Hackaday editors Elliot Williams and Mike Szczys are enamored by this week’s fabrication hacks. There’s a PCB mill that isolates traces by scratching rather than cutting. You won’t believe how awesome this angle-cutter jig is at creating tapered augers for injection molding/extruding plastic. And you may not need an interactive way to cut foam, but the art from the cut pieces is more than a mere shadow of excellence. Plus we gab about a clever rotary encoder circuit, which IDE is the least frustrating, and the go-to tools for hard drive recovery.

Take a look at the links below if you want to follow along, and as always, tell us what you think about this episode in the comments!

Direct download (~65 MB)

Places to follow Hackaday podcasts:

• Google Play
• iTunes
• Soundcloud
• Spotify
• Stitcher
• RSS

Episode 076 Show Notes:

New This Week:

• Roboticist Grant Imahara Of Mythbusters Fame Dies Of Aneurysm At Age 49
• Don’t Wait, You Need To See Comet NEOWISE Right Now
  • Stellarium Web Online Star Map
• Dream Team Members Announced For The 2020 Hackaday Prize

Interesting Hacks of the Week:

• Making PCBs The Easy Way
  • Ironclad Tips For Copper-Clad Prototyping
  • Build An Everlasting Continuity Tester
• Learn The Secrets Of Matching Bottle Cap Threads To One Another
  • threadlib: thread library for OpenSCAD
• Making Smalltalk On A Raspberry Pi
  • Project Oberon
  • Reviving a computer system of 25 years ago
  • Hjalfi makes smalltalk (in Javascript)
• Interactive CNC Foam Cutter Churns Out Abstract Art
  • We Didn’t Know The Sun Could Do Digital
  • CNC Hot-Wire Cutter Gives Form To Foam
• Open-Source Grinder Makes Compression Screws For Plastic Extruders Easy
• Spoofing An Analog Rotary Knob With An ATtiny, And Vampiric Power
  • LS7183 quadrature converter datasheet

Quick Hacks:

• Elliot’s Picks:
  • Home Automation Covers Everything
  • An Easier Way To Roll Your Own LED Ball
  • High-End Ham Radio Gives Up Its Firmware Secrets
• Mike’s Picks:
  • 1975 Circuit Board Was A Masterpiece Hidden On Your Wrist
  • Printed TS100 Case Beats The Heat With A Bearing
  • Video: Bil Herds Looks At Mitosis

Can’t-Miss Articles:

• Tales From The Sysadmin: Impending Hard Drive Doom
• Surgery On The Arduino IDE Makes Bigger Serial Buffers

source https://hackaday.com/2020/07/17/hackaday-podcast-076-grinding-compression-screws-scratching-pcbs-and-melting-foam/

There was a time when building realistic simulations of vehicles was the stuff of NASA and big corporations. Today, many people have sophisticated virtual cockpits or race cars that they use with high-resolution screens or even virtual reality gear. If you think about it, a virtual car isn’t that hard to pull off. All you really need is a steering wheel, a few pedals, and a gear shifter. Sure, you can build fans to simulate the wind and put haptics in your seat, but really the input devices alone get you most of the way there. [Oli] decided he wanted a quick and easy USB gear shifter so he took a trip to the hardware store, picked up an arcade joystick, and tied it all together with an Arduino Leonardo. The finished product that you can see in the video below cost about $30 and took less than six hours to build.

The Leonardo, of course, has the ability to act like a USB human interface device (HID) so it can emulate a mouse or a keyboard or a joystick. That comes in handy for this project, as you would expect. The computer simply has to read the four joystick buttons and then decide which gear matches which buttons. For example up and to the left is first gear, while 4th gear is only the down button depressed. A custom-cut wooden shifter plate gives you the typical H pattern you expect from a stick shift.

Of course, the joystick doesn’t have a long handle like a true stick shift, so [Oli] added some extensions. In addition, a real shifter doesn’t require you to hold it in position as a joystick would. To rectify this, the shifter plate has magnets that grab the stick and hold it. They aren’t strong enough that you can’t move the stick, but they are strong enough to keep it from moving on its own.

We noticed that the design doesn’t allow for a clutch, so it isn’t quite the same as driving a real stick. However, [Oli] mentions several upgrades he has in mind and a clutch is one of them. Some haptics would be a cool addition so could feel the gears grind if you didn’t do the shift correctly.

The last shifter we saw like this was 3D printed. It is getting harder to find a car in the US with a manual transmission, but [Kristina Panos] is definitely a fan.

source https://hackaday.com/2020/07/17/four-on-the-floor-for-your-virtual-race-car/

Twitter just had their biggest security breach in years. Mike warned us about it on Wednesday, but it’s worth revisiting a few of the details. The story is still developing, but it appears that malicious actors used social engineering to access an internal Twitter dashboard. This dashboard, among other interesting things, allows directly changing the email address associated with an account. Once the address is changed to the attacker’s, it’s simple to do a password reset and gain access.

The bitcoin address used in the crypto scam ended up receiving nearly $120,000 USD worth of bitcoin, all of which has been shuffled off into different accounts. It’s an old and simple scam, but was apparently rather believable because the messages were posted by verified Twitter accounts.

A series of screenshots have been posted, claiming to be the internal Twitter dashboard used in the attack. More than a few eyebrows have been raised, as a result of that dashboard. First off, the fact that Twitter employees can directly change an account’s email address is asking for trouble. Even more interesting are the tags that can be added to an account. “Trends Blacklist” and “Search Blacklist” do call to mind the rumors of shadow-banning, but at this point it’s impossible to know the details. Motherboard is reporting that Twitter is removing that screenshot across the board when it’s posted, and even suspending accounts that post it. Of course, they’d do that if it were faked as well, so who knows?

We detected what we believe to be a coordinated social engineering attack by people who successfully targeted some of our employees with access to internal systems and tools.

— Twitter Support (@TwitterSupport) July 16, 2020

SIGRed

CVE-2020-1350 was just announced and fixed as a part of Microsoft’s patch Tuesday push. If you run a Windows Server machine, especially if it has a DNS resolver running, make sure to go patch right away. Yet another CVE scoring a perfect 10, this one is particularly bad as it appears to be a wormable exploit.

Some of the vulnerability details are already available — enough to get an idea of what’s going on. The flaw is in how the DNS daemon handles DNS SIG responses. The code that allocates a buffer for the sig response uses a 16 bit int for the allocation size. It maxes out at 64k characters. As UDP DNS responses have an enforced size limit of 4096 bytes, this seems safe. As you might guess, there’s a catch.

Certain legitimate DNS responses do in fact require more than 4096 bytes, so the spec includes the truncation flag, which means that there is more to this message that didn’t fit in the UDP packet. The proper response is to initiate a TCP connection and make the request again. Once the DNS request is happening over TCP, that message can be up to 64k in length. Still not long enough to trigger the bug. Enter DNS pointer compression. DNS responses can contain a simple type of data compression, usually used to squeeze a message into a single UDP packet. If this compression is used on a TCP DNS query, the final decompressed message size can exceed 64k.

Once the message is decompressed, a buffer is allocated, based on the message size, but because it’s a 16-bit int, if the size is over 64k, that value wraps back around to 0. So a small buffer is allocated, and then 64+ kB of data is copied to it, overwriting the end of the buffer. Because of the security features built into modern versions of Windows Server, there are more steps to a full compromise, but based on the response to this vulnerability, it seems that a sophisticated attacker won’t have too much trouble developing it into a full exploit.

SAP RECON

The third major event of this week is the RECON vulnerability in SAP devices, accompanied by a not very helpful PDF. CVE-2020-6287 scored a severity of 10, as it’s exploitable from the network with no authentication, and easily leads to a full takeover of the system. The flaw is twofold, first is yet another path transversal attack. The “../” operator isn’t properly stripped out of incoming requests. The other half of the vulnerability is the fact that certain URL endpoints on a vulnerable device are accessible without authentication.

A Proof of Concept has been posted to Github, though without the RCE elements. It’s likely that the specifics needed to fully compromise the device will be figured out in short order, so best to get your devices updated right away.

Apple Security Bypass

MacOS has a built in app sandboxing system, known as TCC. The aim of this particular component is to keep an app from accessing the rest of the filesystem without user permission. [Jeff Johnson] discovered a way to bypass that protection, and reported it to Apple, who have yet to fix it. After waiting six months, double the standard disclosure time, he’s published his findings for all to see.

Android Security Updates

The July security updates for Android have been released, and there are a couple of interesting vulns in there, namely CVE-2020-0224 and CVE-2020-0225.

0224 seems to be related to the processing of regular expressions. Based on the limited bug writeup, it’s unclear how this vulnerability would be triggered remotely. This bug is a bit of an older one, first discovered in the Chromium project. Because of the code sharing between projects, it was present in both, and only now getting patched in Android.

0225 is a Bluetooth issue, related to audio over Bluetooth. The details are scarce, but it appears that a 0-length packet can trigger a null pointer access.

The 4 Hour Unc0ver Uncovering

And lastly for this week, [Brandon Azad] at Google’s Project Zero steps us through the story of taking apart the unc0ver jailbreak, designing a PoC, and sending the issue over to Apple. In the case of a big release like that one, there’s something of a race to see who can reverse engineer it first. Brandon couldn’t make heads or tails out of the heavily obfuscated exploit binary, but he had a clever trick up his sleeve. Start the exploit, but kill that app before the install finished. The system was left in an unstable state, crashed, and he was able to trace the crash back to the vulnerability. The full write-up is worth checking out.

source https://hackaday.com/2020/07/17/this-week-in-security-twitter-windows-dns-sap-recon/

Twitter just had their biggest security breach in years. Mike warned us about it on Wednesday, but it’s worth revisiting a few of the details. The story is still developing, but it appears that malicious actors used social engineering to access an internal Twitter dashboard. This dashboard, among other interesting things, allows directly changing the email address associated with an account. Once the address is changed to the attacker’s, it’s simple to do a password reset and gain access.

The bitcoin address used in the crypto scam ended up receiving nearly $120,000 USD worth of bitcoin, all of which has been shuffled off into different accounts. It’s an old and simple scam, but was apparently rather believable because the messages were posted by verified Twitter accounts.

A series of screenshots have been posted, claiming to be the internal Twitter dashboard used in the attack. More than a few eyebrows have been raised, as a result of that dashboard. First off, the fact that Twitter employees can directly change an account’s email address is asking for trouble. Even more interesting are the tags that can be added to an account. “Trends Blacklist” and “Search Blacklist” do call to mind the rumors of shadow-banning, but at this point it’s impossible to know the details. Motherboard is reporting that Twitter is removing that screenshot across the board when it’s posted, and even suspending accounts that post it. Of course, they’d do that if it were faked as well, so who knows?

We detected what we believe to be a coordinated social engineering attack by people who successfully targeted some of our employees with access to internal systems and tools.

— Twitter Support (@TwitterSupport) July 16, 2020

SIGRed

CVE-2020-1350 was just announced and fixed as a part of Microsoft’s patch Tuesday push. If you run a Windows Server machine, especially if it has a DNS resolver running, make sure to go patch right away. Yet another CVE scoring a perfect 10, this one is particularly bad as it appears to be a wormable exploit.

Some of the vulnerability details are already available — enough to get an idea of what’s going on. The flaw is in how the DNS daemon handles DNS SIG responses. The code that allocates a buffer for the sig response uses a 16 bit int for the allocation size. It maxes out at 64k characters. As UDP DNS responses have an enforced size limit of 4096 bytes, this seems safe. As you might guess, there’s a catch.

Certain legitimate DNS responses do in fact require more than 4096 bytes, so the spec includes the truncation flag, which means that there is more to this message that didn’t fit in the UDP packet. The proper response is to initiate a TCP connection and make the request again. Once the DNS request is happening over TCP, that message can be up to 64k in length. Still not long enough to trigger the bug. Enter DNS pointer compression. DNS responses can contain a simple type of data compression, usually used to squeeze a message into a single UDP packet. If this compression is used on a TCP DNS query, the final decompressed message size can exceed 64k.

Once the message is decompressed, a buffer is allocated, based on the message size, but because it’s a 16-bit int, if the size is over 64k, that value wraps back around to 0. So a small buffer is allocated, and then 64+ kB of data is copied to it, overwriting the end of the buffer. Because of the security features built into modern versions of Windows Server, there are more steps to a full compromise, but based on the response to this vulnerability, it seems that a sophisticated attacker won’t have too much trouble developing it into a full exploit.

SAP RECON

The third major event of this week is the RECON vulnerability in SAP devices, accompanied by a not very helpful PDF. CVE-2020-6287 scored a severity of 10, as it’s exploitable from the network with no authentication, and easily leads to a full takeover of the system. The flaw is twofold, first is yet another path transversal attack. The “../” operator isn’t properly stripped out of incoming requests. The other half of the vulnerability is the fact that certain URL endpoints on a vulnerable device are accessible without authentication.

A Proof of Concept has been posted to Github, though without the RCE elements. It’s likely that the specifics needed to fully compromise the device will be figured out in short order, so best to get your devices updated right away.

Apple Security Bypass

MacOS has a built in app sandboxing system, known as TCC. The aim of this particular component is to keep an app from accessing the rest of the filesystem without user permission. [Jeff Johnson] discovered a way to bypass that protection, and reported it to Apple, who have yet to fix it. After waiting six months, double the standard disclosure time, he’s published his findings for all to see.

Android Security Updates

The July security updates for Android have been released, and there are a couple of interesting vulns in there, namely CVE-2020-0224 and CVE-2020-0225.

0224 seems to be related to the processing of regular expressions. Based on the limited bug writeup, it’s unclear how this vulnerability would be triggered remotely. This bug is a bit of an older one, first discovered in the Chromium project. Because of the code sharing between projects, it was present in both, and only now getting patched in Android.

0225 is a Bluetooth issue, related to audio over Bluetooth. The details are scarce, but it appears that a 0-length packet can trigger a null pointer access.

The 4 Hour Unc0ver Uncovering

And lastly for this week, [Brandon Azad] at Google’s Project Zero steps us through the story of taking apart the unc0ver jailbreak, designing a PoC, and sending the issue over to Apple. In the case of a big release like that one, there’s something of a race to see who can reverse engineer it first. Brandon couldn’t make heads or tails out of the heavily obfuscated exploit binary, but he had a clever trick up his sleeve. Start the exploit, but kill that app before the install finished. The system was left in an unstable state, crashed, and he was able to trace the crash back to the vulnerability. The full write-up is worth checking out.

source https://hackaday.com/2020/07/17/this-week-in-security-twitter-windows-dns-sap-recon/

Twitter just had their biggest security breach in years. Mike warned us about it on Wednesday, but it’s worth revisiting a few of the details. The story is still developing, but it appears that malicious actors used social engineering to access an internal Twitter dashboard. This dashboard, among other interesting things, allows directly changing the email address associated with an account. Once the address is changed to the attacker’s, it’s simple to do a password reset and gain access.

The bitcoin address used in the crypto scam ended up receiving nearly $120,000 USD worth of bitcoin, all of which has been shuffled off into different accounts. It’s an old and simple scam, but was apparently rather believable because the messages were posted by verified Twitter accounts.

A series of screenshots have been posted, claiming to be the internal Twitter dashboard used in the attack. More than a few eyebrows have been raised, as a result of that dashboard. First off, the fact that Twitter employees can directly change an account’s email address is asking for trouble. Even more interesting are the tags that can be added to an account. “Trends Blacklist” and “Search Blacklist” do call to mind the rumors of shadow-banning, but at this point it’s impossible to know the details. Motherboard is reporting that Twitter is removing that screenshot across the board when it’s posted, and even suspending accounts that post it. Of course, they’d do that if it were faked as well, so who knows?

We detected what we believe to be a coordinated social engineering attack by people who successfully targeted some of our employees with access to internal systems and tools.

— Twitter Support (@TwitterSupport) July 16, 2020

SIGRed

CVE-2020-1350 was just announced and fixed as a part of Microsoft’s patch Tuesday push. If you run a Windows Server machine, especially if it has a DNS resolver running, make sure to go patch right away. Yet another CVE scoring a perfect 10, this one is particularly bad as it appears to be a wormable exploit.

Some of the vulnerability details are already available — enough to get an idea of what’s going on. The flaw is in how the DNS daemon handles DNS SIG responses. The code that allocates a buffer for the sig response uses a 16 bit int for the allocation size. It maxes out at 64k characters. As UDP DNS responses have an enforced size limit of 4096 bytes, this seems safe. As you might guess, there’s a catch.

Certain legitimate DNS responses do in fact require more than 4096 bytes, so the spec includes the truncation flag, which means that there is more to this message that didn’t fit in the UDP packet. The proper response is to initiate a TCP connection and make the request again. Once the DNS request is happening over TCP, that message can be up to 64k in length. Still not long enough to trigger the bug. Enter DNS pointer compression. DNS responses can contain a simple type of data compression, usually used to squeeze a message into a single UDP packet. If this compression is used on a TCP DNS query, the final decompressed message size can exceed 64k.

Once the message is decompressed, a buffer is allocated, based on the message size, but because it’s a 16-bit int, if the size is over 64k, that value wraps back around to 0. So a small buffer is allocated, and then 64+ kB of data is copied to it, overwriting the end of the buffer. Because of the security features built into modern versions of Windows Server, there are more steps to a full compromise, but based on the response to this vulnerability, it seems that a sophisticated attacker won’t have too much trouble developing it into a full exploit.

SAP RECON

The third major event of this week is the RECON vulnerability in SAP devices, accompanied by a not very helpful PDF. CVE-2020-6287 scored a severity of 10, as it’s exploitable from the network with no authentication, and easily leads to a full takeover of the system. The flaw is twofold, first is yet another path transversal attack. The “../” operator isn’t properly stripped out of incoming requests. The other half of the vulnerability is the fact that certain URL endpoints on a vulnerable device are accessible without authentication.

A Proof of Concept has been posted to Github, though without the RCE elements. It’s likely that the specifics needed to fully compromise the device will be figured out in short order, so best to get your devices updated right away.

Apple Security Bypass

MacOS has a built in app sandboxing system, known as TCC. The aim of this particular component is to keep an app from accessing the rest of the filesystem without user permission. [Jeff Johnson] discovered a way to bypass that protection, and reported it to Apple, who have yet to fix it. After waiting six months, double the standard disclosure time, he’s published his findings for all to see.

Android Security Updates

The July security updates for Android have been released, and there are a couple of interesting vulns in there, namely CVE-2020-0224 and CVE-2020-0225.

0224 seems to be related to the processing of regular expressions. Based on the limited bug writeup, it’s unclear how this vulnerability would be triggered remotely. This bug is a bit of an older one, first discovered in the Chromium project. Because of the code sharing between projects, it was present in both, and only now getting patched in Android.

0225 is a Bluetooth issue, related to audio over Bluetooth. The details are scarce, but it appears that a 0-length packet can trigger a null pointer access.

The 4 Hour Unc0ver Uncovering

And lastly for this week, [Brandon Azad] at Google’s Project Zero steps us through the story of taking apart the unc0ver jailbreak, designing a PoC, and sending the issue over to Apple. In the case of a big release like that one, there’s something of a race to see who can reverse engineer it first. Brandon couldn’t make heads or tails out of the heavily obfuscated exploit binary, but he had a clever trick up his sleeve. Start the exploit, but kill that app before the install finished. The system was left in an unstable state, crashed, and he was able to trace the crash back to the vulnerability. The full write-up is worth checking out.

source https://hackaday.com/2020/07/17/this-week-in-security-twitter-windows-dns-sap-recon/

According to [Alex] it is easy to make your own rolls of 3D printing filament, even though existing off-the-shelf solutions don’t work very well. His explanation for this is economics. He built a filament extruder using a high torque induction motor and gearbox that was locally sourced. He argues that shipping heavy gear around would make a similar extruder commercially unattractive. He sunk about $600 into the device but estimates that a company would need to charge at least $1,500 or more for the same thing. That may seem steep but as [Alex] points out, a 1 kg roll of filament really only has about 750 grams for filament and plastic pellets cost $2 to $3 per kilogram.

There are other costs, of course, like the electricity required to heat and move the plastic. Still, the system appears to use about $1 of electricity for every 10 kg of filament. You can see the process in the video below.

If you think about it, the mechanism isn’t too different from a 3D printer. You heat plastic, force it through a nozzle, and it cools off. The big differences are you are not moving around and have to manage the pellets using a screw feed. It turns out the screw and associated components make up a large part of the machine’s cost.

The other key component is a 1 HP motor. A typical motor will run at 1800 RPM, so you also need a gearbox to slow things down. You’ll also need drive electronics, heaters, and temperature control. If you pay retail for everything, you are going to have trouble matching the $600 price tag. However, the motors and quite a bit of it can be found used or salvaged. A lot of the details are in the second post. The details of the part of the machine that winds the new filament are in yet another post.

If you don’t want to spend quite as much, you can also make a smaller version that can produce about 2 kg per hour as opposed to the 5 kg per hour that the big machine makes. The little sister uses an eBike motor and the whole thing should come in for well under $500. There are several other posts linked from the original ones, including notes on the water bath required, measuring filament thickness, and even selling filament for profit.

We’ve seen a lot of takes on making filament. One even claims to cost about $100.

source https://hackaday.com/2020/07/17/make-your-own-filament/

If you’re building a CNC machine from scratch, the number of decisions you have to make is nearly boundless. Metal or wood construction? Welded or bolted? Timing belts or lead screws? And even once the mechanical bits are sorted, you still face a universe of choices in terms of control electronics. That’s where something like this modular CNC controller could really prove to be a game-changer.

The idea behind [Barton Dring]’s latest creation started with his port of GRBL to the ESP32. In fact, the current controller bears a strong family resemblance to his version 1.0 dev board, with a few conspicuous and intriguing additions. First, everything is modular — the main PCB is basically a motherboard with little more than a 5-volt power supply and some housekeeping electronics, plus a lot of headers. There’s support for up to six channels of steppers, either directly on the board with Pololu-style modules or as external drivers using pluggable screw terminal blocks. There’s also room for five IO modules; the current collection of modules includes a four-channel switch input, a relay output, an RS-485 module and a 0-10-V interface for talking to a variable frequency drive (VFD) spindle controllers, and buffered 5-V output module. The best part is that the IO module spec is completely open, so designing custom modules should be a snap.

The video below gives a quick tour of the controller. We’re really impressed with the thought that went into this, and we’ll venture a guess that having something like this available is going to kickstart a lot of stalled CNC machine projects. We can think of one shop that finally lost its last excuse for making the move.

source https://hackaday.com/2020/07/17/the-motherboard-of-all-cnc-controllers/

Most Hackaday readers are likely to be familiar with character LCDs driven by the extremely common Hitachi HD44780 controller chip. If you’re looking for a cheap and easy way for your microcontroller project to display some data, they’re pretty much the go-to solution. But as popular as these displays are, there’s no denying that they’re starting to look a bit dated in 2020. Which is why the tweaks [Joseph Rautenbach] is working on are so interesting.

With one of these displays, the controller puts a single character on each 5×8 block of pixels. There’s also support for creating custom characters, which can be used for rudimentary icons. You’re pretty limited by the per-block resolution, but with a little imagination, you can usually get the point across. With a bit of dead space between each block of the display there’s little point in trying to make icons that “bridge” multiple blocks, as they’ll always be segmented.

But as [Joseph] realized, that’s less of a problem for scrolling text. So he wrote some code that takes an ASCII string and breaks it down into partial letters and numbers which can be displayed as custom characters. The controller only has space for 8 of these characters though, so the code needs to continually step through the string and generate the appropriate offset characters as the position of the text changes.

While the effect looks pretty good in the video after the break, [Joseph] has found that real-world utilization is a bit finicky. He tried the same code on one of the displays that uses white text on a blue background, and the scrolling text ended up ghosting together so it looked like gibberish. So while he’s released the source code for others to experiment with this trick, your mileage may vary.

This certainly isn’t the first time we’ve seen somebody make clever use of custom characters on the HD44780. We’ve seen it used for an exceptionally tiny game of Tetris, a rendition of Conway’s Game of Life, and even a horizontal space-shooter.

source https://hackaday.com/2020/07/16/smoother-text-scrolling-on-hd44780-lcds/