This Week In Security: Ubiquity Update, PHP Backdoor, And Netmask

April 2, 2021 by Jonathan Bennett 11 Comments

Back in January, we covered the news that Ubiquiti had a breach of undisclosed severity. One reader pointed out the compromise of a handful of devices as potentially related. With no similar reports out there, I didn’t think too much of it at the time. Now, however, a whistleblower from Ubiquiti has given Krebs the juicy details.

The “third party cloud provider” the original disclosure referred to was Amazon Web Services (AWS). According to the whistleblower, just about everything was accessible, including the keys to log in to any Ubiquiti device on the internet, so long as it was cloud enabled. The attackers installed a couple of backdoors in Ubiquiti’s infrastructure, and sent a 50 bitcoin blackmail threat. To their credit, Ubiquiti ignored the blackmail and cleaned up the mess.

To the claim that there was no evidence attackers had accessed user accounts, it seems that the database in question simply has no logging enabled. There was no evidence, because nothing was watching. So far, I’ve only seen the one report of device compromise that was potentially a result of the attack. If you had a Ubiquiti device go rogue around December 2020 – January 2021, be sure to let us know. Continue reading “This Week In Security: Ubiquity Update, PHP Backdoor, And Netmask” →

NFTs Are The Hope For A New Tomorrow!

April 1, 2021 by Jenny List 54 Comments

Here at Hackaday, we’re always working as hard as we can to bring you the latest and most exciting technologies, and like so many people we’ve become convinced that the possibilities offered by the rise of the Blockchain present unrivaled opportunities for humanity to reinvent itself unfettered by the stifling regulations of a dying system. This is why today we’ve decided to join in with the digital cognoscenti and celebrities embracing Non-Fungible Tokens, or NFTs, as a new promise of non-corporeal digital investment cryptoasset that’s taking the world by storm.

Crypto Non-Fungible Investment Gains!

Imagine for a minute, yourself owning a very expensive car. Skievl, CC BY-SA 4.0.

An NFT is a digital token representing something in the real world, and coupled to a unique ID held in a secure entry in the Blockchain. It’s non-fungible, which means that it’s unique and not interchangeable in the manner of a traditional old-style cryptoasset such as Bitcoin. As it allows a real-world object to be tokenised in digital form it represents a way to own something that provides an irrefutable connection to it as as a digital cryptoasset.

It’s a complex system that’s maybe too difficult to explain fully in a single article, but think of an NFT as a way to invest in a cryptoasset in digital form with its uniqueness guaranteed by Blockchain security, without having the inconvenience of physically owning it. Instead your NFT is safely held on a server on the Internet, and can’t be physically stolen as it would from a bank vault because it has the Blockchain cryptosecurity baked in.

Non Fungible Blockchain Cryptoassets!

You don't own this. Yet. — You don’t own this. Yet.

NFTs have so far found a space in the creative markets, where they have provided a revolutionary opportunity for artists to expand their sales in the digital realm by selling NFTs of their work. A struggling artist can now access buyers all over the world, who can in turn now invest with confidence in creative talent to which they would never otherwise be exposed. It’s a win-win situation in which both cryptoinvestor and artist benefit from The Power of the Blockchain.

Hackaday is excited to offer a once-in-a-lifetime chance to acquire a Blockchain-cryptosecured NFT representing one of our own articles; our first ever NFT is the only officially sanctioned digital copy of a Hackaday article presenting a novel method of handling toilet paper shortages. The original article will continue to exist on Hackaday.com with all rights reserved, but we will not make any other NFTs of it. We may also decide to update the original article to let everyone know you are the lucky owner of the only digital copy of this piece of greatness. That’s right, this NFT will let you prove you own a screenshot!

Having today sold you on the incredible cryptoinvestment opportunity offered by NFTs, we’ll be back on another date with a more sober and in-depth technical examination of the technology behind them. Meanwhile should our brief foray into NFTs garner any interest (and we really hope it does not), we will donate proceeds to the excellent Girls Who Code, a truly solid investment with a tangible bright future.

Thanks [Micah Scott] for some NFT consultancy during the making of this piece.

Direct Memory Access: Data Transfer Without Micro-Management

March 31, 2021 by Maya Posch 16 Comments

In the most simple computer system architecture, all control lies with the CPU (Central Processing Unit). This means not only the execution of commands that affect the CPU’s internal register or cache state, but also the transferring of any bytes from memory to to devices, such as storage and interfaces like serial, USB or Ethernet ports. This approach is called ‘Programmed Input/Output’, or PIO, and was used extensively into the early 1990s for for example PATA storage devices, including ATA-1, ATA-2 and CompactFlash.

Obviously, if the CPU has to handle each memory transfer, this begins to impact system performance significantly. For each memory transfer request, the CPU has to interrupt other work it was doing, set up the transfer and execute it, and restore its previous state before it can continue. As storage and external interfaces began to get faster and faster, this became less acceptable. Instead of PIO taking up a few percent of the CPU’s cycles, a big transfer could take up most cycles, making the system grind to a halt until the transfer completed.

DMA (Direct Memory Access) frees the CPU from these menial tasks. With DMA, peripheral devices do not have to ask the CPU to fetch some data for them, but can do it themselves. Unfortunately, this means multiple systems vying for the same memory pool’s content, which can cause problems. So let’s look at how DMA works, with an eye to figuring out how it can work for us.
Continue reading “Direct Memory Access: Data Transfer Without Micro-Management” →

Hershey Fonts: Not Chocolate, The Origin Of Vector Lettering

March 30, 2021 by Chris Lott 57 Comments

Over the past few years, I kept bumping into something called Hershey fonts. After digging around, I found a 1967 government report by a fellow named Dr. Allen Vincent Hershey. Back in the 1960s, he worked as a physicist for the Naval Weapons Laboratory in Dahlgren, Virginia, studying the interaction between ship hulls and water. His research was aided by the Naval Ordnance Research Calculator (NORC), which was built by IBM and was one of the fastest computers in the world when it was first installed in 1954.

The NORC’s I/O facilities, such as punched cards, magnetic tape, and line printers, were typical of the era. But the NORC also had an ultra-high-speed optical printer. This device had originally been developed by the telecommunications firm Stromberg-Carlson for the Social Security Administration in order to quickly print massive amounts of data directly upon microfilm.

Continue reading “Hershey Fonts: Not Chocolate, The Origin Of Vector Lettering” →

Physics Of Lightning Hack Chat

March 29, 2021 by Dan Maloney 2 Comments

Join us on Wednesday, March 31 at noon Pacific for the Physics of Lightning Hack Chat with Greg Leyh!

Of all the things that were around to terrify our ancestors, lightning must have been right up there on the list. Sure, the savannahs were teeming with things that wanted to make lunch out of you, but to see a streak of searing blue-white light emerge from a cloud to smite a tree out of existence must have been a source of dread to everyone. Even now, knowing much more about how lightning happens and how to protect ourselves from it, it’s still pretty scary stuff to be around.

But for as much as we know about lightning, there are plenty of unanswered questions about its nature. To get to the bottom of this, Greg Leyh wants to build a lightning machine of gargantuan proportions: a pair of 120 foot (36 m) tall Tesla towers. Each 10-story tower will generate 8.8 million volts and recreate the conditions inside storm clouds. It’s an ambitious goal, but Greg and his team at Lightning on Demand have already built and demonstrated a 1/3-scale prototype Tesla tower, which is impressively powerful in its own right.

As you can imagine, there are a ton of engineering details that have to be addressed to make a Tesla tower work, not to mention the fascinating physics going on inside a machine like this. Greg will stop by the Hack Chat to answer our questions about the physics of lightning, as well as the engineering needed to harness these forces and call the lightning down from the sky.

Our Hack Chats are live community events in the Hackaday.io Hack Chat group messaging. This week we’ll be sitting down on Wednesday, March 31 at 12:00 PM Pacific time. If time zones have you tied up, we have a handy time zone converter.

Click that speech bubble to the right, and you’ll be taken directly to the Hack Chat group on Hackaday.io. You don’t have to wait until Wednesday; join whenever you want and you can see what the community is talking about.
Continue reading “Physics Of Lightning Hack Chat” →

Wet Country Wireless; How The British Weather Killed A Billion Pound Tech Company

March 29, 2021 by Jenny List 51 Comments

A dingy and cold early February in a small British town during a pandemic lockdown is not the nicest time and place to take your exercise, but for me it has revived a forgotten memory and an interesting tale of a technology that promised a lot but delivered little. Walking through an early-1990s housing development that sprawled across the side of a hill, I noticed a couple of houses with odd antennas. Alongside the usual UHF Yagis for TV reception were small encapsulated microwave arrays about the size of a biscuit tin. Any unusual antenna piques my interest but in this case, though they are certainly unusual, I knew immediately what they were. What’s more, a much younger me really wanted one, and only didn’t sign up because their service wasn’t available where I lived.

All The Promise…

Ionica was a product of Cambridge University’s enterprise incubator, formed at the start of the 1990s with the aim of being the first to provide an effective alternative to the monopolistic British Telecom in the local loop. Which is to say that in the UK at the time the only way to get a home telephone line was to go through BT because they owned all the telephone wires, and it was Ionica’s plan to change all that by supplying home telephone services via microwave links.

Their offering would be cheaper than BT’s at the socket because no cable infrastructure would be required, and they would aim to beat the monopoly on call costs too. For a few years in the mid 1990s they were the darling of the UK tech investment world, with a cutting edge prestige office building just outside Cambridge, and TV adverts to garner interest in their product. The service launched in a few British towns and cities, and then almost overnight they found themselves in financial trouble and were gone. After their demise at the end of 1998 the service was continued for a short while, but by the end of the decade it was all over. Just what exactly happened?

Continue reading “Wet Country Wireless; How The British Weather Killed A Billion Pound Tech Company” →

Hackaday Links: March 28, 2021

March 28, 2021 by Dan Maloney 17 Comments

If you thought the global shortage of computer chips couldn’t get any worse, apparently you weren’t counting on 2021 looking back at 2020 and saying, “Hold my beer.” As if an impacted world waterway and fab fires weren’t enough to squeeze supply chains, now we learn that water restrictions could potentially impact chip production in Taiwan. The subtropical island usually counts on three or four typhoons a year to replenish its reservoirs, but 2020 saw no major typhoons in the region. This has plunged Taiwan into its worst drought since the mid-1960s, with water-use restrictions being enacted. These include a 15% reduction of supply to industrial users as well as shutting off the water entirely to non-industrial users for up to two days a week. So far, the restrictions haven’t directly impacted chip and display manufacturers, mostly because their fabs are located outside the drought zone. But for an industry where a single fab can use millions of gallons of water a day, it’s clearly time to start considering what happens if the drought worsens.

Speaking of the confluence of climate and technology, everyone problem remembers the disastrous Texas cold snap from last month, especially those who had to endure the wrath of the unusually brutal conditions in person. One such victim of the storm is Grady, everyone’s favorite YouTube civil engineer, who recently released a very good post-mortem on the engineering causes for the massive blackouts experienced after the cold snap. In the immediate aftermath of the event, we found it difficult to get anything approaching in-depth coverage on its engineering aspects — our coverage excepted, naturally — as so much of what we found was laden with political baggage. Grady does a commendable job of sticking to the facts as he goes over the engineering roots of the disaster and unpacks all the complexity of the infrastructure failures we witnessed. We really enjoyed his insights, and we wish him and all our friends in Texas the best of luck as they recover.

If you’re into the demoscene, chances are pretty good that you already know about the upcoming Revision 2021, the year’s big demoscene party. Like last year’s Revision, this will be a virtual gathering, but it seems like we’re all getting pretty used to that by now. The event is next weekend, so if you’ve got a cool demo, head over and register. Virtual or not, the bar was set pretty high last year, so there should be some interesting demos that come out of this year’s party.

Many of us suffer from the “good enough, move on” mode of project management, leaving our benches littered with breadboarded circuits that got far enough along to ~~bore the hell out of us~~ make a minimally useful contribution to the overall build. That’s why we love it when we get the chance to follow up on a build that has broken from that mode and progressed past the point where it originally caught our attention. A great example is Frank Olsen’s all-wood ribbon microphone. Of course, with magnets and an aluminum foil ribbon element needed, it wasn’t 100% wood, but it still was an interesting build when we first spied it, if a bit incomplete looking. Frank has fixed that in grand style by continuing the wood-construction theme that completes this all-wood replica of the iconic RCA Model 44 microphone. It looks fabulous and sounds fantastic; we can’t help but wonder how many times Frank glued his fingers together with all that CA adhesive, though.

Continue reading “Hackaday Links: March 28, 2021” →