News

3606 Articles

Flashlight shining through gold leaf on glass

Shining Through: Germanium And Gold Leaf Transparency

January 5, 2025 by 26 Comments

Germanium. It might sound like just another periodic table entry (number 32, to be exact), but in the world of infrared light, it’s anything but ordinary. A recent video by [The Action Lab] dives into the fascinating property of germanium being transparent to infrared light. This might sound like sci-fi jargon, but it’s a real phenomenon that can be easily demonstrated with nothing more than a flashlight and a germanium coin. If you want to see how that looks, watch the video on how it’s done.

The fun doesn’t stop at germanium. In experiments, thin layers of gold—yes, the real deal—allowed visible light to shine through, provided the metal was reduced to a thickness of 100 nanometers (or: gold leaf). These hacks reveal something incredible: light interacts with materials in ways we don’t normally observe.

For instance, infrared light, with its lower energy, can pass through germanium, while visible light cannot. And while solid gold might seem impenetrable, its ultra-thin form becomes translucent, demonstrating the delicate dance of electromagnetic waves and electrons.

The implications of these discoveries aren’t just academic. From infrared cameras to optics used in space exploration, understanding these interactions has unlocked breakthroughs in technology. Has this article inspired you to craft something new? Or have you explored an effect similar to this? Let us know in the comments!

We usually take our germanium in the form of a diode. Or, maybe, a transistor.

Continue reading “Shining Through: Germanium And Gold Leaf Transparency” →

Nottingham Railway departure board in Hackspace

All Aboard The Hack Train: Nottingham’s LED Revival

January 4, 2025 by 4 Comments

Hackerspaces are no strangers to repurposing outdated tech, and Nottingham Hackspace happens to own one of those oddities one rarely gets their hands on: a railway departure board. Left idle for over a decade, it was brought back to life by [asjackson]. Originally salvaged around 2012, it remained unused until mid-2024, when [asjackson] decided to reverse-engineer it. The board now cycles between displaying Discord messages and actual train departures from Nottingham Railway Station every few minutes. The full build story can be found in this blog post.

The technical nitty-gritty is fascinating. Each side of the board contains 4,480 LEDs driven as two parallel chains. [asjackson] dove into its guts, decoding circuits, fixing misaligned logic levels, and designing custom circuit boards in KiCAD. The latest version swaps WiFi for a WizNet W5500 ethernet module and even integrates the Arduino Uno R4 directly into the board’s design. Beyond cool tech, the display connects to MQTT, pulling real-time train data and Discord messages via scripts that bridge APIs and custom Arduino code.

This board is a true gem for any hackerspace, even more so now it’s working. It waited for the exact mix of ingredients why hackerspaces exist in the first place: curiosity, persistence, and problem-solving. Nottingham Hackspace is home to a lot more, as we once wrote in this introductory article.If you don’t have room for the real thing, maybe set your sights a bit smaller.

Do you have a statement piece this cool in your hackerspace or your home? Tip us!

Continue reading “All Aboard The Hack Train: Nottingham’s LED Revival” →

High Performance RISC-V

January 3, 2025 by 12 Comments

From the Institute of Computing Technology division of the Chinese Academy of Sciences and Peng Cheng Laboratory comes a high-performance and well-documented RISC-V core called XiangShan.

In the Git repository, you’ll find several branches including at least two stable branches: Yanqihu and Nanhu. The currently developed architecture, Kunminghu, is impressive, with a sophisticated instruction fetch unit, a reorder buffer, and a register renaming scheme.

The point of these types of circuits in a CPU is to allow multiple instructions to process at once. This also implies that instructions can be executed out of order. A cursory glance didn’t show any branch prediction logic, but that may be a limitation of the documentation. If there isn’t one, that would be an interesting thing to add in a fork if you are looking for a project.

On the computing side, the processor contains an integer block, a floating point unit, and a vector processor. Clearly, this isn’t a toy processor and has the capability to compete with serious modern CPUs.

There is a separate GitHub for documentation. It looks like they try to keep documentation in both Mandarin and English. You can also find some of the academic papers about the architecture there, too.

We love CPU design, and this is an interesting chance to contribute to an open CPU while there are still interesting things to do. If you need to start with something easier, plenty of small CPUs exist for educational purposes.

This Week In Security: IOCONTROL, (Location) Leaking Cars, And Passkeys

January 3, 2025 by 11 Comments

Claroty’s TEAM82 has a report on a new malware strain, what they’re calling IOCONTROL. It’s a Linux malware strain aimed squarely at embedded devices. One of the first targets of this malware, surprisingly, is the Iraeli made Orpak gas station pumps. There’s a bit of history here, as IOCONTROL is believed to be used by CyberAv3ngers, a threat actor aligned with Iran. In 2023 a group aligned with Israel claimed to have compromised the majority of the gas stations in Iran. IOCONTROL seems to have been deployed as retribution.

There are a few particularly interesting aspects of this malware, and how TEAM82 went about analyzing it. The first is that they used unicorn to emulate the obscure ARM platform in question. This was quite an adventure, as they were running the malicious binary without the normal Linux OS under it, and had to re-implement system calls to make execution work. The actual configuration data was encrypted as the data section of the executable, presumably to avoid simple string matching detection and analysis.

Then to communicate with the upstream command and control infrastructure, the binary first used DNS-Over-HTTPS to resolve DNS addresses, and then used the MQTT message protocol for actual communications. Once in place, it has the normal suite of capabilities, like code execution, cleanup, lateral scanning, etc. An interesting speculation is that the level of control this malware had over these gas pumps, it was in a position to steal credit card information. This malware family isn’t limited to gas pumps, either, as it’s been spotted in IoT and SCADA devices from a whole host of vendors. Continue reading “This Week In Security: IOCONTROL, (Location) Leaking Cars, And Passkeys” →

38C3: Lawsuits Are Temporary; Glory Is Forever

December 29, 2024 by 35 Comments

One of the blockbuster talks at last year’s Chaos Communications Congress covered how a group of hackers discovered code that allegedly bricked public trains in Poland when they went into service at a competitor’s workshop. This year, the same group is back with tales of success, lawsuits, and appearances in the Polish Parliament. You’re not going to believe this, but it’s hilarious.

The short version of the story is that [Mr. Tick], [q3k], and [Redford] became minor stars in Poland, have caused criminal investigations to begin against the train company, and even made the front page of the New York Times. Newag, the train manufacturer in question has opened several lawsuits against them. The lawsuit alleges the team is infringing on a Newag copyright — by publishing the code that locked the trains, no less! If that’s not enough, Newag goes on to claim that the white hat hackers are defaming the company.

What we found fantastically refreshing was how the three take all of this in stride, as the ridiculous but incredibly inconvenient consequences of daring to tell the truth. Along the way they’ve used their platform to speak out for open-sourcing publicly funded code, and the right to repair — not just for consumers but also for large rail companies. They are truly fighting the good fight here, and it’s inspirational to see that they’re doing so with humor and dignity.

If you missed their initial, more technical, talk last year, go check it out. And if you ever find yourself in their shoes, don’t be afraid to do the right thing. Just get a good lawyer.

close up hands holding lighting pcb

Circuit Secrets: Exploring A $5 Emergency Light

December 28, 2024 by 2 Comments

Who would’ve thought a cheap AliExpress emergency light could be packed with such crafty design choices? Found for about $5, this unit uses simple components yet achieves surprisingly sophisticated behaviors. Its self-latching feature and decisive illumination shut-off are just the beginning. A detailed analysis by [BigCliveDotCom] reveals a smart circuit that defies its humble price.

The circuit operates via a capacitive dropper, a cost-effective way to power low-current devices. What stands out, though, is its self-latching behavior. During a power failure, transistors manage to keep the LEDs illuminated until the battery voltage drops below a precise threshold, avoiding the dreaded fade-to-black. Equally clever is the automatic shut-off when the voltage dips too low, sparing the battery from a full drain.

Modifications are possible, too. For regions with 220V+ mains, swapping the dropper capacitor with a 470nF one can reduce heat dissipation. Replacing the discharge resistor (220k) with a higher value improves longevity by running cooler. What remarkable reverse engineering marvels have you come across? Share it in the comments!  After all, it is fun to hack into consumer stuff. Even if it is just a software hack.

Continue reading “Circuit Secrets: Exploring A $5 Emergency Light” →

This Week In Security: License Plates, TP-Link, And Attacking Devs

December 27, 2024 by 22 Comments

We’re covering two weeks of news today, which is handy, because the week between Christmas and New Years is always a bit slow.

And up first is the inevitable problem with digital license plates. Unless very carefully designed to be bulletproof, they can be jailbroken, and the displayed number can be changed. And the Reviver plates were definitely not bulletproof, exposing a physical programming port on the back of the plate. While it’s not explicitly stated, we’re guessing that’s a JTAG port, given that the issue is considered unpatchable, and the port allows overwriting the firmware. That sort of attack can be hardened against with signed firmware, and using an MCU that enforces it.

This does invite comparisons to the James Bond revolving license plate — and that comparison does put the issue into context. It’s always been possible to swap license plates. If someone really wants to cause mischief, traditional plates can be stolen, or even faked. What a digital plate adds to the equation is the ability to switch plate numbers on the fly, without stopping or turning a screwdriver. Regardless, this seems like it will be an ongoing problem, as so many manufacturers struggle to create secure hardware.

Malicious RDP

There’s a clever attack, that uses Microsoft’s Remote Desktop Protocol (RDP), to give away way too much control over a desktop. That’s accomplished by sending the target a .rdp file that shares local resources like the clipboard, filesystem, and more. What’s new is that it seems this theoretical attack has now shown up in the wild.

The attack campaign has been attributed to APT29, CozyBear, a threat actor believed to be associated with Russia’s Foreign Intelligence Service. This attribution tracks with the victims of choice, like government, research, and Ukrainian targets in particular. To escape detection, the malicious RDP endpoints are set up behind RDP proxies, running on services like AWS. The proxies and endpoints are accessed through TOR and other anonymous proxies. The .rdp files were spread via spear-phishing emails sent through compromised mail servers. The big push, with about 200 targets, was triggered on October 22nd. Researchers at TrendMicro believe this was the end of a targeted campaign. The idea being that at the end of the campaign, it no longer matters if the infrastructure and methods get discovered, so aim for maximum impact.

Free* Mcdonalds?

Here we learn that while McDonald’s USA dosn’t have a bug bounty program, McDonald’s India does — and that’s why researcher [Eaton Zveare] looked there. And found a series of Broken Object Level Authorization (BOLA) bugs. That’s a new term to this column, but a concept we’ve talked about before. BOLA vulnerabilities happen when a service validates a user’s authentication token, but doesn’t properly check that the user is authorized to access the specific resources requested.

In the McDonald’s case, any user of the web app is issued a guest JWT token, and that token is then valid to access any Order ID in the system. That allows some interesting fun, like leaving reviews on other users’ orders, accessing delivery maps, and getting copies of receipts. But things got really interesting when creating an account, and then ordering food. A hidden, incomplete password login page allowed breaking the normal user verification flow, and creating an account. Then after food is added to the cart, the cart can be updated to have a total price of a single rupee, about the value of a penny.

This research earned [Eaton] a $240 Amazon gift card, which seems a little stingy, but the intent behind the gesture is appreciated. The fixes landed just over 2 months after reported, and while [Eaton] notes that this is slower than some companies, it’s significantly faster than some of the less responsive vendors that we’ve seen.

Banning TP-Link

The US Government has recently begun discussing a plan to ban TP-Link device purchases in the United States. The reported reason is that TP-Link devices have shipped with security problems. One notable example is a botnet that Microsoft has been tracking, that primarily consists of TP-Link devices.

This explanation rings rather hollow, particularly given the consistent security failings from multiple vendors that we’ve covered on this very column over the years. Where it begins to make more sense is when considered in light of the Chinese policy that all new vulnerabilities must first be reported to the Chinese government, and only then can fixes be rolled out. It suggests that the US Commerce Department suspects that TP-Link is still following this policy, even though it’s technically now a US company.

I’m no stranger to hacking TP-Link devices. Many years ago I wrote a simple attack to put the HTTPD daemon on TP-Link routers into debug mode, by setting the wifi network name. Because the name was used to build a command run with bash, it was possible to do command injection, build a script in the device’s /tmp space, and then execute that script. Getting to debug mode allowed upgrading to OpenWRT on the device. And that just happens to be my advice for anyone still using TP-Link hardware: install OpenWRT on it.

Developers Beware

We have two separate instances of malware campaigns directly targeting developers. The first is malicious VSCode extensions being uploaded to the marketplace. These fakes are really compelling, too, with lots of installs, reviews, and links back to the real pages. These packages seem to be droppers for malware payloads, and seem to be targeting cryptocurrency users.

If malware in your VSCode extensions isn’t bad enough, OtterCookie is a campaign believed to come from North Korea, spreading via fake job interviews. The interview asks a candidate to run a Node.js project, or install an npm package as part of prep. Those are malicious packages, and data stealers are deployed upon launch. Stay frosty, even on the job hunt.

Bits and Bytes

PHP has evolved over the years, but there are still a few quirks that might trip you up. One of the dangerous ones is tied up in $_SERVER['argv'], a quick way to test if PHP is being run from the command line, or on a server. Except, that relies on register_argc_argv set to off, otherwise query strings are enough to fool a naive application into thinking it’s running on the command line. And that’s exactly the footgun that caught Craft CMS with CVE-2024-56145.

Australia may know something we don’t, setting 2030 as the target for retiring cryptography primitives that aren’t quantum resistant. That’s RSA, Elliptic-curve, and even SHA-256. It’s a bit impractical to think that those algorithms will be completely phased out by then, but it’s an interesting development to watch.

Fuzzing is a deep subject, and the discovery of 29 new vulnerabilities found in GStreamer is evidence that there’s still plenty to discover. This wasn’t coverage-guided fuzzing, where the fuzzer mutates the fuzzing input to maximize. Instead, this work uses a custom corpus generator, where the generator is aware of how valid MP4 files are structured.