We’re fans of haveibeenpwned.com around here, but a weird story came across my proverbial desk this week — [Troy Hunt] wrote a malicious SQL injection into one of their emails! That attack string was a simple ';--
Wait, doesn’t that look familiar? You remember the header on the haveibeenpwned web page? Yeah, it’s ';--have i been pwned?. It’s a clever in-joke about SQL injection that’s part of the company’s brand. An automated announcement was sent out to a company that happened to use the GLPI service desk software. That company, which shall not be named for reasons that are about to become obvious, was running a slightly out-of-date install of GLPI. That email generated an automated support ticket, which started out with the magic collection of symbols. When a tech self-assigned the ticket, the SQL injection bug was triggered, and their entire ticket database was wiped out. The story ends happily, thanks to a good backup, and the company learned a valuable lesson. Continue reading “This Week In Security: HaveIBeenPwned And Facebook Attack Their Customers”→
Light-emitting diodes (LEDs) are not exactly new technology, but their use over time has evolved from rather dim replacements of incandescent signal lights in control panels to today’s home lighting. Although LEDs have the reputation of being power-efficient, there is still a lot of efficiency to be gained.
UC Santa Barbara researchers [Jonathan Schuller] and his team found that a large number of the photons that are generated never make it out of the LED. This means that the power that was used to generate these photons was essentially wasted. Ideally one would be able to have every single photon successfully make it out of the LED to contribute to the task of illuminating things.
In their paper titled ‘Unidirectional luminescence from InGaN/GaN quantum-well metasurfaces‘ (pre-publication Arxiv version) they describe the problem of photon emission in LEDs. Photons are normally radiated in all directions, causing a ‘spray’ of photons that can be guided somewhat by the LED’s packaging and other parameters. The challenge was thus to start at the beginning, having the LED emit as many photons in one direction as possible.
Their solution was the use of a metasurface-based design, consisting out of gallium nitride (GaN) nanorods on a sapphire substrate. These were embedded with indium gallium nitride (InGaN) quantum wells which emit the actual photons. According to one of the researchers, the idea is based on subwavelength antenna arrays already used with coherent light sources like lasers.
With experiments showing the simulated improvements, it seems that this research may lead to even brighter, more efficient LEDs before long if these findings translate to mass production.
Back when Windows NT was king, Microsoft was able to claim that it met the strict “Orange Book” C2 security certification. The catch? Don’t install networking and remove the floppy drives. Turns out most of the things you want to do with your computer are the very things that are a security risk. Even copy and paste.
[Michal Benkowki] has a good summary of his research which boils down to the following attack scenario:
Visit a malicious site.
Copy something to the clipboard which allows the site to put in a dangerous payload.
Visit another site with a browser-based visual editor (e.g., Gmail or WordPress)
At the end of 2018, a spate of drone sightings caused the temporary closure of London Gatwick Airport, and set in train a chain of events that were simultaneously baffling and comedic as the authorities struggled to keep up with both events and the ever widening gap in their knowledge of the subject.
One of the more inept actions of the Sussex Police was to respond by arresting the first local drone enthusiast they could find on Facebook, locking up a local couple for 36 hours and creating a media frenzy by announcing the apprehension of the villains before shamefacedly releasing them without charge.
So how has the new drone law progressed, since it was decided that Something Must Be Done? Enthusiasts have continued as before, and the multirotor community is as technically creative as ever. We were fortunate enough to host the Lets Drone Out podcast at MK Makerspace back in those halcyon days before the pandemic and see the state of the art in sub-250g craft, and with those and commercial offerings such as the DJI Mavic Mini all requiring no registration there is increasingly little need for an enthusiast to purchase a larger machine. The boost to the British drone industry we were promised has instead been a boost for the Chinese industry as we predicted, and of course we’re still waiting for the public inquiry into the whole mess. Something tells us Hell will freeze over first.
The global COVID-19 pandemic has kept many of us socially isolated from friends, family, and colleagues for several months at this point. But thanks to modern technology, the separation has only been in the physical sense. From job interviews to grade school book reports, many of the things we’d previously done in person are now happening online. The social distancing campaign has also shown that virtual meetups can be a viable alternative to traditional events, with several notable hacker conventions already making the leap into cyberspace.
With this in mind, we’re proud to announce HackadayU. With weekly online videos and live office hours, these online classes will help you make the most of your time in isolation by learning new skills or diving deeper into subjects with experienced instructors from all over the world. Whether you’re just curious about a topic or want to use these classes to help put yourself on a new career path, we’re here to help.
In a community like ours, where so many people already rely on self-study and tutorial videos, these four week classes are perfect for professional engineers and hobbyists alike. To make sure HackadayU is inclusive as possible, classes will be offered on a pay-as-you-wish basis: we’ll pick up the tab for the instructor’s time, and you kick in whatever you think is fair. All money collected will be donated to charities that help feed, house, and educate others. We know these are tough times, and the hope is that HackadayU can not only benefit the members of our core community, but pass on some goodwill to those who are struggling.
Although online voting in elections has been a contentious topic for decades already, it is during the current pandemic that it has seen significant more attention. Along with mail-based voting, it can be a crucial tool in keeping the world’s democratic nations running smoothly. This is where the OmniBallot software, produced by Democracy Live, comes into play, and its unfortunate unsuitability for this goal.
Despite already being used by multiple US jurisdictions for online voting, a study by MIT’s [Michael Specter] and University of Michigan researchers points out the flaws in this web-based platform. Their recommendations are to either avoid using OmniBallot completely, or to only use it for printing out a blank ballot that one then marks by hands and sends in by mail.
One of the issues with the software is that it by default creates the marked ballot PDF on the Democracy Live servers, instead of just on the user’s device. Another is that as a web-based platform it is hosted on Amazon Web Services (AWS), with JavaScript sources pulled from both CloudFlare and Google servers. Considering that the concern with electronic voting machines was that of unauthorized access at a polling station, it shouldn’t require a lengthy explanation to see this lack of end-to-end security with OmniBallot offers many potential attack surfaces.
When Ars Technica contacted Democracy Live for commentary on these findings, Democracy Live CEO [Bryan Finney] responded that “The report did not find any technical vulnerabilities in OmniBallot”. Since the researchers did not examine the OmniBallot code itself that is technically true, but misses the larger point of the lack of guarantee of every single voter’s device being secured, as well as every AWS, CloudFlare and Google instance involved in the voting process.
As a result, the recommended use of OmniBallot is to use it for the aforementioned printing out of blank ballots, to save half of the trip time of the usual mail-in voting.
Last week, [Danal Estes] passed away. This comes as a shock to many of us who had the pleasure of interacting with him online. Not only was [Danal] an active contributor to the 3D printing community, he was simply a warm-hearted character who was just fun to get along with. I met [Danal] online less than a year ago. But I owe him a debt in helping transform a set of design files that I posted online into a full blown community of hardware enthusiasts.
Here’s my best shot at recounting some of this fellow human’s legacy as seen from the fellow tool changing 3D printing enthusiasts who knew him.
Getting to Know an Online Community Builder
I first met [Danal] online last September through Thingiverse when he posted a make of Jubilee, a tool changing machine design that I posted a few weeks prior. At a time when Jubilee was just a set of files and instructions on the internet, I was stoked that someone in the world was out there building a duplicate. To get to know these people better and work out any pinch points in their assembly process, I started a Discord Chat Server. [Danal] was the first to join and start telling his story in pictures.
As a community of curious people on Discord grew, questions about the machine started to arise. How big was it? How did the tool changing work? I tried answering as many as I could, putting an FAQ blurb on Thingiverse, But a few weeks in, something else happened: [Danal] started answering the questions. Not only that, he was greeting nearly every single person who introduced themselves on the server. I didn’t understand the value of a simple “welcome aboard!” that follows someone’s first post in a budding online community, but [Danal] did. So he did just that. He made you feel welcome to have landed in this corner of the internet. In a world full of engineers who don’t like repeating themselves, [Danal] seemed to get that his repeat interaction was new for the person on the other end; and that made it worth doing.
Danal’s first tool changes
As the days passed, questions continued, and [Danal] continued to fill people in with answers to questions–even repeat questions. All the while, he posted progress pictures of his own machine. In a way, the rest of the community seemed to be holding their breath during this time, watching [Danal] post status reports; waiting for some conviction that these files actually turned into something that worked. Then, less than a month later, [Danal] posted a video of his first successful tool change. It did work! Almost certainly inspired by [Danal’s] success, a few more folks started building machines of their own. But [Danal] was the first person to duplicate a Jubilee.
More than twenty machines have been built in the wild since I posted the project files back in September. I believe that the inspiration to start draws from the success of people who have finished before, which chains down to the inspiration drawn from the success of the first person to finish: [Danal Estes]. I owe him one for that: for inspiring a community of folks to follow in this adventure.
Commoditized Automatic Nozzle Alignment
[Danal] did more than affirm the machine design to a new Jubilee community. Over the short span of the project, [Danal] put his software hat on and developed an automated machine-vision based tool alignment system that he called TAMV. It turns out that tool tip calibration is one of the gnarly problems for any multi-nozzle 3D printer. Tools must be aligned relative to each other such that each of the unique materials they print are aligned in the resulting print. The current ways of doing this are cumbersome and manual. Either you measure offsets by printing a vernier scale or by taking pictures with an upwards-facing microscope. [Danal] took this gnarly problem as an opportunity to automate the process completely, so he did.
In just two months, [Danal] returned with an announcement on the Jubilee Discord to present TAMV, aka: Tool Align Machine Vision. By mounting an upwards facing webcam to the front of his Jubilee, [Danal] simply ran his one-button script, and his machine automatically calibrated each available tool both automatically and better than most humans could with the prior methods. It did this by sequentially picking up tools, putting them in the camera field of view, and then measuring their offsets. What’s more, he released the entire code base as open-source, literally transforming a gnarly problem into a thing of the past with a commodity solution made usable with a simple installation script and setup instructions that he also wrote.
Here on Hackaday, it’s humbling to read about the amazing feats folks are overcoming all from the comfort of their home workbenches. But it’s invigorating to see that same feat unfolded in a way that lets us unpack it, learn from it, build on top of it. The act of documenting work you’ve already done with the intent that others could follow it is an act of grace. [Danal] was gracious.
A Shared Story Told in Projects
As [Danal] became one of the most active community members on Discord, we started to learn more about his other projects. For [Danal], 3D printers were as much a side project as they were tools in a family of other tools for creative projects. Armed with these machines, [Danal] put them to work on machines for flight, from extraordinary remote control aircraft (3D printed of course) that could barely work their wingspan through a doorway to the consoles of real world aircraft that could carry a pilot.
It was always a pleasure to get a slice of [Danal’s] adventures. Getting to hear about his excitement in projecting was food for a growing community of hobbyists eager to get back to our workbenches. And the framing of his adventures was warm enough to make you feel not just that you wanted a bit of this lifestyle for yourself, but that you could have it too. I hope that this part of [Danal’s] legacy is something that we online folk can continue: the shared courtesy and warm attitude to newcomers in a hardware hacking community.
In 
