and GSM networks, check out the &#8220;Fahrplan&#8221;.
I hope to meet some old friends and find some interesting new people. And by the way: Happy Christmas!
]]></description>
			<content:encoded><![CDATA[<p>Hi there, it is getting time for the annual <a href="http://events.ccc.de/congress/2008/">Chaos Communication Congress</a> in Berlin, Germany, Old Europe. This time there are many speeches about mobile device security and GSM networks, check out the <a href="http://events.ccc.de/congress/2008/Fahrplan/events.en.html">&#8220;Fahrplan&#8221;</a>.<br />
I hope to meet some old friends and find some interesting new people. And by the way: <a href="http://www.behance.net/Gallery/Happy-Christmas-from-AKQA/159865">Happy Christmas!</a></p>
]]></content:encoded>
			<wfw:commentRss>http://www.evilgenius.de/2008/12/25/25c3-25th-chaos-communication-congress-berlin/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
	<georss:point>48.7771072 9.1807690</georss:point>	</item>
		<item>
		<title>Crapto1 &#8211; the tool to break the Mifare crypto algorithm</title>
		<link>http://www.evilgenius.de/2008/10/27/crapto1-the-tool-to-break-the-mifare-crypto-algorithm/</link>
		<comments>http://www.evilgenius.de/2008/10/27/crapto1-the-tool-to-break-the-mifare-crypto-algorithm/#comments</comments>
		<pubDate>Mon, 27 Oct 2008 21:02:53 +0000</pubDate>
		<dc:creator>hosh</dc:creator>
				<category><![CDATA[RFID]]></category>
		<category><![CDATA[hacking]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://www.evilgenius.de/?p=110</guid>
		<description><![CDATA[A few month ago a paper was released which described how to break the Crypto1 algorithm of the Mifare Classic cards. Now the implementation has been released. The files with the source code have all in all only 611 LOC. Not so much&#8230;
]]></description>
			<content:encoded><![CDATA[<p>A few month ago a <a href="http://www.sos.cs.ru.nl/applications/rfid/2008-esorics.pdf">paper</a> was released which described how to break the Crypto1 algorithm of the Mifare Classic cards. Now the <a href="http://code.google.com/p/crapto1/">implementation</a> has been released. The files with the source code have all in all only 611 LOC. Not so much&#8230;</p>
]]></content:encoded>
			<wfw:commentRss>http://www.evilgenius.de/2008/10/27/crapto1-the-tool-to-break-the-mifare-crypto-algorithm/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>Configuring your DSL modem through your router</title>
		<link>http://www.evilgenius.de/2008/10/09/configuring-your-dsl-modem-through-your-router/</link>
		<comments>http://www.evilgenius.de/2008/10/09/configuring-your-dsl-modem-through-your-router/#comments</comments>
		<pubDate>Thu, 09 Oct 2008 21:38:42 +0000</pubDate>
		<dc:creator>hosh</dc:creator>
				<category><![CDATA[hacking]]></category>
		<category><![CDATA[kthxbye]]></category>

		<guid isPermaLink="false">http://www.evilgenius.de/?p=104</guid>
		<description><![CDATA[I unplugged my modem last week before I went to Dortmund for some days and plugged it back in last Sunday when I came back. Since then my DSL broadband access is pretty slow. Like 1 Mbit/s downstream, should be around 16 Mbit/s. Therefore I messed a little bit around with my configuration and found [...]]]></description>
			<content:encoded><![CDATA[<p>I unplugged my modem last week before I went to Dortmund for some days and plugged it back in last Sunday when I came back. Since then my DSL broadband access is pretty slow. Like 1 Mbit/s downstream, should be around 16 Mbit/s. Therefore I messed a little bit around with my configuration and found out that my DSL Modem &#8211; <em>Siemens C2-010-I</em>, is actually <a href="http://www.asiacom.com.cn/UploadFiles/File/system/200806/2007110_11-32-29.pdf">Viking II Plus</a> and not a modem but a moden/router/bridge. My provider configured the Viking as a bridge, therefore it looked like a usual DSL modem.</p>
<p><span id="more-104"></span></p>
<p>Basically you just have to configure your interface on your PC to have the IP-Address <code>192.168.1.2</code> (or any other address within <code>192.168.1.0/24</code>) and then you either can access the Viking&#8217;s HTTP or telnet server via <code>192.168.1.1</code>.</p>
<p>With the web interface running on the HTTP server you can configure basic things like switching your bridging modem into a router. The basic configurations options you have for every DSL router. Anyway more interesting is the telnet interface. With the help of it you can get many more informations about your DSL connection. I found a preliminary command reference for the Viking chip set family which seems to contains many commands you can use to get some more informations out of your modem/router/bridge.</p>
<p><code><br />
martin@kovalski:~$ telnet 192.168.1.1<br />
Trying 192.168.1.1...<br />
Connected to 192.168.1.1.<br />
Escape character is '^]'.</p>
<p>                         ******************<br />
                               Welcome<br />
                         ******************</p>
<p>Software Release R100B01.0B_HN_20060406<br />
Copyright (c) 2001-2004</p>
<p>login: alice@13184<br />
password:<br />
Login Successful<br />
$help<br />
Command        Description<br />
-------        -----------<br />
alias          To Alias a command<br />
apply          Apply configuration/image file<br />
commit         Commit the active config to the flash<br />
create         Create a new entry of specified type<br />
delete         Delete the specified entry<br />
download       Download a file on to the Device<br />
exit           To exit the CLI shell<br />
get            Display info for the search<br />
help           Provides help<br />
list           List files<br />
modify         Modify information for specified entry<br />
passwd         To modify user password<br />
ping           The normal ping command<br />
prompt         Change the user prompt<br />
reboot         Reboot the device<br />
remove         Remove file<br />
reset          Reset info for the specified entry<br />
size           ATM Sizing Information<br />
traceroute     The normal traceroute command<br />
trigger        To set trigger<br />
unalias        To undefine previously defined alias<br />
verbose        Switch ON/OFF the verbose mode<br />
$get dsl stats curr</p>
<p>No.  of  15  Min. Valid Data Intervals   : 6<br />
No.  of  15  Min. Invalid Data Intervals : 0<br />
Current  15  Min. Elapsed Time (MM:SS)   : 6:56<br />
Current  15  Min. Errored Seconds        : 0<br />
Current  15  Min. Sev Errored Seconds    : 0<br />
Current  15  Min. Unavailable Seconds    : 0<br />
Current  Day Elapsed Time (HH:MM:SS)     : 1:51:56<br />
Current  Day Errored Seconds             : 0<br />
Current  Day Sev Errored Seconds         : 0<br />
Current  Day Unavailable Seconds         : 38<br />
Previous Day Monitored Time (HH:MM:SS)   : 0:0:0<br />
Previous Day Errored Seconds             : 0<br />
Previous Day Sev Errored Seconds         : 0<br />
Previous Day Unavailable Seconds         : 0<br />
$get dsl params</p>
<p>Vendor ID            : 0039<br />
Revision Number      : E.37.2.8<br />
Serial number        : 123456789abcdx<br />
Self Test            : Passed              Framing Structure     : Unknown<br />
Standard             : ADSL2/2+            Trellis Coding        : -<br />
Local Tx. Power(dB)  : 12.6                Remote Tx.Power(dB)   : 0.0<br />
Local Line Atten(dB) : 18.5                Remote Line Atten(dB) : 11.5<br />
Local SNR Margin(dB) : 12.5                Remote SNR Margin(dB) : 6.5<br />
Tx Line Rate(kbps)   : 0                   Rx Line Rate(kbps)    : 0<br />
Up SValue            : -                   Down SValue           : -<br />
Up DValue            : -                   Down DValue           : -<br />
Data Boost           : -                   Max Att. DnS LR(kbps) : 0        </p>
<p>           UpIntrlvd UpFast DownIntrlvd DownFast<br />
AS0(kbps): -         -      -           -<br />
AS1(kbps): -         -      -           -<br />
LS0(kbps): -         -      -           -<br />
LS1(kbps): -         -      -           -<br />
RValue   : -         -      -           -<br />
$<br />
</code></p>
<p>Anyway&#8230; now that you are able to get some informations out of your DSL modem/router. I actually like my <a href="http://openwrt.org">OpenWrt</a> based router&#8230;. damn&#8230;</p>
<p>&#8230;. writing this I just realized that this whole problem might not be related to my broadband provide &#8211; you remember, I just wanted to figure out why my connection was so slow before I tried to mess around with my modem &#8211;  but to the not configured QOS settings of my so beloved OpenWrt router. Before I went to Dortmund my router got a little software update. Check, confirmed. QOS disabled.</p>
<p>&#8230; now that I have my whole bandwidth back&#8230; what was the point&#8230; right: I love my OpenWrt router. So I like to keep the bridge configuration but want to be able to access the DSL modem/router/bridge from within my local network behind my OpenWrt router. Therefore I have to adjust the firewall configuration a little. First make sure, that your modem and your router are not in the same subnet. I decided to configure my router to be <code>192.168.2.1/24</code> and the modem to stay as <code>192.168.1.1/24</code>.</p>
<p>Now, the adjustment of the router&#8217;s firewall:</p>
<p><code><br />
martin@kovalski:~$ ssh root@192.168.2.1<br />
root@192.168.2.1's password: </p>
<p>BusyBox v1.4.2 (2008-10-01 22:05:02 CEST) Built-in shell (ash)<br />
Enter 'help' for a list of built-in commands.</p>
<p>  _______                     ________        __<br />
 |       |.-----.-----.-----.|  |  |  |.----.|  |_<br />
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|<br />
 |_______||   __|_____|__|__||________||__|  |____|<br />
          |__| W I R E L E S S   F R E E D O M<br />
 KAMIKAZE (7.09) -----------------------------------<br />
  * 10 oz Vodka       Shake well with ice and strain<br />
  * 10 oz Triple sec  mixture into 10 shot glasses.<br />
  * 10 oz lime juice  Salute!<br />
 ---------------------------------------------------<br />
root@SRB178:~#  ifconfig eth0.1 192.168.1.2 up<br />
root@SRB178:~# iptables -t nat -A postrouting_rule -o eth0.1 -d 192.168.1.1/24 -j MASQUERADE<br />
root@SRB178:~# iptables -A forwarding_rule -i br-lan -o eth0.1 -p tcp --dport 80 -d 192.168.1.1 -j ACCEPT<br />
root@SRB178:~# iptables -A forwarding_rule -i br-lan -o eth0.1 -p tcp --dport 23 -d 192.168.1.1 -j ACCEPT<br />
</code></p>
<p>First configure your WAN interface. Then the firewall: The first rule is to masquerade the traffic from <code>192.168.2.0/24</code> as <code>192.168.1.2</code>. The modem/router does not know anything about the <code>192.168.2.0/24</code> network. It will receive the requests out of the network but does not know where to send them back.<br />
The other two rules are to allow the forwarding of traffic from the internal network to the modem/router on port 80 (http) and 23 (telnet).</p>
<p>If you want to get the informations easier than manually telnet into the modem and send the commands you can also use the fancy <a href="http://dmt.mhilfe.de/">DSL-Modem Tool</a>. There are several versions of this tool for different modems, but basically they all seem to use telnet to gather the informations.</p>
<p>By the way, the user name and password for accessing my modem were:<br />
User: <code>alice@13184</code> password: <code>hnto$mgmt@lice</code><br />
This is the default configuration of my broadband provider <a href="http://www.alice.de/">Alice</a>.</p>
<p>kthxbye.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.evilgenius.de/2008/10/09/configuring-your-dsl-modem-through-your-router/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Counter measurements of FTE against copying their Bluetooth sniffer</title>
		<link>http://www.evilgenius.de/2008/09/04/counter-measurement-of-fte-against-copying-their-bluetooth-sniffer/</link>
		<comments>http://www.evilgenius.de/2008/09/04/counter-measurement-of-fte-against-copying-their-bluetooth-sniffer/#comments</comments>
		<pubDate>Thu, 04 Sep 2008 19:54:49 +0000</pubDate>
		<dc:creator>hosh</dc:creator>
				<category><![CDATA[bluetooth]]></category>
		<category><![CDATA[hacking]]></category>

		<guid isPermaLink="false">http://www.evilgenius.de/?p=82</guid>
		<description><![CDATA[Seems that FTE is finally reacting on the fact that you can easily copy their Comprobes firmware to other, regular Bluetooth USB dongles. First, with their new hardware they released earlier this year, also the structure of the firmware has changed. Therefore the newer firmware wont work out of the box the good old way.
Second [...]]]></description>
			<content:encoded><![CDATA[<p>Seems that FTE is finally reacting on the fact that you can easily copy their Comprobes firmware to other, regular Bluetooth USB dongles. First, with their new hardware they released earlier this year, also the structure of the firmware has changed. Therefore the newer firmware wont work out of the box the <a href="http://www.evilgenius.de/2008/03/29/slides-for-modifying-your-bt-dongle-into-a-sniffer/">good old way</a>.</p>
<p>Second they seem to have changed their licensing policy. You have to register your software (with your license key) of FTE4BTonline. And, that&#8217;s the funny thing, seems that you also have to &#8216;de-register&#8217; your software online. Means: when you want to install your software somewhere else, de-install it on the other PC and &#8216;de-register&#8217; it online. Then install it on the other PC. What happens when your old PC is br0ken? No idea.</p>
<p>Anyway.. maybe that way more people will be interested in <a href="http://darkircop.org/bt/">building their own and free Bluetooth sniffer</a>.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.evilgenius.de/2008/09/04/counter-measurement-of-fte-against-copying-their-bluetooth-sniffer/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
		<item>
		<title>CBBQWE08 and Secure Simple Pairing</title>
		<link>http://www.evilgenius.de/2008/06/19/cbbqwe08-and-secure-simple-pairing/</link>
		<comments>http://www.evilgenius.de/2008/06/19/cbbqwe08-and-secure-simple-pairing/#comments</comments>
		<pubDate>Wed, 18 Jun 2008 22:29:30 +0000</pubDate>
		<dc:creator>hosh</dc:creator>
				<category><![CDATA[bluetooth]]></category>
		<category><![CDATA[conference]]></category>
		<category><![CDATA[hacking]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://www.evilgenius.de/?p=80</guid>
		<description><![CDATA[This weekend the CBBQWE08 will take place in Dortmund, Germany, Old Europe. It&#8217;s organized by the CCC Dortmund there will be some lectures &#8211; I will give an overview of the new security features of Bluetooth Secure Simple Pairing &#8211; but the main focus of the event is the BBQ and having some fun. I [...]]]></description>
			<content:encoded><![CDATA[<p>This weekend the <a href="http://events.ctdo.de/wiki/CBBQWE08/">CBBQWE08</a> will take place in Dortmund, Germany, Old Europe. It&#8217;s organized by the <a href="http://www.chaostreff-dortmund.de/">CCC Dortmund</a> there will be some lectures &#8211; I will give an overview of the new security features of Bluetooth Secure Simple Pairing &#8211; but the main focus of the event is the BBQ and having some fun. I hope it will be good weather.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.evilgenius.de/2008/06/19/cbbqwe08-and-secure-simple-pairing/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Slides for modifying your BT dongle into a sniffer</title>
		<link>http://www.evilgenius.de/2008/03/29/slides-for-modifying-your-bt-dongle-into-a-sniffer/</link>
		<comments>http://www.evilgenius.de/2008/03/29/slides-for-modifying-your-bt-dongle-into-a-sniffer/#comments</comments>
		<pubDate>Fri, 28 Mar 2008 23:37:21 +0000</pubDate>
		<dc:creator>hosh</dc:creator>
				<category><![CDATA[bluetooth]]></category>
		<category><![CDATA[hacking]]></category>
		<category><![CDATA[slides]]></category>

		<guid isPermaLink="false">http://www.evilgenius.de/2008/03/29/slides-for-modifying-your-bt-dongle-into-a-sniffer/</guid>
		<description><![CDATA[Remark: FTE changed something in their firmware, therefore the described way does not work anymore!
Found this slides, which give you a nice 20min walk through for changing your BT dongle to a BT sniffer.
]]></description>
			<content:encoded><![CDATA[<p><strong>Remark: FTE changed something in their firmware, therefore the described way does not work anymore!</strong></p>
<p>Found <a href='http://www.evilgenius.de/wp-content/uploads/2008/03/diy_bt_sniffer.pdf' title='Slides BT sniffer'>this slides</a>, which give you a nice 20min walk through for changing your BT dongle to a BT sniffer.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.evilgenius.de/2008/03/29/slides-for-modifying-your-bt-dongle-into-a-sniffer/feed/</wfw:commentRss>
		<slash:comments>6</slash:comments>
		</item>
		<item>
		<title>24C3: Mifare Security</title>
		<link>http://www.evilgenius.de/2008/01/06/mifare-security/</link>
		<comments>http://www.evilgenius.de/2008/01/06/mifare-security/#comments</comments>
		<pubDate>Sun, 06 Jan 2008 15:41:40 +0000</pubDate>
		<dc:creator>hosh</dc:creator>
				<category><![CDATA[RFID]]></category>
		<category><![CDATA[conference]]></category>
		<category><![CDATA[hacking]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://www.evilgenius.de/2008/01/06/mifare-security/</guid>
		<description><![CDATA[Seems that I have missed one of the most interesting speeches at 24C3.
Henryk Plötz and Karsten Nohl presented the recent developments in reverse engineering the Mifare RFID card. What they basically did is polishing away the different layers of the chip in the Mifare card and then visually analyze the layers, trying to find the [...]]]></description>
			<content:encoded><![CDATA[<p>Seems that I have missed one of the most interesting<a href="http://events.ccc.de/congress/2007/Fahrplan/events/2378.en.html"></a> speeches at <a href="http://events.ccc.de/congress/2007/Main_Page">24C3</a>.<br />
Henryk Plötz and Karsten Nohl presented the recent developments in reverse engineering the Mifare RFID card. What they basically did is polishing away the different layers of the chip in the Mifare card and then visually analyze the layers, trying to find the cryptographic relevant parts. The security of the low-end Mifare Classic cards is to be concerned as broken. &#8220;Start migrating!&#8221; <img src='http://www.evilgenius.de/wp-includes/images/smilies/icon_wink.gif' alt=';-)' class='wp-smiley' />  This does not have an impact on the high-end  Mifare DESFire card. Check out the video!</p>
<p><a href="http://events.ccc.de/congress/2007/Fahrplan/attachments/1049_CCC-07-Mifare-v2.pdf">Slides 1</a><br />
<a href="http://events.ccc.de/congress/2007/Fahrplan/attachments/1051_24c3-mifare-henryk-ooo.pdf">Slides 2</a></p>
<p><a href="http://outpost.h3q.com/fnord/24c3-torrents/24c3-2378-en-mifare_security.mkv.torrent">Torrent of the video recording in Matroska / Vorbis / H.264</a><br />
<a href="http://outpost.h3q.com/fnord/24c3-torrents/24c3-2378-en-mifare_security.mp4.torrent">Torrent of the video recording in MPEG-4 / AAC-LC / H.264</a></p>
]]></content:encoded>
			<wfw:commentRss>http://www.evilgenius.de/2008/01/06/mifare-security/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
	<georss:point>52.5234070 13.4113998</georss:point>	</item>
		<item>
		<title>24C3: Bluetooth Stuff</title>
		<link>http://www.evilgenius.de/2007/12/28/24c3-bluetooth-stuff/</link>
		<comments>http://www.evilgenius.de/2007/12/28/24c3-bluetooth-stuff/#comments</comments>
		<pubDate>Fri, 28 Dec 2007 21:06:50 +0000</pubDate>
		<dc:creator>hosh</dc:creator>
				<category><![CDATA[bluetooth]]></category>
		<category><![CDATA[conference]]></category>
		<category><![CDATA[hacking]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://www.evilgenius.de/2007/12/28/24c3-bluetooth-stuff/</guid>
		<description><![CDATA[Hi there! Greetings from 24C3, the annual hacker meeting of CCC. Some updates on Bluetooth related stuff:
Balle released a new version of bluediving, now available in version 0.9.
A funky new tool has been released at this congress: bluedrift. What driftnet is for ethernet, bluedrift is for Bluetooth. Using a special Bluetooth dongle which is capable [...]]]></description>
			<content:encoded><![CDATA[<p>Hi there! Greetings from 24C3, the annual hacker meeting of CCC. Some updates on Bluetooth related stuff:</p>
<p>Balle released a new version of <a href="http://bluediving.sourceforge.net/">bluediving</a>, now available in version 0.9.</p>
<p>A funky new tool has been released at this congress: <a href="http://events.ccc.de/congress/2007/User:Bluedrift">bluedrift</a>. What <a href="http://www.ex-parrot.com/~chris/driftnet/">driftnet</a> is for ethernet, bluedrift is for Bluetooth. Using a special Bluetooth dongle which is capable of <a href="http://www.evilgenius.de/2007/04/10/bluetooth-dongle-with-csr-chipset-and-flash-or-external-memory-using-flash/">being flashed</a>, you are now able to automatically sniff Bluetooth traffic and extract OBEX data, e.g. electronic vcards or pictures, from your sniff.</p>
<p>Another project I didn&#8217;t know before is the <a href="http://www.ladyada.net/make/wavebubble/">Wave Bubble</a> by ladyada: &#8220;A design for a self-tuning portable RF jammer&#8221;</p>
<p>Best cite of the congress: <em>&#8220;MIT doesn&#8217;t teach you how to fuck GSM-Networks&#8221;</em> &#8212; Ladyada</p>
]]></content:encoded>
			<wfw:commentRss>http://www.evilgenius.de/2007/12/28/24c3-bluetooth-stuff/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>iPhone&#8217;s Bluetooth Bug and the Metasploit Framework</title>
		<link>http://www.evilgenius.de/2007/09/29/iphones-bluetooth-bug-and-the-metasploit-framework/</link>
		<comments>http://www.evilgenius.de/2007/09/29/iphones-bluetooth-bug-and-the-metasploit-framework/#comments</comments>
		<pubDate>Sat, 29 Sep 2007 20:21:55 +0000</pubDate>
		<dc:creator>hosh</dc:creator>
				<category><![CDATA[bluetooth]]></category>
		<category><![CDATA[hacking]]></category>
		<category><![CDATA[security]]></category>
		<category><![CDATA[wifi]]></category>

		<guid isPermaLink="false">http://www.evilgenius.de/2007/09/29/iphones-bluetooth-bug-and-the-metasploit-framework/</guid>
		<description><![CDATA[As balle already pointed out, there is a major Bluetooth Bug in iPhones. The SDP-Service can be exploited to execute arbitrary code. The funny thing with iPhones is, that even when Inquiry Scan is disabled (&#8220;hidden Bluetooth device&#8221;) it&#8217;s easy to find out the Bluetooth Address of an iPhone: The  WiFi-address is the Bluetooth [...]]]></description>
			<content:encoded><![CDATA[<p>As <a href="http://datenterrorist.wordpress.com/2007/09/29/iphone-bluetooth-bug/">balle</a> already pointed out, there is a major Bluetooth Bug in iPhones. The SDP-Service can be exploited to execute arbitrary code. The funny thing with iPhones is, that even when Inquiry Scan is disabled (&#8220;hidden Bluetooth device&#8221;) it&#8217;s easy to find out the Bluetooth Address of an iPhone: The  WiFi-address is the Bluetooth address incremented by one. When you know the MAC Address of the iPhone, you also know the Bluetooth address. </p>
<p>Another interesting thing: The <a href="http://www.metasploit.com/">Metasploit Framework</a> about to be ported to the iPhone. All the applications seem to run as UID 0 on the iPhone &#8211; this is going to be fun!</p>
<p>Source: <a href="http://www.computerworld.com/action/article.do?command=viewArticleBasic&#038;articleId=9039739">Computerworld</a></p>
]]></content:encoded>
			<wfw:commentRss>http://www.evilgenius.de/2007/09/29/iphones-bluetooth-bug-and-the-metasploit-framework/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
	</channel>
</rss>
