Plug Into USB, Get a Reverse Shell

Computers blindly trust USB devices connected to them. There’s no pop-up to confirm a device was plugged in, and no validation of whether the device should be trusted. This lets you do some nefarious things with a simple USB microcontroller.

We’ve recently seen two examples of this: the USBdriveby and the Teensyterpreter. Both devices are based on the Teensy development board. When connected to a computer, they act as a Human Interface Device to emulate a keyboard and mouse.

The USBdriveby targets OS X. When connected, it changes the DNS server settings to a custom IP, to allow for DNS spoofing of the victim’s machine. This is possible without a password through the OS X System Preferences, but it requires emulating both keystrokes and clicks. AppleScript is used to position the window in a known location, then the buttons can be reliably clicked by code running on the Teensy. After modifying DNS, a reverse shell is opened using netcat. This allows for remote code execution on the machine.

The Teensyterpreter gives a reverse shell on Windows machines. It runs command prompt as administrator, then enters a one-liner to fire up the reverse shell using Powershell. The process happens in under a minute, and works on all Windows versions newer than XP.

With a $20 microcontroller board you can quickly fire up remote shells for… “support purposes”. We’d like to see the two projects merge into a single codebase that supports both operating systems. Bonus points if you can do it on our Trinket Pro. Video demos of both projects after the break.

Continue reading “Plug Into USB, Get a Reverse Shell”

RISC, Tagged Memory, and Minion Cores

Buy a computing device nowadays, and you’re probably getting something that knows x86 or an ARM. There’s more than one architecture out there for general purpose computing with dual-core MIPS boards available and some very strange silicon that’s making its way into dev boards. lowRISC is the latest endeavour from a few notable silicon designers, able to run Linux ‘well’ and adding a few novel security features that haven’t yet been put together this way before.

There are two interesting features that make the lowRISC notable. The first is tagged memory. This has been used before in older, weirder computers as a sort of metadata for memory. Basically, a few bits of each memory address tag each memory address as executable/non-executable, serve as memory watchpoints, garbage collection, and a lock on every word. New instructions are added to the ISA, allowing these tags to be manipulated, watched, and monitored to prevent the most common single security problem: buffer overflows. It’s an extremely interesting application of tagged memory, and something that isn’t really found in a modern architecture.

The second neat feature of the lowRISC are the minions. These are programmable devices tied to the processor’s I/O that work a lot like a Zynq SOC or the PRU inside the BeagleBone. Basically, they’re used for programmable I/O, implementing SPI/I2C/I2S/SDIO in software, offloading work from the main core, and devices that require very precise timing.

The current goal of the lowRISC team is to develop the hardware on an FPGA, releasing some beta silicon in a year’s time. The first complete chip will be an embedded SOC, hopefully release sometime around late 2016 or early 2017. The ultimate goal is an SOC with a GPU that would be used in mobile phones, set-top boxes, and Raspi and BeagleBone-like dev boards. There are enough people on the team, including [Robert Mullins] and [Alex Bradbury] of the University of Cambridge and the Raspberry Pi, researchers at UC Berkeley, and [Bunnie Huang].

It’s a project still in its infancy, but the features these people are going after are very interesting, and something that just isn’t being done with other platforms.

[Alex Bardbury] gave a talk on lowRISC at ORConf last October. You can check out the presentation here.

Beating the Skins of Oatmeal Tins

Ithaca-based power trio [Nick, Roshun, and Ian] share a love of music and beating on things with drum sticks. To that end (and for class credit), they built a Digitally-Recordable, User-Modifiable Sound Emitting Tool (DRUMSET) using force-sensing resistors housed in oatmeal cans.

Anyone who has dealt with FSRs knows how persnickety they can be. In order to direct the force and avoid false positives, these enterprising beat purveyors suspended a sawed-off 2-liter bottle to the underside of each lid. This directs the force coming in from their patent-pending foam-enhanced drum sticks to the small, round sensing area of the FSR. There’s just enough space between the cap and the FSR to account for the play in the oatmeal can lid drum head when struck.

DRUMSET offers different-sounding kits at the push of a momentary switch. At present, there are four pre-programmed kits: the acoustic and electronic foursomes you’d expect, and a kit of miscellaneous sounds like hand claps and wooden claves that sound like something They Might Be Giants would have used on their first album. The fourth is called ‘Smoke on Water’, and is exactly what it sounds like. Should you tire of these, DRUMSET has a program mode with around 20 samples. These can be cycled through on the LCD and assigned to any of the four drums.

The microphone is for record mode, and whatever is recorded can be mapped to any drum. The memory limitations of the ‘1284P make for a 0.2 second sample of whatever is barked into the mic, but that’s plenty of time for shouting ‘hack!’ or firing off whatever hilarious bodily sound one can muster. We think this four track-like functionality of DRUMSET has interesting recording and live performance implications. The team’s future plans include space for longer samples and more robust drum construction (although it is possible to do this without any drums whatsoever). They’d also like to add more drums in case Neil Peart calls. The beat goes on after the break.

Continue reading “Beating the Skins of Oatmeal Tins”

World’s First Smart Snowboard Changes Music According To Your Actions

Ever wanted a soundtrack to your life? For a couple of minutes at a time, Signal Snowboards creates that experience with a smart snowboard that varies your music depending on the tricks you perform on your way down the mountain.

The sign on the door says “School For Gifted Hackers”. Inside [Matt Davis] helped interface audio with an accelerometer – something he regularly does with all manner of hacked devices. At first the prototype was an iPhone mimicking the motions of a snowboarder the way fighter pilots describe dogfights with their hands. The audio engine that pulls those mostions to sound is open source and anyone is welcome to do their own tuning.

Once the audio was figured out the boys took it back to their shop and embedded the sensors into a new snowboard. The board is equipped with GPS, an accelerometer, a few rows of LEDs and a bluetooth board to connect to the phone app. It’s all powered by an on-board LiPo battery and a barrel jack out the side to charge it. Channels were cut by hand with a router then electronics sealed in place with epoxy. Not wanting to “just strap some Christmas lights onto a snowboard” the lighting is also connected to the sensors and is programmable.

See the video below of them making the board and taking it out for a test run on Bear Mountain.

Continue reading “World’s First Smart Snowboard Changes Music According To Your Actions”

Is This Power Supply Bigger Than A Bread Box? No, It Is One.

[newtonn2] must have had food on his mind when he was deciding to embark on a power supply project. The enclosure is quite different…. it is a Bread Box! Even so, flipped up on end we must say it looks pretty cool. [newtonn2’s] previous power supply had crapped out and he needed a replacement supply ASAP, it was a loaf or death situation for this electronics enthusiast.

Similar to a lot of DIY bench power supplies, this one would also be based on an ATX computer power supply. These are good high-current supplies that output voltage in several convenient amounts and in this case are are all routed to their own spring terminals mounted on the enclosure. Even though those standard voltages might be good enough for most, [newtonn2] is extremely kneady and wanted a fully adjustable output so he designed up an adjustable voltage regulation circuit using an LM350 regulator. A volt meter and an amp meter indicates the power being supplied on the adjustable circuit.

Since his last power supply was toast, [newtonn2] wanted this one to be easily repairable. The ATX power supply inside can be replaced in two minutes because nothing is hard wired. The only connections are the ATX connector and power cord. For cooling, holes were drilled in the side of the enclosure so that fans could be installed. This was the yeast he could do to keep the temperature of the interior components down.

In the end [newtonn2] completed his goal of building a pretty unique and functional bench top power supply without spending a lot of dough. Check out his Instructable for extremely detailed build instructions including schematics for how all his components are wired.

Electronic Glove Detects Sign Language

A team of Cornell students recently built a prototype electronic glove that can detect sign language and speak the characters out loud. The glove is designed to work with a variety of hand sizes, but currently only fits on the right hand.

The glove uses several different sensors to detect hand motion and position. Perhaps the most obvious are the flex sensors that cover each finger. These sensors can detect how each finger is bent by changing the resistance according to the degree of the bend. The glove also contains an MPU-6050 3-axis accelerometer and gyroscope. This sensor can detect the hand’s orientation as well as rotational movement.

While the more high-tech sensors are used to detect most characters, there are a few letters that are similar enough to trick the system. Specifically, they had trouble with the letters R, U, and V. To get around this, the students strategically placed copper tape in several locations on the fingers. When two pieces of tape come together, it closes a circuit and acts as a momentary switch.

The sensor data is collected by an ATmega1284p microcontroller and is then compiled into a packet. This packet gets sent to a PC which then does the heavy processing. The system uses a machine learning algorithm. The user can train the it by gesturing for each letter of the alphabet multiple times. The system will collect all of this data and store it into a data set that can then be used for detection.

This is a great project to take on. If you need more inspiration there’s a lot to be found, including another Cornell project that speaks the letters you sign, as well as this one which straps all needed parts to your forearm.
Continue reading “Electronic Glove Detects Sign Language”

Santa’s Autonomous Helping Hands Let the Jolly ol’ Fellow Kick Back this Season

For those skeptical about the feasibility of Santa’s annual delivery schedule, here’s an autonomous piece of the puzzle that will bewilder even the most hard-hearted of non-believers.

The folks over at the Center of Excellence Cognitive Interaction Technology (CITEC) in Germany have whipped together a fantastic demo featuring Santa’s extra pair of helping hands. In the two-and-a-half minute video, the robot executes a suite of impressive autonomous stocking-stuffing maneuvers: from recognizing the open hole in the stocking, to grasping specific candies from the cluster of goodies available.

On the hardware-side, the arms appear to be a KUKA-variant, while on the software-side, the visualizations are being handled by the open source robot software ROS‘ RVIZ tool.

If some of the props in the video look familiar, you’ll find that the researchers at CITEC have already explored some stellar perception, classification, and grasping of related research topics. Who knew this pair of hands would be so jolly to clock some overtime this holiday season? The entire video is set to a crisp computer-voiced jingle that serves as a sneaky summary of their approach to this project.

Now, if only we could set these hands off to do our other dirty work….

Continue reading “Santa’s Autonomous Helping Hands Let the Jolly ol’ Fellow Kick Back this Season”