This Week In Security: UTorrent Vulnerable, Crowd-Sourcing Your Fail2Ban, And Cryptographers At Casinos

September 25, 2020 by Jonathan Bennett 22 Comments

The uTorrent client was recently updated to fix a null pointer dereference (CVE-2020-8437), discovered by [whtaguy]. Triggering the dereference simply crashes the client — so far an actual RCE hasn’t been found. Given the nature of the null pointer dereference, it’s possible this bug is limited to denial of service. That’s extremely good, because the flaw is extremely easy to target.

BitTorrent is a clever protocol. It’s still used to distribute large files, like Linux ISOs. The concept is simple: Split a large file into small chunks. Send the chunks to a client one at a time. As each chunk is received, the client sends a copy of that chunk to the next client. As a result of this peer-to-peer (p2p) arrangement, the bandwidth available to the server is greatly multiplied. As with all other p2p arrangements, the sticking point is how to make those connections between peers, particularly when most of the world’s desktops are behind NAT routers. In practice, for two peers to share data, at least one of them has to have a port opened or forwarded to the client. This is often accomplished through Universal Plug-n-Play (UPnP) or the NAT Port Mapping Protocol (NAT-PMP). The idea of both protocols are the same; a client on an internal device can request a temporary port forward without manual intervention. Whether it’s a good idea to allow automatic port forwards is another issue for another day. Continue reading “This Week In Security: UTorrent Vulnerable, Crowd-Sourcing Your Fail2Ban, And Cryptographers At Casinos” →

Hacking A Cheap Action Cam Into A Dashcam With A Microcontroller

September 25, 2020 by Danie Conradie 15 Comments

Repurposing commodity electronics is one of the true forms of hacking, and it’s always the simple little hacks that lead to big ones. [Everett] wanted to use a $20 GoPro clone as a dash cam, so he wired a microcontroller into it to automate some actions and make it practical.

The camera turns on automatically when connected to external power like a car charger, but starting and stopping a recording and power down all had to be done manually. [Everett] wanted to automate these functions, so he opened up the camera and started probing with an oscilloscope. He found the power button, record button, 3.3 V and external 5 V traces conveniently next to each other in the top of the camera.

To automate the required functions, he wired in a PIC10 on a small breakout board, powered by the 3.3 V line. It detects if 5 V is connected to the charging port on start-up via an N-channel FET, then automatically starts a recording. When the 5 V power is switched off with the car, it waits 10 seconds before stopping the recording and switching off the camera. If no external 5 V is not detected on start-up the microcontroller does nothing, which allows the camera to be used as a normal handheld. [Everett] mounted the camera to his rearview mirror with a magnetic bracket made using a combination of a 3D printer and 3D pen.

This is a simple and practical little hack, and the firmware is available on Github. Cheap dashcams are available for similar prices, but you won’t get any hacking satisfaction that way.

The very nature of actions cameras inspire hacking. You can simply add an external battery with the help of a 3D printer, or go all out and build a gimballed helmet cam from scratch

Adding WiFi To The Acorn Electron

September 25, 2020 by Maya Posch 9 Comments

In the continuing quest by countless hobbyists to allow every 1980s 8-bit home computer to experience the joys of an online experience that doesn’t involve a 9600 baud modem, [Roland Leurs] has created a cartridge-based module for the Acorn Electron that adds WiFi, which he showed off at the virtual ABug conference in September 2020.

The Acorn Electron is a Synertek 6502-based computer that was released in the UK in August of 1983. It’s a budget version of the well-known BBC Micro educational/home computer, with 32 kB of RAM and featuring BBC BASIC v2 in its ROM. [Roland]’s ElkWiFi card slots into an available cartridge slot, after which the onboard ESP8266 (ESP-1 module) can be enabled and used as a WiFi modem.

Acorn Electron with Plus 1 expansion, ElkWiFi and additional expansion card inserted.

The board features the Exar ST16C2552CJ dual UART chip, one channel of which connects to the ESP-1 module, with the other channel used as an uncommitted UART header. The control logic is implemented in VHDL and flashed to the onboard Xilinx CPLD, and a 128 kB RAM module is used as WiFi data buffer.

Although a definite niche product, reading through the forum thread makes one really appreciate the technical complexity and joy once things are beginning to work reliably. It also shows one of the few cases where an ESP-1 module is used for its original purpose: as an easy way to add WiFi functionality with full WiFi and TCP stack, without burdening the main CPU.

(Thanks, BaldPower)

DIY Grout Cleaning Machine Does A Good Job

September 24, 2020 by Lewin Day 26 Comments

Cleaning tiled floors can be a drag. Getting the tiles themselves clean is bad enough, but often dealing with the grouted joints in between requires more elbow grease and attention to detail. It’s a tedious chore, and thus one ripe for improvement. [Elite Worm]’s cleaning machine is an excellent solution to the problem.

The machine is built entirely from scratch, using primarily 3D printed components. A fluid tank is fitted to the chassis, along with a custom 3D-printed pump run by a DC motor, to deliver cleaning product where its needed. A large DC motor is then used to spin a nylon brush which gets deep in the tile grooves to clean out the grime. The chassis is then fitted with rollers to allow it to glide along the floor. Finally, a handle is fitted which allows the user to push the tool along, with switches to turn on the spinning brush and dispense cleaning fluid.

It’s a great tool, and one which eliminates hours of scrubbing on hands and knees. We’re sure the time investment in the build will pay off before long. We’ve seen other tricky cleaning hacks before, too. Video after the break.

Continue reading “DIY Grout Cleaning Machine Does A Good Job” →

Robotic Worm Uses NinjaFlex Filament

September 24, 2020 by Al Williams 8 Comments

If you think about building a moving machine, you probably will consider wheels or tracks or maybe even a prop to take you airborne. When [nwlauer] found an earthworm in the garden, it inspired a 3D-printed robot that employs peristaltic motion. You can see a video of it moving, below.

The robot uses pneumatics and soft plastic, and is apparently waterproof. Your printer’s feed path has to be pretty rigid to support flexible filament without jamming. There’s also some PVA filament and silicone tubing involved.

Continue reading “Robotic Worm Uses NinjaFlex Filament” →

Plaster Annealing 3D Prints For Strength

September 24, 2020 by Al Williams 29 Comments

[Stefan] is always trying to make stronger 3D prints. Annealing can strengthen prints, but often at the expense of the part’s exact dimensions. His latest approach is to embed the prints in plaster and then anneal in an attempt to fuse the plastic together without changing its shape or size. Did it work? See for yourself in the video below.

He’s done a lot of work we’ve taken note of before where he measures the strength of parts after different post-processing steps. His test plastic parts used both PLA and PETG.

Continue reading “Plaster Annealing 3D Prints For Strength” →