NetworkJew » Hacks

WiFi Protected Setup not so Protected after all

Network Jew — Tue, 31 Jan 2012 15:40:26 +0000

Every WiFi-certified router that ships these days must have WPS (WiFi protected setup) in order to meet the certification guidlines put forth by the WiFi Alliance. WPS allows you to easily connect your device to a WiFi router through the use of either a button or a 8-digit pin, usually harcoded to the router itself, and typically printed on a sticker on the device itself.

Unfortunately, the manner in which WPS was implemented is not secure at all. Without getting too technical, the problem lies with how the 8 digit PIN is verified by router. Instead of checking the entire 8 digits, it checks the first four, then the next four. Well, you have a 1 in 10,000 chance of guessing the first four digits, which in a brute force attack doesn’t take an unreasonable amount of time.

In fact, using the open source tool, REAVER (http://code.google.com/p/reaver-wps/), you can EASILY crack the WPA password of your (or your neighbor’s) router very easily. I”m sure that Windows and Mac tools to perform this attack will be released soon.

The kicker is that in order tobe certified, WPS has to be enabled BY DEFAULT by the manufacturer, even if you’re not using it or aware that it exists.

You should go into your WIFI router’s configuration pages and disable WPS as soon as you can. It is highly insecure, and you run the risk of strangers eavesdropping on your network traffic if you don’t. Certainly, if you’re in a corporate environment you need to do this ASAP. For the average home user, you’ll need to weigh the risk, but if it was me, I’d disable it right now.

My favorite Gmail Search trick

Network Jew — Fri, 27 Jan 2012 18:29:28 +0000

One thing I hate is having unread messages in my mailbox. Its espeically bothersome if you have an iPhone, as the little new mail number icon on your homescreen will constantly be incrementing, and at some point becomes a useless number. Sometimes, you get so many messages but don’t necessarily want to read all of them. Often you get the idea from just the subject and the sender. Rather than going through and checking each one and selecting mark as read, here’s a little trick to easily select only the unread messages. In the search box for gmail type:

is:unread

Now, only the unread messages will show up. Simply click the select all box at the top and choose mark as read, and BAM, they’re all read. If you’re like me, you may have multiple pages of these to go through. After you clear one page, the next should show up automagically.

Hack your Wii

Network Jew — Wed, 04 Feb 2009 15:40:00 +0000

Here’s a great tutorial on Instructables on how to hack your Wii without having to make any hardware modifications.

This will allow you to fun things like play Homebrew games (which are lame), play games from other regions, backup your game discs, and play those “backed up” games.

Don’t blame me, however, if you turn your Wii into a doorstop.

http://www.instructables.com/id/Run_Backups_on_any_Wii_Without_a_Modchip/

Fannie Mae Computer Plot Thwarted

Network Jew — Tue, 03 Feb 2009 14:50:23 +0000

This is a very interesting story about a fired admin at Fannie Mae, who dropped a malicious script on their servers. Bottom line- He was fired in October ’08, they didn’t kill his access until later in the day, he was pissed off and left a Unix script which was supposed to zero out ALL Fannie Mae’s data on January 31st. Apparently the scripts were found by accident a couple months later.

Some important lessons to be learned here:

Always terminate employees access immediately upon termination. Double check remote access privileges.
Escort them to their workspace to gather their stuff, and escort them out of the building.
Don’t use shared logins/passwords.