Trap Naughty Web Crawlers In Digestive Juices With Nepenthes

January 23, 2025 by Maya Posch 45 Comments

In the olden days of the WWW you could just put a robots.txt file in the root of your website and crawling bots from search engines and kin would (generally) respect the rules in it. These days, however, we have especially web crawlers from large language model (LLM) companies happily ignoring such signs on the lawn before proceeding to hover up every scrap of content on websites. Naturally this makes a lot of people very angry, but what can you do about it? The answer by [Aaron B] is Nepenthes, described on the project page as a ‘tar pit for catching web crawlers’.

More commonly known as ‘pitcher plants’, nepenthes is a genus of carnivorous plants that use a fluid-filled cup to trap insects and small critters unfortunate enough to slip & slide down into it. In the case of this Lua-based project the idea is roughly the same. Configured as a trap behind a web server (e.g. /nepenthes), any web crawler that accesses it will be presented with an endless number of (randomly generated) pages with many URLs to follow. Page generating is deliberately quite slow to not soak up significant CPU time, while still giving the LLM scrapers plenty of random nonsense to chew on.

Considering that these web crawlers deemed adhering to the friendly sign on the lawn beneath them, the least we can do in response, is to hasten model collapse by feeding these LLM scrapers whatever rolls out of a simple (optionally Markov-based) text generator.

Making Wire Explode With 4,000 Joules Of Energy

January 21, 2025 by Maya Posch 80 Comments

The piece of copper wire moments before getting vaporized by 4,000 joules. (Credit: Hyperspace Pirate, Youtube)

In lieu of high-explosives, an exploding wire circuit can make for an interesting substitute. As [Hyperspace Pirate] demonstrates in a recent video, the act of pumping a lot of current very fast through a thin piece of metal can make for a rather violent detonation. The basic idea is that by having the metal wire (or equivalent) being subjected to a sufficiently large amount of power, it will not just burn through, but effectively vaporize, creating a very localized stream of plasma for the current to keep travelling through and create a major shockwave in the process.

This makes the exploding wire method (EWM) an ideal circuit for any application where you need to have a very fast, very precise generating of plasma and an easy to synchronize detonation. EWM was first demonstrated in the 18th century in the Netherlands by [Martin van Marum]. These days it finds use for creating metal nanoparticles, brief momentary light sources and detonators in explosives, including for nuclear (implosion type) weapons.

While it sounds easy enough to just strap a honkin’ big battery of capacitors to a switch and a piece of wire, [Hyperspace Pirate]’s video demonstrates that it’s a bit more involved than that. Switching so much current at high voltages ended up destroying a solid-state (SCR) switch, and factors like resistance and capacitance can turn an exploding wire into merely a heated one that breaks before any plasma or arcing can take place, or waste a lot of potential energy.

As for whether it’s ‘try at home’ safe, note that he had to move to an abandoned industrial site due to the noise levels, and the resulting machine he cobbled together involves a lot of high-voltage wiring. Hearing protection and extreme caution are more than warranted.

Continue reading “Making Wire Explode With 4,000 Joules Of Energy” →

Bambu Lab Tries To Clarify Its New “Beta” Authentication Scheme

January 20, 2025 by Maya Posch 62 Comments

Perhaps one of the most fascinating aspects of any developing tech scandal is the way that the target company handles criticism and feedback from the community. After announcing a new authentication scheme for cloud & LAN-based operations a few days ago, Bambu Lab today posted an update that’s supposed to address said criticism and feedback. This follows the original announcement which had the 3D printer community up in arms, and quickly saw the new tool that’s supposed to provide safe and secure communications with Bambu Lab printers ripped apart to extract the security certificate and private key.

In the new blog post, the Bambu Lab spokesperson takes a few paragraphs to get to the points which the community are most concerned about, which is interoperability between tools like OrcaSlicer and Bambu Lab printers. The above graphic is what they envision it will look like, with purportedly OrcaSlicer getting a network plugin that should provide direct access, but so far the Bambu Connect app remains required. It’s also noted that this new firmware is ‘just Beta firmware’.

As the flaming wreck that’s Bambu Lab’s PR efforts keeps hurtling down the highway of public opinion, we’d be remiss to not point out that with the security certificate and private key being easily obtainable from the Bambu Connect Electron app, there is absolutely no point to any of what Bambu Lab is doing.

Bambu Connect’s Authentication X.509 Certificate And Private Key Extracted

January 19, 2025 by Maya Posch 125 Comments

Hot on the heels of Bambu Lab’s announcement that it would be locking down all network access to its X1-series 3D printers with new firmware, the X.509 certificate and private key from the Bambu Connect application have now been extracted by [hWuxH]. This application was intended to be the sole way for third-party software to send print jobs to Bambu Lab hardware as we previously reported.

The Bambu Connect app is a fairly low-effort Electron-based affair, with some attempt at obfuscation and encryption, but not enough to keep prying eyes out. The de-obfuscated main.js file can be found here (archived), with the certificate and private key clearly visible. These are used to encrypt HTTP traffic with the printer, and is the sole thing standing in the way of tools like OrcaSlicer talking with authentication-enabled Bambu Lab printers.

As for what will be the next steps by Bambu Lab, it’s now clear that security through obfuscation is not going to be very effective here. While playing whack-a-mole with (paying) users who are only interested in using their hardware in the way that they want is certainly an option, this might be a wake-up call for the company that being more forthcoming with their userbase would be in anyone’s best interest.

We await Bambu Lab’s response with bated breath.

Investigating USB-to-Ethernet Dongles With “Malware” Claims

January 18, 2025 by Maya Posch 56 Comments

Recently a video surfaced from someone claiming that certain USB-to-Ethernet dongles contained ‘malware’ among other big claims. Basically these dongles were said to be designed by China (and Russia) to spy on users and so on, but how much of this is actually grounded in reality? When [lcamtuf] dove into the topic, what he found was not so much a smoking gun, but rather a curious relic from the era when drivers-on-CD were being phased out.

The item that the video went bananas about was namely an additional SPI Flash chip on the PCB alongside the USB 2.0 – Ethernet IC, with many conspiracy theories being floated as to what it would be used for. After some digging, [lcamtuf] found that the IC used in these dongles (SR9900) is by a company called CoreChips Shenzhen, with a strong suggestions that it is a clone of the (2013-era) Realtek RTL8152B.

Both chips have an external SPI Flash option, which is used with the USB side to present a ‘virtual CD drive’ to the user when the dongle is plugged in. This was borne out with the SR9900 Windows system mass production tool that [lcamtuf] obtained a copy of. Included with the flashing tool is a 168 kB ISO image (containing the SR9900 driver package) which happily fits on the 512 kB Flash chip.

Although it’s always possible for chips and firmware to contain backdoors and malware, in this particular case it would appear to be that it’s merely a cruel reminder that 2013 is now already vanishing into the realm of ‘retro computing’ as us old fogies cling to our driver installation floppies and CDs.

New Bambu Lab Firmware Update Adds Mandatory Authorization Control System

January 17, 2025 by Maya Posch 105 Comments

As per a recent Bambu Lab blog post, its FDM printers in the X1 series will soon receive a firmware update that adds mandatory authentication for certain operations, starting with the firmware update on January 23rd for the aforementioned FDM printers. These operations include performing firmware upgrades, initiating a print job (LAN or cloud), remote video access and adjusting parameters on the printer. Using the printer directly and starting prints from an SD card are not affected.

As reasoning for this new feature Bambu Lab points to recent exploits that gave strangers access to people’s printers, though cheekily linking to an article on an Anycubic printer exploit. While admittedly a concern, this mostly affects internet-exposed printers, such as those that are tied into a ‘cloud’ account. Even so, LAN-based printing also falls under this new mandatory authentication system, with Bambu Lab offering a new tool called Bambu Connect for those who insist on using non-Bambu Lab branded software like OrcaSlicer. This allows for exported G-code files to be sent to a (property authenticated) Bambu Lab printer.

For those who do not wish to use this feature, not upgrading the firmware is currently the only recourse. Although this firmware update is only for X1-series printers, Bambu Lab promised that it’ll arrive for their other printers too in due time. While Bambu Lab printer owners consider installing the alternative X1 Plus firmware, the peanut gallery can discuss the potential security issues (or lack thereof) of an open Fluidd or similar UI on their LAN-connected, Klipper-based FDM printers.

Thanks to [mip] for the tip.

Repairing A Samsung 24″ LCD Monitor With Funky Color Issues

January 16, 2025 by Maya Posch 21 Comments

Dumpster diving is one of those experiences that can net you some pretty cool gear for a reasonable price. Case in point the 24″ Samsung S24E650XW LCD monitor that [MisterHW] saved from being trashed. Apparently in very good condition with no visible external damage, the unit even powered up without issues. It seemed like a golden find until he got onto the Windows desktop and began to notice quaint red shimmering in darker areas and other issues that made it clear why the monitor had been tossed. Of course, the second best part about dumpster diving is seeing whether you can repair such issues.

Prior to disassembly it had been noted that percussive maintenance and bending of the frame changed the symptoms, suggesting that something was a bit loose inside. After taking the back cover and shielded enclosure off, a quick visual inspection of the boards and cables quickly revealed the likely suspect: broken traces on one of the cables.

Apparently somewhere during the assembly step in the factory the cable had been pushed against the PCB’s edge, causing the initial damage. Based on the listed assembly date the monitor had only been in use for a few years before it was tossed, so likely the symptoms would have begun and worsened as one after another of the traces gradually cracked and broke due to vibrations, thermal expansion, etc.

This issue made fixing the monitor very simple, however, assuming a suitable replacement cable could be found. The broken cable is a 30P 1.0 pitch PFC, with EBay throwing up a cable with similar specs for a Thomson brand TV. One purchase and anxious wait later, the replacement cable was installed as in the featured image alongside the old cable. Perhaps unsurprisingly it restored the monitor to full working order, demonstrating once again that dumpster diving is totally worth it.