This Week In Security: Bluetooth Hacking, NEC Phones, And Malicious Tor Nodes

August 21, 2020 by Jonathan Bennett 4 Comments

One of the fun things about vulnerability research is that there are so many places for bugs to hide. Modern devices have multiple processors, bits of radio hardware, and millions of lines of code. When [Veronica Kovah] of Dark Mentor LLC decided to start vulnerability research on the Bluetooth Low Energy protocol, she opted to target the link layer itself, rather than the code stack running as part of the main OS. What’s interesting is that the link layer has to process data before any authentication is performed, so if a vulnerability is found here, it’s guaranteed to be pre-authentication. Also of interest, many different devices are likely to share the same BLE chipset, meaning these vulnerabilities will show up on many different devices. [Veronica] shares some great info on how to get started, as well as the details on the vulnerabilities she found, in the PDF whitepaper. (Just a quick note, this link isn’t to the raw PDF, but pulls up a GitHub PDF viewer.) There is also a video presentation of the findings, if that’s more your speed.

The first vuln we’ll look at is CVE-2019-15948, which affects a handful of Texas Instruments BT/BLE chips. The problem is in how BLE advertisement packets are handled. An advertisement packet should always contain a data length of at least six bytes, which is reserved for the sending device address. Part of the packet parsing process is to subtract six from the packet length and do a memcpy using that value as the length. A malicious packet can have a length of less than six, and the result is that the copy length integer underflows, becoming a large value, and overwriting the current stack. To actually turn this into an exploit, a pair of data packets are sent repeatedly, to put malicious code in the place where program execution will jump to.

The second vulnerability of note, CVE-2020-15531 targets a Silicon Labs BLE chip, and uses malformed extended advertisement packets to trigger a buffer overflow. Specifically, the sent message is longer than the specification says it should be. Rather than drop this malformed message, the chip’s firmware processes it, which triggers a buffer overflow. Going a step further, this chip has non-volatile firmware, and it’s possible to modify that firmware permanently. [Veronica] points out that even embedded chips like these should have some sort of secure boot implementation, to prevent these sort of persistent attacks.
Continue reading “This Week In Security: Bluetooth Hacking, NEC Phones, And Malicious Tor Nodes” →

ESP32 Altair Emulator Gets Split Personality

August 20, 2020 by Al Williams 36 Comments

If you wanted me to demo CP/M running on an emulated Altair 8800, I’d pull out a tiny board from my pocket. You might wonder how I wound up with an Altair 8800 that runs CP/M (even WordStar), that fits in your pocket and cost less than $10. Turns out it’s a story that goes back to 1975.

When the Altair 8800 arrived back in 1975, I wanted one. Badly. I’d been reading about computers but had no hands-on experience. But back then, as far as I was concerned, the $400 price tag might as well have been a million bucks. I was working for no real pay in my family’s store, though in all fairness, adjusted into today’s money that was about $2,000.

I’d love to buy one now, but a real Altair costs even more today than it did back then. They also take up a lot of desk space. Sure, there are replicas and I’ve had a few. I even helped work the kinks out of Vince Briel’s clone which I’ve enjoyed. However, the Briel computer has two problems. First, it takes a little work to drive a serial port (it uses a VGA and a PS/2 keyboard). Second, while it’s smaller than a real Altair, it is still pretty large — a byproduct of its beautiful front panel.

So to quickly show off CP/M to someone, you need to haul out a big box and find a VGA monitor and PS/2 keyboard — both of which are becoming vanishing commodities. I made some modifications to get the serial port working, but it is still a lot to cart around. You could go the software route with a simulator like SIMH or Z80pack, but now instead of finding a VGA monitor and a PS/2 keyboard, you need to find a computer where you can install the software. What I really wanted was a simple and portable device that could boot CP/M.

Continue reading “ESP32 Altair Emulator Gets Split Personality” →

Russell Kirsch: Pixel Pioneer And The Father Of Digital Imaging

August 20, 2020 by Kristina Panos 28 Comments

It’s true what they say — you never know what you can do until you try. Russell Kirsch, who developed the first digital image scanner and subsequently invented the pixel, was a firm believer in this axiom. And if Russell had never tried to get a picture of his three-month-old son into a computer back in 1957, you might be reading Hackaday in print right now. Russell’s work laid the foundation for the algorithms and storage methods that make digital imaging what it is today.

Russell reads SEAC’s last printout. Image via TechSpot

Russell A. Kirsch was born June 20, 1929 in New York City, the son of Russian and Hungarian immigrants. He got quite an education, beginning at Bronx High School of Science. Then he earned a bachelor’s of Electrical Engineering at NYU, a Master of Science from Harvard, and attended American University and MIT.

In 1951, Russell went to work for the National Bureau of Standards, now known as the National Institutes of Science and Technology (NIST). He spent nearly 50 years at NIST, and started out by working with one of the first programmable computers in America known as SEAC (Standards Eastern Automatic Computer). This room-sized computer built in 1950 was developed as an interim solution for the Census Bureau to do research (PDF).

Standards Eastern Automatic Computer (SEAC) was the first programmable computer in the United States. Credit: NIST via Wikimedia

Like the other computers of its time, SEAC spoke the language of punch cards, mercury memory, and wire storage. Russell Kirsch and his team were tasked with finding a way to feed pictorial data into the machine without any prior processing. Since the computer was supposed to be temporary, its use wasn’t as tightly controlled as other computers. Although it ran 24/7 and got plenty of use, SEAC was more accessible than other computers, which allowed time for bleeding edge experimentation. NIST ended up keeping SEAC around for the next thirteen years, until 1963.

The Original Pixel Pusher

This photo of Russell’s son Walden is the first digitized image. Public Domain via Wikimedia

The term ‘pixel’ is a shortened portmanteau of picture element. Technically speaking, pixels are the unit of length for digital imaging. Pixels are building blocks for anything that can be displayed on a computer screen, so they’re kind of the first addressable blinkenlights.

In 1957, Russell brought in a picture of his son Walden, which would become the first digital image (PDF). He mounted the photo on a rotating drum scanner that had a motor on one end and a strobing disk on the other. The drum was coupled to a photo-multiplier vacuum tube that spun around on a lead screw. Photo-multipliers are used to detect very low levels of light.

As the drum slowly rotated, a photo-multiplier moved back and forth, scanning the image through a square viewing hole in the wall of a box. The tube digitized the picture by transmitting ones and zeros to SEAC that described what it saw through the square viewing hole — 1 for white, and 0 for black. The digital image of Walden is 76 x 76 pixels, which was the maximum allowed by SEAC.

Variable-Shaped Pixels

If Russell Kirsch had any regrets, it is that he designed pixels to be square. Ten years ago at the age of 81, he started working on a variable-shaped pixels with the hope of improving the future of digital imaging. He wrote a LISP program to explore the idea, and simulated triangular and rectangular pixels using a 6×6 array of square pixels for each.

Alternative pixel geometries. Image via Cloudseed Films

In in the video below, Russell discusses the idea and proves that variable pixels make a better image with more information than square pixels do, and with significantly fewer pixels overall. It takes some finagling, as pixel pairs of triangles and rectangles must be carefully chosen, rotated, and mixed together to best represent the image, but the image quality is definitely worth the effort. Following that is a video of Russell discussing SEAC’s hardware.

Russell retired from NIST in 2001 and moved to Portland, Oregon. As of 2012, he could be found in the occasional coffeehouse, discussing technology with anyone he could engage. Unfortunately, Russell developed Alzheimer’s and died from complications on August 11, 2020. He was 91 years old.

Continue reading “Russell Kirsch: Pixel Pioneer And The Father Of Digital Imaging” →

How To Get Into Cars: Aero Mods For More Grip

August 19, 2020 by Lewin Day 32 Comments

In 1960, Enzo Ferrari said “Aerodynamics are for people who can’t build engines”. It’s a quote that’s been proven laughably wrong in decades since. Aerodynamics are a key consideration for anyone serious about performance in almost any branch of motorsport. Today, we’ll take a look at how aero influences the performance of your car, and what modifications you might undertake to improve things.

Gains To Be Had

Improving the aerodynamics of your vehicle can mean wildly different things, depending on what your end goal is. Aerodynamics affects everything from top speed, to fuel economy, to grip, and optimizing for these different attributes can take wildly different routes. Often, it’s necessary to find a balance between several competing factors, as improvements in one area can often be detrimental in another.

To understand aerodynamics with regards to cars, we need to know about the forces of lift (or downforce), and drag. Drag is the force that acts against the direction of motion, slowing a vehicle down. Lift is the force generated perpendicular to the direction of motion. In the context of flight, the lift force is generated upwards with respect to gravity, lofting planes into the air. In an automotive context, we very much prefer to stay on the ground. Wings and aerodynamic surfaces on cars are created to create lift in the opposite direction, pushing the vehicle downwards and creating more grip. We refer to this “downwards lift” as downforce.

Continue reading “How To Get Into Cars: Aero Mods For More Grip” →

Linux-Fu: One At A Time, Please! Critical Sections In Bash Scripts

August 18, 2020 by Al Williams 12 Comments

You normally think of a critical section — that is, a piece of a program that excludes other programs from using a resource — as a pretty advanced technique. You certainly don’t often think of them as part of shell scripting but it turns out they are surprisingly useful for certain scripts. Most often, a critical section is protecting some system resource like a shared memory location, but there are cases where a shell script needs similar protection. Luckily, it is really easy to add critical sections to shell scripts, and I’ll show you how.

Sometimes Scripts Need to Be Selfish

One very common case is where you want a script to run exactly one time. If the same script runs again while the original is active, you want to exit after possibly printing a message. Another common case is when you are updating some file and you need undisturbed access while making the change.

That was actually the case that got me thinking about this. I have a script — may be the subject of a future Linux-Fu — that provides dynamic DNS by altering a configuration file for the DNS server. If two copies of the script run at the same time, it is important that only one of them does modifications. The second copy can run after the first is totally complete.

Continue reading “Linux-Fu: One At A Time, Please! Critical Sections In Bash Scripts” →

Inputs Of Interest: The Infogrip BAT Chording Keyboard

August 18, 2020 by Kristina Panos 29 Comments

I guess it shouldn’t surprise me that by researching weird and interesting keyboards, I would uncover more weird and interesting keyboards. This is the BAT personal keyboard by Infogrip, and it’s something I came across while researching the DataHand keyboard and mentally filed away as something cool to look into.

When I came across a used BAT for a reasonable price, I snagged it, even though it didn’t come with any of the manuals or software, not even a cord. Like I said, reasonable price. I looked these keyboards up and found out that you can buy them new for a lot more than what I paid.

My gently used BAT in all its angular glory.

The lowercase letter chords use either the middle thumb key or no thumb key. Image via Infogrip

So what is this thing? It’s a chording keyboard that’s meant to be used a standard PC input device by anyone who either can’t use a regular keyboard or has a need for speed. Years of research went into the BAT’s chording scheme, which was developed in conjunction with NASA’s Stennis Space Center.

Instead of stretching your fingers all over a regular keyboard, poking keys one at a time to spell out words, you press combinations of keys simultaneously, like playing chords on a piano.

You’re meant to use your thumb for the red, grey, and blue keys, and lay the other four on the rest of the keys. All of the alphabet keys are chorded with or without the gray thumb key, and all the number, symbol, and modifier keys are accessed through the red and blue layers.

Why would you want one of these? Well, given enough time to learn the chords, you can do anything a standard 104+ keyboard can do with only seven keys. You would never need to look down, not even for those weird seldom-used keys, and the only finger that ever travels is your thumb. All of this reduced hand/finger/wrist travel is going to be easier on the body.

The BAT lets you CAD like a madlad. Via Bill Buxton

The BAT is also part programmable macro pad, and from what I can gather, the main selling point was that you could quickly input shortcuts in CAD programs and the like, because you could keep one hand on the mouse.

The BAT came in both left- and right-handed versions that can be used either alone or together. Imagine how fast you could type if you chorded everything and split the typing duties between both hands! The only trouble is learning all those different finger combinations, although they say it doesn’t take that long.

So why is it called the BAT? Legend has it that it’s because company started out in Baton Rouge, Louisiana, but also because a pair of BATs sitting next to each other resembles a bat (PDF).

Continue reading “Inputs Of Interest: The Infogrip BAT Chording Keyboard” →

E3D Teaches Additive 3D-Printers How To Subtract

August 18, 2020 by Sonya Vasquez 29 Comments

We might’ve thought that extrusion based 3D printers have hit their peak in performance capabilities. With the remaining process variables being tricky to model and control, there’s only so much we can expect on dimensional accuracy from extruded plastic processes. But what if we mixed machines, adding a second machining process to give the resulting part a machined quality finish? That’s exactly what the folks at E3D have been cooking up over the last few years: a toolchanging workflow that mixes milling and 3D printing into the same process to produce buttery smooth part finishes with tighter dimensional accuracy over merely 3D printing alone.

Dubbed ASMBL (Additive/Subtractive Machining By Layer), the process is actually the merging of two complimentary processes combined into one workflow to produce a single part. Here, vanilla 3D printing does the work of producing the part’s overall shape. But at the end of every layer, an endmill enters the workspace and trims down the imperfections of the perimeter with a light finishing pass while local suction pulls away the debris. This concept of mixing og coarse and fine manufacturing processes to produce parts quickly is a re-imagining of a tried-and-true industrial process called near-net-shape manufacturing. However, unlike the industrial process, which happens across separate machines on a large manufacturing facility, E3D’s ASMBL takes place in a single machine that can change tools automatically. The result is that you can kick off a process and then wander back a few hours (and a few hundred tool changes) later to a finished part with machined tolerances.

What are the benefits of such an odd complimentary concoction, you might ask? Well, for one, truly sharp outer corners, something that’s been evading 3D printer enthusiasts for years, are now possible. Layer lines on vertical surfaces all but disappear, and the dimensional tolerances of holes increases as the accuracy of the process is more tightly controlled (or cleaned up!) yielding parts that are more dimensionally accurate… in theory.

But there are certainly more avenues to explore with this mixed process setup, and that’s where you come in. ASMBL is still early in development, but E3D has taken generous steps to let you build on top of their work by posting their Fusion 360 CAM plugin, the bill-of-materials and model files for their milling tool, and even the STEP files for their toolchanging motion system online. Pushing for a future where 3d printers produce the finer details might just be a matter of participating.

It’s exciting to see the community of 3D printer designers continue to rethink the capabilities of its own infrastructure when folks start pushing the bounds beyond pushing plastic. From homebrew headchanging solutions that open opportunity by lowering the price point, to optical calibration software that makes machines smarter, to breakaway Sharpie-assisted support material, there’s no shortage of new ideas to play with in an ecosystem of mixed tools and processes.

Have a look at ASMBL at 2:29 in their preview after the break.

Continue reading “E3D Teaches Additive 3D-Printers How To Subtract” →