This Week In Security: Vulnerable Boxes, Government Responses, And New Tools

April 8, 2022 by Jonathan Bennett 1 Comment

The Cyclops Blink botnet is thought to be the work of an Advanced Persistent Threat (APT) from Russia, and seems to be limited to Watchguard and Asus devices. The normal three and four letter agencies publicized their findings back in February, and urged everyone with potentially vulnerable devices to go through the steps to verify and disinfect them if needed. About a month later, in March, over half the botnet was still online and functioning, so law enforcement took a drastic step to disrupt the network. After reverse-engineering the malware itself, and getting a judge to sign off on the plan, the FBI remotely broke in to 13 of the Watchguard devices that were working as Command and Control nodes. They disinfected those nodes and closed the vulnerable ports, effectively knocking a very large chunk of the botnet offline.

The vulnerability in WatchGuard devices that facilitated the Botnet was CVE-2022-23176, a problem where an “exposed management access” allowed unprivileged users administrative access to the system. That vague description sounds like either a debugging interface that was accidentally included in production, or a flaw in the permission logic. Regardless, the problem was fixed in a May 2021 update, but not fully disclosed. Attackers apparently reversed engineered the fix, and used it to infect and form the botnet. The FBI informed WatchGuard in November 2021 that about 1% of their devices had been compromised. It took until February to publish remediation steps and get a CVE for the flaw.

This is definitely non-ideal behavior. More details and a CVE should have accompanied the fix back in May. As we’ve observed before, obscurity doesn’t actually prevent sophisticated actors from figuring out vulnerabilities, but it does make it harder for users and security professionals to do their jobs. Continue reading “This Week In Security: Vulnerable Boxes, Government Responses, And New Tools” →

AARP Swipes Right On Senior Social Network

April 1, 2022 by Kristina Panos 19 Comments

Can you believe that Facebook turns 18 this year? One of the troubled teenager’s biggest problems is that not only are the young people still leaving in droves, many of the remaining denizens are 50 or over and susceptible to the various predators and sources of misinformation that plague the site.

Well, AARP wants to change the landscape of social media for those who are approaching or already living out their twilight years. Basically, they want to lure them away from Facebook. The organization spent untold amounts of money creating Senior Planet Community, which is kind of like a baby version of reddit in that the site is broken into interest categories such as photography, gardening, pets, and fitness enthusiasts.

The site was developed by Older Adults Technology Service (OATS), who are an AARP affiliate. OATS were leading computer classes for seniors and moved online during the pandemic, and the idea grew from there.

The main difference is that Senior Planet Community is absolutely free (for now, at least), including a complete lack of advertisements. If Grandma’s gonna unwittingly spend hundreds on micro-transactions, it won’t be taking place here, and not just because there’s no mobile app or games just yet. As far as moderation, there’s a long list of house rules that involve courtesy and encourage the citing of sources. Posts can be reported should they violate the rules.

We’ll see how it goes. There are plenty of bad actors that could pretend to be age 50+, or don’t even have to lie about it. We also wonder how long they’ll be able to go without advertisers.

We’re all getting older, including Zuckerberg. Don’t believe it? Here’s video proof.

Main and thumbnail images via Unsplash.

This Week In Security: More State-Sponsored Activity, Spring4Shell

April 1, 2022 by Jonathan Bennett 4 Comments

[Editor’s note: There is a second, fake iteration of this column out today. This is obviously the real column.]

An alert from CISA, combined with an unsealed pair of indictments, sheds some new light on how Russian hackers pursue high-value targets. The key malware here is Triton, essentially a rootkit designed for the Tricon safety systems, widely deployed at refineries and other infrastructure facilities. One of the early deployments of this was to a Saudi oil plant in 2017. This deployment seems to have been botched, as it caused malfunctions and shut the plant down for about a week.

The new information is confirmation that the same operators, out of the “Central Scientific Research Institute of Chemistry and Mechanics”, attempted to target US facilities with the same campaign. The Wired coverage initially struck me as odd, as it detailed how these Russian attackers researched US refineries, looking for the most promising targets. How exactly did US intelligence agencies know about the research habits of agents in Russia? The details of the indictment has the answer: They were researching US refineries by downloading papers from the US Department of Energy. As the IP addresses of this Russian research group is known and tracked, it was easy enough for US agencies to make the connection.

Continue reading “This Week In Security: More State-Sponsored Activity, Spring4Shell” →

This WeeΚ In Security: Hackerman, Twitter’s Best, And Signs To Watch Out For

April 1, 2022 by Jonathan Bennett 6 Comments

[Editor’s note: There is a second, fake iteration of this column out today. This is obviously the real column.]

First off, there’s an amazing video tutorial from [Hackerman], embedded below the break. It’s a beginners guide to temporal displacement through GPU accelerated, cellular-connected partition board. The central flaw that makes this possible is a segmentation violation, accessible through a mode 6 cursor address reset. Watch out, though, because many mainframes actually have a core terminal capable of shutting such an attempt out of the grid altogether.

It’s a great guide, and definitely worth a watch if temporal security tickles your fancy. Watch out, though, because everyday objects can apparently act as bridges, infecting even users with temporal effects.

Continue reading “This WeeΚ In Security: Hackerman, Twitter’s Best, And Signs To Watch Out For” →

Watching A Spacewalk In Real Time

March 31, 2022 by Al Williams 6 Comments

If you go to, say, a football game, you probably don’t get to see as much of the game as close as you do when you stay home and watch on TV. But there’s something about being there that counts. That’s probably how [Sebastian Voltmer] feels. While we’ve all seen video of astronauts and cosmonauts spacewalking, [Sebastian] managed to take a snapshot of a pair of spacewalkers from his telescope.

Of course, this wasn’t your ordinary department store Christmas gift telescope. The instrument was a Celestron 11 inch EdgeHD Schmidt-Cassegrain telescope on a very expensive GM2000 HPS mount. An ASI290 planetary camera took the shot. You can see the gear and more about the photos in the video below.

Continue reading “Watching A Spacewalk In Real Time” →

Desktop Performance In A Custom Mac Laptop

March 24, 2022 by Bryan Cockfield 17 Comments

Most of us either own or have used a laptop at some point. For traveling, as a student, or even for browsing Hackaday on the couch in front of the TV, they are pretty much indispensable. They do tend to have a sharp performance reduction compared to a desktop though thanks to the thermal and battery limitations of a portable form factor. [Scott Yu-Jan] wanted to solve that in his own life by building a custom Mac laptop with none of these downsides.

Noticing that a modern iPad Mini has exactly the same width of his Mac Mini, [Scott] set about combining the two devices into a single unit that he could assemble when traveling. A 3D printed case with a traditional laptop clamshell design takes care of physically combining these two devices, and a USB-C cable between the two takes care of combining them in software thanks to Apple’s Duet program. While this has better performance than a Macbook Pro it might actually have some perks, since Apple continues to refuse to make a laptop with a touchscreen.

There are some downsides, of course. The price is higher than a comparable Macbook Pro for the iPad and Mac together, plus it doesn’t include a keyboard or mouse. It also has no battery, so it needs to be plugged in. In the follow-up video linked below, though, [Scott] notes that for him this still made sense as he uses the Mac and iPad individually already, and only works remotely at places that have power outlets readily available. For the average person, though, we might recommend something different if you really need an esoteric laptop-like machine.

Thanks to [Varun] for originally sending in this tip!

Continue reading “Desktop Performance In A Custom Mac Laptop” →

NVIDIA Unveils Jetson AGX Orin Developer Kit

March 22, 2022 by Tom Nardi 14 Comments

When you think of high-performance computing powered by NVIDIA hardware, you probably think of applications leveraging the capabilities of the company’s graphics cards. In many cases, you’d be right. But naturally there are situations where the traditional combination of x86 computer and bolt-on GPU simply isn’t going to cut it; try packing a modern gaming computer onto a quadcopter and let us know how it goes.

For these so-called “edge computing” situations, NVIDIA offers the Jetson line of ARM single-board computers which include a scaled-down GPU that gives them vastly improved performance for machine learning applications than something like the Raspberry Pi. Today during their annual GPU Technology Conference (GTC), NVIDIA announced the immediate availability of the Jetson AGX Orin Developer Kit, which the company promises can deliver “server-class AI performance” in a package small enough for use in IoT or robotics.

As with the earlier Jetsons, the palm-sized development kit acts as a sort of breakout board for the far smaller module slotted into it. This gives developers access to the full suite of the connectivity and I/O options offered by the Jetson module in a desktop-friendly form that makes prototyping the software side of things much easier. Once the code is working as intended, you can simply pop the Jetson module out of the development kit and install it in your final hardware.

NVIDIA is offering the Orin module in a range of configurations, depending on your computational needs and budget. At the high end is the AGX Orin 64 GB at $1599 USD; which offers a 12-core ARM Cortex-A78AE processor, 32 GB of DDR5 RAM, 64 GB of onboard flash, and a Ampere GPU with 2048 CUDA cores and 64 Tensor cores, which all told enables it to perform an incredible 275 trillion operations per second (TOPS).

At the other end of the spectrum is the Orin NX 8 GB, a SO-DIMM module that delivers 70 TOPS for $399. It’s worth noting that even this low-end flavor of the Orin is capable of more than double the operations per second as 2018’s Jetson AGX Xavier, which until now was the most powerful entry in the product line.

The Jetson AGX Orin Developer Kit is available for $1,999 USD, and includes the AGX Orin 64 GB module. Interestingly, NVIDIA says the onboard software is able to emulate any of of the lower tier modules, so you won’t necessarily have to swap out the internal modules if your final hardware will end up using one of the cheaper modules. Of course the inverse of that is even folks who only planned on using the more budget-friendly units either have to shell out for an expensive dev kit, or try to spin their own breakout board.

While the $50 USD Jetson Nano is far more likely to be on the workbench of the average Hackaday reader, we have to admit that the specs of these new Orin modules are very exciting. Then again, we’ve covered several projects that used the previously top-of-the-line Jetson Xavier, so we don’t doubt one of you is already reaching for their wallet to pick up this latest entry into NVIDIA’s line of diminutive powerhouses.