Slider

5172 Articles

Breaking SimpliSafe Security Systems With Software Defined Radio

February 23, 2016 by 49 Comments

The SimpliSafe home security system is two basic components, a keyboard and a base station. Sensors such as smoke detectors, switches, and motion sensors can be added to this system, all without a wired installation. Yes, this security system is completely wireless. Yes, you can still buy a software defined radio for ten dollars. Yes, the device has both “simple” and “safe” in its name. We all know where this is going, right?

Last week, [Andrew Zonenberg] at IOActive published a security vulnerability for the SimpliSafe wireless home security system. As you would expect from an off-the-shelf, wireless, DIY security system, the keypad and base station use standard 433 MHz and 315 MHz ISM band transmitters and receivers. [Dr. Zonenberg]’s attack on the system didn’t use SDR; instead, test points on the transmitters were tapped and messages between the keypad and base station were received in cleartext. When the correct PIN is entered in the keypad, the base station replies with a ‘PIN entered’ packet. Replaying this packet with a 433 MHz transmitter will disable the security system.

[Michael Ossmann] took this one step further with a software defined radio. [Ossmann] used a HackRF One to monitor the transmissions from the keypad and turned to a cheap USB SDR dongle to capture packets. Replaying keypad transmissions were easy, but with a little bit more work new attacks can be found. The system can be commanded to enter test mode even when the system is armed bypassing notifications to the owner.

It’s a hilarious failure of wireless security, especially given the fact that this exploit can be performed by anyone with $100 in equipment. With a little more effort, an attacker can execute a PIN replay from a mile away. Sadly, failures of security of this magnitude are becoming increasingly common. There will assuredly be more attacks of this kind in the future, at least until hardware manufacturers start taking the security (of their security products) seriously.

Worlds Collide: Hot Rodders And Hackers

February 23, 2016 by 59 Comments

When we think of the average hot rodder, we think of guys and gals that love anything on four wheels. They’re good with hand tools, fabrication and know the ins and outs of the internal combustion engine. Their tools of the trade are welders, grinders and boxed-end wrenches. But their knowledge of electric circuits doesn’t go beyond wiring up a 12 volt DC tail light. On the surface, the role of a hot rodder would seem quite different from that of a hardware hacker. But if you abstract what they do, you find that they take machines and modify their design to make them do something more than they were originally designed to do. When viewed in this light, hot rodders are hackers.
Continue reading “Worlds Collide: Hot Rodders And Hackers” →

Ask Hackaday: Selling CAD Prints That Are Not Yours

February 22, 2016 by 242 Comments

[Louise] tried out her new E3D Cyclops dual extrusion system by printing a superb model dragon. The piece was sculpted in Blender, stands 13cm tall and can be made without supports. It’s an impressive piece of artwork that reflects the maker’s skill, dedication and hard work. She shared her creation on the popular Thingiverse website which allows others to download the file for use on their own 3D printer. You can imagine her surprise when she stumbled upon her work being sold on eBay.

It turns out that the owner of the eBay store is not just selling [Louise]’s work, he’s selling thousands of other models taken from the Thingiverse site. This sketchy and highly unethical business model has not gone unnoticed, and several people have launched complaints to both Thingiverse and eBay. Now, there are lots of things to talk about here, but the 800 pound high voltage transformer in the room is the legality of the whole thing. What he’s doing might be unethical, but is it illegal?

When [Louise] politely asked the eBay store owner to remove her work, he responded with:

“When you uploaded your items onto Thingiverse for mass distribution, you lost all rights to them whatsoever. They entered what is known in the legal world as “public domain”. The single exception to public domain rules are original works of art. No court in the USA has yet ruled a CAD model an original work or art.”

Most of the uploaded CAD models on Thingiverse are done under the Creative Commons license, which is pretty clear in its assertion that anyone can profit from the work. This would seem to put the eBay store owner in the clear for selling the work, but it should be noted that he’s not properly attributing the work to the original creator. There are other derivatives of the license, some of which prohibit commercial use of the work. In these cases, the eBay store owner would seem to be involved in an obvious violation of the license.

There are also questions stirring with his use of images.  He’s not taking the CAD model and making his own prints for images. He lifting the images of the prints from the Thingiverse site along with the CAD files. It’s a literal copy/paste business model.

With that said,  the eBay store owner makes a fairly solid argument in the comments section of the post that broke the news. Search for the poster named “JPL” and the giant brick of text to read it. He argues that the Thingiverse non-commercial license is just lip service and has no legal authority. One example of this is how they often provide links to companies that will print a CAD design on the same page of a design that’s marked as non-commercial. He sums up one of many good points with the quote below:

“While we could list several other ways Thingiverse makes (money), any creator should get the picture by now-Thingiverse exists to make Stratasys (money) off of creators’ designs in direct violation of its very own “non-commercial” license. If a creator is OK with a billion-dollar Israeli company monetizing his/her designs, but hates on a Philly startup trying to make ends-meet, then they have a very strange position indeed.”

OK Hackaday readers, you have heard both sides of the issue. Here’s the question(s):

1.  Is the eBay seller involved in illegal activity?

2. Can he change his approach to stay within the limits of the license? For instance, what if he credits the                      original maker on the sale page?

3. How would you feel if you found your CAD file for sale on his eBay store?

Imperial Shuttle Drone Is Sure To Scare The Cat

February 20, 2016 by 16 Comments

[Adam Woodworth] tries to build some kind of RC plane every month. He’s been at it for almost a decade, and he’s getting pretty damn good at it. By day, he’s a Hardware Engineer at Google, though he went to MIT for Aerospace Engineering. Coincidence? We think not.

His latest project is an Imperial Shuttle drone, or to be specific, a Lambda class imperial shuttle — the infamous Shuttle Tydirium. You have to watch this thing unfold.

Using paper model plans, [Adam] printed out the shuttle on a combination of 3mm and 6mm thick foam board (Depron), and then assembled it. This kept the model light enough that the set of quad rotors would have more than enough power to fly it around.

Continue reading “Imperial Shuttle Drone Is Sure To Scare The Cat” →

Waiting For China To Re-Open, From Huaqiangbei

February 20, 2016 by 24 Comments

The Chinese New Year is something we keep in mind at least half of the year, and probably still don’t plan for properly. In case you’re new to the situation: The Chinese New Year celebration empties out Shenzhen of its more than 12 million residents for the better part of a month. It’s the one time of year that manufacturing sector workers (and everyone that supports that ecosystem) travels home to visit family.

For those involved in manufacturing goods in Shenzhen, this part of the year leaves us cut off from one of our vices and we count the days until our tracking numbers and order confirmations start to show signs of life. It’s an inconvenience of an entirely different nature if you are one of the lonely few that stays in the city during the holiday. [Ian] over at Dangerous Prototypes wrote a blog post from his office in Huaqiangbei which is a sub-district of Shenzhen, China to share the experience with us.

Shenzhen is uniquely a migrant-worker city, and when emptied of the factory employees there are not enough people to patronize local services like markets and restaurants so they also shut down. But an empty city offers its own interesting entertainment like wicked fireworks sessions. As always, [Ian] does a great job of sharing this peculiar part of Shenzhen culture. He also kindly points out some of the offensive offers that come through the inter-webs from desperate customers who have poorly planned around the holiday.

Variable Instruction Computing: What Is Old Is New Again

February 19, 2016 by 63 Comments

Every twenty to twenty-five years, trends and fads start reappearing. 2016 is shaping up to be a repeat of 1992; the X-files is back on the air, and a three-way presidential election is a possibility. Star Trek is coming back, again. Roll these observations back another twenty-five years, and you have The Outer Limits, Star Trek, and riots at the DNC convention in Chicago.

History repeating itself is not the exclusive domain of politics and popular culture. It happens with tech, too: the cloud is just an extension of thin clients which are an extension of time-sharing. Everything old is new again.

For the last few years, Soft Machines, a fabless semiconductor company running in stealth mode, released the first preview for an entirely new processor architecture. This new architecture, VISC, offers higher performance per Watt than anything available on the market. If you’ve been paying attention for the last decade or so, the future of computing isn’t 200-Watt space heaters that also double as powerful CPUs. The future is low power machines that are good enough to run Facebook or run some JavaScript. With servers, performance per Watt is possibly the most important metric. How will Soft Machines upend the semiconductor market with new processors and new architectures? If you know your history, it shouldn’t be a surprise.

Continue reading “Variable Instruction Computing: What Is Old Is New Again” →