When shipping units in the hundreds rather than thousands, keeping overheads low is key to maintain a sustainable profit margin on each unit sold. Thus, [bald greg] built a rig that would allow for effective testing of devices rather than breaking the bank. The rig also handles programming, saving the cost of purchasing pre-programmed microcontrollers from the manufacturer. A Raspberry Pi runs the show, using its GPIO pins to program boards and saving test results and serial numbers for later reference. A bed of nails fixture is used to connect to each individual board. Additionally, to test each board as realistically as possible, hardware mimicking a real Airsoft electric pistol is used to properly load the hardware.
[bald greg]’s work is a great example of approaching QC on a budget, and we suspect he’ll sleep soundly knowing the boards in the mail are going to work first time. We’ve seen others take similar approaches, too. If you’re working on your own production testing rig, be sure to let us know!
It seems like many keyboard aficionados have been gravitating towards ever smaller boards, but not [Ren]. He’s mostly completed a 433% keyboard with a whopping 450 distinct keys. Using two off the shelf PCBs and Teensy to control it all, this keyboard means you’ll never need to strain to make some awkward chord.
The PCBs have a diode matrix arrangement for 225 keys, which we would have thought was big enough. After all, a Scrabble board has 225 squares, so we assume that’s why the vendor calls them scrabbleboards. Honestly, we’re jealous someone has the desk space for this monster. We were also thinking what other sorts of switch-like sensors you could use with this board. Imagine a home system, for example, with 225 occupancy sensors, each with its own key you could easily read via USB.
There was a time when building your own keyboard of any sort would have been challenging. But now there’s a cottage industry supplying chips, switches, caps, and PCBs to those looking to craft their own custom input devices. The ready availability of 3D printers has also sparked a minor revolution in custom keyboard enclosures and keycaps.
Working and learning from home may be the new norm, and if IKEA shelves are any indication, folks are tricking out their home office with furniture, gadgets, and squishy chairs. While teleconferencing has proven to be an invaluable tool, paper documents aren’t going down with out a fight.
Unfortunately dedicated document cameras require significant space and monies, so they’re impractical if you only share once in a while. [John Umekubo] didn’t want students and teachers hobbled by the same costs and inconveniences, so he modeled a mirror holder that slides over a laptop’s webcam and directs the view downward.
[John]’s adventures started with a Twitter post, as seen below, but the responses were so encouraging that he published his design on Thingiverse for everyone. There’s also a version that can be laser cut out of cardboard, though we imagine a pair of scissors would work in a pinch. He admits there’s already a consumer model, but wasn’t planning to sell them anyway. Like us, he wants to get people to share their work.
[Irene Posch] has done some incredible work with knitted, crocheted, and fabric circuits — check out the crocheted ALUs and embroidered computer for starters. Now, it seems [Irene] is building up a how-to catalog of e-textile tools that can be easily connected to a multimeter.
So far, this toolbox includes a seam ripper and a crochet hook. The concept is similar for both — print out a handle and connect the tool to a banana jack that can then be connected to a multimeter. The crochet hook is simple: just print out the handle, jam the hook in one end, and stick a mini banana jack in the other end. They’re designed to butt up against each other and make a connection without wires.
Building the ripper takes a bit more effort. There’s another printed handle involved, but you must first free the seam ripper from its stock plastic handle and solder a wire to it. Then twist the other end of the wire around a banana jack and and put that in the other end of the handle.
It’s great to see a little bit insight into the troubleshooting tools of e-textiles, especially because they are all-around fiddly. It all starts with a circuit, so why not do your prototyping with a thread-friendly breadboard?
Anti-static ESD straps are de rigueur in lab settings for those working with sensitive electronics. They’re a simple protective device, and one that generally doesn’t warrant a second thought. However, [Daniel Bogdanoff] figured they could stand to be a little more fashionable, and set to work on a fancier design.
The first step was to take a look at a regular ESD strap. Typically, they consist of a band that fastens around the wearer’s wrist, with a metal stud for connecting to the earthing lead. The earthing lead contains a high resistance to limit the discharge current to avoid ugly high-energy shorts when wearing the strap.
The metal stud is attached to a replacement link on the ROLEX’s strap, making the modification neat, tidy, and reversible.
With a good understanding of the basics, [Daniel] set about modifying a CASIO calculator watch for practice. After soldering a metal stud to the watch case failed, a second attempt with conductive epoxy worked great. The watch could be connected to the earthing strap, and an ESD tester confirmed the device was doing its job.
But unfortunately, permanently modifying the borrowed ROLEX wasn’t an option. Instead, [Daniel] limited his work to a single replacement link which could be inserted into the watch band. Hooked up to an earthing strap, the luxury watch also passed a basic ESD test successfully.
[Daniel] notes that while this is a fun experiment, using properly rated safety equipment is best. Additionally, he points out that the ROLEX is likely to do worse than the CASIO for the simple fact that a metal-banded watch is more likely to cause shorts when working on electronics. Of course, if a watch isn’t your thing, consider a ring instead. Video after the break.
Anti-static ESD straps are de rigueur in lab settings for those working with sensitive electronics. They’re a simple protective device, and one that generally doesn’t warrant a second thought. However, [Daniel Bogdanoff] figured they could stand to be a little more fashionable, and set to work on a fancier design.
The first step was to take a look at a regular ESD strap. Typically, they consist of a band that fastens around the wearer’s wrist, with a metal stud for connecting to the earthing lead. The earthing lead contains a high resistance to limit the discharge current to avoid ugly high-energy shorts when wearing the strap.
The metal stud is attached to a replacement link on the ROLEX’s strap, making the modification neat, tidy, and reversible.
With a good understanding of the basics, [Daniel] set about modifying a CASIO calculator watch for practice. After soldering a metal stud to the watch case failed, a second attempt with conductive epoxy worked great. The watch could be connected to the earthing strap, and an ESD tester confirmed the device was doing its job.
But unfortunately, permanently modifying the borrowed ROLEX wasn’t an option. Instead, [Daniel] limited his work to a single replacement link which could be inserted into the watch band. Hooked up to an earthing strap, the luxury watch also passed a basic ESD test successfully.
[Daniel] notes that while this is a fun experiment, using properly rated safety equipment is best. Additionally, he points out that the ROLEX is likely to do worse than the CASIO for the simple fact that a metal-banded watch is more likely to cause shorts when working on electronics. Of course, if a watch isn’t your thing, consider a ring instead. Video after the break.
Anti-static ESD straps are de rigueur in lab settings for those working with sensitive electronics. They’re a simple protective device, and one that generally doesn’t warrant a second thought. However, [Daniel Bogdanoff] figured they could stand to be a little more fashionable, and set to work on a fancier design.
The first step was to take a look at a regular ESD strap. Typically, they consist of a band that fastens around the wearer’s wrist, with a metal stud for connecting to the earthing lead. The earthing lead contains a high resistance to limit the discharge current to avoid ugly high-energy shorts when wearing the strap.
The metal stud is attached to a replacement link on the ROLEX’s strap, making the modification neat, tidy, and reversible.
With a good understanding of the basics, [Daniel] set about modifying a CASIO calculator watch for practice. After soldering a metal stud to the watch case failed, a second attempt with conductive epoxy worked great. The watch could be connected to the earthing strap, and an ESD tester confirmed the device was doing its job.
But unfortunately, permanently modifying the borrowed ROLEX wasn’t an option. Instead, [Daniel] limited his work to a single replacement link which could be inserted into the watch band. Hooked up to an earthing strap, the luxury watch also passed a basic ESD test successfully.
[Daniel] notes that while this is a fun experiment, using properly rated safety equipment is best. Additionally, he points out that the ROLEX is likely to do worse than the CASIO for the simple fact that a metal-banded watch is more likely to cause shorts when working on electronics. Of course, if a watch isn’t your thing, consider a ring instead. Video after the break.
There are negative-one hacks to this project. Someone lost at their game, lost their temper, then raged at their Xbox controller with some horsepower. The result is that [Taylor Burley] gets a free controller with a non-responsive joystick out of the deal, and since he had nothing to lose, he decided to heat up the iron and bring the controller back to life.
The majority of the project is told in pictures and through the narration in the video below. In removing the joystick, [Taylor] opts for the technique of doping the connections with fresh solder (we assume containing lead for easier melting) before reaching for the desoldering wick. The diagnosis stage is brief because when the joystick lifts away, the PCB falls apart into two separate pieces! The next step was to glue the two halves together with cyanoacrylate to get into the nooks and crannies, then epoxy to provide structure. Solder bridges were not going to jump that gap, so he used 30ga wire and attached it wherever he could scrape away some solder mask. Best of all, it worked when he reattached the joystick. Job well done.
Xbox controllers are not a scarce commodity, so people do not spend their idle hours fixing them, but not many people can claim experience. Maybe someday the stakes will be higher and he will have the courage to repair vintage electronics. We won’t rant on how things aren’t built to last, and how we don’t train people to fix things. Today, we want to focus on someone who used their time to repair and learn.
The next time you have some “junked” hardware, ask yourself, do I want the XP?
Mike and I were talking about two very similar clock projects we’d both built recently: they both use ESP8266 modules to get the time over WiFi and NTP, and they both failed. Mike’s failed because he was visiting relatives in a different timezone with different WiFi credentials, and mine failed because daylight savings time caught me off-guard. In both cases, we hard-coded stuff that could obviously change, but we drew vastly different conclusions.
Mike thought he’d solve his WiFi problem with a fallback to a captive portal, and maybe would have to figure out some web interface for configuring the timezone. A very clean, professional solution. Me? I’ve got good comments in the code, can find the UTC offset (or the WiFi creds) in a few minutes, and flash the new version up simply by fetching a USB cable, for something that happens twice a year. It’s hardly worth the trouble to cobble together a web interface.
There’s an XKCD for everything.
We’ve accidentally embodied a quandary that spans both the hardware and software worlds: should flexibility be exposed to the end-user or to the hacker who can peer under the hood or open up the source code? (And what if the end-user is the hacker?) What are the tradeoffs, in project complexity and in ease of use?
And in this, Mike is on the side of right and good, and I’m the heretic. I don’t always write my code to be extensible or re-usable. I sometimes write it to be quickly re-edited and patched whenever I need to. Is it full of magic numbers? Sure! But I know just where they are and how to change them. Heck, most are even well documented in their own header file. You could probably figure it out just about as fast. Would my father-in-law be able to tweak the timezone? Nope! But this ain’t his project anyway.
Dare to code for hackers! Don’t over-generalize or over-abstract. Less is more. Don’t be afraid to edit code. Tweak, compile, and re-flash when the situation changes. After all, that’s how you got the code there in the first place.
And although I’m on the wrong end of history, in this case I was right. You see, before daylight savings time could come around again, and I could have made use of that captive portal that I didn’t bother coding up anyway, my son entered first grade. Everything needs to be changed, from the hardware to the software. Will I code up the next version with flexible time regimes? As flexible as I need it to be, but not more.
This article is part of the Hackaday.com newsletter, delivered every seven days for each of the last 200+ weeks. It also includes our favorite articles from the last seven days that you can see on the web version of the newsletter.
Want this type of article to hit your inbox every Friday morning? You should sign up!
A Super Nintendo that has trouble showing sprites doesn’t make for a very good game system. As it turns out, Super Mario World is a lot less fun when the titular hero is invisible. So it’s no surprise that [jwotto] ended up tossing this partially functional SNES into the parts bin a few years back.
But he recently came up with a project that may actually benefit from its unusual graphical issues; turning the glitched console into a circuit bent video synthesizer. The system was already displaying corrupted visuals, so [jwotto] figured he’d just help things along by poking around inside and identifying pins that created interesting visual effects when shorted out.
Installing the new electronics into the SNES.
Once he mapped out the pins, he wired them all up to a transistor switching board that he’d come up with for a previous project. That would let an Arduino short out the pins on command while still keeping the microcontroller relatively isolated from the SNES. Then it was just a matter of writing some code that would fire off the transistors based on MIDI input.
The end result is a SNES that creates visual glitches along with the music, which [jwotto] can hook up to a projector when he does live shows. A particularly neat feature is that each game responds in its own way, so he can swap out the cartridge to show completely different visuals without having to change any of the MIDI sequencing.
Learning a new language is hard work, but they say that the best way to learn something is to teach it. [Angeliki Beyko] is learning Greek, and what better way to teach than to build a vocabulary flash-card game from Arduinos, color screens, 1602 text screens, and arcade buttons? After the break, we have a video from the creator talking about how to play, the hardware she chose, and what to expect in the next version.
Pegboard holds most of the hardware except the color screens, which are finicky when it comes to their power source. The project is like someone raided our collective junk drawers and picked out the coolest bits to make a game. Around the perimeter are over one hundred NeoPixels to display the game progress and draw people like a midway game. Once invested, you select a category on the four colored arcade buttons by looking at the adjacent LCD screens’ titles. An onboard MP3 shield reads a pseudo-random Greek word and displays it on the top-right 1602 screen in English phonetics. After that, it is multiple choice with your options displaying in full-color on four TFT monitors. A correct choice awards you a point and moves to the next word, but any excuse to mash on arcade buttons is good enough for us.
[Angeliki] does something we see more often than before, she’s covering what she learned, struggled with, would do differently, and how she wants to improve. We think this is a vital sign that the hacker community is showcasing what we already knew; hackers love to share their knowledge and improve themselves.
Typing Greek with a modern keyboard will have you reaching for an alt-code table unless you make a shortcut keyboard, and if you learn Greek, maybe you can figure out what armor they wore to battle.
Programming computers used to be harder. Don’t get us wrong — today, people tend to solve harder problems with computers, but the fundamental act of programming is easier. We have high-level languages, toolkits, and even help from our operating systems. Most people never have to figure out how to directly read from a disk drive, deblock the data into records, and perform multiplication using nothing but shifts and adds. While that’s a good thing, sometimes it is good to study the basics. That was [gnebehay’s] thought when his university studies were too high level, so he decided to write an arithmetic expression parser in Python. It came out in about 100 lines of code.
Interpreting math expressions is one of those things that seems simple until you get into it. The first problem is correctly lexing the input — a term that means splitting into tokens. For a human, it seems simple that 5-3 is three tokens, {5, -, and 3} and that’s easy to figure out. But what about 5+-3? That’s also three tokens: {5,+,-3}. Tricky.
Precedence is the other problem. If you look at 5+3*2, you should remember that the answer is 11 or 5+(3*2). However, other than by convention, it is equally valid to consider the answer is 16, or (5+3)*2. Another convention is left association so that 7-4+2 is 5 instead of 1. As it turns out, [gnebehay’s] parser currently spits out 1 for that expression, but he’s promised to fix it soon.
While it is interesting to read the code, the real value is the readme file which documents the creation of the parser and some of the theory behind it. This sort of thing used to be a staple of computer science classes, but today you are less likely to encounter it as classes focus on higher-level constructs.
You probably won’t use this code for anything. You rarely need to parse just a math expression and even if you did, there are many tools to help do that now. But you might just learn something about how interpreters and compilers digest text and garner meaning.
Today, you would probably build a parser with ANTLR or some similar tool. While 100 lines seems small, we’ve seen tiny languages that are smaller.
Many of us have been inspired by the videos of the Falcon 9 booster, tall as an office building, riding a pillar of flame down to a pinpoint landing at Kennedy Space Center or on one of SpaceX’s floating landing pads in the ocean. It’s not often that we get to see science fiction fantasy become reality on such a short timescale, and while they might not be sold on the practicality of reusable rockets, even the most skeptical of observers have to admit it’s an incredible feat of engineering.
Though it can’t quite compare to the real thing, this 1:60 scale Falcon 9 lamp by [Sir Michael II] promises to bring a little of that excitement home every time you flick on the light. Combining a scratch built model of the reusable booster with some RGB LEDs, the hovering tableau recreates the tense final seconds before the towering rocket comes to a rest on its deployable landing legs. We imagine those last moments must seem like an eternity for the SpaceX engineers watching from home as well.
The LED “exhaust” without the fluff.
[Michael] walks readers through assembling the Falcon 9 model, which cleverly uses a 2 inch white PVC pipe as the fuselage. After all, why waste the time and material printing a long white cylinder when you can just buy one at the hardware store for a few bucks?
Dressed up with 3D printed details from Thingiverse user [twuelfing] and splashed with a bit of paint, it makes for a very convincing model. While the diameter of the pipe isn’t quite right for the claimed 1:60 scale, unless Elon Musk is coming over your place to hang out, we don’t think anyone will notice.
The rocket is attached to the pad with a piece of threaded steel rod, around which [Michael] has wrapped one meter of RGB LEDs controlled by an Arduino Uno. With some polyester fiber filler as a diffuser and a bit of code to get the LEDs flickering, he’s able to produce a realistic “flame” that looks to be coming from the Falcon 9’s center engine. While we admit it may not make a very good lamp in the traditional sense, it certainly gets extra points for style.
The big news this week is the huge flaw in Microsoft’s Active Directory, CVE-2020-1472 (whitepaper). Netlogon is a part of the Windows domain scheme, and is used to authenticate users without actually sending passwords over the network. Modern versions of Windows use AES-CFB8 as the cryptographic engine that powers Netlogon authentication. This peculiar mode of AES takes an initialization vector (IV) along with the key and plaintext. The weakness here is that the Microsoft implementation sets the IV to all zeros.
XKCD.com CC BY-NC 2.5
It’s worth taking a moment to cover why IVs exist, and why they are important. The basic AES encryption process has two inputs: a 128 bit (16 byte) plaintext, and a 128, 192, or 256 bit key. The same plaintext and key will result in the same ciphertext output every time. Encrypting more that 128 bits of data with this naive approach will quickly reveal a problem — It’s possible to find patterns in the output. Even worse, a clever examination of the patterns could build a decoding book. Those 16 byte patterns that occur most often would be guessed first. It would be like a giant crossword puzzle, trying to fill in the gaps.
This problem predates AES by many years, and thankfully a good solution has been around for a long time, too. Cipher Block Chaining (CBC) takes the ciphertext output of each block and mixes it (XOR) with the plaintext input of the next block before encrypting. This technique ensures the output blocks don’t correlate even when the plaintext is the same. The downside is that if one block is lost, the entire rest of the data cannot be decrypted. You may ask, what is mixed with the plaintext for the first block? There is no previous block to pull from, so what data is used to initialize the process? Yes, the name gives it away. This is an initialization vector: data used to build the initial state of a crypto scheme. Generally speaking, an IV is not secret, but it should be randomized. In the case of CBC, a non-random IV value like all zeros doesn’t entirely break the encryption scheme, but could lead to weaknesses.
Netlogon, on the other hand, uses a Cipher FeedBack (CFB8) mode of AES. This mode takes a 16 byte IV, and prepends that value to the data to be encrypted. The basic AES operation is performed on the first 16 bytes of this message (just the IV). The first byte of the output is XOR’d with the 17th byte of the combined string, and then the 16 byte window slides one byte to the right. When the last byte of the plaintext message has been XOR’ed, the IV is dropped and the process is finished. The peculiar construction of AES-CFB8 means that a random IV is much more important to strong encryption.
Remember the actual flaw? Microsoft’s implementation sets that IV value as all zeros. The encryption key is generated from the password, but the plaintext to be encrypted can be specified by the attacker. It’s fairly simple to manipulate the situation such that the entire IV + Plaintext string consists of zeros. In this state, 1-in-256 keys will result in an all-zero ciphertext. Put another way, the 128-bit security of AES is reduced to 8-bit. Within just a handful of guesses, an attacker can use Netlogon to authenticate as any user.
Microsoft has patched the issue in their August security updates. While it’s true that exploiting this issue does require a toehold in a network, the exploitation is simple and proof of concept code is already available. This is definitely an issue to go patch right away.
Few security truisms are as universal as “Enable two factor authentication.” There is a slight gotcha there. 2FA adds an extra attack surface. Palo Alto found this out the hard way with their PAN-OS systems. With 2FA or the captive portal enabled, it’s possible to exploit a buffer overflow and execute code as root. Because the interface to be exploited is often exposed to the public, this vulnerability scored a 9.8 critical rating.
CardBleed Virtual Card Skimmer
Magento is an e-commerce platform, owned by Adobe since 2018. To put that more simply, it’s a shopping cart system for websites. In the last few days, it seems that nearly 2,000 Magento v1 instances were compromised, with a digital skimmer installed on those sites. The rapid exploitation would suggest that someone had a database of Magento powered sites, and acquired a zero-day exploit that could be automated.
Hacking Politicians for Fun and Profit
It’s been the fodder of pundits and politicians for years now, to talk about hacking elections, particularly by a particularly large country in northern Asia. Be it bravery or foolishness, we’re actually going to take a brief look at some real stories of political hacking.
First up, A trio of Dutch hackers managed to break into Donald Trump’s twitter account back in 2016, just before the election. How? The same story we’re all familiar with: password re-use and a LinkedIn database dump. Fun fact, Donald Trump’s favorite password was “yourefired”.
A successful break-in is often accompanied by a moment of terror. “Did I do everything right, or am I going to jail for this?” It’s not an unfounded fear. Breaking into a corporation is one thing, but what happens to the guys that hacked the president of the US? The moment their long-shot attempts paid off, they went into defensive mode, and documented everything. Once they had their documentation safely secured, an email was sent off to USCERT (United States Computer Emergency Readiness Team) informing them of what was found. Our Dutch friends haven’t been arrested or “disappeared”, so it seems their responsible disclosure was well received.
In a similar story, a former Australian prime minister posted a picture online containing his boarding pass, and a resourceful researcher managed to use that information to recover his passport and telephone number. Did you know that a boarding pass is considered sensitive information? To authenticate with an airline, all that is needed is a last name and matching booking reference number. This gets you access to a very uninteresting page, but when you have access to 1337 hackor tools (like Google Chrome’s page inspector), the sky is the limit. Apparently the Qantas website backend was sending everything in the database about the given customer, and only a few bits of that information was being shown to the user. Far more information was just waiting to be sniffed out.
The whole story is a trip, and ends with a phone call with the politician in question. Go read it, you won’t regret it.
Tor 0-Day?
[Dr. Neal Krawetz] runs a TOR hidden service, and found himself the victim of a DDoS attack over the TOR network. He called up a friend who did network security professionally, and asked for help. After reading out half of the public IP address where the hosting server lived, his friend told him the rest of the address. Let’s think through that process. Hidden TOR service under attack, someone with access to a big enough Network Operations Center (NOC) can tell what the Public IP address of that service is. This is a fundamental break in TOR’s purpose.
In retrospect, it’s pretty obvious that if you can watch traffic on a large chunk of the internet, or enough of the TOR nodes, you can figure out what service is running where. The surprise is how small the percentage needs to be, and that there are already companies (and certainly three-letter agencies) that casually have the capability to make those connections. [Krawetz] calls these flaws 0-days, which is technically correct, because there are no real mitigations in place to protect against them. Really, it should serve as a reminder of the limitations of the TOR model.
The big news this week is the huge flaw in Microsoft’s Active Directory, CVE-2020-1472 (whitepaper). Netlogon is a part of the Windows domain scheme, and is used to authenticate users without actually sending passwords over the network. Modern versions of Windows use AES-CFB8 as the cryptographic engine that powers Netlogon authentication. This peculiar mode of AES takes an initialization vector (IV) along with the key and plaintext. The weakness here is that the Microsoft implementation sets the IV to all zeros.
XKCD.com CC BY-NC 2.5
It’s worth taking a moment to cover why IVs exist, and why they are important. The basic AES encryption process has two inputs: a 128 bit (16 byte) plaintext, and a 128, 192, or 256 bit key. The same plaintext and key will result in the same ciphertext output every time. Encrypting more that 128 bits of data with this naive approach will quickly reveal a problem — It’s possible to find patterns in the output. Even worse, a clever examination of the patterns could build a decoding book. Those 16 byte patterns that occur most often would be guessed first. It would be like a giant crossword puzzle, trying to fill in the gaps.
This problem predates AES by many years, and thankfully a good solution has been around for a long time, too. Cipher Block Chaining (CBC) takes the ciphertext output of each block and mixes it (XOR) with the plaintext input of the next block before encrypting. This technique ensures the output blocks don’t correlate even when the plaintext is the same. The downside is that if one block is lost, the entire rest of the data cannot be decrypted. You may ask, what is mixed with the plaintext for the first block? There is no previous block to pull from, so what data is used to initialize the process? Yes, the name gives it away. This is an initialization vector: data used to build the initial state of a crypto scheme. Generally speaking, an IV is not secret, but it should be randomized. In the case of CBC, a non-random IV value like all zeros doesn’t entirely break the encryption scheme, but could lead to weaknesses.
Netlogon, on the other hand, uses a Cipher FeedBack (CFB8) mode of AES. This mode takes a 16 byte IV, and prepends that value to the data to be encrypted. The basic AES operation is performed on the first 16 bytes of this message (just the IV). The first byte of the output is XOR’d with the 17th byte of the combined string, and then the 16 byte window slides one byte to the right. When the last byte of the plaintext message has been XOR’ed, the IV is dropped and the process is finished. The peculiar construction of AES-CFB8 means that a random IV is much more important to strong encryption.
Remember the actual flaw? Microsoft’s implementation sets that IV value as all zeros. The encryption key is generated from the password, but the plaintext to be encrypted can be specified by the attacker. It’s fairly simple to manipulate the situation such that the entire IV + Plaintext string consists of zeros. In this state, 1-in-256 keys will result in an all-zero ciphertext. Put another way, the 128-bit security of AES is reduced to 8-bit. Within just a handful of guesses, an attacker can use Netlogon to authenticate as any user.
Microsoft has patched the issue in their August security updates. While it’s true that exploiting this issue does require a toehold in a network, the exploitation is simple and proof of concept code is already available. This is definitely an issue to go patch right away.
Few security truisms are as universal as “Enable two factor authentication.” There is a slight gotcha there. 2FA adds an extra attack surface. Palo Alto found this out the hard way with their PAN-OS systems. With 2FA or the captive portal enabled, it’s possible to exploit a buffer overflow and execute code as root. Because the interface to be exploited is often exposed to the public, this vulnerability scored a 9.8 critical rating.
CardBleed Virtual Card Skimmer
Magento is an e-commerce platform, owned by Adobe since 2018. To put that more simply, it’s a shopping cart system for websites. In the last few days, it seems that nearly 2,000 Magento v1 instances were compromised, with a digital skimmer installed on those sites. The rapid exploitation would suggest that someone had a database of Magento powered sites, and acquired a zero-day exploit that could be automated.
Hacking Politicians for Fun and Profit
It’s been the fodder of pundits and politicians for years now, to talk about hacking elections, particularly by a particularly large country in northern Asia. Be it bravery or foolishness, we’re actually going to take a brief look at some real stories of political hacking.
First up, A trio of Dutch hackers managed to break into Donald Trump’s twitter account back in 2016, just before the election. How? The same story we’re all familiar with: password re-use and a LinkedIn database dump. Fun fact, Donald Trump’s favorite password was “yourefired”.
A successful break-in is often accompanied by a moment of terror. “Did I do everything right, or am I going to jail for this?” It’s not an unfounded fear. Breaking into a corporation is one thing, but what happens to the guys that hacked the president of the US? The moment their long-shot attempts paid off, they went into defensive mode, and documented everything. Once they had their documentation safely secured, an email was sent off to USCERT (United States Computer Emergency Readiness Team) informing them of what was found. Our Dutch friends haven’t been arrested or “disappeared”, so it seems their responsible disclosure was well received.
In a similar story, a former Australian prime minister posted a picture online containing his boarding pass, and a resourceful researcher managed to use that information to recover his passport and telephone number. Did you know that a boarding pass is considered sensitive information? To authenticate with an airline, all that is needed is a last name and matching booking reference number. This gets you access to a very uninteresting page, but when you have access to 1337 hackor tools (like Google Chrome’s page inspector), the sky is the limit. Apparently the Quantas website backend was sending everything in the database about the given customer, and only a few bits of that information was being shown to the user. Far more information was just waiting to be sniffed out.
The whole story is a trip, and ends with a phone call with the politician in question. Go read it, you won’t regret it.
Tor 0-Day?
[Dr. Neal Krawetz] runs a TOR hidden service, and found himself the victim of a DDoS attack over the TOR network. He called up a friend who did network security professionally, and asked for help. After reading out half of the public IP address where the hosting server lived, his friend told him the rest of the address. Let’s think through that process. Hidden TOR service under attack, someone with access to a big enough Network Operations Center (NOC) can tell what the Public IP address of that service is. This is a fundamental break in TOR’s purpose.
In retrospect, it’s pretty obvious that if you can watch traffic on a large chunk of the internet, or enough of the TOR nodes, you can figure out what service is running where. The surprise is how small the percentage needs to be, and that there are already companies (and certainly three-letter agencies) that casually have the capability to make those connections. [Krawetz] calls these flaws 0-days, which is technically correct, because there are no real mitigations in place to protect against them. Really, it should serve as a reminder of the limitations of the TOR model.
The big news this week is the huge flaw in Microsoft’s Active Directory, CVE-2020-1472 (whitepaper). Netlogon is a part of the Windows domain scheme, and is used to authenticate users without actually sending passwords over the network. Modern versions of Windows use AES-CFB8 as the cryptographic engine that powers Netlogon authentication. This peculiar mode of AES takes an initialization vector (IV) along with the key and plaintext. The weakness here is that the Microsoft implementation sets the IV to all zeros.
XKCD.com CC BY-NC 2.5
It’s worth taking a moment to cover why IVs exist, and why they are important. The basic AES encryption process has two inputs: a 128 bit (16 byte) plaintext, and a 128,192, or 256 bit key. The same plaintext and key will result in the same ciphertext output every time. Encrypting more that 128 bits of data with this naive approach will quickly reveal a problem — It’s possible to find patterns in the output. Even worse, a clever examination of the patterns could build a decoding book. Those 16 byte patterns that occur most often would be guessed first. It would be like a giant crossword puzzle, trying to fill in the gaps.
This problem predates AES by many years, and thankfully a good solution has been around for a long time, too. Cipher Block Chaining (CBC) takes the ciphertext output of each block and mixes it (XOR) with the plaintext input of the next block before encrypting. This technique ensures the output blocks don’t correlate even when the plaintext is the same. The downside is that if one block is lost, the entire rest of the data cannot be decrypted. You may ask, what is mixed with the plaintext for the first block? There is no previous block to pull from, so what data is used to initialize the process? Yes, the name gives it away. This is an initialization vector: data used to build the initial state of a crypto scheme. Generally speaking, an IV is not secret, but it should be randomized. In the case of CBC, a non-random IV value like all zeros doesn’t entirely break the encryption scheme, but could lead to weaknesses.
Netlogon, on the other hand, uses a Cipher FeedBack (CFB8) mode of AES. This mode takes a 16 byte IV, and prepends that value to the data to be encrypted. The basic AES operation is performed on the first 16 bytes of this message (just the IV). The first byte of the output is XOR’d with the 17th byte of the combined string, and then the 16 byte window slides one byte to the right. When the last byte of the plaintext message has been XOR’ed, the IV is dropped and the process is finished. The peculiar construction of AES-CFB8 means that a random IV is much more important to strong encryption.
Remember the actual flaw? Microsoft’s implementation sets that IV value as all zeros. The encryption key is generated from the password, but the plaintext to be encrypted can be specified by the attacker. It’s fairly simple to manipulate the situation such that the entire IV + Plaintext string consists of zeros. In this state, 1-in-256 keys will result in an all-zero ciphertext. Put another way, the 128-bit security of AES is reduced to 8-bit. Within just a handful of guesses, an attacker can use Netlogon to authenticate as any user.
Microsoft has patched the issue in their August security updates. While it’s true that exploiting this issue does require a toehold in a network, the exploitation is simple and proof of concept code is already available. This is definitely an issue to go patch right away.
Few security truisms are as universal as “Enable two factor authentication.” There is a slight gotcha there. 2FA adds an extra attack surface. Palo Alto found this out the hard way with their PAN-OS systems. With 2FA or the captive portal enabled, it’s possible to exploit a buffer overflow and execute code as root. Because the interface to be exploited is often exposed to the public, this vulnerability scored a 9.8 critical rating.
CardBleed Virtual Card Skimmer
Magento is an e-commerce platform, owned by Adobe since 2018. To put that more simply, it’s a shopping cart system for websites. In the last few days, it seems that nearly 2,000 Magento v1 instances were compromised, with a digital skimmer installed on those sites. The rapid exploitation would suggest that someone had a database of Magento powered sites, and acquired a zero-day exploit that could be automated.
Hacking Politicians for Fun and Profit
It’s been the fodder of pundits and politicians for years now, to talk about hacking elections, particularly by a particularly large country in northern Asia. Be it bravery or foolishness, we’re actually going to take a brief look at some real stories of political hacking.
First up, A trio of Dutch hackers managed to break into Donald Trump’s twitter account back in 2016, just before the election. How? The same story we’re all familiar with: password re-use and a LinkedIn database dump. Fun fact, Donald Trump’s favorite password was “yourefired”.
A successful break-in is often accompanied by a moment of terror. “Did I do everything right, or am I going to jail for this?” It’s not an unfounded fear. Breaking into a corporation is one thing, but what happens to the guys that hacked the president of the US? The moment their long-shot attempts paid off, they went into defensive mode, and documented everything. Once they had their documentation safely secured, an email was sent off to USCERT (United States Computer Emergency Readiness Team) informing them of what was found. Our Dutch friends haven’t been arrested or “disappeared”, so it seems their responsible disclosure was well received.
In a similar story, a former Australian prime minister posted a picture online containing his boarding pass, and a resourceful researcher managed to use that information to recover his passport and telephone number. Did you know that a boarding pass is considered sensitive information? To authenticate with an airline, all that is needed is a last name and matching booking reference number. This gets you access to a very uninteresting page, but when you have access to 1337 hackor tools (like Google Chrome’s page inspector), the sky is the limit. Apparently the Quantas website backend was sending everything in the database about the given customer, and only a few bits of that information was being shown to the user. Far more information was just waiting to be sniffed out.
The whole story is a trip, and ends with a phone call with the politician in question. Go read it, you won’t regret it.
Tor 0-Day?
[Dr. Neal Krawetz] runs a TOR hidden service, and found himself the victim of a DDoS attack over the TOR network. He called up a friend who did network security professionally, and asked for help. After reading out half of the public IP address where the hosting server lived, his friend told him the rest of the address. Let’s think through that process. Hidden TOR service under attack, someone with access to a big enough Network Operations Center (NOC) can tell what the Public IP address of that service is. This is a fundamental break in TOR’s purpose.
In retrospect, it’s pretty obvious that if you can watch traffic on a large chunk of the internet, or enough of the TOR nodes, you can figure out what service is running where. The surprise is how small the percentage needs to be, and that there are already companies (and certainly three-letter agencies) that casually have the capability to make those connections. [Krawetz] calls these flaws 0-days, which is technically correct, because there are no real mitigations in place to protect against them. Really, it should serve as a reminder of the limitations of the TOR model.
Electronic devices can be surprisingly leaky, often spraying out information for anyone close by to receive. [Docter Cube] has found another such leak, this time with the speakers in iPhones. While repairing an old AM radio and listening to a podcast on his iPhone, he discovered that the radio was receiving audio the from his iPhone when tuned to 950-970kHz.
[Docter Cube] states that he was able to receive the audio signal up to 20 feet away. A number of people responded to the tweet with video and test results from different phones. It appears that iPhones 7 to 10 are affected, and there is at least one report for a Motorola Android phone. The amplifier circuit of the speaker appears to be the most likely culprit, with some reports saying that the volume setting had a big impact. With the short range the security risk should be minor, although we would be interested to see the results of testing with higher gain antennas. It is also likely that the emission levels still fall within FCC Part 15 limits.
I've confirmed this on an 8 non-pro AND discovered that when you're around 960 KHz you ALSO can detect the haptic clicks! I am suspecting that they are running a class D amp with the PWM at 960 KHz, which would be 20x 48khz-right on the mark for a class D amp. Video demo of both. pic.twitter.com/EbodZS11kB
The phenomenon of electronics leaking unintended information in magnetic waves has been knows since WW2, and it even has a codename, TEMPEST. If you want to learn more about it and do some experimentation, there are a number of open source software toolkits you can play with.
While the full steampunk aesthetic might be a bit much for most people, those antique gauges do have a certain charm about them. Unfortunately, implementing them on a modern project can be somewhat tricky. Even if you’ve got a stock of old gauges laying around, you’ve still got to modify the scale markings and figure out how to drive them with digital electronics. While we’ve seen plenty of people do it over the years, there’s no debating it’s a lot harder than just wiring up an I2C display.
But maybe it doesn’t have to be. With his Rad-O-Matic, [Hans Jørgen Grimstad] created a pretty convincing “analog” gauge using a small e-ink panel. Of course it won’t fool anyone who gives it a close look, but at a glance, you could certainly be forgiven for thinking it was some kind of vintage indicator. Especially with the cracked and stained Fresnel lens he put in front of it.
For this project [Hans] used a LilyGo T5, which combines an ESP32 with a 2.13 inch electronic paper display. These are presumably meant to be development boards for digital signage applications, but they occasionally show up in hacker projects since they’re so easy to work with. The board pulls data from a RD200M radon sensor over a simple UART connection, and the current reading is indicated by a “needle” that moves across a horizontal scale on the display.
On its own, it wouldn’t look very vintage. In fact, quite the opposite. But [Hans] really helped sell the look on this project by designing and 3D printing a chunky enclosure and then weathering it to make it look like it’s been kicking around since the Cold War.
We would have never guessed there would be so many browser-based CAD packages. While TinkerCAD is great for simple things, there are also packages such as OnShape that rival commercial CAD programs. A site calle Figuro claims to occupy the space between TinkerCAD and Blender. We aren’t so sure, but it is an interesting entry into the field. Apparently, Figuro has been around for some time, but has recently had a major face lift. The new interface looks good, but it has invalidated a number of video tutorials on their YouTube channel.
One of the things we like about TinkerCAD is it is highly discoverable. That is, you can fire it up, play with it a bit, and probably do quite a few things. Maybe it is just us, but Figuro didn’t give us the same experience. It is easy enough to draw simple shapes. But trying to multiselect was unreliable. Panning and rotating the view was very sensitive too, so we found we were occasionally lost in the work view with no easy way to reset the view. Even something as simple as subtracting one shape from another was painful.
On the plus side, there were some interesting tools such as sculpting, and maybe if you were more accustomed to working in something like Blender, it might have been easier to use. It is also possible that some of the bad experience was due to browser compatibility issues. For example, the Alt key modifies mouse movement, but on Linux with KDE, moving the mouse with the Alt key pressed moves the entire browser.
Sure, you can turn that off, but we didn’t really want to disable that behavior for the browser. However, things like the lack of a clear select indication during multiselect didn’t seem to be browser or operating system related. It also seems like sometimes the program treats an object like a cube as an entity, but in other cases, you work with the faces of the cube.
Maybe it is us. It doesn’t cost anything to try and see if you have a better experience. Updated tutorials would probably help, too. But we’ll stick with TinkerCAD or some of our favorite desktop programs. If you must use the browser, there’s 3D Slash (like designing in Mine Craft), Vectary (not free), SketchUp, or — if you have a few days for training — OnShape. If you don’t like anything on someone’s server, try this one all in JavaScript.
Atmospheric pressure is all around us, and capable of providing a great deal of force when used properly. As Otto Von Guericke demonstrated with his Magdeburg hemispheres over 350 years ago, simply removing air from a chamber to create a vacuum can have astounding results. More recently, [Tom Stanton] has used vacuum to power a small 3D-printed dragster.
In the dragster build, a typical plunger syringe is plugged at the end, and the plunger pulled back. Atmospheric pressure acts against the vacuum, wanting to push the plunger back towards its original position. To make use of this, a string is attached to the plunger, causing it to turn a gear as it moves forward, driving the rear wheels through a belt drive. With the correct gear ratio on the belt drive, the dragster is capable of spinning its tires and shooting forwards at a quick pace.
The work is a great follow on from [Tom]’s earlier vacuum experiments, using syringes as small rockets. It reminds us of the classic CO2 dragsters from high school competitions, and would be a great project for any science class. Video after the break.
You wake up in the morning, and check Hackaday over breakfast. Then it’s off to work or school, where you’ve already had to explain the Jolly Wrencher to your shoulder-surfing colleagues. And then to a hackspace or back to your home lab, stopping by the skull-and-cross-wrenches while commuting, naturally. You don’t bleed red, but rather #F3BF10. It’s time we talked.
The Hackaday writing crew goes to great lengths to cover all that is interesting to engineers and enthusiasts. We find ourselves stretched a bit thin and it’s time to ask for help. Want to lend a hand while making some extra dough to plow back into your projects? We’re looking for contributors to write a few articles per week and keep the Hackaday flame burning.
Contributors are hired as private contractors and paid for each article. You should have the technical expertise to understand the projects you write about, and a passion for the wide range of topics we feature. You’ll have access to the Hackaday Tips Line, and we count on your judgement to help us find the juicy nuggets that you’d want to share with your hacker friends.
One example article written in the voice of Hackaday. Include a banner image, at least 150 words, the link to the project, and any in-links to related and relevant Hackaday features. We need to know that you can write.
Details about your background (education, employment, interests) that make you a valuable addition to the team. What do you like, and what do you do?
Links to your blog/project posts/etc. that have been published on the Internet, if any.
What are you waiting for? Ladies and Gentlemen, start your applications!
Remember Heelys, the shoes with wheels in the heels? Just lift up your toes, and away you go. We were at least ten or fifteen years older than the target demographic, but got a pair anyway just to please our inner child and have some fun. Young kids would wear them everywhere and zip around inside stores to the annoyance of everyone but other young kids. We imagine some shopkeepers got to the point where they could spot the things as they walked in the door and nipped the skating party in the bud.
Each wheel has a bearing on both ends that spin on a threaded rod. We’re not sure why [DevNerd] went with threaded rod, because it seems like that would prematurely wear out the frame box.
Remember Heelys, the shoes with wheels in the heels? Just lift up your toes, and away you go. We were at least ten or fifteen years older than the target demographic, but got a pair anyway just to please our inner child and have some fun. Young kids would wear them everywhere and zip around inside stores to the annoyance of everyone but other young kids. We imagine some shopkeepers got to the point where they could spot the things as they walked in the door and nipped the skating party in the bud.
Each wheel has a bearing on both ends that spin on a threaded rod. We’re not sure why [DevNerd] went with threaded rod, because it seems like that would prematurely wear out the frame box.
Remember Heelys, the shoes with wheels in the heels? Just lift up your toes, and away you go. We were at least ten or fifteen years older than the target demographic, but got a pair anyway just to please our inner child and have some fun. Young kids would wear them everywhere and zip around inside stores to the annoyance of everyone but other young kids. We imagine some shopkeepers got to the point where they could spot the things as they walked in the door and nipped the skating party in the bud.
Each wheel has a bearing on both ends that spin on a threaded rod. We’re not sure why [DevNerd] went with threaded rod, because it seems like that would prematurely wear out the frame box.
[3dprintedlife] is apparently a little bored. Instead of whiling away the time playing tic tac toe, he built an impressive tic tac toe robot named TOBOT. The robot uses a Rasberry Pi Zero and a Feather to control a two-axis robot arm that can draw the board and make moves using a pen. It also uses a simple computer vision system to look at the board to understand your move, and it has a voice too.
The other thing TOBOT has is a bad attitude. The robot wants to win. Badly. Check out the video below and you’ll see what we mean.
The code is on GitHub. We were impressed with the simple algorithm TOBOT uses to watch your move. The 3D printed robot arm looks and works great, too. The initial PC board didn’t work out very well, but the replacement did a great job.
We love projects that combine mechanics, electronics, and software. Bonus points for the element of whimsy, too. We wonder if TOBOT will learn to play some other games like dots.
