How To Nokia N97 Hack

The latest version of HelloOX has been released, and it’s easier than ever to get unsigned software working on your N97. But let’s step back a bit: unsigned software is simply any kind of application that hasn’t gone through the Symbian Foundation’s rigorous signing process. Most freeware is unsigned, mainly due to the costs involved (around ~$525 for the bare minimum of one signing, with extra $$$ or euroseuroseuros for additional signing). With the included ROMPatcher utility, you can also apply unofficial patches to the firmware to fix bugs, modify current functionality, or adding new features. Pretty cool, right?
Unfortunately, by default your N97 (or any other recent S60 phone) will not allow you to install unsigned applications. We’re going to change that.

The Setup

You’re going to need a signed HelloOX2 sis file. Technically, that’s all you need, but a little out of reach for most people. If you’re starting from scratch, you’ll also need a .cer file, a .key file, and the SISContents application. Note that the HelloOX2 site claims that you can get a signed version of the app by donating $5. This may or may not be preferable, as it does avoid the steps (and the waiting) found here.
Remember, if you get confused anywhere in the tutorial, click on the screenshot above each step. You might find it easier to just click on the pictures and use the onboard Prev/Next buttons to go through each step (every image has the instructions underneath).
Let’s begin.

Developer Certificate and Key File

Skip this section if you already have a Dev. Cert and a key file. Otherwise, read on.
The easiest way to get the two files you need is to register an account on OPDA. By registering and filling out some forms (directions below), you can get your cert within a couple of days.

1. Go to the OPDA web site. Click on the Register button.

2. You should something that sort of resembles a Disclaimer page. Scroll down to the bottom, and there will be a countdown timer. Wait for it to reach zero, then click the leftmost button that appears.

3. Next up, you’ll have to fill out the registration form. Click anywhere inside the first box, and you’ll see a Captcha box pop up. Enter the characters that appear. After that is some kind of random math problem, answer it and go on to the next box. This is your username. The following two boxes are your password and your password confirmation (enter your password twice). I hope the Email box is self-explanatory. You can ignore that last checkbox – it shows you some advanced user options that are completely and utterly useless in this tutorial. Finally, click the yellow submit button on the bottom.

4. You should see a message pop up, wait a few seconds for it to redirect you to the forum page. Congratulations, you registered an account! Too bad we’re only a third of the way through. Click on the Apply Cer. in the top right corner of the page.

5. You should be at a page that looks similar to the picture here. Click on the English button (top right corner) to see what that important-looking green box says. Now click on the Loginbutton and enter your credentials into the following form. (no picture for this step)

6. This is the My Certificates page. Click on the Apply cer button (in orange, see picture if necessary).

7. Finally, a form that’s completely in English. Make sure you put the correct model and IMEI as this is critical to generating a valid certificate for your phone. For Phone Number, enter an 11-digit number starting with either 13, 15, or 18. Example: 15134567890. If you’ve filled out the form correctly, you’ll see the message: Operation Success! Now you’ll have to wait until your certificate and key files are generated. Generally it takes anywhere from 1-3 days.

8. Assuming that your screen looks like mine, and your certificates/keys were generated, click and save the .cer and .key files. Pat yourself on the back, you got through Part 1 of this walkthrough.

Using SISContents

SISContents is the software application that uses your .cer/.key files to digitally sign a Symbian application. It’s fairly easy to use, but I’ll write out all of the steps involved regardless.

1. If you haven’t already, download and run SISContents. Click on the large folder icon in the top left corner (Open file), and browse to the directory where you put the HelloOX2.unsigned.sis file. Double-click to open it.
2. Now go to Tools -> Sign package.

3. Another box should pop up. You’ll notice that there’s two tabs on the top of the box, Package and Key pairs. Click on the Key pairs tab to switch.

4. Here you’ll create a profile with your new files. A key pair is made up of a .cer file, and a .key file. Make sure you add both of these files using the Browse… button. For Private Key Passphrase, enter 12345. You can name the profile anything you want, but I find that a simple, description name like “N97 Certificate” works well. When you’ve finished, click the Add profile button.

5. Note the change once you click the Add profile button: a new profile should appear in the box labeled “Available signing profiles”.

6. Remember those two tabs on top? Click on the Package tab to switch back to the package view. On the right side, you should see “Signing profiles:”, with an empty drop-down box underneath. Click on this box, and select your newly created profile.

7. Click on the Add signature button. You should see a new entry in the “Signatures of selected component box” (right side) that reads something like “SHA1 with RSA” and some certificate validity period dates. If you see those, you’re almost there! All that’s left now is to close this box (use the X in the top right corner), and save the file that you just modified (File -> Save as…). Congratulations! You’re even closer than before!

Installing and Running HelloOX2

And now the step we’ve been waiting for. HelloOX2 should be signed with your own developer certificate and key file. Now copy it to your phone, and run it in File Manager. The installation is very straightforward, and the only prompt that might give you pause is the “Install Modo?” one. Modo is a freeware File Manager that you may want to use instead of Nokia’s crappy stock one.
Once HelloOX2 is installed, you need to enable the correct patches to allow you to run unsigned applications. Go to your Applications folder, and run the ROMPatcher utility. You should see two entries: Installserver_FP2 and open4all. For each entry, go to Options -> Patch -> Apply, and then Options -> Patch -> Add to auto. Add to auto autoloads the patches on each reboot.
And now…wait for it…you’re done! Go out and have a beer or something. You successfully navigated through this nightmare of a tutorial!
If you’d like to test out your new unsigned application installation functionality, grab VirtualKey(it’s unsigned by default) and try to install it.

New Threats You Should be Aware Of

The importance of cyber security for companies cannot be emphasized enough. A big part of preparing for possible future attacks is to be aware of not just the existing threats, but also new ones. Keep in mind that cyber crime is as dynamic as your interactive website. Only when you understand what you are up against can you incorporate suitable measures to remove vulnerabilities. Here’s a look at the changing face of cyber crime.

Hacktivism

Nothing explains hacktivism better than WikiLeaks, which threatened to blow the lid off political scandals, and made the Obama Administration, among others, break into a sweat. When the likes of MasterCard, PayPal, Visa and Amazon came under pressure to suspend payment services to WikiLeaks, ‘hacktivists’ launched DOS (denial-of-service) attacks against them in a show of support for WikiLeaks and its Australian founder Julian Assange.

Hacktivism includes any form of security breach and cyber attack, the motive for which is not monetary gain, but a disagreement with the decisions and practices of the targeted websites.

Sample another case of hacktivism, this time involving RIAA (Recording Industry Association of America) and MPAA (Motion Picture Association of America), against whom the members of imageboard site 4Chan launched DDOS (distributed denial of service) attacks. The retaliation had to do with the RIAA’s and MPAA’s role in shutting down The Pirate Bay, a bit-torrent site and a haven for illegal downloading.

The threat of hacktivism is alive and real – even if you believe that there is no motive for ‘cyber activists’ to target your company’s website, it is advisable to establish the necessary cyber-security measures to combat this threat effectively.

Clickjacking

If your company maintains a Facebook presence, then ‘clickjacking’ may sound familiar. In simple words, clickjacking is a form of cyber attack where the hacker uses an invisible layer over the embedded web content (this could be an image, video or button) to intercept and ‘hijack’ you to a mirror website and mine information from you. You will be unaware that you have been routed to another webpage, and this will cost you big, in terms of divulging sensitive information that can be used for malicious intent.

Cross Site Scripting

A threat to webpages that contain dynamic content, cross site scripting is a form of cyber attack that is targeting commercial websites across the world. Once the attacker figures out that an application on your site is defenseless against cross site scripting, the attacker will formulate and launch an attack, which may include (a) making changes to user settings (b) hijacking accounts (c) cookie theft (d) false advertising. The users can also be connected to a server that the attacker has chosen, which in all likelihood will be a malicious one.

Vulnerability of Mobile Devices

Tablet PCs and smartphones have revolutionized the way we use technology. These devices are fast becoming a very integral part of our everyday lives. Unfortunately, with the good comes the bad; and cyber criminals are increasingly targeting mobile devices, including tablets and digital wallets. The malicious intent in this case is almost always linked to financial gain. Online banking through smartphones is one instance where a malicious real-time attack can result in significant monetary losses. The services that are hosted on popular gadgets, like the iPhone or Android based devices, can be infected with corrupt software or used for access to sensitive information.

Cloud Computing Loopholes

You may have experienced the convenience and cost-savings of cloud computing. But here’s a bit of bad news – cyber crime is all set to make its way across cloud-based applications and services. A more recent case of cloud-related security compromise was in the form of a malware named “Trojan-Dropper.Win32.Drooptroop.jpa” that was detected in Rapidshare, the extremely popular cloud-based file-hosting website. A concerning feature about this malware was that it was able to bypass traditional cyber security filters by not being visible in the Rapidshare link’s body.

Sophisticated Attacks on a Specific Target

Stuxnet is a computer worm that made an appearance in 2010, and showed how malware can be used to launch cyber attacks on a global scale. Targeting computer systems that use Siemens software, this worm was tailored to attack an Iranian nuclear power plant. China’s ‘Aurora’ attack targeting Google is yet another indication that cyber warfare, launched by nations, can pose a big threat to companies on the receiving end of the attack.

With the right cyber-security measures, you can enjoy peace of mind, prevent any potentially harmful attacks and avoid embarrassments. In this regard, it is advisable to engage the services of a reliable cyber-security firm that can address all such concerns of your business