One of the core features of the scientific community is the concept of “peer review” where any claims made by a scientist are open to be analyzed and reproduced by others in the community for independent verification. This leads to either rejection of ideas which can’t be reproduced, or strengthening of those ideas when they are. In this community we typically only feature the first step of this process, the original projects from various builders, but we don’t often see someone taking those instructions and “peer reviewing” someone’s build. This is one of those rare cases.
[oxullo] came across [Leo]’s original build for the ultimate continuity tester. This design is much more sensitive than the function which is built in to most multi-meters, and when building this tool specifically some other refinements can be built in as well. [oxullo] began by starting with the original designs, but made several small modifications. Most of these were changing to surface-mount parts, and switching some components for ones already available. Even then, there was still a mistake in the PCB which was eventually corrected. The case for this build is also 3D printed instead of being made out of metal, and with the original video to work from the rest fell into place easily.
[oxullo] is getting comparable results with this continuity tester, so we can officially say that this design is peer reviewed and tested to the highest of standards. If you’re in need of a more sensitive continuity sensor, or just don’t want to shell out for a Fluke meter when you don’t need the rest of its capabilities, this is the way to go. And don’t forget to check out our original write-up for this tester if you missed it the first time around.
In a perfect world, all of our electronic devices would come with complete documentation, and there’d be open source libraries available for interfacing them with whatever we wanted. There’d never be arbitrary lockouts preventing us from using a piece of hardware in a way the manufacturer didn’t approve of, and the “cloud” wouldn’t be a black-box server in some data center on the other side of the planet, but a transparent and flexible infrastructure for securely storing and sharing information.
Unfortunately, that’s not the world we live in. What’s worse, rather than moving towards that electronic utopia, the industry appears to be heading in the opposite direction. It seems like every month we hear about another service shutting down and leaving viable hardware to twist in the wind. Just yesterday Google announced they’d be retiring their Stadia game streaming service early next year — leaving users with unique Internet-connected controllers that will no longer have a back-end to communicate with.
Matthew Alt
Luckily for us, there’s folks like Matthew [wrongbaud] Alt out there. This prolific hacker specializes in reverse engineering, and has a knack not just for figuring out how things work, but in communicating those findings with others. His conquests have graced these pages many times, and we were fortunate enough to have him helm the Introduction to Reverse Engineering with Ghidra class for HackadayU back in 2020. This week, he stopped by the Hack Chat to talk about the past, present, and future of reverse engineering.
Matthew got his start in reverse engineering during college, when he was working in a shop that specialized in tuning engine control units (ECUs). He was responsible for figuring out how the ECUs functioned, which ultimately would allow them to be modified to improve engine performance beyond the vehicle’s stock configuration. Sometimes that involved uploading modified calibration data, or disabling functions that were detrimental to engine performance. These software changes could potentially increase engine output by as much as 50 HP, though he says that sometimes the goal was to simply increase throttle response so the vehicle would feel more aggressive on the road.
Moving on to the tools of the trade, Matthew explained why he prefers using Ghidra for embedded targets over classic reverse engineering tools like IDA Pro. As an example he points to a recent project where he used Ghidra’s API and intermediary language PCode to crack passwords in Game Boy Advance games. Though he does mention that IDA still has its place if you’re looking to peek into some Windows C++ software.
Matthew also pointed to new techniques and tools for working with fault injection which have opened up a lot of exciting possibilities over the last few years. In fact, he says tools like ChipWhisperer will become invaluable as newer devices adopt advanced security features. When gadgets are using secure boot and encrypted firmware, gaining access is going to take a bit more than just finding an unleaded serial port on the board. Glitching attacks will become more commonplace, so you might as well get up to speed now.
Colin O’Flynn’s ChipWhisperer makes side-channel power analysis and glitching attacks far more accessible.
We’d like to thank Matthew Alt for not just stopping by the Hack Chat, but for being such a good friend to the Hackaday community. His work has been inspirational for all of us here, and it’s always exciting when he’s penned a new blog post detailing another challenge bested. The next time your favorite MegaCorp releases some anti-consumer gadget, you can take some comfort in knowing he’s still out there bending hardware to his will.
The Hack Chat is a weekly online chat session hosted by leading experts from all corners of the hardware hacking universe. It’s a great way for hackers connect in a fun and informal way, but if you can’t make it live, these overview posts as well as the transcripts posted to Hackaday.io make sure you don’t miss out.
This week, Editor-in-Chief Elliot Williams and Assignments Editor Kristina Panos gushed about NASA’s live obliteration of minor planet Dimorphos using a probe outfitted with a camera. Spoiler alert: the probe reaches its rock-dappled rocky target just fine, and the final transmitted image has a decidedly human tinge.
Kristina brought the mystery sound again this week, much to Elliot’s sonic delight. Did he get it? Did he figure it out? Well, no. The important thing is one of you is bound to get it.
We kick off the hacks with a really neat 3D printed linkage that acts as an elevator for a marble run, and then we discuss a mid-century hack that helps you decide whether it’s time to emerge from the fallout shelter using the contents of your typical 1950s pockets. We spent a few minutes comparing our recent radiation exposure levels — Kristina wins with about a dozen x-rays so far this year, but no full-body CT scans. Then we talk guitars for a bit, remember a forgotten CPU from TI, and spend a few cycles talking about a tone-wheel organ that sounds like a chorus of gleeful gerbils.
Finally, we talk toner transfer for 3D prints, argue in defense of small teams versus large committees, and get all tangled up in cursive.
In college I had an exceptional piano teacher that was entirely blind. One day he noticed I had brought in my new-ish laptop, and his unexpected request — “can I look at your laptop?” — temporarily flabbergasted me. Naturally there wasn’t much he could do with it, so he gave it a once over with his fingers to understand the keyboard layout, and that was that. I still think about this experience from time to time, and the most obvious lesson is that my paradigm for using a computer didn’t map well to his abilities and disability.
The folks at Microsoft are thinking about this problem, too, and they’re doing a lot of work to make technology work for more users, like the excellent Xbox Adaptive Controller pictured above. Now, if you have some experience helping folks overcome the challenges of disability, or have a killer idea for an assistive technology solution, Microsoft is looking for projects to fund. Did you rig up a Raspberry Pi and webcam to automatically read text aloud? Maybe you pulled that old Kinect out, and are working on sign-language reader using 3D data points.
Make a pitch of your project or solid idea by the November 4th deadline, and just maybe you can get some help to make it a reality. Just make sure you come back and tell us about it! After all, some of the coolest hacks we’ve ever covered have been adaptive tech projects.
Thanks to [MauroPichiliani] for sending in this tip.
According to researchers at GTSC, there’s an unpatched 0-day being used in-the-wild to exploit fully patched Microsoft Exchange servers. When they found one compromised server, they made the report to Microsoft through ZDI, but upon finding multiple Exchange servers compromised, they’re sounding the alarm for everyone. It looks like it’s an attack similar to ProxyShell, in that it uses the auto-discover endpoint as a starting point. They suspect it’s a Chinese group that’s using the exploit, based on some of the indicators found in the webshell that gets installed.
There is a temporary mitigation, adding a URL-based request block on the string .*autodiscover\.json.*\@.*Powershell.. The exact details are available in the post. If you’re running Exchange with IIS, this should probably get added to your system right now. Next, use either the automated tool, or run the PowerShell one-liner to detect compromise: Get-ChildItem -Recurse -Path -Filter "*.log" | Select-String -Pattern 'powershell.*autodiscover\.json.*\@.*200. This one has the potential to be another really nasty problem, and may be wormable. As of the time of writing, this is an outstanding, unpatched problem in Microsoft Exchange. Come back and finish the rest of this article after you’ve safed up your systems.
Dangerous machines, like ones that can quickly reduce you to a fine red mist or a smoking cinder, tend to have a Big Red Button™ to immediately stop whatever the threat is. Well, if a more dangerous machine than social media has ever been invented, we’re not sure what it would be, which is why we’re glad this social media kill switch exists.
The idea behind [Gunter Froman]’s creation is to provide a physical interface to SocialsDetox, a service that blocks or throttles connectivity to certain apps and websites. SocialDetox blocks access using either DNS over HTTPS (DoH) or, for particularly pesky and addictive apps, a service-specific VPN. The service does require a subscription, the cost of which varies by the number of devices you want to protect, but the charges honestly seem pretty reasonable.
While SocialsDetox can be set up to block access on a regular schedule, say if you want to make the family dinner a social-free time, there may be occasions where killing social access needs to happen right now. This is where the Big Red Button comes into it, which is attached to a Wemos D1 Mini. Pressing the kill switch sends an API request to either enable or disable the service, giving you a likely much-needed break from the swirling vortex of hate and envy that we all can’t seem to live without. Except for Hackaday, of course — it’s totally not like that here.
The irony of using an IoT appliance to restrict access to social media is not lost on us, but you work with the tools you’ve got. And besides, we like the physical interface here, which sort of reminds us this fitting enclosure for a PiHole.
If you’ve ever eyed up a kids laptop and wondered whether it could take an upgrade with a single board computer, you’re not alone. [Labz] have taken a couple of Brazilian Max Steel toy computers from a decade or more ago, and made them into usable if unconventional portable computers (Brazilian Portuguese, but YouTube’s subtitle translation is your friend).
The computers are similar to the ones you may be familiar with from the likes of VTech, a QWERTY keyboard and fairly conventional form factor but with a tiny monochrome LCD and a few built-in games. In the video below the break we see both the laptop and desktop variants butchered with a rotary tool to receive new larger screens, with the laptop getting a Raspberry Pi and the desktop getting a small form factor PC. The laptop needed a 3D printed extension to make extra space, while the desktop received a PCI Express extension cable for a video card. Finally, an Arduino took care of the keyboard.
