Chataigne: An Open-Source Swiss Army Knife

January 6, 2023 by Dave Rowntree 47 Comments

[Ben Kuper] is a developer with a history of working on art installations, and had hit upon a common problem often cited by artists. When creating installations involving light, sound, and motion, they often spend too much time on the nuts and bolts of electronics, programming, and so on. Such matters are a huge time sink with a steep learning curve and oftentimes just a plain distraction from the actual artistic intent they’re trying to focus upon. [Ben] has been working for a few years on a software tool, Chataigne which is designed as the glue between various software tools and hardware interfaces, enabling complex control of the application using simple building blocks. Continue reading “Chataigne: An Open-Source Swiss Army Knife” →

All About USB-C: Resistors And Emarkers

January 4, 2023 by Arya Voronova 16 Comments

If you’ve been following along our USB-C saga, you know that the CC wire in the USB-C cables is used for communications and polarity detection. However, what’s not as widely known is that there are two protocols used in USB-C for communications – an analog one and a digital one. Today, let’s look at the analog signalling used in USB-C – in part, learn more about the fabled 5.1 kΩ resistors and how they work. We’ll also learn about emarkers and the mysterious entity that is VCONN!

USB-C power supply expects to sense a certain value pulldown on the CC line before it provides 5 V on VBUS, and any higher voltages have to be negotiated digitally. The PSU, be it your laptop’s port or a charger, can detect the pulldown (known as Rd) because it keeps a pullup (known as Rp) on the CC line – it then checks if a voltage divider has formed on CC, and whether the resulting voltage is within acceptable range.

If you plug a device that doesn’t make a pulldown accessible through the CC wire in the cable, your device will never get power from a USB-C port, and would only work with a USB-A to USB-C cable. Even the smarter devices that can talk the digital part of USB-C are expected to have pulldowns, it’s just that those pulldowns are internal to the USB-C communication IC used. A USB-C port that wants to receive power needs to have a pulldown.

This part is well-known by now, but we’ve seen lack-of-resistor failures in cheap devices aplenty, and the colloquial advice is “add 5.1 kΩ resistors”. You might be afraid to think it’s so simple, but you’d be surprised. Continue reading “All About USB-C: Resistors And Emarkers” →

This Week In Security: Adblock For Security, ProxyNotShell Lives, And CVSS 10 To Not Worry About

December 30, 2022 by Jonathan Bennett 14 Comments

The ubiquity of ransomware continues, this time with The Guardian announcing they were partially shut down from an attack. Staff are working from home as the incident is being investigated and data is recovered. Publishing seems to be continuing, and the print paper ran as expected.

There have been a couple reports published recently on how ransomware and other malware is distributed, the first being a public service announcement from the FBI, detailing what might be a blindly obvious attack vector — search engine advertising. A bad actor picks a company or common search term, pays for placement on a search engine, and then builds a fake web site that looks legitimate. For bonus points, this uses a typosquatted domain, like adobe[dot]cm or a punycode domain that looks even closer to the real thing.

The FBI has a trio of recommendations, one of which I whole-heartedly agree with. Their first suggestion is to inspect links before clicking them, which is great, except for the punycode attack. In fact, there are enough lookalike glyphs to make this essentially useless. Second is to type in URLs directly rather than using a search engine to find a company’s site. This is great so long as you know the URL and don’t make a typo. But honestly, haven’t we all accidentally ended up at website[dot]co by doing this? Their last recommendation is the good one, and that is to run a high-quality ad-blocker for security. Just remember to selectively disable blocking for websites you want to support. (Like Hackaday!) Continue reading “This Week In Security: Adblock For Security, ProxyNotShell Lives, And CVSS 10 To Not Worry About” →

An exercise bike modified to become a game controller

Pedal Your Way Through Games With This USB Exercise Bike

December 26, 2022 by Robin Kearey 12 Comments

If you’re into cycling, there’s nothing better than heading out on the open road and feeling the wind in your hair. Unfortunately, climatic conditions make this uncomfortable or impossible at certain times of year, so you might be tempted to stay inside and play video games instead. Luckily, you can now get your gaming fix and still get in shape thanks to [Patrick]’s exercise bike game controller.

[Patrick] got himself a second-hand exercise bike and discovered that the speed sensor inside it was based on a magnet and reed relay, just like a regular bike computer. Reading out the sensor was therefore as simple as counting pulses using an Arduino Leonardo, and the USB HID protocol made it easy to turn the cycling mechanism into a one-dimensional game controller.

He then completed the setup by adding two 3D-printed handlebar-mounted gamepads with a few buttons and a thumbstick on each side. The total system now works as an ordinary gamepad, but with the option of using the bike as a forward/backward control.

We can imagine that this system will stay interesting for far longer than any off-the-shelf internet-connected exercise bike, because you can interface it with basically any game. [Patrick] demos his rig using first-person shooters like Doom and Team Fortress 2, but the possibilities are endless: how about turning FIFA games into bike polo? Or Mirror’s Edge into a bicycle courier adventure? After all, we’ve already seen how a similar game controller can turn Grand Theft Auto into something more like Grand Theft Bicycle.

Continue reading “Pedal Your Way Through Games With This USB Exercise Bike” →

Encoding NTSC With Your Hands Tied

December 25, 2022 by Matthew Carlson 10 Comments

Generally, when trying to implement some protocol, you are constrained by your hardware and time. But for someone like [EMMIR], that’s not enough. For example, NTSC-CRT is a video signal encoding/decoding simulator with no hardware acceleration, floating point math, or third-party libraries. Just basic C.

While NTSC has officially gone dark in America, people still make their own ATTiny-powered transmitters. NTSC is a bit of a strange standard and is sometimes referred to as never-twice-the-same color, but it does produce a distinct look.

That look is what [EMMIR] was going for. It encodes a message in a ppm format into NTSC and then back in ppm with some configurable noise. It can do this in real-time as an effect in [EMMIR’s] engine or on a rendered image via a CLI. It looks incredible, and there’s something very satisfying. There’s a video after the break showing off the effect. The code is pretty short and easy to read.

Continue reading “Encoding NTSC With Your Hands Tied” →

Two hands holding a 3d printed alarm clock with an LCD display, snooze button and knob on top

IO Connected Radio Alarm Clock

December 19, 2022 by Abe Connelly 3 Comments

[CoreWeaver] creates an alarm clock that includes features one might expect in such a project, including an FM radio, snooze button inputs and a display, but goes beyond the basic functionality to include temperature sensing and a PC connection, opening the way for customizable functionality.

An Atmega328 is used for the main microcontroller which communicates via I2C both to a DS1307 real time clock (RTC) and a TEA5767 FM module. The main power comes from a 9V power source with an LM317 and LM7805 linear regulators providing a 3.3V and 5V power rail, respectively. Most of the electronics are powered using 5V except for the TEA5767, which is powered from the 3.3V rail and has its I2C communication levels shifted from 5V to 3.3V. The audio output of the TEA5767 feeds directly into the TDA7052 audio amplifier to drive the speakers. Since the RTC has an auxiliary coin cell battery for power, the alarm clock can keep accurate time even when not plugged in. Continue reading “IO Connected Radio Alarm Clock” →

This Week In Security: Scamming The FBI, In The Wild, And AI Security

December 16, 2022 by Jonathan Bennett 16 Comments

If you’re part of a government alphabet agency, particularly running a program to share information to fight cybercrime, make sure to properly verify the identity of new members before admission. Oh, and make sure the API is rate-limited so a malicious member can’t scrape the entire user database and sell it on a dark web forum.

Putting snark aside, this is exactly what has happened to the FBI’s InfraGuard program. A clever user applied to the program using a CEO’s name and phone number, and a convincing-looking email address. The program administrators didn’t do much due diligence, and approved the application. Awkward.

BSD Ping

First off, the good folks at FreeBSD have published some errata about the ping problem we talked about last week. First off, note that while ping does elevate to root privileges via setuid, those privileges are dropped before any data handling occurs. And ping on FreeBSD runs inside a Capsicum sandbox, a huge obstacle to system compromise from within ping. And finally, further examination of the bug in a real-world context casts doubt on the idea that Remote Code Execution (RCE) is actually possible due to stack layouts.

If someone messes up somewhere, go look if you messed up in the same or similar way somewhere else.

Sage advice from [Florian Obser], OpenBSD developer. So seeing the ping problem in FreeBSD, he set about checking the OpenBSD ping implementation for identical or similar problems. The vulnerable code isn’t shared between the versions, so he reached for afl++, a fuzzing tool with an impressive list of finds. Connect afl++ to the function in ping that handles incoming data, and see what shakes out. The conclusion? No crashes found in this particular effort, but several hangs were identified and fixed. And that is a win. Continue reading “This Week In Security: Scamming The FBI, In The Wild, And AI Security” →