LILIN DVRs and cameras are being actively exploited by a surprisingly sophisticated botnet campaign. There are three separate 0-day vulnerabilities being exploited in an ongoing campaigns. If you have a device built by LILIN, go check for firmware updates, and if your device is exposed to the internet, entertain the possibility that it was compromised.
The vulnerabilities include a hardcoded username/password, command injection in the FTP and NTP server fields, and an arbitrary file read vulnerability. Just the first vulnerability is enough to convince me to avoid black-box DVRs, and keep my IP cameras segregated from the wider internet.
About a year ago, Zachary McCoy took a bike ride around his neighborhood in Gainesville, Florida. It may have been forgettable to him, but not to history. Because McCoy used an app to track his mileage, the route was forever etched in the Google-verse and attached to his name.
On the day of this ill-fated bike ride, McCoy passed a certain neighbor’s house three times. While this normally wouldn’t raise alarm, the neighbor happened to be the victim of a burglary that day, and had thousands of dollars worth of jewelry stolen. The Gainesville police had zero leads after a four-day investigation, so they went to the county to get a geofence warrant. Thanks to all the location data McCoy had willingly generated, he became the prime suspect.
There appears to be no shortage of reasons to hate on wind farms. That’s especially the case if you live close by one, and as studies have shown, their general acceptance indeed grows with their distance. Whatever your favorite flavor of renewable energy might be, that’s at least something it has in common with nuclear or fossil power plants: not in my back yard. The difference is of course that it requires a lot more wind turbines to achieve the same output, therefore affecting a lot more back yards in total — in constantly increasing numbers globally.
Personally, as someone who encounters them occasionally from the distance, I find wind turbines mostly to be an eyesore, particularly in scenic mountainous landscapes. They can add a futuristic vibe to some otherwise boring flatlands. In other words, I can not judge the claims actual residents have on their impact on humans or the environment. So let’s leave opinions and emotions out of it and look at the facts and tech of one issue in particular: light pollution.
This might not be the first issue that comes to mind when thinking about wind farms. But wind turbines are tall enough to require warning lights for air traffic safety, and can be seen for miles, blinking away in the night sky. From a pure efficiency standpoint, this doesn’t seem reasonable, considering how often an aircraft is actually passing by on average. Most of the time, those lights simply blink for nothing, lighting up the countryside. Can we change this?
In many parts of the world the COVID-19 pandemic is causing shortages in hospital space, staff, medical supplies, and equipment. Severe cases may require breathing support, but there are only so many ventilators available. With that in mind, MIT is working on FDA approval of an emergency ventilator system (E-Vent). They have submitted the design to the FDA for fast track review. The project is open source, so once they have approval the team will release all the data needed to replicate it.
The design is actually made simple by using something that is very common: a manual resuscitator. You have doubtlessly seen these on your favorite medical show. It is the bag someone squeezes while the main character struggles valiantly to save their patient. Of course, having someone sit and squeeze the bag for days on end for thousands of people isn’t very practical and that’s where they’ve included an Arduino-controlled motor to automate the process.
The ESP8266 is about six years old now and the ESP32 is getting more mainstream every day. Unsurprisingly, Espressif is developing even newer product and the ESP32-S2 was in the hands of some beta testers last year. Now it is finally landing as “final silicon” samples in people’s hands. [Unexpected Maker] got a few and a prototype development board for the chip and shared his findings in a recent video.
The ESP32-S2 has a single core LX7 running at 240 MHz along with a RISC-V-based coprocessor. Onboard is 320K of RAM and 128K of ROM. You might notice this is less than the ESP32. However, the device can support up to 128MB of external RAM and up to 1GB of external flash. It also supports USB, although the prototype module appears to have an external USB chip on it.
This week the new coronavirus has spread like wildfire. The good news last week has been the success with which China, Taiwan, and Singapore have handled the epidemic, and that western nations are just beginning to emulate their approach of reducing person-to-person interactions as much as possible to slow the rate of infection. The bad news, however, is that countries like Italy currently have a number of cases that is overwhelming their health system, and that the disease seems to be spreading rapidly in other countries. It’s going to get a lot worse before it gets better.
Our sincerest thanks go out to all of the medical professionals who are providing care in this difficult situation. But also to those who are providing public infrastructure in less obvious ways: the cashiers who subject themselves to hundreds of contacts per day just so that you and I can buy toothpaste, for instance. The rest of us are staying at home as much as possible, washing our hands, and slowing the spread as much as possible simply by not catching or passing on the virus.
The original part, left, with its 3D-printed counterpart.
But most of us don’t have medical expertise. If you have spare CPU cycles, consider donating them to the folding@home effort to simulate the proteins in the virus. And any hack to make the lives of those stuck in voluntary quarantine more “normal” is perhaps as important in the long run. I made a simple clock to help my son who’s stuck at home and can’t yet tell time, adjust to his new daily routine. Others have made more obviously whimsical devices. We like this computer-vision face-touching alarm. If it makes people smile while slowing down one transmission vector, it’s a win.
If you have the expertise, consider helping out your local schools with telepresence and online education. While a number of colleges are already geared up for distance learning, it’s uncharted territory for primary education most everywhere. I’m sure you can also think of other ways to help out locally. If so, don’t hesitate to tell us your success stories.
For the rest: simply washing your hands, staying healthy, and not passing the virus on to others is a quietly heroic act that we think shouldn’t be overlooked. Thanks.
This article is part of the Hackaday.com newsletter, delivered every seven days for each of the last 212 weeks or so. It also includes our favorite articles from the last seven days that you can see on the web version of the newsletter.
Want this type of article to hit your inbox every Friday morning? You should sign up!
As the world sits back and waits for Coronavirus to pass, the normally frantic pace of security news has slowed just a bit. Google is not exempt, and Chrome 81 has been delayed as a result. Major updates to Chrome and Chrome OS are paused indefinitely, but security updates will continue as normal. In fact, Google has verified that the security related updates will be packaged as minor updates to Chrome 80.
Chinese Viruses Masquerading as Chinese Viruses
Speaking of COVID-19, researchers at Check Point Research stumbled upon a malware campaign that takes advantage of the current health scare. A pair of malicious RTF documents were being sent to various Mongolian targets. Created with a tool called “Royal Road“, these files target a set of older Microsoft Word vulnerabilities.
This particular attack drops its payload in the Microsoft Word startup folder, waiting for the next time Word is launched to run the next stage. This is a clever strategy, as it would temporarily deflect attention from the malicious files. The final payload is a custom RAT (Remote Access Trojan) that can take screenshots, upload and download files, etc.
While the standard disclaimer about the difficulty of attribution does apply, this particular attack seems to be originating from Chinese intelligence agencies. While the Coronavirus angle is new, this campaign seems to stretch back to 2017. Continue reading “This Week In Security: Working From Home Edition”→
