Hacking a TX (transmitter) from left handed to right handed

The following video shows how to hack a RC transmitter from left handed to right handed, or vice versa. It should work both for heli and airplanes. The video is made by Doc.eXe.

Actually, the transmitter can be configured in any way you like, mixing the channels to have the desired control under the hand you like (in some cases it needs resoldering). Another way is changing the channels on receiver. Also don't forget you can invert the channel, so when you move the stick up, the plain goes down, or up, the way you want it.

I added the video also on youtube, and it has a higher resolution: http://www.youtube.com/watch?v=JUqb6Undgr8

Microcontroller programming

it's over a month since i started playing with microcontrollers, and electronic stuff and i can't say the progress is impressive :). 

here is a little video of a finished demonstration, switching a red led on and off using bluetooth connection. 

the application on the laptop connects using bluetooth to the microcontroller and sends the "led1on" and "led1off" commands. the microcontrollre then responds with "led1 is on" and "led1 is off", and the application also benchmarks the time needed to send the command, and receive the response. the thing with a blue led is the LM400 bluetooth module with an unknown AT command set.

MD5 Collisions

Today i find the need to make a post on MD5 collisions as many people still don’t understand what it really is..

Just like all the rest i tended to believe that the method of finding collisions (described by Xiaoyun Wang and Hongbo Yu) can help make a 128 byte block that will have the same hash code as the hash code that i am interested in. That’s one of the last ferry tails from my youth that i believed till yesterday.

I’ve heard about MD5 collisions since the moment when first posts have appeared about a source code released in public domain. It was the time when i was experimenting with all dangerous stuff like delphi, c++ and asm mixed in one cocktail. Actually it came to my attention as i was trying to write a very fast implementation of MD5 that could be used for brute forcing and i was searching for any info on MD5. When i’ve read about collisions i thought that this is big.. that this will shake the world of web sites, when lots of guys had MD5 hashes hacked from engines like forums, or CMS, and were searching for a way to brute force them. After almost 2 years of believing that collisions can break a hash code, i finally realized that i was wrong.. and i do admit it. There were lots of discussions on forums like what to do with the user databases, how to migrate to a different hashing method, and guys from the other camp asking how to use the collision sources. How naive it was..

The truth

The source code (released by Xiaoyun Wang and Hongbo Yu) won’t generate a block that has the same hash code (unfortunately).. By using this code you can make 2 files that will have the same hash code. All the basic idea is described in this article that i find really nice http://www.mathstat.dal.ca/~selinger/md5collision/.

So to all web admins, web developers and so on, stop freaking out. MD5 passwords still can be cracked only by brute forcing or Rainbow Tables.

google.com or the Google Empire?

I would really like someone to tell me where to start this little story, but since there is no one to do that I'll start it somewhere..

intro (kind of)
Once upon a time, there were 2 guys who said: "Hey, let's do a web search engine!", so the google.com was born. As google was growing he realized that just searching stupid stuff for people is too small for him. He began expanding, offering people more services, telling people that web is good, web is best. In his still immature mind a great idea was born, he knew, there must be one day when people, without realizing that, won't be able to exist without him.

next the story follows from the point of a paranoid mind (or simply part I)
I don't know anyone that doesn't use google. The least, everybody does googling (this term is already added to some important dictionaries). Most of my friends have gmail accounts, and most colleagues at work use gtalk.
When saying google, first thing that comes in mind is the page where you enter the words for your search.
But what is "google"? Did you ever thought about google as a threat? I bet not.. Still when gmail was just at it's start there were concerned voices talking about privacy, the fact that google will use content from the mails to show targeted ads (some of you may remember that there were ads in the gmail).
So lets start expanding the understanding of google. Yes, it is a search engine; yes, it also has a mail service; yes, it helps you post ads all over the internet; yes, it shows you ads when you are not in the mood for them. But hey, that's no secret, just about everyone knows that. But have you heard about Google Analytics?
Google Analytics is no intelligence agency (or is it?), just a service for tracking statistics for your site, like from what geographic region are the most of your visitors, the language they speak, time zone and other stuff like that. It is supposed to help you know better your target audience. Do you see any evil in that? I think i might like that kind of statistics on my site. Still, there is one little thing that bothers me.. When someone enters a site with GA, he can be easily tracked on all other sites with GA. I mean, that GA will know that a user that entered a site about cars, also visited a site about motorcycles and also a store with sport equipment. But hey, that's not a problem right? The most they got is an IP, which can change. Hm.. on a second thought, it's enough that you log into your google account (it can be Gmail, or blogspot), you will be identified in the GA, and all your browsing history will be assigned to your account. To make it short, YOU'VE BEEN TRACKED DOWN!
Just to add a little bit of salt and pepper, every time you visit a web site with AdSense ads on it, you are also tracked. There is nowhere you can hide (actualy there is but it's not in the scope of this little post).
Almost forgot.. Google also offers a service called Web History. It is supposed to help you track the sites you visit, to get statistics about your web activities. But once again, it will help track even your slightest move. I think my paranoia is getting worse..
What should I continue my story with? May be AdSense? I don't think there is one man on this planet that is using internet, that hasn't seen the Google AdSense ads. One thing that makes it one step ahead others is that these ads are targeted by the contents of the site they are placed on, ads related to cars on a site about cars, etc. What evil is in that? None I say. None till you read what I've wrote about Google Analytics. When talking about ads, there must be lots of analytics! First step in AdSense was to relate the ads to the sites they were placed on, next one is to relate the ads to your personal preferences.
Here is a scenario: you google around for the new BMW X5. Find websites with reviews and start reading, watching galleries. The websites you entered on have GA, and all your moves are tracked and registered, attached to your personal record. Next site you'll visit will have ads with a local BMW dealer offering the best prices around for the model you've been investigating. (didn't i tell you that by your IP it's easy to know in what town you are? But there is no need for that, you've probably entered your location in your gmail account).
But that was a very simplified scenario, I'm afraid I don't have enough imagination to figure out all the possible ways to use the analytics in more efficient advertising and not only..
With the resources that google has, it is possible to create engines that will analyze and identify the general sense in a web page, not just the most repeated words and words related by meaning or domain. It's scaring what potential it has if applied with bad intention..

I said nothing about the privacy of your information.. till now.
Are you using gmail? How about Google Calendar? Picasa may be? Have you set info about your credit card for a fast Google Checkout? Whell.. can you at least imagine how much information google has about you? They've got your credit card that ensures your real identity. All your e-mails, and id's of the friends you are mailing with. They've even got your foto, and fotos of your friends. And your callendar, and your Google Notepad with all your private notes.. That's what any inteligence agency allways dreamed of (and is ready to kill for)..

part II
Enough with bad guys, let's assume (completly theoretical), that google is no evil corporation. Let's assume that there work only nice guys, that really care about you, your privacy and not the bilions they earn.
In that case the whorld is still full with people willing to get access to your account and to the information you have there.
As threat number 1 I'd call the social networks, dating sites and all the crap of this kind. Scenario: the bad guy (it's not necessarily a bad guy, may be it's me doing a PoC), creates rapidly a dating site (it's quite easy you know, with all these templates and ready made scrips), then sends spam to about 1M addresses of gmail offering to join the dating site for free. A innocent victim enters on the site and begins registration. At one step, he/she is asked to enter the gmail/yahoo/hotmail account so the system will synchronize with his/her contacts automatically. Got it? Once gaining the account and the password the attacker has control to all data not just contacts and e-mails. If the info for credit card is set, the attacker can change the default shipping address and make orders online.
In this kind of attack once it's started the number of victims raises exponentially (until one point), because having access to the contacts, the system without asking the victim will send invites from the victims name to all the addresses in it, asking to join the dating site. What will you do if you get such an invitation from one of your friends?
So for the sake of the God of computers, DO NOT EVER GIVE THE PASSWORD FROM YOUR GMAIL ACCOUNT! Not to me, not to any site that asks for it!

outro
After all said and done.. The problem is that with one name and password you can access a lot of services, and all provided by one company. If password to your e-mail has been found you're in trouble. Google promises to protect your data, but.. Quis custodiet ipsos custodes?

Web charting? Piece of cake

You are still trying to figure out how to build charts with php? It's so last week..
Today, sniffing around, i got on the http://code.google.com, and discovered Google Chart API, which caught my attention from the start.
What google offers is a simple way to build charts, just with a request. Best example:The request behind this chart is: http://chart.apis.google.com/chart?chs=300x200&chd=s:MiMImia&
cht=lc&chxt=x,y&chxl=0:|1|2|3|4|5|1:||50+Kb

Now an example of access statistics, that is customized for our site:
So it has the same color as we use, and it has some nice bars (the white margins are not part of the chart, just can't figure out how to remove them:).
Let's dissect it and see how it's build:
http://chart.apis.google.com/chart? - the base request
chs=300x200 - chart image size
&chf=bg,s,CCDDBB - background color, in our case same as the blog.
&chd=s:MiMImia - this is the chart values, each character encodes a value from 0 to 61. There are more options.
&cht=bvg&chbh=20 - the type of chart (vertical bars) and their width
&chxt=x,y - axes
&chxl=0:|1|2|3|4|5|6|7|1:||50+Users|100+Users - the notations on the axis.

It looks pretty simple, doesn't it?
This is just a very basic example. You can chose from different chart types, coloring, sizes, etc. Perfect for small projects when some basic charting is needed.
But (there is always a but), you are limited by the URL length (if you are curios to know what is the maximum URL length: http://www.boutell.com/newfaq/misc/urllength.html), thou you will be able to show statistics for about 100 of your users for sure..