Watch

Show Notes

Matt forgoes the vicodin for this shoot (Wisdom teeth coming out this week) and blames Darren for the HakHouse – the Internet in our living room.

D props Ghost and EDP

Post_Break has been helping D with airbase-ng and wifizoo in BackTrack3

Matt’s birthday landed on our shoot day. We took advantage of the opportunity and surprised him with, well, you’ll just have to see.

First Responder Forensics with Helix/Live View
If you’re ever in a position where you have to perform forensic imaging duties on a machine, this segment may be useful to you! The overall goal is to be able to load a forensic .dd image into an environment where you can interact at the user level with it, and perform some initial analysis that may help to paint the overall picture of what happened later on.

Requirements:

• A Helix live CD (any of their versions should work, but I recommend 2.0)
• Any machine that has an OS which is compatible with VMware
• Either a removable drive, or enough free space on a network share in order to push the .dd image out to it.
• Live View

Having VMware Workstation is a plus, but if not, Live View will automatically download and install VMware Server and the DiskMount utility for you, if you so choose.

Helix is a forensic Live CD with loads of tools. We’re focused on just the image acquisition part today. For the most part, the default options are fine, just specify where you are outputting the .dd image to and you’re on your way!

Install Live View and make sure you either let it install the necessary components, or already have VMware installed ahead of time. It tends to not like the absolute newest version of VMware Server, so ideally use the older one that it suggests. Open the .dd image with Live View, and either Start it directly or Generate the config files. Should you encounter problems with Starting it directly, use the generate config files option and then manually open the .vmx/.vmdk file from within VMware itself. Don’t forget to check the settings on the new VM and make sure the operating system is set correctly, the program does not always autodetect it.

In layman’s terms, this takes the forensic image and converts it to a virtual machine format, so you can interact with it as if you were the user. It does not write anything to the .dd image at all, but obviously I suggest using this with a COPY of the original .dd image you make of the suspect machine.

Trivia
Last week’s trivia was answered correctly by Mike S. who wrote “Dornier Do-X”. We’ve sent him the first volume of Ed Piskor’s WIZZYWIG hacker graphic novel series.

A note on trivia. Please answer trivia questions on the Hak5 forums from now on. We would love to continue doing dual winners but with growing prize costs we cannot. Also, if you’re interested in volunteering to help with trivia code challenges lend a hand in the Dev5 board.

Editing Super Mario World levels with Lunar Magic
It should be noted here that Matt sucks at Mario. Shannon walks us through some of the basics of editing Super Mario World levels with forum thread on the subject.

Rightfully red Matt shares with us another tip that’ll save you sysadmins some time and sanity. This week Matt features Bare Tail. Not just a Windows equivalent to the Unix command but a full featured log file following, highlighting and prettifying GUI perfect for everything from transaction logs to happy birthday IM conversations with yer mum.

Until next week we welcome your feedback and remind you to Trust your Technolust

Watch

Show Notes

Is WPA Broken? Interesting stuff coming out of PacSec this year. Ars has a great writeup about it our check out Martin Beck and Erik Tews’ paper Practical attacks against WEP and WPA (PDF). There is a proof of concept tool available from the Aircrack-NG folks. Take a look at Tkiptun-ng. At time of writing the tool is not fully functional. Something to keep an eye on.

Steve P. writes to us about the Helmer beowulf cluster. This 6xCore2Quad is sure to make any geek smile. Kitty approved too! While stuffing a personal cluster into an Ikea cabinet is novel in and of itself the mad scientist behind it has thought some insane cluster designs including the 50 tflop Helmer 2 and the 4 pflop Helmer 3. All I can say is I want one. Thanks for the links Steve.

Darren enjoys a Bondages’ No Problem while Matt and Shannon stick with the margaritas.

More importantly Darren talks about Session Hijacking and demos a tool from Errata Security called Hamster and Ferret that, in conjunction with the latest 2.0 build of Jasager, an ICS’d EVDO connection and Tftpd32 we’re able to “sidejack” with our little man-in-the-middle setup. Lesson learned? Be suspicious of any wifi. Check for signatures of trusted networks and tunnel your traffic. We’ll come back to this topic with a more indepth segment on Jasager detection and traffic encryption soon.

A note on trivia. Please answer trivia questions on the Hak5 forums from now on. We would love to continue doing dual winners but with growing prize costs we cannot. Also, if you’re interested in volunteering to help with trivia code challenges lend a hand in the Dev5 board.

Matt shows us how to convert a physical server into a virtual server locally using the free VMware converter tool and talks about some of the concerns you must consider when preparing to virtualize. If you have virtualization questions hit up Matt and we’ll cover ‘em on future segments. Matt at Hak5 d0t org.

Alex W. writes with a question about screen recording. We highly recommend the open source Camstudio as well as FRAPS and Techsmith’s Camtasia Studio (warning: sticker shock may occur at techsmith.com). Paul (our “camera guy”) suggests checking out the new screen capturing functionality of the latest verison of VLC, especially if you’re on the Linux or Mac side.

As always we’d love to hear your feedback. Your questions, comments or concerns can be directed to HakHouse.com. It’s a crazy interactive project we’re working on. Just wait ’till we get the web-enabled robots up in there.

Trust your Technolust

Sponsors

Failbus
This episode of Hak5 is proudly sponsored by the Fail Bus. See site for special offer on one-way, half-way and round trip tickets exclusively for Hak5 viewers!

GoDaddy
It used to cost a fortune to protect your site with an SSL Cert. Thankfully, GoDaddy.com changed all that. You can get a standard SSL cert from Go Daddy for just $29.99 a year. They have the same basic specs you’d find on other certs – 256-bit encryption, 99% browser recognition, all that – but for about 80% less than the competition. Now you’ve got no reason to leave your data exposed. Grab an SSL cert from GoDaddy.com now for just $29.99. And save 10% on Domains and SSL certs with coupon code HAK.

Dreamhost
Get awesome web hosting from the pros at Dreamhost and receive $25 off your order when you enter coupon code HAK5! Plans start at $7.95/mo including 500 GB storage, 5 TB bandwidth, and one-click installs of popular software like Wordpress, phpBB, and MediaWiki.

We’ll be uploading a ton of archive material over the next few weeks so if you’re subscribed to the site-wide RSS feed you’ll likely get flooded with pages.

This will not impact the xvid, mp4, or wmv feeds.

We’ll have an update on the HakHouse progress soon. The short version is we’ve moved back into the HakHouse but the first flood is still under construction meaning we don’t have a kitchen, living room, or studio.

Cheers,
Darren

PS: Hak5 and trust your technolust stickers available for a limited time.

Hak5 will return with Season 4 on August 5, 2008. Hang tight and trust your technolust!

Production Notes

Darren’s Editing PC borked hardcore in the disaster. This episode is proof that an Eee PC is capable of post-production.

Sponsors

Failbus
This episode of Hak5 is proudly sponsored by the Fail Bus. See site for special offer on one-way, half-way and round trip tickets exclusively for Hak5 viewers!

GoDaddy
It used to cost a fortune to protect your site with an SSL Cert. Thankfully, GoDaddy.com changed all that. You can get a standard SSL cert from Go Daddy for just $29.99 a year. They have the same basic specs you’d find on other certs – 256-bit encryption, 99% browser recognition, all that – but for about 80% less than the competition. Now you’ve got no reason to leave your data exposed. Grab an SSL cert from GoDaddy.com now for just $29.99. And save 10% on Domains and SSL certs with coupon code HAK.

Dreamhost
Get awesome web hosting from the pros at Dreamhost and receive $25 off your order when you enter coupon code HAK5! Plans start at $7.95/mo including 500 GB storage, 5 TB bandwidth, and one-click installs of popular software like Wordpress, phpBB, and MediaWiki.