This Week In Security: REvil Goes Dark, Kaseya Cleanup, Android Updates, And Terrible Firmware

The funniest thing happened to REvil this week. Their online presence seems to have disappeared.
Their Tor sites as well as conventional sites all went down about the same time Tuesday morning, leading to speculation that they may have been hit by a law enforcement operation. This comes on the heels of a renewed push by the US for other countries, notably Russia, to crack down on ransomware groups operating within their borders. If it is a coordinated takedown, it’s likely a response to the extremely widespread 4th of July campaign launched via the Kaseya platform. Seriously, if you’re going to do something that risks ticking off Americans, don’t do it on the day we’re celebrating national pride by blowing stuff up.

Speaking of Kaseya, they have finished their analysis, and published a guide for safely powering on their VSA on-premise hardware. Now that the fixes are available, more information about the attack itself is being released. Truesec researchers have been following this story in real time, and even provided information about the attack back to Kaseya, based on their observations. Their analysis shows that 4 separate vulnerabilities were involved in the attack. First up is an authentication bypass. It takes advantage of code that looks something like this: Continue reading “This Week In Security: REvil Goes Dark, Kaseya Cleanup, Android Updates, And Terrible Firmware”

A Phone That Old Shouldn’t Be Running Android

Cars and smartphones have something curious in common, just as most everyday saloon cars from different manufacturers have tended towards similarity, so have smartphones. Whether your smartphone the latest and greatest or only cost you $50 from a supermarket, it matters little to look at because both phones will be superficially near-identical black slabs.

It wasn’t always this way though, in decades past phones from different manufacturers each had their own flavours, and there was a variety in form factors to suit all tastes. There’s a ray of hope for fans of those days though, in the form of [befinitiv]’s 2000-era Sony flip phone. It runs Android. Yes, you read that right, there on the tiny screen is Android 9.

Of course whatever processor and electronics the phone came with are long gone, and instead the phone sports the internals of a modern Chinese watch-smartphone grafted in in place of the original. The whole electronics package fits in the screen opening, and though it required some wiring for the USB-C socket and a few other parts it looks for all the world from the outside as though it was meant to run Android. You can take a look in the video below the break.

He cheerfully admits that there’s still a way to go for example in getting the original keyboard working, but even with a tiny touchscreen it’s good enough to be a daily driver. It may be a little on the small side, but for those of us who miss our old phones maybe there’s hope in it for something new.

Meanwhile this isn’t the first re-use of an old phone we’ve seen recently.

Continue reading “A Phone That Old Shouldn’t Be Running Android”

Make Android’s New Power Menu Work On Your Terms

Introduced in Android 11, the power menu is a way to quickly interact with smart home gadgets without having to open their corresponding applications. Just hold the power button for a beat, and you’ll be presented with an array of interactive tiles for all the gadgets you own. Well that’s the idea, anyway.

[Mat] of “NotEnoughTech” wasn’t exactly thrilled with how this system worked out of the box, so he decided to figure out how he could create his own power menu tiles. His method naturally requires quite a bit more manual work than Google’s automatic solution, but it also offers some compelling advantages. For one thing, you can make tiles for your own DIY devices that wouldn’t be supported otherwise. It also allows you to sidestep the cloud infrastructure normally required by commercial home automation products. After all, does some server halfway across the planet really need to be consulted every time you want to turn on the kitchen light?

Adding tiles in Tasker.

The first piece of the puzzle is Tasker, a popular automation framework for Android. It allows you to create custom tiles that will show up on Android’s power menu, complete with their own icons and brief descriptions. If you just wanted to perform tasks on the local device itself, this would be the end of the story. But assuming that you want to control devices on your network, Tasker can be configured to fire off a command to a Node-RED instance when you interact with the tiles.

In his post, [Mat] gives a few examples of how this combination can be used to control smart devices and retrieve sensor data, but the exact implementation will depend on what you’re trying to do. If you need a bit of help getting started, our own [Mike Szczys] put together a Node-RED primer last year that can help you put this flow-based visual programming tool to work for you.

Continue reading “Make Android’s New Power Menu Work On Your Terms”

Soundbar Bested By Virtual Android Bluetooth Sniffer

Out of the box, the Yamaha YAS-207 soundbar can be remotely controlled over Bluetooth, but only when using a dedicated application on iOS or Android. Users who want to command their hardware with their computer, or any other Bluetooth device for that matter, are left out in the cold. Or at least they were, before [Wejn] got on the case.

To capture the communication between the soundbar and the application, [Wejn] first installed Android-x86 in a virtual machine on his computer and then enabled the “Bluetooth HCI snoop log” within Developer Settings. From there, a netcat command running on the virtual Android device continually sent the contents of the btsnoop_hci.log file out to Wireshark on his Linux desktop. As he hit buttons in the Yamaha application, he could watch the data come in live. We’ve seen plenty of people use Android’s integrated Bluetooth packet capture in the past, but never quite like this. It’s certainly a tip worth mentally filing away for the future.

The Pi can now control the TOSLINK connected speakers.

From there, things move pretty quickly. [Wejn] is able to determine that the devices are communicating over a virtual serial port, and starts identifying individual command and response packets. It turns out the commands closely mirror the NEC IR codes that he’d previously decoded on a whim, which helped clear things up. Once the checksum was sorted out, writing some code that can talk to the soundbar from his Raspberry Pi media player was the next logical step.

[Wejn] combined this with the Shairport Sync project, which lets the Raspberry Pi turn on the speaker and switch the input over when he wants to stream AirPlay from his phone. But of course, the same technique could be applied to whatever source of digital audio captures your fancy.

This is one of those posts you should really read in its entirety to truly appreciate. While every device is going to be different, the basic principles and workflow that [Wejn] demonstrates in this project will absolutely be useful in your own reverse engineering adventures. If you’re more of a visual learner, we recently covered a series of YouTube tutorials that cover sniffing BLE devices that’s not to be missed as well.

Hackaday Podcast 105: 486 Doom On FPGA, How Thick Is Your Filament, Raspberry Pi Speaks Android Auto, And We’re Headed To Mars

Hackaday editors Mike Szczys and Elliot Williams unpack great hacks of the past week. We loves seeing the TIL311 — a retro display in a DIP package — exquisitely recreated with SMD electronics and resin casting. You might never need to continuously measure the diameter of your 3D printer filament, but just in case there’s a clever hall-effect sensor mechanism for that. Both of us admire the work being done in the FPGA realm and this week we saw a RISC-V core plumbed into quite the FPGA stack to run a version of Doom originally played on 486 computers. And we’re getting excited for the three ring circus of engineering acrobatics that will land NASA’s Perseverance rover on the surface of Mars next week.

Take a look at the links below if you want to follow along, and as always, tell us what you think about this episode in the comments!

Direct download (~60 MB)

Places to follow Hackaday podcasts:

Continue reading “Hackaday Podcast 105: 486 Doom On FPGA, How Thick Is Your Filament, Raspberry Pi Speaks Android Auto, And We’re Headed To Mars”

Android 10 Ported To The Nintendo Switch

Nintendo’s Switch is perhaps most famous for blurring the lines between handheld consoles and those you plug into a TV. However, the tablet-esque device can also run Android if you’re so inclined, and it recently got an upgrade to version 10.

It’s an upgrade that brings many new features to the table, most of which you might consider must haves for regular use. The newer port brings support for USB Power Delivery, as well as deep sleep modes that enable the unit’s battery to last for several weeks. There’s also support for over-the-air updates which should ease ongoing maintenance, and improvements for Bluetooth compatibility and the touch screen as well.

Like most console hacks to run custom code, you’ve got to have the right hardware version with the right firmware, as Nintendo have been regularly iterating to try and lock out hacks where possible. The install has a few hurdles to jump through, but nothing too strenuous that would scare away the average Hackaday reader. Just be sure to not attempt this on a cherished console, as there’s always the chance that it all ends in tears. If you pull it off, you can then go about turning your Nintendo Switch into a networking switch. Net…tendo… Switch? Come up with a better pun in the comments. Continue reading “Android 10 Ported To The Nintendo Switch”

Do Androids Search For Cosmic Rays?

We always like citizen science projects, so we were very interested in DECO, the Distributed Electronic Cosmic-ray Observatory. That sounds like a physical location, but it is actually a network of cell phones that can detect cosmic rays using an ordinary Android phone’s camera sensor.

There may be some privacy concerns as the phone camera will take a picture and upload it every so often, and it probably also taxes the battery a bit. However, if you really want to do citizen science, maybe dedicate an old phone, put electrical tape over the lens and keep it plugged in. In fact, they encourage you to cover the lens to reduce background light and keep the phone plugged in.

Continue reading “Do Androids Search For Cosmic Rays?”