Blog Entries
eclecticmethod: Hackers
Apr 13, 1:57
You don’t use the same password over and over right? Let’s be honest this is the day and age of the hacker. Eclectic Method brings you “Hackers” , Hollywood’s celebration of basement dwelling 128 bit encryption masters. They’ll shut down before you can trace them, hack into the mainframe…
Hack the planet!
Super Mario World “Completed” in Under 3 Minutes by Corrupting the RAM | minimaxir
Apr 3, 4:46This is essentially an AV exploit against Super Mario World that results in running the end game code. Watch the video. “…there’s a glitch that’s been known for a while, where Yoshi can end up in the “I have an item in my mouth” state, but not actually have an item in his mouth. When he spits out this nothingness, the game crashes. …That address did not contain code, and so the system crashed. But wait a second. What if, by some sheer coincidence, that address did contain code? The specific address dropped him in somewhere amongst various data for the game’s internal random number generator, and the random number generator can be manipulated in a TAS. Could the game be coerced into running arbitrary code?…”
Zelda Starring Zelda (by Kenna W) Original NES Legend of Zelda...
Mar 18, 2:17Zelda Starring Zelda (by Kenna W)
Original NES Legend of Zelda ROM modified to swap Zelda and Link: play as Zelda saving Link.
DSL modem hack used to infect millions with banking fraud malware | Ars Technica
2012 Oct 1, 6:33According to the links within this article, although the root URI of the router requires authentication, the /password.cgi URI doesn’t and the resulting returned HTML contains (but does not display) the plaintext of the password, as well as an HTML FORM to modify the password that is exploitable by CSRF.
The attack… infected more than 4.5 million DSL modems… The CSRF (cross-site request forgery) vulnerability allowed attackers to use a simple script to steal passwords required to remotely log in to and control the devices. The attackers then configured the modems to use malicious domain name system servers that caused users trying to visit popular websites to instead connect to booby-trapped imposter sites.
Decrypt.py: Act like a decrypting hacker on tv (github.com)
2012 Aug 8, 3:34A python script that d3crypt5 the input pipe’s ASCII content from ASCII garbage slowly into the correct output.
wired: cnet: Mp3 playing retainer transmits music through your...
2012 Jul 3, 2:31
cnet:
Mp3 playing retainer transmits music through your teeth:
Bone conduction audio, retainers, and shiny hip-hop teeth grills aren’t new inventions, but tech hacker Aisen Caro Chacin had the clever idea to put them all together.
The Play-A-Grill MP3 player prototype fits in your mouth like a retainer, shines on the outside like a precious metal rap grill, and plays music through bone conduction through your teeth.
Oh man, this would have made puberty just a touch cooler. Maybe.
NICT Daedalus Cyber-attack alert system #DigInfo (by...
2012 Jun 20, 3:23NICT Daedalus Cyber-attack alert system #DigInfo (by Diginfonews)
Someone has been watching too much Ghost in the Shell. I’d say someone has been watching too much Hackers but this actually looks cooler than their visualizations and also you can never watch too much of Hackers.
IAmA a malware coder and botnet operator, AMA (reddit.com)
2012 May 11, 10:19Very interesting - both technically as well as looking into the moral justifications the botnet operator provides. But equally interesting is the discussion on Hacker News: http://news.ycombinator.com/item?id=3960034. Especially the discussion on the Verified by Visa (3D Secure) system and how the goal is basically to move liability onto the consumer and off of the merchant or credit card company.
The Lazy Man's URL Parsing (joezimjs.com)
2012 May 7, 12:41Web apps really make obvious the lack of URI APIs in the DOM or JavaScript. This blog post goes over using DOM API side effects to resolve relative URIs and parse URIs. An additonal benefit of this mechanism is that you avoid security issues caused by mismatched behavior between the browser’s URI parsing and your app’s URI parsing.
A VC: The Twitter "Patent Hack"
2012 Apr 18, 6:19Specifically Twitter has said that they will only used these assigned patent rights defensively to protect themselves against hostile actions. And further that any company that acquires these patent rights from Twitter will need the inventor’s consent to use them in an offensive action. Twitter has also provided the inventor with certain rights to license the patent to others for defensive purposes. You can read the entire set of provisions on GitHub.
Client Side Cross Domain Data YQL Hack
2012 Feb 27, 2:28One of the more limiting issues of writing client side script in the browser is the same origin limitations of XMLHttpRequest. The latest version of all browsers support a subset of CORS to allow servers to opt-in particular resources for cross-domain access. Since IE8 there's XDomainRequest and in all other browsers (including IE10) there's XHR L2's cross-origin request features. But the vast majority of resources out on the web do not opt-in using CORS headers and so client side only web apps like a podcast player or a feed reader aren't doable.
One hack-y way around this I've found is to use YQL as a CORS proxy. YQL applies the CORS header to all its responses and among its features it allows a caller to request an arbitrary XML, HTML, or JSON resource. So my network helper script first attempts to access a URI directly using XDomainRequest if that exists and XMLHttpRequest otherwise. If that fails it then tries to use XDR or XHR to access the URI via YQL. I wrap my URIs in the following manner, where type is either "html", "xml", or "json":
yqlRequest = function(uri, method, type, onComplete, onError) {
var yqlUri = "http://query.yahooapis.com/v1/public/yql?q=" +
encodeURIComponent("SELECT * FROM " + type + ' where url="' + encodeURIComponent(uri) + '"');
if (type == "html") {
yqlUri += encodeURIComponent(" and xpath='/*'");
}
else if (type == "json") {
yqlUri += "&callback=&format=json";
}
...
This also means I can get JSON data itself without having to go through JSONP.
Using CSS without HTML (mathiasbynens.be)
2012 Feb 20, 6:11Implied HTML elements, CSS before/after content, and the link HTTP header combines to make a document that displays something despite having a 0 byte HTML file. Demo only in Opera/FireFox due to link HTTP header support.
Hacking Google for Fun and Profit (andrewcantino.com)
2011 Dec 28, 5:34First hand account of security researcher reporting security issues to Google and details on the security issues.
Playable Archaeology: An Interview with Telehack's Anonymous Creator - Waxy.org
2011 Jun 20, 2:25I knew it was a game but still felt bad war-dialing and otherwise messing around in there. What if I accidentally find a way out? "Telehack is the most interesting game I've played in the last year... a game that most users won't realize is a game at all. It's a tour de force hack — an interactive pastiche of 1980s computer history, tying together public archives of Usenet newsgroups, BBS textfiles, software archives, and historical computer networks into a multiplayer adventure game." Also, see all the accounts of people finding their teenage selves in the game.LulzSec manifesto: "We screw each other over for a jolt of satisfaction"
2011 Jun 20, 2:09"Why did the hackers at Lulz Security ("LulzSec") invade Sony Pictures websites, take down cia.gov, and release 60,000+ e-mail addresses and passwords? For the lulz, of course—but what might look lulzy to one person could certainly enrage another. In honor of its 1,000th tweet, the witty wankers of LulzSec released a manifesto of sorts, defending their actions to the angry Internets."Hidden device distorts news on wireless networks, brews beer, is time machine - Hack a Day
2011 May 30, 3:13"We covered the Newstweek, a wall-wart sized box that injects fake news stories over public WiFi connections last February, but now there’s a great walk through and it seems our doubts about this project were disproved."Using client-side storage, today. ✩ Mozilla Hacks – the Web developer blog
2011 Apr 5, 5:14A JS wrapper script that lets you use storage in IE6/7 via userData or localStorage every where else.Car key fob technology hacked - Boing Boing
2011 Jan 19, 7:45I always wondered how easy it would be to hack the key fobs. Now we know...Spirit of Indiana (Jones) – syncing HTML5 Video with Maps ✩ Mozilla Hacks – the Web developer blog
2010 Dec 16, 1:12Nice! Indiana Jones style map fade in over video done in HTML5 with video tag, and Google maps API.
Some rights reserved