It took nearly a year for [Chris Crocker-White] to assemble this glorious mahogany and brass Geiger counter, but we think you’ll agree with us that it was time well spent. From the servo-actuated counter to the Nixie tubes and LED faux-decatrons, this project is an absolute love letter to antiquated methods of displaying information. Although for good measure, the internal Raspberry Pi also pushes all the collected radiation data into the cloud.

[Chris] says the design of this radiation monitor was influenced by his interest in steampunk and personal experience working on actual steam engines, but more specifically, he also drew inspiration from a counter built by [Richard Mudhar].

Based on a design published in Maplin back in 1987, [Richard] included a physical counter and LED “dekatron” displays as an homage to a 1960s era counter he’d used back in his school days. [Chris] put a modern spin on the electronics and added the glowing display of real-time Counts Per Minute (CPM) as an extra bonus; because who doesn’t like some Nixies in their steampunk?

Internally, the pulses generated by a common Geiger counter board are picked up by some custom electronics to drive the servo and LEDs. Triggered by those same pulses, the Raspberry Pi 3A+ updates the Nixie display and pushes the data out to the cloud for analysis and graphing. Note that the J305β Geiger tube from the detector has been relocated to the outside of the machine, with two copper elbows used as connectors. This improves the sensitivity of the instrument, but perhaps even more importantly, looks awesome.

We’ve seen some very high-tech DIY radiation detection gear over the years, but these clever machines that add a bit of whimsy to the otherwise mildly terrifying process of ionizing radiation are always our favorite.

source https://hackaday.com/2020/07/10/steampunk-geiger-counter-is-a-mix-of-art-and-science/

The big story of the last week is a problem in F5’s BIG-IP devices. A rather trivial path traversal vulnerability allows an unauthenticated user to call endpoints that are intended to be restricted to authenticated. That attack can apparently be as simple as:

'https://[F5 Host]/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=list+auth+user+admin'

A full exploit has been added to the metasploit framework. The timeline on this bug is frighteningly quick, as it’s apparently being actively exploited in the wild. F5 devices are used all over the world, and this vulnerability requires no special configuration, just access to the opened management port. Thankfully F5 devices don’t expose the vulnerable interface to the internet by default, but there are still plenty of ways this can be a problem.

Freta

Microsoft has made a new tool publicly available, Freta. This tool searches for rootkits in uploaded memory snapshots from a Linux VM. The name, appropriately, is taken from the street where Marie Curie was born.

The project’s namesake, Warsaw’s Freta Street, was the birthplace of Marie Curie, a pioneer of battlefield imaging.

The impetus behind the project is the realization that once a malicious actor has compromised a machine, it’s possible to compromise any security software running on that machine. If, instead, one could perform a security x-ray of sorts, then a more reliable conclusion could be reached. Freta takes advantage of the VM model, and the snapshot capability built into modern hypervisors.

As you might imagine, the idea of sending snapshots of your Linux VMs to Microsoft for scanning has been met with some skepticism. That said, the primary use case for Freta will likely be the Azure cloud, so it’s reasonable to see this as just another tool for that ecosystem. It will be interesting to see this technology mature, as there seems to be great potential.

Vulnerability Compatibility in IE11

Earlier in the year, yet another jscript.dll vulnerability was found and fixed in Internet Explorer. As a quick recap, jscript.dll is the javascript engine from IE8. The continual presence of IE8 compatibility mode means that this old codebase still persists in modern Windows versions. Were IE8 only accessible by user intervention, this would be much less of an issue, but a website can request this compatibility mode, meaning that simply visiting a malicious website could enable an attack.

What we have this week is a detailed look at CVE-2020-1062, the bug in question. It’s a use after free, and it’s triggered by freeing an object in an overridden callback of that object. In the example code, the exploit defines the “toString” function, and manages to free the parent object in that function. As is almost always the case, finding a crash is the easy part, but turning it into a working exploit is much harder. The use-after-free bug doesn’t in itself allow for code execution, but results in code execution jumping to a location controlled by the attacker. Using the Binary Ninja tool, the researchers found an existing function that they could jump to, and from there pull off remote code execution. The full story is more involved than we have space here to cover, so go check it out for the full details.

Citrix Bug Detailed

Earlier this year, we covered CVE-2019-19781, another path transversal vulnerability, but this one is in Citrix products. Now, six months have passed since the initial disclosure, and Mikhail Klyuchnikov has written up a more detailed report on the flaw.

At it’s core, the vulnerability is simple. On a Citrix gateway, “/vpn/” hosts the login page for remote users. The url isn’t properly sanitized, so something like: /vpn/../vpns/portal/scripts/[scriptName].pl
doesn’t require authentication, but does actually execute the Perl script at the given location. The ability to interact directly with these scripts as an unauthenticated user would be problem enough, but the newbm.pl script actually allows writing data to arbitrary locations. Between the ability to execute Perl scripts, and the ability to write to the file system, it’s rather trivial to install a remote shell using this vulnerability.

Ransomware Hitchhikes on USB Drives

Try2cry is a new ransomware, spreading itself through USB flash drives. In the old days, this sort of worm would simply use the autorun feature of Windows to automatically infect a machine when plugged in. On modern machines, with autorun disabled, malware authors have to be more creative in order to spread their wares. Try2cry copies it’s installer to the root of the flash drive, marks all the existing files and folders as hidden, and then creates shortcuts in place of the hidden files. These shortcuts all point back to the malware installer, and the hope is that a user won’t notice the change, and installs the malware when trying to access the files.

Apparently this ransomware is little more than a copy-and-paste of the open source “stupid” ransomware, available on GitHub. The good news is that it can be decrypted with available tools.

MongoDB Ransomware

Yes, even more ransomware. MongoDB databases are quite popular, with something like 45,000 of them exposed to the internet. The problem is that half of those are configured without a password. Anyone can connect to, read, and write to them. Yes, many of those are probably just for testing, but inevitably some of them have live data as well. Apparently some aspiring blackhat realized that all those unprotected databases were a prime target, and launched an attack.

Each database is wiped, and a ransomware note is added in place. As far as ransomware goes the .015 BTC that is requested is rather cheap, valued at $138 at time of writing. The worst part of the attack might be the threat attached: to leak the stolen data, and then file a GDPR complaint on behalf of those whose data was exposed.

And Finally…

Samba announced a pair of bugs recently. So far, it appears that neither problem can lead to RCE, but they’re rather simple to launch DoS attacks. One attack is a variation on the zip bomb, where a DNS name composed of 8127 dots causes Samba to lose it’s mind. The other flaw is a code softlock triggered by a UDP packet with an empty data message. Both flaws require netbios to be enabled in an Active Directory configuration.

IBM’s Db2 database software has a remotely exploitable buffer overflow. This issue can result in arbitrary code execution as root, so make sure to get this patched if you’re running big blue.

 

source https://hackaday.com/2020/07/10/this-week-in-security-f5-novel-ransomware-freta-and-database-woes/

The big story of the last week is a problem in F5’s BIG-IP devices. A rather trivial path traversal vulnerability allows an unauthenticated user to call endpoints that are intended to be restricted to authenticated. That attack can apparently be as simple as:

'https://[F5 Host]/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=list+auth+user+admin'

A full exploit has been added to the metasploit framework. The timeline on this bug is frighteningly quick, as it’s apparently being actively exploited in the wild. F5 devices are used all over the world, and this vulnerability requires no special configuration, just access to the opened management port. Thankfully F5 devices don’t expose the vulnerable interface to the internet by default, but there are still plenty of ways this can be a problem.

Freta

Microsoft has made a new tool publicly available, Freta. This tool searches for rootkits in uploaded memory snapshots from a Linux VM. The name, appropriately, is taken from the street where Marie Curie was born.

The project’s namesake, Warsaw’s Freta Street, was the birthplace of Marie Curie, a pioneer of battlefield imaging.

The impetus behind the project is the realization that once a malicious actor has compromised a machine, it’s possible to compromise any security software running on that machine. If, instead, one could perform a security x-ray of sorts, then a more reliable conclusion could be reached. Freta takes advantage of the VM model, and the snapshot capability built into modern hypervisors.

As you might imagine, the idea of sending snapshots of your Linux VMs to Microsoft for scanning has been met with some skepticism. That said, the primary use case for Freta will likely be the Azure cloud, so it’s reasonable to see this as just another tool for that ecosystem. It will be interesting to see this technology mature, as there seems to be great potential.

Vulnerability Compatibility in IE11

Earlier in the year, yet another jscript.dll vulnerability was found and fixed in Internet Explorer. As a quick recap, jscript.dll is the javascript engine from IE8. The continual presence of IE8 compatibility mode means that this old codebase still persists in modern Windows versions. Were IE8 only accessible by user intervention, this would be much less of an issue, but a website can request this compatibility mode, meaning that simply visiting a malicious website could enable an attack.

What we have this week is a detailed look at CVE-2020-1062, the bug in question. It’s a use after free, and it’s triggered by freeing an object in an overridden callback of that object. In the example code, the exploit defines the “toString” function, and manages to free the parent object in that function. As is almost always the case, finding a crash is the easy part, but turning it into a working exploit is much harder. The use-after-free bug doesn’t in itself allow for code execution, but results in code execution jumping to a location controlled by the attacker. Using the Binary Ninja tool, the researchers found an existing function that they could jump to, and from there pull off remote code execution. The full story is more involved than we have space here to cover, so go check it out for the full details.

Citrix Bug Detailed

Earlier this year, we covered CVE-2019-19781, another path transversal vulnerability, but this one is in Citrix products. Now, six months have passed since the initial disclosure, and Mikhail Klyuchnikov has written up a more detailed report on the flaw.

At it’s core, the vulnerability is simple. On a Citrix gateway, “/vpn/” hosts the login page for remote users. The url isn’t properly sanitized, so something like: /vpn/../vpns/portal/scripts/[scriptName].pl
doesn’t require authentication, but does actually execute the Perl script at the given location. The ability to interact directly with these scripts as an unauthenticated user would be problem enough, but the newbm.pl script actually allows writing data to arbitrary locations. Between the ability to execute Perl scripts, and the ability to write to the file system, it’s rather trivial to install a remote shell using this vulnerability.

Ransomware Hitchhikes on USB Drives

Try2cry is a new ransomware, spreading itself through USB flash drives. In the old days, this sort of worm would simply use the autorun feature of Windows to automatically infect a machine when plugged in. On modern machines, with autorun disabled, malware authors have to be more creative in order to spread their wares. Try2cry copies it’s installer to the root of the flash drive, marks all the existing files and folders as hidden, and then creates shortcuts in place of the hidden files. These shortcuts all point back to the malware installer, and the hope is that a user won’t notice the change, and installs the malware when trying to access the files.

Apparently this ransomware is little more than a copy-and-paste of the open source “stupid” ransomware, available on GitHub. The good news is that it can be decrypted with available tools.

MongoDB Ransomware

Yes, even more ransomware. MongoDB databases are quite popular, with something like 45,000 of them exposed to the internet. The problem is that half of those are configured without a password. Anyone can connect to, read, and write to them. Yes, many of those are probably just for testing, but inevitably some of them have live data as well. Apparently some aspiring blackhat realized that all those unprotected databases were a prime target, and launched an attack.

Each database is wiped, and a ransomware note is added in place. As far as ransomware goes the .015 BTC that is requested is rather cheap, valued at $138 at time of writing. The worst part of the attack might be the threat attached: to leak the stolen data, and then file a GDPR complaint on behalf of those whose data was exposed.

And Finally…

Samba announced a pair of bugs recently. So far, it appears that neither problem can lead to RCE, but they’re rather simple to launch DoS attacks. One attack is a variation on the zip bomb, where a DNS name composed of 8127 dots causes Samba to lose it’s mind. The other flaw is a code softlock triggered by a UDP packet with an empty data message. Both flaws require netbios to be enabled in an Active Directory configuration.

IBM’s Db2 database software has a remotely exploitable buffer overflow. This issue can result in arbitrary code execution as root, so make sure to get this patched if you’re running big blue.

 

source https://hackaday.com/2020/07/10/this-week-in-security-f5-novel-ransomware-freta-and-database-woes/

The big story of the last week is a problem in F5’s BIG-IP devices. A rather trivial path traversal vulnerability allows an unauthenticated user to call endpoints that are intended to be restricted to authenticated. That attack can apparently be as simple as:

'https://[F5 Host]/tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=list+auth+user+admin'

A full exploit has been added to the metasploit framework. The timeline on this bug is frighteningly quick, as it’s apparently being actively exploited in the wild. F5 devices are used all over the world, and this vulnerability requires no special configuration, just access to the opened management port. Thankfully F5 devices don’t expose the vulnerable interface to the internet by default, but there are still plenty of ways this can be a problem.

Freta

Microsoft has made a new tool publicly available, Freta. This tool searches for rootkits in uploaded memory snapshots from a Linux VM. The name, appropriately, is taken from the street where Marie Curie was born.

The project’s namesake, Warsaw’s Freta Street, was the birthplace of Marie Curie, a pioneer of battlefield imaging.

The impetus behind the project is the realization that once a malicious actor has compromised a machine, it’s possible to compromise any security software running on that machine. If, instead, one could perform a security x-ray of sorts, then a more reliable conclusion could be reached. Freta takes advantage of the VM model, and the snapshot capability built into modern hypervisors.

As you might imagine, the idea of sending snapshots of your Linux VMs to Microsoft for scanning has been met with some skepticism. That said, the primary use case for Freta will likely be the Azure cloud, so it’s reasonable to see this as just another tool for that ecosystem. It will be interesting to see this technology mature, as there seems to be great potential.

Vulnerability Compatibility in IE11

Earlier in the year, yet another jscript.dll vulnerability was found and fixed in Internet Explorer. As a quick recap, jscript.dll is the javascript engine from IE8. The continual presence of IE8 compatibility mode means that this old codebase still persists in modern Windows versions. Were IE8 only accessible by user intervention, this would be much less of an issue, but a website can request this compatibility mode, meaning that simply visiting a malicious website could enable an attack.

What we have this week is a detailed look at CVE-2020-1062, the bug in question. It’s a use after free, and it’s triggered by freeing an object in an overridden callback of that object. In the example code, the exploit defines the “toString” function, and manages to free the parent object in that function. As is almost always the case, finding a crash is the easy part, but turning it into a working exploit is much harder. The use-after-free bug doesn’t in itself allow for code execution, but results in code execution jumping to a location controlled by the attacker. Using the Binary Ninja tool, the researchers found an existing function that they could jump to, and from there pull off remote code execution. The full story is more involved than we have space here to cover, so go check it out for the full details.

Citrix Bug Detailed

Earlier this year, we covered CVE-2019-19781, another path transversal vulnerability, but this one is in Citrix products. Now, six months have passed since the initial disclosure, and Mikhail Klyuchnikov has written up a more detailed report on the flaw.

At it’s core, the vulnerability is simple. On a Citrix gateway, “/vpn/” hosts the login page for remote users. The url isn’t properly sanitized, so something like: /vpn/../vpns/portal/scripts/[scriptName].pl
doesn’t require authentication, but does actually execute the Perl script at the given location. The ability to interact directly with these scripts as an unauthenticated user would be problem enough, but the newbm.pl script actually allows writing data to arbitrary locations. Between the ability to execute Perl scripts, and the ability to write to the file system, it’s rather trivial to install a remote shell using this vulnerability.

Ransomware Hitchhikes on USB Drives

Try2cry is a new ransomware, spreading itself through USB flash drives. In the old days, this sort of worm would simply use the autorun feature of Windows to automatically infect a machine when plugged in. On modern machines, with autorun disabled, malware authors have to be more creative in order to spread their wares. Try2cry copies it’s installer to the root of the flash drive, marks all the existing files and folders as hidden, and then creates shortcuts in place of the hidden files. These shortcuts all point back to the malware installer, and the hope is that a user won’t notice the change, and installs the malware when trying to access the files.

Apparently this ransomware is little more than a copy-and-paste of the open source “stupid” ransomware, available on GitHub. The good news is that it can be decrypted with available tools.

MongoDB Ransomware

Yes, even more ransomware. MongoDB databases are quite popular, with something like 45,000 of them exposed to the internet. The problem is that half of those are configured without a password. Anyone can connect to, read, and write to them. Yes, many of those are probably just for testing, but inevitably some of them have live data as well. Apparently some aspiring blackhat realized that all those unprotected databases were a prime target, and launched an attack.

Each database is wiped, and a ransomware note is added in place. As far as ransomware goes the .015 BTC that is requested is rather cheap, valued at $138 at time of writing. The worst part of the attack might be the threat attached: to leak the stolen data, and then file a GDPR complaint on behalf of those whose data was exposed.

And Finally…

Samba announced a pair of bugs recently. So far, it appears that neither problem can lead to RCE, but they’re rather simple to launch DoS attacks. One attack is a variation on the zip bomb, where a DNS name composed of 8127 dots causes Samba to lose it’s mind. The other flaw is a code softlock triggered by a UDP packet with an empty data message. Both flaws require netbios to be enabled in an Active Directory configuration.

IBM’s Db2 database software has a remotely exploitable buffer overflow. This issue can result in arbitrary code execution as root, so make sure to get this patched if you’re running big blue.

 

source https://hackaday.com/2020/07/10/this-week-in-security-f5-novel-ransomware-freta-and-database-woes/

Building a PCB at home can be frought. If you’re etching, there are chemicals and the nuances of toner transfer. If you’re milling, getting the surface height just right, and not breaking those pointy little v-cutters is always a challenge. [Robin] has tips for both of these cases, and solves a lot of the common hassles by using a milling machine.

Whether he’s scraping away etch resist or entire copper isolation lines, [Robin] uses a non-spinning scratching tool instead of a v-bit: they’re more robust and cut every bit as well. He’s got tips for using FlatCam and KiCAD to make scratched-out traces. His registration system allows him to get double-sided boards with a minimum of hassle. And as a bonus, he’s doing some experimentation with embedding SMT parts inside the boards as well. Be sure that you check out his whole guide, or just watch the video embedded below.

We’re pretty sure you’ll pick up a trick or two, and maybe you’ll be convinced to bite the bullet and invest in a nice mill. If you’d like a more traditional take on PCB milling, try out our own [Adil Malik]’s guide.

source https://hackaday.com/2020/07/10/making-pcbs-the-easy-way/

In the days when the best an impoverished student could hope to find in the way of computing was a cast-off 1980s PC clone, one upgrade was to fit an NEC V20 or V30 processor in place of the Intel 8088 or 8086. Whether it offered more than a marginal advantage is debatable, but it’s likely that one of the chip’s features would never have been used. These chips not only supported the 8086 instruction set, but also offered a compatibility mode with the older 8080 processor. It’s a feature that [Just4Fun] has taken advantage of, with V20-MBC, a single board computer that can run both CP/M-86 and CPM/80.

If this is starting to look a little familiar then it’s because we’ve featured a number of [Just4Fun]’s boards before. The Z80-MBC2 uses the same form factor, and like this V20 version, it has one of the larger ATMega chips taking place of the acres of 74 chips that would no doubt have performed all the glue logic tasks of the same machine had it been built in the early 1980s. There is a video of the board in action that we’ve placed below the break, showing CP/M in ’80, ’86, and even ’80 emulated in ’86 modes.

The only time a V20 has made it here before, it was in the much more conventional home of a home-made PC.

source https://hackaday.com/2020/07/10/an-nec-v20-for-two-processors-in-one-sbc/

In the days when the best an impoverished student could hope to find in the way of computing was a cast-off 1980s PC clone, one upgrade was to fit an NEC V20 or V30 processor in place of the Intel 8088 or 8086. Whether it offered more than a marginal advantage is debatable, but it’s likely that one of the chip’s features would never have been used. These chips not only supported the 8086 instruction set, but also offered a compatibility mode with the older 8080 processor. It’s a feature that [Just4Fun] has taken advantage of, with V20-MBC, a single board computer that can run both CP/M-86 and CPM/80.

If this is starting to look a little familiar then it’s because we’ve featured a number of [Just4Fun]’s boards before. The Z80-MBC2 uses the same form factor, and like this V20 version, it has one of the larger ATMega chips taking place of the acres of 74 chips that would no doubt have performed all the glue logic tasks of the same machine had it been built in the early 1980s. There is a video of the board in action that we’ve placed below the break, showing CP/M in ’80, ’86, and even ’80 emulated in ’86 modes.

The only time a V20 has made it here before, it was in the much more conventional home of a home-made PC.

source https://hackaday.com/2020/07/10/an-nec-v20-for-two-processors-in-one-sbc/