Boing Boing 

Kodak set us up the bomb: kept a nuclear reactor in the basement

As Kodak stumbles through its bankruptcy, all sorts of weird facts are surfacing, like the news that the company had its own nuclear reactor, producing weapons-grade isotopes. It was installed for neutron imaging experiments in 1974, and while the feds were duly notified, it doesn't look like there was ever a public announcement -- nor was there any notice given to the local firefighters who'd have turned up if anything ever went wrong. If only I'd known about this when writing Makers (which concerns itself with hedge fundies who buy up and strip down Kodak and Duracell), think of the subplots I could have written!

From the Democrat and Chronicle piece by Steve Orr:

Company spokesman Christopher Veronda said he could find no record that Kodak ever made a public announcement of the facility. He also wasn’t sure whether the company had ever notified local police, fire or hazardous-materials officials.

Current city of Rochester officials, whose personnel might have been summoned to Building 82 had an untoward incident occurred, said they were in the dark. Monroe County officials did not provide comment despite several requests.

The Democrat and Chronicle learned of the facility when an employee happened to mention it to a reporter a few months ago.

The recent silence was by design. Detailed information about nuclear power plants and other entities with radioactive material has been restricted since the 2001 terrorist attacks.

Did you know? Kodak Park had a nuclear reactor

(Image: Nuclear Regulatory Commission)

WiFi Pineapple: an appliance to do WiFi snooping, password sniffing, and site-spoofing


The $90 WiFi Pineapple is now in its fourth iteration. The gadget does man-in-the-middle attacks on WiFi networks, allowing its owner to snoop on all the traffic, keylog password entries, and generally compromise the shit out of anyone using WiFi in the area. It's a damned good reason to use a VPN, like The Pirate Bay's IPREDator. Also: it has epic rickrolling potential.

The WiFi Pineapple Mark IV improves tremendously on previous models in both hardware capabilities and ease of use. Where the Mark III brought a completely redesigned web management interface the Mark IV continues with plug & play 3G / 4G connectivity, automatic presistent reverse SSH tunnels and a simplistic status page to name a few. The new control center shows at a glance connected clients hostnames, IP addresses, Karma'd SSID as well as signal strength, idle time and network throughput.

Hardware wise the Mark IV is built on a powerful Atheros AR9331 SoC at 400 MHz--over double that of the previous generation--and sports two Ethernet ports, 802.11 b/g and N connectivity, as well as most notably a USB 2.0 port, allowing for expansions like mass storage and 3G / 4G modems. *modem sold separately.

Also it's black, which adds at least 50 hacker points.

WiFi Pineapple Mark IV (via JWZ)

Random network security tip for those about to appear on TV

Don't do this. (via @ryanaraine + @kimzetter)

US doxes Bin Laden (always use encryption, kids)

CNET's Emil Protalinski reports that Osama bin Laden did not encrypt the thousands of files stored in the Pakistani compound where he was killed, and "17 of the 6,000 documents have now been publicly released." (via @ioerror)

Cybercrime sucks (for criminals)

Bruce Schneier comments on an NYT report on cybercrime that shows that there's just not much money to be had in being a ripoff artist. Dinei Florêncio and Cormac Herley wrote:

A cybercrime where profits are slim and competition is ruthless also offers simple explanations of facts that are otherwise puzzling. Credentials and stolen credit-card numbers are offered for sale at pennies on the dollar for the simple reason that they are hard to monetize. Cybercrime billionaires are hard to locate because there aren’t any. Few people know anyone who has lost substantial money because victims are far rarer than the exaggerated estimates would imply.

The authors frame cybercrime as a "tragedy of the commons," where the overfishing (overphishing) by crooks has reduced everyone's margins to nothing, making it hard graft indeed. Meanwhile, cybercrime estimates are subject to the same lobbynomics used to calculate losses from music downloading and profits from drug seizures:

Suppose we asked 5,000 people to report their cybercrime losses, which we will then extrapolate over a population of 200 million. Every dollar claimed gets multiplied by 40,000. A single individual who falsely claims $25,000 in losses adds a spurious $1 billion to the estimate. And since no one can claim negative losses, the error can't be canceled.

Cybercrime as a Tragedy of the Commons

This week in TSA awfulness: a recap of recent American airport atrocities

Cue up the Yakity Sax! In case you missed it, there have been a number of Boing Boing posts of late documenting outrageous TSA incidents:

• A terminal in Newark airport was evacuated because the TSA forgot to screen a tiny baby.
• TSA agents discovered an "anomaly in the crotchital area" of a 79-year-old woman.
• TSA agents at JFK harassed the family of a 7-year-old girl with cerebral palsy and developmental disability.
• TSA screeners in LA ran a drug ring and took bribes from drug dealers.
• The TSA's anti-hugging squad caught a terrorist masquerading as a 4-year-old girl who loves her grandma.
• A 95-year-old US Air Force veteran from World War II and his 85-year-old friend were humiliated, searched and robbed at a San Diego TSA checkpoint.

Did we miss anything else in the past week or so? Let us know in the comments.

Photo: Carolina K. Smith, M.D. / Shutterstock.com

Samsung TVs can be plunged into endless restarts with easy attack

Some WiFi-connected Samsung TVs can be put into an endless restart loop by sending invalid new-remote-added messages to them. Best part: the researcher who discovered this couldn't report it, because Sammy doesn't have a locatable facility for accepting information about security flaws.

“The bugs have been tested on a d6000 and d6050 TV, but it's highly possible that many of the Samsung devices supporting this protocol are vulnerable because d6xxx is a recent TV and usually these 'core' components are like libraries shared with other devices that make use of the same protocol,” he said via email.

Auriemma claims there is no fix for these bugs because he was unable to report the bugs to Samsung. He has also received no word from Samsung. He claims that Samsung doesn’t even have a channel through which to report these types of bugs.

Researcher Causes Endless Restart Loop on Samsung TVs (via The Command Line)

TSA screeners in LA ran drug ring, took narco bribes


Photo: Reuters. A man is screened with a backscatter x-ray machine at an LAX TSA checkpoint.

Four present and past security screeners at LAX took 22 payments of up to $2400 each to let large shipments of coke, meth, and pot slip through baggage X-ray machines. Oh, we are so very, very shocked.

In one incident detailed in the 40-page indictment (Link), screeners plotted to allow eight pounds of crystal meth to get through—then one of them ducked into an airport men's room where he was handed $600, the second payment for that delivery.

Read the rest

Who did the TSA terrorize today? A 4-year-old girl. Why? She hugged her grandma.

PHOTO: Snapshot by Lori Croft of her 4-year-old granddaughter Isabella Brademeyer, in Wichita, Kan., where she was a flower girl at her uncle’s wedding. The child was harassed by TSA goons on the way back from that family event, for the crime of hugging her granny.


Earlier this week on Boing Boing, Cory blogged about a 95-year-old Air Force veteran who was robbed of $300 at a TSA checkpoint. After picking on the elderly, today the TSA is bullying children. A 4-year-old girl who was upset during a TSA screening at the Wichita, KS airport was forced to undergo a manual pat-down after hugging her grandmother. Agents yelled at the child, and called her an uncooperative suspect.

Nope, we're not making this up.

The child's mom, Michelle Brademeyer of Montana, shared the incident in a public Facebook post last week, and the story has since spread widely.

“They didn’t explain anything and she did not know what was going on,” the grandmother told the Associated Press. “She saw people grabbing at her and raising their voices. To her, someone was trying to kidnap her or harm her in some way.”

Think the TSA has apologized? Nah. The agency is defending its agents, despite promised changes in operational standards to "reduce pat-downs of children."

Read the rest

Nigh-undetectable ATM skimmer


If the previous ATM skimmer posts didn't scare the pants off you, this one from San Fernando Valley, which Brian Krebs reports on, might. It has a near-undetectable pinhole camera for recording timestamped footage of your PIN entry, and apart from that indicator, the only way to spot it is to yank hard on the front of the ATM before you start using it.

A few tips about ATM skimmers and skimming scams. It’s difficult — once you’re aware of how sophisticated some of these skimmers can be — to avoid being paranoid around ATMs; friends and family often tease me for stopping to tug at ATMs that I pass on the street, even when I have no intention of withdrawing money from the machines.

Still, it’s good and healthy to be somewhat paranoid while at an ATM. Make sure nobody is “shoulder surfing” you to watch you enter your PIN. A simple precaution defeats shoulder surfing and many other types of video-based PIN stealing mechanism: Cover the PIN pad with your hand or another object when you enter your PIN.

Skimtacular: All-in-One ATM Skimmer

High-stakes one-shot Prisoner's Dilemma on a British game show with an astounding strategy

A British game-show called "Golden Balls" concludes each installment with a single-shot version of the Prisoner's Dilemma in which the two players' choices can result in a large cash prize being awarded to both of them, neither of them, or just one of them. The players are allowed to tell each other what they plan on doing, but they are also allowed to lie and try to trick the other player into making a choice that would leave the whole pot in the trickster's hands.

In this remarkable clip, a player named Nick runs an extraordinary end-game that has to be seen to be believed. As Bruce Schneier says,

This is the weirdest, most surreal round of "Split or Steal" I have ever seen. The more I think about the psychology of it, the more interesting it is. I'll save my comments for the comments, because I want you to watch it before I say more. Really.

Once you've watched the clip, check out Bruce's spoiler-y discussion of what is going on there.

Amazing Round of "Split or Steal"

Iranian finance/tech manager publishes 3,000,000 bank accounts' details and PINs

A finance technology manager named Khosrow Zarefarid discovered a critical flaw in Iran's online banking systems. He extracted 1,000 account details (including card numbers and PINs) and emailed them to the CEOs of 22 Iranian banks along with detailed information about the vulnerability. A year later, nothing had been done. Zarefarid extracted 3 million accounts' details from the bank's systems and posted them to ircard.blogspot.ca. Many Iranian banks have now frozen their customers' accounts and are only allowing PIN-change transactions at ATMs. Some banks have texted their customers to warn them of the breach. The Central Bank of Iran has published an official notice of the breach, but the notice does not say that the underlying vulnerability has been fixed, or even whether it is being addressed. Zarefarid is said to have left Iran, though his whereabouts are not known, at least to Emil Protalinski, who wrote about the breach for ZDNet:

It does not appear as if Zarefarid stole money from the accounts; he merely dumped the account details of around 3 million individuals, including card numbers and PINs, on his blog: ircard.blogspot.ca. I found the link via his Facebook account, along with the question “Is your bank card between thease 3000000 cards?”

...Zarefarid previously worked as a manager at a company called Eniak, which operates the Shetab (Interbank Information Transfer Network) system, an electronic banking clearance and automated payments system used in Iran. The company also manufactures and installs point of sale (POS) devices. In other words, Zarefarid worked for a firm that offered services to Iranian banks for accepting electronic payments.

Update: In a post to the ircard blog, Zarefarid clarifies what he has done, and claims he is not a "hacker." (via "Khosrow Zarefarid, in the comments)

3 million bank accounts hacked in Iran (via /.)

Forever-day bugs

A nice piece of frightening securityspeak to conjure with: forever-day bugs, which are known bugs that the vendor has no intention of patching. These are often found in control systems, and are the sort of thing that Stuxnet exploited to attack the Iranian nuclear program. These controllers are also found on other kinds of industrial lines and, of course, in aircraft. "Forever day is a play on 'zero day,' a phrase used to classify vulnerabilities that come under attack before the responsible manufacturer has issued a patch. Also called iDays, or 'infinite days' by some researchers..." [Ars Technica]

Malware targeted at Syrian activists can operate webcam, disable AV, keylog, steal passwords


A fake PDF purporting to contain information on "the formation of the leadership council of the Syrian revolution" is circulating. As the Electronic Frontier Foundation's Eva Galperin and Morgan Marquis-Boire report, it's bad news for people who install it.

The latest surveillance malware comes in the form of an extracting file which is made to look like a PDF if you have file extensions turned off. The PDF purports to be a document concerning the formation of the leadership council of the Syrian revolution and is delivered via Skype message from a known friend. The malware installs a remote administration tool called DarkComet RAT, which can capture webcam activity, disable the notification setting for certain antivirus programs, record key strokes, steal passwords, and more. It sends this data back to the same IP address in Syrian IP space that was used in several previous attacks, including the attacks reported by CNN in February, the Xtreme RAT Trojan EFF reported in March, and this sample from March 21st.

Syrian Internet users should be extremely cautious about clicking on suspicious-looking links, or downloading documents over Skype, even if the document purportedly comes from a friend.

Campaign Targeting Syrian Activists Escalates with New Surveillance Malware

Shredding company's awesome logo


Snapped yesterday near my flat in east London, this Irish shredding company's logo on the back of their truck. Talk about "does what it says on the tin!"

Awesome logo on hard-drive-shredding service's lorry, Brunswick Place, Hackney, London, UK

Buy a ticket to HOPE in NYC and 10% goes to EFF

Emmanuel Goldstein writes, "The coordinators of this year's Hackers On Planet Earth conference in New York have joined forces with the Electronic Frontier Foundation and have designated April as the month where 10 percent of all ticket sales will be donated to EFF. The net would be a much more dangerous place without the EFF being around to help fight the many battles currently taking place. This is a way to help them out and be part of a really cool conference at the same time."

H.O.P.E. stands for Hackers On Planet Earth, one of the most creative and diverse hacker events in the world. HOPE Number Nine will be taking place on July 13, 14, and 15, 2012 at the Hotel Pennsylvania in New York City. If you haven't been before, this is the year to attend. For every ticket purchased in the month of April, conference organizers 2600: The Hacker Quarterly are donating 10% of the proceeds to EFF--so buy your tickets today!

For three full days and nights you can explore hackerspace villages, film festivals, art installations, vintage computers, electronic workshops, savor the country's biggest supply of Club-Mate, and attend the host of provocative talks that HOPE has become well-known for offering. Join thousands of hackers to hear this year's keynote on hacking corporations by famous troublemakers and EFF clients The Yes Men, as well as these exciting talks from EFF staffers...

Buy Your HOPE 9 Tickets in April and 10% of Proceeds Go to EFF (Thanks, Emmanuel!)

It's easy to get credit card numbers off used Xbox 360s


A group of researchers at Drexel University have demonstrated a method of recovering credit card details and other sensitive information from used Xbox 360s, even after they have been "reset to factory defaults." The method is straightforward and uses readily available tools. Ashley Podhradsky, one of the Drexel researchers, says, "Microsoft does a great job of protecting their proprietary information. But they don't do a great job of protecting the user's data."

Which is to say that Microsoft is spending a lot of money and resource in ensuring that your Xbox 360 only runs software that is authorized by Microsoft (like Apple and iOS and Nintendo and the Wii/3DS, Microsoft charges money for the right to sell software that will play on your device). But they don't pay any particular attention to protecting your interests as the owner of the device.

What's more, the Digital Millennium Copyright Act, which regulates the breaking of software locks, makes it illegal to investigate the internal workings of devices like the Xbox 360, and to publish the details of your findings, where those findings might also aid people in choosing to run unauthorized software on their own property.

Podhradsky, along with colleagues Rob D'Ovidio and Cindy Casey at Drexel and Pat Engebretson at Dakota State University, bought a refurbished Xbox 360 from a Microsoft-authorized retailer last year. They downloaded a basic modding tool and used it to crack open the gaming console, giving them access to its files and folders. After some work, they were able to identify and extract the original owner's credit card information.

We reached out to Microsoft for comment on this issue, but as of press time, they have not yet responded.

Podhradsky isn't even a gamer, she says. For seasoned modders and hackers, the process might be even easier.

"A lot of them already know how to do all this," she said. "Anyone can freely download a lot of this software, essentially pick up a discarded game console, and have someone's identity."

..."I think Microsoft has a longstanding pattern of this," Podhradsky said. "When you go and reformat your computer, like a Windows system, it tells you that all of your data will be erased. In actuality that's not accurate—the data is still available... so when Microsoft tells you that you're resetting something, it's not accurate. There's a lot more that needs to be done."

Hackers Can Steal Credit Card Information From Your Old Xbox, Experts Tell Us (via /.)

(Image: Red Ring of Death: RRoD 1 Microsoft Xbox 360, a Creative Commons Attribution (2.0) image from tomasland's photostream)