This Week In Security: Three Billion SS Numbers, IPv6 RCE, And Ring -2

You may have heard about a very large data breach, exposing the Social Security numbers of three billion individuals. Now hang on. Social Security numbers are a particularly American data point, and last time we checked there were quite a few Americans shy of even a half of a billion’s worth. As [Troy Hunt] points out, there are several things about this story that seem just a bit odd.

First up, the claim is that this is data grabbed from National Public Data, and there’s even a vague notice on their website about it. NPD is a legitimate business, grabbing data on as many people as possible, and providing services like background checks and credit checks. It’s not impossible that this company has records on virtually every citizen of the US, UK, and Canada. And while that’s far less than 2.9 billion people, it could feasibly add up to 2.9 billion records as was originally claimed.

The story gets strange as we consider the bits of data that have been released publicly, like a pair of files shared with [Troy] that have names, birthdays, addresses, phone numbers, and social security numbers. Those had a total of 2.69 billion records, with an average of 3 records for each ID number. That math is still just a little weird, since the US has to date only generated 450 million SSNs and change.

So far all we have are partial datasets, and claims on the Internet. The story is that there’s a grand total of 4 TB of data once uncompressed. The rest of the details are unclear, and it’s likely to take some time for the rest of the story to come out. Continue reading “This Week In Security: Three Billion SS Numbers, IPv6 RCE, And Ring -2”

Hackaday Podcast Episode 284: Laser Fault Injection, Console Hacks, And Too Much Audio

The summer doldrums are here, but that doesn’t mean that Elliot and Dan couldn’t sift through the week’s hack and find the real gems. It was an audio-rich week, with a nifty microsynth, music bounced off the moon, and everything you always wanted to know about Raspberry Pi audio but were afraid to ask. We looked into the mysteries of waveguides and found a math-free way to understand how they work, and looked at the way Mecanum wheels work in the most soothing way possible. We also each locked in on more classic hacks, Elliot with a look at a buffer overflow in Tony Hawks Pro Skater and Dan with fault injection user a low-(ish) cost laser setup. From Proxxon upgrades to an RC submarine to Arya’s portable router build, we’ve got plenty of material for your late summer listening pleasure.

Worried about attracting the Black Helicopters? Download the DRM-free MP3 and listen offline, just in case.

Continue reading “Hackaday Podcast Episode 284: Laser Fault Injection, Console Hacks, And Too Much Audio”

FLOSS Weekly Episode 796: Homebrew, I’m More Of A Whopper Guy

This week Jonathan Bennett and David Ruggles chat with John Britton and Mike McQuaid about Homebrew! That’s the missing package manager for macOS; and Workbrew, the commercial offering built on top of it. We cover lots of territory, like why the naming scheme sounds like it was conceived during a pub visit, how Workbrew helps businesses actually use Homebrew, and why you might even want to run Homebrew on a Linux machine!

Continue reading “FLOSS Weekly Episode 796: Homebrew, I’m More Of A Whopper Guy”

Hacker Tactic: Pimp Your Probes

Is your multimeter one of your trusty friends when building up boards, repairing broken gadgets, and reverse-engineering proprietary ones? Is it accompanied by a logic analyzer or an oscilloscope at times?

Having a proper probing setup is crucial for many a task, and the standard multimeter probes just won’t do. As a PCB is slipping under your grip as you’re trying to hold the standard multimeter probes on two points at once, inevitably you will ponder whether you could be doing things differently. Here’s an assortment of probing advice I have accumulated.

Beyond The Norm

There’s the standard advice – keep your board attached firmly to a desk, we’ve seen gadgets like the Stickvise help us in this regard, and a regular lightweight benchtop vise does wonders. Same goes for using fancy needle probes that use gravity to press against testpoints – they might be expensive, but they are seriously cool, within limits, and you can even 3D-print them!

Continue reading “Hacker Tactic: Pimp Your Probes”

Portable Router Build: Picking Your CPU

I want to introduce you to a project of mine – a portable router build, and with its help, show you how you can build a purpose-built device. You might have seen portable routers for sale, but if you’ve been in the hacking spheres long enough, you might notice there are “coverage gaps”, so to speak. The Pi-hole project is a household staple that keeps being product-ized by shady Kickstarter campaigns, a “mobile hotspot” button is a staple in every self-respecting mobile and desktop OS, and “a reset device for the ISP router” is a whole genre of a hacker project. Sort the projects by “All Time” popularity on Hackaday.io, and near the very top, you will see an OpenVPN &Tor router project – it’s there for a reason, and it got into 2014 Hackaday Prize semifinals for a reason, too.

I own a bunch of devices benefitting from both an Internet connection and also point-to-point connections between them. My internet connection comes sometimes from an LTE uplink, sometimes from an Ethernet cable, and sometimes from an open WiFi network with a portal you need to click through before you can even ping anything. If I want to link my pocket devices into my home network for backups and home automation, I can put a VPN client on my laptop, but a VPN client on my phone kills its battery, and the reasonable way would be to VPN the Internet uplink – somehow, that is a feature I’m not supposed to have, and let’s not even talk about DNSSEC! Whenever I tried to use one of those portable LTE+WiFi[+Ethernet] routers and actively use it for a month or two, I’d encounter serious hardware or firmware bugs – which makes sense, they are a niche product that won’t get as much testing as phones.

Continue reading “Portable Router Build: Picking Your CPU”

Hackaday Links Column Banner

Hackaday Links: August 11, 2024

“Please say it wasn’t a regex, please say it wasn’t a regex; aww, crap, it was a regex!” That seems to be the conclusion now that Crowdstrike has released a full root-cause analysis of its now-infamous Windows outage that took down 8 million machines with knock-on effects that reverberated through everything from healthcare to airlines. We’ve got to be honest and say that the twelve-page RCA was a little hard to get through, stuffed as it was with enough obfuscatory jargon to turn off even jargon lovers such as us. The gist, though, is that there was a “lack of a specific test for non-wildcard matching criteria,” which pretty much means someone screwed up a regular expression. Outside observers in the developer community have latched onto something more dire, though, as it appears the change that brought down so many machines was never tested on a single machine. That’s a little — OK, a lot — hard to believe, but it seems to be what Crowdstrike is saying. So go ahead and blame the regex, but it sure seems like there were deeper, darker forces at work here.

Continue reading “Hackaday Links: August 11, 2024”

Better Living Through Hackery

Hackaday’s own [Arya Voronova] has been on a multi-year kick to make technology more personal by making it herself, and has just now started writing about it. Her main point rings especially true in this day and age, where a lot of the tech devices we could use to help us are instead used to spy on us or are designed to literally make us addicted to their services.

The project is at the same time impossible and simple. Of course, you are not going to be able to build a gadget that will bolster all of your (perceived or otherwise) personal weaknesses in one fell swoop. But what if you start looking at them one at a time? What if you start building up the good habits with the help of a fun DIY project?

That’s where [Arya]’s plan might just be brilliant. Because each project is supposed to be small, it forces you to focus on one specific problem, rather than getting demoralized at the impossibility of becoming “better” in some vague overall sense. Any psychologist would tell you that introspection and dividing up complex problems are the first steps. And what motivates a hacker to take the next steps? You got it, the fun of brainstorming, planning, and building a nice concrete DIY project. It’s like the ultimate motivation, Hackaday style.

And DIY solutions are a perfect match to personal problems. Nothing is so customizable as what you design and build yourself from the ground up. DIY means making exactly what you need, or at least what you think you need. Iteration, improvement, and the usual prototyping cycle applied to personal growth sounds like the ideal combo, because that’s how the tech works, and that’s also how humans work. Of course, even the coolest DIY gadget can’t instantly make you more mindful, for instance, but if it’s a tool that helps you get there, I don’t think you could ask for more.