worst malware analysis ever

Symantec has decided that Lose/Lose is a trojan. It is, in fact, a video game that deletes files. The game's web site warns that the game deletes files. The game itself warns the player that it deletes files. There is nothing whatsoever malicious about a program deleting files after warning the user that it will delete files.

Why does Symantec (oh, Trend too) think this is malware? Because "there’s nothing stopping someone with more malicious intentions from modifying it slightly and then passing it on to unsuspecting users, causing significant damage to a computer." By that logic, rm should be considered malware because it could be modified (say, by renaming it) to delete files contrary to a user's expectation. Frozen Bubble must be malware too, because it could easily be modified to delete files!

ToorCon workshop

I'll be running a software radio workshop at ToorCon in October. It will be similar to the workshop at ToorCamp but with more electricity and less volcanic ash! With a more pleasant environment and more structured lessons, a greater amount of material will be covered.

building an all-channel Bluetooth monitor

video (179M) of my presentation with Dominic Spill at ShmooCon 2009 has been posted.

toorcamp badge hacking

The badges at Toorcamp were solder-yourself passive RFID detectors. With the jumper in one position, an LED lights up in the presence of 125 kHz signals (used by low frequency RFID tags). With the jumper in the other position, a second LED indicates the presence of 13.56 MHz signals (used by high frequency RFID tags and Near Field Communication).

The circuit is very simple. Each side consists of an inductive loop (of traces on the circuit board), a tuning capacitor (forming a tank circuit with the loop), and an LED. It is powered by the received signals (as are passive RFID tags). I've tested my badge by holding it up to both types of RFID readers, and it works perfectly. Unfortunately it only works at very close range, so it isn't the most useful device on its own. As a component in other circuits, however, the unit has great potential.

Thanks to some spare parts and excellent soldering equipment provided by my friends at the Dorkbot campsite, I was able not only to assemble the badge but to perform a simple modification that turned it into a low frequency RFID decoder (in conjunction with a laptop computer). All I had to do was attach a cable with an audio plug in place of the jumper. At the camp, I soldered the audio cable directly to the board, but I have since reworked it with a plug that can be removed or repositioned on the header.

125 kHz RFID tags (at least the ones I've had an opportunity to play with) use a double modulation scheme. The data signal is frequency modulated (FSK) in the neighborhood of 14 kHz, and then the resulting signal is amplitude modulated up to 125 kHz. One way to demodulate the over-the-air signal is to perform the whole process in reverse: undo the amplitude modulation to get back to 14 kHz FSK, and then FM demodulate back to the baseband signal.

The fist step can be done with a small analog circuit. The simplest way to demodulate an AM signal is to rectify the signal (only allowing current to pass in one direction) with a diode and then smooth the resulting signal with a low pass filter (which can be as simple as a single capacitor). This results in a waveform that represents the envelope, the amplitude variations over time, of the original signal. Lucky for me, the LED on the Toorcamp badge is a diode that rectifies the signal! With the badge plugged into a laptop's microphone jack, the sound card's anti-aliasing filter does the smoothing, and the resulting signal of approximately 14 kHz is within the range that the sound card can record.

The FSK demodulation can then be done in software, allowing the whole setup to act as a close-range RFID decoder. You could even plug the badge into a small audio recorder and decode recorded signals later on a computer.

This simple modification just scratches the surface of what can be done with the Toorcamp badges. Having RFID frequency tuned loops available to plug into your own circuits makes it easy to play with both reception and transmission of RFID and NFC signals. For example, at the camp I used a second badge plugged into a USRP in order to transmit the 125 kHz signal needed to excite an RFID tag for testing the decoder.

Thanks again to everyone who made Toorcamp possible and to all the new friends I made there, especially the Dorkbot campers. It was an incredible experience.

toorcamp awaits

Next week Dominic and I will reprise our ShmooCon Bluetooth talk at Toorcamp, North America's first hacker camp (which happens to be taking place at a defunct Titan-1 missile silo). The nice folks from DorkbotPDX have allowed us to join their campsite. While we're there we also plan to run a software radio workshop. It is high time that more hackers learn how to use this technology.

Black Hat video up

Video (warning! 283 MB!) of my talk, Software Radio and the Future of Wireless Security, at Black Hat USA 2008 is now available along with all the other presentations from the event.

Star Crossed

After four years of developing tools and techniques, three gloves and mittens cut by angle grinders, two broken slabs of ice intended for moving parts, one tool confiscated by the TSA, and zero broken beaks, we completed Star Crossed. The sculpture features a realistic penguin on the left and a mechanical penguin on the right. It is the first working mechanical ice sculpture that we have completed in the Single Block Classic.

The head of the realistic penguin is shown in this detail photo. We used two textures: scratched and transparent.

This shot shows the mechanism on edge. The head piece rotates on the upper axle and has a long slot that extends downward. The key on the lower axle turns a cam with a lug that rides along the slot. You can watch a video of the mechanism in action.

We carved Star Crossed in three days and had a great time doing it. Thanks to all the volunteers and sculptors at Ice Alaska who make the experience a fun one every year. Thanks to Sharon Hansen for the shooting the photos and video.