Big And Glowy Tetris Via Arduino

TetrisĀ was a breakout hit when it was released for the Nintendo Game Boy in 1989, in much the same way thatĀ Breakout was a breakout hit in arcades in 1976. Despite this, gamers of today expect a little more than a tiny monochrome LCD with severe motion blur problems. Enter the LED Tetris build from [Electronoobs].

The build relies on a hacker favourite, the WS2812B LED string. The LEDs are set up in a 8×16 matrix to create the familiar Tetris playfield. Buttons and a joystick are then installed on the front panel to allow the player to control the action. An Arduino Mega runs the show, with a DFPlayer used to play the famous theme music as the cherry on top.

It’s a fun build that would be an awesome addition to any hacker’s coffee table. Big glowing LEDs make everything better, after all – this ping-pong ball display is a great example of the form. Video after the break.

Continue reading “Big And Glowy Tetris Via Arduino”

This Week In Security: Mass IPhone Compromise, More VPN Vulns, Telegram Leaking Data, And The Hack Of @Jack

In a very mobile-centric installment, we’re starting with the story of a long-running iPhone exploitation campaign. It’s being reported that this campaign was being run by the Chinese government. Attack attribution is decidedly non-trivial, so let’s be cautious and say that these attacks were probably Chinese operations.

In any case, Google’s Project Zero was the first to notice and disclose the malicious sites and attacks. There were five separate vulnerability chains, targeting iOS versions 10 through 12, with at least one previously unknown 0-day vulnerability in use. The Project Zero write-up is particularly detailed, and really documents the exploits.

The payload as investigated by Project Zero doesn’t permanently install any malware on the device, so if you suspect you could have been compromised, a reboot is sufficient to clear you device.

This attack is novel in how sophisticated it is, while simultaneously being almost entirely non-targeted. The malicious code would run on the device of any iOS user who visited the hosting site. The 0-day vulnerability used in this attack would have a potential value of over a million dollars, and these high value attacks have historically been more targeted against similarly high-value targets. While the websites used in the attack have not been disclosed, the sites themselves were apparently targeted at certain ethnic and religious groups inside China.

Once a device was infected, the payload would upload photos, messages, contacts, and even live GPS information to the command & control infrastructure. It also seems that Android and Windows devices were similarly targeted in the same attack.

Telegram Leaking Phone Numbers

“By default, your number is only visible to people who you’ve added to your address book as contacts.” Telegram, best known for encrypted messages, also allows for anonymous communication. Protesters in Hong Kong are using that feature to organize anonymously, through Telegram’s public group messaging. However, a data leak was recently discovered, exposing the phone numbers of members of these public groups. As you can imagine, protesters very much want to avoid being personally identified. The leak is based on a feature — Telegram wants to automatically connect you to other Telegram users whom you already know.

By default, your number is only visible to people who you’ve added to your address book as contacts.

Telegram is based on telephone numbers. When a new user creates an account, they are prompted to upload their contact list. If one of the uploaded contacts has a number already in the Telegram system, those accounts are automatically connected, causing the telephone numbers to become visible to each other. See the problem? An attacker can load a device with several thousand phone numbers, connect it to the Telegram system, and enter one of the target groups. If there is a collision between the pre-loaded contacts and the members of the group, the number is outed. With sufficient resources, this attack could even be automated, allowing for a very large information gathering campaign.

In this case, it seems such a campaign was carried out, targeting the Hong Kong protesters. One can’t help but think of the first story we covered, and wonder if the contact data from compromised devices was used to partially seed the search pool for this effort.

The Hack of @Jack

You may have seen that Twitter’s CEO, Jack [@Jack] Dorsey’s Twitter account was hacked, and a series of unsavory tweets were sent from that account. This seems to be a continuing campaign by [chucklingSquad], who have also targeted other high profile accounts. How did they manage to bypass two factor authentication and a strong password? Cloudhopper. Acquired by Twitter in 2010, Cloudhopper is the service that automatically posts a user’s SMS messages to Twitter.

Rather than a username and password, or security token, the user is secured only by their cell phone number. Enter the port-out and SIM-swap scams. These are two similar techniques that can be used to steal a phone number. The port-out scam takes advantage of the legal requirement for portable phone numbers. In the port-out scam, the attacker claims to be switching to a new carrier. A SIM-swap scam is convincing a carrier he or she is switching to a new phone and new SIM card. It’s not clear which technique was used, but I suspect a port-out scam, as Dorsey hadn’t gotten his cell number back after several days, while a SIM swap scam can be resolved much more quickly.

Google’s Bug Bounty Expanded

In more positive news, Google has announced the expansion of their bounty programs. In effect, Google is now funding bug bounties for the most popular apps on the Play store, in addition to Google’s own code. This seems like a ripe opportunity for aspiring researchers, so go pick an app with over 100 million downloads, and dive in.

An odd coincidence, that 100 million number is approximately how many downloads CamScanner had when it was pulled from the Play store for malicious behavior. This seems to have been caused by a third party advertisement library.

Updates

Last week we talked about Devcore and their VPN Appliance research work. Since then, they have released part 3 of their report. Pulse Secure doesn’t have nearly as easily exploited vulnerabilities, but the Devcore team did find a pre-authentication vulnerability that allowed reading arbitraty data off the device filesystem. As a victory lap, they compromised one of Twitter’s vulnerable devices, reported it to Twitter’s bug bounty program, and took home the highest tier reward for their trouble.

Capture A Star In A Jar With Sonoluminescence

If nothing else, [Justin Atkin] is persistent. How else do you explain a five-year quest to create sonoluminescence with simple tools?

So what exactly is sonoluminescence? The short answer is as the name suggests: a release of light caused by sound. In [Justin]’s case, he used an ultrasonic transducer to set up a standing wave at the resonant frequency of a flask of water. A drop of water is used to entrain a small air bubble, which is held in a stable position in the flask in much the same way as styrofoam beads are in an acoustic levitator. Turn off the lights and you’ll see that the bubble glows with a ghostly blue light.

What causes the glow? Good question. According to [Justin], we just don’t know for sure what causes it, although the leading theory is that cavitation of the bubble causes the trapped gas to compress and heat violently, turning into a brief bit of plasma. But there are problems with that theory, which is one of the reasons he wanted to show just how easy the process can be – now that he’s shaken out the bugs with five years of effort. It wasn’t easy getting the transducers attached and the driver circuit properly tuned, but with little more than a signal generator, an audio amp, and a spool of magnet wire, you too can make your own “star in a jar.”

We applaud [Justin]’s determination to bring this project to a successful conclusion. It’s not unlike his dogged effort to make a cold plasma torch, or even his desktop radio telescope.

Continue reading “Capture A Star In A Jar With Sonoluminescence”

High Voltage Protects Low Denominations

How do you keep people out of your change jar? If you didn’t say with a 3D printed iris mechanism and high-voltage spark gap, then clearly you aren’t [Vije Miller]. Which is probably for the best, as we’re not sure we actually want to live in a world where there are two of these things.

Regular Hackaday readers will know that [Vije] has a way of using electromechanical trickery to inject a bit of excitement, and occasionally a little danger, into even the most mundane aspects of life. His latest project is an automated change jar that uses a pinpad to authenticate users, while everyone else gets the business end of a spark gap if the PIR sensor detects them getting to close.

You can see a demonstration of the jar in the video after the break, where he shows the jar’s ability to stop…himself, from getting access to it. Hey, nobody said it was meant to keep out real intruders. Though we do think a similar gadget could be a fun way to keep the kids out of the cookie jar before dinner, though we’d strongly suggest deleting the high-voltage component from the project before deploying it with a gullet full of Keebler’s best.

[Vije] was able to adapt a printable iris design he found on Thingiverse to fit over the mouth of the jar, and uses servos in the base to rotate the whole assembly around and open it up. The internal Arduino Nano handles reading from the pinpad, controlling the stepper, and of course firing up the spark generator for 1000 milliseconds each time the PIR sensor detects somebody trying to be cute. Just the sound of the arc should be enough to get somebody to reconsider the value of literal pocket change.

Some of the design elements used in this change jar’s high voltage components were influenced by the lessons learned when [Vije] was building his plasma-powered toilet air freshener. There’s a sentence we bet you never expected to read today.

Continue reading “High Voltage Protects Low Denominations”