Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
×

Comment Re:The most used ten chords (Score 1) 576

I just can't help myself....this will either torture you, or amuse you (maybe some twisted combination of the two). I also am not really much of a fan of Death Metal. Every once in a while, there are a couple of bands that make some decent stuff, but I definitely can't listen to it for extended periods, and a LOT of the stuff coming out now is very trite.

There's a band called Six Feet Under that has a whole series of albums called "Graveyard Classics" and it's literally them doing Death Metal cover versions of Classic Rock songs. It is utterly ridiculous. I defy you to listen to some clips and not wince or burst out in laughter.

Smoke on the Water
Purple Haze
Back in Black

By the way, before anyone mistakes me for a fan, I heard these one morning listening to Howard Stern. He has a guy on his show that is a pretty well known drummer in the Death Metal circles who brought in clips of this stuff for everyone to goof on.

Submission + - Black Hat hacker gains access to 4 million hotel rooms with Arduino microcontrol (extremetech.com)

Joe_Dragon writes: "Black Hat hacker gains access to 4 million hotel rooms with Arduino microcontroller

        By Sebastian Anthony on July 25, 2012 at 7:00 am
        5 Comments

Cody Brocious opens an Onity hotel lock with an Arduino microcontroller
Share This article

Bad news: With less than $50 of off-the-shelf hardware and a little bit of programming, it’s possible for a hacker to gain instant, untraceable access to millions of key card-protected hotel rooms.

This hack was demonstrated by Cody Brocious, a Mozilla software developer, at the Black Hat security conference in Las Vegas. At risk are four million hotel rooms secured by Onity programmable key card locks. According to Brocious, who should be scolded for not disclosing the hack to Onity before going public, there is no easy fix: There isn’t a firmware upgrade — if hotels want to secure their guests, every single lock will have to be changed.

The hack in its entirety is detailed on Brocious’s website, but in short: At the base of every Onity lock is a small barrel-type DC power socket (just like on your old-school Nokia phone). This socket is used to charge up the lock’s battery, and to program the lock with a the hotel’s “sitecode” — a 32-bit key that identifies the hotel. By plugging an Arduino microcontroller into the DC socket, Brocious found that he could simply read this 32-bit key out of the lock’s memory. No authentication is required — and the key is stored in the same memory location on every Onity lock.

ArduinoThe best bit: By playing this 32-bit code back to the lock it opens. According to Brocious, it takes just 200 milliseconds to read the sitecode and open the lock. “I plug it in, power it up, and the lock opens,” Brocious says. His current implementation doesn’t work with every lock, and he doesn’t intend to take his work any further, but his slides and research paper make it very clear that Onity locks, rather ironically, lack even the most basic security.

I wish I could say that Brocious spent months on this hack, painstakingly reverse-engineering the Onity lock protocol, but the truth is far more depressing. “With how stupidly simple this is, it wouldn’t surprise me if a thousand other people have found this same vulnerability and sold it to other governments,” says Brocious, in an interview with Forbes. “An intern at the NSA could find this in five minutes.”

That is how he justifies his public disclosure of the vulnerability: If security agencies and private militias already have access to millions of hotel rooms, then this is Brocious’s way of forcing Onity to clean up its act. By informing the public, it also means that we can seek out other methods of securing our rooms — such as chain- or dead-locks on the inside of the room.

As for how Onity justifies such a stupendously disgusting lack of security, who knows. Generally, as far as managerial types go, securing a system seems like a frivolous expense — until someone hacks you. In non-high-tech circles, hacks like this are par for the course — usually, a company doesn’t hire a security specialist until after its first high-profile hack. For a company that is tasked with securing millions of humans every night, though, it would’ve been nice if Onity had shown slightly more foresight."

Now there should be a harder way to get to the ports even having them under a screwed in panel or use a custom port that only the lock maker and hotel have. can make it harder and take more time to brake in.

Comment Re:there are signs (Score 1) 627

The ONLY thing they can do is to call the police. They do not have any other right

That is also the case in the US. Private security, AKA "rent-a-cops" have no rights beyond any other private citizen.

You are incorrect. While not the case for ALL private security companies, there are many that have been granted police powers. There are privately run prisons that are staffed by employees of that Security Company. Even internationally, we use private "security" companies with significantly more "police power" than your average citizen (i.e. Blackwater/Xe). I'm not saying I agree with this, just that it is indeed the case.

Comment Re:Whats the difference... (Score 1) 486

BMW has an entry-level model that allows people who can't actually afford their cars to get their cars. This is not the case with Mercedes.

Not true. Mercedes also has a lower end model that is comparable with other new sedans. Heck, there are pickup trucks that cost more than this one.

With that said, I don't disagree totally with the point you're making. I think way too often, the attitude of the folks driving these cars has more to do with how they want to be perceived (i.e. powerful, wealthy, stylish, etc) than anything else.

Comment Re:They cost about $79 (Score 1) 448

I generally agree with you. My advice (as a musician) is to consider visiting a Guitar Center or Sam Ash and checking out the "pro-audio" headphones in their Recording section. The Sam Ash near me probably has around 30 to 40 different headphones that you can try on and listen to (they're all receiving the same music, so you really get to try them out). It's really great for contrasting and comparing. As you can see here , there are plenty to choose from in the $50 range.

Just to throw in my 2 cents, if you're willing to shell out $50 more these KRK headphones are fantastic. I use them in my home studio all the time. They're very comfortable and I find their response to be pretty impressive. I find them adequate for composing everything from orchestral scores to the craziest dub-step mashups you can find, so I think you'd be pretty happy with them.

Comment Re:Oblig Buddhist response (Score 1) 573

Buddhism is not Christianity. It's medieval Catholicism in which the patent lawyers and company executives would spend eternity in a nasty place

Nope, that's not quite right either. I agree with the "There is no good or bad karma, there is only karma", but karma still isn't some sort of cosmic justice. It works a lot differently.

Slashdot Top Deals

"If truth is beauty, how come no one has their hair done in the library?" -- Lily Tomlin

Working...