5G Cellphone’s Location Privacy Broken Before It’s Even Implemented

December 7, 2018 by 52 Comments

Although hard to believe in the age of cheap IMSI-catchers, “subscriber location privacy” is supposed to be protected by mobile phone protocols. The Authentication and Key Agreement (AKA) protocol provides location privacy for 3G, 4G, and 5G connections, and it’s been broken at a basic enough level that three successive generations of a technology have had some of their secrets laid bare in one fell swoop.

When 3G was developed, long ago now, spoofing cell towers was expensive and difficult enough that the phone’s International Mobile Subscriber Identity (IMSI) was transmitted unencrypted. For 5G, a more secure version based on a asymmetric encryption and a challenge-reponse protocol that uses sequential numbers (SQNs) to prevent replay attacks. This hack against the AKA protocol sidesteps the IMSI, which remains encrypted and secure under 5G, and tracks you using the SQN.

The vulnerability exploits the AKA’s use of XOR to learn something about the SQN by repeating a challenge. Since the SQNs increment by one each time you use the phone, the authors can assume that if they see an SQN higher than a previous one by a reasonable number when you re-attach to their rogue cell tower, that it’s the same phone again. Since the SQNs are 48-bit numbers, their guess is very likely to be correct. What’s more, the difference in the SQN will reveal something about your phone usage while you’re away from the evil cell.

A sign of the times, the authors propose that this exploit could be used by repressive governments to track journalists, or by advertisers to better target ads. Which of these two dystopian nightmares is worse is left as comment fodder. Either way, it looks like 5G networks aren’t going to provide the location privacy that they promise.

Via [The Register]

Header image: MOs810 [CC BY-SA 4.0].

Hacking Your Way To A Custom TV Boot Screen

December 7, 2018 by 45 Comments

More and more companies are offering ways for customers to personalize their products, realizing that the increase in production cost will be more than made up for by the additional sales you’ll net by offering a bespoke product. It’s great for us as consumers, but unfortunately we’ve still got a ways to go before this attitude permeates all corners of the industry.

[Keegan Ryan] recently purchased a TV and wanted to replace its stock boot screen logo with something of his own concoction, but sadly the set offered no official way to make this happen. So naturally he decided to crack the thing open and do it the hard way The resulting write-up is a fascinating step by step account of the trials and tribulations that ultimately got him his coveted custom boot screen, and just might be enough to get you to take a screw driver to your own flat panel at home.

The TV [Keegan] brought was from a brand called SCEPTRE, but as a security researcher for NCC Group he thought it would be a fun spin to change the boot splash to say SPECTRE in honor of the infamous x86 microarchitecture attack. Practically speaking it meant just changing around two letters, but [Keegan] would still need to figure out where the image is stored, how it’s stored, and write a modified version to the TV without letting the magic smoke escape. Luckily the TV wasn’t a “smart” model, so he figured there wouldn’t be much in the way of security to keep him from poking around.

He starts by taking the TV apart and studying the main PCB. After identifying the principle components, he deduces where the device’s firmware must be stored: an 8 MB SPI flash chip from Macronix. He connects a logic analyzer up to the chip, and sure enough sees that the first few kilobytes are being read on startup. Confident in his assessment, he uses his hot air rework station to lift the chip off the board so that he can dive into its contents.

With the help of the trusty Bus Pirate, [Keegan] is able to pull the chip’s contents and verify its integrity by reading a few human-readable strings from it. Using the binwalk tool he’s able to identify a JPEG image within the firmware file, and by feeding its offset to dd, pull it out so he can view it. As hoped, it’s the full screen SCEPTRE logo. A few minutes in GIMP, and he’s ready to merge the modified image with the firmware and write it back to the chip.

He boots the TV back up and finds…nothing changed. A check of the datasheet for the SPI flash chip shows there are some protection bits used to prevent modifying particular regions of the chip. So after some modifications to the Bus Pirate script and another write, he boots the TV and hopes for the best. Finally he sees the object of his affection pop up on the big screen, a subtle change that reminds him every time the TV starts about the power of reverse engineering.

A Scratch-Built Forgotten Classic Of The Early PC Age

December 6, 2018 by 36 Comments

All the retrocomputer love for Commodore machines seems to fall on the C64 and Amiga, with a little sprinkling left over for the VIC-20. Those machines were truly wonderful, but what about the Commodore machine that paved their way? What about the machine that was one of the first to be gobbled up in the late 1970s by school districts eager to convert a broom closet into the new “computer lab”?

The PET 2001 might be a little hard to fall in love with given its all-in-one monitor, cassette recorder, and horrible chiclet keyboard, but some still hold a torch for it. [Glen] obviously felt strongly enough about the machine to build a PET from current production parts, and the results are pretty neat. When trying to recreate a 40-year old machine from scratch, some concessions must be made, of course. The case doesn’t attempt to replicate the all-in-one design, and the original keyboard was mercifully replaced by a standard PS/2 keyboard. But other than that the architecture is faithfully replicated using new production 65xx chips and 74HCT family logic chips. [Glen] had to jump through some hoops to get there, but as the video below shows, the finished machine plays a decent game of Space Invaders.

We’ve seen a PET brought back from the grave by FPGA and a C64 emulated on a Raspberry Pi, but going back to basics and building this from scratch was a fitting homage to an important machine in PC history.

Continue reading “A Scratch-Built Forgotten Classic Of The Early PC Age” →

Eyes On The Prize Of Glucose Monitoring

December 6, 2018 by 18 Comments

People with diabetes have to monitor their blood regularly, and this should not be a shock to anyone, but unless you are in the trenches you may not have an appreciation for exactly what that entails and how awful it can be. To give a quick idea, some diabetics risk entering a coma or shock because drawing blood is painful or impractical at the moment. The holy grail of current research is to create a continuous monitor which doesn’t break the skin and can be used at home. Unaided monitoring is also needed to control automatic insulin pumps.

Alphabet, the parent company of Google, gave up where Noviosense, a Netherlands company owned by [Dr. Christopher Wilson], may gain some footing. Instead of contact lenses which can alter the flow of fluids across the eye, Noviosense places their sensor below the lower eyelid. Fluids here flow regardless of emotion or pain, so the readings correspond to the current glucose level. Traditionally, glucose levels are taken through blood or interstitial fluid, aka tissue fluid. Blood readings are the most accurate but the interstitial fluid is solid enough to gauge the need for insulin injection, and the initial trial under the eyelid showed readings on par with the interstitial measurements.

Hackers are not taking diabetes lying down, some are developing their own insulin and others are building an electronic pancreas.

Via IEEE Spectrum.

Spend All Day On The Lake

December 6, 2018 by 23 Comments

Solar vehicles are getting more and more common as the price of solar panels comes down, and the availability of motors and controllers for all of these vehicles rises. Making a solar-electric bike from a kit is one thing, but this solar-powered boat is a master class in hacking at all levels, from the solar drive train to the pontoons, and even the anchor.

[J Mantzel] has many videos about his boat on his channel, and watching them all will likely leave you wanting to build your own. He builds almost everything on his boat from scratch from things he has lying around. For example, the anchor was hand-built from fiberglass and then filled with concrete, and his steering system is a semi-complex system of ropes, pulleys, and shafts. Most of the boat’s shell was hand-built from fiberglass as well, and everything that can be repurposed is saved for later use.

The ten panels, batteries, inverter, and other miscellaneous part of the system were about half of the cost of the whole vessel, but he reports that he also uses the boat as a backup power source for his house, and can use the system to run other things like an electric chainsaw for example. He also uses the boat for camping and construction, and without having to worry about fuel it has been very useful to him.

If you get into the videos on the channel, you’ll find that this isn’t his only solar-powered boat. He recently completed a solar speedboat as well with a custom-built propeller that can really move across the water. His videos are apparently very popular as well, since they have been linked to repeatedly by readers in some of the recent solar vehicle write-ups we’ve published.

Continue reading “Spend All Day On The Lake” →

Fan-Based Parts Tumbler Is A Breeze To Build

December 6, 2018 by 53 Comments

A parts tumbler is a great tool to have around. But if you don’t use it all the time, it’s hard to justify dropping hundreds of dollars on one. Fortunately, there are many ways to make your own tumbler while tailoring it to meet the need. Because really, as long as you get the medium moving enough to abrade the parts, you’re good.

[Daniele]’s parts tumbler is cool because it’s fairly easy to make, it’s really quiet, and it does the job quickly. This tumbler moves the medium by using an imbalanced plastic fan, which [Daniele] created by drilling a hole through one of the blades and fastening a short bolt and nut through it. If you’ve ever tried to stop a washing machine from walking away, you may be thinking this is a strange idea, because now he’s got a 4500 RPM vibration machine scuttling about the shop. So really, the true genius of this build lies in the great pains [Daniele] took to absorb all that vibration.

He’s got the fan float-mounted on rubber-lined springs and rubber mats under the washers involved in connecting the latching plastic box to the fan. Our favorite anti-vibration features are the twist-lock power connector and the custom silicone feet made from Motorsil D and cap bolts. We don’t know what the medium is here, but it’s got us thinking Grape-Nuts might work. Blow past the break to chew on the build video.

The only problem with this build is that this type of fan isn’t cheap, and using it this way will definitely shorten its life.

Not a fan of this type of tumbling? Here’s one that takes your drill for a spin.

Continue reading “Fan-Based Parts Tumbler Is A Breeze To Build” →

Mechanizing A Eurorack Sequencer

December 6, 2018 by 3 Comments

Eurorack has taken over the synthesizer community, and hundreds of people are building their own eurorack modules. [Michael Forrest] designed and built his own Eurorack sequencer module that doesn’t use weird things like capacitors and chips to store a signal. Instead, he’s doing it with stepper motors and some clever engineering.

The basic idea of a Eurorack sequencer is to somehow store a series of values and play them back repeatedly. Connect that sequence to a clock, and you get the same pattern of sounds out of your synth. This can be done digitally with a circular buffer, in the analog domain with a bunch of FETs and caps, or in this case, on a piece of paper glued to a stepper motor.

The key bit of mechanism for this build is a stepper motor with 96 steps per rotation. This is important, because the module is controlled by a clock pulse from the sequencer. Since 96 is evenly divisible by 8 and 16, that means this sequencer will play back in 4/4 time. That NEMA 17 motor with 200 steps per resolution simply won’t work in this situation. Rather, it will technically work, but it’ll be unusable.

The electronics for this build are surprisingly simple, with an Arduino taking in the clock pulse and sending the step signals to an H-driver. The motor spins a paper disk, which is read with a photoresistor and a LED. It’s simple enough to be fun, and yes, it is mounted to a proper Eurorack-sized panel. You can check out the video of this build below.

Continue reading “Mechanizing A Eurorack Sequencer” →