hacking

After a review of bids and testing the capabilities of some of the exploits offered, the team decided to build its own malware. “This is the only inexpensive way to get to the iPhone, except for the [Israeli] solution for 7 million and that’s only for WhatsApp,” explained one team member in a message. “We still need Viber, Skype, Gmail, and so on.” The same was true of the Android and Windows malware and the back-end tools used to manage the campaign. Rather than using zero-day exploits, the organization relied on a combination of physical access, spear-phishing, and other techniques to inject its espionage tools onto the targeted devices.

From Sean Gallagher in ArsTechnica on the details leaked from a state sponsored malware effort.

http://www.fernjager.net/post-8/sdcard:

As a 400 MHz Linux system with 32 MB of RAM, using only ~100 mA @ 3.3 V, the possibilities are endless!

http://haxit.blogspot.com/2013/08/hacking-transcend-wifi-sd-cards.html:

This post is written with the intention of exposing not only the exploits which will allow you to root (or jailbreak) the device, but also the process of discovering and exploiting bugs, some of which are a dead end, while others lead to the holy root B-)

http://hackaday.com/2013/08/12/hacking-transcend-wifi-sd-cards/:

As he suspected that some kind of Linux was running on it, he began to see if he could get a root access on it… and succeeded.

In a piece that will have some people eagerly looking for some Afro Celt Sound System, others singing Where Do They Make Balloons, and some people just shaking their heads, this fellow, apparently standing in his bathroom, introduces us to another guy and his balloon organ. Really. Check this for more homemade organ fun.

Answers.com is throwing a bone to WordPress users with their new AnswerLinks plugin written by Alex King.

But wait, there’s an Answers.com API? A few pokes at the Google machine reveal nothing relevant, and Asnwers.com’s site is mum too. Taking apart the code, I get the following (modded enough to make it run-able if you drop it in the base of your WordPress install):

If the input string isn’t sufficiently long, the output will be empty (eliminating one of my potential uses for it), but it’s interesting to twiddle.

I’ve whittled things down to the point where the only baseline change from WordPress 2.0.2 is in the next_posts_link function of the wp-includes/template-functions-links.php file. The change is necessary because WPopac rewrites the SQL search queries in a way that’s incompatible with a piece of this function, but necessary for performance reasons.

Here’s how my version reads:

`

function next_posts_link($label='Next Page »', $max_page=0) {
	global $paged, $result, $request, $posts_per_page, $wpdb, $max_num_pages;
	if ( !$max_page ) {
			if ( isset($max_num_pages) ) {
				$max_page = $max_num_pages;
			} else {
				preg_match('#FROM\s(.*)\sGROUP BY#siU', $request, $matches);

				// added April 5 2006 by Casey Bisson to support WPopac
				// necessary because the preg_match above fails with some queries
				if(!$fromwhere)
					$fromwhere = $wpdb->posts;
				
				// changed April 5 2006 by Casey Bisson to speed the query by eliminating
				// the slow DISTINCT clause
				//$numposts = $wpdb->get_var(“SELECT COUNT(DISTINCT ID) FROM $fromwhere”);
				$numposts = $wpdb->get_var(“SELECT COUNT(*) FROM $fromwhere”);
				$max_page = $max_num_pages = ceil($numposts / $posts_per_page);
			}
	}
	if ( !$paged )
		$paged = 1;
	$nextpage = intval($paged) + 1;
	if ( (! is_single()) && (empty($paged) || $nextpage < = $max_page) ) {
		echo '<a href=“';
		next_posts($max_page);
		echo '”>'. preg_replace('/&([^#])(?![a-z]{1,8};)/', '&$1', $label) .'</a>';
	}
}

`

The MAKE: podcast pointed me to gumstix — really small computers built for hacking. Cool.

From O’Grady’s PowerPage{#14723}:

I have no interest in true hacking (i.e. rummaging through people’s private junk) although viewing random unprotected IP cameras around the world in public places and controlling their panning and zoom functions is kind of mind-blowing. There are a ton of fun GHacks out there – like spelling out words in pictures using Google image search, and the Google poetry generator, or the news map generator etc. Check out more than a dozen Google Hacks here.

Sort of related: put an “&btnI=I%27m+Feeling+Lucky” at the end of your query URL to invoke Google’s “I’m feeling lucky” option. This is incredibly useful when using Google to search WorldCat, like this.