This Week In Security: Second Verse, Worse Than The First

Isn’t there some claim events come in threes? After the extremely rare leak of the iOS Coruna exploit chain recently, now we have details from Google on a second significant exploit in the wild, dubbed Darksword.

Like Coruna, Darksword appears to have followed the path of government security contractors, to different government actors, to crypto stealer. It appears to focus on exploits already fixed in modern iOS releases, with most affecting iOS 18 and all patched by iOS 26.3.

Going from almost no public examples of modern iOS exploits to two in as many weeks is wild, so if mobile device security is of interest, be sure to check out the Google write-up.

Another FBI Router Warning

The second too early to be retro – but too important to ignore – repeat security item is a second alert by the FBI cautioning about end-of-life consumer network hardware under active exploitation, with the FBI tracking almost 400,000 device infections so far.

Like the warning two weeks ago, the FBI calls out a handful of consumer routers – but this time they’re devices that may actually still be service in some of our homes (or our less cutting edge friends and family), calling out devices from Netgear, TP-Link, D-Link, and Zyxel:

  • Netgear DGN2200v4 and AC1900 R700
  • TP-Link Archer C20, TL-WR840N, TL-WR849N, and WR841N
  • D-Link DIR-818LW, 850L, and 860L
  • Zyxel EMG6726-B10A, VMG1312-B10D, VMG1312-T20B, VMG3925-B10A, VMG3925-B10C, VMG4825-B10A, VMG4927-B50A, VMG8825-T50K

While many of these devices are over ten years old, they still support modern networking – some of them even supporting 802.11ac (also called Wi-Fi 5).  Unfortunately, since support has been ended by the manufacturers, publicly disclosed vulnerabilities have not been patched (and now never will be, officially) Continue reading “This Week In Security: Second Verse, Worse Than The First”

FLOSS Weekly Episode 867: Pangolin: People Can Lie

This week Jonathan chats with Milo Schwartz about Pangolin, the Open Source tunneling solution. Why do we need something other than Wireguard, and how does Pangolin fix IoT and IT problems? And most importantly, how do you run your own self-hosted Pangolin install? Watch to find out!

Continue reading “FLOSS Weekly Episode 867: Pangolin: People Can Lie”

Retail Fail: The :CueCat Disaster

Digital Convergence Corporation is hardly a household name, and there’s a good reason for that. However, it raised about $185 million in investments around the year 2000 from companies such as Coca-Cola, Radio Shack, GE, E. W. Scripps, and the media giant Belo Corporation. So what did all these companies want, and why didn’t it catch on? If you are old enough, you might remember the :CueCat, but you probably thought it was Radio Shack’s disaster. They were simply investors.

The Big Idea

The :CueCat was a barcode scanner that, usually, plugged into a PC’s keyboard port (in those days, that was normally a PS/2 port). A special cable, often called a wedge, was like a Y-cable, allowing you to use your keyboard and the scanner on the same port. The scanner looked like a cat, of course.

However, the :CueCat was not just a generic barcode scanner. It was made to only scan “cues” which were to appear in catalogs, newspapers, and other publications. The idea was that you’d see something in an ad or a catalog, rush to your computer to scan the barcode, and be transported to the retailer’s website to learn more and complete the purchase.

The software could also listen using your sound card for special audio codes that would play on radio or TV commercials and then automatically pop up the associated webpage. So, a piece of software that was reading your keyboard, listening to your room audio at all times, and could inject keystrokes into your computer. What could go wrong?

Continue reading “Retail Fail: The :CueCat Disaster”

Age-Verification And The World Before Social Media

Although it may be hard to believe for current generations, there was a time when the Internet and the World Wide Web were not as integrated into society as it is today. The only forms of online ‘social media’ that existed came in the form of IRC, forums, BBSes, newsgroups and kin, while obtaining new software for your PC involved generally making your way over to a physical store to buy a boxed copy, at least officially.

In this era – and those before it – age-verification already existed, with various goods ranging from tobacco and alcohol to naughty adult magazines requiring you to pass some form of age check. Much like how movies also got age-gated, so did video games, with a sales clerk taking a very good look at you before selling you that naughty puzzle game or boxed copy of Quake 3.

Today we’re seeing a big fuss being made about online age-verification, with the claim being that it is ‘for the children’, but as any well-adjusted adult can attest to, this is essentially a big bucket of hogwash.

Continue reading “Age-Verification And The World Before Social Media”

Hackaday Links Column Banner

Hackaday Links: March 22, 2026

On Friday, Reuters reported that Amazon is going to try to get into the smartphone game…again. The Fire Phone was perhaps Amazon’s biggest commercial misstep, and was only on the market for about a year before it was discontinued in the summer of 2015. But now industry sources are saying that a new phone code-named “Transformer” is in the works from the e-commerce giant.

At this point, there’s no word on how much the phone would cost or when it would hit the market. The only information Reuters was able to squeeze out of their contacts was that the device would feature AI heavily. Real shocker there — anyone with an Echo device in their kitchen could tell you that Amazon is desperate to get you talking to their gadgets, presumably so they can convince you to buy something. While a smartphone with even more AI features we didn’t ask for certainly won’t be on our Wish List, if history is any indicator, we might be able to pick these things up cheap on the second-hand market.

On the subject of AI screwing everything up, earlier this week, the Electronic Frontier Foundation reported that The New York Times had started blocking the Internet Archive’s crawlers, citing concerns over their content being scraped up by bots for training data. The EFF likens this to a newspaper asking libraries to stop storing copies of their old editions, and warns that in an era where most people get their news via the Internet, not having an archived copy of sites like The Times will put holes in the digital record. They also point out that mirroring web pages for the purposes of making them more easily searchable is a widely accepted practice (ask Google) and has been legally recognized as fair use in court.

Assuming we take the NYT’s side of the story at face value, there’s a tiny part of our cold robotic heart that feels some sympathy for them. Over the last year or so, we’ve noticed some suspicious activity that we believe to be bots siphoning up content from the blog and Hackaday.io, and it’s resulted in a few technical headaches for us. On the other hand, what’s Hackaday here for if not to share information? Surely the same could be said for any newspaper, be it the local rag or The New York Times. If a chatbot learning some new phrases from us is the cost of doing business in 2026, so be it. Can’t stop the signal.

Continue reading “Hackaday Links: March 22, 2026”

The Unreasonable Power Density Of Lithium-Ion

We’re all used to it by now, but I’d just like to reflect on how insanely power-packed lithium ion batteries are, and everything that’s afforded us. I’m trying to think of a gadget, a hobby, or nearly anything in my house that’s not touched by the battery chemistry.

I’m looking at my portable wireless keyboard in front of me, with a LiPo pack inside. Oddly enough, I’m charging it with a LiPo-based power bank, simply because the cable to the nearest USB-C adapter is too short. A gaming console, cell phone, and a DSLR camera are all within arms reach and powered with lithium.

It’s not just consumer stuff either. I fly FPV quads and airplanes for fun when I can, and of course those are made entirely possible by the combination of smaller brushless DC motors and their drivers, and the high-power-density LiPo packs that power them. For field recharging, I have a huge self-made LiIon pack that can keep them all in the air all day. These days, LiPo and LiIon tech is the heart of hacker projects big and small. Heck, we even powered this year’s Hackaday Supercon badge with a LiPo that allowed it to run all weekend on a charge for many folks, where in the past swapping out AAs during the event was commonplace.

The application that still blows my mind is that we recently got a solar installation on our roof, which means a huge LiFePO battery in the basement. And while it’s one thing to power noisy little quads on the battery tech, it somehow seems another to power our entire house, for multiple hours per day, from a battery. Granted it’s not a couple of AAA cells in a little black plastic box, but it’s simply amazing to run a washing machine, the fridge, the stove, and even the heating off of what amounts to a battery pack.

Of course, I’m aware of the costs of producing the cells, both in terms of money and the environmental damage. It’s not a free lunch, and I’m looking forward to both cleaner and cheaper energy storage chemistries in the future. But for now, I’m still in awe of the many options that lithium-based battery chemistry has brought us. May your pillows remain non-spicy!

Hackaday Podcast Episode 362: Compression Molding, IPv4x, And Wired Headphones

As the sun goes down on a glorious spring evening on the western edge of Europe, Elliot Williams is joined by Jenny List for a look at the week in all things Hackaday.

First up: Hackaday Europe tickets are on sale! Bad luck folks, the early bird tickets disappeared in an instant, but regular ones are still available for now. We’re really looking forward to making our way to Lecco for a weekend of hacks, and it would be great to see you there too.

Then we have a new feature for the podcast, the Hackaday Mailbag. This week’s contribution comes from [Kenny], a longtime friend of Hackaday and probably our most regular conference attendee.

To the hacks, and we have some good ones. An air hockey robot might not seem like a challenge, but the engineering which went into [BasementBuilds’] one proves it’s not a job for the faint hearted. Then we look at compression molding of recycled plastic using 3D-printed molds, something that seems surprisingly accessible and we’d like to try, too. We’ve got a new DOS, a 3D-printed zipper repair, the IPv4 replacement we didn’t get, and the mind-bending logic of ternary computing. It’s one of those weeks where the quick hacks could all deserve their own in-depth look, but perhaps the stand-outs are and Arduino style compiler that includes the source code compressed within the binary, and a beautifully-done revival of a 1980s brick cellphone as a modern 5G unit.

Finally in the longer reads we’ve got an examination of wired versus Bluetooth headphones — we’re both in the wired camp — and a look back at the age of free dialup. As is so often the case, the experience there differed between Brits and Americans. Anyway, enjoy the episode, and we have another week to look forward to.

Download your own personal copy of the Podcast in glorious 192 kB MP3.

Continue reading “Hackaday Podcast Episode 362: Compression Molding, IPv4x, And Wired Headphones”