Even when the HDCP (High bandwidth Digital Content Protection) master key, which is a core element of the encrytion, was leaked last year the standard has still not been cracked because using it to build an decryption chip is very difficult and costly.

Any technology saying something is uncrackable however is just an invitation for most people to try, and not professor Tim Güneysu and Benno Lomb, a PhD student from the Ruhr University in Germany have used a “man in the middle” approach to crack the encryption for just $350.

Instead of designing and creating an HDCP-capable chip, the two men built a standalone hardware solution that is based on an inexpensive FPGA (Field Programmable Gate Array) board that contains an HDMI port and an RS232 Serial port.  These boards are programmable and designed to be configured by the user.

The purpose of the research was not to crack the HDCP encryption they said.

“Our intention was rather to investigate the fundamental security of HDCP systems and to measure the actual financial outlay for a complete knockout. The fact that we were able to achieve this in the context of a PhD thesis and using materials costing just €200 is not a ringing endorsement of the security of the current HDCP system”

The board modifies all the communications between the Blu-Ray player and a flat screen TV without the interruption being detected.  This is something that some set-top-boxes are already able to do and some boxes that can remove HDCP data from HD video have been available since shortly after the HDMI standard was introduced.  These boxes allow otherwise encrypted high-definition content that is broadcast to be compressed and recorded to disc or a hard drive.

At the moment pirates are using these boxes to copy high-definition content, admittedly in a compressed form.  But there is currently no way for them to intercept the uncompressed raw data from a Blu-Ray disc.

This solution then isn’t much use for pirates at the moment then as what would really be required is a software solution, much in the way DVD John did in 1999 when he and two friends released the DeCSS software that decrypted DVDs.  This hardware solution doesn’t offer anything that’s really useful for pirates, especially as the researchers aren’t saying how they did it.

It does prove though that with some know how and determination anything is crackable, and with a software emulated version of the hardware board a possibility in the future, encrypted Blu-Ray discs could still come under attack from pirates, not to mention the threat this poses to encrypted high-definition digital video downloads in the future.

Where this is of interest is the ease with which the researchers were able to do this and the affordability of the overall parts involved.  To claim something is uncrackable unless significant volumes of money are spent designing a new silicon chip overlooks the fact that much existing technology can emulate this process, providing anybody with full and unfettered access to unencrypted video.

The news first emerged on Friday when they said that the email addresses and dates of birth of customers on its Sega Pass database had been accessed by hackers.  Now the larger admission will be hugely embarrassing to the company.

Sega remain committed to a statement though saying that the credit card details of customers remained safe.  This will come as little comfort though to over a million people who can change their credit card details but not their date of birth or mother’s maiden name.

A spokesperson for the company said “We are deeply sorry for causing trouble to our customers.  We want to work on strengthening security.”

Sega informed customers over the weekend with an email confirming an “unauthorised entry” to their computer systems and announcing that they were conducting an investigation into the breach.

The company said it had automatically reset the passwords of every Sega Pass customer and they urged them to change their log-in details for other websites where they used the same username and password combination.

This data was accessed because, the same as Sony which has also had millions of customer details stolen, the basic information about their customers was not encrypted.  Thus when hackers gained access to the information it was all in plain text and easily steal able.

Nintendo, which has also been the subject of a hacking attack reassured customers afterwards that the hackers had failed to penetrate their systems.

Their will be continued calls now from all sectors and from governments to make sure that all the personal details of every individual, whether they reside on a company or a government server, must be encrypted.  People such as you and I share our personal information with these companies in good faith and expect them to treat it as personal and secure.  We wouldn’t, for instance, pass the information over an insecure website that does not display a padlock and have a current security certificate.  Why then should we assume that the information won’t be encrypted when it arrives at the server at the far end?

This is an appalling mess all round and many people will now be thinking very carefully about what information they share and with which companies they share it.  A debate should also be reiased as to how much of this information companies actually need.  For instance, while it can be argued that games companies need dates of birth to ensure that under-age gamers do not get access to titles that have an age rating that is inappropriate for them, does a credit card with a matching name on the account also provide the same age verification?

The hacking group Lulz Security which has been involved in a number of high-profile attacks, including on Nintendo, denied any responsibility for the Sega hack.  They instead expressed sympathy saying on their Twitter stream “We want to help you destroy the hackers that attacked you. We love the Dreamcast, these people are going down.”

It may surprise some, then, that after all of the media attention surrounding this major breach of security, that the group called “Lulzsec” is claiming to have attacked the servers yet again and say that they have walked away with unencrypted security information. According to examples of their hacking as provided on Twitter (when challenged for proof of their claims) it looks as though they did indeed hack Sony networks and web sites, including Sony Music Belgium, Sony Music Netherlands and Sony Pictures. Lulzsec wrote, on the site of Pastebin, the following:

“We recently broke into SonyPictures.com and compromised over 1,000,000 users’ personal information, including passwords, email addresses, home addresses, dates of birth and all Sony opt-in data associated with their accounts. Among other things, we also compromised all admin details of Sony Pictures (including passwords) along with 75,000 ‘music codes’ and 3.5 million ‘music coupons’.”

The sobering claim from Lulzsec is that the group says that not only did it gain access to SonyPictures.com with a single SQL injection, but, “What’s worse is that every bit of data we took wasn’t encrypted. Sony stored over 1,000,000 passwords of its customers in plaintext, which means it’s just a matter of taking it,” (as posted online). “This is disgraceful and insecure: they were asking for it. “

While it’s probable that the general public would not agree that Sony was asking to have its customers private information compromised, it’s hard to disagree on the point about nothing being encrypted. After such an unprecedented and well publicized attack in April, one can’t help but wonder how “industry standard” doesn’t require the encryption of sensitive information. Employee and admin passwords can well be looked upon as the gateway to everything else and with customers around the world, one would think that Sony would have a vested interest in protecting their private information. That certainly seemed to be the case when considering their swift response to previous hackings.

After careful consideration, most would agree that Beth Givens, director of Privacy Rights Clearinghouse has a good point. She suggests that Sony has resorted to using industry standards for security. “If that’s true,” she says, “then perhaps it is time to re-evaluate and even go beyond such standards.” Sony’s clients all over the world can’t help but agree. In the meantime, they should change their passwords and be on the lookout for suspicious activities on their accounts and be careful not to fall for fishing scams that appear to be from Sony.

That said, it’s done now and a massive 77 million people have had their personal information exposed.  We still don’t know how much information this includes and what it could be used for.  One thing is for certain, people such as the ‘security expert’ who went on the BBC this week and said if you haven’t seen fraudulent transactions on your credit card yet you’re probably safe, are just idiots.  How quickly do these people think criminals can get through 77 million records?

I thought I’d write up some strategies here to help keep you and your personal information safe online.  Some of these you will be able to implement and some you won’t, but in conjunction they ought to make you safer.

Keep your email and online files password safest

This isn’t just to do with Spam, it’s something I wrote about here a few days ago.  Create yourself a super-strong password (see below for advice on how to do this) that you use only for your email, contacts and anywhere that you store documents online, such as SkyDrive or DropBox.  It’s essential to keep this information safe.  You are being trusted by others with valuable contact information attached to your email account for, sometimes, several hundred other people including their full addresses, mobile phone numbers, dates of birth and more.  This isn’t to mention any personal financial or other sensitive data you’re storing in your online files.

Use different passwords in different places

This isn’t always easy to do as people have trouble remembering passwords so tend to have just one or two.  There’s nothing to stop you writing down a list of passwords in a file on your phone (if you have a code lock on the handset) or at home if you have them in code.  For instance you could have the letter s appended to the beginning of the password.  To any glancing eye it just looks like an extra letter on the code.  You will know that is the password you use for shopping websites.  A g could signify gaming websites and so on.  While remembering passwords might be a pain when away from home and on new computers, your own computer equipment will usually remember the passwords for you.

Create a strong password

The strongest and most secure password follow the same rules…

• Make it at least 10 characters in length
• Use a mixture of Lower and Upper-case letters
• Use numbers (you can substitute some for letters too, 0/o, 1/i/l, 5/s and so on)
• Use symbols (which you can also substitute for letters, $/s, _/L, #/o for instance)
• Do not ever use the following (common words, names, date of birth, the word password)

One thing to note with this is that many websites still won’t allow you to use certain characters (usually *) in passwords.

Never use your banking passwords or PIN

Your banking password and card PIN number are for your banking ONLY.  Do not ever use them on any other service or website!

Minimise the information you share

This can be difficult.  On websites such as social networking it’s easier to do and you should never share…

• Address
• Phone numbers
• Date of Birth

But sometimes, especially in the case of a website you’ll have financial dealings with this is unavoidable as they need your date of birth and address for security.  Go back to my previous rule about different passwords for different websites for this situation then.

If a web service is hacked though any and all information that you share is vulnerable.  If you must give away this information to validate yourself on a website can you remove or change it afterwards?  Will the website’s service still work for you if you later log into your account and either remove the information completely or change it, perhaps by changing the phone number to 12345?

Be careful with usernames and email addresses

You can inadvertantly share useful information in your email address and usernames.  It’s common for someone to append their date or year of birth to these.  Always avoid doing so!

Use online banking

If you use online banking you can keep a much closer eye on transactions on your accounts.  Rather than have to wait up to 30 days for your statement to arrive, online banking will usually show you the most recent transactions whenever you log in.  This is an excellent way to see if someone is fraudulently using your credit or debit cards so that you can inform the bank promptly and have those cards cancelled, minimising the economic effect on you.  Remember it can take the banks a while to refund money to you.

Reduce the surface area for attack

Again this is something I wrote about at the beginning of the week.  Try not to sign up for every website and web service going.  Don’t spread yourself out on the web so far that you’ll never remember where you have accounts.  Keep and eye on your email and junk folder.  Occasionally these websites will send you an email and you can use this as a reminder to go back there and either remove or replace any personal and sensitive information, or preferably, just close the account completely.

Be vigilant

To be honest there’s absolutely nothing you can do to prevent a hacking attack such as the one that recently hit Sony.  It could happen to any company at any time, no matter how big or small they are.  The trick is to not have the information that can be exploited avillable to begin with but this is rarely easy in today’s Internet age.  The best advice I can give is simply to be vigilant and aware of what’s going on with your banking and your accounts.  With these simple rules you won’t be completely protected, but you can at least minimise the damage if something does go wrong.

On the bad news front, somebody has produced a proof of concept program that steals every one of those programs, free or paid for, from the Windows Phone Marketplace and downloads them for you to use free of charge.  Admitted no Windows Phone has enough installed memory to run them all, and who would want to, but for those few people who like pirating stuff and getting everything for free, this will be tempting.

Fortunately the developer of the hack is actively working with Microsoft on this to block the hack and the beginning of the new year should see changes made to the underlying architecture of the Marketplace which will see this blocked.  This is a white hat hack and will not be released into the wide world.

What’s concerning though is that Microsoft have, for their online services at least, a formidable reputation for security.  Hotmail has only faced 1 or 2 major exploits in its entire 15 year life and their server products and server security products are better than they’ve ever been before.

This crack for the marketplace was apparently put together very quickly and easily however, which raises serious questions about Microsoft’s security for the marketplace.  It’s not just apps that are kept here but details of the app developers, including financial information used to transfer royalty payments to them.

Hopefully Microsoft will act quickly over this holiday period to avoid a serious data leak.  In the mean time a video demonstrating the software used to crack the marketplace is available at NeoWin.

According to information posted on Mediaite nearly 1.25 million user accounts were dumped from the databases by a group called Gnosis. The group is currently cracking the database and managed to retrieve 273k passwords so far, some of which are linked to government sites.

The group promised to release the full site source code and full database dump in the next days. They did release a partial dump already. A total of 2650 users of the database have been using the password “password” or “qwerty”, two of the most insecure passwords ever. Of those users one had a gov, three a mil and 52 an edu email address.

Now, what do users need to do that had an account over at Lifehacker. They need to assume that their account was hacked along with the others, and that attackers were able to crack the password.

First step is to change the password over at the Gawker media site. That’s all if the username / password combination was only used on that one site. Problems arise for users who use the same username and password combination on all of their web accounts. These users need to change the password on all of their accounts.

Our tip: Install a password manager like Last Pass that can help in the generation of secure passwords and the storage of them. It is imperative to use a username / password combination only once on the web.

More information about the hack are available at Download Squad and Lifehacker.

The attack was dreamt up by security expert Sam Kamkar who demonstrated at the Black Hat hackers conference a website exploiting common shortcomings in a router to reveal it’s real-world location.

He tricked the router into believing the request for it’s ID information was coming from the connected PC, not from the Internet.  He then used the revealed MAC address with a geo-location feature in Firefox to interrogate the database Google gathered when it made its Street View photographs.

The data, which was controversially gathered, linked the MAC addresses of routers to GPS co-ordinates.  “This is geo-location gone terrible,” said Mr Kamkar during his presentation. “Privacy is dead people. I’m sorry.”

Mikko Hyponnen, senior researcher at F Secure called the demonstration “very interesting” adding that such a technique could be used for “stalking or targeted attacks against an individual”.

“The fact that databases like Google Streetview’s Mac-to-Location database or the Skyhook database can be used in these attacks just underlines how much responsibility companies that collect such data have to safeguard it correctly.” said Mr Hypponen

In 2005, Mr Kamkar created a work that helped him gain more than 1 million MySpace friends in a single day.

The code was placed in the comments section of targeted videos and would run automatically when people watched the clip.

Google says the problem was fixed within only two hours of being reported, according to the BBC.

“We took swift action to fix a cross-site scripting (XSS) vulnerability on youtube.com,” a spokesperson said.

“Comments were temporarily hidden by default within an hour, and we released a complete fix for the issue in about two hours.

Hackers had used JavaScript and HTML code to trigger the malicious pop-ups.

“The thing with a cross-site scripting attack is that it will appear that it is a message being posted by that website, which gives it a certain legitimacy, Graham Cluley of security firm Sophos told BBC News.

“It could be used to show a message that tells you to update your password; it could link to a malicious website; or it could attempt to phish you.”

For now YouTube is back to it’s old self and if you’re visiting the site in the next week I thoroughly recommend you click on the football icon during playing videos to add an authentic Vuvuzela soundtrack.

Hackers were able to intercept the email addresses because they were sent unencrypted when the iPad’s were connecting to AT&T’s network.  The mobile phone company says the flaw in it’s network that allowed this has now been patched.

In the letter the company says…

I want to assure you that the email address and ICC-ID were the only information that was accessible. Your password, account information, the contents of your email, and any other personal information were never at risk. The hackers never had access to AT&T communications or data networks, or your iPad. AT&T 3G service for other mobile devices was not affected.

While the attack was limited to email address and ICC-ID data, we encourage you to be alert to scams that could attempt to use this information to obtain other data or send you unwanted email. You can learn more about phishing by visiting the AT&T website.

AT&T takes your privacy seriously and does not tolerate unauthorized access to its customers’ information or company websites. We will cooperate with law enforcement in any investigation of unauthorized system access and to prosecute violators to the fullest extent of the law.

…and it is signed by the Senior Vice President for Public Policy and their Chief Privacy Officer, Dorothy Attwood.

AT&T say they’re working with law enforcement agencies to try and discover who was behind the hack, and questions still may need to be asked about any culpability that Apple may have with a tablet that would allow information to be broadcast in such a manner as it could be intercepted at all.

You can read the full apology email at the Engadget website.

The patch, released through version 10.1 of the Flash player is available now from www.adobe.com and there is also a new version of Adobe Air as well.

The company may have managed to shoot itself in the foot with this patch however as you’ll see from the amusing screenshot below, where the news story about the patch in the new version of the Flash Player is accompanied by a picture of Homer Simplson asking “Ooh. They have the Internet on Computers now!”

Okay, so this is a banner advert for an Adobe Air app, but I had to share the irony of the event with you.

The patch fixes a critical vulnerability which could allow your PC to be hijacked remotely and it covers Windows, Mac and Linux users, so everybody should upgrade.  All PC users should upgrade their version of Flash as soon as possible to prevent their PCs being vulnerable to the flaw.

An update for Acrobat and Acrobat reader is due sometime in the next week or so to fix the same vulnerability.

The group, calling themselves Goatse Security harvested the data using nothing more than a PHP script and are now in possession of some very high profile people’s contact details which include celebrities, white house officials and high ranking military officers.

So who is responsible for this, Apple or AT&T?  To be honest it’s going to be a bit of both and questions need to be asked why the hashing technique, common for exchanging passwords online, hasn’t been implemented here.

Hashing runs your password through a cipher that scrambles it.  It’s a one-way cipher so that the password can never be unscrambled.  A similar cipher scrambles the password on the authenticating computer and then both of these ‘hash codes’ are compared.  The reason for doing this is so that no password is ever put in the open where it can be intercepted.

This is clearly what happened with the iPad hack and it will come as a blow to Apple’s reputation for developing secure operating systems, the iPad OS is based on the same Unix code as their OS X desktop and server operating systems after all.

It remains to be seen if and how quickly a firmware update will be rolled out by Apple to encrypt sensitive data as it’s broadcast over 3G and other wireless networks to authenticate users.  AT&T also have questions to answer on whether this technique can be used to gather sensitive data from any other devices on their network.

Fortunately the hackers notified AT&T of the breach so they could close the hole and came clean about the hack.  The next group of hackers might not feel so benevolent.

The common denominator of the hack was that all affected websites were hosted on so called shared hosting servers. These servers host multiple websites by different users. Affected web hosting companies are Go Daddy, Bluehost, Media temple, Dreamhost and Network Solutions. It is likely that others are affected as well.

It is not clear yet how the hack was carried out. Current suggestions are either weak passwords or file access rights that allow the attacker to gain access.

We are seeing multiple reports today of WordPress sites (running their latest version) getting compromised. The initial reports today were restricted only to Dreamhost, but now we are seeing the same pattern on blogs hosted at GoDaddy, Bluehost, Media temple and other places.

How do you know if your website is affected?

All those sites had this javascript added to their pages:

http://www.indesignstudioinfo.com/ls.php
http://zettapetta.com/js.php

Which came from a long base64 encoded string added to their footer.php file (or on all the PHP files in some cases).

The website WP Security Lock posted detection instructions as well.

Here’s some of Zettapetta’s behavior:
Your website is redirected to:http://www1.firesavez5.com/?p=p52dcWpkbmmHjsbIo216h3de0KCf…….. or
http://www1.firesavez6.com/?p=p52dcWpkbG6HjsbIo…
This redirect page is a blank page. The source code contains the following:

404 Not Found

The page that you have requested could not be found.
All of your .php files on your WordPress contain the following malicious code… Located in the source code near the bottom of all .php files is the following script: http://zettapetta.com/js.php and http://www.indesignstudioinfo.com/
Your antivirus program blocks the installation of the threat: www.firesavez5.com or a www.firesaver6.com installer.

Sucuri.net has posted instructions on how to remove the malicious code from WordPress.

Via SSH:

If you have SSH access to your server, run the following commands on your web root:

$ find ./ -name “*.php” -type f | \
xargs sed -i ‘s###g’ 2>&1
$ find ./ -name “*.php” -type f | \
xargs sed -i ‘/./,$!d’ 2>&1

Via web:

If you don’t have SSH access, download this file to your desktop:
http://sucuri.net/malware/helpers/wordpress-fix_php.txt and rename it to wordpress-fix.php.

After that, upload it to your site via FTP, and run it (using your browser) as: http://yoursite.com/wordpress-fix.php

This script will take a few minutes to complete, but will scan your whole site and remove the malware entries.

Once you are done, go back to your site and remove this file.

Has your blog or website been affected by the hack? Let us know how you resolved the issue in the comments.

First iPhone Worm Rickrolls Jailbroken iPhones

This has been the main worry about everything Mac, They do not have viruses now, true but as they start to get more popular they will attract the attention of malware creators. So in that vein of paranoia, we have news of the first ever worm for the iPhone.

You can cut out the screaming and the deep breathing exercises because it is a) completely harmless and b) only effective on jailbroken iPhones. It does things like change the wallpaper and rickrolling users, so it is not exactly destroying your iPhone yet. A worm on a jailbroken phone is a worm on a device that has already been tampered with. So you can wait for the first ever worm on legit iPhones before you hit the panic button. [read]

Complete Car Control Via iPhone

Okay, this is certifiably crazy. In fact, we should probably start a ‘gHacks Certifiably Nuts’ award just for these fellas. But I must admit that what they are is doing is pretty cool. We know that the iPhone can already be used to start your car remotely but fully driving with the iPhone kinda takes the cake.

So what you do is you take some electronic control circuits, hook them up to control your steering, acceleration and brakes and then control them wirelessly. If you want a less vague and more accurate description, check out the videos. It is quite nicely done and I especially love the fact that they are using the accelerometer to control the steering.

The result is pretty 007-ish — that you can drive your car through your iPhone. Look M(a), no hands! [read]

HD Radio Comes To The iPhone Via Gigaware

Now that the Zune HD is out, your least favorite co-worker who loves to make fun of your liking for Apple has probably been going on and on about how his Zune HD does HD radio and your iPod Touch does not. Setting aside the all important the question of how many good HD radio stations are there near you, you can now get back at him saying “there’s an app for that!”

But that would be kinda half true because even though iBiquity has made an app that plays HD radio on your iPhone, you still have to get an additional hardware for accomplishing the feat. The device is called Gigaware Navigation Controller and is essentially an HD tuner with iPhone integration. It allows you to seek and auto tune as well. Plus there is Facebook tagging and iTunes tagging.

Works with the latest iPhone and the iPod Touch. Available on RadioShack. [read]

Sparkz Projector For Your iPhone

Do you want to spend a lot of money on a pico projector that will work with your iPhone/ iPod Touch/iPod Video? If you do, you can now have the Sparkz dock that lets you connect any of those devices and more to it so that you can project your favorites onto a nearby screen. It will support a/v and VGA inputs too.

Other than this extended support for inputs, it has a resolution of 640×480, stereo speakers and a 60-inch viewing area. It charges your docked device while it is projecting and it comes with its own tripod. The price so much goodness? A mere $495. Hey, I did say a lot of money. [read]

Words are chosen by probability and suggest alternatives which more often than not make more sense than the first word. This introduces a new technique to spy on users without having to actually access the computer at all, all that is needed is a good view of the hands and the measure of the keyboard.

The second spy tech could come right out of the latest James Bond movie. The researchers at Saarland University managed to write a computer algorithm that is capable of interpreting reflections of the computer screen on objects. The quality of the telescope plays an important role, a normal $500 telescope was able to read 12 point fonts of a reflection that was 5 meters away from the computer and 198 point fonts from a distance of ten meters.

A more powerful Dobson telescope for $27500 was able to yield the same results from a maximum distance of 30 meters. Other tests allowed the researchers to view the monitor from a white wall that was 2 meters away from the computer screen.

The best way to defeat the techniques ? Don’t access a computer in public, always close the curtains when working with your computer and make sure no cameras are installed in the room with a computer.

Apparently, all you need to do is to install a small registry fix which will then display the Windows Vista Service Pack 1 Beta as an available update at Windows Updates. The Service Pack 1 adds a watermark to your screen saying ‘Evaluation copy, Build 6001′ which can be removed with another script as well.

You should be aware that this is a beta version of the Service Pack for Windows Vista which means that it could harm your computer or files. I know that some of you guys still want to give it a go and I can fully understand that. Everyone else who is probably working with a Vista computer right now should probably better wait until the Service Pack is officially released by Microsoft.

Downloading Windows Vista Service Pack 1 from Windows Updates:

• Download Windows Vista Service Pack and unpack it to your system.
• Run SP1Beta_Hack.cmd with administrator privileges and Windows Updates afterwards. It should show KB935509 which you should download and restart afterwards.
• Run Windows Updates again, it should display KB937287. Download and restart your PC afterwards.
• Run Windows Updates for a third time. Download the now appearing KB938371, restart your computer.
• Finally, visit Windows Updates again and you should see the Service Pack 1 Beta for Microsoft Windows Vista available for download.

Removing the Evaluation Copy message:

• This is fairly easy to accomplish. Run watermark_fix.reg first
• Rename user32.dll.mui to user32.dll.mui.old in C:\Windows\System32\en-US\
• copy user32.dll.mui from the archive to that location
• Reboot Windows Vista

Several websites claim that this is the legal way to download Windows Vista Service Pack 1 Beta. I’m not a lawyer and can only use my judgment here but I really can’t see a huge difference between downloading the Service Pack from Torrent sites or the Microsoft website. Both are not really authorized downloads somehow.

Update:

The old hack is not working anymore, visit Download Windows Vista SP1 Beta through Windows Update again for a working hack.

Bkp also said that they know who did this but does not say how they know. He could be referring to IP addresses that they found, other traces or confidential information. They ask every user to change the password during their next login which is apparently happening automatically at the very moment. It remains to be seen if the encryption used to encrypt the email addresses is strong enough to withstand decryption.

To summarize the procedure. You load the Vista DVD, choose not to enter a product key when it prompts for one and continue the installation by choosing the right Vista edition. This will install a 30 day trial version of Vista. Run the setup again, this time from the now fully working Vista.

Type in your product key and choose a custom (advanced) installation when asked. This simply means that Windows Vista will be installed again on your system, this time with the right product key. Delete the windows.old directory afterwards which contains the files from the first installation.

Is it a loophole ? Yes it is. Everyone can now use Vista Update DVDs to install Windows Vista without having the operating system at hand that has to be used to update.

Open the command prompt by pressing Windows + R, typing cmd and hitting enter. Type the following line and hit enter at the end:  set devmgr_show_nonpresent_devices=1 ; Once this is done open your device manager from the control panel and enable the option to view hidden devices in the View tab.

This ensures that all hidden devices that have not been removed in the device manager will be listed and you can see if someone else added a external hard drive, usb stick or similar devices to your system. Great way to find out if someone spies on you or copied files from your system while you were not there.

It can be easily countered by removing the device from the device managers list.

CmosPwd is a free program that is able to display information about the bios once it is executed. You do need to create a bootable disk to be able to execute the program in dos mode. To create a bootable disk in windows right-click the disk drive and select format from the list of options. It is important that you enable the option Create an MS-DOS startup disk.

Once the disk is created copy the contents from the dos folder of cmospwd to the disk and restart the computer. You will have to remove all hard drives from the system if you do not automatically boot from disk drive. Type cmospwd.exe in the command line and the password should appear. Ignore the information about the other bios manufacturers and take a look at the one your computer is using.

Another possible method would be to start the computer in safe mode with command prompt which could work as well. You still need to access the files somewhere so make sure that the hard drive is accessible.

The message that appears reads: “All download slots (number) assigned to your country (name) are in use. Several ways to bypass the country limit exist and I would like to explain two of them and hint to others that can also be used if the need arises. The first one has been around for a while. You do need to download the User Agent Switcher add-on for Firefox or edit the registry in Windows if you are using the Internet Explorer.
Firefox:

Click on Tools, User Agent Switcher and select Options.. Options from the menu. Click on User Agents in the new tab and then on ADD. It is only important to fill out the first two fields. Name the first any way you want, Megaupload for instance. Copy and Paste the following line in the second field.

Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Alexa Tool bar)

Internet Explorer:

I strongly advise to use Firefox instead but if you really want to do this in Internet Explorer you have to edit the registry. For IE7 and IE6 navigate to the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings\User Agent\Post Platform.

Right-Click Post Platform and select New String Value and name it Alexa Toolbar.

Firefox users need to switch to the User Agent that they have created before they click on a download link. Do this by clicking on Tools, User Agent Switcher and choosing the name (megaupload) that you entered during the creation.

The second method would be to enter the megaupload website indirectly by using a service that does not reveal where you are coming from. Two services that come to my mind are Google translate and anonym.to