The joys of overengineering a simple gift. [Joren] wanted to create a dress for his daughter’s fourth birthday that would react with lights in sequence for a song from Frozen. The dress and an LED strip, along with a digital microphone and a battery were easy to procure. But how to make it all work? An ESP32 did the trick.

While the project’s name–Olaf–sounds like it was from Frozen, according to the GitHub page it actually means Overly Lightweight Acoustic Fingerprinting. Right. However, as the name implies, it can learn to identify any sound you want.

One interesting twist. The code is in C, so running it through Emscripten allows the code to run in your browser and you can watch it work alongside a YouTube video of the movie. You can see in the image above that the fingerprint screen gets red dots until it matches the audio and then the dots turn green, indicating a match.

Even if you don’t want a magic Frozen dress, the code on GitHub could be a good starting point for developing audio-sensitive applications.

source https://hackaday.com/2020/08/30/olaf-lets-an-esp32-listen-to-the-music/

Humans continuously communicate with our bodies, and face masks cover one of the most expressive parts. For some, this is a muffler on strangers, but devastating for people who rely on lip-reading. Several masks exist that have a clear window for precisely this purpose, but they’re specialty and high-demand. [Erin St Blaine] over at Adafruit shows how she makes windowed masks with stuff you may already have in your house. Even if your sewing machine is locked up the local maker-space, you are in luck, because you don’t need a single stitch. For the thread-inclined, it is easy to tweak the recipe.

The part of the mask that touches your face is terry cloth, but any breathable cotton towel should work. There is a PDF in the instructions where you can print templates in four sizes. You will also find a cutout for the plastic window salvaged from your cold soft drink cup. A water bottle should work too. Flexible glue holds the fabric together, but to attach the ear-loops, we fall back on our old friend, the red Swingline. If you don’t have that color and brand, any stapler will do in a pinch. Don’t forget to add some defogger and keep smiling.

Wear your homemade mask proudly and fasten it well, but not too fast.

Thank you, [Gerben], for the tip.

source https://hackaday.com/2020/08/30/read-my-lips-under-this-no-sew-mask/

The half-track is a vehicle design that has gradually fallen out of favour in the decades since World War II. Combining the benefits of easy driving and handling of wheeled vehicles with the strong mud and snow performance of a tracked vehicle, they served a niche before largely being phased out with the rise of the armoured personnel carrier. [JackCarter] wished to build his own, so whipped up a lasercut RC version of the SdKfz 251 22.

The work is impressive, with [JackCarter] creating the design in Solidworks from photos and illustrations of the vehicle. The moving parts are lasercut, including the tracks themselves, assembled from many tiny lasercut MDF parts. The benefit of using lasercutting to make the model is that it was easy for [Jack Carter] to create simple jigs to ease the process of putting the tracks together. A NodeMCU with a motor shield controls the gear motors used to drive the tracks, and drives a servo for steering. Control is via a smartphone, thanks to the Blynk framework which makes building apps for custom projects easy.

The finished product really shows off [JackCarter]’s 3D design skills, and looks like great fun to build and drive. We’d love to see it with a lick of paint and some period decals to really complete the look. Hackers love a good tracked vehicle, and we’ve seen some impressive builds before. Video after the break.

source https://hackaday.com/2020/08/29/rc-halftrack-is-lasercut-masterpiece/

Most hobby-grade software defined radio setups don’t transmit. Of the few that do, most of them put out anemic levels around one milliwatt or so. If you want to do something outside of the lab, you’ll need an amplifier and that’s what [Tech Minds] shows how to do in a recent video. (Embedded below.)

The video covers LimeSDR, HackRF, and the Pluto SDR, although the amplifiers should work with any transmitter. The SPF5189Z module is quite cheap and covers 50 MHz to 4 GHz, amplifying everything you throw at it. The downside is that it will amplify everything you throw at it, even parts of the signal you don’t want, such as spurs and harmonics.

There are other modules, depending on your needs. The CN0417 covers a very narrow range from 2.4 GHz to 2.5 GHz. (If you can call 100 MHz bandwidth “narrow”.) The RF2126 will cover from 400 Mhz to 2.7 GHz.

None of these are powerhouses. The maximum 20 dB gain will only give you a watt or so out with the minimal drive from most SDR transmitters. But for very many applications, that’s plenty, especially with some filtering.

Unfortunately the gain isn’t stable, and we wonder about the linearity which would affect some modulation modes. There are datasheets for these devices around, such as this one for the SPF5189Z.

If you are really into SDR, the SDR Academy went virtual this year. You might also enjoy this book.

source https://hackaday.com/2020/08/29/sdr-transmitting-gets-the-power/

Big fizzing electrical arcs are fun, and handled properly, not too dangerous either. The Jacob’s Ladder is one such piece of arc-generating equipment, one that featured heavily in vintage sci-fi films. It remains a charming demonstration of high-voltage electrical principles, and you can easily build your own mini version at home.

The build starts with a basic high-voltage step-up kit that turns 4V DC into 15 kV at the output. At this voltage level, it’s possible to generate an arc in air. To create the Jacob’s ladder, the kit is wired up to a pair of closely-spaced electrodes that slowly get farther apart as they go up vertically. When an arc jumps from one electrode to the other, it ionises the air, and the voltage sags due to the current flow. The flowing current heats up the air, which begins to rise, taking the current path with it, causing the familiar climbing arc we all know and love. As the distance between the electrodes increases towards the top, the arc can eventually no longer be sustained. With no current flowing, the voltage rises again, and a new arc forms at the bottom of the device, repeating the process.

It’s a fun build that would make an excellent desk toy, albeit best shown under glass to avoid accidental electric shocks. You can even build a larger one out of microwave parts if you’re so inclined. Video after the break.

source https://hackaday.com/2020/08/29/a-tiny-jacobs-ladder-you-can-build-at-home/

Millions of people all over the world don’t have access to clean drinking water, and it’s largely because of pollution by corporations and individuals. Solving this problem requires an affordable, scalable way to quickly judge water quality, package the data, and present it to an authority that can crack down on the polluters before the evidence dissipates. Ideally, the solution would be open source and easy to replicate. The more citizen scientists, the better.

[Andrei Florian]’s WaterAid flows directly from this line of thinking. Dip this small handheld device below the surface, and it quickly takes a bunch of water quality and atmospheric readings, averages them, and sends the data to a web dashboard using an Arduino MKR GSM.

WaterAid judges quality by testing the pH and the turbidity of the water, which gauges the amount of impurities. Commercial turbidity sensors work by measuring the amount of light scattered by the solids present in a liquid, so [Andrei] made a DIY version with an LED pointed at a photocell. WaterAid also reads the air temperature and humidity, and reports its location along with a timestamp.

This device can run in one of two modes, depending on the application. The enterprise mode is designed for a fleet of devices placed strategically about a body of water. In this mode, the devices sample continuously, taking readings every 15 minutes, and can send notifications that trigger on predefined thresholds. There’s also a one-and-done individual mode for hikers and campers who need to find potable water. Once WaterAid takes the readings, the NeoPixel ring provides instant color-coded judgment. Check out the demo after the break.

source https://hackaday.com/2020/08/29/wateraid-finds-potable-water-and-stops-polluters/

Millions of people all over the world don’t have access to clean drinking water, and it’s largely because of pollution by corporations and individuals. Solving this problem requires an affordable, scalable way to quickly judge water quality, package the data, and present it to an authority that can crack down on the polluters before the evidence dissipates. Ideally, the solution would be open source and easy to replicate. The more citizen scientists, the better.

[Andrei Florian]’s WaterAid flows directly from this line of thinking. Dip this small handheld device below the surface, and it quickly takes a bunch of water quality and atmospheric readings, averages them, and sends the data to a web dashboard using an Arduino MKR GSM.

WaterAid judges quality by testing the pH and the turbidity of the water, which gauges the amount of impurities. Commercial turbidity sensors work by measuring the amount of light scattered by the solids present in a liquid, so [Andrei] made a DIY version with an LED pointed at a photocell. WaterAid also reads the air temperature and humidity, and reports its location along with a timestamp.

This device can run in one of two modes, depending on the application. The enterprise mode is designed for a fleet of devices placed strategically about a body of water. In this mode, the devices sample continuously, taking readings every 15 minutes, and can send notifications that trigger on predefined thresholds. There’s also a one-and-done individual mode for hikers and campers who need to find potable water. Once WaterAid takes the readings, the NeoPixel ring provides instant color-coded judgment. Check out the demo after the break.

source https://hackaday.com/2020/08/29/wateraid-finds-potable-water-and-stops-polluters/

Microwaves used to be simple to use. Set the dial for the desired time, and hit start. Then, everything went digital and the average microwave now takes between four and six button presses in precise order just to start heating. Music players have gone down a similar path, and those that grew up in the era of vinyl records can find modern digital media simply too hard to work with. To solve this problem, [ananords] whipped up Juuke, a music player focused on ease of use.

The Juuke has a simplistic interface intended to be as easy to use as possible. Songs are selected using printed cards with embedded RFID tags – placing them on the Juuke triggers playback. Volume is controlled with a simple knob, and the only two buttons are for play/pause and shuffle mode.

Underneath, an Arduino Uno runs the show, hooked up to a RC522 RFID interface board. Music is handled by the DFPlayer mini, which loads tracks off a microSD card. The DFPlayer can be hooked up to a speaker directly, but there’s also a 3.5mm jack output if the device is to be used with an external amplifier.

It’s a tidy project, and one that actually looks pretty fun to use. Obviously, there’s some time investment required to prepare the SD card and produce the RFID cards, but the final product could be fun to use at a party, too. We’ve seen similar builds before, as well. Video after the break.

 

source https://hackaday.com/2020/08/29/easy-to-use-music-player-relies-on-rfid/

Your entry for the 2020 Hackaday Prize needs to be in by Monday morning, August 31st!

This is the deadline for initial entries, if you’re one of the one hundred lucky projects that advance to the finals you’ll still have another month to polish up your project. Why not make this weekend your own personal hackathon?

Entries focus on four challenges outlined by our non-profit partners this year. From improving modular dome housing and developing manufacturing techniques in disaster zones, to designing interfaces for people with physical challenges and protecting natural ocean landscapes, there’s plenty of room to be creative here. In addition to the $50,000 grand prize there are still nine other top prizes up for grabs.

You can do this. Tell your story, show a proof of concept, and document it to convince the judges your project is viable. It’ll be tight, but hackers work best when deadlines are looming. We can’t wait to see what you come up with between now and Monday!

source https://hackaday.com/2020/08/29/two-days-left-to-enter-the-hackaday-prize/

Your entry for the 2020 Hackaday Prize needs to be in by Monday morning, August 31st!

This is the deadline for initial entries, if you’re one of the one hundred lucky projects that advance to the finals you’ll still have another month to polish up your project. Why not make this weekend your own personal hackathon?

Entries focus on four challenges outlined by our non-profit partners this year. From improving modular dome housing and developing manufacturing techniques in disaster zones, to designing interfaces for people with physical challenges and protecting natural ocean landscapes, there’s plenty of room to be creative here. In addition to the $50,000 grand prize there are still nine other top prizes up for grabs.

You can do this. Tell your story, show a proof of concept, and document it to convince the judges your project is viable. It’ll be tight, but hackers work best when deadlines are looming. We can’t wait to see what you come up with between now and Monday!

source https://hackaday.com/2020/08/29/two-days-left-to-enter-the-hackaday-prize/

Turning on a lightbulb has never been easier. You can do it from your mobile. Voice activation through home assistants is robust. Wall switches even play nicely with the above methods. It was only a matter of time before someone decided to make it fun, if you consider a Rubik’s cube enjoyable. [Alastair Aitchison] at Playful Technology demonstrated that it is possible to trigger a relay when you match all the colors. Video also after the break.

The cube does little to obfuscate game data, so in this scope, it sends unencrypted transmissions. An ESP32 with [Alastair]’s Arduino code, can track each movement, and recognize a solved state. In the video, he solves the puzzle, and an actuator releases a balloon. He talks about some other cool things this could do, like home automation or a puzzle room, which is in his wheelhouse judging by the rest of his YouTube channel.

We would love to see different actions perform remote tasks. Twisting the top could set a timer for 1-2-3-4-5 minutes, while the bottom would change the bedroom lights from red-orange-yellow-green-blue-violet. Solving the puzzle should result in a barrage of NERF darts or maybe keep housemates from cranking the A/C on a whim.

source https://hackaday.com/2020/08/29/automation-with-a-new-twist/

As popular as the venerable Yaesu FT-817 transceiver might be with amateur radio operators, it’s not without its flaws, particularly in the user interface department. [Andy (G7UHN)] is painfully familiar with these flaws, so he designed this auxiliary display and control panel for the FT-817 to make operating it a little easier.

There are a ton of ways to enjoy ham radio, but one of the more popular ways is to bust out of the shack and operate in the great outdoors. From the seashore to mountain peaks, hams love giving their rigs some fresh air and sunshine. The battery-powered, multimode, all-band FT-817 is great for these jaunts, but to fit as much radio into a small package as they did, Yaesu engineers had to compromise on the controls. Rather than bristling with buttons, many of the most-used features of the radio are buried within menus that require multiple clicks and twists to access.

[Andy]’s solution is a PCB bearing an Arduino Nano, an LCD screen, and a whole bunch of actual buttons. The board sits on top of the case and talks to the radio over a 8-pin mini-DIN cable using both documented and undocumented  CAT, or Computer Aided Transceiver commands. The LCD displays the current status of various features and the buttons provide easy access to changing them, essentially by sending keystrokes to the radio.

Hats off to [Andy] for tackling this project. The only other FT-817 hack we’ve seen before was useful but far simpler, and didn’t require KiCad, which [Andy] had to teach himself for this one.

source https://hackaday.com/2020/08/29/auxiliary-display-makes-ham-radio-field-operations-easier/

Cats are nature’s born hunters. Whether its rodents, insects, or lasers, they’ll pounce and attack with ruthless efficiency. Built to challenge a cat, or perhaps merely to tease it, Sourino is a robotic mouse built with common off-the-shelf parts.

So named for the combination of Souris (French for “mouse”) and Arduino, the project is driven by an Arduino Nano. Hooked up to three sets of ultrasonic transducers, this gives the robot mouse much improved obstacle avoidance abilities compared to using just a single transducer front-and-centre. The ‘bot can navigate basic mazes or household floors with ease. A pair of geared motors are used for drive, using simple skid-steering to turn corners. It’s all packed in a 3D printed enclosure, which mounts the various components and exposes the ultrasonic sensors. There’s even an IR remote enabling mode selection or full manual control.

While the ‘bot lacks the speed and agility of common house mice, it’s nevertheless a project that teaches plenty of valuable lessons. We’re sure [Electrocat01] picked up plenty of skills in robotic navigation, mechanical design and 3D printing along the way. Creating robot mice is actually a competitive field, as we’ve seen before. Video after the break.

 

source https://hackaday.com/2020/08/28/robotic-mouse-toy-built-for-cats/

Cats are nature’s born hunters. Whether its rodents, insects, or lasers, they’ll pounce and attack with ruthless efficiency. Built to challenge a cat, or perhaps merely to tease it, Sourino is a robotic mouse built with common off-the-shelf parts.

So named for the combination of Souris (French for “mouse”) and Arduino, the project is driven by an Arduino Nano. Hooked up to three sets of ultrasonic transducers, this gives the robot mouse much improved obstacle avoidance abilities compared to using just a single transducer front-and-centre. The ‘bot can navigate basic mazes or household floors with ease. A pair of geared motors are used for drive, using simple skid-steering to turn corners. It’s all packed in a 3D printed enclosure, which mounts the various components and exposes the ultrasonic sensors. There’s even an IR remote enabling mode selection or full manual control.

While the ‘bot lacks the speed and agility of common house mice, it’s nevertheless a project that teaches plenty of valuable lessons. We’re sure [Electrocat01] picked up plenty of skills in robotic navigation, mechanical design and 3D printing along the way. Creating robot mice is actually a competitive field, as we’ve seen before. Video after the break.

 

source https://hackaday.com/2020/08/28/robotic-mouse-toy-built-for-cats/

Cats are nature’s born hunters. Whether its rodents, insects, or lasers, they’ll pounce and attack with ruthless efficiency. Built to challenge a cat, or perhaps merely to tease it, Sourino is a robotic mouse built with common off-the-shelf parts.

So named for the combination of Souris (French for “mouse”) and Arduino, the project is driven by an Arduino Nano. Hooked up to three sets of ultrasonic transducers, this gives the robot mouse much improved obstacle avoidance abilities compared to using just a single transducer front-and-centre. The ‘bot can navigate basic mazes or household floors with ease. A pair of geared motors are used for drive, using simple skid-steering to turn corners. It’s all packed in a 3D printed enclosure, which mounts the various components and exposes the ultrasonic sensors. There’s even an IR remote enabling mode selection or full manual control.

While the ‘bot lacks the speed and agility of common house mice, it’s nevertheless a project that teaches plenty of valuable lessons. We’re sure [Electrocat01] picked up plenty of skills in robotic navigation, mechanical design and 3D printing along the way. Creating robot mice is actually a competitive field, as we’ve seen before. Video after the break.

 

source https://hackaday.com/2020/08/28/robotic-mouse-toy-built-for-cats/

[Ottverse] has an interesting series in progress to demystify video compression. The latest installment promises to explain discrete cosine transforms as though you were five years old.

We’ll be honest. At five, we probably didn’t know how to interpret this sentence:

…the Discrete Cosine Transform takes a set of N correlated (similar) data-points and returns N de-correlated (dis-similar) data-points (coefficients) in such a way that the energy is compacted in only a few of the coefficients M where M << N.

Still, the explanation is pretty clear and we really liked the analogy with the spheres and the stars in a constellation.

The example Matlab code is probably also lost on a five-year-old, but we liked it. Anyone, we think, can understand the practical result where removing too much data — high compression — resulted in a poor quality image, but the image quality was pretty good even when 75% of the data vanishes.

So while you might not want to show this to your five-year-old, you might enjoy it and even learn something. The rest of the series is pretty good, too. There are discussions of data compression, codecs, and encoders. We are sure there’s more to come, also.

If you are not into Matlab, you could probably do the same trick with SciPy pretty easily. Or, try Octave, one of several open-source projects that are similar to Matlab.

source https://hackaday.com/2020/08/28/video-compression-explainer-like-were-five-year-olds/

Most of us can say that we have taken an obsolete hard drive out of a computer and felt it was a waste to toss it in the e-waste pile. Some of us have children’s drawings hung on the fridge with actuator magnets, or maybe a vast spreadsheet suspended on a steel filing cabinet. Let us not forget that there is also a high-speed, low-noise motor in there. On some models it is separate from the PCB, so grab an Electronic Speed Controller (ESC), your microcontroller of choice, and make yourself a salvaged HDD centrifuge like [Cave Man] has. His build uses the tray as a chassis, but he modeled and printed a new face in the same style as the original.

On top, he has an OLED screen for displaying the requested speed, measured speed, and runtime. Next to the display is a four-button pad with a customized legend for setting parameters. The video after the break shows the machine running through its paces. This version accommodates the tiny capillary tubes, microhematocrit tubes, for processing raw blood. This test can calculate the packed cell volume, which professionals use to determine things from dehydration to anemia.

There are other builds out there where people have modified an old drive into the kind of centrifuge that accepts larger diameter tubes, but this was a shining example of what is possible. One good turn deserves another, so we recommend a desktop bio-lab companion, or enlist some LEGO Mindstorms to help out.

source https://hackaday.com/2020/08/28/a-new-spin-on-a-medical-test/

CNC machines are every maker’s dream. Capable of churning out accurate parts from CAD designs with a minimum of manual labor, they’re a great tool to have in the workshop. Alternatively, you can use them for more entertaining pursuits. [Leo]’s project is one of the latter – etching greyscale photos on to eggs.

The first thing you’ll need is an egg-compatible CNC machine. The Eggbot is a popular option, else a fourth-axis on an existing machine can also do the job as in [Leo]’s case. Coupling the egg is a delicate task, for which some rubber paper rollers are salvaged from an old printer and put to work. Then, a laser needs to be fitted to the CNC head, and the egg depth mapped with a probe to ensure the entire etching is in focus. Then it’s simply a matter of loading up an image, and turning the greyscale data into the relevant G-code to burn it onto the egg.

Using eggs coated in black ink, the results [Leo] achieves are impressive. The eggs would make an amusing Easter gift, or serve as a great cheap way to teach students about CNC techniques. Obviously, eye protection is a must, and be sure to mount your laser securely to avoid any unintentional exposures. Video after the break.

source https://hackaday.com/2020/08/28/laser-etching-photos-on-to-eggs/

Since the COVID-19 pandemic started, we’ve seen several attempts to create homebrew ventilators designed to address the shortage of these lifesaving machines. Unfortunately, most hackers aren’t terribly experienced when it comes to designing practical medical equipment. So while many of the designs might have appeared functional on the workbench, there’s little chance they’d get used in any official capacity.

The open source DP Ventilator is still clearly the product of a couple plucky hackers, but we think it shows a level of design maturity that’s been missing in many of the earlier attempts. Made primarily with 3D printed components, this mechanical device is designed to operate a hand-held manual resuscitator; essentially standing in for a human operator. This makes the design far less complex than if it had to actually pump air itself, not to mention safer for the patient since the resuscitator (often referred to as an Ambu Bag) installed in it would be a sterile pre-packaged item.

In the video after the break, you can see just how much thought and effort has been put into the device’s touch screen interface. With a few quick taps the medical professional operating the DP Ventilator can dial in variables such as breathing rate, pressure, and volume to match the patient’s needs. While the Arduino Mega 2560 at the machine’s heart wouldn’t pass muster for any regulating body in charge of medical devices, we think with a few more tweaks, this design is getting close to something that might actually be able to save lives.

source https://hackaday.com/2020/08/28/building-a-heavy-duty-open-source-ventilator/

Hackaday editors Elliot Williams and Mike Szczys check in on the best hacks from the past week. All the buzz is the algorithm that can reverse engineer your house keys from the way they sound going into the lock. Cardboard construction goes extreme with an RC car build that’s beyond wizard-level. Speaking of junk builds, there’s a CNC mill tipped on its side grinding out results worlds better than you expect from something made with salvaged CD-ROM drives. And a starburst character display is a clever combination of laser cutting and alternative using UV-cured resin as a diffuser.

Take a look at the links below if you want to follow along, and as always, tell us what you think about this episode in the comments!

Direct download (~65 MB)

Places to follow Hackaday podcasts:

• Google Play
• iTunes
• Soundcloud
• Spotify
• Stitcher
• RSS

Episode 082 Show Notes:

New This Week:

• Running A Successful Hacker Camp In A Pandemic: BornHack 2020
• 2020 Hackaday Prize

Interesting Hacks of the Week:

• Mini CNC Mill Goes Horizontal To Reuse CD Drives
  • Cheap small CNC mill – “Formula 1551” for now
• Four Years Later, Off-Grid Office Shed Still Rocks
  • Working In Peace With An Off-Grid Office Shed
• Stealing Keys From The Sound Of The Lock
• Prop-Driven Cardboard RC Car Doesn’t Skimp On Performance
• Breaking Smartphone NFC Firmware: The Gory Details
  • RFID Readers, Writers, And Spoofers
  • Nexmon Turns Nexus 5 (and RPi3!) Into WiFi Toolkit
• Unique LED Display Inspired By Fighter Jet Dashboard

Quick Hacks:

• Elliot’s Picks:
  • New Arduino JPEG Library Focuses On Speed
  • Circle Guitar Creates Wall Of Sound
  • Sunrise, Sunset, Repeat
• Mike’s Picks:
  • MIDI Slide Whistle Shows The Value Of A Proper Fipple
  • Mini Marble-Powered Synth Pays Homage To Its Bigger Cousins
  • GTA V Mod Shows (And Cheats) Those Stunt Jump Hoops

Can’t-Miss Articles:

• 3D Printering: The World Of Non-Free 3D Models Is Buyer Beware
• Damage To Arecibo Leaves Gaping Hole In Astronomy
  • Aricebo Message

source https://hackaday.com/2020/08/28/hackaday-podcast-082-dj-cnc-nfc-black-box-sound-of-keys-and-payin-for-3d-prints/

[VoltLog] has a cheap Hantek LCR meter, but it only has two probes. The best resistance and impedance measurements, though, use four wires to improve accuracy. The first order of business was a custom PCB to fit into the connector of the meter, along with a 3D-printed case.

Using a four-wire scheme requires unusual alligator clips that don’t electrical short the jaws together. The clips were hard to solder and even harder to strain relief. but [VoltLog] seemed to handle it with little problem.

There are some ready-made solutions for this, of course, but the good ones aren’t cheap. Besides, this way, the lead length is exactly what you want and you can control the entire construction, including sheilding and strain releif.

If you haven’t run into four-wire sensing before, it is a simple idea. In a normal two-wire measurement, you send a voltage through the device under test and measure the current through the wires. But since you’re using the same pair of wires to deliver the current and measure it, the resistance of the test leads get tangled up in the measurement.

With four wires, one pair of wires is used to supply the current, and the other to measure the voltage drop across them. The sense wires won’t carry very much current and, thus, there won’t be a significant voltage drop between the device under test and the measurment device. There may be a drop across the supply wires, but we don’t care anymore.

We have seen four-wire measurements in a lot of different places. We even simulated how it improves measurements and you can too.

source https://hackaday.com/2020/08/28/creating-kelvin-test-leads-for-four-wire-measurments/

There is a scenario that keep security gurus up at night: Malware that can detect software compilation and insert itself into the resulting binary. A new Mac malware, XCSSET (PDF), does just that, running whenever Xcode is used to build an application. Not only is there the danger of compiled apps being malicious, the malware also collects data from the developer’s machine. It seems that the malware spreads through infected Xcode projects.

WordPress Plugins

WordPress has a complicated security track record. The core project has had very few serious vulnerabilities over the years. On the other hand, WordPress sites are routinely compromised. How? Generally through vulnerable plugins. Case in point? Advanced Access Manager. It’s a third party WordPress plugin with an estimate 100,000 installations. The problem is that this plugin requires user levels, a deprecated and removed WordPress feature. The missing feature had some unexpected results, like allowing any user to request administrator privileges.

The issue has been fixed in 6.6.2 of the plugin, so if you happen to run the Advanced Access Manager plugin, make sure to get it updated. Beyond that, maybe it’s time to do an audit on your WordPress site. Uninstall unused plugins, and make sure the rest are up to date, along with the WordPress installation itself.

Freepik

A source of graphics and stock photos, Freepik gives a few bits away for free, and requires a monthly subscription for access to the rest of the library. A few days ago, someone discovered a SQL injection attack on the icon site, and the user database was grabbed. A few things caught my interest about their report. First, the report claims that the only data that escaped was email addresses and in some cases, password hashes. It’s unclear why addresses and credit card information weren’t part of the leak.

The next tidbit of interest is that any account using a federated login, that is using a Facebook, Twitter, or Google account to log in, only exposed an email address. In retrospect, it’s an obvious advantage of using a single sign on. The service has that much less information to lose about the account. The other bit of interest is that a few older accounts still used salted MD5 password hashes, while the vast majority used the more modern bcrypt.

Overcoming Exploit Mitigations

Crowdstrike put out a pair of blog posts about the state of OS hardening techniques, and how to overcome them. Data Execution Prevention and Address Space Layout Randomization are considered legacy techniques at this point, so go check out the series to get up to date.

Let’s Talk About Crypto

What’s the first rule of crypto? “Don’t roll your own crypto.” What exactly does that mean, and why? We have a case study in how crypto can go wrong, and a few tips on how to do it right. The project in question is a .net implementation of the Branca token, which is an interesting protocol in itself.

That warning about rolling your own crypto usually means that you should use published algorithms, that have been proven by time and peer review. For years now, AES has had smarter people than you or I looking for flaws. It’s very likely that it’s a better block cipher than anything we could come up with. That warning, however, doesn’t mean that you shouldn’t ever build anything crypto related. If there isn’t a library that does what you need for a project, go for it, built it from scratch. But take some precautions to keep yourself out of trouble.

Test vectors are the published results of running an algorithm with specific settings. If you run AES with a certain key and a certain input text, you get a known ciphertext every time. A good set of test vectors will include possible edge cases, like an empty string for the plaintext. Find the test vectors for the crypto you’re using, and make sure your project replicates them. Even better, build in unit testing, and automate that process. The Branca token has published vectors, and the .net implementation in question failed to replicate. Oops.

Another bit of good crypto hygiene is to use constant time functions to thwart timing-based attacks. Again, in our example library, Branca uses the Poly1305 Message Authentication Code (MAC). A MAC is essentially a keyed hash that is appended to the string to be verified. It’s the last thing changed on the outgoing message, and the first thing checked on the incoming message. If the MAC doesn’t validate, the message can be dropped right away. It’s possible that an attacker would be able to detect how long it takes the receiving end to drop a message with an invalid MAC. If the comparison is done in a naive way, as it is here, the timing gives away how far into the comparison the message differed from what was expected. You know the scene in the movie when the super secret password is being guessed one character at a time? That’s kind of how a timing attack against this sort of flaw would work, and that’s what you want to avoid.

There are obviously more gotchas when working with cryptography, but this particular story underlines two of the first steps you should take to be sure that you’re using cryptography correctly. Use known good code and algorithms, verify inputs with outputs, and follow best practices like constant time string comparisons.

Hacking Google’s infrastructure for Fun and Profit

[Wouter ter Maat] and [Ezequiel Pereira] were researching Google’s Cloud SQL service, and found a SQL injection in a CSV export function. Just a bit of cleverness allowed them to dump data from a database into a specified file in the /mysql/temp/ directory. The real trick is that they could run the export again, but intercept the API call and modify it, adding command line options to the mysqldump command.

One of those options? Specifying an authentication plugin. Since they already had the ability to drop a file on the filesystem, getting mysqldump to run a malicious plugin was fairly easy, leading to a reverse shell. For their efforts, they got a message from the Google Site Reliability Engineering (SRE) team in the form of a greetings.txt file. The bugs they found have been fixed, but not before they discovered an SSH hijack that allowed escaping the SQL container. Let’s hope Google paid them a nice bounty for their hard work.

source https://hackaday.com/2020/08/28/this-week-in-security-xcode-infections-freepik-and-crypto-fails/

Since Apple switched to Intel chips in the mid-00s, the PowerPC chips from Motorola and the PowerPC Instruction Set Architecture (ISA) that they had been using largely fell by the wayside. While true that niche applications like supercomputing still use the Power ISA on other non-Apple hardware, the days of personal computing with PowerPC are largely gone unless you’re still desperately trying to keep your Power Mac G5 out of the landfill or replaying Twilight Princess. Luckily for enthusiasts, though, the Power ISA is now open source and this group has been working on an open-source laptop based on this architecture.

While development is ongoing and there are no end-user products available yet, the progress that this group has made shows promise. They have completed their PCB designs and schematics and have a working bill of materials, including a chassis from Slimbook. There are also prototypes with a T2080RDB development kit and a NXP T2080 processor, although they aren’t running on their intended hardware yet. While still in the infancy, there are promising videos (linked below) which show the prototypes operating smoothly under the auspices of the Debian distribution that is tailored specifically for the Power ISA.

We are excited to see work continue on this project, as the Power ISA has a number of advantages over x86 in performance, ARM when considering that it’s non-proprietary, and even RISC-V since it is older and better understood. If you want a deeper comparison between all of these ISAs, our own [Maya Posch] covered that topic in detail as well as covered the original move that IBM made to open-source the Power ISA.

source https://hackaday.com/2020/08/28/open-hardware-laptop-built-on-power-pc-isa/

Feature creep is typically something to be avoided, since watching a relatively simple project balloon into a rat’s nest of complexity often leads to ineffective, or even abandoned, projects. On the other hand, if you can maintain a tight focus, it’s not always a bad thing. [cbm80Amiga] shows us how to drill down and add specific features in this single-button timer without losing focus on what the original project was all about.

The timer is based on an Arduino Pro Mini and an HX1230 LCD with a simple piezo speaker for audible alerts. A single button controls operation of the timer, with short presses incrementing each digit and long presses moving on to the next digit. Controlling button presses this finely is a project in its own, but then [cbm80Amiga] moves on to other features such as backlight control, low power modes which allow it to operate for around two years on a single battery charge, preset times for various kitchen uses, and different appearance settings.

Honestly we aren’t sure how you could cram any more features on this timer without fundamentally altering the designed simplicity. It doesn’t fall into the abyss of feature creep while being packed with features, and it’s another example of how keeping things simple is often a recipe for success.

Thanks to [Hari] for the tip!

source https://hackaday.com/2020/08/28/over-engineered-single-button-timer/

Back in the early 1980s, there was a certain fad in making your computer produce something resembling human speech. There were several hardware solutions to this, adding voices to everything from automated telephone systems to video game consoles, all the way to Steve Jobs using the gimmick to introduce Macintosh to the world in 1984. In 1982, a software-based version of this synthesis was released for the Atari 8-bit line of computers, and ever since them [rossumur] has wondered whether or not it could run on the very constrained 2600.

Fast-forward 38 years and he found out that the answer was that yes, it was indeed possible to port a semblance of the original 1982 Software Automatic Mouth (or SAM) to run entirely on the Atari 2600, without any additional hardware. To be able to fit such a seemingly complicated piece of software into the paltry 128 bytes (yes, bytes) of RAM, [rossumur] actually uses an authoring tool in order to pre-calculate the allophones, and store only those in the ROM. This way, the 2600 alone can’t convert text to phonemes, but there’s enough space left for the allophones, which are converted into sound, that about two minutes of speech can fit into one cartridge. As for why he went through the trouble, we quote the author himself: “Because creating digital swears with 1982 speech synthesis technology on a 1977 game console is exactly what we need right now.”

For this project, [rossumur] has written an incredibly interesting article on speech synthesis in order to explain the SAM engine used here. And this isn’t his first time on the website either, always cramming software where it shouldn’t fit, such as a “Netflix”-like streaming service, or 8-bit console emulators, both on nothing but an ESP32 microcontroller. Check this one out in action after the break.

source https://hackaday.com/2020/08/27/38-years-later-the-atari-2600-learns-to-speak/