Hackaday Columns

4817 Articles

This excellent content from the Hackaday writing crew highlights recurring topics and popular series like Linux-Fu, 3D-Printering, Hackaday Links, This Week in Security, Inputs of Interest, Profiles in Science, Retrotechtacular, Ask Hackaday, Teardowns, Reviews, and many more.

This Week In Security: Invalid Curve Attacks, OpenSSH Shielded, And More Details On Coinbase

June 28, 2019 by 19 Comments

AMD Epyc processors support Secure Encrypted Virtualization (SEV), a technique that prevents even a hypervisor reading memory belonging to a virtual machine. To pull this off, the encryption and decryption is handled on the fly by the Platform Security Processor (PSP), which is an ARM core that handles processor start-up and many security features of modern AMD processors. The vulnerability announced this week is related to the encryption scheme used. The full vulnerability is math heavy, and really grokking it requires a deeper understanding of elliptical curve cryptography (ECC) than your humble author currently possesses.

During the process of starting a virtual machine, the VM process goes through a key-sharing process with the PSP, using an ECC Diffie-Hellman key exchange. Rather than raising prime numbers to prime exponents, an ECC-DH process bounces around inside an elliptical curve in order to find a shared secret. One of the harder problems to solve when designing an ECC based cryptographic system, is the design of the curve itself. One solution to this problem is to use a published curve that is known to be good. AMD has taken this route in their SEV feature.

The attack is to prime the key exchange with invalid data, and observing the shared key that is generated. A suitably simple initial value will leak information about the PSP’s secret key, allowing an attacker to eventually deduce that key and decrypt the protected memory. If you’d like to bone up on invalid curve attacks, here’s the seminal paper. (PDF)

OpenSSH Shielding

[Damien Miller] of OpenSSH was apparently tired of seeing that project tied to vulnerabilities like Rambleed and Rowhammer, so added a technique he’s calling key-shielding. OpenSSH now encrypts private keys in memory using a 16 kB pre-key. While an attacker with full knowledge of the process’s memory wouldn’t be deterred, the error rate of Rambleed and similar attacks is high enough that the 16 kB of randomness is likely to thwart the attempt to recover the secret key.

Firefox and Coinbase

We mentioned Firefox vulnerabilities and updates last week, and as anticipated, more information is available. [Philip Martin] from Coinbase shared more information on Twitter. Coinbase employees, as well as other cryptocurrency companies, were targeted with fishing emails. These lured employees to a malicious page that attempted to exploit a pair of Firefox vulnerabilities. Coinbase has a security system in place that was able to prevent the exploit, and their security team was able to reverse engineer the attack.

The first vulnerability has been dissected in some detail by a Google security researcher. It’s a weakness in Firefox’s Javascript engine related to type handling. An object is created with one data type, and when that data is changed to another type, not all the data handlers are appropriately updated. Under the hood, a value is assumed to be a pointer, but is actually a double-length value, controlled by the attacker.

The second vulnerability is in the functions used to prompt for user interaction. Specifically the call to “Prompt:Open” isn’t properly validated, and can result in the un-sandboxed Firefox process loading an arbitrary web location. I suspect the sandbox escape is used to run the initial exploit a second time, but this time it’s running outside the sandbox.

Odds and Ends

[Tom] wrote a great intro into how to Impersonate The President With Consumer-Grade SDR, go check it out!

Another city, more ransomware. Riviera Beach, Florida was hit with a ransomware attack, and paid $600,000 in an attempt to get their data back. For a city of 35,000 inhabitants, that’s $17.14 in ransom per man, woman, and child. According to the linked article, though, the city was insured.

Brett Smith Makes Your Life Easier With Hidden Microcontroller Features

June 27, 2019 by 37 Comments

There was a time when microprocessors were slow and expensive devices that needed piles of support chips to run, so engineers came up with ingenious tricks using extra hardware preprocessing inputs to avoid having to create more code. It would be common to find a few logic gates, a comparator, or even the ubiquitous 555 timer doing a little bit of work to take some load away from the computer, and engineers learned to use these components as a matter of course.

The nice thing is that many of these great hardware hacks have been built into modern microcontrollers through the years. The problem is you know to know about them. Brett Smith’s newly published Hackaday Superconference talk, “Why Do It The Hard Way?”, aims to demystify the helpful hardware lurking in microcontrollers.

Join us below for a deeper dive and the embedded video of this talk. Supercon is the Ultimate Hardware con — don’t miss your chance to attend this year, November 15-17 in Pasadena, CA.

Continue reading “Brett Smith Makes Your Life Easier With Hidden Microcontroller Features” →

What’s The Deal With Square Traces On PCBs

June 26, 2019 by 110 Comments

When designing a printed circuit board, there are certain rules. You should place decoupling capacitors near the power pins to each chip. Your ground planes should be one gigantic fill of copper; two ground planes connected by a single trace is better known as an antenna. Analog sections should be kept separate from digital sections, and if you’re dealing with high voltage, that section needs to be isolated.

One that I hear a lot is that you must never put a 90-degree angle on a trace. Some fear the mere sight of a 90-degree angle on a PCB tells everyone you don’t know what you’re doing. But is there is really no greater sin than a 90-degree trace on a circuit board?

This conventional wisdom of eschewing 90-degree traces is baked into everything we know about circuit board design. It is the first thing you’re taught, and it’s the first thing you’ll criticize when you find a board with 90-degree traces. Do square traces actually matter? The short answer is no, but there’s still a reason we don’t do it.

Continue reading “What’s The Deal With Square Traces On PCBs” →

You’re Sitting On An Engineering Masterpiece: Chairs As A Design Challenge

June 25, 2019 by 26 Comments

If you move as a hardware hacker through the sometimes surprisingly similar world of artists, craftspeople, designers, blacksmiths, and even architects, there’s one piece of work that you will see time and time again as an object that exerts a curious fascination. It seems that designing and building a chair is a rite of passage, and not just a simple chair, but in many cases an interesting chair.

An American-made Windsor chair from the turn of the 19th century. Los Angeles County Museum of Art [Public domain]
An American-made Windsor chair from the turn of the 19th century. Los Angeles County Museum of Art [Public domain]
Some of the most iconic seating designs that you will be instantly familiar with through countless mass-produced imitations began their lives as one-off design exercises. Yet we rarely see them in our community of hackers and makers, a search turns up only a couple of examples. This is surprising, not least because there is more than meets the eye to this particular piece of furniture. Your simple seat can be a surprisingly complex challenge.

Moving Charis From Artisan to Mass Market

The new materials and mass production techniques of the 19th and 20th centuries have brought high-end design into the hands of the masses, but while wealthy homes in earlier centuries had high-quality bespoke furniture in the style of the day, the traditional furniture of the masses was hand-made in the same way for centuries often to a particular style dependent on the region in which it was produced.

Continue reading “You’re Sitting On An Engineering Masterpiece: Chairs As A Design Challenge” →

Preserving Computer History Hack Chat

June 24, 2019 by 6 Comments

Join us on Wednesday 26 June 2019 at noon Pacific for the Preserving Computer History Hack Chat with Dag Spicer!

In our age of instant access to the seeming total of human knowledge at the swipe of a finger, museums may seem a little anachronistic. But the information available at our fingertips is often only the tip of the iceberg, and institutions like the Computer History Museum in Mountain View, California are dedicated to collecting and preserving the artifacts of the information age, capturing the intellectual capital that went into making them, and perhaps more importantly, providing context and making everything accessible.

The CHM is an incredible resource for anyone doing research involving the early days of computing. Dag Spicer is the Senior Curator at CHM, or “Chief Content Officer” as he likes to put it. Dag has been collecting, cataloging, and overseeing the largest collection of computer artifacts in the world for almost 25 years, and he has some stories to tell. He’ll stop by the Hack Chat this week to share them, and to answer your questions about the history of computers and how studying the past shapes the future of computing.

join-hack-chatOur Hack Chats are live community events in the Hackaday.io Hack Chat group messaging. This week we’ll be sitting down on Wednesday June 26 at 12:00 PM Pacific time. If time zones have got you down, we have a handy time zone converter.

Click that speech bubble to the right, and you’ll be taken directly to the Hack Chat group on Hackaday.io. You don’t have to wait until Wednesday; join whenever you want and you can see what the community is talking about.

 

Hackaday Links Column Banner

Hackaday Links: June 16th, 2019

June 23, 2019 by 28 Comments

OpenSCAD has been updated. The latest release of what is probably the best 3D modeling tool has been in the works for years now, and we’ve got some interesting features now. Of note, there’s a customizer, for allowing parametrizing designs with a GUI. There’s 3D mouse support, so drag out that weird ball mouse from the 90s. You can export in SVG, 3MF, and AMF. Update your install of OpenSCAD now.

New Hampshire is the home of BASIC, and now there’s a sign on the side of the road saying so. This is a New Hampshire state historical marker honoring BASIC, invented at Dartmouth College in 1964. Interestingly, there are 255 historical markers in New Hampshire, usually honoring bridges and historical figures, which means there’s an off-by-one error depending on implementation.

Because robots a great way to get kids into technology — someone has to repair the future robot workers of the world — DJI has release the RoboMaster S1. It’s a robot with four Mecanum wheels, something like a Nerf turret, a camera, and WiFi. The best part? It’s programmable, either through Scratch or Python. Yes, it’s drag-and-drop programming for line following robots.

If you have a C by GE Smart Light Bulb and connect a new router to your home network, you will need to disassociate your C By GE Smart Light Bulb with your old network. To do this, you first need to turn your bulb on for eight seconds, then turn off for two seconds, then turn on for eight seconds, then turn off for two seconds. Then turn the bulb on for eight seconds, and finally turn the bulb off for two seconds. Finally, turn the bulb on for eight seconds, then turn the bulb off for two seconds. Your bulb should blink three times, indicating it has dissociated with the WiFi network. If this procedure does not work, your light bulb is running an older version of firmware. This is why you put a physical reset button on your stuff, people.

Have a lot of Raspberry Pi hats but you want to play around with the ESP32? No problem, because here’s a Pi-compatible GPIO ESP32 board. It needs a catchier name, but this is an ESP32 that’s mostly compatible with the 40-pin connector found on all Pis. Here’s a Crowd Supply link.

 

Bunnie Huang Talks Manufacturing And Component Choices During Hackaday Prize Mentoring Session

June 21, 2019 by 4 Comments

Andrew “Bunnie” Huang’s mentor session for the Hackaday Prize shows off the kind of experience and knowledge hard to come by unless you have been through the hardware development gauntlet countless times. These master-classes match up experts in product development with Prize entrants working to turn their projects into products. We’ve been recording them so that all may benefit from the advice and guidance shared in each session.

The appealing little FunKey pocket gaming platform.
The appealing little FunKey pocket gaming platform.

Bunnie is someone who is already familiar to most Hackaday readers. His notoriety in our community began nearly two decades ago with his work reverse engineering the original Microsoft X-box, and he quickly went on to design (and hack) the Chumby Internet appliance, he created the Novena open-source laptop, and through his writing and teaching, he provides insight into sourcing electronic manufacture in Shenzhen. He’s the mentor you want to have in your corner for a Hackaday Prize entry, and that’s just what a lucky group had in the video we’ve placed below the break.

While this session with Bunnie is in the bag it’s worth reminding you all that we are still running mentor sessions for Hackaday Prize entrants, so sign up your entry for a chance to get some great feedback about your project.

The first team to meet with Bunnie are FunKey, whose keychain Nintendo-like handheld gaming platform was inspired by a Sprite_tm project featuring a converted novelty toy. The FunKey team have produced a really well-thought-out design that is ready to be a product, but like so many of us who have reached that point they face the impossible hurdle of turning it into a product. Their session focuses on advice for finding a manufacturing partner and scaling up to production.

A prototype HotorNot Coffee Stirrer, showing their problem of having to maintain food-safe components.
A prototype HotorNot Coffee Stirrer, showing their problem of having to maintain food-safe components.

HotorNot Coffee Stirrer is trying to overcome a problem unique to their food-related project. A hot drink sensor that has to go in the drink itself needs to be food safe, as well as easy enough to clean between uses. A variety of components are discussed including a thermopile on a chip that has the advantage of not requiring contact with the liquid, but sometimes the simplest ideas can be the most effective as Bunnie reminds us that a cheap medical thermometer teardown can tell us a lot about appropriate parts for this application.

The idea behing PhalangePad is an attractive one, but making those sensors reliable is no trivial eercise.
The idea behing PhalangePad is an attractive one, but making those sensors reliable is no trivial eercise.

It’s another component choice problem that vexes PhalangePad, an input device that relies on the user tapping the inside of their fingers with their thumb. It’s a great idea, but how should these “keypresses” be detected? Would you use a capacitive or magnetic sensor, a force sensitive resistors, or maybe even machine vision? Here Bunnie’s encyclopaedic knowledge of component supply comes to the fore, and the result is a fascinating insight into the available technologies.

We all amass a huge repository of knowledge as we pass through life, some of the most valuable of which is difficult to pass on in a structured form and instead comes out as incidental insights. An engineer with exceptional experience such as Bunnie can write the book on manufacturing electronics in China but still those mere pages can only scratch the surface of what he knows about the subject. There lies the value of these mentor sessions, because among them the gems of knowledge slip out almost accidentally, and if you’re not watching, you’ll miss them.

This is the second in our series of Hackaday Prize mentoring sessions this year, but we have more already in the can and further sessions to record. We’re constantly looking for more participants though, so make sure if you haven’t already that you put your entry in for Hackaday Prize and check out the list of mentors who are here to share their knowledge and experience. Continue reading “Bunnie Huang Talks Manufacturing And Component Choices During Hackaday Prize Mentoring Session” →