Your Next Airport Meal May Be Delivered By Robot

December 23, 2022 by Zoe Skyforest 26 Comments

Robot delivery has long been touted as a game-changing technology of the future. However, it still hasn’t cracked the big time. Drones still aren’t airdropping packages into our gutters by accident, nor are our pizzas brought to us via self-driving cars.

That’s not to say that able minds aren’t working on the problem. In one case, a group of engineers are working ton a robot that will handle the crucial duty of delivering food to hungry flyers at the airport.

Continue reading “Your Next Airport Meal May Be Delivered By Robot” →

This Week In Security: GitHub Actions, SHA-1 Retirement, And A Self-Worming Vulnerability

December 23, 2022 by Jonathan Bennett 6 Comments

It should be no surprise that running untrusted code in a GitHub Actions workflow can have unintended consequences. It’s a killer feature, to automatically run through a code test suite whenever a pull request is opened. But that pull request is run in some part of the target’s development environment, and there’s been a few clever attacks found over the years that take advantage of that. There’s now another one, what Legit Security calls Github Environment Injection, and there were some big-name organizations vulnerable to it.

The crux of the issue is the $GITHUB_ENV file, which contains environment variables to be set in the Actions environment. Individual variables get added to this file as part of the automated action, and that process needs to include some sanitization of data. Otherwise, an attacker can send an environment variable that includes a newline and completely unintended environment variable. And an unintended, arbitrary environment variable is game over for the security of the workflow. The example uses the NODE_OPTIONS variable to dump the entire environment to an accessible output. Any API keys or other secrets are revealed.

This particular attack was reported to GitHub, but there isn’t a practical way to fix it architecturally. So it’s up to individual projects to be very careful about writing untrusted data into the $GITHUB_ENV file.

Continue reading “This Week In Security: GitHub Actions, SHA-1 Retirement, And A Self-Worming Vulnerability” →

BBC World Service Turns 90

December 22, 2022 by Al Williams 23 Comments

If you’ve ever owned a shortwave radio, you’ve probably listened at least a little to the BBC World Service. After all, they are a major broadcasting force, and with the British Empire or the Commonwealth spanning the globe, they probably had a transmitter close to your backyard. Recently, the BBC had a documentary about their early years of shortwave broadcasting. It is amazing both because it started so simply and when you think how far communications have progressed in just a scant 100 years.

Today, the BBC World Service broadcasts in over 40 languages distributing content via radio, TV, satellite, and the Internet. Hard to imagine it started with four people who were authorized to spend 10 pounds a week.

Continue reading “BBC World Service Turns 90” →

Blood Pressure Monitoring, Courtesy Of Cameras And AI

December 21, 2022 by Zoe Skyforest 60 Comments

At the basic level, methods of blood pressure monitoring have slowly changed in the last few decades. While most types of sphygmomanometer still rely on a Velcro cuff placed around the arm, the methodology used in measurement varies. Analog mercury and aneroid types still abound, while digital blood pressure monitors using electrical sensors have become mainstream these days.

Researchers have now developed a new non-invasive method of measurement that does away with the arm cuff entirely. The method relies entirely on video capture with a camera and processing via AI.

Continue reading “Blood Pressure Monitoring, Courtesy Of Cameras And AI” →

Big Chemistry: Liquefied Natural Gas

December 21, 2022 by Dan Maloney 44 Comments

The topic of energy has been top-of-mind for us since the first of our ancestors came down out of the trees looking for something to eat that wouldn’t eat them. But in a world where the neverending struggle for energy has been abstracted away to the flick of a finger on a light switch or thermostat, thanks to geopolitical forces many of us are now facing the wrath of winter with a completely different outlook on what it takes to stay warm.

The problem isn’t necessarily that we don’t have enough energy, it’s more that what we have is neither evenly distributed nor easily obtained. Moving energy from where it’s produced to where it’s needed is rarely a simple matter, and often poses significant and interesting engineering challenges. This is especially true for sources of energy that don’t pack a lot of punch into a small space, like natural gas. Getting it across a continent is challenging enough; getting it across an ocean is another thing altogether, and that’s where liquefied natural gas, or LNG, comes into the picture.

Continue reading “Big Chemistry: Liquefied Natural Gas” →

All About USB-C: Connector Mechanics

December 20, 2022 by Arya Voronova 32 Comments

There’s two cases when hackers have to think about USB-C connector mechanics. The first is when a USB-C connector physically breaks, and the second is when we need to put a connector on our own board. Let’s go through both of them.

Clean That Connector

What if a socket on your phone or laptop fails? First off, it could be due to dust or debris. There’s swabs you can buy to clean a USB-C connector; perhaps adding some isopropyl alcohol or other cleaning-suitable liquids, you can get to a “good enough” state. You can also reflow pins on your connector, equipped with hot air or a sharp soldering iron tip, as well as some flux – when it comes to mechanical failures, this tends to remedy them, even for a short period of time.

How could a connector fail, exactly? Well, one of the pins could break off inside the plastic, or just get too dirty to make contact. Consider a device with a USB-C charging and data socket, with USB 2.0 but without high-speed pairs – which is to say, sadly, the majority of the phones out there. Try plugging it into a USB-A charger using a USB-A to USB-C cable. Does it charge, even if slowly? Then, your VBUS pins are okay.

Plug it into a Type-C charger using a Type-C cable, and now the CC pins are involved. Does it charge in both orientations? Then both of your CC pins are okay. Does it charge in only one orientation? One of the CC pins has to be busted. Then, you can check USB 2.0 pins, used for data transfer and legacy charging. Plug the phone into a computer using a USB-A to USB-C cable. Does it enumerate as a device? Does it enumerate in both orientations? If not, you might want to clean D- and D+ pins specifically, maybe even both sets. Continue reading “All About USB-C: Connector Mechanics” →

A Love Letter To My Lost Amiga

December 20, 2022 by Jenny List 141 Comments

My first love was a black wedge. It was 1982, and I had saved up to buy a Sinclair ZX81. That little computer remains the only one of the huge number that I have owned over the years about which I can truly say that I understood its workings completely; while I know how the i7 laptop on which this is being written works I can only say so in a loose way as it is an immensely complex device.

Computing allegiance is fickle, and while I never lost an affection for the little Sinclair I would meet my true electronic soulmate around eight years later as an electronic engineering student. It no longer graces my bench, but this was the computer against which all subsequent machines I have owned would be measured, the one which I wish had not been taken from me before its time, and with which I wish I could have grown old together. That machine was a Commodore Amiga, and this is part love letter, part wistful musing about what could have been, and part rant about what went wrong for the best desktop computer platform ever made. Continue reading “A Love Letter To My Lost Amiga” →