This Week In Security: Linux WiFi, Fortinet, Text4Shell, And Predictable GUIDs

Up first this week is a quintet of vulnerabilities in the Linux kernel’s wireless code. It started with [Soenke Huster] from TU Darmstadt, who found a buffer overwrite in mac80211 code. The private disclosure to SUSE kernel engineers led to a security once-over of this wireless framework in the kernel, and some other nasty bugs were found. A couple result in Denial-of-Service (DOS), but CVE-2022-41674, CVE-2022-42719, and CVE-2022-42720 are Remote Code Execution vulnerabilities. The unfortunate bit is that these vulnerabilities are triggered on processing beacon frames — the wireless packets that announce the presence of a wireless network. A machine doesn’t have to be connected or trying to connect to a network, but simply scanning for networks can lead to compromise.

The flaws were announced on the 13th, and were officially fixed in the mainline kernel on the 15th. Many distros shipped updates on the 14th, so the turnaround was quite quick on this one. The flaws were all memory-management problems, which has prompted a few calls for the newly-merged Rust framework to get some real-world use sooner rather than later.

Fortinet

Much of Fortinet’s lineup, most notable their Fortigate firewalls, has a pre-auth authentication bypass on the administrative HTTP/S interface. Or plainly, if you can get to the login page, you can break in without a password. That’s bad, but at this point, you *really* shouldn’t have any administrative interfaces world-accessible on any hardware. Updated firmware is available.

More than just a couple days have passed, so we have some idea of the root problem and how it was fixed. It’s a simple one — the Forwarded HTTP headers on an incoming request are unintentionally trusted. So just send a request with Forwarded:for and Forwarded:by set to 127.0.0.1, and it falls through into code logic intended for internal API calls. Add a trusted SSH key, and pop, you’re in. Whoops. Continue reading “This Week In Security: Linux WiFi, Fortinet, Text4Shell, And Predictable GUIDs”

Retrotechtacular: The Original Weather Channel

The Weather Channel has decided to pull the plug on its automated weather display, a favorite experience for weather geeks everywhere. However, it wasn’t the original weather nerd TV station.  Early cable TV networks had their own low-tech versions of this much longer ago than you might expect. For example, check out the video below which shows one of these weather stations back in 1975.

The audio was from a local FM station and you can enjoy handwritten public service announcements, as well.

Continue reading “Retrotechtacular: The Original Weather Channel”

Crusty Leaking Cells Kill Your Tech. Just What’s Going On?

Seasoned Hackaday readers may have noticed over the years, that some of us who toil under the sign of the Jolly Wrencher have a penchant for older tech. After all, what’s not to like in a dirt cheap piece of consumer electronics from decades past that’s just begging for a bit of hardware hacking? For me at the moment this is manifesting itself in a selection of 8mm movie cameras, as I pursue a project that will eventually deliver a decent quality digital film cartridge.

When A Cell Is From West Germany, You Know It’s Old

A leaky Duracell, "Made In West Germany"
“Made in West Germany”

The trouble with scouring junk shops for a technology superseded four decades ago is that the cameras I find have in most cases been sitting in a drawer since the early 1980s. They were a valuable item back in the day so of course they were hung on to, then they were forgotten about until one day the grown-ups who were once the kids featured in the home movies are clearing the house, and they start their journey to my bench.

The problem is that very few owners of 8mm cameras had the good sense to remove their batteries before putting them away, so I inevitably end up with a battery compartment full of crusty 1980s Duracells and rusted contacts. This has left me curious, just what has happened here and how can I fix it?

What’s The Leaky Stuff?

Construction of a zinc-manganese "alkaline" cell.
Construction of a zinc-manganese “alkaline” cell. Tympanus, Public domain.

Non-rechargeable cells come in a variety of chemistries, but the commercial ones we’re most familiar with are zinc-carbon “dry cells”, and “Alkaline” zinc-manganese dioxide cells. The zinc-carbon variety are becoming less common here in 2022 and have an acidic zinc chloride or ammonium chloride electrolyte, while the alkaline cells have a higher capacity and a basic potassium hydroxide electrolyte. They both have different failure modes that result in the leaky cells, so it’s worth taking a look at each one.

The failure mode of a zinc-carbon cell is a chemical one, the acidic electrolyte reacts with the zinc can anode, and eventually eats through it. The leaking electrolyte then attacks the surrounding circuitry and battery clips. It’s hardly a concentrated acid, but it’s enough to do plenty of damage over the years.

Meanwhile an alkaline cell has a build-up of hydrogen as it degrades. It incorporates a vent which allows the hydrogen to escape, however the hydrogen pressure can instead force the electrolyte out through this vent. The electrolyte will then corrode the battery terminals and any other electronics it touches. A feature of alkaline cell leakage is a white crust, this is potassium carbonate formed from the reaction between the potassium hydroxide electrolyte and carbon dioxide in the air.

The Global Parts Bin To The Rescue

Fresh and new battery clips for AA holders
Fresh and new battery clips for AA holders

How much damage has been done is usually a function of how long the leaking batteries have been in the device. Sometimes one is lucky and the battery contacts are salvageable, otherwise they are too far gone and a replacement has to be found. A past me tried all sorts of home-made solutions using stiff copper wire and other materials, but today thanks to the miracle of international commerce it’s usually possible to find a contact the same as or very similar to the old one. A quick AliExpress search on terms such as “AA battery spring” will return numerous options, and it’s simply a case then of paging through to find the one you need on the terms you like.

So those of you who like retro tech will find something familiar in the last few paragraphs, but there’s a lesson to be found in dealing with ancient batteries. Here in 2022 we’re more likely to have lithium polymer cells in our consumer devices and so the need to keep a pile of Duracells at hand is reduced. But the thought of today’s equivalent of a Super 8 camera lying forgotten in a drawer for decades with a cheap li-po pouch cell inside it is far more frightening than something with some crusty manganese cells. Have we just found the root cause of house fires in the 2040s?

2022 Hackaday Prize: Congratulations, Wildcard Winners!

The Wildcard Round is the wildest round, and the 2022 Hackaday Prize had a slew of great entries. We’ve winnowed the wildcards down to a large handful, and we’re happy to announce the finalists. Every winner receives a $500 award, and is automatically entered for the final round of the Hackaday Prize. The grand prize winners will be announced during Supercon on Nov. 5th, and we’ll be streaming so you can root for your favorites whether you’re with us in Pasadena or not.

So without further ado, the finalists. Continue reading “2022 Hackaday Prize: Congratulations, Wildcard Winners!”

Art of 3D printer in the middle of printing a Hackaday Jolly Wrencher logo

3D Printering: Managing Multiple Printing Profiles

I know people who have 3D printers that are little more than appliances. They buy it, they print with it, and they don’t change much of anything. That doesn’t describe me and, I’m guessing, it doesn’t describe you either. This does lead to a problem, though, when it comes to slicers. You have to keep changing profiles and modifying them. It can be hard to keep things straight. For example, if you have profiles for different nozzles, you get to make a choice: keep one profile and edit the parts that change, or keep multiple profiles and any common changes have to be propagated to the other profiles.

Part of the reason I want to manage multiple profiles has to do with this mystery object…

I’ve long wanted to create a system that lets me have baseline profiles and then just use specific profiles that change a few items in the baseline. Turns out, I didn’t need to do it. Prusa Slicer and its fork, SuperSlicer, have the capability already. Both of these, of course, are based on Slic3r, but the scripting languages are different and what I’m doing does require G-code scripting. The problem is, this capability is not documented very well and the GUI doesn’t really support it directly, which requires a little sidestepping. I’ll show you how I have things set up and where the limitations are. If you want to try your hand at it, I highly suggest you backup your configuration directory or switch to a new one.

Continue reading “3D Printering: Managing Multiple Printing Profiles”

Mining And Refining: Cobalt, The Unfortunately Necessary Metal

The story of humankind is largely a tale of conflict, often brought about by the uneven distribution of resources. For as long as we’ve been down out of the trees, and probably considerably before that too, our ancestors have been struggling to get what they need to survive, as often as not at the expense of another, more fortunate tribe. Food, water, land, it doesn’t matter; if They have it and We don’t, chances are good that there’s going to be a fight.

Few resources are as unevenly distributed across our planet as cobalt is. The metal makes up only a fraction of a percent of the Earth’s crust, and commercially significant concentrations are few and far between, enough so that those who have some often end up at odds with those who need it. And need it we do; what started in antiquity as mainly a rich blue pigment for glass and ceramics has become essential for important industrial alloys, high-power magnets, and the anodes of lithium batteries, among other uses.

Getting access to our limited supply of cobalt and refining it into a useful metal isn’t a trivial process, and unfortunately its outsized importance to technological society forces it into a geopolitical role that has done a lot to add to human misery. Luckily, market forces and new technology are making once-marginal sources viable, which just may help us get the cobalt we need without all the conflict.

Continue reading “Mining And Refining: Cobalt, The Unfortunately Necessary Metal”

Lubrication Engineering Hack Chat

Join us on Wednesday, October 19 at noon Pacific for the Lubrication Engineering Hack Chat with Rafe Britton!

You know the old joke: if it moves when it shouldn’t, fix it with duct tape, and if it doesn’t move but it should, fix it with WD-40. For a lot of us, that’s about as far as our expertise on lubricants — and adhesives — goes. That’s a shame, because with hundreds of years of petrochemical engineering expertise behind us, not to mention millennia more of ad hoc experience with natural substances, just reaching for that trusty blue and yellow can for a spritz is perhaps a wasted opportunity. Sure, it’ll work — maybe — but is it really the right tool for the job?

Modern lubricants are extremely complex and highly engineered materials, often built atom by atom to perform a specific job under specific, often extremely challenging, conditions. Oils and greases are much more than just the slippery stuff that keeps our mechanical systems running, and while you might not need to know all the details of how they’re made to put them to use, a little inside information could go a long way in making sure your mechanism lasts.

join-hack-chatWe’ve invited Rafe Britton on the Hack Chat to talk about all aspects of lubrication engineering. With degrees in engineering and physics, Rafe runs Lubrication Expert and the Lubrication Explained channel on YouTube to help his clients figure out what they don’t know about lubrication, and how to put that knowledge to use in the real world. Be sure to bring your questions and concerns about lubrication, as well as your lubrication success stories and failures — especially the failures!

Our Hack Chats are live community events in the Hackaday.io Hack Chat group messaging. This week we’ll be sitting down on Wednesday, October 19 at 12:00 PM Pacific time. If time zones have you tied up, we have a handy time zone converter.