This Week In Security: What’s Up With Whatsapp, Windows XP Patches, And Cisco Is Attacked By The Thrangrycat

May 21, 2019 by Jonathan Bennett 21 Comments

Whatsapp allows for end-to-end encrypted messaging, secure VoIP calls, and until this week, malware installation when receiving a call. A maliciously crafted SRTCP connection can trigger a buffer overflow, and execute code on the target device. The vulnerability was apparently found first by a surveillance company, The NSO Group. NSO is known for Pegasus, a commercial spyware program that they’ve marketed to governments and intelligence agencies, and which has been implicated in a number of human rights violations and even the assassination of Jamal Khashoggi. It seems that this Whatsapp vulnerability was one of the infection vectors used by the Pegasus program. After independently discovering the flaw, Facebook pushed a fixed client on Monday.

Windows XP Patched Against Wormable Vulnerability

What year is it!? This Tuesday, Microsoft released a patch for Windows XP, five years after support for the venerable OS officially ended. Reminiscent of the last time Microsoft patched Windows XP, when Wannacry was the crisis. This week, Microsoft patched a Remote Desktop Protocol (RDP) vulnerability, CVE-2019-0708. The vulnerability allows an attacker to connect to the RDP service, send a malicious request, and have control over the system. Since no authentication is required, the vulnerability is considered “wormable”, or exploitable by a self-replicating program.

Windows XP through Windows 7 has the flaw, and fixes were rolled out, though notably not for Windows Vista. It’s been reported that it’s possible to download the patch for Server 2008 and manually apply it to Windows Vista. That said, it’s high time to retire the unsupported systems, or at least disconnect them from the network.

The Worst Vulnerability Name of All Time

Thrangrycat. Or more accurately, “😾😾😾” is a newly announced vulnerability in Cisco products, discovered by Red Balloon Security. Cisco uses secure boot on many of their devices in order to prevent malicious tampering with device firmware. Secure boot is achieved through the use of a secondary processor, a Trust Anchor module (TAm). This module ensures that the rest of the system is running properly signed firmware. The only problem with this scheme is that the dedicated TAm also has firmware, and that firmware can be attacked. The TAm processor is actually an FPGA, and researchers discovered that it was possible to modify the FPGA bitstream, totally defeating the secure boot mechanism.

The name of the attack, thrangrycat, might be a satirical shot at other ridiculous vulnerability names. Naming issues aside, it’s an impressive bit of work, numbered CVE-2019-1649. At the same time, Red Balloon Security disclosed another vulnerability that allowed command injection by an authenticated user.

Odds and Ends

Google discovered that their Bluetooth Security Keys use Bluetooth, and maybe that’s not a great idea.
Our own Bob Baddeley finally put the Supermicro server story to bed, probably.
Fifty year old aviation technology is hackable, but probably won’t be.

See a security story you think we should cover? Drop us a note in the tip jar!

Flexible PCBs Hack Chat With OSH Park

May 20, 2019 by Dan Maloney No comments

Join us Thursday at noon Pacific time for the Flexible PCBs Hack Chat with Drew and Chris from OSH Park!
Note the different day from our usual Hack Chat schedule!
Printed circuit boards have been around for decades, and mass production of them has been an incalculable boon to the electronics industry. But turning the economics of PCB production around and making it accessible to small-scale producers and even home experimenters is a relatively recent development, and one which may have an even broader and deeper impact on the industry in the long run.

And now, as if professional PCBs at ridiculous prices weren’t enough, the home-gamer now has access to flexible PCBs. From wearables to sensor applications, flex PCBs have wide-ranging applications and stand to open up new frontiers to the hardware hacker. We’ve even partnered with OSH Park in the Flexible PCB Contest, specifically to stretch your flexible wings and get you thinking beyond flat, rigid PCBs.

Our Hack Chats are live community events in the Hackaday.io Hack Chat group messaging. This week we’ll be sitting down on Thursday, May 23 at 12:00 PM Pacific time. If time zones have got you down, we have a handy time zone converter.

Click that speech bubble to the right, and you’ll be taken directly to the Hack Chat group on Hackaday.io. You don’t have to wait until Thursday; join whenever you want and you can see what the community is talking about.

Hackaday Links: May 19, 2019

May 19, 2019 by Brian Benchoff 16 Comments

Cheap nostalgia, that’s the name of the game. If you can somehow build and ship ‘cheap nostalgia’, you’re going to be raking in the bucks. For the ‘musicians’ in the crowd, the king of cheap nostalgia has something great. Behringer is cloning the Yamaha CS-80. and it was announced at this month’s Superbooth.

The Yamaha CS-80 is the synth in Blade Runner, and since Toto’s Africa is making a comeback on top-40 radio, it’s the instrument of our time. A Wonderful Christmas Time, it seems. Aaaannnyway, yes, there might be a huge and inexpensive version of one of the greatest synthesizers ever made real soon. The cheap 808s and 909s are making their way to stores soon, and the 101 needs a firmware update but you can buy it now. Cheap nostalgia. That’s how you do it.

The PiDP-11/70 is a project we’ve been neglecting for some time, which is an absolute shame. This is a miniature simulation of what is objectively the best-looking minicomputer of all time, the PDP-11/70. This version is smaller, though, and it runs on a Pi with the help of SimH. There are injection molded switches, everything is perfect, and now there are a whole bunch of instructional videos on how to get a PiDP-11/70 up and running. Check it out, you want this kit.

Considering you can put a phone screen in anything, and anyone can make a keyboard, it’s a wonder no one is making real, well-designed palmtop computers anymore. The Vaio P series of PCs would be great with WiFi, Bluetooth, and a slight upgrade in memory and storage. This was [NFM[‘s recent project. This palmtop gets an SSD. The object of modification is a decade-old Sony Vaio CPCP11 palmtop modified with a 256 GB SSD. The Vaio only supports PATA, and the SSD is mSATA, so this is really a project of many weird adapters that also have to be built on flex connectors.

Here’s something for the brain trust in the Hackaday comments. First, take a look at this picture. It’s the inside of a rotary encoder. On the top, you have a Gray code (or what have you) that tracks the absolute position of a shaft. On the bottom, you have some sort of optical detection device with 13 photodiodes (or something) that keeps track of each track in the Gray code. This is then translated to some output, hopefully an I2C bus. What is this device, circled in red? I know what it is — it’s an optical decoder, but that phrase is utterly ungooglable, unmouserable, and undigikeyable. If you were me, what would you use to build your own custom absolute rotary encoder and you only needed the sensor? I technically only need 10 tracks/sensors/resolution of 1024, but really I only need a name.

Lol, someone should apply to Y Combinator and pitch yourself as a B Corp.

The $50 Ham: Dummy Loads, Part 2

May 17, 2019 by Dan Maloney 21 Comments

In the last installment of “The $50 Ham” I built a common tool used by amateur radio operators who are doing any kind of tuning or testing of transmitters: a dummy load. That build resulted in “L’il Dummy”, a small dummy load intended for testing typical VHF-UHF handy talkie (HT) transceivers, screwing directly into the antenna jack on the radio.

As mentioned in the comments by some readers, L’il Dummy has little real utility. There’s actually not much call for a dummy load that screws right into an HT, and it was pointed out that a proper dummy load is commercially available on the cheap. I think the latter observation is missing the point of homebrewing specifically and the Hackaday ethos in general, but I will concede the former point. That’s why at the same time I was building L’il Dummy, I was building the bigger, somewhat more capable version described here: Big Dummy.

Continue reading “The $50 Ham: Dummy Loads, Part 2” →

Hackaday Podcast 019: Extreme Clock Accuracy, Mobius Gears And Planetary Stunts, Jamming All Fobs, Pi In Your Wii

May 17, 2019 by Mike Szczys 4 Comments

Join Mike Szczys and Elliot Williams as they riff on the coolest hacks from the past week. Clocks and 3D printing seem to keep coming up this week as we look at using an FPGA plus GPS receiver for better accuracy than we’re used to, and we haggle over what to call the robot arms that nudge the hands on a shelf-clock. There’s a wicked 3D-printed planetary gear design, and brackets that turn flat cardboard into boxes (more useful than you might think). We close out with great reads on the Supermicro fallout of the last 7 months, and a pretty big oops-moment as a hacker knocks out keyfobs for an entire neighborhood.

Take a look at the links below if you want to follow along, and as always, tell us what you think about this episode in the comments!

Direct download (60 MB or so.)

Continue reading “Hackaday Podcast 019: Extreme Clock Accuracy, Mobius Gears And Planetary Stunts, Jamming All Fobs, Pi In Your Wii” →

Fun With Negative Resistance II: Unobtanium Russian Tunnel Diodes

May 16, 2019 by Ted Yapo 24 Comments

In the first part of this series, we took a look at a “toy” negative-differential-resistance circuit made from two ordinary transistors. Although this circuit allows experimentation with negative-resistance devices without the need to source rare parts, its performance is severely limited. This is not the case for actual tunnel diodes, which exploit quantum tunneling effects to create a negative differential resistance characteristic. While these two-terminal devices once ruled the fastest electronic designs, their use has fallen off dramatically with the rise of other technologies. As a result, the average electronics hacker probably has never encountered one. That ends today.

Due to the efficiencies of the modern on-line marketplace, these rare beasts of the diode world are not completely unobtainable. Although new-production diodes are difficult for individuals to get their hands on, a wide range of surplus tunnel diodes can still be found on eBay for as little as $1 each in lots of ten. While you’d be better off with any number of modern technologies for new designs, exploring the properties of these odd devices can be an interesting learning experience.

For this installment, I dug deep into my collection of semiconductor exotica for some Russian 3И306M gallium arsenide tunnel diodes that I purchased a few years ago. Let’s have a look at what you can do with just a diode — if it’s the right kind, that is.

[Note: the images are all small in the article; click them to get a full-sized version]

Continue reading “Fun With Negative Resistance II: Unobtanium Russian Tunnel Diodes” →

2019 Cornell Cup Winners Include Autonomous Boat, Flapping UAV, And Leaping Rover

May 15, 2019 by Tom Nardi 5 Comments

For college-aged engineers and designers, finding a problem they’re truly passionate about early on could very well set the trajectory for an entire career. This is precisely the goal of the Cornell Cup, a competition that tasks applicants with solving a real-world problem in a unique and interesting way. From what we saw this is definitely working, as teams showed up with ornithopter-based quadcopters, robotic dinghies, forest fire sniffers, and high-jumping rovers.

With such an open ended approach, individual entries have a tendency to vary wildly, running the gamut from autonomous vehicles to assistive technology. No team feels pressured to pursue a project they aren’t truly invested in, and everyone’s the better for it.

Given such lofty goals, Hackaday was proud to sponsor the 2019 Cornell Cup. Especially as it so closely aligns with the product design focus of this year’s Hackaday Prize. Designing something which solves a real-world problem is definitely part of the formula when the goal is to reach large scale production. And after seeing the entries first-hand during the Finals at Kennedy Space Center, we think every one of them would be a fantastic entry into the Hackaday Prize.

I don’t envy the judges who ultimately had to narrow it down to just a few teams to take home their share of the nearly $20,000 awarded. Join me after the break for a closer look at the projects that ended up coming out on top.

Continue reading “2019 Cornell Cup Winners Include Autonomous Boat, Flapping UAV, And Leaping Rover” →