The Dark Arts – Remote File Inclusion

July 31, 2017 by Will Sweatman 26 Comments

In the waning hours of 2010, a hacking group known as Lulzsec ran rampant across the Internet, leaving a path of compromised servers, a trail of defaced home pages, leaked emails, and login information in their wake. They were eventually busted via human error, and the leader of the group becoming an FBI informant. This handful of relatively young hackers had made a huge mess of things. After the digital dust had settled – researches, journalists, and coders began to dissect just how these seemingly harmless group of kids were able to harness so much power and control over the World Wide Web. What they found was not only eye-opening to web masters and coders, but shined a light on just how vulnerable all of our data was for everyone to see. It ushered in an era of renewed focus on security and how to write secure code.

In this Dark Arts series, we have taken a close look at the primary techniques the Luzsec hackers used to gain illegal access to servers. We’ve covered two them – SQL injection (SQLi) and cross-site scripting (XSS). In this article, we’ll go over the final technique called remote file inclusion (RFI).

DISCLAIMER: Fortunately, the surge of security-minded coding practices after the fall of Lulzsec has (for the most part) removed these vulnerabilities from the Internet as a whole. These techniques are very dated and will not work on any server that is maintained and/or behind a decent firewall, and your IP will probably get flagged and logged for trying them out. But feel free to set up a server at home and play around. Continue reading “The Dark Arts – Remote File Inclusion” →

Home Automation: Evolution Of A Term

July 26, 2017 by John Baichtal 31 Comments

Home automation: for me the term recalls rich dudes in the ’80s who could turn off their garage lights with remote-control pads. The stereotype for that era was the more buttons your system had—even non-enabled ones—the more awesome it was, and by extension any luxury remote control had to be three times the size of any TV remote.

And it was a luxury–the hardware was expensive and most people couldn’t justify it. Kind of like the laser-disc player of home improvements. The technology was opaque to casual tinkering, it cost a lot to buy, and also was expensive to install.

The richie-rich stereotypes were reinforced with the technology seen in Bond movies and similar near-future flicks. Everything, even silly things, is motorized, with chrome and concrete everywhere. You, the hero, control everything in the house in the comfort of your acrylic half-dome chair. Kick the motorized blinds, dim the track lighting, and volume up the hi-fi!

This Moonraker-esque notion of home automation turned out to be something of a red herring, because home automation stopped being pretty forever ago; eventually it became available to everyone with a WiFi router in the form of Amazon Echo and Google Nest.

But the precise definition of the term home automation remains elusive. I mean, the essence of it. Let’s break it down.

Continue reading “Home Automation: Evolution Of A Term” →

Earth Ground And The Grid

July 25, 2017 by Steven Dufresne 46 Comments

The electrical grid transmits power over wires to our houses, and our Bryan Cockfield has covered it very well in his Electrical Grid Demystified series, but what part does the earth ground play? It’s commonly known to be used for safety, but did you know that in some cases it’s also used for power transmission?

Typical House Grounding System

A pretty typical diagram for the grounding system for a house is shown here, along with a few of the current carrying conductors commonly called live and neutral. On the far left is the transformer outside the house and on the far right is an appliance that’s plugged in. In between them is a breaker panel and a wall socket of the style found in North America. The green dashed line shows the normal path for current to flow.

Notice the grounding electrodes for making an electrical connection with the earth ground. To use the US National Electrical Code (NEC) as an example, article 250.52 lists eight types of grounding electrodes. One very good type is an electrode encased in concrete since concrete continues to draw moisture from the ground and makes good physical contact due to its weight. Another is a grounding rod or pipe at least eight feet long and inserted deep enough into the ground. By deep enough, we mean to include factors such as the fact that the frost line doesn’t count as a good ground since it has a high resistance. You have to be careful of using metal water pipes that seemingly go into the ground, as sections of these are often replaced with non-metallic pipes during regular maintenance.

Notice also in the diagram that there are places where the various metal cases are connected to the grounding system. This is called bonding.

Now, how does all this system grounding help us? Let’s start with handling a fault.

Continue reading “Earth Ground And The Grid” →

Serious DX: The Deep Space Network

July 21, 2017 by Dan Maloney 28 Comments

Humanity has been a spacefaring species for barely sixty years now. In that brief time, we’ve fairly mastered the business of putting objects into orbit around the Earth, and done so with such gusto that a cloud of both useful and useless objects now surrounds us. Communicating with satellites in Earth orbit is almost trivial; your phone is probably listening to at least half a dozen geosynchronous GPS birds right now, and any ham radio operator can chat with the astronauts aboard the ISS with nothing more that a $30 handy-talkie and a homemade antenna.

But once our spacecraft get much beyond geosynchronous orbit, communications get a little dicier. The inverse square law and the limited power budget available to most interplanetary craft exact a toll on how much RF energy can be sent back home. And yet the science of these missions demands a reliable connection with enough bandwidth to both control the spacecraft and to retrieve its precious cargo of data. That requires a powerful radio network with some mighty big ears, but as we’ll see, NASA isn’t the only one listening to what’s happening out in deep space. Continue reading “Serious DX: The Deep Space Network” →

Hitching A Ride On A Missile

July 18, 2017 by Bryan Cockfield 71 Comments

Before the Saturn V rocket carried men to the moon, a number of smaller rockets carried men on suborbital and orbital flights around the Earth. These rockets weren’t purpose-built for this task, though. In fact, the first rockets that carried people into outer space were repurposed ballistic missiles, originally designed to carry weapons.

While it might seem like an arduous task to make a ballistic missile safe enough to carry a human, the path from a weapons delivery system to passenger vehicle was remarkably quick. Although there was enough safety engineering and redundancy to disqualify the space program as a hack, it certainly was a clever repurposing of the available technology. Read on for the full story.

Continue reading “Hitching A Ride On A Missile” →

Conventional Current Vs. Electron Current

July 17, 2017 by Steven Dufresne 58 Comments

Electric current comes in many forms: current in a wire, flow of ions between the plates of a battery and between plates during electrolysis, as arcs, sparks, and so on. However, here on Hackaday we mostly deal with the current in a wire. But which way does that current flow in that wire? There are two possibilities depending on whether you’re thinking in terms of electron current or conventional current.

Electron current vs. conventional current

In a circuit connected to a battery, the electrons are the charge carrier and flow from the battery’s negative terminal, around the circuit and back to the positive terminal.

Conventional current takes just the opposite direction, from the positive terminal, around the circuit and back to the negative terminal. In that case there’s no charge carrier moving in that direction. Conventional current is a story we tell ourselves.

But since there is such a variety of forms that current comes in, the charge carrier sometimes does move from the positive to the negative, and sometimes movement is in both directions. When a lead acid battery is in use, positive hydrogen ions move in one direction while negative sulfate ions move in the other. So if the direction doesn’t matter then having a convention that ignores the charge carrier makes life easier.

Saying that we need a convention that’s independent of the charge carrier is all very nice, but that seems to be a side effect rather than the reason we have the convention. The convention was established long before there was a known variety of forms that current comes in — back even before the electron, or even the atom, was discovered. Why do we have the convention? As you’ll read below, it started with Benjamin Franklin.

Continue reading “Conventional Current Vs. Electron Current” →

Books You Should Read: The Bridge

July 14, 2017 by Adam Fabio 97 Comments

A few weeks ago, Amazon’s crack marketing AI decided to recommend a few books for me. That AI must be getting better because instead of the latest special-edition Twilight books, I was greeted with this:

“The asteroid was called the Hand of God when it hit.”

That’s the first sentence of The Bridge, a new Sci-Fi book by Leonard Petracci. If you think that line sucks you in, wait until you read the whole first chapter.

The Bridge is solidly in the generation ship trope. A voyage hundreds or even thousands of years long, with no sleep or stasis pods. The original crew knows they have no hope of seeing their destination, nor will their children and grandchildren. Heinlein delved into it with Orphans of the Sky. Even Robert Goddard himself discussed generation ships in The Last Migration.

I wouldn’t call The Bridge hard Sci-Fi — and that’s perfectly fine. Leonard isn’t going for scientific accuracy. It’s a great character driven story. If you enjoyed a book like Ready Player One, you’ll probably enjoy this.

The Bridge Is the story of Dandelion 14, a ship carrying people of Earth to a new planet. At some point during the journey, Dandelion 14 was struck by an asteroid, which split the ship in two. Only a few wires and cables keep the halves of the ship together. The crew on both sides of the ship survived, but they had no way to communicate. They do catch glimpses of each other in the windows though.

Much of the story is told in the first person by Horatius, a young man born hundreds of years after the asteroid strike. Horatius’ side of the ship has a population of one thousand, carefully measured at each census. They’ve lost knowledge of how to operate the ship’s systems, but they are surviving. Most of the population are gardeners, but there are doctors, cooks, porters, and a few historians. At four years old, Horatius is selected to become a gardener, like his father was before him. But Horatius has higher aspirations. He longs to become a historian to learn the secrets of the generations that came before him and to write his own story down for those who will come after.

Horatius sees the faces of the people on the other side of the ship as well. Gaunt, hungry, often fighting with knives or other weapons. A stark contrast to the well-fed people on his side of the vessel. The exception is one red-haired girl about his age. He often finds her staring back at him, watching him.

Horatius might have been chosen as a gardener, but he’s clever — a fact that sometimes gets him in trouble. His life takes an abrupt turn when the sleeping ship awakens with an announcement blaring “Systems Rebooting, Ship damage assessed. Reuniting the two halves of the ship and restoring airlock, approximately twenty-four hours until complete.”

The hardest part of writing a book review is not giving too much away. While I won’t tell you much more about the plot for The Bridge, I can tell a bit about how the book came about. You might call this book a hack of the publishing system. Leonard Petracci is also known as leoduhvinci on Reddit. The Bridge started life as Leonard’s response to a post on /r/writingprompts. The prompt went like this:

After almost 1,000 years the population of a generation ship has lost the ability to understand most technology and now lives at a pre-industrial level. Today the ship reaches its destination and the automated systems come back online.

Leonard ’s response to the prompt shot straight to the top, and became the first chapter of The Bridge. Chapter 2 followed soon after. In only a few months, the book was complete. Available on Reddit, and on Leonard’s website. The Bridge is also available on Amazon for Kindle, and on paper from Amazon’s CreateSpace.

The only real criticism I have about The Bridge is the ending. The book’s resolution felt a bit rushed. It would have been nice to have a few more pages telling us what happened to the characters after the major events of the book. Leonard is planning a sequel though, and he teases this in the final pages.

You can start reading The Bridge right now on Leonard’s website. He has the entire book online for free for a few more weeks. If you’ve missed the free period, the Kindle edition is currently $2.99.