Gentoo Linux, Now A Bit Less For The 1337

December 29, 2023 by Jenny List 37 Comments

Among users of Linux distributions there’s a curious one-upmanship, depending on how esoteric or hardcore your distro is. Ubuntu users have little shame, while at the other end if you followed Linux From Scratch or better still hand-compiled the code and carved it onto the raw silicon with a tiny chisel, you’re at the top of the tree*. Jokes aside though, it’s fair to say that if you were running the Gentoo distribution you were something of a hardcore user, because its source-only nature meant that everything had to be compiled to your liking. We’re using the past tense here though, because in a surprise announcement, the distro has revealed that it will henceforth also be available as a set of precompiled binary packages.

There may be readers with long and flowing neckbeards who will decry this moment as the Beginning of the End, but while it does signal a major departure for the distro if it means that more people are spurred to take their Linux usage further and experiment with Gentoo, this can never be a bad thing. Gentoo has been on the list for a future Jenny’s Daily Drivers OS review piece, and while we’re probably going to stick with source-only when we do it, it’s undeniable that there will remain a temptation to simply download the binaries.

Meanwhile this has been written on a machine running Manjaro, or Arch-for-cowards as we like to call it, something that maybe confers middle-ranking bragging rights. Read a personal tale of taking off those Linux training wheels.

* Used a magnifying glass? You’re just not cutting it!

This Week In Security: Triangulation, ProxyCommand, And Barracuda

December 29, 2023 by Jonathan Bennett 6 Comments

It’s not every day we get to take a good look inside a high-level exploit chain developed by an unnamed APT from the western world. But thanks to some particularly dedicated researchers at Kaspersky, which just happens to be headquartered in Moscow, that’s exactly what we have today. The name Operation Triangulation was picked, based off part of the device fingerprinting code that rendered a yellow triangle on an HTML canvas.

The entire talk is available, given this week at the 37th Chaos Communication Congress, 37c3. The exploit starts with an iMessage attachment, delivered silently, that exploits an undocumented TrueType font instruction. Looking at the source code implies that it was a copy-paste error where a programmer didn’t quite get the logic right for a pointer calculation. That vulnerability gives a memory write primitive that pivots into code execution. What’s particularly interesting is that Apple silently fixed this bug January 2023, and didn’t make any public statements. Presumably there were an uptick of crash logs that pointed to this problem, but didn’t conclusively show attempted exploitation.

The exploits then moves to using NSExpression as a next stage. NSExpression is an ugly way to write code, but it does allow the exploit chain to get to the next stage, running JavaScript as an application, without Just In Time compilation. The JS payload is quite a beast, weighing in at 11,000 lines of obfuscated code. It manages to call native APIs directly from JS, which then sets up a kernel exploit. This is multiple integer overflow flaws that result in essentially arbitrary system memory reads and writes. Continue reading “This Week In Security: Triangulation, ProxyCommand, And Barracuda” →

Paged Out! Releases Long-Awaited Third Issue

December 27, 2023 by Tom Nardi 4 Comments

We’re happy to pass along word that Paged Out! has finally released Issue #3. This online zine covers a wide array of technical topics, from software development to hardware hacking, computer security, and electronics.

It’s distributed as a PDF, and is notable for its somewhat experimental format that limits each article to a single page. The first two issues were released back in 2019, but between a global pandemic and some administrative shuffling, progress on the current release was slowed considerably.

Among the 50 articles that make up the third Paged Out! there are a number of pieces focusing on hardware, such as the serial communications “cheat sheet” from [Jay Greco], and a pair of articles covering the state-of-the-art in custom keyboards. But overall the zine does lean hard into programming topics, and is probably best suited for those with an interest in software development and infosec.

Still, the line between hardware and software is getting blurrier all the time, so we’re sure you can find something in Paged Out! that should interest you no matter which side of the fence you’re on. Here’s hoping the time between releases can be reduced a bit for Issue #4.

Veteran SpaceX Booster Lost Due To Rough Seas

December 27, 2023 by Tom Nardi 44 Comments

With the notable exception of the now retired Space Shuttle orbiters, essentially every object humanity ever shot into space has been single-use only. But since December of 2015, SpaceX has been landing and refurbishing their Falcon 9 boosters, with the end goal of operating their rockets more like cargo aircraft. Today, while it might go unnoticed to those who aren’t closely following the space industry, the bulk of the company’s launches are performed with boosters that have already completed multiple flights.

This reuse campaign has been so successful these last few years that the recent announcement the company had lost B1058 (Nitter) came as quite a surprise. The 41 meter (134 foot) tall booster had just completed its 19th flight on December 23rd, and had made what appeared to be a perfect landing on the drone ship Just Read the Instructions. But sometime after the live stream ended, SpaceX says high winds and powerful waves caused the booster to topple over.

Continue reading “Veteran SpaceX Booster Lost Due To Rough Seas” →

The Tech That Died In 2023

December 25, 2023 by Al Williams 26 Comments

We don’t indulge too often in looking back, but [Chloe Albanesisu] at PC Magazine did and wrote the tech obituary for all the tech gadgets and services that died over this past year. Some of the entries are a bit predictable: Twitter died to be replaced by X, which is exactly like it, only different. Others we hardly noticed, like Netflix stopping its DVD shipments.

Google Glass died again, but this time it was the enterprise edition. Amazon gave up on both donating money through shopping and print subscriptions via Kindle.

Glass wasn’t the only Google casualty. Gmail lost its basic HTML version and shut down its smart whiteboard product, Jamboard. They also sold off their Internet domain business in an effort to focus on core businesses. Other notable Google shutdowns include their popular podcast app and Usenet support for Groups. Oh, and don’t forget their experiment in offering Pixels phones as a subscription. That’s done, too.

As you might expect, PC Magazine’s list is a bit consumer-oriented. What hacker-centric products and services vanished this year that you’ll miss? The Sculpteo Marketplace? XYZ Printing? Start up companies collapsed in 2023 at an alarming rate, but you didn’t hear about most of them. Were there any you were especially disappointed about? Let us know in the comments.

This Week In Security: Terrapin, Seized Unseized, And Autospill

December 22, 2023 by Jonathan Bennett 5 Comments

There’s a new SSH vulnerability, Terrapin (pdf paper), and it’s got the potential to be nasty — but only in an extremely limited circumstance. To understand the problem, we have to understand what SSH is designed to do. It replaces telnet as a tool to get a command line shell on a remote computer. Telnet send all that text in the clear, but SSH wraps it all inside a public-key encrypted tunnel. It was designed to safely negotiate an unfriendly network, which is why SSH clients are so explicit about accepting new keys, and alerting when a key has changed.

SSH uses a sequence counter to detect Man-in-the-Middle (MitM) shenanigans like packet deletion, replay, or reordering. That sequence isn’t actually included in the packet, but is used as part of the Message Authentication Check (MAC) of several encryption modes. This means that if a packet is removed from the encrypted tunnel, the MAC fails on the rest of the packets, triggering a complete connection reset. This sequence actually starts at zero, with the first unencrypted packet sent after the version banners are exchanged. In theory, this means that an attacker fiddling with packets in the pre-encryption phase will invalidate the entire connection as well. There’s just one problem.

The innovation from the Terrapin researchers is that an attacker with MitM access to the connection can insert a number of benign messages in the pre-encryption phase, and then silently drop the first number of messages in the encrypted phase. Just a little TCP sequence rewriting for any messages between, and neither the server nor client can detect the deception. It’s a really interesting trick — but what can we do with it?

For most SSH implementations, not much. The 9.6 release of OpenSSH addresses the bug, calling it cryptographically novel, but noting that the actual impact is limited to disabling some of the timing obfuscation features added to release 9.5.

Continue reading “This Week In Security: Terrapin, Seized Unseized, And Autospill” →

NASA’s Tech Demo Streams First Video From Deep Space Via Laser

December 19, 2023 by Maya Posch 46 Comments

Everyone knows that the most important part of a tech demo is to make the right impression, and the team over at NASA’s Jet Propulsion Laboratory (JPL) definitely had this part nailed down when they showed off streaming a cat video from deep space using laser technology as part of NASA’s Deep Space Optical Communication (DSOC) program. This system consists out of a ground-based laser transmitter and receiver along with a space-based laser transceiver, which for this experiment was positioned at a distance of 31 million kilometers – 80 times the distance between the Moon and Earth – as a part of the Psyche spacecraft.

After a range of tests with the system to shake out potential issues, the team found that they could establish a 267 Mbps link, with a one-way latency of a mere 101 seconds, allowing Psyche’s transceiver to transmit the preinstalled 15-second high-definition video in effectively real-time and making the cat Taters instantly world-famous. Although the potential for space-based cat videos cannot be underestimated, the main purpose of DSOC is to allow spacecraft to send back much larger data sets than they could before.

For robotic and potential future manned missions DSOC would mean high bandwidth video and data links, enabling more science, better communication and possibly the occasional cat video during interplanetary travel.

Continue reading “NASA’s Tech Demo Streams First Video From Deep Space Via Laser” →