30 posts from 2007

The guys over at 24C3 just demoed a Wii hack that is set to provide native wii homebrew in the near future (not running in GC mode, and with full access to all the Wii hardware!) They were able to find encryption and decryption keys by doing full memory dumps at runtime over a custom serial interface. Using these keys, they were able to create a Wii ‘game’ that ran their own code (their demo happened to show live sensor/Wiimote information, amongst a few other things).

Have you ever had deja vu on the internet but the second time around you were smart enough to "save as"... no? never? Well, I just had the good fortune of such an experience!

I present to you, enough frog species in a single txt document for the rest of my network nomenclature life:

Poison Dart Frog Species

So far I've got:

Captivus
Pictus
Sirensis

Looking forward to:
maculatus (take a wild guess at the computer that will inherit this name in January after WWDC)

I assure you my wlan's SSID isn't a function call. This bug is likely exploitable if you want to donate your free time to trace it. I'll even give you steps to reproduce it, but I think it's hardly worth the effort.

GTK_Submit

This past week has been pretty traumatic for me but even more so for my girlfriend. She's in the hospital for open hip surgery (I absolutely hate hospitals with every bone and all the red squishy stuff inside me) and is in a lot of pain. I'm seriously worried about the long term effects of taking 40+ vicodin, large amounts of oxycodone, and a 24 hour morphine IV but doctors are like synonymous to apple geniuses, so they know everything right? The only thing that was really able to calm my nerves was doing my best comfort her, watching every episode of The Office with her and drawing in a new recycled paper sketchbook I bought in Santa Monica during her surgery. Oh and wandering into Westwood at like 3-4am and starting conversations with the homeless. (not a joke). All in all, it's really awful to see somebody you love in pain.

She was discharged today, but still on heavy painkillers that make her adorable, twice daily injections in the stomach of blood thinning medication and some crazy apparatus that probably transforms into bumblebee when nobody's looking . She won't be coming home to the bay area until this weekend unfortunately.  I however, AMA (against mother's advice) will be back in the bay area once I finish this post and pack my belongings. SO without further ado, I present a bunch of sleepless, eatless, drawings:

Dear Internet,

Today I was using Google image search and I came across a seemingly innocuous webpage that triggered an alert from my antivirus software. (Figure 1)

Figure 1

Like any concerned internet citizen, I submitted this file to the manufacturer of my AV software, Eset, for analysis.
Unfortunately they usually take a few days to respond, so naturally, I also saved a copy for own analysis and named it "virii.noexec".

After SCP'ing it to captivus I ran it through xxd but soon realized it was all binary data. I was hoping to find a PE packing header, like upx or similar but all I saw was jibberish. (Figure 2)

Figure 2

So, determined to figure this out, I ran it through the command, "File", which looks for common data structures and can help determine what kind of file we have. File said:

                                                       virii.noexec: Macromedia Flash data (compressed), version 7

Eureka! We're on the trail now. It would make sense that it's a flash movie (.swf) as these are easily embedded as objects in web pages. There have even been cases where malicious ads appeared on web pages that weren't meant to be harmful.

So the next logical step was to uncompress this nasty .swf. For that I used flasm. (Who doesn't love that name?)

                                                       virii.noexec successfully decompressed, 45270 bytes

After unpacking and disassembling it with flasm I got the bytecode. With a little more tinkering I got the sourcecode.

SO what does it do Internet? False positive? Or positively malware?

Edit: Oh ps, the infected site was some livejournal page. Damn Russians. ;)

See it at istartedsomething. 

Eva Torres

Dec 7, 2007 11:17 PM

hey.. what's up?
So, i guess it's time for me to start using this site. I can resist it no more! I wandered into your page and well, I liked what I saw.. :p So.. ya :) my name is Eva Torres. I think me and you should probably be friends, because you seem pretty fun, and maybe even cute! (it's everso hard to tell in this digital world :) anyways, i'd go on and on, but I'd like to get a response from you.. You should check out my other profile on this other site, I'm usually on over there: http://<EDIT>/?id=2546&mypics (my username is <EDIT>). Then maybe we could chat sometime! you know what they say.. looks catches the eyes, but personality catches the heart.. haha.. talk to you soon, Eva Torres

Lucky for the spammer, this isn't an email and headers are unavailable to me ;)

Here are the rest of the photos.

I've been wanting to remotely log on my Tomato flashed wrt routers for some time now but haven't had the time or energy to invest in configuration. Well, with my Cal Arts portfolio out of the way, I finally got around to it.

What's great about the Tomato firmware is that it's gives you the control of a familiar unix backend however it offers ease of use through a very well engineered graphical front end. Not as much control as openwrt but it's all about balance. In fact, I like it so much that it's one of the few open source projects I donate to.

So let's begin:

First off you'll need to enable remote logging under the Administration section of your wrt flashed with Tomato. I chose to log all packets because at some point I'd love to dump this into a graphing program and serve it up via https so I can  spy monitor the users of my Tomato routers. ( Before you go jumping into how unethical I am, remember that I have little bothers and a sister and the internet is, well, the internet)

Tomatio remote logging configuration