Gone in 2 Seconds : Tesla Model S Hack

KU Leuven researchers found that Tesla uses a keyless entry system built by a manufacturer called Pektron, which uses a weak 40-bit cipher to encrypt those key fob codes.

The researchers made a 6-terabyte table of all possible keys for any combination of code pairs, and then used a Yard Stick One radio, a Proxmark radio, and a Raspberry Pi mini-computer, which cost about $600 total—not bad for a Tesla Model S though—to capture the required two codes.

With that table and those two codes, the team says it can calculate the correct cryptographic key to spoof any key fob in just 1.6 seconds. To understand more clearly, you can watch the proof of concept video demonstration which shows the hack in action.

The team reported the issue to Tesla last year, but the company addressed it in June 2018 by upgrading the weak encryption. Last month, the company also added an optional PIN as an additional defense.

Tesla Paid $10,000 Bounty to the Researchers

After the story broke, Tesla was criticised on Twitter for using a weak cipher, though a member of the KU Leuven team appreciated Tesla for quickly responding to their report and fixing the issue,, on the same time, accused other vehicle makers using keyless entry techhashtag

Google Fixes 40 Security bugs in new Chrome Updates for Windows, Mac, Linux, Android

A new version of Google Chrome is rolling out to Windows, Mac, Linux, and Android over the next few weeks, the company announced this week.

Chrome version 69.0.3497.81 is being promoted to the stable channel for Windows, Mac, and Linux. The update packs 40 security fixes, including patches for vulnerabilities an attacker could abuse to assume control over a target system, according to a US-CERT advisory on the update.

In addition to Google's security team, many of the bugs were detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.

Chrome for Android 69 (69.0.3497.76) has also been released and will be available on Google Play over the next few weeks, Google reports. The 10^thanniversary edition aims to improve mobile payment security with third-party payment apps, password generation on more websites, stability and performance improvements, and a cleaner modernized design.

Read more details here.

Time to change your password: Air Canada has locked down all 1.7 million accounts

Don't be surprised if If you are not able to login to air canada mobile app as Air canada has lock down al of its 1.7 million users in response of a breach detection which impacts it's 1% users which is around 20000 users.

  Air Canada said that detected unusual login behaviour with Air Canada’s mobile App between Aug. 22-24, 2018. We immediately took action to block these attempts and implemented additional protocols to protect against further unauthorized attempts.
Air Canada has confirmed a data breach that may have 1% users from 1.7 million mobile Mobile app users which is about 20000 users.
So what has been exposed and what not : any thing which is stored in your  profile could be accessed by the attackers
1. Credit card information: It is encrypted so even attacker access it they may not be able to use it
but as precaution keep an eye on your credit card bill for any unusual activity
2. Passport number :  yes
3. Aeropplan number : yes
4. Aeroplan Password : no
5. Personal information: like date of birth, gender ,NEXUS number etc that you have saved in your profile

What user can do now: 

1. Mobile app itself is secure so you can continue using it
2. Change your password
3. Be Aware of Phishing email that can lead to other problems always verify any password change
email and make sure its from the Air Canada
4. Keep an eye for any unusual activity on ur credit card & Aeroplan transaction
5. Change password from other site as well if same password has been used

S

SPONSORED

Tug of War: Researcher released POC for Windows Unpatched Zero Day

Researcher named SandboxEscaper Disclosed a zero-day vulnerability, without notifying Microsoft which is very rare now days. Its not clear what trigger this action from researcher as now a days MS is very friendly with researcher . This Disclosure leaving all Windows users vulnerable to the hackers until a security patch is release by the tech giant to address the issue..

The vulnerability is a privilege escalation issue which resides in the Windows' task scheduler program and occurred due to errors in the handling of Advanced Local Procedure Call (ALPC) systems.

Advanced local procedure call (ALPC) is an internal mechanism, available only to Windows operating system components, that facilitates high-speed and secure data transfer between one or more processes in the user mode.

Since Advanced Local Procedure Call (ALPC) interface is a local system, the impact of the vulnerability is limited with a CVSS score of 6.4 to 6.8, but the PoC exploit released by the researcher could potentially help malware authors to target Windows users.
Here is POC demo

NEwspaper

Father's Wish list for baby handling hack

Being a new father bring many challenges, though every dad wants their child to be happpy & play with innocent once but they also deal with many boring stuff .Apart from sleepless nights dad need to learn many new skill e.g. how change diaper, feed baby  understand what is meaning of baby cry .

being a programmer  and hacker we can automate and hack many boring stuffs at work  . So i am also lookin forward some hack around baby handling and here is my top wish list .

Diaper changer:  An automatic diaper changer robot that can change baby diaper in schedule interval . you dont want your baby to be made  neother want to have rashes. Some time baby dosn't cry even it's too wet .

Diaper Wet indicator: if robot is not fasible or too costly then a simple device that send a message to parents when diaper is wet enough to change.

Soother insertion: voice activated soother insertion device that automaticaly goes to into baby mouth whenenver they cry and use very gentlr push if baby take the soother in then great else message to parent so they can see if any thing else need to do calm baby.

Auto milk feeder: This will need a process to warm enough bottled milk and then send to baby mouth with same technique as soother inserter. in this device milk uantity need to be controlled.

Cry activated messanger service: Most baby monitors are dependent on wifi connection or master slave device with short rang . imagine you left your baby with a day care rpovider how do u monitor if care provider doing good job ? a device which will recognoze baby cry and send message if it don't stop in certain time so parents ca call back to check thee loved once wellbeing.

Oopss! HBO Itself Accidentally Leaked 'Game of Thrones' Season 7 Episode 6

Oopss! HBO Itself Accidentally Leaked 'Game of Thrones' Season 7 Episode 6

HBO Spain appeared to have accidentally broadcast the next episode—Episode 6—of Game of Thrones season 7 five days before its official premiere.

And as expected, the GoT episode 6 quickly began circulating online.



ere's what HBO has to say about the latest leak:

"We have learned that the upcoming episode of Game of Thrones was accidentally posted for a brief time on the HBO Nordic and HBO España platforms." 

"The error appears to have originated with a third-party vendor, and the episode was removed as soon as it was recognized. This is not connected to the recent cyber incident at HBO in the US."

Short footage and GIFs from the GOT S07E06 was started circulating on YouTube, Reddit, Instagram, Twitch and other streaming services.

The episode 6 of "Game of Thrones" will officially be premiered on Sunday at 9 p.m. on HBO.