This Week In Security: USB Cable Kia, Reddit, And Microsoft RCEs

There is vulnerability in many Hyundai and Kia vehicles, where the ignition switch can be bypassed with a USB cable. And it’s getting a patch rollout right now, but it’s not a USB vulnerability, in quite the way you might think. In most cars, the steering column is easily disassembled, but these vehicles have an extra-bad design problem. The ignition cylinder can be disassembled while locked, just by depressing a pin.

Physical security has some parallels to computer security, and one such parallel is that good security can often be bypassed by a simple mistake. When it comes to lock design, one such potential bypass is the ability to disassemble a lock while it’s still locked. And somehow, Kias after 2010, and Hyundais after 2015 were made with exactly this flaw. The lock could be disassembled, and the interface between the lock and the ignition switch just happens to be the right shape and size for USB A. Oh, and these cars don’t have an engine immobilizer — there isn’t a chip built into the keys for extra security.

The problem became widespread late last year when the flaw went viral on TikTok, and thousands of copycat crimes were inspired. Beyond the obvious problem, that teenagers were getting an early start on a life of crime with grand theft auto, there were at least 8 deaths directly attributed to the inane stunt. And this brings us back to this week’s news, that a software update is rolling out to address the issue.

Honestly, I have questions. A software update doesn’t add in-key security chips. At best, it could attempt to detect the key position, and sabotage the engine management control, in an ad-hoc immobilizer. That’s likely a paper clip-turned-jumper away from being bypassed. The other new feature, doubling the alarm time from 30 second to a minute, doesn’t inspire much confidence. Hopefully the changes are enough to kill the trend. Continue reading “This Week In Security: USB Cable Kia, Reddit, And Microsoft RCEs”

Retro Gadgets: Nintendo R.O.B Wanted To Be Your Friend

Too busy playing video games to have a social life? No worries. In 1985, Nintendo introduced R.O.B. — otherwise known as the Robotic Operating Buddy. It was made to play Nintendo with you. In Japan, apparently, it was the Family Computer Robot. We suppose ROB isn’t a very Japanese name. The robot was in response to the video game market crash of 1983 and was meant to keep the new Nintendo Entertainment System (NES) from being classified as a video game, which would have been a death sentence at the time of its release.

Since you might not have heard of R.O.B., you can probably guess it didn’t work out very well. In fact, the whole thing tanked in two years and resulted in only two games.

Continue reading “Retro Gadgets: Nintendo R.O.B Wanted To Be Your Friend”

MXenes Make Faraday Cages You Can Turn On And Off

Shielding is crucial for all manner of electronic devices. Whether you want to keep power supply noise out of an audio amplifier, or protect ICBMs against an electromagnetic pulse from a nuclear attack, the basic physics behind shielding remains the same. A Faraday cage or shield will do the trick.

At times, though, it would be desirable to shield and unshield a device at will. A new class of materials known as MXenes may be able to offer just that functionality, with microscopically thin films serving as shields that can be switched on and off at will.

Continue reading “MXenes Make Faraday Cages You Can Turn On And Off”

Matt Venn speaking at Supercon 2022

Supercon 2022: Matt Venn’s Tiny Tapeout Brings Chip Design To The Masses

Not that long ago, rolling your own printed circuit boards was difficult, time-consuming and expensive. But thanks to an army of cheap, online manufacturing services as well as high-quality free design software, any hobbyist can now make boards to rival those made by pros. A similar shift might be underway when it comes to chip design: affordable manufacturing options and a set of free software tools are slowly bringing custom chips into the realm of hackers and hobbyists. One of those working hard to democratize chip design is Matt Venn, who’s been telling us all about his current big project, called Tiny Tapeout, in his talk at Remoticon 2022.

Matt’s quest to bring IC design to the masses started in 2020, when the first open-source compatible Process Design Kit (PDK) was released to the public. A PDK is a collection of files, normally only available under strict non-disclosure agreements, that describe all the features of a specific chip manufacturing process and enable you to make a design. With this free PDK in hand and a rag-tag collection of free software tools, Matt set out to design his first chip, a VGA clock, which he taped out (released to manufacturing) in July 2020. Continue reading “Supercon 2022: Matt Venn’s Tiny Tapeout Brings Chip Design To The Masses”

Ban On Physical Mail Slated For NYC Jails, Which Could Go Digital Instead

Prison is a scary place, very much by design. It’s a place you end up when convicted of crimes by the judicial system, or in some cases, if you’re merely awaiting trial. Once you go in as a prisoner, general freedom and a laundry list of other rights are denied to you. New York City is the latest in a long list of municipalities looking to expand that list to include a ban on inmates receiving physical mail.

To achieve this, prisons across the US are instead switching to digital-only systems, which would be run by a private entity. Let’s look at the how, what, and why of this contentious new idea.

Continue reading “Ban On Physical Mail Slated For NYC Jails, Which Could Go Digital Instead”

Hackaday Links Column Banner

Hackaday Links: February 12, 2023

So, maybe right now isn’t the best time to get into the high-altitude ballooning hobby? At least in the US, which with the downing of another — whatever? — over Alaska, seems to have taken a “Sidewinders first, threat identification later” approach to anything that floats by. The latest incident involved an aircraft of unknown type, described as “the size of a small car” — there’s that units problem again — that was operating over Prudhoe Bay off the northern coast of Alaska. The reason that was given for this one earning a Sidewinder was that it was operating much lower than the balloon from last week, only about 40,000 feet, which is well within the ceiling of commercial aviation. It was also over sea ice at the time of the shootdown, making the chance of bothering anyone besides a polar bear unlikely. We’re not taking any political position on this whole thing, but there certainly are engineering and technical aspects of these shootdowns that are pretty interesting, as well as the aforementioned potential for liability if your HAB goes astray. Nobody ever really benefits from having an international incident on their resume, after all.

Continue reading “Hackaday Links: February 12, 2023”

Hackaday Podcast 205: Hackaday Berlin, So Many Sundials, And Ovens Pinging Google

Editor-in-Chief Elliot Williams and Managing Editor Tom Nardi start this week’s episode off with the announcement of Hackaday Berlin on March 25th. It’s been quite some time since we’ve been on the other side of the pond, because we had to cancel 2020’s Hackaday Belgrade due to COVID-19, so excitement is high for all three days of this “one-day” event.

After a new What’s that Sound, discussion moves on to an impressive collection of DIY sundials, the impact filament color has on the strength of 3D printed parts, the incredible retrocomputer replicas of Michael Gardi, and the Arduino FPGA that you’ve probably never heard of. We’ll wrap things up with the unexpected difficulties of mixing multiple cheap audio sources in Linux, and try to figure out why our kitchen appliances need to be connected to the Internet.

Check out the links below if you want to follow along, and as always, tell us what you think about this episode in  the comments!

Download all the bits!

Continue reading “Hackaday Podcast 205: Hackaday Berlin, So Many Sundials, And Ovens Pinging Google”