Unicode, the wonderful extension to to ASCII that gives us gems like “”, “”, and “”, has had some unexpected security ramifications. The most common problems with Unicode are visual security issues, like character confusion between letters. For example, the English “M” (U+004D) is indistinguishable from the Cyrillic “М” (U+041C). Can you tell the difference between IBM.com and IBМ.com?

This bug, discovered by [John Gracey] turns the common problem on its head. Properly referred to as a case mapping collision, it’s the story of different Unicode characters getting mapped to the same upper or lowercase equivalent.

'ß'.toLowerCase() === 'SS'.toLowerCase() // true
// Note the Turkish dotless i
'John@Gıthub.com'.toUpperCase() === 'John@Github.com'.toUpperCase()


GitHub stores all email addresses in their lowercase form. When a user sends a password reset, GitHub’s logic worked like this: Take the email address that requested a password reset, convert to lower case, and look up the account that uses the converted email address. That by itself wouldn’t be a problem, but the reset is then sent to the email address that was requested, not the one on file. In retrospect, this is an obvious flaw, but without the presence of Unicode and the possibility of a case mapping collision, would be a perfectly safe practice.

This flaw seems to have been fixed quite some time ago, but was only recently disclosed. It’s also a novel problem affecting Unicode that we haven’t covered. Interestingly, my research has turned up an almost identical problem at Spotify, back in 2013.

TrueCrypt and German Secrets

TrueCrypt is an amazing piece of software that literally changed the world, giving every computer user a free, source-available solution for hard drive encryption. While the source of the program was made freely available, the license was odd and restrictive enough that it’s technically neither Free Software, nor Open Source Software. This kept it from being included in many of the major OS distributions. Even at that, TrueCrypt has been used by many, and for many reasons, from the innocent to reprehensible. TrueCrypt was so popular, a crowdfunding campaign raised enough money to fund a professional audit of the TrueCrypt code in 2013.

The story takes an odd turn halfway through the source code audit. Just after the initial audit finished, and just before the in-depth phase II audit was begun, the TrueCrypt developers suddenly announced that they were ending development. The TrueCrypt website still shows the announcement: “WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues.” Many users thought the timing was odd, and speculated that there was a backdoor of some sort that would be uncovered by the audit. The in-depth audit was finished, and while a few minor issues were discovered, nothing particularly serious was uncovered.

One of the more surprising users of TrueCrypt is the German government. It was recently discovered that the BSI, the information security branch of the German government, did an audit on TrueCrypt back in 2010.

Many governments have now have laws establishing the freedom of information, granting a “right-to-know” to their citizens. Under these laws, a citizen may make an official request for documentation, and if such documentation exists, the government is compelled to provide it, barring a few exceptions. A German citizen made an official request for information regarding TrueCrypt, particularly in regards to known backdoors in the software. Surprisingly, such documentation did exist!

Had the German government secretly backdoored TrueCrypt? Were they part of a conspiracy? Probably not. After some red tape and legal wrangling, the text of the audit was finally released and cleared for publication. There were some issues found back in 2010 that were still present in the TrueCrypt/Veracrypt source, and got fixed as a result of this report coming to light.

NPM Binary Planting

The Node Package Manager, that beloved repository of all things Javascript, recently pushed out an update and announced a pair of vulnerabilities. The vulnerabilities, simply stated, were both due to the lack of any sanity checking when installing packages.

First, the binary install path wasn’t sanitized during installation, meaning that a package could attempt to interact with any file on the target filesystem. Particularly when running the NPM CLI as root, the potential for abuse is huge. While this first issue was taken care of with the release of version 6.13.3, a second, similar problem was still present in that release.

Install paths get sanitized in 6.13.3, but the second problem is that a package can install a binary over any other file in its install location. A package can essentially inject code into other installed packages. The fix for this was to only allow a package to overwrite binary files owned by that package.

The upside here is that a user must install a compromised package in order to be affected. The effect is also greatly mitigated by running NPM as a non-root user, which seems to be good practice.

Google Cloud Shell

Google provides a bunch of services around their cloud offering, and provides the very useful web-based Cloud Shell interface for managing those services. A researcher at Offensi spent some time looking for vulnerabilities, and came up with 9 of them. The first step was to identify the running environment, which was a docker image in this case. A socket pointing back to the host system was left exposed, allowing the researcher to easily escape the Docker container. From there, he was able to bootstrap some debugging tools, and get to work finding vulnerabilities.

The vulnerabilities that are detailed are interesting in their own right, but the process of looking for and finding them is the most interesting to me. Google even sponsored a YouTube video detailing the research, embedded below:

Odds and Ends

Using an iPhone to break the security of a Windows machine? The iPhone driver sets the permissions for a certain file when an iPhone is plugged into the machine. That file could actually be a hardlink to an important system file, and the iPhone driver can unintentionally make that arbitrary file writable.

The Nginx web server is currently being held hostage. Apparently the programmers who originally wrote Nginx were working for a technology company at the time, and now that the Nginx project has been acquired, that company has claimed ownership over the code. It’s likely just a fraudulent claim, but the repercussions could be far-reaching if that claim is upheld.

OpenBSD has fixed a simple privilege escalation, where a setuid binary is called with a very odd LD_LIBRARY_PATH — a single dot, and lots of colons. This tricks the loader into loading a user owned library, but with root privileges.

source https://hackaday.com/2019/12/20/this-week-in-security-unicode-truecrypt-and-npm-vulnerabilities/

Over the years, the media has managed to throw together some pretty ridiculous visual depictions of computer hacking. But perhaps none have gone as far down the road of obfuscation as The Matrix, where the most experienced hackers are able to extract information from a display of cascading green glyphs like a cyberpunk version of reading tea leaves. It’s absolutely ridiculous, with zero basis in reality.

Well, maybe not anymore. Taking a page from these outlandish visions of hacking, [Erik Bosman] has constructed a dedicated hex dump display out of fourteen segment alphanumeric LEDs that looks like it could be pulled from a movie set. But make no mistake, it’s more than just a pretty face. By cleverly varying the brightness of the individual characters, he’s managed to make his so-called “hexboard” completely usable despite the fact that everything’s the same color.

While he says the project is not quite at 100% yet, he’s already released the firmware, computer-side software, and even the PCB design files for anyone who might want to build their own version. Though as you might imagine, it’s quite a tall order.

The display is broken up into segments holding eight Houkem-5421 LED modules apiece, each with its own STM32F030F4 and two TC7258E LED controllers. The bill of materials on this one is a bit intimidating, but when the end result look this good it’s hard to complain.

To build a somewhat smaller version that also features a more retro vibe, you might consider doing something similar by chaining together vintage LED “bubble” displays.

source https://hackaday.com/2019/12/20/movie-style-hacking-with-a-wall-of-glowing-hex/

Programming is a valuable skill, though one that can be daunting to learn. Throw hardware in the mix, and things ratchet up another level again. However, there are many projects that have sought to reduce the level of difficulty for newcomers. HeyTeddy is a new project that allows users to program an Arduino with voice commands, and the help of on-screen tutorials.

It’s a system that initially sounds cumbersome, but through smart design, is actually quite streamlined. Users can talk to the system, which uses an Amazon Alexa device for natural language voice recognition. This enables HeyTeddy to respond to questions like “how do I use a flex sensor?” as well as direct commands, such as “Set pin 10 to 250”.

The demo video does a great job of demonstrating the system. While the system is not suited to professional development tasks, its has value as an educational tool for beginners. The system is able to guide users through both hardware setup on a breadboard, as well as guide them through tests when things don’t work. Once their experience level builds, code can be exported to the Arduino IDE for direct editing.

It’s a great tool that has plenty of promise to bring many more users into the hardware hacking fold. It’s out of the workshop of [MAKInteract], whose work we’ve seen before. Video after the break.

source https://hackaday.com/2019/12/20/programming-arduinos-with-voice-commands/

[Andy Geppert] sends in his incredibly clever interactive core memory shield. 

In a great display of one hacker’s work being the base for another’s, [Andy] started out with [Jussi Kilpelainen]’s core memory shield for Arduino.  As he was playing with the shield he had a desire to “see” the core memory flipping and got the idea to add an LED matrix aligned behind the individual cores.

The first iteration worked, but it only showed the state that the Arduino believed the core memory to be in. What he really wanted was a live read on the actual state. He realized that an Adafruit Featherwing 8×8 matrix display also fits behind the core memory. Now the LEDs update based on the read state of the core memory. This allows him to flip the individual bits with a magnetic stylus and see the result. Very cool.

You can see a video of it working after the break.

source https://hackaday.com/2019/12/19/interactive-core-memory-shield-helps-explains-the-past/

[Discreet Electronics Guy] sends in his very pocket sized boom box.

One thing we love about [Discreet Electronics Guy]’s projects is how they really showcase that a cool hack is possible without access to 3D printers, overnight PCB services, and other luxuries. Everything in this board is hand made by electronics standards. The board is etched, the vias are wires, and even the case seems to be a modified plastic mint container.

The boombox itself uses an ATiny85 at its core which plays .wav files from an SD card. This is routed through an audio amp which powers two small speakers. We love the volume knob being a board mount potentiometer. The device even features its own small LiON battery pack. If you don’t want to enjoy the deep sound of the two small speakers there’s a headphone jack.

He’s got a great write-up on the circuit design on his website and you can see a video of him presenting the project here or after the break.

source https://hackaday.com/2019/12/19/a-box-with-a-pocket-sized-boom/

Anyone who has delved into DIY wheels knows that they are a trickier than it may seem, especially if the wheels aren’t just for show and need to provide things like decent traction and durability. 3D printers have helped a lot, but they’re not a cure-all.

Check out how [Robert K.] makes wheels from segments of automotive silicone hose, which are constructed with fibers embedded within them for durability and structure. Not only are these hoses easily sourced, but the silicone makes a great wheel surface and the hoses themselves are highly durable. He uses a 3D printed jig to cut a slice of hose that press-fits perfectly onto a 3D printed hub. [Robert] finds that a 28 mm hose pulled over a 35 mm diameter wheel is a perfect fit.

These wheels are for a Beetleweight class combat robot, which are limited to three pounds (1.36 kg) or less. You can see some video of [Robert]’s previous Beetleweight robot named ‘Bourbon’, and we have featured what goes into the even-smaller Antweight class (one pound or less) in the past.

source https://hackaday.com/2019/12/19/super-easy-small-robot-wheels/

Anyone who’s tried to encapsulate something in epoxy resin knows how much of a hassle air bubbles can be. If you’re trying to get a perfectly clear finish, the last thing you want is a bunch of microscopic bubbles frozen in time. The best way to prevent this is to put the parts in a vacuum chamber so all the air works its way out before the epoxy cures, but that’s a considerable investment for a one-off project.

But assuming your parts are small enough, [Jasper Sikken] has a great tip that allows you to construct a simple vacuum chamber for just a few dollars. He shows his homemade chamber off in the video after the break, and we think you’ll agree that the change between before and after is pretty dramatic. The best part is that if you want to build your own version, you only need two parts.

The first one is a airtight container large enough to hold the piece you’re working on. Remember that the larger the chamber is the more time it will take to pump down to a suitable vacuum, so avoid the temptation to use something larger than necessary. [Jasper] used a glass jar with a locking lid, which is not only cheap and readily available, but has a decently large internal volume.

Obviously, the second component is the vacuum pump itself. This might normally be a tall order, but [Jasper] recently found that you can buy small battery-powered gadgets designed for sucking the air out of food containers for as little as $5 USD from the usual import sites. All you need to do is pop a hole in the lid of your container, hold the device over the hole, and watch the magic.

This method is great for anything smaller than a paperweight, but if you’ve got something bigger than that, you’ll need to step up your chamber game. Luckily even larger vacuum chambers can be built cheaply at a pinch.

source https://hackaday.com/2019/12/19/degassing-epoxy-resin-on-the-very-cheap/

It’s hard not to feel the constant pull on our limited attention from the very interesting rectangles in our pockets and packs. [Antoine Pintout] is fighting against it with three interesting pendants.

The three objects each have functions. Sablier, tells time, but rather than giving the numerals it vibrates on a set interval to give a relative sense of the passage. Boussole is a compass like device which doesn’t tell the cardinal directions. Instead it tells you which way to go in order to get to a pre-set location. The last, Sifflet, is a pager, but rather than sending a text it plays a melody reflecting the sender’s mood.

We love the look of the objects. The circuits are beautifully laid out and showcased in well machined brass cases. Small details abound; in Sifflet for example, the coil antenna is symmetrically presented with its own cutout in the board. Laying out a board is hard enough, but taking this much care in component placement easily doubles the time.

All the files and models are available,  though we’re not sure we possess the craftsmanship to reproduce these to the same standard.

source https://hackaday.com/2019/12/19/replace-your-smartphone-with-these-arcane-amulets/

If you read the scientific literature, you see the familiar subatomic particles you learned about in school: protons, neutrons, and electrons. If you are young enough, you see others you probably heard about, too, like quarks and gluons. But recently there has been a lot of buzz about excitons and even some transistor circuits demonstrated that use them. But what is an exciton?

It actually sounds like a subatomic particle, but it is a little more complicated than that. An exciton is a bound state of an electron and an electron hole and is technically a bosun. You are probably familiar with the idea of an electron hole from semiconductor physics. Technically, it is a quasiparticle. The reason scientists are interested in the beast is that it can transport energy without transporting net electric charge. That is, the state itself is neutral, but also contains energy.

Exciting Times for an Exotic Particle

This one-minute cartoon from École Polytechnique Fédérale de Lausanne (EPFL) is a good way to wrap your head around why excitons are exciting.

EPFL had the breakthrough last year that allowed room temperature exciton transistors. The paper that explains it all isn’t quite as entertaining, but you can find it as “Room-temperature electrical control of exciton flux in a van der Waals heterostructure” in the usual places (https://doi.org/10.1038/s41586-018-0357-y).

One way to form an exciton is to hit a material with a photon above its bandgap energy. This moves an electron from the valance band into the conduction band. The new spot on the conduction band is the electron and the hole back on the valence band is bound to the electron by electrostatic force. In particular, the hole’s attraction to all the surrounding electrons keeps everything stable. It also consumes a bit of the pair’s energy.

Oddly, excitons aren’t new. They were first proposed in 1931 by a guy named Yakov Frenkel (pictured). He actually was describing something observed by H. H. Poole involving conduction in insulators. In fact, Frenkel introduced the idea of a hole into the physics vernacular and certain types of holes are still known as Frenkel defects.

Work continues to make excitons practical. Cornell recently announced they increased the condensation temperature for excitons significantly (from 1 kelvin to 100 kelvin; still a long way from room temperature).

Waiting is the Hardest Part

What will this mean for us? Nothing this week. But someday in the future, the IC you are using might just take advantage of these exotic particles. While that might sound far-fetched, imagine how crazy it would have sounded to a tube radio designer in the 1930s that in just a few decades we’d have something that acted like a tube, would fit on your fingernail, and be totally rugged by comparison to a tube.

source https://hackaday.com/2019/12/19/whats-an-exciton/

If you’re one of the lucky ten thousand today who still haven’t tried programming electronics with the Arduino platform, this detailed guide by [Dafna Mordechai] should hopefully give you enough incentive to pick it up now and make a simple bit of Christmas-themed decoration with it.

The guide isn’t exactly aimed at complete ground-up beginners but it does give some pointers on where to look up whatever information you don’t have in order to follow along. Other than that, it’s very simple and has well-detailed steps, showing you how to turn a breadboard into a simple animated arrangement of LEDs in the shape of a Christmas tree, along with a piezo buzzer playing “Jingle Bells”. If you’ve never done this sort of stuff before, [Dafna] explains in pretty good detail which part of the code does what, making it pretty simple if you want to play around with it and customize it to your taste.

Once you’ve gotten the hang of the basics of Arduino, why not try a project that’s a little more elaborate? Without having to stray too far from your comfort zone, you can easily build a kid’s toy full of switches and lights or even a very extra clock that has no shortage of lights and dials.

source https://hackaday.com/2019/12/19/learn-arduino-in-time-and-in-tune-for-christmas/

When Isaac Asmiov was writing I, Robot, the field of robotics was still in its infancy. As he notes in The Complete Robot, as the field began to mature, it started showing signs of conforming to the popular ideas held by science fiction writers about what robotics ought to be. Notions of humanoid robots, the functions that robots would have in domestic settings, even the ethical quandaries that AI ethicists face today were all themes of early sci-fi writers.

The idea of a robot – at least of automata – predates the field of robotics. The idea of an independent automata may have existed as early as the ancient Egyptians Chinese, and Greeks, who attempted to build self-operated machines that resembled animals and humans. Myths of clay golems in Jewish legends and clay giants in Norse legends perpetuated the idea of an artificial being that could mimic the actions of living creatures. A 400 BC myth from Crete spoke of a man of bronze who guarded their island from pirates.

In 1066, the Chinese inventor [Su Song] constructed a water clock consisting of a tower with mechanical features that would chime the hours. The tower had programmable drums with pegs that would bump into levers to operate the percussion instruments. Later, in the 13th century, Muslim scientist [Ismail al-Jazari] created a humanoid waitress that could serve tea to customers. Drinks were stored in a reservoir tank. The drinks would drip from a bucket into a cup, which the waitress could then serve through an open door. Centuries later, [Leonardo da Vinci] would sketch plans for a mechanical knight that would sit up, wave its arms, and move its head.

It wasn’t until 1920, however, that the term robot began being used to describe these automata. The Czech writer [Karel Čapek] published a play titled R.U.R. about artificial bodies without souls, which borrowed their name from the Czech word for peasant slaves (“robota”). The story told of mechanical men working on factory assembly lines who rebelled against their human masters, a recurring storyline in what would become a major sub-genre of science fiction writing.

In 1932, inventor [W. H. Richards] exhibited one of the first humanoid robots at the Model Engineers Society in London. The frame consisted of an aluminum body with eleven electromagnets and a motor powered by a 12 V power source. In 1948, [William Grey Walter] from the Burden Neurological Institute in Bristol created the first complex autonomous robot, based on his theory that the connections between brain cells could give rise to complex behaviors. Elmer and Elsie, the robotic tortoises, were constructed with a phototropic plastic shell that doubled as a bump sensor. The devices showed the interaction between a light sensitive and touch sensitive control mechanism mimicking nerve cells with tactile and visual input. The systems interacted well enough that the tortoises appeared to exhibit behavior when navigating around obstacles.

While there is contention over the exact origins of the field, the notion that analog electronics could simulate brain processes – an idea [Alan Turing] and [John von Neumann] were also famed for entertaining – may have jump-started subsequent robotics research.

Kentucky inventor [George C. Devol] is often credited with creating the first modern robot in 1954, known as Ultimate. The robot was the first industrial machine, working on a General Motors assembly line. With the help of his business associated [Joseph Engelberger], the pair started the first robot manufacturing company. The job of the robots was to transport die castings from an assembly line and weld the parts onto auto bodies. It was a particularly useful task to automate since the work was especially dangerous for human workers, who could be poisoned by toxic fumes or injured if they weren’t careful.

As far as robotics research goes, the scientific study remains an interdisciplinary branch between mechanical engineering, electrical engineering, and computer science. Much of the theory that plays into the field is borrowed from aspects of controls, design, information processing, and other subfields of these branches. Given how wide the applications of robotics can be – from autonomous vehicles to prosthetics to industrial robots – the many branches of robotics span numerous adjacent fields.

Back to Sci-Fi

The most famous laws of robotics were probably those proposed by [Asimov] – the Three Laws of Robotics:

First Law: A robot may not injure a human being or, through inaction, allow a human being to come to harm.

Second Law: A robot must obey the orders given it by human beings except where such orders would conflict with the First Law.

Third Law: A robot must protect its own existence as long as such protection does not conflict with the First or Second Laws.

These laws governed the underlying universe behind Asimov’s robot stories, intended as a safety feature for their interactions with humans and one another. Whenever one of his robots would act counter-intuitively, it was often a direct consequence of one of the laws being applied to the situation. While they may have originated as a facet of fiction, they have become incorporated into the study of the ethics of artificial intelligence as well.

As the study of robotics has matured and incorporated more applications of research into artificial intelligence and intelligent agents, the ideas of ethics has become more prominent as a real barrier to further work in the field. While early robots may have been hard-wired to perform certain rote actions, as robots have become more free agents with the ability to select actions based on their optimizations of reaching certain goals, the subtleties of the algorithms used to govern these actions has come more into question. Questions in the ethics of AI tackle ideas from whether artificial general intelligence is possible, whether the machines are inherently dangerous and if there are ways to curb this danger, and whether machines have some semblance of a consciousness and certain rights. The same ideas covered by Black Mirror are very much real problems that today’s philosophers are dealing with solving.

As for the current state of robotics research, opinions range widely depending on who you ask. As one analogy puts it, tasks that are difficult for a human adult – such as quickly identifying differences in a vast database – can be easy for a robot. However, tasks that are easy for a human baby – such as grasping and throwing a ball – can be nearly impossible for robots. Even in rescue work, robots may not be ready to act as the sole responders simply due to deficiencies in their speed, versatility, and ease of use.

The biggest change and future outlook for robotics is probably the level to which autonomous agents will invade our society. With the rise of global opportunities for companies capable of building better state-of-the-art technologies for transportation, manufacturing, medicine, and other high-profit fields, there will only be more robots deployed in roles that were once filled by human workers. We may not be living in a robot dystopia proposed by [Asimov] just yet, but it isn’t just science fiction anymore.

source https://hackaday.com/2019/12/19/the-birth-of-the-modern-robot/