This Week In Security: SACK Of Death, Rambleed, HIBP For Sale, And Oracle Weblogic — Again!

June 21, 2019 by Jonathan Bennett 13 Comments

Netflix isn’t the first name to come to mind when considering security research firms, but they make heavy use of FreeBSD in their content delivery system and do security research as a result. Their first security bulletin of the year, not surprisingly, covers a FreeBSD vulnerability that happens to also affect Linux kernels from the last 10 years. This vulnerability uses SACKs and odd MSS values to crash a server kernel.

To understand Selective ACKs, we need to step back and look at how TCP connections work. TCP connections provide guaranteed delivery, implemented in the from of ACKnowledgement (ACK) packets. We think of a TCP connection as having a dedicated ACK packet for every data packet. In reality, the Operating System makes great effort to avoid sending “naked” ACK packets, and combines multiple ACKs in a single packet. An ACK is simply a flag in a packet header combined with a running total of bytes received, and can be included in a normal data packet. As much as is possible, the ACK for data received is sent along with data packets flowing in the opposite direction. Continue reading “This Week In Security: SACK Of Death, Rambleed, HIBP For Sale, And Oracle Weblogic — Again!” →

Electric Cars Sound Off, Starting July 1st

June 20, 2019 by Zoe Skyforest 89 Comments

By and large, automakers have spent much of the last century trying to make cars quieter and more comfortable. Noise from vehicles can be disruptive and just generally annoying, so it makes sense to minimise it where possible.

However, the noise from the average motor vehicle can serve a useful purpose. A running engine acts as an auditory warning to those nearby. This is particularly useful to help people avoid walking in front of moving vehicles, and is especially important for the visually impaired.

Electric vehicles, with their near-silent powertrains, have put this in jeopardy. Thus, from July 1st, 2019, the European Union will enforce regulations on the installation of noise-making devices on new electric and hybrid vehicles. They are referred to as the “Acoustic Vehicle Alert System”, and it’s been a hot area of development for some time now. Continue reading “Electric Cars Sound Off, Starting July 1st” →

An Evening With Space Shuttle Atlantis

June 18, 2019 by Tom Nardi 26 Comments

When I got the call asking if I’d be willing to fly down to Kennedy Space Center and cover an event, I agreed immediately. Then about a week later, I remembered to call back and ask what I was supposed to be doing. Not that it mattered, I’d gladly write a few thousand words about the National Crocheting Championships if they started holding them at KSC. I hadn’t been there in years, since before the Space Shuttle program had ended, and I was eager to see the exhibit created for the fourth member of the Shuttle fleet, Atlantis.

So you can imagine my reaction when I learned that the event Hackaday wanted me to cover, the Cornell Cup Finals, would culminate in a private viewing of the Atlantis exhibit after normal park hours. After which, the winners of the competition would be announced during a dinner held under the orbiter itself. It promised to be a memorable evening for the students, a well deserved reward for the incredible work they put in during the competition.

Thinking back on it now, the organizers of the Cornell Cup and the staff at Kennedy Space Center should truly be commended. It was an incredible night, and everyone I spoke to felt humbled by the unique experience. There was a real, palpable, energy about it that you simply can’t manufacture. Of course, nobody sitting under Atlantis that night was more excited than the students. Though I may have come in as a close second.

I’ll admit it was somewhat bittersweet to see such an incredible piece of engineering turned into a museum piece; it looked as if Atlantis could blast off for another mission at any moment. But there’s no denying that the exhibit does a fantastic job of celebrating the history and accomplishments of the Space Shuttle program. NASA officially considers the surviving Shuttle orbiters to be on a “Mission of Inspiration”, so rather than being mothballed in a hangar somewhere in the desert, they are out on display where the public can get up close and personal with one of humanities greatest achievements. Judging by the response I saw, the mission is going quite well indeed.

If you have the means to do so, you should absolutely make the trip to Cape Canaveral to see Atlantis and all the other fascinating pieces of space history housed at KSC. There’s absolutely no substitute for seeing the real thing, but if you can’t quite make the trip to Florida, hopefully this account courtesy of your humble scribe will serve to give you a taste of what the exhibit has to offer.

Continue reading “An Evening With Space Shuttle Atlantis” →

You Wouldn’t Download A Nuclear Reactor, But Could You?

June 17, 2019 by Tom Nardi 43 Comments

By pretty much any metric you care to use, the last couple of decades has been very good for the open source movement. There was plenty of pushback in the early days, back when the only people passionate about the idea were the Graybeards in the IT department. But as time went on, more and more developers and eventually companies saw the benefit of sharing what they were working on. Today, open source is effectively the law of the land in many fields, and you don’t have to look far to find the community openly denouncing groups who are keeping their source under lock and key.

The open source submarine that won 2017 Hackaday Prize.

In the last few years, we’ve even seen the idea gain traction in the hardware field. While it’s not nearly as prevalent as opening up the software side of things, today it’s not uncommon to see hardware schematics and PCB design files included in project documentation. So not only can you download an open source operating system, web browser, and office suite, but you can also pull down all the information you need to build everything from a handheld game system to an autonomous submarine.

With so many projects pulling back the curtain, it’s not unreasonable to wonder where the limits are. There’s understandably some concerns about the emerging field of biohacking, and anyone with a decent 3D printer can download the files necessary to produce a rudimentary firearm. Now that the open source genie is out of the bottle, it seems there’s precious little that you can’t download from your favorite repository.

Scratching an exceptionally surprising entry off that list is Transatomic, who late last year uploaded the design for their TAP-520 nuclear reactor to GitHub. That’s right, now anyone with git, some uranium, and a few billion dollars of seed money can have their very own Molten Salt Reactor (MSR). Well, that was the idea at least.

So six months after Transatomic dumped a little under 100 MB worth of reactor documentation on GitHub, is the world any closer to forkable nuclear power? Let’s find out.

Continue reading “You Wouldn’t Download A Nuclear Reactor, But Could You?” →

Shorting Pins On A Raspberry Pi Is A Bad Idea; PMIC Failures Under Investigation

June 12, 2019 by Jonathan Bennett 153 Comments

You may have noticed, we’re fans of the Raspberry Pi here at Hackaday. Hardly a day goes by that we don’t feature a hack that uses a Pi somewhere in the build. As useful as the Pis are, they aren’t entirely without fault. We’ve talked about the problems with the PoE hat, and multiple articles about keeping SD cards alive. But a new failure mode has popped that is sometimes, but not always, caused by shorting the two power rails on the board.

The Pi 3 B+ has a new PMIC (Power Management Integrated Circuit) made by MaxLinear. This chip, the MxL7704, is a big part of how the Raspberry Pi foundation managed to make the upgrades to the Pi 3 without raising the price over $35.

A quick look at the Raspberry Pi forum shows that some users have been experiencing a specific problem with their new Raspberry Pi 3 B+ units, where the power LED will illuminate but the unit will not boot. The giveaway is zero voltage on the 3v3 pin. It’s a common enough problem that it’s even mentioned in the official boot problems thread.

Make sure the probe you are measuring with does not slip, and simultaneously touches any of the other GPIO pins, as that might instantly destroy your PI, especially shorting the 3V3 pin to the 5V pin will prove to be fatal.

Continue reading “Shorting Pins On A Raspberry Pi Is A Bad Idea; PMIC Failures Under Investigation” →

A Field Guide To Transmission Lines

June 11, 2019 by Bryan Cockfield 122 Comments

The power grid is a complicated beast, regardless of where you live. Power plants have to send energy to all of their clients at a constant frequency and voltage (regardless of the demand at any one time), and to do that they need a wide array of equipment. From transformers and voltage regulators to line reactors and capacitors, breakers and fuses, and solid-state and specialized mechanical relays, almost every branch of engineering can be found in the power grid. Of course, we shouldn’t leave out the most obvious part of the grid: the wires that actually form the grid itself.

Continue reading “A Field Guide To Transmission Lines” →

Takata’s Deadly Airbags: An Engineering Omnishambles

June 10, 2019 by Zoe Skyforest 119 Comments

Engineers are, for the time being, only human. This applies even more so to executives, and all the other people that make up a modern organisation. Naturally, mistakes are made. Some are minor, while others are less so. It’s common knowledge that problems are best dealt with swift and early, and yet so often they are ignored in the hopes that they’ll go away.

You might have heard the name Takata in the news over the last few years. If that name doesn’t ring a bell you’ve likely heard that there was a major recall of airbag-equipped vehicles lately. The story behind it is one of a single decision leading to multiple deaths, scores of injuries, a $1 billion fine, and the collapse of a formerly massive automotive supplier.

Continue reading “Takata’s Deadly Airbags: An Engineering Omnishambles” →