This Week In Security: Sudo, Database Breaches, And Ransomware

January 29, 2021 by 27 Comments
We couldn't resist, OK?
Obligatory XKCD

Sudo is super important Linux utility, as well as the source of endless jokes. What’s not a joke is CVE-2021-3156, a serious vulnerability around incorrect handling of escape characters. This bug was discovered by researchers at Qualys, and has been in the sudo codebase since 2011. If you haven’t updated your Linux machine in a couple days, you may very well be running the vulnerable sudo binary still. There’s a simple one-liner to test for the vulnerability:

sudoedit -s '\' `perl -e 'print "A" x 65536'`

In response to this command, my machine throws this error, meaning it’s vulnerable:

malloc(): corrupted top size
Aborted (core dumped)

To understand the problem with sudo, we have to understand escape characters. It really boils down to spaces in file and folder names, and how to deal with them. You want to name your folder “My Stuff”? That’s fine, but how do you interact with that directory name on the command line, when spaces are the default delimiter between arguments? One option is to wrap it in quotation marks, but that gets old in a hurry. The Unix solution is to use the backslash character as an escape character. Hence you can refer to your fancy folder as My\ Stuff. The shell sees the escape character, and knows to interpret the space as part of the folder name, rather than an argument separator. Escape characters are a common vulnerability location, as there are plenty of edge cases. Continue reading “This Week In Security: Sudo, Database Breaches, And Ransomware” →

Fire In The Palm Of Your Hand

January 29, 2021 by 15 Comments

For as long as super-heroes have existed, they have inspired hacker projects. For [Everett Bradford], emulating the character Pyro from X-Men has been an on and off project for the last decade. His latest version, Pyro System V4, integrates quite a bit of control electronics to give the rather convincing effect of mind-controlled fire in the palm of his hand. (Video, embedded below.)

The system is a motor-actuated slider strapped to [Everett]’s forearm, which pushes a pivoting end-effector with an integrated butane burner into the palm of his hand. The slider runs on 4 mm linear bearings actuated by a small geared DC motor using cables. The end effector is spring-loaded to push it into the palm and integrates a high voltage ignition arc generator circuit, nozzle, and capacitive activation button.

The butane gas canister and the valve was cannibalized from a small blow torch lighter, and the valve is actuated by another geared DC motor. The valve actuator, slide actuator, and end-effector hinge all integrate position feedback via hall effect sensors and magnets. The sensor in the hinge allows the slide to actively correct for the angle of the user’s wrist, keeping the end effector in the middle of the palm.

The control circuit is split into two parts. One PIC16 microcontroller runs all the motion control and position sensing, while a PIC18 connected to a small touch screen handles user interface, control parameters, and ignition. The touch screen proved especially useful for control parameters during development without needing to connect to a laptop.

Some of [Everett]’s previous version had a much more impressive (and dangerous) flame but was also very bulky. We think this latest version strikes a pretty good balance regarding compactness and achieving convincing illusion.

[Colin Furze] is another name commonly associated with fire-breathing contraptions, but they have a proven history of landing him in hospital.

Continue reading “Fire In The Palm Of Your Hand” →

A Look At The Interesting RP2040 Peripheral, Those PIOs

January 29, 2021 by 41 Comments

The Raspberry Pi Pico is the latest product in the Raspberry Pi range, and it marks a departure from their previous small Linux-capable boards. The little microcontroller board will surely do well in the Pi Foundation’s core markets, but its RP2040 chip must have something special as a commercial component to avoid being simply another take on an ARM microcontroller that happens to be a bit more expensive and from an unproven manufacturer in the world of chips. Perhaps that special something comes in its on-board Programable IO perhipherals, or PIOs. [CNX Software] have taken an in-depth look at them, which makes for interesting reading.

Continue reading “A Look At The Interesting RP2040 Peripheral, Those PIOs” →

This Negative Reinforcement Keyboard May Shock You

January 28, 2021 by 23 Comments

We wouldn’t be where we are today without Mrs. Coldiron’s middle school typing class. Even though she may have wanted to, she never did use negative reinforcement to improve our typing speed or technique. We unruly teenagers might have learned to type a lot faster if those IBM Selectrics had been wired up for discipline like [3DPrintedLife]’s terrifying, tingle-inducing typist trainer keyboard (YouTube, embedded below).

This keyboard uses capsense modules and a neural network to detect whether the user is touch-typing or just hunting and pecking. If you’re doing it wrong, you’ll get a shock from the guts of a prank shock pen every time you peck the T or Y keys. Oh, and just for fun, there’s a 20 V LED bar across the top that is supposed to deter you from looking down at your hands with randomized and blindingly bright strobing light.

Twenty-four of the keys are connected in groups of three by finger usage — for example Q, A, and Z are wired to the same capsense module. These are all wired up to a Raspberry Pi Zero along with the light bar. [3DPrintedLife] was getting a lot of cross-talk between capsense modules, so they solved the problem in software by training a TensorFlow model with a ton of both proper and improper typing data.

We love the little meter on the touchscreen that shows at a glance how you’re doing in the touch typing department. As the meter inches leftward, you know you’re in for a shock. [3DPrintedLife] even built in some games that use pain to promote faster and more accurate typing. Check out the build video after the break, but don’t say we didn’t warn you about the strobing lights.

The secret to the shock pen is a tiny flyback transformer like the kind used in CRT televisions. Find a full-sized flyback transformer and you can build yourself a handheld high-voltage power supply.

Continue reading “This Negative Reinforcement Keyboard May Shock You” →

Controlling A Quadcopter With One Dead Motor

January 28, 2021 by 17 Comments

Quadcopters have incredible flying abilities, but if one loses just a single motor, it drops like a rock. Researchers from the University of Zurich’s Robotics and Perception Group have proven that this does not need to be the case by keeping a quadcopter flying with only three motors.

A quadcopter usually has enough thrust to stay aloft with only three motors, but it will spin uncontrollably in the yaw axis. It is impossible to stop a quadcopter from spinning, so the focus for researchers was on keeping the drone controllable while it’s spinning. To achieve this, accurate position and motion estimation is required, so they attached a pair of cameras to the bottom of the craft for visual-inertial odometry (VIO). One is a normal optical camera, while the other is an event camera, which has pixels that can independently respond to changes in light as they occur. This means that it has better low light performance and does not suffer from motion blur.

The feeds from the cameras are analyzed in real-time by an onboard Nvidia Jetson TX2 for state estimation, which is then used with an optical range sensor and onboard IMU to maintain controlled flight, as demonstrated in the video after the break. The research paper is free to read, and all the code is available on GitHub.

New developments in drone control schemes are always fascinating, like this hexacopter with an innovative motor layout to achieve six degrees of freedom, or a conventional helicopter with a virtual swash plate.
Continue reading “Controlling A Quadcopter With One Dead Motor” →

Randonaut Device Tells You Where To Be And When

January 28, 2021 by 5 Comments

Randonauting is the pastime of using random numbers to generate a destination to visit, in the pursuit of adventure. Of course, anything that can be done on a website with a script is even cooler with custom hardware, so [Decker] built a rig for the job. 

The device uses a USB hardware random number generator to produce truly random numbers through quantum effects; at least, according to our best theories of the universe. These numbers are then used to pick a random set of GPS coordinates and a time in which to be there, a fun twist on traditional Randonauting of [Decker]’s own creation.

At its heart, it’s a random number generator pumped through some Python scripts. Where this build elevates itself is not in the mechanics, but the presentation. The rig runs on a Raspberry Pi, inside a bell jar, with a vacuum fluorsecent display, fairy lights and plumbing components. It plays on the cyberpunk aesthetic, and it’s so much harder to ignore one’s mission when the time and place are given in glowing numerals by an enigmatic, mysterious machine.

It looks like great fun, though beware the dangers of randonauting – some participants have found more then they bargained for. It’s not dissimilar to the old geohashing craze. Video after the break.

Continue reading “Randonaut Device Tells You Where To Be And When” →

A Physical Front Panel For Oscilloscope Software

January 28, 2021 by 19 Comments

For hackers on a tight budget or with limited bench space, a USB oscilloscope can be a compelling alternative to a dedicated piece of hardware. For plenty of hobbyists, it’s a perfectly valid option. But while the larger discussion about the pros and cons of these devices is better left for another day, there’s one thing you’ll definitely miss when the interface for your scope is a piece of software: the feel of physical buttons and knobs.

But what if it doesn’t have to be that way? The ScopeKeypad by [Paul Withers] looks to recreate the feel of a nice bench oscilloscope when using a virtual interface. Is such a device actually necessary? No, of course not. Although one could argue that there’s a certain advantage to the feedback you get when spinning through the detents on a rotary encoder versus dragging a slider on the screen. Think of it like a button box for a flight simulator: sure you can fly the plane with just the keyboard and mouse, but you’re going to have a better time with a more elaborate interface.

The comparison with a flight simulator panel actually goes a bit deeper, since that’s essentially what the ScopeKeypad is. With an STM32 “Blue Pill” microcontroller doing its best impression of a USB Human Interface Device, the panel bangs out the prescribed virtual key presses when the appropriate encoder is spun or button pressed. The project is designed with PicoScope in mind, and even includes a handy key map file you can load right into the program, but it can certainly be used with other software packages. Should you feel so inclined, it could even double as a controller for your virtual spaceship in Kerbal Space Program.

Affordable USB oscilloscopes have come a long way over the years, and these days, using one is hardly the mark of shame it once was. But the look and feel of the classic bench scope is about as timeless as it gets, so we can certainly see the appeal of a project that tries to combine the best of both worlds.

Continue reading “A Physical Front Panel For Oscilloscope Software” →