2022 Cyberdeck Contest: The Oscilloscope Deck

September 30, 2022 by Jonathan Bennett 27 Comments

When [Jak_o_Shadows] Siglent Oscilloscope died, he didn’t just mourn the loss, he saw an opportunity. See, he had a Raspberry Pi 400 already set aside for a cyberdeck build, and he just scored a novel case. Most of the insides of the old scope came out, but the screen and control knobs live on in the new build. An HDMI-to-LVDS adapter brought the screen back to life, and the control knobs are a work-in-progress. Added to the case are some fun goodies, like a LimeSDR, connected to the old scope inputs. A PL2303 is wired to the serial port, making that functional, too. It’s a very nice touch that the build retains the original scope’s functions this way.

There’s plenty of 3d-printed goodness, like some internal brackets to hold things in place. The real star of the show is a 3d-printed hinge, holding the scope and Pi 400 together and making the whole package portable. There’s a neat tip, too, in that the Pi 400 has a huge integrated heat sync under the keyboard. It’s just a sheet of metal, so you can drill and tap it as mounting points. Cool!

This is a nifty build, and certainly a worthy deck for jacking-in to whatever you’re working on. And re-purposing an oscilloscope is a nice aesthetic. If [Jak_o_Shadows] can just get the front array of buttons and knobs working with his STM32, this will be a killer deck, the envy of console cowboys everywhere.

Microsoft Wants You (To Help With Assistive Tech)

September 30, 2022 by Jonathan Bennett 12 Comments

In college I had an exceptional piano teacher that was entirely blind. One day he noticed I had brought in my new-ish laptop, and his unexpected request — “can I look at your laptop?” — temporarily flabbergasted me. Naturally there wasn’t much he could do with it, so he gave it a once over with his fingers to understand the keyboard layout, and that was that. I still think about this experience from time to time, and the most obvious lesson is that my paradigm for using a computer didn’t map well to his abilities and disability.

The folks at Microsoft are thinking about this problem, too, and they’re doing a lot of work to make technology work for more users, like the excellent Xbox Adaptive Controller pictured above. Now, if you have some experience helping folks overcome the challenges of disability, or have a killer idea for an assistive technology solution, Microsoft is looking for projects to fund. Did you rig up a Raspberry Pi and webcam to automatically read text aloud? Maybe you pulled that old Kinect out, and are working on sign-language reader using 3D data points.

Make a pitch of your project or solid idea by the November 4th deadline, and just maybe you can get some help to make it a reality. Just make sure you come back and tell us about it! After all, some of the coolest hacks we’ve ever covered have been adaptive tech projects.

Thanks to [MauroPichiliani] for sending in this tip.

This Week In Security: Exchange 0-day, Doppelgangers, And Python Gets Bit In The TAR

September 30, 2022 by Jonathan Bennett 13 Comments

According to researchers at GTSC, there’s an unpatched 0-day being used in-the-wild to exploit fully patched Microsoft Exchange servers. When they found one compromised server, they made the report to Microsoft through ZDI, but upon finding multiple Exchange servers compromised, they’re sounding the alarm for everyone. It looks like it’s an attack similar to ProxyShell, in that it uses the auto-discover endpoint as a starting point. They suspect it’s a Chinese group that’s using the exploit, based on some of the indicators found in the webshell that gets installed.

There is a temporary mitigation, adding a URL-based request block on the string .*autodiscover\.json.*\@.*Powershell.. The exact details are available in the post. If you’re running Exchange with IIS, this should probably get added to your system right now. Next, use either the automated tool, or run the PowerShell one-liner to detect compromise: Get-ChildItem -Recurse -Path -Filter "*.log" | Select-String -Pattern 'powershell.*autodiscover\.json.*\@.*200. This one has the potential to be another really nasty problem, and may be wormable. As of the time of writing, this is an outstanding, unpatched problem in Microsoft Exchange. Come back and finish the rest of this article after you’ve safed up your systems.

Continue reading “This Week In Security: Exchange 0-day, Doppelgangers, And Python Gets Bit In The TAR” →

The 1337 PNG Hashquine

September 28, 2022 by Jonathan Bennett 7 Comments

A hashquine is a fun way to show off your crypto-tricks — It’s a file that contains its own hash. In some file types it’s trivial, you just pick the hash to hit, and then put random data in a comment or other invisible field till you get a collision. A Python script that prints its own hash would be easy. But not every file type is so easy. Take PNG for instance. these files are split into chunks of data, and each chunk is both CRC-32 and adler32 checksummed. Make one change, and everything changes, in three places at once. Good luck finding that collision. So how exactly did [David Buchanan] generate that beautiful PNG, which does in fact md5sum to the value in the image? Very cleverly.

Thankfully [David] shared some of his tricks, and they’re pretty neat. The technique he details is a meet-in-the-middle hack, where 36 pairs of MD5 collision blocks are found, with the understanding that these 36 blocks will get added to the file. For each block, either A or B of the pair will get plugged in at that location, and the md5sum won’t change. It’s a total of 2^36 possible combinations of these blocks, which is more computation than was practical for this particular hack. The solution is to pre-compute the results of every possible combination of the first 18 blocks, and store the results in a lookup table. The second half of the collisions are run backwards from a target CRC value, and the result checked against the lookup table. Find a hit, and you just found a series of blocks that matches both your target md5sum and CRC32 results.

Thanks to [Julian] for the tip! And as he described it, this hack is one that gets more impressive the more you think about it. Enjoy!

The First Microcomputer: The Q1

September 28, 2022 by Jonathan Bennett 53 Comments

Quiz time, what was the first commercially available microcomputer? The Altair 8800? Something obscure like the SCELBI? The Mark-8 kit? According to [The Byte Attic], it was actually the Q1, based on the Intel 8008 processor. The first Q1 microcomputer was delivered in December of 1972, making it the first, as far as he can tell. Later revisions used the Z80 processor, which is the model pictured above that [The Byte Attic] has in his possession. It’s a beautiful little machine, with a striking orange plasma display.

The irony is that this machine is almost entirely forgotten about. The original unit may have looked more like a typewriter, pictured here. If you have any first hand knowledge, or especially software, documentation, or surviving hardware bits, make sure to check in to add to the knowledge pool about this amazing little machine.

It’s an important milestone, and the development of the Q1 may have been a direct cause of Intel developing the more powerful 8080 microprocessor. It seems that Daniel Alroy’s work on this machine literally kicked off the microcomputer revolution, and it’s been missing from our computer lore for too many years. We’re very hopeful to see more of this story come together, and the history of the Q1 fully recovered.

And if retro hardware is your jam, we’ve got you covered, including among others, the parallel story about the first microprocessor.

Continue reading “The First Microcomputer: The Q1” →

Animated LED Arrows Point The Way

September 24, 2022 by Jonathan Bennett 11 Comments

Visitors at the Garden D’Lights in Bellevue, Washington had a problem. While touring the holiday lights show, they kept straying off the path. The event organizers tried some simple LED arrows, but they were just more points of light among a sea filled with them. This is when [Eric Gunnerson] was asked to help out. He’s apparently had some experience with LED animations, even cooking up a simple descriptor language for writing animations driven by an ESP32. To make the intended path obvious, he turned to a PVC board with 50 embedded WS2812 pixels –RGB controllable LEDs. The control box was a USB power adapter and an ESP8266, very carefully waterproofed and connected to the string of pixels. The backer board is painted black, to complete the hardware. Stick around after the inevitable break, to get a look at the final

The description of the build process is detailed and contains some great tips, but without a clever LED animation, it’s still of questionable utility. The pattern chosen is great, with the LEDs being blue most of the time, and a flame-like gradient chasing through the arrow every couple seconds. It’s obviously different from the lights of the show, and seems to be a real winner. [Eric] has published his code, with the sheepish caveat that he had to reinvent the wheel once again, and couldn’t reuse any of his previous LED animation work on this one. It’s a simple hack, but a great build log, and an effective solution to a subtle problem. And if addressable LEDs are your thing, check out our other hacks!

Continue reading “Animated LED Arrows Point The Way” →

This Week In Security: Malwarebytes Goes Nuts, Uber

September 23, 2022 by Jonathan Bennett 12 Comments

I got a rude awakening Wednesday morning this week. HaD writers don’t necessarily keep normal hours — don’t judge. A local client called, complaining that Google Maps was blocking on one of their computers, and the browser stated that it was a malicious site. Well that got my attention. Standard incident response: “Turn off the affected computers, I’m on my way.” Turns out, it was Malwarebytes that was complaining and blocking Google Maps, as well as multiple other Google domains. That particular machine happened to have a fresh install of the program, and was still in the trial period of Malwarebytes premium, which includes the malicious IP and domain blocking feature.

Oof, this could be bad. The first possibility that came to mind was a DNS hijack. The desktop’s DNS was set to the router, and the router’s DNS was set to the ISP’s. Maybe the ISP had their DNS servers compromised? Out came the cell phone, disconnected from the WiFi, for DNS lookups on some Google domains. Because Google operates at such a massive scale, they have multiple IPs serving each domain, but since the two different results were coming from the same subnet, the suspicious DNS server was likely OK. A whois on the blocked IP also confirmed that it was a Google-owned address. We were running out of explanations, and as a certain fictional detective was known for saying, “whatever remains, however improbable, must be the truth.” And, yes, Malwarebytes did indeed accidentally add Google to its bad list. The upside was that my customer wasn’t compromised. The downside? I had to answer a phone call before my first cup of coffee. Blegh.

Continue reading “This Week In Security: Malwarebytes Goes Nuts, Uber” →