Old Thermometer Gets New Eyes

As much as we’d like to have the right tools for the right job all of the time, sometimes our parts drawers have other things in mind. After all, what’s better than buying a new tool than building one yourself from things you had lying around? That’s at least what [Saulius] must have been thinking when he needed a thermometer with a digital output, but only had a dumb, but feature-rich, thermometer on hand.

Luckily, [Saulius] had a webcam lying around as well as an old thermometer, and since the thermometer had a LCD display it was relatively straightforward to get the camera to recognize the digits in the thermometer’s display. This isn’t any old thermometer, either. It’s a four-channel thermometer with good resolution and a number of other useful features (with an obvious lack of communications abilities), so it’s not something that he could just overlook.

Once the camera was mounted to an arm and pointed at the thermometer’s screen, an algorithm running on a computer detects polygons and reports its information into a CSV file. This process is made simpler by the fact that LCD screens like this are very predictable. From there, the data is imported into LibreOffice and various charts and graphs can be made.

Although perhaps not the most elegant of hacks, sometimes you have to work with the supplies that are on hand at the time. Sometimes the tools you need are too expensive, politically dangerous, or too impractical to obtain. To that end [Saulius]’s hack is a great example of what hacks are possible with the right mindset.

Cloudbleed — Your Credentials Cached in Search Engines

In case you are still wondering about the SHA-1 being broken and if someone is going to be spending hundreds of thousands of dollars to create a fake Certificate Authority and sniff your OkCupid credentials, don’t worry. Why spend so much money when your credentials are being cached by search engines?… Wait, what?

A serious combination of bugs, dubbed Cloudbleed by [Tavis Ormandy], lead to uninitialized memory being present in the response generated by the reverse proxies and leaked to the requester. Since these reverse proxies are shared between Cloudflare clients, this makes the problem even worst, since random data from random clients was leaking. It’s sort of like Heartbleed for HTTP requests. The seriousness of the issue can be fully appreciated in [Tavis] words:

“The examples we’re finding are so bad, I cancelled some weekend plans to go into the office on Sunday to help build some tools to cleanup. I’ve informed cloudflare what I’m working on. I’m finding private messages from major dating sites, full messages from a well-known chat service, online password manager data, frames from adult video sites, hotel bookings. We’re talking full https requests, client IP addresses, full responses, cookies, passwords, keys, data, everything.”

sexAccording to Cloudflare, the leakage can include HTTP headers, chunks of POST data (perhaps containing passwords), JSON for API calls, URI parameters, cookies and other sensitive information used for authentication (such as API keys and OAuth tokens). An HTTP request to a Cloudflare web site that was vulnerable could reveal information from other unrelated Cloudflare sites.

Adding to this problem, search engines and any other bot that roams free on the Internet, could have randomly downloaded this data. Cloudflare released a detailed incident report explaining all the technicalities of what happened and how they fixed it. It was a very quick incident response with initial mitigation in under 47 minutes. The deployment of the fix was also quite fast. Still, while reading the report, a sense that Cloudflare downplayed this issue remains. According to Cloudflare, the earliest date that this problem could have started is 2016-09-22 and the leak went on until 2017-02-18, five months, give or take.

Just to reassure the readers and not be alarmist, there is no evidence of anyone having exploiting what happened. Before public exposure, Cloudflare worked in proximity with search engines companies to ensure memory was scrubbed from search engine caches from a list of 161 domains they had identified. They also report that Cloudflare has searched the web (!), in sites like Pastebin, for signs of leaks and found none.

On the other hand, it might be very well impossible to know for sure if anyone has a chunk of this data cached away somewhere in the aether. It’s impossible to know. What we would really like to know is: does [Tavis] get the t-shirt or not?

SHAttered — SHA-1 is broken in

A team from Google and CWI Amsterdam just announced it: they produced the first SHA-1 hash collision. The attack required over 9,223,372,036,854,775,808 SHA-1 computations, the equivalent processing power as 6,500 years of single-CPU computations and 110 years of single-GPU computations. While this may seem overwhelming, this is a practical attack if you are, lets say, a state-sponsored attacker. Or if you control a large enough botnet. Or if you are just able to spend some serious money on cloud computing. It’s doable. Make no mistake, this is not a brute-force attack, that would take around 12,000,000 single-GPU years to complete.

SHA-1 is a 160bit standard cryptographic hash function that is used for digital signatures and file integrity verification in a wide range of applications, such as digital certificates, PGP/GPG signatures, software updates, backup systems and so forth. It was, a long time ago, proposed as a safe alternative to MD5, known to be faulty since 1996. In 2004 it was shown that MD5 is not collision-resistant and not suitable for applications like SSL certificates or digital signatures. In 2008, a team of researchers demonstrated how to break SSL based on MD5, using 200 Playstations 3.

Early since 2005 theoretical attacks against SHA-1 were known. In 2015 an attack on full SHA-1 was demonstrated (baptized the SHAppening). While this did not directly translate into a collision on the full SHA-1 hash function due to some technical aspects, it undermined the security claims for SHA-1. With this new attack, dubbed SHAttered, the team demonstrated a practical attack on the SHA-1 algorithm, producing two different PDF files with the same checksum.

The full working code will be released in three months, following Google’s vulnerability disclosure policy, and it will allow anyone to create a pair of PDFs that hash to the same SHA-1 sum given two distinct images and some, not yet specified, pre-conditions.

For now, recommendations are to start using SHA-256 or SHA-3 on your software. Chrome browser already warns if a website has SHA-1 certificate, Firefox and the rest of the browsers will surely follow. Meanwhile, as always, tougher times are ahead for legacy systems and IoT like devices.

Microchip Launches New Family Of PICs

Over the last few years, we’ve seen projects and products slowly move from 8-bit microcontrollers to more powerful ARM microcontrollers. The reason for this is simple — if you want to do more stuff, like an Internet-connected toaster, you need more bits, more Flash, and more processing power. This doesn’t mean 8-bit microcontrollers are dead, though. Eight bit micros are still going strong, and this week Microchip announced their latest family of 8-bit microcontrollers.

The PIC16F15386 family of microcontrollers is Microchip’s latest addition to their portfolio of 8-bit chips. This family of microcontrollers is Microchip’s ‘everything and the kitchen sink’ 8-bit offering. Other families of PICs have included features such as a complementary waveform generator, numerically controlled oscillator, a configurable logic controller, power saving functionality and the extreme low power features, but never before in one piece of silicon.

This feature-packed 8-bit includes a few new tricks not seen before in previous Microchip offerings. Of note are power management features (IDLE and DOZE modes), and a Device Information Area on the chip that contains factory-calibrated data (ADC voltage calibration and a fixed voltage reference) and an ID unique to each individual chip.

As you would expect from a new family of PICs, the 16F15386 is compatible with the MPLAB Xpress IDE and the MPLAB Code Configurator, a graphical programming environment. The products in the family range from 8-pin packages (including DIP!) with 3.5kB of program Flash to 48-pin QFPs with 28kB of program Flash. The goal for Microchip is to provide a wide offering, allowing designers to expand their builds without having to change microcontroller families.

All of these chips can be sampled now, although the lower pin count devices won’t be available through normal means until next month.

Genetically Engineered Muscle Cells Power Tiny Bio-Robots

One of the essential problems of bio-robotics is actuators. The rotors, bearings, and electrical elements of the stepper motors and other electromechanical drives we generally turn to for robotics projects are not really happy in living systems. But building actuators the way nature does it — from muscle tissue — opens up a host of applications. That’s where this complete how-to guide on building and controlling muscle-powered machines comes in.

Coming out of the [Rashid Bashir] lab at the University of Illinois at Urbana-Campaign, the underlying principles are simple, which of course is the key to their power. The technique involves growing rings of muscle tissue in culture using 3D-printed hydrogel as forms. The grown muscle rings are fitted on another 3D-printed structure, this one a skeleton with stiff legs on a flexible backbone. Stretched over the legs like rubber bands, the muscle rings can be made to contract and move the little bots around.

Previous incarnations of this technique relied on cultured rat heart muscle cells, which contract rhythmically of their own accord. That yielded motion but lacked control, so for this go-around, [Bashir] et al used skeletal muscle cells genetically engineered to contract when exposed to light. Illuminating different parts of the muscle ring lets the researchers move the bio-bots anywhere they want. They can also use electric stimulation to control the bio-bots.

The method isn’t quite at the point where home lab biohackers will start churning out armies of bio-bots. But the paper is remarkably detailed in methods and materials, from the CAD files for 3D-printing the forms and bio-bot skeletons to a complete troubleshooting guide. It’s all there, and it could be a game changer for developing the robotic surgeons of the future.

Continue reading “Genetically Engineered Muscle Cells Power Tiny Bio-Robots”

More Layoffs at MakerBot

MakerBot CEO [Nadav Goshen] announced that changes are needed to ensure product innovation and support long-term goals in a blog post published yesterday. To that end, MakerBot will reduce its staff by 30%. This follows a series of layoffs over a year ago that reduced the MakerBot workforce by 36%. With this latest series of layoffs, MakerBot has cut its workforce by over 50% in the span of two years.

In addition to these layoffs, the hardware and software teams will be combined. Interestingly, the current Director of Digital Products, [Lucas Levin], will be promoted to VP of Product. Many in the 3D printer community have speculated MakerBot is pivoting from a hardware company to a software company. [Levin]’s promotion could be the first sign of this transition.

When discussing MakerBot, many will cite the documentary Print the Legend. While it is a good introduction to the beginnings of the desktop 3D printer industry, it is by no means complete. The documentary came out too early, it really doesn’t mention the un-open sourceness of MakerBot, the lawsuit with Form Labs wasn’t covered, and there wasn’t a word on how literally every other 3D printer manufacturer is selling more printers than MakerBot right now.

Is this the end of MakerBot? No, but SYSS is back to the pre-3D-printer-hype levels. Stratasys’ yearly financial report should be out in a month or so. Last year, that report was the inspiration for the MakerBot obituary. It’s still relevant, and proving to be more and more correct, at least from where MakerBot’s Hardware business stands.

SparkFun Gets Back To Their Roots With SparkX

Way back in the before years when there were still interesting concepts for reality TV, Nate Seidle blew up a power supply in his dorm room. Instead of finding replacement parts, Nate decided to start a company. For the last decade and a half, SparkFun has grown immensely, been an incredible resource for makers and engineers alike, and shipped out hundreds of thousands of their iconic red boxes.

Being the CEO of a company means you need to do CEO stuff, and a few summers ago Nate the CEO became Nate the Engineer once again. SparkFun is still doing great, but now we know what Nate has been up to these last months. He’s getting back to SparkFun’s roots with SparkX. This is the newest stuff SparkFun has to offer, there is zero documentation or support, and they’re only developing products because Nate wants to.

In a series of blog posts on the SparkFun blog, Nate goes over what is involved in building a new brand for the latest and greatest SparkFun can produce. This involves setting up the SparkX lab, getting the OtherMills pumping out circuit boards, and  inevitably the occasional containment failure of the blue smoke.

The first product in the SparkX lineup, Product 0, is a breakout board for the MLX90393 magnetometer. This is a pretty nifty magnetometer that Ted Yapo over on hackaday.io has used to characterize magnets. Really, though, the SparkX Product 0 is exactly what it says on the tin: a breakout board that is just an experiment, comes with no guarantees or support. It is the heart of what Sparkfun set out to do twenty years ago.