Year: 2024

This Week In Security: Zimbra, DNS Poisoning, And Perfctl

October 4, 2024 by 6 Comments

Up first this week is a warning for the few of us still brave enough to host our own email servers. If you’re running Zimbra, it’s time to update, because CVE-2024-45519 is now being exploited in the wild.

That vulnerability is a pretty nasty one, though thankfully requires a specific change from default settings to be exposed. The problem is in postjournal. This logging option is off by default, but when it’s turned on, it logs incoming emails. One of the fields on an incoming SMTP mail object is the RCPT TO: field, with the recipients made of the to, cc, and bcc fields. When postjournal logs this field, it does so by passing it as a bash argument. That execution wasn’t properly sanitized, and wasn’t using a safe call like execvp(). So, it was possible to inject commands using the $() construction.

The details of the attack are known, and researchers are seeing early exploratory attempts to exploit this vulnerability. At least one of these campaigns is attempting to install webshells, so at least some of those attempts have teeth. The attack seems to be less reliable when coming from outside of the trusted network, which is nice, but not something to rely on.

New Tool Corner

What is that binary doing on your system? Even if you don’t do any security research, that’s a question you may ask yourself from time to time. A potential answer is WhoYouCalling. The wrinkle here is that WYC uses the Windows Event Tracing mechanism to collect the network traffic strictly from the application in question. So it’s a Windows only application for now. What you get is a packet capture from a specific executable and all of its children processes, with automated DNS capture to go along. Continue reading “This Week In Security: Zimbra, DNS Poisoning, And Perfctl” →

The Raspberry Pi 500 Hints At Its Existence

October 4, 2024 by 55 Comments

It’s fairly insignificant in the scheme of things, and there’s no hardware as yet for us to look at, but there it is. Tucked away in a device tree file, the first mention of a Raspberry Pi 500. We take this to mean that the chances of an upgrade to the Pi 400 all-in-one giving it the heart of a Pi 5 are now quite high.

We’ve remarked before that one of the problems facing the Raspberry Pi folks is that a new revision of the regular Pi no longer carries the novelty it might once have done, and certainly in hardware terms (if not necessarily software) it could be said that the competition have very much caught up. It’s in the Compute Module and the wildcard products such as the all-in-one computers that they still shine then, because even after several years of the 400 it’s not really seen an effective competitor.

So we welcome the chance of an all-in-one with a Pi 5 heart, and if we had a wish list for it then it should include that mini PCI-E slot on board for SSDs and other peripherals. Such a machine would we think become a must-have for any space-constrained bench.

Need High-Power Li-Ion Charging? How About 100 W

October 4, 2024 by 21 Comments

Ever want a seriously powerful PCB for charging a Li-Ion pack? Whatever you want it for, [Redherring32] has got it — it’s a board bearing the TPS25750D and BQ25713 chips, that lets you push up to 100 W into your 1S Li-Ion pack through the magic of USB Power Delivery (USB-PD).

Why do you need so much power? Well, when you put together a large amount of Li-Ion cells, this is how you charge it all at once – an average laptop might charge the internal battery at 30 W, and it’s not uncommon for laptop batteries to be dwarfed by hackers’-built packs.

A 4-layer creation peppered with vias, this board’s a hefty one — it’s not often that you see a Li-Ion charger designed to push as much current as possible into a cell, and the chips are smart enough for that. As far as the onboard chips’ capabilities go, the board could handle pack configurations from 1S to 4S, and even act as a USB-PD source — check the IC configuration before you expect to use it for any specific purpose.

Want a simpler charger, even if it’s less powerful? Remember, you can use PPS-capable PD chargers for topping up Li-Ion packs, with barely any extra hardware required.

A Mobius keyboard surrounded by the parts to make a Mobius keyboard.

Mobius Keyboard Wastes Little Space

October 3, 2024 by 24 Comments

What is with all the wasted space on keyboards? There’s a whole back side just sitting there doing nothing. But how can you use the back at the same time as the front?

How to properly wire the boards together.
All the board sandwiches must be wired together like this, natch.

Just when we think Google Japan can’t possibly produce another weird, amazing keyboard that actually works and comes with full documentation, they go and outdo themselves with this ortholinear Mobius thing that wastes (almost) no space. (Japanese, translated) Be sure to check out the video after the break where hilarity ensues.

This crazy thing is made up of 26 modules, each with 8 key switches, four on a side. Do the math — that’s a total of 208 keys! More than enough to stretch out around the table and do some group programming without rubbing elbows. All the switches are hot-swappable, and there’s even RGB backlighting. The controller here is the STM32F042F4P6.

So what are all the extra keys for? Well, the keyboard is half in Japanese and half QWERTY, and has a set of emoji keys as well for the full programming experience. You can also make a paper version if you want to test out the topology.

Be sure to check out the documentation, because it’s pretty interesting how this keyboard is put together. And no, we’re not sure how to set it down and use it without accidental key presses. Suppose that’s part of the charm?

Have you ever wondered what happened to all the Japanese computers of yore? We did.

Continue reading “Mobius Keyboard Wastes Little Space” →

On The Nature Of Electricity: Recreating The Early Experiments

October 3, 2024 by No comments

Bits of material levitating against gravity, a stream of water deflected by invisible means, sparks of light appearing out of thin air; with observations like those, it’s a wonder that the early experiments into the nature of electricity progressed beyond the catch-all explanation of magic. And yet they did, but not without a lot of lamb’s bladders and sulfur globes, and not a little hand waving in the process. And urine — lots and lots of urine.

Looking into these early electrical experiments and recreating them is the unlikely space [Sam Gallagher] has staked out with the “Experimental History of Electricity,” a growing playlist on his criminally undersubscribed YouTube channel. The video linked below is his latest, describing the apparatus one Francis Hauksbee used to generate static electric charges for his early 18th-century experiments. Hauksbee’s name is nowhere near as well-known as that of Otto von Guericke or William Gilbert, who in the two centuries before Hauksbee conducted their own experiments and who both make appearances in the series. But Hauksbee’s machine, a rotating glass globe charged by the lightest touch of a leather pad, which [Sam] does a fantastic job recreating as closely as possible using period-correct materials and methods, allowed him to explore the nature of electricity in much greater depth than his predecessors.

But what about the urine? As with many of the experiments at the time, alchemists used what they had to create the reagents they needed, and it turned out that urine was a dandy source of phosphorous, which gave off a brilliant light when sufficiently heated. The faint light given off by mercury when shaken in the vacuum within a barometer seemed similar enough that it became known as the “mercurial phosphor” that likely inspired Hauksbee’s electrical experiments, which when coupled with a vacuum apparatus nearly led to the invention of the mercury discharge lamp, nearly 200 years early. The more you know. Continue reading “On The Nature Of Electricity: Recreating The Early Experiments” →

3D Print A Stenciling Frame For Your PCB

October 3, 2024 by 14 Comments

For many a hacker, stenciling a board for the first time is a game-changing experience – the solder joints you get, sure do give your PCB the aura of a mass-manufactured device. Now, you might not get a perfect print – and neither did [Atul R]. Not to worry, because if you have a 3D printer handy, he’s showing you how to design a 3D-printed frame using Blender and TinkerCAD, making your solder paste print well even if you’re trying to rest a giant stencil on top of a tiny board.

[Atul]’s situation was non-characteristic – the project is a 2mm thick PCB designed to plug right into a USB port, so the usual trick of using some scrap PCBs wouldn’t work, and using a 3D-printed frame turned out to be key. To get it done, he exported a .wrl from KiCad, processed it in Blender, and then designed a frame with help of TinkerCAD. These techniques, no doubt, will translate into your CAD of choice – especially if you go with .step export instead of .wrl.

This kind of frame design will get you far, especially for boards where the more common techniques fail – say, if you need to assemble a double-sided board and one side is already populated. Don’t have a stencil? You could surely make a 3D printed stencil, too, both for KiCad boards and for random Gerber files. Oh, and don’t forget this 3D-printable stencil alignment jig, while you’re at it – looks like it ought to save you quite a bit of trouble.

A Lightweight Balloon Tracker For High Altitude Missions

October 3, 2024 by 47 Comments

It’s pretty easy to take a balloon, fill it up with helium, and send it up in to the upper atmosphere. It’s much harder to keep track of it and recover it when it falls back to Earth. If you’re trying to do that, you might find some value in the Tiny4FSK project from the New England Weather Balloon Society.

Tiny4FSK is intended to be a very small solution for high-altitude tracking. As you might have guessed from the name, it communicates via 4FSK—four frequency shift keying. Basically, it communicates data via four separate tones. Based around the SAMD21G18A microcontroller, it’s designed to run on a single AA battery, which should last for anywhere from 10-17 hours. It communicates via a Si4063 transmitter set up to communicate on 433.2 MHz, using the Horus Binary v2 system. As for data, it’s hooked up with a GPS module and a BME280 environmental sensor for location. The balloon can figure out where it is, and tell you the temperature, pressure, and humidity up there, too.

If you’re looking for a lightweight balloon tracker, this one might be very much up your alley. We’ve featured other projects in this vein, too. Meanwhile, if you’re developing something new in the high-altitude ballooning space, you could keep it to yourself. Or, alternatively, you could tell us via the tipsline and we’ll tell everybody else. Your call!