I’d like to gather input from those of you who work or have interaction with this field, and I bet an interesting list may result. I’ll post my suggestions in comments as well, and a running list can be started.

Then, when we get enough good ones, I’ll throw a board together if it looks interesting.

Here is the abstract, to give you a brief overview of our work:

“Here we present methods for injecting raw frames at Layer 1 from within upper-layer protocols by abuse of in-band signaling mechanisms common to most digital radio protocols. This packet piggy-backing technique allows attackers to hide malicious packets inside packets that are permitted on the network. When these carefully crafted Packets-in-Packets (PIPs) traverse a wireless network, a bit error in the outer frame will cause the inner frame to be interpreted instead. This allows an attacker to evade firewalls, intrusion detection/prevention systems, user-land networking restrictions, and other such defenses. As packets are constructed using interior fields of higher networking layers, the attacker only needs the authority to send cleartext data over the air, even if it is wrapped within several networking layers. This paper includes tested examples of raw frame injection for IEEE 802.15.4 and 2-FSK radios. Additionally, implementation complications are described for 802.11 and a variety of other modern radios. Finally, we present suggestions for how this technique might be extended from wireless radio protocols to Ethernet and other wired links.”

This work stems from some of my research with 802.15.4 security, and specifically some of the tools I produced (Scapy dot15d4, KillerBee extensions, Tmote GoodFET firmware, etc) were used in testing this theory and creating and verifying the results in the paper.

I look forward to discussing this paper more with interested parties, and if anyone wants to discuss it, please contact me.

USENIX WOOT 11 PIP

UPDATE: Video of Travis presenting our paper at USENIX WOOT.

Travis has introduced some of the GoodFET port to this platform on his post, and basic installation is covered on the appropriate GoodFET hardware page. I encourage you to read those — I won’t repeat everything here. Instead, I’ll focus on one of the parts of code I wrote, specifically the port of the TinyOS demonstration code RadioCountToLeds. In order to test and validate the GoodFET firmware’s compatibility with other OS (motes typically run OSs like TinyOS or Contiki, which have more feature bloat than GoodFET), Travis suggested that I port the RadioCountToLeds application — specifically the transmit end — to the GoodFET. All code for the GoodFET project consists of “hacky” code in files like goodfet.ccspi, and the more refined library code in files like GoodFETCCSPI.py. As features mature and are tested, they are moved into libraries.

The RadioCountToLeds code basically requires two devices to be flashed with it, and they maintain a 4Hz counter  broadcasting the value of the counter in an AM packet (a TinyOS abstraction that I find quite frustrating when trying to work with real 802.15.4) over the radio to the other device. The receiving device displays the lower 3 bits of the counter received on it’s three LED lights (built into mote design boards). This basically validate AM communication and timers for the TinyOS system.

So, how do we pretend to be a TinyOS RadioCountToLeds transmitter? There are two ways, each of which I implemented in goodfet.ccspi (run with verb txtoscount -i or -r). First, we could just send messages at a set interval with different counter values (-i option). The key is that we wanted to make sure that GoodFET was forming valid packets that would be accepted by the receiving TinyOS node. From capturing a TinyOS packet (using KillerBee which is my main research focus or using the goodfet.ccspi sniff command), we see that the application is sending packets like:

[0x0f, 0x41, 0x88, 0xFF, 0x22, 0x00, 0xff, 0xff, 0x01, 0x00, 0x3f, 0x06, 0x00, 0xFF]

The second way to play the RadioCountToLeds game is closer to what the actual TinyOS application does, and this is accessible with “goodfet.ccspi txtoscount -r”. It waits for an incoming packet from a real TinyOS node and then replays this over the air. Simple enough. The key with receiving is making sure that the CC2420′s registers are set (ex disable/enable auto-CRC and address validation) correctly to receive the packets. Also note that the CC2420, if auto-CRC is on, changes the FCS bytes in the incoming packet to communicate other information (link quality, RSSI, and one bit to say if the FCS was correct). So, we truncate the incoming packet to only have the MAC header and data payload (aka chop off the FCS data) before re-playing it as auto-CRC is enabled on CC2420 (using the GoodFET function RF_autocrc(1) to set it) and it will recalculate and append the FCS for us.

That is just a brief intro of how the GoodFET firmware and client scripts can easily enable transmit and receive over 802.15.4. I’ll get around to writing more about my work with parsing/generating 802.15.4 frames (see my commits to scapy-com) and some other work with the GoodFET and KillerBee projects to bring 802.15.4 capture and injection to this platform (via killerbee/dev_telsob.py driver support).

Contact me with questions, comments, etc.

Disclaimer: Before modifying your phone, please make sure that doing so does not violate your contract, corporate IT policy, or any laws. This information is provided only as a reference, and should not be used unless you are allowed to modify your phone’s OS. Also, make sure you understand what is going on — this information is provided without any warranty or guarantees!

1. Download MyBackup from the Android Market, and install it.
2. Run MyBackup, select “Backup” and then “Applications” and then “Local (SD Card)”. Select the applications you want to backup the packages for (you may not want to backup everything… installing some new may be better…)
3. After the Applications backup finishes, click OK and then select “Backup” > “Data” > “Local (SD Card)” again. Select the data you want to backup from the list. If your contacts are all synced to Google, you shouldn’t need to backup stuff like these or your calendars, but it may not be a bad idea to just in case. After the Data backup finishes, click “OK”, and quit MyBackup.
4. Now you need to gain full access to your phone. Thanks to the developer jcase, Eclips3, and TeamAndIRC’s post. Please read it so you see what they have to say and their license on the program they released. Here is what I needed to do.
   • “download and install this apk http://dl.dropbox.com/u/8699733/erisone010.apk – VERSION 0.1.0″
   • After installing, open the program “Eris Rooter”, read the disclaimer, and click “I agree, Root Me.”
   • Reboot your device (Press power button for a second, then click Shutdown from the menu that appears. Once phone is off, press the power button to turn it back on, and wait for the startup to complete)
   • Shutdown your phone.
   • Hold the Volume UP key (and continue holding it), and press the power button to boot into recovery.
5. From the Recovery menu, move down to “Backup/Restore” and then select “Nand backup” using the trackball click. Click trackball again to confirm… and wait… until it says “Backup complete!”. Press Volume DOWN, and then click on “Reboot system now”.
6. Connect your phone to your computer via USB. If your phone hasn’t prompted you, go into your notification bar (drag down the bar at the top of your screen) and if you see “Charge only” or “HTC Sync” click on it and change it so that it is “Disk drive”. Your computer should soon mount the phone’s SD card as a drive (mine named it “NO NAME”, but it mounts!)
7. Drag over the backup files to some directory on your computer, just for extra safe keeping. Techically you don’t need to do this… but why not? I dragged over “rerware” (MyBackup’s creation) and “nandroid” (from the full phone backup).
8. Get the new ROM that you want from the internet. Here one option is KaosFroyo. I used the latest version that was there, which was version 38. Download the ZIP file to your harddrive, and then drag it over to the phone’s SD card.
9. Turn off your phone.
10. Power up your phone in recovery mode (as described above).
11. Select “Wipe”
12. Select “Wipe data/factor reset”, and confirm.
13. Once done, select “Wipe Dalvik-cache”, and confirm. Once done, hit the Volume DOWN button to get to the main menu.
14. Select “Flash zip from SD card”, and select the ZIP file that you just put on your phone. It will ask you to confirm… and then wait…
15. When it is done, select “Reboot phone now”
16. Once your phone is up, you should see an intro configuration screen, etc. Do this.
17. I suggest reinstalling applications direct from the Android Market instead of restoring from MyBackup. However, if you want data/applications that you saved beforehand using MyBackup, just download this from the Android Market and run it in “Restore” mode.

If anything goes terribly wrong, this is why you made a Nandroid backup, so just boot into recovery mode and do Backup/Restore and then Nand Restore. Hopefully you won’t need that though!

So, all I wanted was to grab a user’s public photos from Flickr (by username) and then allow someone to easily display one (or many). Lets look at how you use the classes:

        require_once("photosFlickr.php");
        $flickrphotos = new photosFlickr($flickr_username, "YOUR-API-KEY-HERE");
        $photos = $flickrphotos->getPhotos();
        $photoOfInterest = $photos[array_rand($photos, 1)];
        $flickrpic = new photoFlickr($photoOfInterest, "YOUR-API-KEY-HERE");
        $flickrpic->setSize($width, $height);
        print $flickrpic->getHTML(true);

Before you start, you need to put two PHP files on your server. One is mine (photosFlickr.php) and my code expects to find phpFlickr Class 3.0 (written by Dan Coulter that you can get at http://phpflickr.com/). Download his files, and upload the one called phpFlickr.php to your website (it is easiest to put it in the same folder as you put my code).

First, we include the code I wrote. Make sure to include the full and correct relative path to the file on your server.
require_once("photosFlickr.php");

Second, we instantiate an instance of the class that handles multiple photos. We give the constructor the flickr username (as a string), and also your API key (as a string) which you can get for free from Flickr by clicking here.
$flickrphotos = new photosFlickr($flickr_username, "YOUR-API-KEY-HERE");

Then lets actually use the instance we just created… the simplest way to do so is to ask for all the public photos (Flickr may only return the first 100 due to how their API works. You can easily modify my code to ask for more.). We do this by calling:
$photos = $flickrphotos->getPhotos();
And we have the list of photos in the array called $photos. But if you look at this array, it is a mess! It is all information that makes sense to Flickr, but not as much to you. Don’t worry, I have a class to handle that as well.

For our example, lets pick one photo to deal with. We’ll do this randomly by calling:
$photoOfInterest = $photos[array_rand($photos, 1)];
We now have picked the photo we want to work with. You can do this in many ways, the random method is just an example ($photos[0] would give you the first one image Flickr returned, etc.).

Now lets display this picture. We instantiate a photoFlickr instance (note this is different than the photosFlickr instance we used before:
$flickrpic = new photoFlickr($photoOfInterest, "YOUR-API-KEY-HERE");
This will cause my code to make some sense out of the information returned by Flickr.

Optionally, you can decide the size you want to display the picture at. Just call:
$flickrpic->setSize($width, $height);
This provides it the width and height. For example this may look like $flickrpic->setSize(300, 200); but you can also just give it the width (like $flickrpic->setSize(300); and my code will figure out the correct height based on the dimensions of the image.

It will also intelligently choose the image to load from Flickr’s site. Flickr stores multiple versions of each image (thumbnail, square, medium, large, original) and the code will look through these and pick the smallest one that has dimensions equal or greater than what you need. This means your viewer’s browser has to load as small a file as possible while still not stretching an image and thus making it look bad.

But you still haven’t shown anything to your user! You need to display the HTML code for the image. This is done easily by calling:
print $flickrpic->getHTML();
This will output the image tag, with the sizes you specified (if any, otherwise default), and will automatically link the image to it’s page on Flickr. If you don’t want it to link to Flickr, just use $flickrpic->getHTML(false);.

That is all!

Please feel free to leave feedback. I’ll also consider new feature requests. Please alert me to bugs and I’ll fix and repost ASAP (I know there are some, I just don’t have time to fix all the edge cases right now).

A sanitized form of our paper has been published in the Fall 2009 issue of the Dartmouth Undergraduate Journal of Science, and you can read it online here. For ease of reading, I have also posted it in the original PDF format, formatted by LaTeX.

My team of myself and two other students, created this program, of which screenshots are included here. It supports posting text, images, and audio to a server, that the program captures. It allows you to draw with the stylus on the screen on a captured image or the canvas. The program displays these posts which are close to the location you are viewing, which is determined by the internal GPS or by you panning on the map. Map images are provided in 3 styles – map, satellite imagery, and a hybrid.

Graffiti Map View

Graffiti Sat View

Graffiti Posting Screen

I am continuing to work on improved stability and features.

For now, I use a DND search plugin for Firefox (should also work in IE, etc). This has the full functionality and I suggest installing it if you are a Dartmouth user. You can my implementation here.

The first invaluable resource is CanooNet, an online grammar guide and inflection dictionary. I use Canoo every time I am using a verb in a strange setting, or need to double-check my inflection of it. The website is canoo.net, however I have also created a Mozilla Search Plugin (also should work on IE), that allows you to quickly search for a verb without going to the page. This plugin directs you to the inflection of the verb. If you have not entered a verb, or there is confusion, it will take you to a listing page to select what you actually want to look for. To install this plugin, go here.

The second also invaluable resource is LEO, an online dictionary. You can access it at dict.leo.org. To make the most out of this dictionary, it is important to click on the word you think is the correct entry, which automatically searches for that word and you can make sure it is the right thing for the context you are looking for. Also, a useful icon appears next to the search results, which you can mouse over. This displays a pronunciation sound-byte, a link to the CanooNet entry, and a link to the full dictionary entry. To learn more about search features on LEO, click here. To get a Firefox/IE search bar plugin for LEO, go here.