Slider

5168 Articles

This Week In Security: Backdoors In Cisco Switches, PGP Spoofing In Emails, Git Ransomware

May 13, 2019 by 7 Comments

Some switches in Cisco’s 9000 series are susceptible to a remote vulnerability, numbered CVE-2019-1804 . It’s a bit odd to call it a vulnerability, actually, because the software is operating as intended. Cisco shipped out these switches with the same private key hardcoded in software for all root SSH logins. Anyone with the key can log in as root on any of these switches.

Cisco makes a strange claim in their advisory, that this is only exploitable over IPv6. This seems very odd, as there is nothing about SSH or the key authentication process that is IPv6 specific. This suggests that there is possibly another blunder, that they accidentally left the SSH port open to the world on IPv6. Another possibility is that they are assuming that all these switches are safely behind NAT routers, and therefore inaccessible through IPv4. One of the advantages/disadvantages of IPv6 is that there is no NAT, and all the network devices are accessible from the outside network. (Accessible in the sense that a route exists. Firewalling is still possible, of course.)

It’s staggering how many devices, even high end commercial devices, are shipped with unintentional yet effective backdoors, just like this one. Continue reading “This Week In Security: Backdoors In Cisco Switches, PGP Spoofing In Emails, Git Ransomware” →

Hacking The Ionosphere, For Science

May 10, 2019 by 14 Comments

Imagine what it must have been like for the first human to witness an aurora. It took a while for our species to migrate from its equatorial birthplace to latitudes where auroras are common, so it was a fairly recent event geologically speaking. Still, that first time seeing the shimmers and ribbons playing across a sky yet to be marred by light pollution must have been terrifying and thrilling, and like other displays of nature’s power, it probably fueled stories of gods and demons. The myths and legends born from ignorance of what an aurora actually represents seem quaint to most of us, but it was as good a model as our ancestors needed to explain the world around them.

Our understanding of auroras needs to be a lot deeper, though, because we now know that they are not only a beautiful atmospheric phenomenon but also a critical component in the colossal electromagnetic system formed by our planet and our star. Understanding how it works is key to everything from long-distance communication to keeping satellites in orbit to long-term weather predictions.

But how exactly does one study an aurora? Something that’s so out of reach and so evanescent seems like it would be hard to study. While it’s not exactly easy science to do, it is possible to directly study auroras, and it involves some interesting technology that actually changes them, somehow making the nocturnal light show even more beautiful.

Continue reading “Hacking The Ionosphere, For Science” →

How Art Became Science In Machining

May 7, 2019 by 57 Comments

Machining is one of those fascinating fields that bridges the pre-scientific and scientific eras. As such, it has gone from a discipline full of home-spun acquired wisdom and crusty old superstitions to one of rigorously analyzed physics and crusty old superstitions.

The earliest machinists figured out most of what you need to know just by jamming a tool bit into spinning stock and seeing what happens. Change a few things, and see what happens next. There is a kind of informal experimentation taking place here. People are gradually controlling for variables and getting better at the craft as they learn what seems to affect what. However, the difference between fumbling around and actually knowing something is controlling for one’s own biases in a reproducible and falsifiable way. It’s the only way to know for sure what is true, and we call this “science”. It also means being willing to let go of ideas you had because the double-blinded evidence clearly says they are wrong.

That last part is where human nature lets us down the most. We really want to believe things that confirm our preconceived notions about the world, justify our emotions, or make us feel better. The funny thing about science, though, is that it doesn’t care whether you believe in it or not. So go get your kids vaccinated, and up your machining game with scientific precision. Let’s take a look.

Continue reading “How Art Became Science In Machining” →

X-Rays Are The Next Frontier In Space Communications

May 6, 2019 by 90 Comments

Hundreds of years from now, the story of humanity’s inevitable spread across the solar system will be a collection of engineering problems solved, some probably in heroic fashion. We’ve already tackled a lot of these problems in our first furtive steps into the wider galaxy. Our engineering solutions have taken humans to the Moon and back, but that’s as far as we’ve been able to send our fragile and precious selves.

While we figure out how to solve the problems keeping us trapped in the Earth-Moon system, we’ve sent fleets of robotic emissaries to do our exploration by proxy, to make the observations we need to frame the next set of engineering problems to be solved. But as we reach further out into the solar system and beyond, our exploration capabilities are increasingly suffering from communications bottlenecks that restrict how much data we can ship back to Earth.

We need to find a way to send vast amounts of data back as quickly as possible using as few resources as possible on both ends of the communications link. Doing so may mean turning away from traditional radio communications and going way, way up the dial and developing practical means for communicating with X-rays.

Continue reading “X-Rays Are The Next Frontier In Space Communications” →

New Part Day: Lynxmotion Smart Servos

May 3, 2019 by 33 Comments

Anyone who shops for robotics kits would have come across a few designed by Lynxmotion. They’ve been helping people build robots since 1995, from robot arm kits to hexapod chassis and everything in between. We would expect these people know their motors, so when they launched their own line of servo motors called Lynxmotion Smart Servos (LSS), it is worth spending a bit of time to look over what they offer.

While these new devices have a PWM mode compatible with classic remote control servos, unleashing their full power requires bidirectional communication over a serial bus. We’ve previously given an overview of three serial bus servos already on the market for comparison. A quick look at the $68-$100 price tags listed on Lynxmotion’s parent company RobotShop made it clear they do not intend to compete on price, so what interesting features do these new kids on the block have?

Digging into product documentation found some great details. Acceleration and deceleration rates are adjustable, which can help with smoother robot movement. There’s also an adjustable level of “stiffness” that adds some “give” (compliance) so a robot won’t have to be as stiff as… well, a robot!

Mechanically, the most interesting internal component is the magnetic position sensor. They are far more precise than potentiometers, but more importantly, they allow positioning anywhere within full 360 degrees. Many other serial bus servos are constrained to positions within an arc less than 360 degrees leaving a blind spot.

An interesting quirk of the LSS offerings is that the serial communication protocol uses human-readable text characters, so sending a number 255 means transmitting a three byte string ‘2’, ‘5’, and ‘5’ instead of single byte 0xFF. This would make debugging our custom robot code far easier, at the cost of reduced bandwidth efficiency and loss of checksum for detecting communication errors. It’s a trade-off that some robot builders would be happy to make, but others might not.

Externally, these servos have bountiful mounting options including some we didn’t know to ask for. Historically Lynxmotion kits have used a wide variety of servo mounting brackets, so they are motivated to make mechanical integration easy. The most novel offering is the ability to bolt external gears to the servo body. A set of 1:3 gears allow for gearing the servo up or down, or you can use a set of 1:1 gears for a compact gripper.

As you’d expect of servos in this price range, they all have metal gears, but they also have the ability to power the motor directly from a battery pack (a 3 cell lithium polymer is recommended). There are additional features, like an RGB LED for visual feedback, which we didn’t cover here so dig into the documentation for more. We look forward to seeing how these interesting little actuators perform in future robotics projects.

How-To: Mapping Server Hits With ESP8266 And WS2812

May 2, 2019 by 17 Comments

It has never been easier to build displays for custom data visualization than it is right now. I just finished one for my office — as a security researcher I wanted a physical map that will show me from where on the planet my server is being attacked. But the same fabrication techniques, hardware, and network resources can be put to work for just about any other purpose. If you’re new to hardware, this is an easy to follow guide. If you’re new to server-side code, maybe you’ll find it equally interesting.

I used an ESP8266 module with a small 128×32 pixel OLED display connected via an SSD1306 controller. The map itself doesn’t have to be very accurate, roughly knowing the country would suffice, as it was more a decorative piece than a functional one. It’s a good excuse to put the 5 meter WS2812B LED strip I had on the shelf to use.

The project itself can be roughly divided into 3 parts:

  1. Physical and hardware build
  2. ESP8266 firmware
  3. Server-side code

It’s a relatively simple build that one can do over a weekend. It mashes together LED strips, ESP8266 wifi, OLED displays, server-side code, python, geoip location, scapy, and so on… you know, fun stuff.

Continue reading “How-To: Mapping Server Hits With ESP8266 And WS2812” →