Watch hulu.com outside the US on Mac OS X

2009-01-05T06:26:00.000-08:00

It's fairly easy to go around most ip geolocation systems like on pandora.com, you just need a proxy located in the US.

But hulu.com made it a bit trickier, by using Flash's RTMP connection to get the real IP of the viewer. Using a socks proxy inside your browser won't be enough to get around this. We need a way to "socskify" transparently the whole browser. This way all the tcp connection (including flash RTMP) will appear to come from the US.

I tried tsocks/dsocks/dante from macports, none of them worked well.
I finally found proxifier a native cocoa application which let you tunnel a whole application through various kinds of proxies.

Let's see how this works:
A friend of mine gave me an access to a ssh server in the US. I use it as a local socks proxy.
But you can probably use any public http or socks proxy located in the US.

First create an local socks proxy on the port 8800 using ssh. In a terminal type :
ssh -D 8800 USER@SSH_SERVER_IN_THE_US
Leave the terminal open.

Then go to Proxifier > Options > Proxy Settings > Add
Add the address, port, andtype of the proxy you want to use.
In this case, localhost:8800 and socks5

Finally go to Proxifier > Options > Proxification Rules
Select "Process Only the Following" option and add a rule for the applications you want to tunnel through the proxy (by default it'll try to socksify everything, and in my case I need the ssh connection to be direct).
The configuration should look somewhat like that :

That should do the trick, you can now enjoy your favorite series.

Caffe Latte

2008-10-14T12:42:00.000-07:00

DISCLAIMER: This discussion is only for academic research around the model of security implemented by WEP. I do not encourage you to break the law and gain unlawful access to protected network.
The source code provided is only a demonstration, and is not by any mean a practical attack.

During the ToorCon 9, security researcher Vivek Ramachandran exposed an innovative attack to compromise wep protected WiFi networks.

This attack called Caffe Latte targets clients of the network instead of the AP, also there is no need to be close to the network to recover the wep key.
Let say you have the wep network you usually connect to on top of your preferred network and you boot your computer next to a "Caffe Latte enabled" laptop, in a starbucks for example it will lure the client into thinking it's the AP of that network. Then in about 7 minutes, the time it will take you to drink your coffee the wep key can be recovered.

Here is my attempt to make my own working implementation of Caffe Latte :

How it works

Here you can download the presentation made at ToorCon by Vivek.

To summarize :

First you need to lure the client into associating with your wep enabled AP, it needs to have the same SSID.
Once the connection is established a Windows box will try several different things untill it will send a Gratuitous ARP
Even though the packet is encrypted, it is easy to determine that it's the Gratuitous ARP (destination address, size of the packet)
Using the techniques described in The Final Nail in WEP's Coffin, we can change bits in this packet and still have a valid packet (we still ignore the key). We then craft an ARP that the client will respond too.
We then send this crafted packet over and over, in order to gather several thousands of responses.
Using tools such as Aircrack-ng we can there recover the key.

How I implemented it

This will most likely work only with wifi adapter using the madwifi-ng driver.

The first part is to lure the client into associating with us, I used a patch for the madwifi-ng driver from KARMA (a rogue access point project), which will allow the creation of an 802.11 Access Point that responds to any probed SSID. (I modified the patch to work with the actual driver)
Another patch needs to be applied in order to be able to inject 802.11 frame with the network adapter, this one is found in the Aircrack-ng suite.
I then used Lorcon which is a "generic library for injecting 802.11 frames, capable of injection via multiple driver frameworks" to develop the real Caffe Latte attack.

Here you can download a demo implementation of this, including source code, patches and directions if you want to try it.

Matthieu Tourne - Random Stuffs

Watch hulu.com outside the US on Mac OS X

Caffe Latte