If you’re familiar with dd it’s simply a matter of downloading the torrent, unzipping and imaging the included chrome_os.img to your media. For example, dd if=’chrome_os.img’ of=/dev/sdb where /dev/sdb is the path of your removable media.

If you’re in Windows you’ll be delighted to find that the linked zip contains a copy of WinDD, as well as writing instructions. More information can be found at this makeuseof.com article. Important tidbits include the fact that the default user and password are chronos / password and that a terminal can be accessed by CTRL+ALT+T. Oh, and the xrandr command is available if your desired resolution isn’t detected automatically. The syntax is typically xrandr -s 1024×768 or similar.

Download HD Download MP4 Download XviD Download WMV

Hacking the Motorola Droid: Root Access!

As expected the Motorola Droid has been rooted. That is to say there’s a hack that’ll unlock SU, or super user privileges on the phone. The hack is essentially su bundled in an unsigned update that can be run from the SD card. The unlocking process, which has changed since introduction, is outlined at this AllDroid.org forum thread.

At time of writing the process is to download this zip, rename it to update.zip and copy it to the root of your Droid’s SD card. Shutdown the Droid and start it by holding Power and X. Once greeted by an exclamation point on your screen hold the camera and volume+ buttons. From the menu choose the update.zip with the D-Pad, and once updated choose reboot.

Keep in mind that when it comes to unlocking moving targets like this it’s best to check with droid forums beforehand.

A Linux Doom Source Port

It was only a matter of time before we put Doom on The Zipit Z2. The recently unlocked linux-based wireless device is a prime candidate for fragging, what with it’s QVGA color display, WiFi and all. After unlocking, installing Doom is simply a matter or launching Fluxbox with startx and downloading PrBoom, a cross-platform Doom Source Port, with apt-get install prboom. The trick in launching PrBoom from /usr/games/ is to add the -width 320 -height 240 parameters. While PrBoom comes included with Freedoom, a free and open source Doom compatible IWAD, you may provide your own doom or Doom2-iwad parameter.

It is also worth noting that PrBoom comes with it’s own tcp game server for deathmatch. If anyone wants to try a little Zipit Z2 deathmatching hit us up. Or if you’re looking for some Doom goodness on the PC check out my favorite port, Skulltag.

Boot Chromium OS from USB

While still early in it’s development stages, Google’s upcoming Chrome OS is a neat OS to play with — especially on a netbook. While the Virtual Machine images floating around are nice for a glimpse, if you really want to immerse yourself in the Chrome OS experience it’s best to boot it from the metal. This can be achieved by “burning” this Chromium OS image to 3GB or greater USB or SD media. Here’s a torrent.

If you’re familiar with dd it’s simply a matter of downloading the torrent, unzipping and imaging the included chrome_os.img to your media. For example, dd if=’chrome_os.img’ of=/dev/sdb where /dev/sdb is the path of your removable media.

If you’re in Windows you’ll be delighted to find that the linked zip contains a copy of WinDD, as well as writing instructions. More information can be found at this makeuseof.com article. Important tidbits include the fact that the default user and password are chronos / password and that a terminal can be accessed by CTRL+ALT+T. Oh, and the xrandr command is available if your desired resolution isn’t detected automatically. The syntax is typically xrandr -s 1024×768 or similar.

Download HD Download MP4 Download XviD Download WMV

It has been the dream of many to combine the pen-testing, forensics and recovery power of our favorite USB bootable linux distros into one drive complete with customized boot menu. Finally Frank Castle shares this digital mojo with us. I bring you the USB Muiltipass.

While the video walks you through the step by step I’ll provide an overview with links here.

First you’ll need three programs, PeToUSB, grubinst and grub4dos.

Prepare the USB drive by formatting it with PeToUSB. With the drive plugged in run the PeToUSB executable, select the drive, check Enable Disk Format, Quick Format and Force Volume Dismount and click Start. If you are using a drive over 2 GB you will receive an error about dismounting — it’s no big deal — simply format the drive as Fat32 with the Windows Disk Manager.

Next run grubinst_gui. Select the disk option and pick your USB drive. Be sure to select the correct drive number. If you’re not sure which drive is your USB drive check with Windows Disk Manager. Once you are assured the correct drive is selected go ahead and click Install. No options need to be checked, the defaults are fine.

You will then need to copy the grldr file from the grub4dos package to the root of your USB drive. Finally finish off the install by creating a blank text file in the root of your USB drive called “menu.lst”.

You can now boot from this drive. Of course there aren’t any Linux distributions and utilities installed yet, so let’s move on to adding all the goodies.

When it comes to installing distros I’ll go ahead and quote Frank Castle as he puts it best.

For most of the distros I added, I started off with an iso version of it. I then extracted the isos either to my desktop or directly to the root of the thumb drive (or you could just copy the files from a burnt version of the distro, just as long as you get the files to the root of your thumb drive). Most Linux Distros come with 2 folders: a boot folder and another folder that actually holds the meat and potatoes of the distro. Since it would be impossile to have 6 or 7 different boot folders that don’t overlap on the same thumb drive (without multiple partitions…a route I tired to take for way too long) I simply renamed the boot folder to something like “bootbt3″ or “bootknop” depending on the distro, and just left the other folder as is. I then added the appropriate information by using the information by either:

1) Looking at the information provided in the syslinux or isolinux file in most linux distros

2) Looking at a (now taken down) webpage with tons of examples (appropriatly added to this tutorial under Examples.txt)

3) Trial and Error

Most distros fell under the first of these options: Backtrack 3, Backtrack 4, Knoppix, and Trinity Rescue Kit all worked fine under these conditions

Some distros fell under the examples webpage: these included Ubuntu LiveCD (a different example because there is no boot folder and way more than two folders, but it ended up working without changing any folder names) as well as some others

Few Distros fell into the third option, but the ones that did were a bitch and a half to get working. These included Kon-Boot and OPHcrack.

OPHcrack (the latest version – 2.3.0), a tool I have known, loved, and depended on (at least until I met Kon-boot…thank you) was a apparently different than any of the other distros because just copying the files from the iso… blah blah blah didn’t work. It turns out that you have to burn the Distro to a spare thumb drive using tazusb (Slitaz installer) from http://www.objectif-securite.ch/slitaz/tazusb.exe. You then copy these files to the root of your thumb drive and so on and so on. The second challenge was to get both versions of OPHcrack (XP and Vista) on the drive, since ALL of the files overlapped. It turns out that the only difference in the two verisons were the tables provided so I just copied the tables from one cd to the other and proceeded forward as usual.

Kon-Boot was yet another bitch of a thing to get running via USB. No matter what I did it would boot, load, and promptly go back to the Grub bootloader. After a few hours of trial and error, I discovered I had to tell GRUB to tell the BIOS that the hard drive was the first boot device, even though it was obviously the thumb drive, because Windows apparently won’t run at all if it isn’t the first boot device. This reqiured a few extra lines. Also, for some reason the .iso file wouldn’t work (I could never extract or even see the raw files of Kon-Boot), so i was forced to use the Floppy image (.img)

When it comes to customizing Grub its simply a matter of creating a 640×480 – 14 color splash screen image. This is easy to accomplish with the Gimp. Once you’ve created a 640×480 image you can crunch the colors be selecting Image, Mode, Indexed and entering 14 ad the maximum colors. Save this file as a XMP, then gzip it. Copy the gz to the root of your USB drive and prepend “splashimage /image.xpm.gz” to your menu.lst file.

Further information on customizing the grub menu.lst file for your specific distros can be found in the grub manual. As an example I’ll provide my config here:

splashimage /jozette.xpm.gz
color blue/black yellow/blue
timeout 120

title BackTrack 4 BETA
root (hd0,0)
kernel /bootbt4/vmlinuz vga=0x317 ramdisk_size=6666 root=/dev/ram0 rw quiet
initrd=/bootbt4/initrd.gz
boot

title Kon-Boot-test
map --mem /FD0-konboot-v1.1-2in1.img (fd0)
map --hook
chainloader (fd0)+1
map (hd1) (hd0)
map --hook
rootnoverify (fd0)

title Memtest86
kernel /memdisk
initrd /memtestp.img

title ntpasswd
kernel /ntpasswd/vmlinuz rw vga=1 initrd=/ntpasswd/initrd.cgz /ntpasswd/scsi.cgz
initrd /ntpasswd/initrd.cgz

title DBAN
kernel /memdisk
initrd /dban.img

title SystemRescueCD
kernel /rescuecd initrd=initram.igz video=ofonly vga=0 scandelay=5
initrd /initram.igz

title FreeDOS
root (hd0,2)
kernel /memdisk
initrd /freedos.img floppy

title Ophcrack
kernel /bootoph/bzImage rw root=/dev/null vga=normal lang=C kmap=us screen=1024x768x16 autologin
initrd /bootoph/rootfs.gz

I’m sure there will be many questions and further development of this project so as I’ll go ahead and point you the episode 524 release thread on the Hak5 forums. Share your thoughts!

Don’t forget about our first ever official Hak5 Meetup at Busch Gardens Williamsburg on August 15th. Find all the details at hak5meetup.squarespace.com or RSVP on Facebook.

Download HD Download MP4 Download XviD Download WMV

Watch

Show Notes

USB Device Tracking

If you’ve ever used a USB storage device and wondered how stealthy you can be with them, you’re in for a scare. Windows XP logs pretty much everything you’d want to know about that USB key in the registry each time it’s plugged in and written to.

When you plug in your USB drive, the Plug and Play manager gets notified and queries the device descriptor in the firmware for information about the device. This helps it locate a driver, which is referenced in the %SystemRoot%/inf folder by various .inf files. Once the device is identified and a driver selected, the information is dropped into HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USBSTOR with a format similar to Disk&Ven_###&Prod_###&Rev_### which will identify the device ID, manufacturer and more. An important number you will find here is the ParentID prefix, which I did not actually say during the segment but this is something that will appear in virtually every registry entry regarding the device.

Microsoft uses serial numbers on the devices to distinguish between devices with the same manufacturer or model. In the case that the serial number is not unique (or even not present), the PnP manager will create a unique instance ID for the device.

All of the numbers you find related to each device should be logged if you’re doing any sort of investigation or trying to track a device across computers.

If you’re trying to determine whether data was perhaps pilfered from your machine/network, you will want to look at HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\DeviceClasses, where you will find the ParentID prefix and will be able to correlate to the device. You should also see the manufacturer name here. We are looking for the Last Write time which will help in determining whether data was pilfered by giving you a timeframe as to when someone last copied data to the device. In order to do this, you’re going to right click on the entry that has the ParentID prefix and manufacturer name for the device you want, and then click Export. Change the file extension to .txt and name it anything you want, remembering where you save the file. Upon opening this file up, you will find the last write time.

There are many applications for this data, and you’ll probably never be in the registry doing it quite this way, as there are many tools, both commercial and free that will simplify all of this. This data is also used in tools/services which help track your devices, such as iHound (ihoundsoftware.com), which helps you track devices if they’re stolen.

If you have any questions feel free to contact me here and visit my website. Many thanks to Harlan Carvey, author of the 2007 book Windows Forensic Analysis (I think I might’ve errantly said 2005, sorry) for without this book I wouldn’t have known as much as I do about the windows registry.

–Chris Gerling Jr.

PFsense

While our smoothwall is and has been working well for us for the past two years, I recently had the need for something a little more robust.

I came across a fork of the monowall project, pfSense is a free, open source customized distribution of FreeBSD tailored for use as a firewall and router. In addition to being a powerful, flexible firewalling and routing platform, it includes a long list of related features and a package system allowing further expandability without adding bloat and potential security vulnerabilities to the base distribution.

Here’s a short summary of some of the eye catching features.

• Filtering by source and destination IP, IP protocol, source and destination port for TCP and UDP traffic
• Able to limit simultaneous connections on a per-rule basis
• pfSense utilizes p0f, an advanced passive OS/network fingerprinting utility to allow you to filter by the Operating System initiating the connection. Want to allow FreeBSD and Linux machines to the Internet, but block Windows machines? pfSense can do so (amongst many other possibilities) by passively detecting the Operating System in use.
• Option to log or not log traffic matching each rule.
• Highly flexible policy routing possible by selecting gateway on a per-rule basis (for load balancing, failover, multiple WAN, etc.)
• Aliases allow grouping and naming of IPs, networks and ports. This helps keep your firewall ruleset clean and easy to understand, especially in environments with multiple public IPs and numerous servers.
• Transparent layer 2 firewalling capable – can bridge interfaces and filter traffic between them, even allowing for an IP-less firewall (though you probably want an IP for management purposes).
• Packet normalization – Description from the pf scrub documentation – “‘Scrubbing’ is the normalization of packets so there are no ambiguities in interpretation by the ultimate destination of the packet. The scrub directive also reassembles fragmented packets, protecting some operating systems from some forms of attack, and drops TCP packets that have invalid flag combinations.”
• Enabled in pfSense by default
• Can disable if necessary. This option causes problems for some NFS implementations, but is safe and should be left enabled on most installations.
• Disable filter – you can turn off the firewall filter entirely if you wish to turn pfSense into a pure router.
• pfSense offers three options for VPN connectivity, IPsec, OpenVPN, and PPTP.

There’s a ton of other great features that you can read up on at http://is.gd/iauk

The LiveCD ISO is available from http://www.pfsense.org/mirror.php?section=downloads and for VMware folks, a prebuilt VM is available at http://files.pfsense.org/vmware/pfSense-1.2.2-VM.zip

–Matt Lestock

LAN Party

This month, we are playing Left4Dead and Zombie Panic! Join us for our LAN Party on Saturday, February 28th at L4D.hak5.org or ZP.hak5.org for a good ol’ zombie apocalypse.

Trivia

Last week’s trivia was: “In PHP, which is faster and why? echo”Hello World”; or print(“Hello World”);?” Zoltan answered right with: “Echo is faster because it doesn’t set a return value and ‘print’ is a more complex function.” Zoltan wins a copy of Pronobozo’s CD ‘Zero=One=Everything’. You can check out more of Pronobozo’s music at his website.

If you want to win this week’s giveaway, enter the letters you see popping up during the episode into our trivia page and answer the trivia question in the first 24 hours from when this episode releases. We will choose a random winner out of the correct answers!

iTunes

Remember to subscribe to our new HD feed on iTunes at Hak5.org.

Feedback

Have a segment suggestion, constructive feedback, or a snack idea for Kerby? Email your ideas to Feedback@hak5.org. Thank you!

Stickers

Don’t forget! We’ve got brand new sticker packs as thanks for your donations at Hak5.org/stickers. Without your help, we wouldn’t be HD right now.

Shmoocon

We will be at Shmoocon this weekend, February 6-8 in Washington DC. If you are in the area, join us for the annual podcaster’s meetup. Meet our cast and crew as well as lots of other great podcasters from PaulDotCom, Securabit, Sploitcast, Cyber Speak, Security Justice, and more! Get the info at Podcaster’s Meetup.com.

Survey

We’re conducting a survey to get some additional information about our viewer. We would love your feedback. If you have a few minutes to spare, please do us a favor and take the survey at the survey page.

For those of you who complete the survey, you will be treated to a sneak peek at a new show that Revision3 has been working on and get a back stage look at the pre-production of a Hak5 episode.

Trust your Technolust!

Download HD Download MP4 Download XviD Download WMV

Watch

Show Notes

QwicKey – Personal Online Security Device

Vuzix iWear 1440 Virtual Reality eyewear

nPower Personal Energy Charger

Super Talent Worlds “smallest” flash drive

Shapeways 3D printing

The “hunt + peck keyboard for one finger typist” – Complete with the LOL key. Really.

Audio Bone Ear Free Listening

MP4 XviD WMV

Watch

Show Notes

MD5 Brute Forcing with your graphics card

Since Nvidia released the CUDA API for Windows, Mac and Linux a number of advances have taken place in the world of brute forcing. In this episode I feature a tool by Svarychevski Michail Aleksandrovich that claims to be the world’s fastest MD5 cracker — BarsWF

Using the brute forcer with a couple Nvidia 8 series or newer graphics cards you’re able to achieve unprecidented speeds. I’ve seen claims of nearly 4 billion hashes per second with quad SLI.

CUDA has also spurred other developments, such as this NTLM brute forcer for Linux.

In my segment I go into the very basics of password cracking theory and MD5 hashes with some simple scenarios. My aim is to provide a fundamental understanding of the concepts. If you’re interested in reading more I suggest starting here.

–Darren Kitchen

Windows Password Recovery with Ophcrack Live USB

Recovering Windows Passwords coulnd’t be easier with Ophcrack Live on USB. Whether it’s your sister’s forgotten XP account or [insert other legit reason] a little USB booting and Rainbow Table loving’s got you covered.

Preparing an Ophcrack USB key is as simple as formatting your drive for FAT32 with the HP USB format tool. Downloading and launching USBOphcrack.exe and running the included batch file. The program will download a small set of rainbow tables and prepare your USB drive.

For even higher password recovering accuracy I recommend finding a larger set of Ophcrack compatible rainbow tables. Or if you’re feeling adventerous why not try out the Hak5 community rainbow tables — a whopping 120GB of NTLM goodness.

–Shannon Morse

Be sure to follow one of us on Twitter if you’ll be at CES this week. We’ll be there finding all the best hackable gadgets!

Sponsors

Get awesome web hosting from the pros at Dreamhost and receive $25 off your order when you enter coupon code HAK5! Plans start at $7.95/mo including 500 GB storage, 5 TB bandwidth, and one-click installs of popular software like Wordpress, phpBB, and MediaWiki.

Keep your personal information away from spammers, hackers and your crazy ex-evilserver. Private Domain Registration from GoDaddy.com protects your privacy by keeping your address, phone number and more out of the public database. Get an additional 10% on your order when you enter coupon code HAK.

Sponsors

Get awesome web hosting from the pros at Dreamhost and receive $25 off your order when you enter coupon code HAK5! Plans start at $7.95/mo including 500 GB storage, 5 TB bandwidth, and one-click installs of popular software like Wordpress, phpBB, and MediaWiki.

Keep your personal information away from spammers, hackers and your crazy ex-evilserver. Private Domain Registration from GoDaddy.com protects your privacy by keeping your address, phone number and more out of the public database. Get an additional 10% on your order when you enter coupon code HAK.

Sponsors

Get awesome web hosting from the pros at Dreamhost and receive $25 off your order when you enter coupon code HAK5! Plans start at $7.95/mo including 500 GB storage, 5 TB bandwidth, and one-click installs of popular software like Wordpress, phpBB, and MediaWiki.

Keep your personal information away from spammers, hackers and your crazy ex-evilserver. Private Domain Registration from GoDaddy.com protects your privacy by keeping your address, phone number and more out of the public database. Get an additional 10% on your order when you enter coupon code HAK.

Plus an interview with the guys from Podzinger.com, a parody we’ve dubbed ‘the token’, an intro from Sean Carruthers of labrats.tv, leet-hack interviews from Karen Johnson, and Leo Laporte of twit.tv shows his evil side.

Sponsors

Get awesome web hosting from the pros at Dreamhost and receive $25 off your order when you enter coupon code HAK5! Plans start at $7.95/mo including 500 GB storage, 5 TB bandwidth, and one-click installs of popular software like Wordpress, phpBB, and MediaWiki.

Keep your personal information away from spammers, hackers and your crazy ex-evilserver. Private Domain Registration from GoDaddy.com protects your privacy by keeping your address, phone number and more out of the public database. Get an additional 10% on your order when you enter coupon code HAK.