Hackaday Columns

4672 Articles

This excellent content from the Hackaday writing crew highlights recurring topics and popular series like Linux-Fu, 3D-Printering, Hackaday Links, This Week in Security, Inputs of Interest, Profiles in Science, Retrotechtacular, Ask Hackaday, Teardowns, Reviews, and many more.

Hackaday Berlin: First Round Of Talks

March 7, 2023 by 11 Comments

We’re super excited to announce the first round of speakers for Hackaday Berlin!  We’re set to convene on Friday night, March 24th for an evening warm up before the main show on Saturday, March 25. Featuring the triumphant return of Voja’s 4-bit badge, a crew of awesome speakers, lightning talks, workshops, music, food, badge hacking, and all the best of the Hackaday community, this will be a day to remember. And then we’ll chill out Sunday morning with a Bring-a-Hack brunch.

So without further ado: the first round of speakers!

Jiska Classen
Hacking Closed-Source: Reverse Engineering Real-World Products

Closed-source software is prevalent in our everyday lives, limiting our ability to understand how it works, which privacy implication it poses to the processed data, and addressing potential issues in time. Despite the growth of open-source movements, users often have no choice but to rely on closed-source solutions, e.g., for medical devices and IoT products. We’ll discuss key techniques to help you get started with reverse engineering. Hacking your own devices can be challenging, bricking a device is not uncommon, but so is celebrating the moments of a revived and modified device.

James Bruton
Being a Full-Time YouTuber

 

YouTube is my full-time job and has been for four years. I create STEM education content using everything from 3D printing, CNC, Welding, to Microcontrollers and Coding. Find out how I got started, how I make money, what goes on in the background, and what my future plans are. I’ll tell you how you can do it too!

Trammell Hudson
Hacking your dishwasher for cloudless appliances

Why does your dishwasher, laundry or coffee-pot need to talk to the cloud? In this presentation, Trammell Hudson shows how he reverse engineered the encrypted connections between Home Connect appliances and the Bosch-Siemens Cloud servers, and how you can control your own appliances with your self-hosted MQTT home automation system by extracting the devices’ authentication keys and connecting to their local websocket ports. No cloud required!

Bleeptrack
Oops, my project ended up in a museum

Parameterized design allows for the adaption of projects to different needs but can also change the aesthetic to a persons liking. Bleeptrack will walk you through the creation process and tools of her generative projects, talk about her experience manufacturing unique pieces and explains how to cope when your freshly finished project gets locked up in an art exhibition for a few months.

Ali Shtarbanov
Creating Hardware Development Platforms for Real-World Impact: FlowIO Platform

What does it really take do create and deploy a development platform for real-world impact? Why do we need development platforms and how can they democratize emerging fields and accelerate innovation? Why do most platform attempts fail and only very few succeed in terms of impact? I will discuss the key characteristics that any platform technology must have in order for it to be able to useful for diverse users. FlowIO was the winner of the 2021 Hackaday Grand Prize as well as over a dozen other engineering, research, and design awards.

Come join us!

You!

Whatever you’re up to.

We want you to bring your current project, world-changing ideas, or simply fun hacks for a 7-minute lightning talk!

 

What’s Going To Happen To Legacy Broadcast Bands When The Lights Go Out?

March 6, 2023 by 215 Comments

Our smartphones have become our constant companions over the last decade, and it’s often said that they have been such a success because they’ve absorbed the features of so many of the other devices we used to carry. PDA? Check. Pager? Check. Flashlight? Check. Camera? Check. MP3 player? Of course, and the list goes on. But alongside all that portable tech there’s a wider effect on less portable technology, and it’s one that even has a social aspect to it as well. In simple terms, there’s a generational divide that the smartphone has brought into focus, between older people who consume media in ways born in the analogue age, and younger people for whom their media experience is customized and definitely non-linear.

The Kids Just Don’t Listen To The Radio Any More

A 1957 American family watching TV
We’re guessing this is no longer a scene played out in many homes. Evert F. Baumgardner, Public domain.

The effect of this has been to see a slow erosion of the once-mighty reach of radio and TV broadcasters, and with that loss of listenership has come less of a need for the older technologies they relied on. Which leaves a fascinating question here at Hackaday, what is going to happen to all that spectrum? Indeed, there’s a deeper question behind all that, is lower frequency spectrum even that valuable any more?

In the old days, we had analogue TV in several-MHz-wide channels spread across a large part of the UHF bands and some smaller chunks of VHF. Among that we had 20 MHz of FM broadcasting around the 100 MHz mark, and disregarding shortwave, then a MHz of AM down around 1 MHz. Europeans got a bonus band down there too: we’ve got Long Wave, over 100 kHz of AM goodness roughly centered around 200 kHz.

Continue reading “What’s Going To Happen To Legacy Broadcast Bands When The Lights Go Out?” →

Hackaday Links Column Banner

Hackaday Links: March 5, 2023

March 5, 2023 by 40 Comments

Well, we guess it had to happen eventually — Ford is putting plans in place to make its vehicles capable of self-repossession. At least it seems so from a patent application that was published last week, which reads like something written by someone who fancies themselves an evil genius but is just really, really annoying. Like most patent applications, it covers a lot of ground; aside from the obvious capability of a self-driving car to drive itself back to the dealership, Ford lists a number of steps that its proposed system could take before or instead of driving the car away from someone who’s behind on payments.

Examples include selective disabling conveniences in the vehicle, like the HVAC or infotainment systems, or even locking the doors and effectively bricking the vehicle. Ford graciously makes allowance for using the repossessed vehicle in an emergency, and makes mention of using cameras in the vehicle and a “neural network” to verify that the locked-out user is indeed having, say, a medical emergency. What could possibly go wrong?

Continue reading “Hackaday Links: March 5, 2023” →

ChatGPT, Bing, And The Upcoming Security Apocalypse

March 4, 2023 by 46 Comments

Most security professionals will tell you that it’s a lot easier to attack code systems than it is to defend them, and that this is especially true for large systems. The white hat’s job is to secure each and every point of contact, while the black hat’s goal is to find just one that’s insecure.

Whether black hat or white hat, it also helps a lot to know how the system works and exactly what it’s doing. When you’ve got the source code, either because it’s open-source, or because you’re working inside the company that makes the software, you’ve got a huge advantage both in finding bugs and in fixing them. In the case of closed-source software, the white hats arguably have the offsetting advantage that they at least can see the source code, and peek inside the black box, while the attackers cannot.

Still, if you look at the number of security issues raised weekly, it’s clear that even in the case of closed-source software, where the defenders should have the largest advantage, that offense is a lot easier than defense.

So now put yourself in the shoes of the poor folks who are going to try to secure large language models like ChatGPT, the new Bing, or Google’s soon-to-be-released Bard. They don’t understand their machines. Of course they know how the work inside, in the sense of cross multiplying tensors and updating weights based on training sets and so on. But because the billions of internal parameters interact in incomprehensible ways, almost all researchers refer to large language models’ inner workings as a black box.

And they haven’t even begun to consider security yet. They’re still worried about how to construct obscure background prompts that prevent their machines from spewing hate speech or pornographic novels. But as soon as the machines start doing something more interesting than just providing you plain text, the black hats will take notice, and someone will have to figure out defense.

Indeed, this week, we saw the first real shot across the bow: a hack to make Bing direct users to arbitrary (bad) webpages. The Bing hack requires the user to already be on a compromised website, so it’s maybe not very threatening, but it points out a possible real security difference between Bing and ChatGPT: Bing gives you links to follow, and that makes it a juicy target.

We’re right on the edge of a new security landscape, because even the white hats are facing a black box in the AI. So far, what ChatGPT and Codex and other large language models are doing is trivially secure – putting out plain text – but Bing is taking the first dangerous steps into doing something more useful, both for users and black hats. Given the ease with which people have undone OpenAI’s attempts to keep ChatGPT in its comfort zone, my guess is that the white hats will have their hands full, and the black-box nature of the model deprives them of their best hope. Buckle your seatbelts.

This article is part of the Hackaday.com newsletter, delivered every seven days for each of the last 200+ weeks. It also includes our favorite articles from the last seven days that you can see on the web version of the newsletter. Want this type of article to hit your inbox every Friday morning? You should sign up!

Daniel Valuch Chats About CERN’s High Caliber Hacking

March 3, 2023 by 9 Comments

For those of us who like to crawl over complex systems, spending hours or even days getting hardware and software to work in concert, working at places like NASA or CERN seems like a dream job. Imagine having the opportunity to turn a wrench on the Space Shuttle or the Large Hadron Collider (LHC) — not only do you get to spend some quality time with some of the most advanced machines ever produced, you can be secure in the knowledge that your work will further humanity’s scientific understanding of the universe around us.

Or at least, that’s what we assume it must feel like as outsiders. But what about somebody who’s actually lived it? What does an actual employee, somebody who’s had to wake up in the middle of the night because some obscure system has gone haywire and stalled a machine that cost taxpayers $4.75 billion to build, think about working at the European Organization for Nuclear Research? Continue reading “Daniel Valuch Chats About CERN’s High Caliber Hacking” →

Hackaday Podcast 208: Hallucinating Robots, Floppy Cartridges, And A Flexure Synth French Horn

March 3, 2023 by 1 Comment

This week, Editor-in-Chief Elliot Williams and [former Assignments Editor] Kristina Panos stood around talking about the greatest hacks of the previous week. But first, we’ve got a contest running now through March 21st — the Low Power Challenge!

Kristina almost got What’s That Sound this week, but could only describe it as some sort of underwater organ, so still no t-shirt for her. But [BalkanBoy] knew exactly what it was — the Zadar Sea Organ in Croatia. Then it’s on to the hacks, beginning with the most beautiful sea of 7-segments you’ll likely ever see. We gush over a tiny PC in a floppy drive that uses custom cartridges, dish about an expressive synth that uses a flexure mechanism, and enjoy a loving ode to the vacuum fluorescent display.

Check out the links below if you want to follow along, and as always, tell us what you think about this episode in  the comments!

And/or download it and listen offline.

Where to Follow Hackaday Podcast

Places to follow Hackaday podcasts:

Continue reading “Hackaday Podcast 208: Hallucinating Robots, Floppy Cartridges, And A Flexure Synth French Horn” →

This Week In Security: OpenEMR, Bing Chat, And Alien Kills Pixels

March 3, 2023 by 8 Comments

Researchers at Sonar took a crack at OpenEMR, the Open Source Electronic Medical Record solution, and they found problems. Tthe first one is a classic: the installer doesn’t get removed by default, and an attacker can potentially access it. And while this isn’t quite as bad as an exposed WordPress installer, there’s a clever trick that leads to data access. An attacker can walk through the first bits of the install process, and specify a malicious SQL server. Then by manipulating the installer state, any local file can be requested and sent to the remote server.

There’s a separate set of problems that can lead to arbitrary code execution. It starts with a reflected Cross Site Scripting (XSS) attack. That’s a bit different from the normal XSS issue, where one user puts JavaScript on the user page, and every user that views the page runs the code. In this case, the malicious bit is included as a parameter in a URL, and anyone that follows the link unknowingly runs the code.

And what code would an attacker want an authenticated user to run? A file upload, of course. OpenEMR has function for authenticated users to upload files with arbitrary extensions, even .php. The upload folder is inaccessible, so it’s not exploitable by itself, but there’s another issue, a PHP file inclusion. Part of the file name is arbitrary, and is vulnerable to path traversal, but the file must end in .plugin.php. The bit of wiggle room on the file name on both sides allow for a collision in the middle. Get an authenticated user to upload the malicious PHP file, and then access it for instant profit. The fixes have been available since the end of November, in version 7.0.0-patch-2.

Bing Chat Injection

Or maybe it’s AI freedom. So, the backstory here is that the various AI chat bots are built with rules. Don’t go off into political rants, don’t commit crimes, and definitely don’t try to scam the users. One of the more entertaining tricks clever users have discovered is to tell a chatbot to emulate a personality without any such rules. ChatGPT can’t comment on political hot button issues, but when speaking as DAN, anything goes.

Arrrrr

This becomes really interesting when Bing Chat ingests a website that has targeted prompts. It’s trivial to put text on a web page that’s machine readable and invisible to the human user. This work puts instructions for the chat assistant in that hidden data, and demonstrates a jailbreak that turns Bing Chat malicious. The fun demonstration convinces the AI to talk like a pirate — and then get the user to click on an arbitrary link. The spooky demo starts out by claiming that Bing Chat is down, and the user is talking to an actual Microsoft engineer.

LastPass Details — Plex?

Last time we talked about the LastPass breach, we had to make some educated guesses about how things went down. There’s been another release of details, and it’s something. Turns out that in one of the earlier attacks, an encrypted database was stolen, and the attackers chose to directly target LastPass Engineers in an attempt to recover the encryption key.

According to Ars Technica, the attack vector was a Plex server run by one of those engineers. Maybe related, at about the same time, the Plex infrastructure was also breached, exposing usernames and hashed passwords. From this access, attackers installed a keylogger on the developer’s home machine, and captured the engineer’s master password. This allowed access to the decryption keys. There is some disagreement about whether this was/is a 0-day vulnerability in the Plex software. Maybe make sure your Plex server isn’t internet accessible, just to be safe.

There’s one more bit of bad news, particularly if you use the LastPass Single Sign On (SSO) service. That’s because the SSO secrets are generated from an XOR of two keys, K1 and K2. K1 is a single secret for every user at an organization. K2 is the per-user secret stored by Lastpass. And with this latest hack, the entire database of K2 secrets were exposed. If K1 is still secret, all is well. But K1 isn’t well protected, and is easily accessed by any user in the organization. Ouch.

The Ring Alien

Turns out, just like a certain horror movie, there is a video that the very watching causes death. If you happen to be a Pixel phone, that is. And “death” might be a bit of an exaggeration. Though the video in question certainly nails the vibe. Playing a specific YouTube clip from Alien will instantly reboot any modern Pixel phone. A stealth update seems to have fixed the issue, but it will be interesting to see if we get any more details on this story in the future. After all, when data can cause a crash, it can often cause code execution, too.

In-The-Wild

The US Cybersecurity and Infrastructure Security Agency (CISA) maintains a list of bugs that are known to be under active exploitation, and that list just recently added a set of notches. CVE-2022-36537 is the most recent, a problem in the ZK Framework. That’s an AJAX framework used in many places, notable the ConnectWise software. Joining the party are CVE-2022-47986, a flaw in IBM Aspera Faspex, a file transfer suite, and CVE-2022-41223 and CVE-2022-40765, both problems in the Mitel MiVoice Business phone system.

Bits and Bytes

There’s yet another ongoing attack against the PyPI repository, but this one mixes things up a bit by dropping a Rust executable as one stage in a chain of exploitation. The other novel element is that this attack isn’t going after typos and misspellings, but seems to be a real-life dependency confusion attack.

The reference implementation of the Trusted Platform Module 2.0 was discovered to contain some particularly serious vulnerabilities. The issue is that a booted OS could read and write two bytes beyond it’s assigned data. It’s unclear weather that’s a static two bytes, making this not particularly useful in the real world, or if these reads could be chained together, slowly leaking larger chunks of internal TPM data.

And finally, one more thing to watch out for, beware of fake authenticator apps. This one is four years old, has a five star rating, and secretly uploads your scanned QR codes to Google Analytics, exposing your secret authenticator key. Yoiks.