WSPR May Hold The Key To MH370 Final Position

April 24, 2021 by Jenny List 53 Comments

The disappearance of Malaysia Airlines flight MH370 after an unexplained course change sent it flying south over the Indian Ocean in March 2014 still holds the mystery of the wreck’s final location. There have been a variety of efforts to narrow down a possible search area over the years, and now we have news of a further angle from an unexpected source. It’s possible that the aircraft’s path could show up in radio scatter detectable as anomalously long-distance contacts using the amateur radio WSPR protocol.

WSPR is a low-power amateur radio mode designed to probe and record the radio propagation capabilities of the atmosphere. Transmit beacons and receiving stations run continuously, and all contacts however fleeting are recorded to an online database. This can be mined by researchers with an interest in the atmosphere, but in this case it might also provide clues to the missing airliner’s flightpath. By searching for anomalously long-distance WSPR contacts whose path crosses the expected position of MH370 it’s possible to spot moments when the aircraft formed a reflector for the radio waves. These contacts can then either confirm positions already estimated using other methods, or even provide further course points. It’s an impressive demonstration of the unexpected data that can lurk in a trove such as the WSPR logbook, and also that while messing about on the airwaves the marks we leave behind us can have more benefit than simply bragging rights over the DX we’ve worked.

If this WSPR business intrigues you, then have a read of the piece in our $50 Ham series about it.

Header: Laurent ERRERA from L’Union, France, CC BY-SA 2.0.

[via Southgate ARC]

“Paper” Bottles For Your Fizzy Drinks (And Bottle Rockets)

April 23, 2021 by Jenny List 144 Comments

A story that passed almost unnoticed was that the Coca-Cola company plan to run a limited trial of paper bottles. Wait, paper for a pressurized beverage? The current incarnation still uses a plastic liner and cap but future development will focus on a “bio-based barrier” and a bio composite or paper cap tethered to the vessel.

Given that plastic pollution is now a major global concern this is interesting news, as plastic drinks bottles make a significant contribution to that problem. But it raises several questions, first of all why are we seemingly unable to recycle the bottles in the first place, and given that we have received our milk and juice in paper-based containers for decades why has it taken the soda industry so long?

Plastic soft drink bottles are made from Polyethylene terephthalate or PET, the same polyester polymer as the one used in Dacron or Terylene fabrics. They’re blow-moulded, which is to say that an injection-moulded preform something like a plastic test tube with a screw top fitting is expanded from inside in a mould by compressed gas. As anyone who has experimented with bottle rockets will tell you, they are immensely strong, and as well as being cheap to make and transport they are also readily recyclable when separated from their caps.

Continue reading ““Paper” Bottles For Your Fizzy Drinks (And Bottle Rockets)” →

This Week In Security: NAME:WRECK, Signal Hacks Back, Updates, And More

April 23, 2021 by Jonathan Bennett 9 Comments

NAME:WRECK is a collection of vulnerabilities in DNS implementations, discovered by Forescout and JSOF Research. This body of research can be seen as a continuation of Ripple20 and AMNESIA:33, as it builds on a class of vulnerability discovered in other network stacks, problems with DNS message compression.

Their PDF Whitepaper contains a brief primer on the DNS message format, which is useful for understanding the class of problem. In such a message, a DNS name is encoded with a length-value scheme, with each full name ending in a null byte. So in a DNS Request, Hackaday.com would get represented as [0x08]Hackaday[0x03]com[0x00]. The dots get replaced by these length values, and it makes for an easily parsable format.

Very early on, it was decided that continually repeating the same host names in a DNS message was wasteful of space, so a compression scheme was devised. DNS compression takes advantage of the maximum host/domain length of 63 characters. This max size means that the binary representation of that length value will never contain “1”s in the first two digits. Since it can never be used, length values starting with a binary “11” are used to point to a previously occurring domain name. The 14 bits that follow this two bit flag are known as a compression pointer, and represent a byte offset from the beginning of the message. The DNS message parser pulls the intended value from that location, and then continues parsing.

The problems found were generally based around improper validation. For example, the NetX stack doesn’t check whether the compression pointer points at itself. This scenario leads to a tight infinite loop, a classic DoS attack. Other systems don’t properly validate the location being referenced, leading to data copy past the allocated buffer, leading to remote code execution (RCE). FreeBSD has this issue, but because it’s tied to DHCP packets, the vulnerability can only be exploited by a device on the local network. While looking for message compression issues, they also found a handful of vulnerabilities in DNS response parsing that aren’t directly related to compression. The most notable here being an RCE in Seimens’ Nucleus Net stack. Continue reading “This Week In Security: NAME:WRECK, Signal Hacks Back, Updates, And More” →

BMW Pushing Hard For Solid-State Battery Tech; Plans Demo By 2025

April 21, 2021 by Lewin Day 26 Comments

Plenty of development is ongoing in the world of lithium batteries for use in electric vehicles. Automakers are scrapping for every little percentage gain to add a few miles of range over their competitors, with efforts to reduce charging times just as frantic as well.

Of course, the real win would be to succeed in bringing a bigger, game-changing battery to market. Solid state batteries fit the bill, potentially offering far greater performance than their traditional lithium counterparts. BMW think there’s merit in the technology, and have announced they intend to show off a solid-state battery vehicle by 2025.

Continue reading “BMW Pushing Hard For Solid-State Battery Tech; Plans Demo By 2025” →

This Week In Security: Pwn2own, Zoom Zero Day, Clubhouse Data, And An FBI Hacking Spree

April 16, 2021 by Jonathan Bennett 11 Comments

Our first story this week comes courtesy of the Pwn2own contest. For anyone not familiar with it, this event is held twice a year, and features live demonstrations of exploits against up-to-date software. The one exception to this is when a researcher does a coordinated release with the vendor, and the update containing the fix drops just before the event. This time, the event was held virtually, and the attempts are all available on Youtube. There were 23 attacks attempted, and only two were outright failures. There were 5 partial successes and 16 full successes.

One of the interesting demonstrations was a zero-click RCE against Zoom. This was a trio of vulnerabilities chained into a single attack. The only caveat is that the attack must come from an accepted contact. Pwn2Own gives each exploit attempt twenty minutes total, and up to three attempts, each of which can last up to five minutes. Most complex exploits have an element of randomness, and exploits known to work sometimes don’t work every time. The Zoom demonstration didn’t work the first time, and the demonstration team took enough time to reset, they only had enough time for one more try.

BleedingTooth

We first covered BleedingTooth almost exactly six months ago. The details were sparse then, but enough time has gone by to get the full report. BleedingTooth is actually a trio of vulnerabilities, discovered by [Andy Nguyen]. The first is BadVibes, CVE-2020-24490. It’s a lack of a length check in the handling of incoming Bluetooth advertisement packets. This leads to a buffer overflow. The catch here is that the vulnerability is only possible over Bluetooth 5. Continue reading “This Week In Security: Pwn2own, Zoom Zero Day, Clubhouse Data, And An FBI Hacking Spree” →

DOOM On A Bootloader Is The Ultimate Cheat Code

April 16, 2021 by Bryan Cockfield 14 Comments

Porting DOOM to run on hardware never meant to run it is a tradition as old as time. Getting it to run on embedded devices, ancient computers, virtual computers, and antique video game consoles are all classic hacks, but what DOOM ports have been waiting for is something with universal applicability that don’t need a bespoke solution for each piece of hardware. Something like DOOM running within a bootloader.

The bootloader that [Ahmad] works with is called Barebox and is focused on embedded systems, often those running Linux. This is the perfect environment for direct hardware access, since the bootloader doubles as a bare metal hardware bring-up toolkit. Now that DOOM runs on this bootloader, it effectively can run anywhere from embedded devices to laptops with minimal work, and although running it in a bootloader takes away a lot of the hard work that would normally need to be done during a port, it may still need some tweaking for specific hardware not otherwise supported.

For those already running Barebox, the bareDOOM code can be found on [Ahmad]’s GitHub page. For those not running Barebox, it does have a number of benefits compared to other bootloaders, even apart from its new ability to play classic FPS games. For those who prefer a more custom DOOM setup, though, we are always fans of DOOM running within an NES cartridge.

Photo: AntonioMDA, CC BY-SA 4.0 via Wikimedia Commons

SV Seeker Is Recycling Batteries

April 14, 2021 by Jonathan Bennett 38 Comments

SV Seeker is a home-made boat currently being built by [Doug Jackson] just north of Tulsa, Oklahoma. It’s a bit different than what you might imagine as a typical DIY boat, though. You see, Seeker is a 75 ft steel boat, intended to work as a research vessel. Doug and his crew proudly refer to Seeker as “The boat the internet built”, and he’s our kind of people. We’ve covered them before, the first time way back in 2013. Doug’s Youtube channel does double duty, both teaching the rest of us all the skills he’s learned while building, and also serving as the eventual user and repair manual for the boat.
Continue reading “SV Seeker Is Recycling Batteries” →