Rickroll The Masses With A Coin Cell Throwie

December 22, 2017 by Jenny List 17 Comments

If there is one educational institution that features on these pages more than any other, it may be Cornell University. Every year we receive a pile of tips showing us the engineering term projects from [Bruce Land]’s students, and among them are some amazing pieces of work. Outside the walls of those technical departments though, we suspect that cool hacks may have been thin on the ground. English Literature majors for example contain among their ranks some astoundingly clever people, but they are not known for their handiness with a soldering iron or a lathe.

We’re happy to note then that someone at Cornell who is handy with a soldering iron has been spreading the love. In the form of coin cell powered throwies that intermittently Rickroll the inhabitants of the institution’s halls of residence. We have few technical details, but they seem to be a simple affair of a small microcontroller dead-bug soldered to a coin cell and a piezoelectric speaker. If we were embarking on such a project we’d reach for an ATtiny of some description, but similar work could be done with a PIC or any number of other families.

The Cornell Daily Sun write-up is more a work of investigative journalism detailing the perplexed residents searching for the devices than it is one of technical reference. We’re pleased to note that the university authorities have a relaxed attitude to the prank, and that no action will be taken against the perpetrator should they be found.

Thus we’d like to take a moment to reach out to the Cornell prankster, and draw their attention to our Coin Cell Challenge competition. There is still time to enter, and a Rickrolling throwie would definitely qualify. This isn’t the first tiny Rickrolling prank we’ve shown you on these pages.

Thanks [Simon Yorkston] for the tip.

Magic Leap Finally Announced; Remains Mysterious

December 21, 2017 by Mike Szczys 74 Comments

Yesterday Magic Leap announced that it will ship developer edition hardware in 2018. The company is best known for raising a lot of money. That’s only partially a joke, since the teased hardware has remained very mysterious and never been revealed, yet they have managed to raise nearly $2 billion through four rounds of funding (three of them raising more than $500 million each).

The announcement launched Magic Leap One — subtitled the Creator Edition — with a mailing list sign up for “designers, developers and creatives”. The gist is that the first round of hardware will be offered for sale to people who will write applications and create uses for the Magic Leap One.

We’ve gathered some info about the hardware, but we’ll certainly begin the guessing game on the specifics below. The one mystery that has been solved is how this technology is delivered: as a pair of goggles attaching to a dedicated processing unit. How does it stack up to current offerings?

Continue reading “Magic Leap Finally Announced; Remains Mysterious” →

FCC Fines Drone FPV Maker For Using Radio Spectrum

December 20, 2017 by Al Williams 35 Comments

If you listen to the radio bands in the United States, you might wonder if anyone at the FCC is paying attention, or if they are too busy selling spectrum and regulating the Internet. Apparently however, they are watching some things. The commission just levied a $180,000 fine on a company in Florida for selling audio/visual transmitters that use the ham bands as well as other frequencies.

The FCC charged that Lumenier Holdco LLC (formerly known as FPV Manuals LLC) was marketing uncertified transmitters some of which exceeded the 1-W power limit for ham transmitters used on model craft.

Continue reading “FCC Fines Drone FPV Maker For Using Radio Spectrum” →

Copyright Exception May Overrule Ability To Jailbreak 3D Printers

December 20, 2017 by Brian Benchoff 49 Comments

At the end of October, the US Patent and Trademark Office renewed a rule allowing anyone to ‘jailbreak’ a 3D printer to use unapproved filament. For those of you following along from countries that haven’t sent a man to the moon, a printer that requires proprietary filament is DRM, and exceptions to the legal enforceability DRM exist, provided these exceptions do not violate US copyright law. This rule allowing for the jailbreaking of 3D printers contains an exception so broad it may overturn the rule.

A few months ago, the US Copyright Office renewed a rule stating that using unapproved filament in a 3D printer does not violate US Copyright law. The language of this rule includes the wording:

‘The exemption shall not extend to any computer program on a 3D printer that produces goods or materials for use in commerce the physical production of which is subject to legal or regulatory oversight…”

This exception is extraordinarily broad; any 3D printers can produce aircraft parts (subject to FAA approval) and medical devices (subject to FDA approval). In effect, if a 3D printer has the ability to produce objects subject to regulatory oversight, the exception allowing the use of filament not approved by the manufacturer does not apply. Additionally, it should be noted that any object produced on a 3D printer that is subject to regulatory oversight is already regulated — there’s no reason to drag the Copyright Office into the world of 3D printed ventilation masks or turbine blades.

[Michael Weinberg], ‘legal guy’ for Shapeways and President of the Open Source Hardware Association has filed a petition with the US Copyright Office, asking the Office to eliminate this exception to the existing rule surrounding DRM and 3D printers. You are encouraged to submit a comment in support of this petition by March 14th.

Better 3D Printing Through Holography

December 16, 2017 by Al Williams 22 Comments

When most of us think about 3D printing, we usually think about a machine that melts plastic filament and extrudes it through a nozzle. But we all know that there are other technologies out there that range from cutting and laminating paper, to printing with molten metal or glass. Many of those are out of range for the common hacker. Probably the second most common method uses photo resin and some light source to build the layers in the resin. Researchers at Lawrence Livermore National Laboratory (LLNL) and several universities are experimenting with a new technique that exposes photo resin using three lasers, printing an entire object at one time. You can see a cube formed using the technique in the video below.

In all fairness, the process really isn’t holography but LLNL refers to it as “hologram-like.” In fact, it appears the lasers project more like an oblique projection (you know, like in drafting) which is considerably simpler. Simple enough, that we can’t help but wonder if the hacker community couldn’t develop machines based on this principle. The key would be arranging for the resin to only cure where laser light overlaps.

Continue reading “Better 3D Printing Through Holography” →

The Zombie Rises Again: Drone Registration Is Back

December 14, 2017 by Jenny List 69 Comments

It’s a trope of horror movies that demonic foes always return. No sooner has the bad guy been dissolved in a withering hail of holy water in the denoeument of the first movie, than some foolish child in a white dress at the start of the next is queuing up to re-animate it with a careless drop of blood or something. If parents in later installments of popular movie franchises would only keep an eye on their darn kids, it would save everybody a whole lot of time!

The relevant passage can be found in section 1092(d) of the National Defense Authorization Act, on page 329 of the mammoth PDF containing the full text, and reads as follows:

(d) RESTORATION OF RULES FOR REGISTRATION AND MARKING OF UNMANNED AIRCRAFT
.—The rules adopted by the Administrator
of the Federal Aviation Administration in the matter of registration
and marking requirements for small unmanned aircraft (FAA-2015-
7396; published on December 16, 2015) that were vacated by the
United States Court of Appeals for the District of Columbia Circuit
in Taylor v. Huerta (No. 15-1495; decided on May 19, 2017) shall
be restored to effect on the date of enactment of this Act.

This appears to reverse the earlier decision of the court, but does not specify whether there has been any modification to the requirements to prevent their being struck down once more by the same angle of attack. In particular, it doesn’t change any of the language in the FAA Modernization Act of 2012, which specifically prevents the Agency from regulating hobby model aircraft, and was the basis of Taylor v. Huerta. Maybe they are just hoping that hobby flyers get fatigued?

We took a look at the registration system before it was struck down, and found its rules to be unusually simple to understand when compared to other aviation rulings, even if it seemed to have little basis in empirical evidence. It bears a resemblance to similar measures in other parts of the world, with its 250 g weight limit for unregistered machines. It will be interesting both from a legal standpoint to see whether any fresh challenges to this zombie law emerge in the courts, and from a technical standpoint to see what advances emerge from Shenzhen as the manufacturers pour all their expertise into a 250 g class of aircraft.

Thanks [ArduinoEnigma] for the tip.

Bluetooth Gun Safe Cracked By Researchers

December 13, 2017 by Tom Nardi 64 Comments

Believe it or not, there are quite a few people out there who have purchased gun safes that can be remotely unlocked by Bluetooth. Now we can understand why somebody might think this was a good idea: the convenience of being able to hit a button on your phone and have your weapon available in the heat of the moment is arguably a big selling point for people who are purchasing something like this for home defense. But those with a more technical mind will likely wonder if the inherent risks of having your firearm (or other valuables) protected by a protocol that often relies on security by obscurity outweighs the convenience of not needing to enter in a combination on the keypad.

Well, you can wonder no more, as researchers at [Two Six Labs] have recently published a detailed document on how they managed to remotely unlock the Vaultek VT20i with nothing more exotic than an Ubertooth. In the end, even the Ubertooth wasn’t actually required, as this particular device turned out to be riddled with security issues.

[Two Six Labs] has not publicly released the complete source code of the software demonstrated in their YouTube video for very obvious reasons, but the page on their site does go into fantastic detail on how they uncovered the multiple vulnerabilities that allowed them to write it. Even if you’re not the kind of person who would ever need a gun safe, the information contained in their documentation about analyzing Bluetooth communications is fascinating reading.

It was discovered that the PIN for the safe was actually being transmitted by the accompanying smartphone application in plain-text, which would be bad enough normally. But after further analysis, it became clear that the safe wasn’t even bothering to check the PIN code anyway.

Scripting app interactions with ADB and Python

For extra style points, [Two Six Labs] also show a way to brute force the PIN using the Vaultek Android application by writing a Python script that punches in codes sequentially until it hits on the right one; the developers didn’t even bother to put in limits on failed attempts.

For a device that is ostensibly designed to contain a deadly weapon, the security flaws the team at [Two Six Labs] discovered are absolutely inexcusable. But there is a positive outcome, as the manufacturer has vowed to update the vulnerable safes and make a better effort in the future to more rigorously design and test their Bluetooth implementation. This is the goal of responsible disclosure, and we’re encouraged to see the manufacturer doing the right thing

The security concerns of Bluetooth controlled locks are well known, so it’s a bit disappointing that devices like this are still slipping through the cracks. We suggest you remain skeptical of any security device utilizing Bluetooth until the industry starts taking things a little more seriously.

Continue reading “Bluetooth Gun Safe Cracked By Researchers” →