Digital Weapons

a reply to: Jukiodone

The problem with vehicle ECUs is that there is ZERO encryption methods being used by ANYONE.

I will likely be making attempts to hijack the ECU in my vehicle..

a reply to: projectvxn

Some magic bytes to send in some cases, nothing more. You need the right interfaces, most cars work on a bus system with several control units. Of course you always need physical access at least once, then you can hook up a HF-module up to your interface and access it wirelessly, sending new firmware etc.

I do not know your technical background in computer systems but if you really want to get into this I strongly suggest you starting to learn phyton, c,c++, maybe some c# if you´re working on windows, makes life easier. Without any basic knowledge in programming you will have a really hard time. You always have to depend on other solutions thus you never gain the level of insight needed. Focus on the languages needed in the field you like, master them and a whole new world opens up for you, I promise. On your way you will establish connections if you ask the right questions at the right places.

a reply to: verschickter

Interestingly I am currently learning those languages.

Starting with with Python and moving to C++. Perl is a language I have some experience with already and have been using it to develop some automation scripts to update my little RPi cluster simultaneously without having to manually access each one to take advantage of the parallel processing power of the mini computers. That way each script I want to execute on the cluster will be migrated to the SD cards and executed immediately.

Like I said I'm diving in because I want to learn. Not just offensive security, but defensive security.

a reply to: projectvxn

That´s a good base!
I´m more into arduino at the moment, a client wants the arduino ports to be accessible as objects in c++ & c# and a GUI for more sophisticated I/O behavior, live values etc. Basically it turns any arduino into a little SPS with 4ms granted execution time resolution and threading. When I´m done with that I want to look into RPi for a multicopter project I want to implement some libs we developed at work some years ago, awaiting permission.. Currently I´m also working on an osmocombb related project (hardware ismi catcher-catcher), that would fit to the topic again. GSM related but it fits.

That´s also something for everyone that uses WLAN and mTan for mobile banking at home to consider. I´m living more rural and ismi catchers are not a problem here but they show up at an alarming rate in our bigger cities (Germany). Couple that with enough criminal energy and resources and you end up with empty online banking accounts.

If you find the work you´ve seen and researched since yet impressive, your mind will blow if you discover the U2U I send you with some keywords for research. I thought about posting it here but not sure about T&C and if it would be responsible, since google indexes this part of ATS.

a reply to: verschickter

I was thinking about using one of my RPi's for encrypted VPN usage and route all of my internet traffic through it. For banking on the internet and secure coms.

I haven't used other micro computers yet, but currently I haven't found one with the functionality of the RPi.

I haven't received any U2Us yet.

a reply to: projectvxn
A good intention. As long as your endpoint is not compromised or your own machine. It only takes one sneaky usb device and you can get into a lot of problems, for example.

U2U went out when you posted, it´s a little bit longer

Ah you´re bughunting, too it seems ;-) See what you did there. You can report it to [email protected].

a reply to: verschickter

Gotcha.

I haven't decided what encryption protocol to use yet.

AES, RSA or PGP sound good, but they've been cracked several times before.

Ah you´re bughunting, too it seems ;-) See what you did there. You can report it to [email protected].

Hah!

a reply to: projectvxn

Write your own and then encrypt it with aes is my advice. You need a server for that. The problem is, if you go unmanaged, you run into defending your dedicated server pretty soon against all kind of bots. If you go the managed route, you can´t be sure if they do the job with the updates and fixes at least and you know, there is always a way regardless of security measures. Running this stunt alone takes time and knowledge and is almost impossible. Costs aside...

A general advice, make yourself an algorithm that you can keep in your head to calculate pws on the fly if you asign short numbers or build some kind of logic tree in your head for account management. This way you have pws that can be the lenght of 30 chars for example -or more-, lacking words using the SHIFT periodic, that would be predictable and you do not have to learn them. Since the algorithm is in your head, no one can predict your passwords.