Beyond The Basics: Exploring More Exotic Scope Trigger Modes

December 27, 2023 by 2 Comments

Last time, we looked at some powerful trigger modes found on many modern scopes, including the Rigol DHO900 series we used as an example. Those triggers were mostly digital or, at least, threshold-based. This time, we’ll look at some more advanced analog triggers as well as a powerful digital trigger that can catch setup and hold violations. You can find the Raspberry Pi code to create the test waveforms online.

In addition to software, you’ll need to add some simple components to generate the analog waveform. In particular, pin 21 of the Pi connects to  2uF capacitor through a 10K resistor. The other side of the capacitor connects to ground. In addition, pin 22 connects directly to the capacitor, bypassing the 10K resistor. This allows us to discharge the capacitor quickly. The exact values are not especially important.

Runt Triggers

A runt pulse is one that doesn’t have the same voltage magnitude as surrounding pulses. Sometimes, this is due to a bus contention, for example. Imagine if you have some square waves that go from 0 to 5V. But, every so often, one pulse doesn’t make it to 5V. Instead, it stops at 3V.

Continue reading “Beyond The Basics: Exploring More Exotic Scope Trigger Modes” →

This Week In Security: Owncloud, NXP, 0-Days, And Fingerprints

December 1, 2023 by 18 Comments

We’re back! And while the column took a week off for Thanksgiving, the security world didn’t. The most pressing news is an issue in Owncloud, that is already under active exploitation.

The problem is a library that can be convinced to call phpinfo() and include the results in the page response. That function reveals a lot of information about the system Owncloud is running on, including environment variables. In something like a Docker deployment, those environment variables may contain system secrets like admin username and password among others.

Now, there is a bit of a wrinkle here. There is a public exploit, and according to research done by Greynoise Labs, that exploit does not actually work against default installs. This seems to describe the active exploitation attempts, but the researcher that originally found the issue has stated that there is a non-public exploit that does work on default installs. Stay tuned for this other shoe to drop, and update your Owncloud installs if you have them. Continue reading “This Week In Security: Owncloud, NXP, 0-Days, And Fingerprints” →

2023 Halloween Hackfest: This Year’s Spooky Winners

November 20, 2023 by 1 Comment

With the zombies, ghouls, and ghosts now safely returned to their crypts until next October, it’s time to unveil this year’s winners for the 2023 Halloween Hackfest.

For this contest, sponsors DigiKey and Arduino challenged the community to come up with their best creations for what’s arguably the most hacker-friendly of holidays. Pretty much everything was fair game, from costumes to decorations. The top three winners will get $150 credit from DigiKey and some treats from Arduino — just don’t try to eat them.

Continue reading “2023 Halloween Hackfest: This Year’s Spooky Winners” →

This Week In Security: Find My Keylogger, Zephyr, And Active Exploitation

November 10, 2023 by 7 Comments

Keyloggers. Such a simple concept — you secretly record all the characters typed on a keyboard, and sort through it later for interesting data. That keyboard sniffer could be done in software, but a really sneaky approach is to implement the keylogger in hardware. Hardware keyloggers present a unique problem. How do you get the data back to whoever’s listening? One creative solution is to use Apple’s “Find My” tracking system. And if that link won’t let you read the story, a creative solution for that issue is to load the page with javascript disabled.

This is based on earlier work from [Fabian Bräunlein], dubbed “Send My”. As an aside, this is the worst naming paradigm, and Apple should feel bad for it. At the heart of this cleverness is the fact that Apple used the standard Bluetooth Low Energy (BLE) radio protocol, and any BLE device can act like an Apple AirTag. Bits can be encoded into the reported public key of the fake AirTag, and the receiving side can do a lookup for the possible keys.

A fake AirTag keylogger manages to transfer 26 characters per second over the “Find My” system, enough to keep up with even the fastest of typists, given that no keyboard is in use all the time. Apple has rolled out anti-tracking protections, and the rolling key used to transmit data also happens to completely defeat those protections. Continue reading “This Week In Security: Find My Keylogger, Zephyr, And Active Exploitation” →

Fancy Gyroscopes Are Key To Radio-Free Navigation

November 1, 2023 by 49 Comments

Back in the old days, finding out your location on Earth was a pretty involved endeavor. You had to look at stars, use fancy gimballed equipment to track your motion, or simply be able to track your steps really really well. Eventually, GPS would come along and make all that a bit redundant for a lot of use cases. That was all well and good, until it started getting jammed all over the place to frustrate militaries using super-accurate satellite-guided weapons.

Today, there’s a great desire for more accurate navigational methods that don’t require outside communications that can easily be jammed. High-tech gyroscopes have long been a big part of that effort, allowing the construction of inertial navigation systems with greater accuracy than ever before.

Continue reading “Fancy Gyroscopes Are Key To Radio-Free Navigation” →

Open Source Key Programmer For HiTag2 Keys

October 28, 2023 by 9 Comments

Hitag transponders have been used in a wide variety of car keys as a protective measure against hot-wiring and theft. They’re also a reason why it’s a lot more expensive to get car keys duplicated these days for many models that use this technology. However, there is now an open source programmer that works with these transponder keys, thanks to [Janne Kivijakola].

The hack uses an old reader device salvaged from a Renault in a scrapyard, hooked up to an Arduino Mega 2560 or Arduino Nano. With this setup, key transponders can be programmed via a tool called AESHitager, which runs on Windows. It’s compatible with a variety of Hitag transponders, including Hitag2, Hitag3, and Hitag AES, along with the VVDI Super Chip and certain types of BMW keys.

If you’ve been having issues with coded keys, this project might just be what you need to sort your car out. Everything you need is available on GitHub for those wishing to try this at home. We’ve seen some interesting hacks in this space before, too. Video after the break.

Continue reading “Open Source Key Programmer For HiTag2 Keys” →

The Simulated Universe Thought Experiment And Information Entropy

October 26, 2023 by 38 Comments

Do we live in a simulation? This is one of those questions which has kept at least part of humanity awake at night, and which has led to a number of successful books and movies being made on the subject, topped perhaps by the blockbuster  movie The Matrix. Yet the traditional interpretation of the ‘simulated universe’ thought experiment is one in which we – including our brains and bodies – are just data zipping about in a hyper-advanced simulation rather than physical brains jacked into a computer. This simulation would have been set up by (presumably) a hyper-advanced species who seem to like to run their own version of The Sims on a Universe-sized scale.

Regardless of the ‘why’, the aspect of this question where at least some scientific inquiry is possible concerns whether or not it would be possible to distinguish anything uniquely simulation-like in our environment that’d give the game away, like a sudden feeling of déjà vu in the world of The Matrix where you can suddenly perceive the fabric of the simulation. However, the major problem which we have to consider when trying to catch a simulation in the act is that to this point we cannot ourselves create even a miniature galaxy and intelligent beings inside it to provide a testable hypothesis.

Beyond popular media like movies and series like Rick & Morty, what do science and philosophy have to say about this oddly controversial subject? According to some, we have already found the smoking gun, while others are decidedly more skeptical.

Continue reading “The Simulated Universe Thought Experiment And Information Entropy” →