MiniPwner

I recently finished building my first MiniPwner – a tiny OpenWrt-based system for pen-testing. At only 2.25 x 2.25 inches, the device plus battery is still extremely small – it easily fits in a pocket, and could be hidden anywhere.

The device is based on the TP-LINK TL-WR703N, which uses a 400Mhz Atheros AR7240 CPU – not exactly a power-house, but enough power for standard pen-testing (or even just as a super-portable linux box). In cases where the 400Mhz CPU and 32MB RAM aren’t enough, you can easily use OpenVPN as a tunnel to run your tests remotely.

The total investment for the build was only $38 – though next time I’ll pay a little extra and get the 16GB drive – mostly for extra room when working with logs. The 4GB drive used in the standard build has plenty of room for the software – but I’d rather have the extra room to work with.

The build process was process was simple – thankfully the instructions are quite good, though I did have to change a few things to make it all work.

Step 1): To save looking, here’s a direct link to the OpenWrt image.

Step 4): I formated the thumb drive by mounting it in a Ubuntu VM, and used GParted to delete the existing partition, and created a 512MB swap partition, then the rest is ext4.

Step 16): Read step 17 first so you don’t feel so stupid for wasting time trying to figure out why step 16 doesn’t seem to do anything.

Step 21): I use WPA2 on my network, so I had to edit the /etc/config/wireless a little differently:

config wifi-iface
        option device   wlan0
        option network  wan
        option mode     sta
        option ssid     <ssid>
        option encryption psk2+tkip
        option key <password>

More information about the wireless setup can be found here.

Step 24): My local wireless network is in the 192.168.1.x range, so this wasn’t working for me. Seeing as changing the wireless doesn’t make sense for me (way too many static devices), I had to change the IP address of eth0 to deal with the issue. I updated my /etc/config/network to look something like this:

config 'interface' 'lan'
        option 'ifname' 'eth0'
        option 'type' 'bridge'
        option 'proto' 'static'
        option 'ipaddr' '192.168.2.1'
        option 'netmask' '255.255.255.0'

Once the change is made, you’ll need to execute /etc/init.d/network restart – then update your PC’s static IP address to “192.168.2.111” and reconnect your telnet session.

Step 27): When executing the installs I was receiving this error:

opkg_install_cmd: Cannot install package <package-name>

To correct this error, I had to run opkg update – after this the installs started working fine.

Step 27b): The install for samba2-client was failing, as there isn’t a package by that name – though samba36-client installed fine.

Overall, it’s a great little setup – I’m quite pleased.

Adam Caudill

Declaring War on Ransomware

It’s time for everyone from the industry, developers, and the government to declare war on ransomware and make it as hard as possible for them to ply their insidious trade. There have been false starts and baby steps, diligent fighters without enough resources, and vendors that have only given a nod to the issue. It’s time to use every tool reasonably available to stop this scourge. For so many in the industry that have dedicated so much of their time and effort to this fight, this statement may seem to diminish their efforts, but that is not my intent.

The Door to Nowhere

Today I was walking around, exploring the local downtown area, and I noticed a door. Or more accurately, what used to be a door, and the symbolism was too perfect to ignore. It’s a door to nowhere. A door once stood here, carefully built, thoughtfully placed, well crafted. Long ago someone decided that they didn’t want the door to exist anymore — so they filled it in. They made an attempt at reversing the decisions of the past to suit their desire at the moment — but they couldn’t.

Revisiting Snapchat API & Security

As Shapchat has increased in popularity, I’ve been asked several times to revisit my Snapchat API & Security post, to address the changes that they made in response to my complaints. So, here is it – sorta. I started making detailed notes and looking at the changes they made – but yesterday @tlack made that mostly irrelevant with his release of Snaphax, a PHP library to interact with the undocumented Shapchat API.

Snapchat: API & Security

Update 3: In 2014 the FTC filed a complaint against Snapchat for their failure to provide the level of security they promised. The findings listed below were sent to the founders of Snapchat, that email was quoted in the FTC compliant as proof that Snapchat was aware of these issues. Update 2: The Snapchat API has changed to address the issues I pointed out to them – and the new API has issues as well.

Slipping Past LastPass

Update: LastPass has confirmed that they’ll address this issue in the next release. Update 2: LastPass has addressed this issue in their new v2.0 release. There is still a way to bypass the password prompt in Chrome, but they will address that in the next release. Overall, it looks like we can close the books on this one. I’m a big fan of LastPass – it’s a great service that has impressed me every step of the way.