The USB-C revolution is well under way, as first your new phone, then your single-board computer, and now your laptop are likely so sport the familiar reversible round-cornered connector. We’re still in the crossover period of requiring to keep micro USB, proprietary laptop, and USB-C power supplies at hand, but the promise of a USB-C-only world is tantalisingly close. For [Purkkaviritys] that’s a little bit closer now, as he’s modified his Thinkpad T440s to take a USB charger instead of its proprietary Lenovo square-plug part. (Video, embedded below.)

At its heart is a USB-PD emulator module that does all the hard work of negotiation with the power supply, giving the laptop the DC voltage it needs. It’s not quite that simple though, because a resistor is required to reassure the laptop that it’s got a genuine power supply. The module is encased in a carefully-designed surround that neatly takes the space vacated by the original connector, and since this laptop has its internal power connector on a short cable it is made very straightforward to fit into the case. If you didn’t know it was a home-made upgrade, you could be forgiven for thinking that this laptop left the factory with a USB-C power socket.

The USB-C module used here is a versatile part. We’ve previously seen it in a soldering iron conversion.

source https://hackaday.com/2020/07/24/usb-c-where-it-was-never-intended-to-be/

Even top-tier security professionals make catastrophic mistakes, and this time it was the operators at Iran’s ITG18. We’re once again talking about the strange shadowy world of state sponsored hacking. This story comes from the IBM X-Force Incident Response Intelligence Services (IRIS). I suspect a Deadpool fan must work at IBM, but that’s beside the point.

A server suspected to be used by ITG18 was incorrectly configured, and when data and training videos were stored there, that data was publicly accessible. Among the captured data was records of compromised accounts belonging to US and Greek military personnel.

The training videos also contained a few interesting tidbits. If a targeted account used two factor authentication, the attacker was to make a note and give up on gaining access to that account. If a Google account was breached, the practice was to start with Google Takeout, the service from Google that allows downloading all the data Google has collected related to that account. Yoiks.

To Make an Exploit From Scratch, You Must First Invent the Universe

We’ve covered many kernel level exploits in this column, but never have we covered a guide quite like the one just published by Secfault Security. They attempt to bridge the gap between being a developer and an exploit author, walking us through the process of building an actual working exploit PoC based on a Google Project Zero write-up.

ProcMon

Microsoft is continuing to develop their Linux presence, this time by re-engineering Process Monitor as ProcMon for Linux. A bit of history, Process Monitor is part of the Sysenternals suite, originally developed by [Bryce Cogswell] and [Mark Russinovich], founders of Winternals. Incidentally, they also broke the Sony BMG rootkit story, using sysinternals tools. Less than a year after that story broke, Winternals was acquired by Microsoft, and while [Cogswell] has moved on, [Russonovich] has stayed with Microsoft, and is now the CTO of Azure.

ProcMon is written in C++, and released under the MIT license. It keeps track of the system calls happening on machine in real time, giving a detailed look at the activity of the system. It’s useful for security, debugging, and troubleshooting performance issues. All in all, it’s a really handy tool, and should be a useful part of the sysadmin’s toolbox. The source is available under an OSI approved license, so the various distros should pick up and package ProcMon before long.

Windows Server Containers

Windows Server supports a couple of ways to run processes in containers: HyperV containers, and Windows Server Containers. It’s fairly widely accepted that virtualization based containerization provides a more secure isolation. That is, if a virtualized container is compromised, is far more difficult for an attacker to migrate out and attack the host machine, as compared to a kernel based containerization.

The news is a new way to escape a Windows Server Container. While not encountered as often as on a Linux machine, Windows does support symbolic links. Reading through the deep dive also makes it clear how much modern Windows machines are becoming POSIX machines with a Windows compatibility layer on top. For example, the “C:” directory is actually a global symlink to “\Device\HarddiskVolumeX\”.

If a containerized process could create a global symlink, AKA one that pointed to the root directory, then the container escape would be trivial. As expected, the container security controls don’t allow the isolated processes to create such a symlink during runtime. That said, there is a particular function that can be abused to create the global symlink. The specific function parameters have yet to be disclosed, in order to make in-the-wild exploitation just a bit more difficult.

Password Reset Gone Wrong

The story of a security audit on a website caught my eye this week, put together by [Maxwell “ꓘ” Dulin]. The password reset form is the focus here, and it has a few problems. The first one is a common flaw: the password reset form verifies whether a given email address is in the system. It’s not the worst flaw, but it does give an attacker information — he can guess email addresses, and gets confirmation when there is an account with that address.

The next flaw is a subtle one, the contents of the password reset email are generated using the host sent in the HTTP request. That normally works as expected: A user goes to ourwebsite.com/reset, inputs their email address, and submits the form to generate a password reset request. They get an email with a link back to ourwebsite.com that allows the password reset. An attacker, however, can send a malicious HTTP request to the password reset form, using someone else’s address, and manipulate the Host value. The reset email now points to the injected host. If the user clicks the link in the email, the magic value is sent to host specified by the attacker, who can then go reset the user’s password.

The last flaw [Maxwell] found was the worst of the bunch. The reset token is confirmed when the user first clicks the link sent via email, but it isn’t confirmed when the password is actually updated. You could create your own account, go through the password reset process, and then change the password reset form to point at another user’s account. Because the back-end sees you as already authenticated, it dutifully sets the new password, even if the account specified isn’t yours.

None of us will likely use the little website that this audit was performed on, but the steps described and problems to look for are a good guide for anyone needing doing the same.

Garbage Collection Use After Free

CVE-2019–1367 is an older bug at this point, found being exploited in the wild in 2019, and given a full write-up by Confiant. It’s yet another vulnerability in Internet Explorer’s jscript engine. For a very brief review, jscript.dll is the deprecated IE implementation of Javascript. It’s no longer the default implementation, but can be requested by a web page for compatibility purposes. It appears that jscript.dll is only accessible in Internet Explorer, and neither iteration of Edge support the legacy implementation at all.

This vuln was being actively used by state actors and was a watering hole style attack, where simply visiting the malicious site was enough to compromise. The next page of the write-up goes into the technical details. This is a class of vulnerability that we haven’t covered before. It’s a use-after-free in a garbage collected language.

Garbage collection is the alternative to manually freeing memory when finished with it. One of the advantages is that it is supposed to make use-after-free bugs a thing of the past, so what’s going on here? The garbage collection code in jscript.dll doesn’t properly track the reference count in certain situations. This bug specifically deals with the Array.sort() callback function. Arguments to that function aren’t properly tracked, so the JS instance can be manipulated such that a GC sweep frees an object that will be later accessed.

For the exploit and further analysis of how this flaw was used in the wild, check out part 2 and part 3 of the full write-up.

source https://hackaday.com/2020/07/24/this-week-in-security-irans-itg18-procmon-for-linux-and-garbage-collection-fail/

As the world has become more environmentally conscious, we’ve seen an uptick in projects that monitor or control home energy use. At a minimum one of these setups involves a microcontroller and some kind of clamp-on current sensor, but if you’re looking for resources to take things a bit farther, this Raspberry Pi energy monitoring system created by [David00] would be a great place to start.

This project includes provides software and hardware to be used in conjunction with the Raspberry Pi to keep tabs on not just home energy consumption, but also production if your home has a solar array or other method of generating its own power. Data is pulled every 0.5 seconds from a MCP3008 ADC connected to up to five current sensors to provide real-time utilization statistics, and visualized with Grafana so you can see all of the information at a glance.

While [David00] has already done the community a great service by releasing the hardware and software under an open source license, he’s also produced some absolutely phenomenal documentation for the project that’s really a valuable resource for anyone who wants to roll their own monitoring system. He’s even offering hardware kits for anyone who’s more interested in experimenting with the software side of things than building the PCB.

Home energy monitoring projects are certainly nothing new, but the incredible advances we’ve seen in the type of hardware and software available for DIY projects over the last decade has really pushed the state-of-the-art forward. With so many fantastic resources available now, the only thing standing between you and your own home energy monitoring dashboard is desire and a long weekend.

source https://hackaday.com/2020/07/24/a-complete-raspberry-pi-power-monitoring-system/

Remote access is great, but if the machine stops booting, ceases to connect to the network, or needs low-level interaction like BIOS settings or boot management, remote access is worthless because it’s only available once the host computer is up and running. The usual solution is to drag a keyboard and monitor to the machine in question for physical access.

For most people, swapping cables in this way is an infrequent task at best. But for those who work more closely with managing hardware or developing software, the need to plug and unplug a keyboard and monitor into machines that otherwise run headless can get tiresome. The modern solution is KVM (keyboard, video, mouse) over IP, but commercial options are expensive. [Michael Lynch]’s TinyPilot on the other hand clocks in at roughly $100 of parts, including a Raspberry Pi and USB HDMI capture device. It does have to drop the ‘M’ from KVM (meaning it does not support a mouse yet) but the rest of it hits all the bases, and does it all from a web browser.

What exactly does TinyPilot do? It provides remote access via web browser, but the device is an independent piece of hardware that — from the host computer’s point of view — is no different from a physical keyboard and monitor. That means keyboard and video access works before the host machine even boots, so even changing something like BIOS settings is no problem.

[Michael] demonstrates his design in the video embedded below, but we encourage you to check out the project page for a fascinating exploration of all the challenges that were part of TinyPilot’s development.

Interested? Make one yourself, or as an alternative [Michael] has made a parts kit available. TinyPilot doesn’t provide an interface to the host machine’s power switch, but if you need to add that you can use this other KVM project’s method of integrating a relay module with some DIY of your own.

source https://hackaday.com/2020/07/24/tinypilot-provides-kvm-over-ip-with-low-cost-and-even-lower-latency/

Remote access is great, but if the machine stops booting, ceases to connect to the network, or needs low-level interaction like BIOS settings or boot management, remote access is worthless because it’s only available once the host computer is up and running. The usual solution is to drag a keyboard and monitor to the machine in question for physical access.

For most people, swapping cables in this way is an infrequent task at best. But for those who work more closely with managing hardware or developing software, the need to plug and unplug a keyboard and monitor into machines that otherwise run headless can get tiresome. The modern solution is KVM (keyboard, video, mouse) over IP, but commercial options are expensive. [Michael Lynch]’s TinyPilot on the other hand clocks in at roughly $100 of parts, including a Raspberry Pi and USB HDMI capture device. It does have to drop the ‘M’ from KVM (meaning it does not support a mouse yet) but the rest of it hits all the bases, and does it all from a web browser.

What exactly does TinyPilot do? It provides remote access via web browser, but the device is an independent piece of hardware that — from the host computer’s point of view — is no different from a physical keyboard and monitor. That means keyboard and video access works before the host machine even boots, so even changing something like BIOS settings is no problem.

[Michael] demonstrates his design in the video embedded below, but we encourage you to check out the project page for a fascinating exploration of all the challenges that were part of TinyPilot’s development.

Interested? Make one yourself, or as an alternative [Michael] has made a parts kit available. TinyPilot doesn’t provide an interface to the host machine’s power switch, but if you need to add that you can use this other KVM project’s method of integrating a relay module with some DIY of your own.

source https://hackaday.com/2020/07/24/tinypilot-provides-kvm-over-ip-with-low-cost-and-even-lower-latency/

Remote access is great, but if the machine stops booting, ceases to connect to the network, or needs low-level interaction like BIOS settings or boot management, remote access is worthless because it’s only available once the host computer is up and running. The usual solution is to drag a keyboard and monitor to the machine in question for physical access.

For most people, swapping cables in this way is an infrequent task at best. But for those who work more closely with managing hardware or developing software, the need to plug and unplug a keyboard and monitor into machines that otherwise run headless can get tiresome. The modern solution is KVM (keyboard, video, mouse) over IP, but commercial options are expensive. [Michael Lynch]’s TinyPilot on the other hand clocks in at roughly $100 of parts, including a Raspberry Pi and USB HDMI capture device. It does have to drop the ‘M’ from KVM (meaning it does not support a mouse yet) but the rest of it hits all the bases, and does it all from a web browser.

What exactly does TinyPilot do? It provides remote access via web browser, but the device is an independent piece of hardware that — from the host computer’s point of view — is no different from a physical keyboard and monitor. That means keyboard and video access works before the host machine even boots, so even changing something like BIOS settings is no problem.

[Michael] demonstrates his design in the video embedded below, but we encourage you to check out the project page for a fascinating exploration of all the challenges that were part of TinyPilot’s development.

Interested? Make one yourself, or as an alternative [Michael] has made a parts kit available. TinyPilot doesn’t provide an interface to the host machine’s power switch, but if you need to add that you can use this other KVM project’s method of integrating a relay module with some DIY of your own.

source https://hackaday.com/2020/07/24/tinypilot-provides-kvm-over-ip-with-low-cost-and-even-lower-latency/

If you want to run an old CP/M program — maybe you want to run WordStar or play StarTrek — you have several options. One is to acquire some classic hardware. You can also build a new computer using a Z80 or some other processor that will emulate a Z80. Finally, you can emulate old hardware on your current computer. The iz-cpm project from [ivanizag] takes this last approach. Unlike some emulators, iz-cpm doesn’t try to emulate everything in one simulated environment. Instead, it directly accesses your file system so it allows CP/M executables to run more as though they were a native program.

You can think of it as Wine for CP/M. The code is portable to Linux, Windows, or MacOS. The author mentions, though, that it won’t run on CP/M itself! The program can run an executable standalone which means you could set .COM files up to execute automatically if you wanted to.

The machine looks like a Kaypro and emulates an ADM-3A. There is a script to download interesting CP/M software, for instance WordStar, Basic, and Zork. You can trace calls and even CPU instructions if you want to debug things. Speaking of debugging, though, you might actually need to do that.

When trying out the program, we noticed that WordStar had some odd behavior. Saving files to drive A works, but if you save anywhere else, the file winds up on drive A, anyway. This confuses WordStar because it tries to reread the file from the other disk so it blanks out the text you were working on. We reported the problem on GitHub and in a couple of hours the author had it fixed. You have to love the open source community.

The program is written in Rust which seems to be gaining traction lately. The program is a great way to get into CP/M hacking, especially if you are interested in Rust programming.

If you want real hardware, it is hard to beat the price for this Z80 computer. However, pick up the PCB and check out our updates to it, as well.

source https://hackaday.com/2020/07/23/portable-cp-m-runs-the-classics-anywhere/

Coffee roasting is an art or a science, depending on who you talk to. Both camps will however agree that attention to detail is key. Many diehard beanheads, as they’re known, will go so far as to create their own roasting hardware to get the job done just right. [Larry Cotton] is one such builder, who has created an elegant roaster to get his brew just right.

The build is based around a wobble disk design. This consists of a round plate fixed at a 45-degree angle to a rotating shaft. As the shaft spins, the disk gently sweeps and agitates the roast, allowing the batch to heat up evenly without burning the beans. It’s a two-part design, with heat gun parts in the base to generate the hot air for the roasting process. The bean basket sits on top, held in place by magnets that also act as a conduit for the wobble disk motor’s power supply.

It’s a tidy build, which allows for accurate roasting and easy dumping of the beans once finished. We’ve featured [Larry]’s builds before, too. If you’re a serious beanhead yourself with a few hacks up your sleeve, be sure to let us know! Video after the break.

source https://hackaday.com/2020/07/23/wobble-disk-coffee-roaster-gets-the-beans-just-right/

Somewhere between the onset of annoying hand pain and the feeling of worn-out, mushy switches, [sinbeard]’s keyboard dissatisfaction came to a head. He decided it was time to slip into something bit more ergonomic and settled on building an Iris — a small split keeb with an ortholinear (non-staggered) key arrangement.

The Iris is open source and uses an on-board controller, so you can have the boards fabbed and do a lot of SMD soldering, or get a pair of PCBs with all of that already done. [sinbeard] went the latter route with this build, but there’s still plenty of soldering and assembly to do before it’s time to start clackin’, such as the TRRS jacks, the rotary encoders, and of course, all the switches. It’s a great way for people to get their feet wet when it comes to building keyboards.

Everything went according to plan until it was time to flash the firmware and it didn’t respond. It’s worth noting that both of the Iris PCBs are the same, and both are fully populated. This is both good and bad.

It’s bad you have two on-board microcontrollers and their crystals to worry about instead of one. It’s good because there’s a USB port on both sides so you can plug in whichever side you prefer, and this comes in mighty handy if you have to troubleshoot.

When one side’s underglow lit up but not the other, [sinbeard] busted out the ISP programmer. But in the end, he found the problem — a dent in the crystal — by staring at the board. A cheap replacement part and a little hot air rework action was all it took to get this Iris to bloom.

Want to build a keyboard but need a few more keys? Check out the dactyl and the ErgoDox.

source https://hackaday.com/2020/07/23/ergo-keyboard-build-issue-becomes-crystal-clear/