5G Cellphone’s Location Privacy Broken Before It’s Even Implemented

December 7, 2018 by Jenny List 52 Comments

Although hard to believe in the age of cheap IMSI-catchers, “subscriber location privacy” is supposed to be protected by mobile phone protocols. The Authentication and Key Agreement (AKA) protocol provides location privacy for 3G, 4G, and 5G connections, and it’s been broken at a basic enough level that three successive generations of a technology have had some of their secrets laid bare in one fell swoop.

When 3G was developed, long ago now, spoofing cell towers was expensive and difficult enough that the phone’s International Mobile Subscriber Identity (IMSI) was transmitted unencrypted. For 5G, a more secure version based on a asymmetric encryption and a challenge-reponse protocol that uses sequential numbers (SQNs) to prevent replay attacks. This hack against the AKA protocol sidesteps the IMSI, which remains encrypted and secure under 5G, and tracks you using the SQN.

The vulnerability exploits the AKA’s use of XOR to learn something about the SQN by repeating a challenge. Since the SQNs increment by one each time you use the phone, the authors can assume that if they see an SQN higher than a previous one by a reasonable number when you re-attach to their rogue cell tower, that it’s the same phone again. Since the SQNs are 48-bit numbers, their guess is very likely to be correct. What’s more, the difference in the SQN will reveal something about your phone usage while you’re away from the evil cell.

A sign of the times, the authors propose that this exploit could be used by repressive governments to track journalists, or by advertisers to better target ads. Which of these two dystopian nightmares is worse is left as comment fodder. Either way, it looks like 5G networks aren’t going to provide the location privacy that they promise.

Via [The Register]

Header image: MOs810 [CC BY-SA 4.0].

A Raspberry Pi Has This Pool Covered

December 2, 2018 by Jenny List 25 Comments

Far from being a tiled hole in the ground with a bit of water in it, a modern swimming pool boasts a complex array of subsystems designed to ensure your morning dip is as perfect as that you’d find on the sun-kissed beaches of your dream tropical isle. And as you might expect with such complex pieces of equipment in a domestic setting, they grow old, go wrong, and are expensive to fix.

[DrewBeer]’s pool had just such a problem. A decades-oldwired controller had failed, so rather than stump up a fortune for a refit, he created his own pool controller which exists under the watchful eye of a Raspberry Pi. The breadth of functionality is apparent from his write-up. In addition to the pump and heater you’d expect, he as a salt water system, environmental monitoring, and even an RTL-SDR to pull in readings from an RF floating temperature probe. It’s all exposed via a node.js API, and thus far has been running for over 6 months without mishap.

From where this is being written in the gloom of a damp November in a Northern Hemisphere maritime climate we can only envy [Drew] his pool and imagine it as perpetually deep blue and sparkling, invitingly cool against the heat of a summer’s day. If you have similar pool automation woes. perhaps you’d also like to look at this ESP8266 pool monitor, or another automation project using a Raspberry Pi.

Naomi Wu On The Sino:Bit, 3D Printers, And Open Source Hardware In China

December 1, 2018 by Jenny List 8 Comments

Many readers will be familiar with [Naomi Wu], the prolific hardware hacker who has shown us so much of the epicentre of Chinese tech in her native Shenzhen through a lens that most outsiders would struggle to achieve. We’ve seen her touring factories and electronics marts, building a load of interesting projects, and achieving the first open source hardware certifications in China.

We’ve seen a lot of [Naomi] speaking to us in English as an audience outside her country, so it is extremely interesting to see her latest video posting in which she makes her case for open source hardware in Chinese to a Chinese audience (Chinese audio with English subtitles). She’s speaking at the recent China open source conference, and her description starts with “**THIS IS VERY BORING UNLESS YOU ARE INTO OPEN SOURCE**”, which we think is a little unfair as it should appeal to anyone with an interest in the Chinese tech business.

In the talk she takes us through the potential benefits of open source to Chinese business by using her projects as case studies. In particular she concentrates on how the arguments for open source in a commercial arena have to be made differently for a Chinese business to those used in the rest of the world. Using the analogy of a college dorm hotpot party, she outlines the importance of a community in open-source development, then we get a blow-by blow account of her work with Elecrow and Creality on the Sino:bit (a single-board computer targeting education in China) and the 3D printers.

The software support for the Sino:bit in particular demonstrates the added value of open source to a business, with significant tutorial and curriculum material coming from Adafruit Industries, Hindi language and character set support from developers in India, and a Chinese developer painstakingly transcribing all the Chinese character set for the device. That last step alone would have cost a non open-source developer a significant sum.

During her talk we are shown the commercial benefits to all three devices, for example one of the Creality 3D printers rapidly becoming Amazon’s top seller despite an array of knock-off machines appearing. We’ve embedded the video below the break, and we think it should be required viewing for anyone with an interest in open source or the Chinese tech industry.

Once you have seen the video you might find [Naomi’s] guide to buying on Taobao to be of interest, as well as her explanation of the Chinese cultural attitude to engineers while introducing us to the historical master craftsman, [Lu Ban].

Continue reading “Naomi Wu On The Sino:Bit, 3D Printers, And Open Source Hardware In China” →

Building Portable Linux Devices: Never Been Easier, But Still Hard

November 30, 2018 by Jenny List 35 Comments

We live in a Golden Age of single-board computers. There was a time when a portable computer that was any good was a relatively rare and expensive device, certainly not something you could expect to replicate for yourself. A Psion, or later a Palm or perhaps a WinCE device would have been a lot more than an impulse purchase, and could not easily have been replicated using the components then available to the experimenter.

Thanks to spin-offs from technology developed for set-top boxes and mobile phones we can now buy any one of a pile of different boards that have almost equivalent power to a desktop computer. The experimenter can leverage that computing power to create their own small portables. Zerophone creator Arsenijs Picugins spoke about the tricky parts of designing a LInux portable at the recent Hackaday Superconference. You’ll find his talk below the break, which makes for a fascinating primer for those tempted to walk in his footsteps.

Minor Details of Portables are the Majority of the Build

In theory, it’s pretty easy to use one of these boards to make a portable computer. Take one of the smaller members of the Raspberry Pi or Beaglebone families, add a battery and a display, and away you go. But as always the devil is in the detail, and for a truly successful build there are a wealth of variables to attend to.

In his talk, Arsenijs takes us through the challenges of power supplies, connectors, and interfaces. In particular there is considerable challenge to running an SBC from a battery small enough to be portable, as efficiency concerns and the ability to easily recharge make for a critical set of choices. Then we learn of another pitfall, that of using USB as a default interface. Power loss in converting 5V to 3.3V that is inconsequential for a desktop computer is a battery-killer in a small device, so we’re pointed at the array of alternatives.

Zerophone screen menu [via @ZeroPhoneOSHW]

Screen Size is a Tricky Spec to Settle

If you’ve been tempted by one of those cheap Raspberry Pi touch screens, you’ll certainly understand that while a full desktop on a screen the size of a playing card looks cool, the reality is almost unusable. Your device will require a user interface that fits its form factor, which from his experience, Arsenijs suggests is best achieved through the medium of buttons rather than a touchscreen on smaller screens. There are a variety of UI and display libraries he introduces us to which make the whole process significantly easier.

Arsenijs’ Zerophone Raspberry Pi smartphone was a finalist in the 2017 Hackaday Prize, and remains an exemplary portable project from which many others can gain inspiration. We are privileged that he was able to bring his experience to speak at the Superconference, and his talk makes for a fascinating watch.

Continue reading “Building Portable Linux Devices: Never Been Easier, But Still Hard” →

Supercon: Alex Hornstein’s Adventures In Hacking The Lightfield

November 21, 2018 by Jenny List 21 Comments

We are all familiar with the idea of a hologram, either from the monochromatic laser holographic images you’ll find on your bank card or from fictional depictions such as Princes Leia’s distress message from Star Wars. And we’ve probably read about how the laser holograms work with a split beam of coherent light recombined to fall upon a photographic plate. They require no special glasses or headsets and possess both stereoscopic and spatial 3D rendering, in that you can view both the 3D Princess Leia and your bank’s logo or whatever is on your card as 3D objects from multiple angles. So we’re all familar with that holographic end product, but what we probably aren’t so familiar with is what they represent: the capture of a light field.

In his Hackaday Superconference talk, co-founder and CTO of holographic display startup Looking Glass Factory Alex Hornstein introduced us to the idea of the light field, and how its capture is key to the understanding of the mechanics of a hologram.

Capturing the light field with a row of GoPro cameras.

His first point is an important one, he expands the definition of a hologram from its conventional form as one of those monochromatic laser-interference photographic images into any technology that captures a light field. This is, he concedes, a contentious barrier to overcome. To do that he first has to explain what a light field is.

When we take a 2D photograph, we capture all the rays of light that are incident upon something that is a good approximation to a single point, the lens of the camera involved. The scene before us has of course countless other rays that are incident upon other points or that are reflected from surfaces invisible from the single point position of the 2D camera. It is this complex array of light rays which makes up the light field of the image, and capturing it in its entirety is key to manipulating the result. This is true no matter the technology used to bring it to the viewer. A light field capture can be used to generate variable focus 2D images after the fact as is the case with the Lytro cameras, or it can be used to generate a hologram in the way that he describes.

One possible future use of the technology, a virtual holographic aquarium.

The point of his talk is that complex sorcery isn’t required to capture a light field, something he demonstrates in front of the audience with a volunteer and a standard webcam on a sliding rail. Multiple 2D images are taken at different points, which can be combined to form a light field. The fact that not every component of the light field has been captured doesn’t matter as much as that there is enough to create the holographic image from the point of view of the display. And since he happens to be head honcho at a holographic display company he can show us the result. Looking Glass Factory’s display panel uses a lenticular lens to combine the multiple images into a hologram, and is probably one of the most inexpensive ways to practically display this type of image.

Since the arrival of the Lytro cameras a year or two ago the concept of a light field is one that has been in the air, but has more often been surrounded by an air of proprietary marketing woo. This talk breaks through that to deliver a clear explanation of the subject, and is a fascinating watch. Alex leaves us with news of some of the first light field derived video content being put online and with some decidedly science-fiction possible futures for the technology. Even if you aren’t planning to work in this field, you will almost certainly encounter it over the next few years.

Continue reading “Supercon: Alex Hornstein’s Adventures In Hacking The Lightfield” →

Rapid-Fire Hail Of Chopstick Arrows Makes Short Work Of Diminutive Foes

November 20, 2018 by Jenny List 9 Comments

Many Hackaday readers may also be familiar with the Discworld series of fantasy novels from [Terry Pratchett], and thus might recognise a weapon referred to as the Piecemaker. A siege crossbow modified to launch a hail of supersonic arrows, it was the favoured sidearm of a troll police officer, and would frequently appear disintegrating large parts of the miscreants’ Evil Lairs to comedic effect.

Just as a non-police-officer walking the streets of Ank-Morpork with a Piecemaker might find swiftly themselves in the Patrician’s scorpion pit, we’re guessing ownership of such a fearsome weapon might earn you a free ride in a police car here on Roundworld. But those of you wishing for just a taste of the arrow-hail action needn’t give up hope, because [Turnah81] has made something close to it on a smaller scale. His array of twelve mousetrap-triggered catapults fires a volley of darts made from wooden kebab skewers in an entertaining fashion, and has enough force to penetrate a sheet of cardboard.

He refers to a previous project with a single dart, and this one is in many respects twelve of that project in an array. But in building it he solves some surprisingly tricky engineering problems, such as matching the power of multiple rubber bands, or creating a linkage capable of triggering twelve mousetraps (almost) in unison. His solution, a system of bent coat-hanger wires actuated by the falling bar of each trap, triggers each successive trap in a near-simultaneous crescendo of arrow firepower.

On one hand this is a project with more than a touch of frivolity about it. But the seriousness with which he approaches it and sorts out its teething troubles makes it an interesting watch, and his testing it as a labour-saving device for common household tasks made us laugh. Take a look, we’ve put the video below the break.

Continue reading “Rapid-Fire Hail Of Chopstick Arrows Makes Short Work Of Diminutive Foes” →

The (UV) Writing’s On The Wall

November 18, 2018 by Jenny List 15 Comments

[Michael Karliner]’s Belshazzar, named for the Biblical character upon whose wall the writing appeared, is a unique light painting machine, that tracks an array of UV LEDs across a glow-in-the-dark background to paint transient dot-matrix letters in light. It was one of many cyberpunk-themed art pieces in Null Sector at the 2018 Electromagnetic Field hacker camp this summer.

The row of LEDs hangs down from a carriage that traverses a tubular rail, and is edged forward by means of a stepper motor driving a roller. This arrangement delivers the benefit that it can be scaled for displays of any length. The LEDs are driven from an Arduino via a Texas Instruments TLC5940 PWM driver ship.The result can be seen in the video below the break, and those who saw it at EMF may remember it tracing suitably dystopian phrases.

Continue reading “The (UV) Writing’s On The Wall” →