Monthly Archives: December 2014

security

The need for emergency access codes

dauod“I have nothing to hide.” is one of the more recent empty responses when conversing about privacy. We’re not all criminals, but we all have something to hide.

Whether it’s a snoopy spouse, an unfair employer or a threatening government cellphones are now -more than ever- secure from physical access. Having a pin code on your old nokia phone little over a decade ago labeled you as “paranoid”. Since smartphones are the equivalent of our parallel lives, they have more access to our information and thus are a much more sought after target to untangle ones “secrets”.

Recently, Time magazine published an article how iPhone’s fingerprint reader does not protect you against the 5th amendment, the protection against self incrimination. Key codes, luckily, do.

This would bare the question to allow multiple keycodes; one to unlock your data. One to censor it, and optionally to remove it. Say you have a smarthphone, and it’s code is 1111. You use it every day to access your contacts, emails and other data. You should be able to set up a 2nd passcode, say 1234 that would purge a certain set of data. In a riot, if the police asks for you to unlock your phone, you type 1234, and it shows a clean phone, filters out some of the questionable text and phone records you have.

code security

Brocade brute forcer

During a pentest, I needed to test a Brocade SAN Switch. Since the Java webstart was quite slow, and I couldn’t find another script – I quickly coded this together to brute force passwords:

brocade_brute.rb