how-to

899 Articles

Hardware hacking how-tos

Airport Runways And Hashtags — How To Become A Social Engineer

August 23, 2019 by 11 Comments

Of the $11.7 million companies lose to cyber attacks each year, an estimated 90% begin with a phone call or a chat with support, showing that the human factor is clearly an important facet of security and that security training is seriously lacking in most companies. Between open-source intelligence (OSINT) — the data the leaks out to public sources just waiting to be collected — and social engineering — manipulating people into telling you what you want to know — there’s much about information security that nothing to do with a strong login credentials or VPNs.

There’s great training available if you know where to look. The first time I heard about WISP (Women in Security and Privacy) was last June on Twitter when they announced their first-ever DEFCON Scholarship. As one of 57 lucky participants, I had the chance to attend my first DEFCON and Black Hat, and learn about their organization.

Apart from awarding scholarships to security conferences, WISP also runs regional workshops in lockpicking, security research, cryptography, and other security-related topics. They recently hosted an OSINT and Social Engineering talk in San Francisco, where Rachel Tobac (three-time DEFCON Social Engineering CTF winner and WISP Board Member) spoke about Robert Cialdini’s principles of persuasion and their relevance in social engineering.

Cialdini is a psychologist known for his writings on how persuasion works — one of the core skills of social engineering. It is important to note that while Cialdini’s principles are being applied in the context of social engineering, they are also useful for other means of persuasion, such as bartering for a better price at an open market or convincing a child to finish their vegetables. It is recommended that they are used for legal purposes and that they result in positive consequences for targets. Let’s work through the major points from Tobac’s talk and see if we can learn a little bit about this craft.

Continue reading “Airport Runways And Hashtags — How To Become A Social Engineer” →

Build A Fungus Foraging App With Machine Learning

August 22, 2019 by 42 Comments

As the 2019 mushroom foraging season approaches it’s timely to combine my thirst for knowledge about low level machine learning (ML) with a popular pastime that we enjoy here where I live. Just for the record, I’m not an expert on ML, and I’m simply inviting readers to follow me back down some rabbit holes that I recently explored.

But mushrooms, I do know a little bit about, so firstly, a bit about health and safety:

  • The app created should be used with extreme caution and results always confirmed by a fungus expert.
  • Always test the fungus by initially only eating a very small piece and waiting for several hours to check there is no ill effect.
  • Always wear gloves  – It’s surprisingly easy to absorb toxins through fingers.

Since this is very much an introduction to ML, there won’t be too much terminology and the emphasis will be on having fun rather than going on a deep dive. The system that I stumbled upon is called XGBoost (XGB). One of the XGB demos is for binary classification, and the data was drawn from The Audubon Society Field Guide to North American Mushrooms. Binary means that the app spits out a probability of ‘yes’ or ‘no’ and in this case it tends to give about 95% probability that a common edible mushroom (Agaricus campestris) is actually edible. 

The app asks the user 22 questions about their specimen and collates the data inputted as a series of letters separated by commas. At the end of the questionnaire, this data line is written to a file called ‘fungusFile.data’ for further processing.

XGB can not accept letters as data so they have to be mapped into ‘classic LibSVM format’ which looks like this: ‘3:218’, for each letter. Next, this XGB friendly data is split into two parts for training a model and then subsequently testing that model.

Installing XGB is relatively easy compared to higher level deep learning systems and runs well on both Linux Ubuntu 16.04 and on a Raspberry Pi. I wrote the deployment app in bash so there should not be any additional software to install. Before getting any deeper into the ML side of things, I highly advise installing XGB, running the app, and having a bit of a play with it.

Training and testing is carried out by running bash runexp.sh in the terminal and it takes less than one second to process the 8124 lines of fungal data. At the end, bash spits out a set of statistics to represent the accuracy of the training and also attempts to ‘draw’ the decision tree that XGB has devised. If we have a quick look in directory ~/xgboost/demo/binary_classification, there should now be a 0002.model file in it ready for deployment with the questionnaire.

I was interested to explore the decision tree a bit further and look at the way XGB weighted different characteristics of the fungi. I eventually got some rough visualisations working on a Python based Jupyter Notebook script:

 

 

 

 

 

 

 

Obviously this app is not going to win any Kaggle competitions since the various parameters within the software need to be carefully tuned with the help of all the different software tools available. A good place to start is to tweak the maximum depth of the tree and the number or trees used. Depth = 4 and number = 4 seems to work well for this data. Other parameters include the feature importance type, for example: gain, weight, cover, total_gain or total_cover. These can be tuned using tools such as SHAP.

Finally, this app could easily be adapted to other questionnaire based systems such as diagnosing a particular disease, or deciding whether to buy a particular stock or share in the market place.

An even more basic introduction to ML goes into the baseline theory in a bit more detail – well worth a quick look.

Turning Scrap Metal Into Something To Work With

August 18, 2019 by 19 Comments

Blacksmiths will frequently work to a customer’s commission, and sometimes those commissions can be somewhat unusual. [Copperrein] had just such a piece of work come his way, a ceremonial sword to be made from a supplied collection of iron and steel items. To render them into something useful he had to melt them together, and the story of how he did that is particularly interesting.

We’re introduced to the Aristotle furnace, a fairly simple top-fed air blast charcoal furnace capable of melting almost any ferrous scrap into a so-called “bloom”, a lump of iron with some slag and carbon inclusions. These furnaces are often built as holes in the ground, but he’s made his atop a portable forge at working height to save bending over it for seven hours.

The source material was a very mixed bag, so the first order was to strip it in an acid bath of any coatings which might contaminate the resulting bloom. The parts, including things as diverse as a huge wrought-iton bolt, a scythe blade, and a pair of dividers, were then cut into small pieces one by one and fed into the furnace. They melt as they progress down through the furnace, resulting in a bloom of iron. The bloom is impure and will need significant working to expel any inclusions, but the final result will be something like the wrought iron of old. Let’s hope he has a power hammer, working the bloom would be hard work by hand!

If this catches your attention, you may be interested in a bit of blast furnace iron smelting. And of course, there is also our ongoing blacksmithing series to get you going at the anvil. You could even make a nail.

Via Reddit.

Thanks [Mike] for the tip.

Spin Me Right Round, Baby: Generator Building Experiments For Mere Mortals

August 13, 2019 by 38 Comments

How many of you plan to build a wind-powered generator in the next year? Okay, both of you can put your hands down. Even if you don’t want to wind your coils manually, learning about the principles in an electric generator might spark your interest. There is a lot of math to engineering a commercial model, but if we approach a simple version by looking at the components one at a time, it’s much easier to understand.

For this adventure, [K&J Magnetics] start by dissect a commercial generator. They picked a simple version that might serve a campsite well, so there is no transmission or blade angle apparatus to complicate things. It’s the parts you’d expect, a rotor and a stator, one with permanent magnets and the other with coils of wire.

The fun of this project is copying the components found in the commercial hardware and varying the windings and coil count to see how it affects performance. If you have ever wound magnet wire around a nail to make an electromagnet, you know it is tedious work so check out their 3D printed coil holder with an embedded magnet to trigger a winding count and a socket to fit on a sewing machine bobbin winder. If you are going to make a bunch of coils, this is going to save headaches and wrist tendons.

They use an iterative process to demonstrate the effect of multiple coils on a generator. The first test run uses just three coils but doesn’t generate much power at all, even when spun by an electric drill. Six windings do better, but a dozen finally does the trick, even when turning the generator by hand. We don’t know about their use of cheap silicone diodes though, that seems like unintentional hobbling, but we digress.

Making turbine blades doesn’t have to be a sore chore either, and PVC may be the ticket there, you may also consider the vertical axis wind turbine which is safer at patio level. Now, you folks building generators, remember to tip us off!

Continue reading “Spin Me Right Round, Baby: Generator Building Experiments For Mere Mortals” →

That E-Cig Battery Probably Fits Into Sunglasses

August 12, 2019 by 20 Comments
This particular e-cigarette is a little bigger than a typical cigarette, with a matching battery.

E-cigarettes use electrical power to rapidly heat and vaporize a base liquid such as propylene glycol, and that power comes from a battery. These devices are functionally straightforward but it can be a messy process on the inside. Thankfully though the batteries can be salvaged once components like heating elements either gum up or burn out.

[facelesstech] decided to use the battery from an e-cig as the power source for a smart sunglasses project, which uses two RGB LED rings to put on a light show. Opening up the device it was discovered that the battery was a straightforward lithium-polymer cell, in AAAA size. If you’ve ever torn open a 9 v battery and discovered the six diminutive cylinders inside, an AAAA cell is about the same size as one of those. However, the battery from the e-cig is both rechargeable and has a nominal voltage of 3.7 volts, which can happily drive a microcontroller project. The small battery fit nicely into one arm of the glasses, and when covered with heat-shrink, was hardly noticeable. The battery charger doesn’t fit inside the glasses, but one can’t have everything.

The ability of an e-cigarette to pump out clouds of vapor has led to some interesting hacks. One such is a DIY portable fog machine, which opens all kinds of doors for costuming applications.

Preserved Lemons On A Hacker’s Budget

August 6, 2019 by 15 Comments

“If you wish to make an apple pie from scratch, you must first invent the universe.” [Carl Sagan]. If you wish to make preserved lemons the same way as [Uri Tuchman], you have to start with that mentality. Video also below. The recipe for [Uri]’s preserved lemons involves two ingredients see sea salt, and sliced lemons, but we don’t expect you came here looking for a recipe and the food is less important than the journey.

Recipes take for granted that we have all the necessary utensils on hand, but what if you are missing one? What if you are missing all of them? Life’s lemons won’t get the best of us, and if we’re utensil-poor and tool-rich we will make those lemons regret trying to take a bite out of us. The first fixture for cutting lemons is a cutting board, then a knife, and finally an airtight container. We see him make all of them from stock material by hand. Does that seem like a lot of work? You forgot that if you’re going to eat up, you’ll need a serving platter and fork. If he ever opens a restaurant, don’t expect it to be fast food.

Maybe humans will only need one tool in the kitchen someday but at least one cat receives food from a single silicone-brained tool.

Continue reading “Preserved Lemons On A Hacker’s Budget” →

A New KiCAD Tutorial Hits The Scene

July 29, 2019 by 42 Comments

KiCAD has a rightfully earned image problem regarding beginners. The shiny new version 5 has improved things (and we’re very excited for v6!) but the tool is a bit obtuse even when coming from a electronics design background, so we’re always excited to see new learning material. [Mike Watts] is the latest to join the esteemed group of people willing to export their knowledge with his KiCAD tutorial series on GitHub that takes the aspiring user from schematic through fab and assembly.

The tutorial is focused around the process of creating a development board for the dimuitive Microchip née Atmel ATSAMD10 Cortex M0 ARM CPU. It opens by asking the reader to create a schematic and proceeds to teach by directing them to perform certain actions then explaining what’s going on and which shortcuts can accelerate things. This method continues through layout, manufacturing, and assembly.

Of note is that when defining the board outline [Mike] describes how to use OpenSCAD to parametrically define it; a neat micro-tutorial on using the two great tools to compliment each other. We also love that upon successful completion of the tutorial series the user will have developed a tiny but useful development board that can be assembled for about $3 in single quantities!

As with all open source work, if you have quibbles or want to contribute open a pull request and give [Mike] a hand!