Hacker Creates Tool That Disables Chip & Pin

The well-known hacker Samy Kamkar has a new tool developed by which he can disable the Chip & Pin feature on credit cards and it is possible to emulate credit cards and magnetic stripes. In this way, all credit cards and magnetic stripes of someone on one device can be stored.

It can also MagSpoof like Kamkar calls his creation, predicting credit card numbers and expiration dates of American Express. For this there is need a full credit card number, but it does not matter if this number ever reported missing in the past or has been reported stolen. MagSpoof is able to generate a strong electromagnetic field which emulates a traditional magnetic stripe card. Kamkar remarks that MagSpoof does not make it possible to use credit cards of others. Moreover, opportunities for American Express numbers to predict and Chip & PIN disable not in the present version has made ​​available to the hacker.

The device is therefore intended primarily for conducting research into magnetic stripes, micro controllers and electromagnetism. During the development of MagSpoof Kamkar discovered that he also Chip & Pin feature of the card can be disabling. If users with a debit card with Chip & PIN using their magstripe the payment will say that the user must map "dipping" for added security.

The information on the card Chip & Pin features is stored in the magnetic strip. Kamkar discovered that he can adjust this. As a result, it is possible to not be required for dipping to a card with Chip & Pin, while the transaction is carried out simply. In this way, the security measure may be bypassed. To help researchers away Kamkar the blueprint MagSpoof published as well as the software and required components. According to the hacker's machine is easy via an Arduino and other general parts to put together.

Hacker Can Now Access Remote BMW And Mercedes

The famous hacker Samy Kamkar recently a tool presented that he cars from General Motors could open remote start and has expanded its device, which also cars from BMW, Mercedes-Benz and Chrysler are no longer safe. This has Kamkar via Twitter announced.

Like General Motoros other manufacturers offer a smartphone app to locate car, open and start. It involves BMW Remote, Mercedes-Benz mbrace and Uconnect Chrysler. Kamkar developed for 100 dollars a small device, the OwnStar that a car or truck should be placed and the communication of the smartphone to the app to intercept.

The Ownstar consists of a Raspberry Pi and three radios and can occur as a friendly network. Once the user starts the app and the phone within range of the device is a man-in-the-middle attack is carried out to steal the user's credentials. Then this data via a 2G GSM connection is sent to the attacker. With the login information, an attacker then follow the car, open the doors, start the engine or to sound the horn or alarm.

The problem is that with the apps who do use SSL to exchange encrypted data, but the certificate not control well to ensure that there are also communicates with the real servers of the mobile service. General Motors fixed it the problem but Kamkar discovered that the problem with BMW, Mercedes-Benz and Chrysler plays. According to the hacker, the cars thus easy to fall into. Manufacturers are now working on an update, but that is not yet available. Kamkar advises car owners not to use temporarily the corresponding apps.

Hacker Makes Tool To Unlock GM Cars Remotely

The well-known hacker Samy Kamkar has a tool designed to cars from manufacturer General Motors (GM) are located remotely open and start. GM offers car owners a service called OnStar with which the car can be found via a smartphone app, opened and started.

Kamkar developed for 100 dollars a small device, the OwnStar that a car or truck should be placed and the communication of the smartphone to the app to intercept. The problem with the app is that SSL be used to exchange encrypted data, but the certificate does not correctly check to ensure that there is communication with the real OnStar servers.

The Ownstar consists of a Raspberry Pi and three radios and can occur as a friendly network. Once the user's GM Remote Link app launch and the smartphone within range of the device is a man-in-the-middle attack is carried out in order to steal the user's credentials. Then these data are from a 2G GSM connection is sent to the attacker. With the login information, an attacker then follow the car, open the doors, start the engine or to sound the horn or alarm.

Starting on distance is not possible, this is still requires a human operator. GM is now working on an update to address the problem, as a spokesperson of the automaker opposite Wired know. During the upcoming Def Con conference in Las Vegas will Kamkar provide more information about his attack. The following video shows already see a short demonstration.

Hacker Develops Device To Surf The Internet Anonymously

A well-known hacker has developed a device that users can go online anonymously, without their actual location or IP address to give up. The ProxyGambit of Samy Kamkar is an "improvement and reincarnation" of the ProxyHam. The ProxyHam would be demonstrated at the Defcon hacking conference initially, but researcher Benjamin Caudill concluded his lecture for letting off unknown reasons.

Also destroyed it all prototypes of the ProxyHam and announced that the software and blueprints of the device would not be published. The ProxyHam was a device that consisted of a Raspberry Pi computer with Wi-Fi card and three antennas. An antenna connection made ​​with an open Wi-Fi network, for example at a Starbucks or library, and two antennas that sent the data to and from the user via a 900Mhz frequency. A user could be at a position of 4 kilometers.

ProxyGambit

Kamkar, which in recent months regularly with all kinds of hardware hacks in the news came out, decided to develop its own solution based on the idea of ProxyHam. The ProxyGambit however, leave more space between the user and the used Wi-Fi network. The device supports both a radio link as a mobile bridge to connect to a Wi-Fi network. In the case of the GSM network can bridge the thousands of kilometers away there. Is made ​​using a direct link, the distance 10 kilometers.

Like the ProxyHam assigns the IP address that is visible to the outside world to the Wi-Fi network that uses the ProxyGambit. To connect to the mobile bridge, which used 2G, can be used as Kamkar a prepaid SIM card, which can be obtained anonymously. "In both cases, your connection proxied by local Wi-Fi networks in the vicinity of the unit, making it difficult to determine your actual location, IP and identity," Kamkar says.

The hardware for the ProxyGambit consists of an Arduino Nano, Raspberry Pi, GSM Fona, USB hub, wifi adapter, Ubiquiti Nano Station and a Power over Ethernet injector. The cost of the parts amounts include 200 dollars. The software for the device, the hacker on GitHub placed while a Linux image via Dropbox is available for download. Kamkar warns that this is still a "proof of concept" goes and users for whom privacy and anonymity is important to do further research.

Hacker Open Garage Doors With Children

The famous hacker Samy Kamkar, who recently in the news came with a robot that combination locks can crack, now has developed a tool to access remote garage doors, including a famous Dutch mathematician played a role. OpenSesame , as the tool is called, is actually a Radica Girl Tech IM-ME manufacturer Mattel and uses a new attack on wireless "fixed-peg" devices that discovered the hacker.

The vulnerable garage doors use weak security codes with a limited set of options. An attacker would have 12-bit garage, which supports 12 bits at maximum combinations (4096 combinations), open in 29 minutes. Kamkar first discovered a way to decrease the time required by a factor of five, so there were only six minutes required. Eventually he worked his assault to the "OpenSesame" attack, in which the work of the Dutch mathematician Nicolaas Govert de Bruijn played an important role. De Bruijn developed De Bruijn row . This algorithm is used by Kamkar concerned and, after some adjustments, he eventually all combinations in 8 seconds is recommended.

By adjusting the IM-ME, toys to children to be able to send messages to each other, it is also possible to carry out the OpenSesame-attack on garage doors. The problem is present in garage doors manufacturer Nortek and North Shore Commercial Door. The doors of manufacturers Chamberlain, LiftMaster, Stanley, Delta 3 and Moore-O-Matic were vulnerable, but the problem would be the latest models no longer play. Users of garage doors with "permanent codes" are advised to upgrade to a system with "rolling code", "hopping codes", "Security +" or "Intellicode".

The IM-ME is not available for sale in the shops, but still available through Amazon and eBay. Kamkar the source put online for toys, but adapted so that criminals do not immediately open doors with. The goal is also to educate users. Experts, however, the code can adapt so that it works completely. However, criminals who is an expert in radio frequency and micro controllers are would help anyway not have needed in the first place, as noted on the hacker. Below is a video of the attack is demonstrated.