It is hard to find anyone that does any kind of software development that doesn’t have some interaction with GitHub. Even if you don’t host your own projects there, there are so many things to study and borrow on the site, that it is nearly ubiquitous. However, when you’ve needed GitHub on the run, you’ve probably had to turn to your phone browser and had a reduced experience. GitHub for Mobile is now out of beta and promises a more fluid phone-based GitHub experience.
In addition to working with tasks and issues, you can also review and merge pull requests. The app sends your phone notifications, too, which can be handy. As you might expect, you can get the app for Android or iPhone in the respective stores.
As you read this, the Open Hardware Summit is taking place, but differently than in previous years. This year, it’s taking place in cyberspace! To what do we owe this futuristic development? Unfortunately, COVID-19, the corona virus.
And just announced yesterday, our own Hackaday Belgrade event is going to be postponed and rescheduled for later this year. It’s truly sad, but we’re still looking forward to seeing you all a little bit later in the summer. If you can’t make the new date, tickets will of course be refunded. We’ll keep you informed when we get a new venue and time.
The best way to slow the spread of a global pandemic, according to the WHO who should know best, is washing your hands and avoiding contact with other people. “Social distancing” is the new catch-phrase, and that means keeping a few meters away from other folks whenever reasonable. And clearly, gathering people from all over the world, packing them into a single auditorium, and spending quality time together doesn’t meet this requirement.
So we’re all probably going to be laying low globally for a little while. On the positive side, this means more time for hacking here in the lab, and I’m excited to be able to watch the online version of the Open Hardware Summit. If you’re working from home, it’s that much easier to keep up to date with Hackaday. Still, I can’t wait to be on the other side of this thing, and it makes me appreciate the various social gatherings that much more.
And of course I have Isaac Newton in my thoughts, who developed the groundwork for his Calculus and laws of gravitation while at home because Cambridge was closed to stop the spread of the Great Plague. Wash your hands!
This article is part of the Hackaday.com newsletter, delivered every seven days for each of the last 210 weeks or so. It also includes our favorite articles from the last seven days that you can see on the web version of the newsletter.
Want this type of article to hit your inbox every Friday morning? You should sign up!
It has been a while since we thought about computers and thought about Honeywell. Sure, they had a series of computers they bought from General Electric and Computer Control Company in the 1970s. Even before that they joined with Raytheon and produced vacuum tube computers that later morphed into transistor-based computers. But in recent years, you are more likely to think of Honeywell for thermostats, air filters, and industrial controls. But now, Honeywell has come out of the computer shadows with some impressive quantum computer hardware and they clearly have big plans.
Comparing quantum computers is a bit dicey just as, for example, judging CPUs by instructions per second has its problems. In the past, vendors have jockeyed for the maximum number of qubits, but that’s misleading in some cases. Processing power depends on the number of qubits, their quality, and how they are connected. IBM introduced the idea of quantum volume and Honeywell claims their new machine will hit 64 by that measure, twice that of anyone else’s quantum computer that we know about.
Kurt.energy is promoting a new line of hybrid supercapacitors. By itself, that wouldn’t be very newsworthy, but the company claims these graphene-based supercapacitors merge the best features of both supercapacitors and lithium-ion batteries. Based on technology from a company called Shenzhen Toomen New Energy, the capacitors are optimized for either high energy or high power. They can reportedly charge and discharge 10-20 times faster than lithium-ion batteries. Of course, we’ve heard wild claims surrounding graphene capacitors before and, so far, they haven’t seemed very credible.
In addition to high performance, the company claims the capacitors are safe from overcharging, short circuit, and other safety issues that plague batteries. The devices are said to operate — including charging — from -40C to 80C. You can see a video from the company, below.
Due to uncertainties about the progress of the spread of the novel corona virus, it’s with a sad heart that we announce that we’re postponing the 2020 Hackaday Belgrade conference.
We will be rescheduling for later in the year, but for now we’ll be refunding conference tickets. We received a record number of incredible presenter proposals, and once we’ve rescheduled, we’ll get in touch with everyone who entered a proposal to check up on your availability.
We know how much you were all looking forward to Belgrade in May, and it pains us to have to take this step. When we get more details ironed out, we’ll be sure to let you know! See you all a little bit later in the summer?
Ready for more speculative execution news? Hope so, because both Intel and AMD are in the news this week.
The first story is Load Value Injection, a different approach to reading arbitrary memory. Rather than try to read protected memory, LVI turns that on its head by injecting data into a target’s data. The processor speculatively executes based on that bad data, eventually discovers the fault, and unwinds the execution. As per other similar attacks, the execution still changes the under-the-hood state of the processor in ways that an attacker can detect.
What’s the actual attack vector where LVI could be a problem? Imagine a scenario where a single server hosts multiple virtual machines, and uses Intel’s Secure Guard eXentensions enclave to keep the VMs secure. The low-level nature of the attack means that not even SGX is safe.
The upside here is that the attack is quite difficult to pull off, and isn’t considered much of a threat to home users. On the other hand, the performance penalty of the suggested fixes can be pretty severe. It’s still early in the lifetime of this particular vulnerability, so keep an eye out for further updates.
AMD’s Takeaway Bug
AMD also found itself on the receiving end of a speculative execution attack (PDF original paper here). Collide+Probe and Load+Reload are the two specific attacks discovered by an international team of academics. The attacks are based around the reverse-engineering of a hash function used to speed up cache access. While this doesn’t leak protected data quite like Spectre and Meltdown, it still reveals internal data from the CPU. Time will tell where exactly this technique will lead in the future.
To really understand what’s going on here, we have to start with the concept of a hash table. This idea is a useful code paradigm that shows up all over the place. Python dictionaries? Hash tables under the hood.
Imagine you have a set of a thousand values, and need to check whether a specific value is part of that set. Iterating over that entire set of values is a computationally expensive proposition. The alternative is to build a hash table. Create an array of a fixed length, let’s say 256. The trick is to use a hash function to sort the values into this array, using the first eight bits of the hash output to determine which array location each value is stored in.
When you need to check whether a value is present in your set, simply run that value through the hash function, and then check the array cell that corresponds to the hash output. You may be ahead of me on the math — yes, that works out to about four different values per array cell. These hash collisions are entirely normal for a hash table. The lookup function simply checks all the values held in the appropriate cell. It’s still far faster than searching the whole table.
AMD processors use a hash table function to check whether memory requests are present in L1 cache. The Takeaway researchers figured out that hash function, and can use hash collisions to leak information. When the hash values collide, the L1 cache has two separate chunks of memory that need to occupy the same cache line. It handles this by simply discarding the older data when loading the colliding memory. An attacker can abuse this by measuring the latency of memory lookups.checking
If an attacker knows the memory location of the target data, he can allocate memory in a different location that will be stored in the same cache line. Then by repeatedly loading his allocated memory, he knows whether the target location has been accessed since his last check. What real world attack does that enable? One of the interesting ones is mapping out the memory layout of ASLR/KASLR memory. It was also suggested that Takeaway could be combined with the Spectre attack.
There are two interesting wrinkles to this story. First, some have pointed out the presence of a thank-you to Intel in the paper’s acknowledgements. “Additional funding was provided by generous gifts from Intel.” This makes it sound like Intel has been funding security research into AMD processors, though it’s not clear what exactly this refers to.
Lastly, AMD’s response has been underwhelming. At the time of writing, their official statement is that “AMD believes these are not new speculation-based attacks.” Now that the paper has been publicly released, that statement will quickly be proven to be either accurate or misinformed.
Closed Source Privacy?
The Google play store and iOS app store is full of apps that offer privacy, whether it be a VPN, adblocker, or some other amazing sounding application. The vast majority of those apps, however, are closed source, meaning that you have little more than trust in the app publisher to ensure that your privacy is really being helped. In the case of Sensor Tower, it seems that faith is woefully misplaced.
A typical shell game is played, with paper companies appearing to provide apps like Luna VPN and Adblock Focus. While technically providing the services they claim to provide, the real aim of both apps is to send data back to Sensor Tower. When it’s possible, open source is the way to go, but even an open source app can’t protect you against a malicious VPN provider.
Does the word “#backdoor” seem frightening? That’s because it’s often used incorrectly – sometimes to deliberately create fear. Watch to learn the truth about backdoors and other types of network access. #cybersecuritypic.twitter.com/NEUXbZbcqw
[Robert Graham] thought the whole story was fishy, and decided to write about it. He makes two important points. First, the Wall Street Journal article cites anonymous US officials. In his opinion, this is a huge red flag, and means that the information is either entirely false, or an intentional spin, and is being fed to journalists in order to shape the news. His second point is that Huawei’s redefinition of government-mandated backdoors as “front doors” takes the line of the FBI, and the Chinese Communist Party, that governments should be able to listen in on your communications at their discretion.
Graham shares a story from a few years back, when his company was working on Huawei brand mobile telephony equipment in a given country. While they were working, there was an unspecified international incident, and Graham watched the logs as a Huawei service tech remoted into the cell tower nearest the site of the incident. After the information was gathered, the logs were scrubbed, and the tech logged out as if nothing had happened.
Did this tech also work for the Chinese government? The NSA? The world will never know, but the fact is that a government-mandated “front door” is still a back door from the users’ perspective: they are potentially being snooped on without their knowledge or consent. The capability for abuse is built-in, whether it’s mandated by law or done in secret. “Front doors” are back doors. Huawei’s gear may not be dirtier than anyone else’s in this respect, but that’s different from saying it’s clean.
Abusing Regex to Fool Google
[xdavidhu] was poking at Google’s Gmail API, and found a widget that caught him by surprise. A button embedded on the page automatically generated an API key. Diving into the Javascript running on that page, as well as an iframe that gets loaded, he arrived at an ugly regex string that was key to keeping the entire process secure. He gives us a tip, www.debuggex.com, a regex visualizer, which he uses to find a bug in Google’s JS code. The essence of the bug is that part of the URL location is interpreted as being the domain name. “www.example.com\.corp.google.com” is considered to be a valid URL, pointing at example.com, but Google’s JS code sees the whole string as a domain, and thinks it must be a Google domain.
For his work, [xdavidhu] was awarded $6,000 because this bit of ugly regex is actually used in quite a few places throughout Google’s infrastructure.
SMBv3 Wormable Flaw
Microsoft’s SMBv3 implementation in Windows 10 and Server 2019 has a vulnerability in how it handles on-the-fly compression, CVE-2020-0796. A malicious packet using compression is enough to trigger a buffer overflow and remote code execution. It’s important to note that this vulnerability doesn’t required an authenticated user. Any unpatched, Internet-accessible server can be compromised. The flaw exists in both server and client code, so an unpatched Windows 10 client can be compromised by connecting to a malicious server.
There seems to have been a planned coordinated announcement of this bug, corresponding with Microsoft’s normal Patch Tuesday, as both Fortinet and Cisco briefly had pages discussing it on their sites. Apparently the patch was planned for that day, and was pulled from the release at the last moment. Two days later, on Thursday the 12th, a fix was pushed via Windows update. If you have Windows 10 machines or a Server 2019 install you’re responsible for, go make sure it has this update, as proof-of-concept code is already being developed.
Readers are no doubt aware of the COVID-19 pandemic and the impact it’s having on many public gatherings. Some events have been curtailed, while others have been cancelled outright. Among the events impacted is the Open Hardware Summit, which was set to kick off this Friday in New York. But all is not lost, as the decision has been made to turn it into a virtual event with with speakers delivering their talks to a live online audience.
Full refunds are available should anyone want them, but ticket holders will still receive their swag bags. The schedule for the one day event is expected to remain pretty close to the one that was already announced, and there will also be a Discord chat and #ohs2020Virtual Twitter hashtag for viewers to discuss the presentations. When it goes live, a link to watch the stream will be added to the front page of the event’s website.
With the usual schedule of hacker events stretching out across the year, it’s likely that this won’t be the only major one impacted by COVID-19. Judging by what we have heard from those event organizers among our friends, the planning required for the outbreak is causing a lot of stress on top of the usual worries inherent to the job. We’d like to ask everyone to extend their understanding to the teams behind any events that are cancelled or postponed during these exceptional times. Stay safe everyone, and enjoy the (virtual) Open Hardware Summit.
