Oh Great, WPA2 Is Broken

October 16, 2017 by Brian Benchoff 131 Comments

WPA2, the standard security for Wi-Fi networks these days, has been cracked due to a flaw in the protocol. Implications stemming from this crack range from decrypting Wi-Fi, hijacking connections, and injecting content. It’s fair to say, WPA2 is now Considered Harmful. The paper is available here (PDF).

This is a proof-of-concept exploit, and like all headline-making network security stories, it has a name. It’s called KRACK, for Key Reinstallation Attack. The key insight to this exploit is a vulnerability in the handshaking between routers and devices to establish a secure connection.

This is not the first time the researchers behind this exploit have found holes in WPA2. In a paper published by the KRACK researchers at the USENIX Symposium last August (PDF), they showed that the Random Number Generator used in 802.11 is flawed, ill-defined, and insecure. The researchers have also spoken at 33c3 on predicting WPA2 Group Keys.

The practical consequences of a poor definition and implementation of an RNG can be found in consumer hardware. The researchers found that in MediaTek-based routers, the only source of randomness is the current time. Meanwhile Broadcom-based routers do not use the RNG proposed by the 802.11 spec, but instead take the MD5 of the current time in microseconds. The researchers do not mention if the current time is a secret.

So what do we do now?

This has happened before. In 2001, WEP, the Wi-Fi security protocol many security-ignorant people are still running, was cracked in much the same was as KRACK. This quickly led to the development of Aircrack, and in 2003, the Wi-Fi Alliance rolled out WPA and WPA2. Sure, you can still select a deprecated security protocol for your router, but the problem of WEP hacking is as solved as it’s ever going to be.

The early 2000s were a different time when it came to wireless networks, though here in 2017 Wi-Fi permeates every cubic inch of our lives. Everything and everyone has Wi-Fi now. This is going to be a bit bigger than cracking WEP, but it remains possible to patch devices to ensure that this exploit is rendered useless. Install those security updates, people! Of course there will still be millions of unpatched devices in a year’s time, and for those routers, IoT baubles, and other wireless devices, turning on WPA2 will be akin to having no security at all.

That said, this isn’t a world-ending Armageddon in the way the botnet of webcams was. You will only be vulnerable if an attacker is within range of your router, and you will still be secure if you’re accessing secure websites. However, turning off Wi-Fi on your phone, relying on mobile data, not ignoring HTTPS cert warnings, and plugging into an Ethernet port might not be a bad idea.

Hackaday Links: October 15, 2017

October 15, 2017 by Brian Benchoff 32 Comments

For the last few months we’ve been running The Hackaday Prize, a challenge for you to build the best bit of hardware. Right now — I mean right now — you should be finishing up your project, crossing your t’s and dotting your lowercase j’s. The last challenge in the Prize ends tomorrow. After that, we’re going to pick 20 finalists for the Anything Goes challenge, then send the finalists off to our fantastic team of judges. Time to get to work! Make sure your project meets all the requirements!

It’s been a few weeks, so it’s time to start talking about Star Trek. I’m paying ten dollars a month to watch Star Trek: Discovery. I was going to pay that anyway, but I think this might actually be worth it. Highlights include Cardassian voles and Gorn skeletons. Also on the Star Trek front is The Orville, [Seth MacFarlane]’s TNG-inspired show. The Orville has far surpassed my expectations and is more Star Trek than Discovery. Leave your thoughts below.

It’s a new edition of Project Binky! Two blokes are spending years stuffing a 4WD Celica into a Mini. It’s the must-watch YouTube series of the decade.

AstroPrint now has an app. If you’re managing a 3D printer remotely and you’re not using Octoprint, you’re probably using AstroPrint. Now it’s in app format.

Have fifty bucks and want to blow it on something cool? A company is selling used LED display tiles on eBay. You get a case of ten for fifty bucks. Will you be able to drive them? Who knows and who cares? It’s fifty bucks for massive blinkies.

[Peter] is building an ultralight in his basement. For this YouTube update, he’s making the wings.

Oh it’s deer season, so here’s how you make deer jerky.

If you’re messing around with Z-Wave modules and Raspberry Pis, there’s a contest for you. The grand prize is an all-expense paid trip to CES2018 in Las Vegas. Why anyone would be enthusiastic about a trip to CES is beyond me, but the Excalibur arcade has Crazy Taxi, so that’s cool.

Go is the language all the cool kids are using. GoCV gives Go programmers access to OpenCV.

Hackaday Prize Entry: An Open Radiation Detector

October 14, 2017 by Brian Benchoff 38 Comments

For his Hackaday Prize entry, [Carlos] is pushing the boundaries of what can be built with PCBs. He’s designed a very low-cost radiation detector that leverages pick and place machines, off-the-shelf components, and very simple electronics. It’s a novel ion chamber design, and if you ever needed a low-cost, easily manufacturable radiation detector, this is the project you want.

Instead of a Geiger tube or a spark detectors, this radiation detector uses an ionization chamber to detect radiation. This project was inspired by the work of [Charles Wenzel] and [Alan Yates], and the implementation is actually pretty simple. A metal can — or some other type of enclosure — is electrified, and a single wire is stuck right into the middle of the can. When alpha and beta particles enter the can, air molecules are ionized, and attracted to either the can or the wire by a difference in voltage. A tiny bit of current flows between the can and the wire, which can be detected if you have a sufficiently sensitive circuit.

The basic idea is well-publicised and well-understood. What [Carlos] is doing with this project is making an ionization chamber easily manufacturable. He’s doing this entirely with standard PCBs and solder instead of paint cans, RF connectors, and deadbugged transistors of the earlier experiments. The resulting PCB actually looks like something that wasn’t put together in a garage (even though it probably was), and is an amazing entry for the Hackaday Prize.

Hackaday Prize Entry: IoT Nixie Clocks

October 13, 2017 by Brian Benchoff 6 Comments

Nixie clocks are the in thing right now, and they have been for at least a decade. For his Hackaday Prize entry, [mladen] is bringing things into the 21st century with a USB-powered, IoT Nixie clock. It displays the time, temperature, the current cryptocurrency price in fiat, your current number of Twitter followers, the number of updoots on your latest reddit meme, or anything else that can be expressed as four digits.

This Nixie clock uses four IN-12B tubes, with the dot, which are more or less standard when it comes to small Nixie clocks. These tubes are mounted directly to a PCB, which is in turn mounted at 90 degrees to the main board, providing a slim form factor for the machined wood or aluminum enclosure.

The control electronics are built around the ESP8266, with a handy USB connection providing the power and a serial connection. A BQ3200 real time clock keeps the time with the help of a supercapacitor. The killer feature here is a piezo sensor to detect taps on the enclosure. Hit the clock once, and it displays the time. Hit it two times, and the current balance of your bitcoin wallet is displayed. It’s a great project, and [mladen] is hoping to turn this project into a product and put it up on Crowdsupply soon. All in all, a great entry to The Hackaday Prize.

Friday Hack Chat: The Incredible BeagleBoard

October 11, 2017 by Brian Benchoff 12 Comments

Over the last year or so, the BeagleBoard community has seen some incredible pieces of hardware. The BeagleBone on a Chip — the Octavo OSD335x — is a complete computing system with DDR3, tons of GPIOs, Gigabit Ethernet, and those all-important PRUs stuffed into a single piece of epoxy studded with solder balls. This chip made it into tiny DIY PocketBones and now the official PocketBeagle is in stock in massive quantities at the usual electronic component distributors.

For this week’s Hack Chat, we’re talking about the BeagleBoard, BeagleBone, PocketBeagle, and PocketBone. [Jason Kridner], the co-founder of BeagleBoard and beagle wrangler, will be on hand to answer all your questions about the relevance of the Beagle platform today, the direction BeagleBoard is going, and the inner workings of what is probably the best way to blink LEDs in a Linux environment.

Topics for this Hack Chat will include the direction BeagleBoard is going, the communities involved with BeagleBoard, and how to get the most out of those precious programmable real-time units. As always, we’re taking questions from the community, submit them here.

As an extra special bonus, this week we’re giving away some hardware. Digi-Key has offered up a few PocketBeagle boards. If you have an idea for a project, put it on the discussion sheet and we’ll pick the coolest project and send someone a PocketBeagle.

Our Hack Chats are live community events on the Hackaday.io Hack Chat group messaging. This Hack Chat will be going down noon, Pacific time on Friday, October 13th. Wondering why the Brits were the first to settle on a single time zone when the US had a more extensive rail network and the longitude so time zones made sense? Here’s a time zone converter! Use that to ponder the mysteries of the universe.

Click that speech bubble to the right, and you’ll be taken directly to the Hack Chat group on Hackaday.io.

You don’t have to wait until Friday; join whenever you want and you can see what the community is talking about.

Building The Hackaday Superconference Badge

October 11, 2017 by Brian Benchoff 36 Comments

The best hardware conference is just a few weeks away. This is the Hackaday Superconference, and it’s two days of talks, an extra day of festivities, soldering irons, and an epic hardware badge. We’ve been working on this badge for a while now, and it’s finally time to share some early details. This is an awesome badge and a great example of how to manufacture electronics on an extremely compressed timetable. This is badgelife, the hardware demoscene of electronic conference badges.

So, what does this badge do? It’s a camera. It has games, and it’s designed by [Mike Harrison] of Mike’s Electric Stuff. He designed and prototyped this badge in a single weekend. On board is a PIC32 microcontroller, an OV9650 camera module, and a bright, crisp 128×128 resolution color OLED display. Tie everything together with a few buttons, and you have a badge that’s really incredible.

So, how do you get one? You’ve got to come to the Hackaday Superconference. This year we’re doing things a bit differently and opening the doors a day early to get the hacker village started with badge hacking topped off by a party that evening and everyone coming to Supercon is invited! This is a badge full of games, puzzles, and video capture and isn’t something to miss. We have less than 30 tickets left so grab your ticket now and read on.

Continue reading “Building The Hackaday Superconference Badge” →

Hackaday Links: October 8, 2017

October 8, 2017 by Brian Benchoff 40 Comments

On the top of the popcorn pile for this weekend is an ambiguous tweet from Adafruit that was offered without comment or commentary. [Lady Ada] is holding some sort of fancy incorporation papers for Radio Shack. The smart money is that Adafruit just bought these at the Radio Shack auction a month or so ago. The speculation is that Adafruit just bought Radio Shack, or at least the trademarks and other legal ephemera. Either one is cool, but holy crap please bring back the retro 80s branding.

A Rubik’s Cube is a fantastic mechanical puzzle, and if you’ve never taken one apart, oh boy are you in for a treat. Here’s an RGB LED Rubick’s Cube with not enough detail as to how each square is getting powered. Here’s an open challenge for anyone: build an RGB LED Rubick’s Cube, and Open Source the design.

Last weekend, the front fell off the engine of an Air France A380 flying over Greenland. As with all aircraft incidents, someone has to find the missing bits. It only took a week to find a mangled cowling on an ice sheet. This is incredibly impressive; if you want a comparison to another accident, it took three months to find the fan disk for UA 232 in an Iowa cornfield.

Poorly thought out Kickstarters don’t grab our attention like they used to, but this is an exception. The Aire is a mashup of one of those voice-activated home assistants (Alexa, whatever the Google one is named…) and a drone. The drone half of the build is marginally interesting as a ducted fan coaxial thingy, and building your own home assistant isn’t that hard with the right mics and a Raspberry Pi. The idea is actually solid — manufacturing is another story, though. It appears no one thought about how annoying it would be to have a helicopter following them around their house, or if the mics would actually be able to hear anyone over beating props. Here’s the kicker: this project was successfully funded. People want to buy this. A fool and his or her money…

Processing is cool, although we’re old skool and still reppin’ Max/MSP. It looks like the first annual Processing Community Day is coming up soon. The Processing Community Day will be at the MIT Media Lab on October 21st, with talks from the headliners of the Processing community.

Maker Faire NYC was two weekends ago, the TCT show in Birmingham was last week, and Open Hardware Summit was in Denver this weekend. Poor [Prusa] was at all of them, racking up the miles. He did, however, get to ride [James from XRobots.co.uk]’s electric longboard. There’s some great videos from [James] right here and here.

Speaking of Open Hardware Summit, there was a field trip to Sparkfun and Lulzbot this Friday. The highlight? The biggest botfarm in the states, and probably the second largest in the world. That’s 155 printers, all in their own enclosures, in a room that’s kept at 80° F. They’re printing ABS. Control of the printers is through a BeagleBone running Octoprint. These ‘Bones and Octoprint only control one printer each, and there is no software layer ‘above’ the Octoprint instances for managing multiple printers simultaneously. That probably means the software to manage a botfarm doesn’t exist. There have been attempts, though, but nothing in production. A glove thrown down?