News

3617 Articles

Lego Space Station Designed By Fan

February 2, 2020 by 9 Comments

It is no secret that most people like to play with Lego, but some people really like it to an extreme degree. Lego’s Idea platform lets people submit designs for review and also lets users vote on these designs. If accepted, the company works with the designer to put a kit in production and they share in the profits. [Christophe Ruge] submitted his design for the International Space Station and three years later, you can buy it on the Lego website.

The kit has 864 parts and the finished model is 12″ x 19″ x 7″ — probably will take longer than a coffee break to finish it. The model even includes the two rotating Solar Alpha Rotary Joints that allow the solar panels to align with the sun. You can see [Scott] building his on a recorded live stream below if you have 3 hours to kill.

Continue reading “Lego Space Station Designed By Fan” →

This Week In Security: OpenSMTPD, Kali Release, Scareware, Intel, And Unintended Consequences

January 31, 2020 by 15 Comments

If you run an OpenBSD server, or have OpenSMTPD running on a server, go update it right now. Version 6.6.2, released January 28th, fixes an exploit that can be launched locally or remotely, simply by connecting to the SMTP service. This was found by Qualys, who waited till the update was released to publish their findings.

It’s a simple logic flaw in the code that checks incoming messages. If an incoming message has either an invalid sender’s username, or invalid domain, the message is sent into error handling logic. That logic checks if the domain is an empty string, in which case, the mail is processed as a local message, sent to the localhost domain. Because the various parts of OpenSMTPD operate by executing commands, this logic flaw allows an attacker to inject unexpected symbols into those commands. The text of the email serves as the script to run, giving an attacker plenty of room to totally own a system as a result.

Browser Locker

“Your browser has been locked to prevent damage from a virus. Please call our Windows help desk immediately to prevent further damage.” Sound familiar? I can’t tell you how many calls I’ve gotten from freaked-out customers, who stumbled upon a scare-ware site that locked their browser. This sort of scam is called a browlock, and one particular campaign was pervasive enough to catch the attention of the researchers at Malwarebytes (Note, the picture at the top of their article says “404 error”, a reference to a technique used by the scam. Keep reading, the content should be below that.).

“WOOF”, Malwarebyte’s nickname for this campaign, was unusual both in its sophistication and the chutzpah of those running it. Browsers were hit via ads right on the MSN homepage and other popular sites. Several techniques were used to get the malicious ads onto legitimate sites. The most interesting part of the campaign is the techniques used to only deliver the scareware payload to target computers, and avoid detection by automated scanners.

It seems that around the time Malwarebytes published their report, the central command and control infrastructure behind WOOF was taken down. It’s unclear if this was a coincidence, or was a result of the scrutiny they were under from the security community. Hopefully WOOF is gone for good, and won’t simply show up at a different IP address in a few days.

Kali Linux

Kali Linux, the distribution focused on security and penetration testing, just shipped a shiny new release. A notable new addition to the Kali lineup is a rootless version of their Android app. Running an unrooted Android, and interested in having access to some security tools on the go? Kali now has your back.

Not all the tools will work without root, particularly those that require raw sockets, and sending malformed packets. It’s still a potentially useful tool to put into your toolbox.

Cacheout, VRD, and Intel iGPU Leaks

Intel can’t catch a break, with three separate problems to talk about. First up is cacheout, or more properly, CVE-2020-0549, also known as L1DES. It’s a familiar song and dance, just a slightly different way to get there. On a context switch, data in the Level 1 cache isn’t entirely cleared, and known side-channel attacks can be used to read that data from unprivileged execution.

VRD, Vector Register Sampling, is another Intel problem just announced. So far, it seems to be a less exploitable problem, and microcode updates are expected soon to fix the issue.

The third issue is a bit different. Instead of the CPU, this is a data leak via the integrated GPU. You may be familiar with the most basic form of this problem. Some video games will flash garbage on the screen for a few moments while loading. In some cases, rather than just garbage, images, video stills, and other graphics can appear. Why? GPUs don’t necessarily have the same strict separation of contexts that we expect from CPUs. A group of researchers realized that the old assumptions no longer apply, as nearly every application is video accelerated to some degree. They published a proof of concept, linked above, that demonstrates the flaw. Before any details were released, Phoronix covered the potential performance hit this would cause on Linux, and it’s not great.

Unintended Legal Consequences

Remember the ransomware attack that crippled Baltimore, MD? Apparently the Maryland legislature decided to step in and put an end to ransomware, by passing yet another law to make it illegal. I trust you’ll forgive my cynicism, but the law in question is a slow-moving disaster. Among other things, it could potentially make the public disclosure of vulnerabilities a crime, all while doing absolutely nothing to actually make a difference.

GE Medical Equipment Scores 10/10

While scoring a 10 out of 10 is impressive, it’s not something to be proud of, when we’re talking about a CVE score, where it’s the most critical rating. GE Healthcare, subsidiary of General Electric, managed five separate 10.0 CVEs in healthcare equipment that they manufacture, and an 8.5 for a sixth. Among the jewels are statements like:

In the case of the affected devices, the configuration also contains a private key. …. The same private key is universally shared across an entire line of devices in the CARESCAPE and GE Healthcare family of products.

The rest of the vulnerabilities are just as crazy. Hard-coded SMB passwords, a network KVM that has no credential checking, and ancient VNC versions. We’ve known for quite some time that some medical equipment is grossly insecure. It will apparently take a security themed repeat of the Therac-25 incident before changes take place.

Odds’n’ends

The Windows 7 saga continues, as Microsoft’s “last” update for the venerable OS broke many users’ desktop backgrounds. Microsoft plans to release a fix.

Firefox purged almost 200 extensions from their official portal over the last few weeks. It was found that over 100 extensions by 2Ring was secretly pulling and running code from a central server.

The Citrix problems we discussed last week has finally been addressed, and patches released, but not soon enough to prevent the installation of future-proof backdoors on devices in the wild. There are already plenty of reports of compromised devices. Apparently the exploitation has been so widespread, that Citrix has developed a scanning tool to check for the indicators of compromise (IoCs) on your devices. Apply patch, check for backdoors.

This Is It For The Particle Mesh Network

January 30, 2020 by 24 Comments

The long-held dream of wireless network hackers everywhere is to dispense with centralised network infrastructure, and instead rely on a distributed network in which the clients perform the role of distribution and routing of traffic. These so-called mesh networks promise scalability and simplicity on paper, but are in practice never as easy to implement as the theory might suggest. Much venture capital has been burned over the years by startups chasing that particular dream, yet most of our wireless connectivity still follows a hub topology.

An exciting development in our sphere concerning mesh networking came in early 2018, when Particle, the purveyors of wireless-equipped dev boards, launched their third generation of products. These offered mesh networking alongside their other features, but this week they have announced that they’ll no longer be developing that particular side of their offering. The Wi-Fi-equipped Argon and Cellular-equipped Boron will remain on sale, but they will henceforth discontinue the mesh-only Xenon. Existing owners of the now orphaned board will be compensated with store credit.

Their rationale for discontinuing mesh networking is interesting, and reflects on the sentiment in our first paragraph. Mesh networking is hard, and in particular their attempt to make it work with zero configuration was simply not successful. But then they talk about the realisation that maybe mesh networking was not the right solution for the IoT applications the boards were being used in, and perhaps another technology such as LoRa would be more appropriate.

So the mesh experiment from Particle is over, but the company and its connected dev boards are very much still with us. We salute them for being bold enough to try it, and we wonder when we’ll next find a piece of similar mesh networking hardware.

DDR-5? DDR-4, We Hardly Knew Ye

January 29, 2020 by 32 Comments

This month’s CES saw the introduction of max speed DDR5 memory from SK Hynix. Micron and other vendors are also reportedly sampling similar devices. You can’t get them through normal channels yet, but since you also can’t get motherboards that take them, that’s not a big problem. We hear Intel’s Xeon Sapphire Rapids will be among the first boards to take advantage of the new technology. But that begs the question: what is it?

SDRAM Basics

Broadly speaking, there are two primary contenders for a system that needs RAM memory: static and dynamic. There are newer technologies like FeRAM and MRAM, but the classic choice is between static and dynamic. Static RAM is really just a bunch of flip flops, one for each bit. That’s easy because you set it and forget it. Then later you read it. It can also be very fast. The problem is a flip flop usually takes at least four transistors, and often as many as six, so there’s only so many of them you can pack into a certain area. Power consumption is often high, too, although modern devices can do pretty well.

Continue reading “DDR-5? DDR-4, We Hardly Knew Ye” →

CRISPR Could Fry All Cancer Using Newly Found T-Cell

January 27, 2020 by 36 Comments

One of the human body’s greatest features is its natural antivirus protection. If your immune system is working normally, it produces legions of T-cells that go around looking for abnormalities like cancer cells just to gang up and destroy them. They do this by grabbing on to little protein fragments called antigens that live on the surface of the bad cells and tattle on their whereabouts to the immune system. Once the T-cells have a stranglehold on these antigens, they can release toxins that destroy the bad cell, while minimizing collateral damage to healthy cells.

CAR T-cell therapy process via National Cancer Institute

This rather neat human trick doesn’t always work, however. Cancer cells sometimes mask themselves as healthy cells, or they otherwise thwart T-cell attacks by growing so many antigens on their surface that the T-cells have no place to grab onto.

Medical science has come up with a fairly new method of outfoxing these crafty cancer cells called CAR T-cell therapy. Basically, they withdraw blood from the patient, extract the T-cells, and replace the blood. The T-cells are sent off to a CRISPR lab, where they get injected with a modified, inactive virus that introduces a new gene which causes the T-cells to sprout a little hook on their surface.

This hook, which they’ve dubbed the chimeric antigen receptor (CAR), allows the T-cell to chemically see through the cancer cells’ various disguises and attack them. The lab multiplies these super soldiers and sends them back to the treatment facility, where they are injected into the patient’s front lines.

Continue reading “CRISPR Could Fry All Cancer Using Newly Found T-Cell” →

Students Use Low Tech Hacks On High Tech Parking Enforcer

January 24, 2020 by 144 Comments

If you are a college student and you get too many parking fines, you are going to get in trouble. But one school didn’t count on students hacking their high tech parking violation deterrent. Some even got free internet from the devices.

You pay your taxes or — in the case of students — your tuition. But still, the city or university wants you to pay to park your car. In the old days, you’d get your car towed. But the people running the parking lot don’t really like having to share the fees they charge you with a tow truck driver. Many places clamp a device to your tire that makes it impossible to drive. Oklahoma University decided that was too much trouble, also, so they turned to Barnacle. Barnacle is a cheaper alternative to the old parking clamp. In sticks to your windshield so you can’t see to drive. The suction cups have an air pump to keep them secure and a GPS squeals if you move the car with it on there anyway.

Continue reading “Students Use Low Tech Hacks On High Tech Parking Enforcer” →

The Truth Is In There: The Art Of Electronics, The X-Chapters

January 23, 2020 by 41 Comments

If you’ve been into electronics for any length of time, you’ve almost certainly run across the practical bible in the field, The Art of Electronics, commonly abbreviated AoE. Any fan of the book will certainly want to consider obtaining the latest release, The Art of Electronics: The x-Chapters, which follows the previous third edition of AoE from 2015. This new book features expanded coverage of topics from the previous editions, plus discussions of some interesting but rarely traveled areas of electrical engineering.

For those unfamiliar with it, AoE, first published in 1980, is an unusually useful hybrid of textbook and engineer’s reference, blending just enough theory with liberal doses of practical experience. With its lively tone and informal style, the book has enabled people from many backgrounds to design and implement electronic circuits.

After the initial book, the second edition (AoE2) was published in 1989, and the third (AoE3) in 2015, each one renewing and expanding coverage to keep up with the rapid pace of the field. I started with the second edition and it was very well worn when I purchased a copy of the third, an upgrade I would recommend to anyone still on the fence. While the second and third books looked a lot like the first, this new one is a bit different. It’s at the same time an expanded discussion of many of the topics covered in AoE3 and a self-contained reference manual on a variety of topics in electrical engineering.

I pre-ordered this book the same day I learned it was to be published, and it finally arrived this week. So, having had the book in hand — almost continuously — for a few days, I think I’ve got a decent idea of what it’s all about. Stick around for my take on the latest in this very interesting series of books.

Continue reading “The Truth Is In There: The Art Of Electronics, The X-Chapters” →