NASA Engineers Poke Voyager 1 And Receive Memory Dump

For months, there has been a rising fear that we may have to say farewell to the Voyager 1 spacecraft after it began to send back garbled data. Now, in a sudden twist, Voyager 1 sent back a read-out of the Flight Data Subsystem (FDS) memory after a “poke” command, which both gives some hope that the spacecraft is in a better condition than feared while also allows engineers to dig through the returned memory read-out for clues. Although this data was not sent in the format that the FDS is supposed to use when it’s working correctly, it’s nevertheless readable.

It was previously suspected that the issue lay with the telemetry modulation unit (TMU), but has since been nailed down to the FDS itself.  This comes after NASA engineers have been updating the firmware on both spacecraft to extend their lifespan, but it’s too early to consider this as a possible reason. Now, as a result of the “poke” instruction – which commands the computer to try different sequences in its firmware in case part of it has been corrupted – engineers can compare it to previous downloads to hopefully figure out the cause behind the FDS problems and a possible solution.

Inspired by this news of the decoded memory download, Nadia Drake – daughter of Frank Drake – wrote about how it affects not only the engineers who have worked on the Voyager mission for the past decades but also her own thoughts about the two Voyager spacecraft. Not only do they form a lasting reminder of her father and so many of his colleagues, but the silence that would follow if we can no longer communicate with these spacecraft would be profound. Still, this new hope is better than the earlier news about this plucky little spaceship.

Thanks to [Mark Stevens] for the tip.

This Week In Security: Apple Backdoors Curl, Tor’s New Bridge, And GhostRace

OK, that headline is a bit of a cheap shot. But if you run the curl binary that Apple ships, you’re in for a surprise if you happen to use the --cacert flag. That flag specifies that TLS verification is only to be done using the certificate file specified. That’s useful to solve certificate mysteries, or to make absolutely sure that you’re connecting to the server you expect.

What’s weird here is that on a MacOS, using the Apple provided curl binary, --cacert doesn’t limit the program to the single certificate file. On an Apple system, the verification falls back to the system’s certificate store. This is an intentional choice by Apple, but not one that’s aimed particularly at curl. The real magic is in Apple’s SSL library, which forces the use of the system keychain.

The current state of things is that this option is simply not going to do the right thing in the Apple provided binary. It’s documented with the note that “this option is supported for backward compatibility with other SSL engines, but it should not be set.” It’s an unfortunate situation, and we’re hopeful that a workaround can be found to restore the documented function of this option. Continue reading “This Week In Security: Apple Backdoors Curl, Tor’s New Bridge, And GhostRace”

An Optical Computer Architecture

We always hear that future computers will use optical technology. But what will that look like for a general-purpose computer? German researchers explain it in a recent scientific paper. Although the DOC-II used optical processing, it did use some conventional electronics. The question is, how can you construct a general computer that uses only optical technology?

The paper outlines “Miller’s criteria” for practical optical logic gates. In particular, any optical scheme must provide outputs suitable for introduction to another gate’s inputs and also support fan out of one output to multiple inputs. It is also desirable that each stage does not propagate signal degradation and isolate its outputs from its inputs. The final two criteria note that practical systems don’t depend on loss for information representation since this isn’t reliable across paths, and, similarly, the gates should require high-precision adjustment to work correctly.

The paper also identifies many misconceptions about new computing devices. For example, they assert that while general-purpose desktop-class CPUs today contain billions of devices, use a minimum of 32-bits of data path, and contain RAM, this isn’t necessarily true for CPUs that use different technology. If that seems hard to believe, they make their case throughout the paper. We can’t remember the last scientific paper we read that literally posed the question, “Will it run Doom?” But this paper does actually propose this as a canonical question.

Continue reading “An Optical Computer Architecture”

μRepRap: Taking RepRap Down To Micrometer-Level Manufacturing

When the RepRap project was started in 2005 by [Dr Adrian Bowyer], the goal was to develop low-cost 3D printers, capable of printing most of their own components. The project slipped into a bit of a lull by 2016 due to the market being increasingly flooded with affordable FDM printers from a growing assortment of manufacturers. Now it seems that the RepRap project may have found a new impetus, in the form of sub-millimeter level fabrication system called the μRepRap as announced by [Vik Olliver] on the RepRap project blog, with accompanying project page.

The basic technology is based around the OpenFlexure project’s Delta Stage, which allows for very precise positioning of an imaging element, or conceivably a fabrication tool. As a first step, [Vik] upgrade the original delta stage to a much reinforced one that can accept larger NEMA17 stepper motors. This also allows for standard 3D printer electronics to control the system much like an FDM printer, only at much smaller scales and with new types of materials. The current prototype [Vik] made has a claimed step accuracy of 3 µm, with a range of tools and deposition materials being considered, including photosensitive resins.

It should be noted here that although this is a project in its infancy, it has solid foundations due to projects like OpenFlexure. Will μRepRap kickstart micrometer-level manufacturing like FDM 3D printing before? As an R&D project it doesn’t come with guarantees, but color us excited.

Thanks to [Tequin] for the tip.

This Week In Security: Blame The Feds, Emergency Patches, And The DMA

The temptation to “take the money and run” was apparently too much for the leadership of the AlphV ransomware crime ring. You may have heard of this group as being behind the breach of Change Healthcare, and causing payment problems for nearly the entire US Healthcare system. And that hack seems to be key to what’s happened this week.

It’s known that a $22 million payment made it through the bitcoin maze to the AlphV wallet on the 1st. It’s believed that this is a payment from Change Healthcare to recover ransomed files. An important detail here is that AlphV is a ransomware-as-a-service provider, and the actual hacking is done by “affiliates”, who use that service, and AlphV handles the infrastructure, maintaining the actual malware, and serving as a payment processor. That last one is key here.

A couple days after that big payment landed in the AlphV account, a seizure notice went up on the AlphV TOR site, claiming that it had been taken down by the FBI and associated agencies. There was something a bit odd about it, though. See, the FBI did seize the AlphV Tor site back in December. The seizure notice this time was an exact copy, as if someone had just done a “save page as”, and posted the copy.

There is precedent for a ransomware group to close up shop and disappear after hitting a big score. The disruption AlphV enabled in the US health care system painted a big target on them, and it didn’t take a tactical genius to realize it might be good to lay low for a while. Pocketing the entire $22 million ransom probably didn’t hurt either. The particularly nasty part is that the affiliate that actually pulled off the attack still claims to have four terabytes of sensitive data, and no incentive to not release it online. It’s not even entirely clear that Change Healthcare actually received a decryption key for their data. You do not want to deal with these people.

Continue reading “This Week In Security: Blame The Feds, Emergency Patches, And The DMA”

Yuzu And Citra Emulators Shut Down After Legal Pressure From Nintendo

In a move that came rather like a surprise to many, the company behind the well-known Switch and 3DS emulators Yuzu and Citra – Tropic Haze LLC – as reported by PC Gamer has shutdown both projects and associated websites as part of a US$2.4M settlement with Nintendo with a last message left on the Yuzu website. This comes in the wake of Nintendo suing Tropic Haze LLC over the Yuzu emulator, claiming that there’s ‘no lawful way to use Yuzu’, as it requires files extracted from a real Switch device to decrypt game files. Although Citra is not part of the lawsuit, it being made by the same developers seems to have resulted in it getting axed along with Yuzu as collateral damage.

What makes this issue so legally hairy is that even though an emulator by itself isn’t illegal, requiring proprietary firmware and keys already gets one into contested territory about the legality of dumping said files from a console, even if you own it. This was already an issue with the first Playstation emulators, which require the Playstation BIOS image to even boot, but left the emulator developers mostly untouchable. What seems to have set off Nintendo’s lawyers here would seem to be the way that the Yuzu developers leaned into the copyright infringement (often incorrectly called ‘piracy’) angle, giving Nintendo’s legal team enough exposed flesh to launch a ballistic legal strike.

Continue reading “Yuzu And Citra Emulators Shut Down After Legal Pressure From Nintendo”

This Week In Security: Forksquatting, RustDesk, And M&Ms

Github is struggling to keep up with a malware campaign that’s a new twist on typosquatting. The play is straightforward: Clone popular repositories, add malware, and advertise the forks as the original. Some developers mistake the forks for the real projects, and unintentionally run the malware. The obvious naming choice is forksquatting, but the researchers at apiiro went with the safer name of “Repo Confusion”.

The campaign is automated, and GitHub is aware of it, with the vast majority of these malicious repositories getting removed right away. For whatever reason, the GitHub algorithm isn’t catching all of the new repos. The current campaign appears to publishing millions of forks, using code from over 100,000 legitimate projects. It’s beginning to seem that the squatting family of attacks are here to stay.

RustDesk and Odd Certificates

The RustDesk remote access software is interesting, as it’s open source, allows self-hosting, and written in Rust. I’ve had exploring RustDesk as a todo item for a long time, but a bit of concerning drama has just finished playing out. A user pointed out back in November that a test root certificate was installed as part of the RustDesk installation. That root cert is self-signed with SHA1. There is also concern that the RustDesk binaries are signed with a different certificate.

There have been new events since then. First, there was a Hacker News thread about the issue earlier this month. The next day, CVE-2024-25140 was registered with NIST, ranking an insane CVE 9.8 CVSS. Let’s cut through some FUD and talk about what’s really going on.

Continue reading “This Week In Security: Forksquatting, RustDesk, And M&Ms”