Hack yourself a USB microscope

This really couldn't get any easier. I found myself at my hackerspace with an incredible amount of lazyness in my hands. Well, lazyness to clean up the place.
Suddently I noticed an old plastic microscope (with and impressive 1000x zoom) and an old stripped usb webcam.
It was pretty obvious what to do... After adjusting the camera lenses to (very) close focus, an usb microscope was working in no time. You can even remove the IR filter from the webcam and get some IR lights under the microscope to get some awesome images, with the right colorants.

My blood. No kidding. No IR lights here tough.

Nuclear Taco

This year Codebits had, once again, Nuclear Tacos.
Nuclear Tacos are super hot super spicy to the point of insanity tacos.
So I did what any decent human being would do and I volunteered to be the guinea pig of altLab hackerspace Nuclear Taco Helmet.

Talk about sweat and tears...

Kudos to altLab. Hack on!

CODEBITS V

Sapo Codebits just rocks... need to say more?

Lego Mindstorm NXT printer

So, me and the guys at our Hackerspace got our hands into a Lego Mindstorm NXT. Actually, I admit, I bought it some months ago. Seriously, I never imagined I could be > 30 years old and still played with Legos...
Anyway, we flashed it with LeJOS real quickly before anything else. "Wait, what?"
For those who are not familiar with LeJOS, leJOS NXJ offers the following:

• Object oriented language (Java)
• Preemptive threads (tasks)
• Arrays, including multi-dimensional
• Recursion
• Synchronization
• Exceptions
• Java types including float, long, and String
• Most of the java.lang, java.util and java.io classes
• A Well-documented Robotics API

Although not essential for our goal, it was fun to fell that warm fuzzy feeling when you're not sure if you just bricked your appliance again.

Well, these were the results:

Cool eh? I like.

Hackito Ergo Sum 2011

Last weekend I was in Paris, taking part of one of the most awesome security conferences worldwide.Talk about skill...

Three intense days full of technical talks, a wargame by Steven from OverTheWire with a really cool story behind. I was lucky to stay at deadbytes house and meet really skilled hackers from Europe. My sincere thanks to deadbyte, for letting so many people into his house and making  sure everybody was confortable, showing us the finest french cousine and hospitality.
I also got to stay at LeLoop, one of the most fantastic Hackerspaces i've been to. Five squared km occupied building, full of people from every spectrum of society.

HES 2011 rocked! And our team won the wargame, which was pretty cool.

Next year, I'm going. I am.

Codebits IV

Froggy frog is being froggy...

Play! Framework <= 1.0.3.1 Directory Transversal Vulnerability

Play! Framework is really great! Since I saw the video intro on their site I decided to bring that technology into my company. I strongly recommend checking it out.
That being said, I was thinking: "Well it's a new technology, let me give it a quick spin, security wise..."
Blam! It suffered from a vulnerability that allowed for anyone to read any file the owner of the java process (play! is java) could read.
So I contacted the author and gave him the details. Let me tell you, he was a very cool guy, and one hour later a fix was released.
Yes, you read it right, one hour later... kudos play!, kudos...
I later published it to the Exploit Database for the curious ones.

libpng <= 1.4.2 DoS

CVE-2010-1205 came out and I decided to play around with it for a bit, since the potential surface attack was huge. Although I couldn't manage to dedicate much time, I eventually published a PoC for it, for those who might wonder you can get it from the excellent Exploit Database.
Fell free to dig into the code, if you manage to get a full working exploit I would love to hear from you.



Codebits III

I'm attending Sapo Codebits for the first time. Looking forward to!
For those not familiar with it, SAPO Codebits is a hackathon held in Portugal annually, organized and sponsored by SAPO.
The event lasts three days, runs 24 hours a day and includes talks, a programming contest and several satellite activities.
And it's free! If you get accepted you got 3 days with food and sleeping puffs on site so you can focus just on hacking on!