Everyone loves a good bubble machine. These oddly satisfying novelty items have brought children and adults mindless entertainment since their inception. [8BitsAndAByte] had the same thought, but wanted to give their bubble machine a taste of the IoT-age.

First, they modified an off-the-shelf bubble machine with a Raspberry Pi and relay module. The Pi can easily trigger the bubbling mechanism by controlling power to the machine using the relay. Seems simple enough. The part of this project that might be a bit more unfamiliar to you is controlling the robot over the internet using remo.tv.

Remo.tv is a robot controller platform that’s both free and open-source, and we’ve seen [8BitsAndAByte] take advantage of this web controller before. Seems like they’re really getting the hang of it. Their writeup links to a detailed setup guide for configuring the Pi, so hopefully, that’s not too much trouble.

Couple the IoT setup with a Pi camera and you’ve got a live stream that’s admittedly oddly satisfying to watch with or without the bubbles.

source https://hackaday.com/2020/07/31/the-internet-of-bubble-machines/

Twilio, the cloud provider for all things telecom, had an embarrassing security fail a couple weeks ago. The problem was the Amazon S3 bucket that Twilio was using to host part of their public facing content. The bucket was configured for public read-write access. Anyone could use the Amazon S3 API to make changes to the files stored there.

The files in question were protected behind Cloudflare’s CDN, but there’s a catch to Cloudflare’s service. If you know the details of the service behind Cloudflare, it can often be interacted with directly. In many cases, knowing the IP address of the server being protected is enough to totally bypass Cloudflare altogether. In this case, the service behind the CDN is Amazon’s S3. Any changes made to the files there are picked up by the CDN.

Someone discovered the insecure bucket, and modified a Javascript file that is distributed as part of the Twilio JS SDK. That modification was initially described as “non-malicious”, but in the official incident report, Twilio states that the injected code is part of an ongoing magecart campaign carried out against misconfigured S3 buckets.

IPTV

We received a story on the Hackaday tip line this week about a Swedish IPTV service, Pongo IPTV. This report is unsubstantiated, but there seems to be something going on. At the very least, pongotv.com is currently returning a Cloudflare error, “This website is using a security service to protect itself from online attacks.”

A pair of Youtube videos seem to show access to the Pongotv backend, with exposed customer records and all. At this point, I have to stress that this is unconfirmed report. Based on the details provided, it sounds like the tipster is actually pretty closely involved with this story, maybe even part of the group that is behind the attack.

Espressif

[Lukas Bachschwell] discovered a flaw in the Espressif SDK, tracked as CVE-2020-12638. The vulnerability affects devices running firmware built using the vulnerable SDK. In short, it allows a WiFi authentication downgrade attack. An attacker can inject WiFi traffic, and cause the device to connect to a network under the attacker’s control. For devices used for home automation and other similar applications, this could have serious consequences. Patches are available for most of the devices the SDK covers, and the rest are in progress.

D-Link Patches EOL Device

In response to a series of flaws discovered by researchers at Loginsoft, D-Link has released firmware for an End Of Life device, and strongly recommends taking other affected devices out of use. The devices in question are the DAP-1520, DAP-1522, and DIR-816L.

These aren’t sophisticated vulnerabilities, either. The first one, CVE-2020-15892, can be triggered as simply as sending 256 characters as the password when trying to log in. The login page limits this value to 15 characters, but that limit is imposed on the client side, so an attacker can easily manipulate the raw response to bypass that restriction. The longer than expected password overflows the buffer and crashes the device. A proper exploit would take it over instead.

Another rather trivial vulnerability, CVE-2020-15893, affects the DIR-816L. A shell command can be injected in a UPnP request, as simply as including a semicolon in the packet data. When the UPnP request is parsed, part of it is used as a command line option. Including a semicolon breaks out of that command, and allows executing arbitrary commands.

Sharepoint

CVE-2020-1147 is a vulnerability in Microsoft Sharepoint, found by multiple researchers independently. [Steven] at Source Insight wrote up an explainer on the bug, and concludes that at its heart it’s a deserialization issue. In this case, it seems that functions of a DataSet object, like parse() and Deserialize() can be overwritten by the data being deserialized.

The write-up includes a full PoC, so consider this vulnerability to fully weaponized already. Patches are available, so be sure to go take care of your Sharepoint servers. [Steven] also suggests that we’ll see this same bug show up in other .net applications, as the DataSet object has been considered safe for outside data.

Apple Research Device

Apple has announced the Security Research Device, a modified iPhone that is essentially rooted from the factory. The program is run in typical Apple fashion, as the device is only loaned out 12 months at a time, and comes with a list of do’s and don’ts. I have to wonder if this is a response to Google Project Zero’s debuggable iPhone work from last year. Either way, Project Zero’s [Ben Hawkes] has already issued a statement that the program is likely a non-starter for them, as their strict 90 day disclosure policy is incompatible with the sign-up agreement.

BootHole

And finally, a vulnerability in Grub2 was released this week, BootHole. This vulnerability is a rather simple buffer overflow bug that can be triggered by a malicious grub.cfg file. You might point out that if an attacker can modify grub.cfg, isn’t the system hopelessly compromised anyway? This is a fair question, and the answer is yes, usually. What makes BootHole novel is that taking control of Grub in this way can allow a Secure Boot bypass. This will obviously be more important in specific use cases where Secure Boot is a key part of security.

This vulnerability was found by [eclypsium], who privately disclosed the bug to the Grub developers and other upstream projects. Patches are available, so make sure to get those updates installed. If your curious about the in-depth details, the writeup and PDF on BootHole are quite detailed, go check them out.

source https://hackaday.com/2020/07/31/this-week-in-security-twilio-pogotv-and-boothole/

When [Erich Styger] recently got featured on Hackaday with his meta-clock project, he probably was not expecting to get featured again so soon, this time regarding a copyright claim on the ‘meta-clock’ design. This particular case ended with [Erich] removing the original blog article and associated PCB design files, leaving just the summaries, such as the original Hackaday article on the project.

Obviously, this raises the question of whether any of this is correct; if one sees a clock design, or other mechanisms that appeals and tries to replicate its looks and functioning in some fashion, is this automatically a breach of copyright? In the case of [Erich]’s project, one could argue that at first glance both devices look remarkably similar. One might also argue that this is rather unavoidable, considering the uncomplicated design of the original.

Not copyright, but patent law

An inherent property of copyright law in most jurisdictions is that the act of creating a work automatically grants one the copyright to that work. In most jurisdictions (e.g. the EU), signing away one’s copyright is even forbidden by law. Not so with patent law. Here we have two distinct forms, one being patents as we all know and love them, for the patenting of ideas and inventions. The other form concerns itself with what a product looks like: its design.

In the US this is referred to as a ‘design patent‘, while elsewhere it is referred to as a ‘registered design’, which effectively comes down to the same thing. It means that one can patent for example the shape of a Coca-Cola bottle, or in the case of the folk at Humans Since 1982 (‘HS1982’) the look of their meta-clocks, in not one, but two EU registered designs.

Comparative analysis

We can compare the two designs side by side to see how similar they are.

The top design is [Erich]’s, while the lower design is HS1982’s clock (black version). Both have the same 8×3 hole pattern, similar color scheme, and so on. That the HS1982’s version is in a mineral composite housing and [Erich]’s in a wooden enclosure is hereby not relevant as it does not change the design. To the casual observer it might indeed appear as if both follow the same design.

Since design registrations are meant to deter companies from for example selling their own soft drink in a bottle that looks exactly like a Coca-Cola one, down to the label design, it makes sense that HS1982 came down on [Erich] and others with similar clock designs like the proverbial sack of bricks.

Naturally, the next question which one should ask here is whether it makes any difference that this was a freely available, open project. Meaning that there was no intention to sell such clocks, or even provide all of the necessary information to assemble a clock from scratch, including the software.

Consistency is key

Although with patents and design registrations there is no need to actively pursue infringement cases to keep the patent as is the case with trademarks, it’s likely that to HS1982 there was no question of tolerating any form of infringement. Their audience appears to be those interested in exclusive art pieces, with the device described by them as ‘both a kinetic sculpture and a functioning clock’.

The manufacturing costs of a single ClockClock24 device is unlikely to be even half the asking price of $6,000 to $10,700, even taking into the account that each version is a limited edition. Yet this asking price remains only ‘legitimate’ if the product remains as exclusive as possible. This provides HS1982 with enough incentive to actively seek out and destroy any similar products. In the end we are talking about sculptures, i.e. art, here.

This isn’t just like one smartphone manufacturer accusing the other manufacturer of also making their smartphone into a black, rounded rectangular slab with glass covering. The ironic thing is probably that any number of small changes to [Erich]’s project could likely have made the registered design not apply, such as through the addition of a colon between the hours and minutes, adding seconds, making the box into an oval, or changing the number of rotating elements.

Not all is lost

As [Erich] also notes in his blog post, there are still certain ‘fair use’ provisions with registered designs. Nobody is going to bust down the doors of a kindergarten when one of the preschoolers clumsily draws a Coca-Cola bottle without explicit permission from Coca-Cola’s lawyers. Similarly, anyone can in theory make their own copy of HS1982’s ClockClock24 clock so long as they do not sell it or otherwise make it publicly available.

This knowledge should give anyone who sets out to copy a design which they saw somewhere and liked at least some idea of how far they can take it. Publishing the project on a blog and making the design files available is the part where things can get dicey. Even making small alterations to the original design are not guaranteed to keep one from getting harassed by a company’s irate lawyers.

While there is a small chance of victory if [Erich] or someone else were to take a case like this to court, to argue that small-fry open-hardware projects are unlikely to harm the profits or sales of a company like HS1982, it would essentially be asking the law makers to add a major exception to patent law that would no doubt come with its own set of headaches.

In the meantime it seems that we can do little but get a chuckle out of the ClockClock24 clones available on Chinese stores for peanuts.

source https://hackaday.com/2020/07/31/patent-law-and-the-legality-of-making-something-similar/

Making certain games run on systems which were never designed to run such games (or any games at all) is a favorite hobby of some, with [deater] being no exception. His latest creation involves porting Myst to the Apple II, or ‘demake’ in his own words. This means taking a game that was released in 1993 for MacOS and later for Windows 3.1 and the original PlayStation, and creating a version that works on an 8-bit system from 1977.

Obviously the graphical fidelity has been turned down some compared to the 1990s version, but at this stage much of the game’s levels have been implemented. For anyone who has ever played the game before, much of the visuals will be instantly recognizable. According to [deater], the game should run on any Apple II/II+/IIe, with at least 48 kB of RAM, but 64 kB needed for sound effects. If a Mockingboard sound card is installed, it will even play the intro theme.

On the project page the (currently) three floppy disks can be downloaded, with the source available on Github. While one is there, one can also check out [deater]’s ‘Another World’ port to the Apple II which we covered last year.

source https://hackaday.com/2020/07/30/myst-demake-for-the-apple-ii/

[8BitsAndAByte] are back, and this time they’re taking on the comments section with art. They wondered whether or not they can take something as dubious as the comments section and redeem it into something more appealing like art.

They started by using remo.tv, a tool they’ve used in other projects, to read comments from their video live feeds and extract random phrases. The phrases are then analyzed by text to speech, and a publicly available artificial intelligence algorithm that generates an image from a text description. They can then specify art styles like modern, abstract, cubism, etc to give their image a unique appeal. They then send the image back to the original commenter, crediting them for their comment, ensuring some level of transparency.

We were a bit surprised that the phrase dog with a funny hat generated an image of a cat, so I think it’s fair to say that their AI engine could use a bit of work. But really, we could probably say that about AI as a whole.

source https://hackaday.com/2020/07/30/art-generated-from-the-dubious-comments-section/

DIY Bluetooth speaker projects are always a staple here at Hackady. In our latest feature of DIY audio builds, we have [Patrick’s] vinyl cylindrical speaker.

He found a pretty inexpensive Bluetooth audio amplifier on AliExpress. However, the amplifier module oddly enough had a few missing components that were critical to its operation, so he had to do a little bit of re-work. Not something you generally expect to do when you purchase a pre-made module, but he was certainly up to the task.

He noticed the board amp module was missing a battery protection circuit even though there was space on the board laid out for those components (maybe an older board revision?). To remedy this problem, he added his own battery protection circuit to prevent any unwanted catastrophes. Secondly, he noticed a lot of distortion at high volumes and figured that some added capacitance on the power supply would help fix the distortion. Luckily, that did the trick.

Finally, and not quite a mistake on the manufacturer’s part this time, but an improvement [Patrick] needed for his own personal use. He wanted the amp module’s board-level LED indicator to be visible once the enclosure was fitted around the electronics. So, he used the built-in status trigger as a digital signal for a simple transistor circuit powering a much brighter ring LED that could be mounted onto the enclosure. That way, he could utilize the firmware for triggering the board-level status indicator for his own ring LED without any software modifications to the amp module.

Now, all that was left was to construct the enclosure he had 3D-printed and fit all the electronics in their place. We’ve gotten pretty used to the always impressive aesthetics of [Patrick’s] designs, having covered a project of his before, and this build is certainly no exception. Great job!

While you’re here, take a look at some other DIY Bluetooth speaker projects on Hackaday.

 

source https://hackaday.com/2020/07/30/aesthetic-diy-bluetooth-speakers/

Many laptops eschew the numeric keypad to free up space, and some desktop keyboards have taken on the trend, too. If you want a specialised numeric entry device and have absolutely no interest in speed or ease of use, [jp3141] has just the build for you.

The idea is to use the rotary dial from an old telephone to enter numbers into a computer. It’s slow and cumbersome, but it’s also pretty entertaining. The build uses an old AT&T Trimline dialer, though we’re sure most rotary phones would work. The pulses produced by the dialer are counted by a Teensy microcontroller, which emulates a USB HID keyboard device and enters the relevant keystroke into the computer. There’s also a USB serial interface for debugging, and an LED which flashes along with the pulses from the dialer circuit.

While it’s not the most efficient data entry method, it’s a semi-useful way to repurpose an old phone, and an amusing piece to take along to your next LAN party. We’ve featured a few… alternative… keyboards before, too. If you’ve cooked up a truly convoluted input device for your computer, be sure to let us know.

source https://hackaday.com/2020/07/30/rotary-dialer-becomes-numeric-keypad/

The HackadayU video series on learning to use Ghidra is now available!

Ghidra is a tool for reverse engineering software binaries — you may remember that it was released as Open Source by the NSA last year. It does an amazing job of turning compiled binaries that tell the computer how to operate into human-readable C code. The catch is that there’s a learning curve to making the most out of what Ghidra gives you. Enter the Introduction to Reverse Engineering with Ghidra class led by Matthew Alt as part of the HackadayU series. This set of four one-hour virtual classroom videos were just made available so that you can take the course at your own pace.

Matthew has actually been schooling us for a while. He’s also known as [wrongbaud] and we’ve been spending a lot of time covering his reverse engineering projects, including the teardowns of NES-on-a-chip hardware and his excellent hacker’s guide to JTAG. His HackadayU class continues that legacy by pulling together course materials for a high-quality hands-on walk through Ghidra. You’ll get a dose of computer architecture, the compilation process, ELF file structure, and x86_64 instructions sets along the way. He’s done a superb job of making example code for the coursework available.

While this was the first HackadayU course, there are more on the way. Anool Mahidharia just finished teaching KiCAD & FreeCAD 101 and videos will be published a soon as the editing process is complete. The fall lineup of classes is shaping up nicely and will be announced soon. As a sneak peak, we have instructors working on classes covering tiny machine learning, a second set of classes on Ghidra reverse engineering, a protocol deep dive (I2C, SPI, one-wire, JTAG etc.), Linux on Raspberry Pi, building interactive art, and all about LEDs, and an intro to design with Rhino. Keep your eye on Hackaday for more info as classes are added to the schedule.

source https://hackaday.com/2020/07/30/learn-software-reverse-engineering-ghidra-class-videos-from-hackadayu-now-available/

An obligatory “Future’s so bright I gotta wear… denim” joke is the only way to kick off this article. Sorry!

Now that that’s out of the way, how would you turn your own blue jeans into sunglasses? Well you wouldn’t, unless you’ve built an intricate jig for assembling sunglasses frames like [Mosevic] has done. Boiled down, this is like making parts out of carbon fiber, except you swap in denim for the carbon fiber. Several layers of blue jean material are layered in a mold and impregnated with resin. Once hardened, parts can be milled or laser cut from this stock and then assembled into the frames all of the hipsters are after.

For us its the assembly jig that’s so interesting to see. [Mosevic] shared it in an unlisted video of an update to the Kickstarter campaign which ran at the end of 2019. The jig is used to align machined parts into stack ups that include brass reinforcement and pins to align layers, as well as the joining for the three parts of the frame via the metal hinges. Most of the jig is made from machined plywood. The plates that hold the three parts of the frame, the “frame front” and the two “temples” in eyeglass parlance, are interchangeable so that the same jig can be used to assemble several variants of the frame design. The most notable non-plywood part of the jig are two metal clamps that hold the hinge into the frame front as the glue dries, holding a couple of tiny chunks of denim/resin block in place.

Here you can see the jig with all clamps fully closed. There is not an insignificant amount of time just getting the parts into this jig. But parts still need quite a bit of cleanup after this process to sand, shape, and polish all edges and surfaces of the frames. And of course you have to figure in the time it took to make the parts that went into the jig in the first place. The finished frames are gorgeous, but we have a lot more respect having seen what it takes to pull it off.

Now if you like your glasses like George Washington liked his false teeth, here’s how you can pull a set of shades out of your woodshop.

source https://hackaday.com/2020/07/30/denim-sunglasses-frames-use-a-wicked-set-of-jigs/