Smart meter hacking tool released

Termineter, an open-source tool designed to assess the security of smart meters, has been released


SecureState, an information security firm, on Thursday announced the public release of Termineter, an open-source framework written in Python that allows users to assess the security of Smart Meter utility meters over the optical interface. The company is calling it the first framework designed to give authorized individuals access to manipulate and test the security of smart meters.


You can check it out, as well as download it for yourself, over on Google Code. For the uninitiated, smart meters measure the amount of power and water being used in a home or business as well as gather other data. They send periodic reports back to the utility company for analysis.


Smart meters have been criticized by privacy advocates for tracking consumer actions while security researchers have warned about their potential for being exploited.


Here's the tool's official description:

Termineter is a framework written in python to provide a platform for the security testing of smart meters. It implements the C12.18 and C12.19 protocols for communication. Currently supported are Meters using C12.19 with 7-bit character sets. Termineter communicates with Smart Meters via a connection using an ANSI type-2 optical probe with a serial interface.

SecureState says it is releasing Termineter publicly to promote security awareness for Smart Meters and to improve security overall by providing a tool that brings basic testing capabilities to the community and meter manufactures. 


While individual users will require general knowledge of the meter's internal workings in order to use Termineter proficiently, power companies can use the framework to identify and validate internal flaws that leave them susceptible to fraud and significant vulnerabilities.


As with any release of a hacking tool, there are two sides of the same coin. On the one hand, Termineter should help companies find vulnerabilities and test their products. On the other hand, Termineter can also be used maliciously to modify consumer data, inflicting financial loss on one or multiple victims.

iPad security breach

AT&T Confirms iPad Security Breach


AT&T has confirmed an iPad security breach which computer experts say has exposed over 100,000 early iPad adopters to potential malicious hacking and spam, with those vulnerable including dozens of CEOs, military officials, top politicians and media personalities.

The security breach was discovered by a group calling itself Goatse Security, with the specific information exposed in the breach including subscribers' email addresses along with an associated ID used to authenticate the subscriber on AT&T's network, known as the ICC-ID. AT&T, the sole U.S. provider of wireless service for the iPad , said it had fixed the security hole by Tuesday after being contacted by Goatse Security.

"At this point, there is no evidence that any other customer information was shared," AT&T said in a statement. "We take customer privacy very seriously, and while we have fixed this problem, we apologize to our customers who were impacted."


Please refer here to read more details.

iPhone SMS database can be hacked

Security Researchers Hacked iPhone

The University of Luxembourg's Ralf-Philipp Weinmann and Zynamics' Vincenzo Iozzo chained existing code bits using the "return-into-libc" or "return-oriented-programming" technique to compromise the iPhone during the PWN2OWN hacking contest in Vancouver, Canada.

The security researchers were able to bypass the iPhone's code signing and data execution prevention technologies a year after previous contest participants were unable to hack into the device. Iozzo and Weinmann were able to execute code on the iPhone when a user visits a malicious Web site, and the attack code steals the iPhone’s SMS database.

Refer here to read more details.

Fully patched iPhone Hacked

Using all new ARM exploit - Entire SMS database hijacked

A pair of European researchers used the spotlight of the CanSecWest Pwn2Own hacking contest here to break into a fully patched iPhone and hijack the entire SMS database, including text messages that had already been deleted.

Using an exploit against a previously unknown vulnerability, the duo — Vincenzo Iozzo and Ralf Philipp Weinmann — lured the target iPhone to a rigged Web site and exfiltrated the SMS database in about 20 seconds. The exploit crashed the iPhone’s browser session but Weinmann said that, with some additional effort, he could have a successful attack with the browser running.

“Basically, every page that the user visits on our [rigged] site will grab the SMS database and upload it to a server we control,” Weinmann explained. Iozzo, who had flight problems, was not on hand to enjoy the glory of being the first to hijack an iPhone at the Pwn2Own challenge.

Please refer here to read more details.

Working the security drama queens.

Queens Wear Brown....

The Vista laptop also went down, the fault of Abode. The irony of Adobe being at fault is only compounded by the LookingGlass vendor of the week last week being Adobe. No NX, No ASLR, unsafe libraries, no cookie Adobe.



Only the Mac faithful could take something like a Macbook being hacked and turn it into a commerical for Apple products. It seems as if the Macalope is stumping for a job as Apple's Chief Security Officer or as Obama's running mate, I can't decide which.

"Plus, you hack it, you keep it. So, sure, everyone's trying to hack the Air."

He seems to imply that the only reason people were hacking Macs were they get to keep them. Since not everyone can live without the faux sexiness that is Apple, of course someone will find a way to go home with that hardware. He also goes on to explain the only reason "security researchers" are paying attention to Mac is that they are cool and we are not.