This excellent content from the Hackaday writing crew highlights recurring topics and popular series like Linux-Fu, 3D-Printering, Hackaday Links, This Week in Security, Inputs of Interest, Profiles in Science, Retrotechtacular, Ask Hackaday, Teardowns, Reviews, and many more.
So, maybe right now isn’t the best time to get into the high-altitude ballooning hobby? At least in the US, which with the downing of another — whatever? — over Alaska, seems to have taken a “Sidewinders first, threat identification later” approach to anything that floats by. The latest incident involved an aircraft of unknown type, described as “the size of a small car” — there’s that units problem again — that was operating over Prudhoe Bay off the northern coast of Alaska. The reason that was given for this one earning a Sidewinder was that it was operating much lower than the balloon from last week, only about 40,000 feet, which is well within the ceiling of commercial aviation. It was also over sea ice at the time of the shootdown, making the chance of bothering anyone besides a polar bear unlikely. We’re not taking any political position on this whole thing, but there certainly are engineering and technical aspects of these shootdowns that are pretty interesting, as well as the aforementioned potential for liability if your HAB goes astray. Nobody ever really benefits from having an international incident on their resume, after all.
Editor-in-Chief Elliot Williams and Managing Editor Tom Nardi start this week’s episode off with the announcement of Hackaday Berlin on March 25th. It’s been quite some time since we’ve been on the other side of the pond, because we had to cancel 2020’s Hackaday Belgrade due to COVID-19, so excitement is high for all three days of this “one-day” event.
After a new What’s that Sound, discussion moves on to an impressive collection of DIY sundials, the impact filament color has on the strength of 3D printed parts, the incredible retrocomputer replicas of Michael Gardi, and the Arduino FPGA that you’ve probably never heard of. We’ll wrap things up with the unexpected difficulties of mixing multiple cheap audio sources in Linux, and try to figure out why our kitchen appliances need to be connected to the Internet.
Check out the links below if you want to follow along, and as always, tell us what you think about this episode in the comments!
There are a few binaries that wind up running in a bunch of places, silently do their jobs, and being easily forgotten about. ImageMagick is used on many servers for image conversion and resizing, and tends to run automatically on uploaded images. Easily forgotten, runs automatically, and with arbitrary inputs. Yep, perfect target for vulnerability hunting. And the good folks at Metabase found two of them.
First up is CVE-2022-44267, a Denial of Service, when ImageMagick tries to process a rigged PNG that contains a textual chunk. This data type is usually used for metadata, and can include a profile entry for something like EXIF data. If this tag is specified inside a text chunk, ImageMagick looks to the given value as a filename for finding that profile data. And notably, if that value is a dash -, it tries to read from standard input. If the server’s image processing flow doesn’t account for that quirk, and virtually none of them likely do, this means the ImageMagick process hangs forever, waiting for the end of input. So while that’s not usually a critical problem, it could be used for a resource exhaustion attack.
But the real problem is CVE-2022-44268. It’s the same trick, but instead of using - to indicate standard input, the processed image refers to a file on the server filesystem. If the file exists, and can be read, the contents are included in the image output. If the attacker has access to the image, it’s a slick data leak — and obviously a real security problem. If a server doesn’t have tight file permissions and isolation, there’s plenty of sensitive information to be found and abused.
The fix landed back in October 2022, and was part of the 7.1.0-52 release. There’s a bit of uncertainty about which versions are vulnerable, but I wouldn’t trust anything older than that version. It’s a pretty straightforward flaw to understand and exploit, so there’s a decent chance somebody figured it out before now. The file exfiltration attack is the one to watch out for. It looks like there’s an Indicator of Compromise (IoC) for those output PNGs: “Raw profile type”. Continue reading “This Week In Security: ImageMagick, VBulletin, And Dota 2”→
Smartphone features used to come thick and fast. Cameras proliferated, navigation got added, and then Apple changed the game by finally making touch computing just work. Since then, truly new features have slowed to a trickle, but Apple’s innovative crash detection system has been a big deal where safety is concerned.
The problem? It’s got a penchant for throwing false positives when iPhone and Apple Watch users are in no real danger at all. We first covered this problem last year, but since then, the wintery season has brought yet more issues for already-strained emergency responders.
One of the most powerful features of Unix and Linux is that using traditional command line tools, everything is a stream of bytes. Granted, modern software has blurred this a bit, but at the command line, everything is text with certain loose conventions about what separates fields and records. This lets you do things like take a directory listing, sort it, remove the duplicates, and compare it to another directory listing. But what if the shell understood more data types other than streams? You might argue it would make some things better and some things worse, but you don’t have to guess, you can install cosh, a shell that provides tools to produce and work with structured data types.
The system is written with Rust, so you will need Rust setup to compile it. For most distributions, that’s just a package install (rust-all in Ubuntu-like distros, for example). Once you have it running, you’ll have a few new things to learn compared to other shells you’ve used. Continue reading “Linux Fu: The Shell Forth Programmers Will Love”→
The Boy Who Cried Wolf is a simple parable that teaches children the fatal risk of raising a false alarm. To do so is to risk one’s life when raising the alarm about a real emergency that may go duly ignored.
Today, we rarely fear wolves, and we don’t worry about them eating us, our sheep, or our children. Instead, we worry about bigger threats, like incoming nuclear weapons, tornadoes, and earthquakes. We’ve built systems to warn us of these calamities, and authorities take a very dim view of those who misuse these alarms. Fox did just that in a recent broadcast, using a designated alarm tone for an advert. This quickly drew the attention of the Federal Communication Commission. Continue reading “Fox Fined For Using EAS Tone In Football Ad”→
It’s been far too long since we’ve had an event in Europe, and we’re going to fix that right now. Hackaday Berlin 2023 will be a day-long conference full of great talks, badge hacking, music, art, madness, and gathering with your favorite hackers on Saturday, March 25.
But it doesn’t stop there. We’ll have a pre-event party Friday night, and then a bring-a-hack brunch on Sunday with further opportunities to show off whatever projects you’re bringing along, hack some more on the badge, wind down, and/or play together. So if your travel plans allow it, come in Friday mid-day and don’t schedule your return ticket until Sunday evening.
Cutting to the chase: early bird tickets are on sale right now, so go get one! But even if you miss out on those, and they’ll go like hotcakes, the regular tickets are well worth it. Everything is fully catered, the badge and the swag are phenomenal, and the talks will be first-rate.
Last time we were in Europe, the party went on until 2 AM!
Saturday’s main events will include a handful of fantastic invited guest talks, but also a few hours of Lightning Talks given by you – yes, you! If you’ve never attended a lightning talk, you get seven minutes to run through one of your favorite projects. We want to know what’s on your workbench right now, what new skills you’ve been teaching yourself, or the groundwork you’ve been laying for the next big project. It’s your chance to inspire everyone in the room – grab it.
Everyone asked us to do a second run of the 2022 Hackaday Supercon badge, and now we’ve got the perfect excuse! Designed by Voja Antonic, the badge is a standalone retrocomputer in the style of an Altair or similar, but it’s much more. Between blinking LEDs that display everything going on, down to the gates in the ALU, and a trimmed-down machine language, it’s an invitation to get deeply in touch with the machine. If you felt left out because you couldn’t travel to Pasadena last November, here’s your second chance.
And then there’s the crowd. Hackaday really is a global community of hackers, and Hackaday events tend to bring out the best. Even if you’re not planning to give a lightning talk (and you should!) be prepared to talk about what you’re doing, because everyone else there is just as interested in cool projects as you are. Hackaday Berlin will be a great opportunity to connect and reconnect with new and old friends alike. Come join us!
We’ll be following up with a speaker announcement next week, but if you have any questions, let us know in the comments below. Otherwise, we’ll see you in Berlin.
