Hackaday Links Column Banner

Hackaday Links: November 14, 2021

If you’re an infrastructure dweeb, it’s hard to drive past an electrical substation and not appreciate the engineering involved in building something like that. A moment’s thought will also make it hard to miss just how vulnerable a substation is to attack, especially those located way out in the hinterlands. And now we’re learning that late year, someone in Pennsylvania noticed this vulnerability and acted on it by attacking a substation with a commercial drone. Rather than trying to fly explosives over the substation fence, the attacker instead chose to dangle a copper wire tether under the drone, in an attempt to cause a short circuit. The attempt apparently failed when the drone crashed before contacting any conductors, and the attacker appears to have been ignorant of the extensive protective gear employed at substations that likely would have made a successful attack only a temporary outage. But it still points to the vulnerability of the grid to even low-skill, low-cost attacks.

We’ve probably all had the experience of using someone’s janky app and thinking, “Pfft! I could write something better than this!” That’s what a bunch of parents of school-age kids in Sweden thought, and they went ahead and did exactly that. Unfortunately, it didn’t turn out quite the way they expected. The problem app was called Skolplattform, which was supposed to make it easy for Stockholm’s parents to keep track of their kids’ progress at school. The app, which cost 1 billion Swedish Krona to develop, is by all accounts a disaster. But some frustrated parents managed to reverse engineer the API and build a new, better one on top of it. This resulted in Öppna Skolplattformen, an open-source app that actually works. Not to be upstaged, the city of Stockholm accused the parents of cyber crimes and data breaches. They also engaged the parents in an “API war”, constantly changing their system to nerf the new app and forcing the parents to rewrite it. In the end, the parents won, with Stockholm changing its position after a police report found that all data being accessed were voluntarily made public by the city. But it’s still a cautionary tale about the dangers of one-upping The Man.

Sam Battles is in a bit of a moral bind, and it’s something that others in our community may run into. Sam is perhaps better known as “Look Mum, No Computer” on YouTube, and as the proprietor of the “This Museum Is (Not) Obsolete” showcase of retro technology in England. He’s also an avid builder of analog synthesizers, including a world-record synth with a thousand oscillators called the “Megadrone.” He’d like to tackle another build to try to break his own records, but in a time of fragile supply chains and other woes too numerous to mention, doing so would likely require the world’s entire supply of some components. Hence the dilemma: do any of us as hobbyists have a moral obligation to tread lightly when it comes to component selection? It’s an interesting question, and one that’s sure to engender strong opinions, which of course we encourage you to share in the comments section. Please just try to keep it civil.

Continue reading “Hackaday Links: November 14, 2021”

This Week In Security: Unicode Strikes, NPM Again, And First Steps To PS5 Crack

Maybe we really were better off with ASCII. Back in my day, we had space for 256 characters, didn’t even use 128 of them, and we took what we got. Unicode opened up computers to the languages of the world, but also opened an invisible backdoor. This is a similar technique to last week’s Trojan Source story. While Trojan Source used right-to-left encoding to manipulate benign-looking code, this hack from Certitude uses Unicode characters that appear to be whitespace, but are recognized as valid variable names.

const { timeout,ㅤ} = req.query;
Is actually:
const { timeout,\u3164} = req.query;

The extra comma might give you a clue that something is up, but unless you’re very familiar with a language, you might dismiss it as a syntax quirk and move on. Using the same trick again allows the hidden malicious code to be included on a list of commands to run, making a hard-to-spot backdoor.

The second trick is to use “confusable” characters like ǃ, U+01C3. It looks like a normal exclamation mark, so you wouldn’t bat an eye at if(environmentǃ=ENV_PROD){, but in this case, environmentǃ is a new variable. Anything in this development-only block of code is actually always enabled — imagine the chaos that could cause.

Neither of these are ground-breaking vulnerabilities, but they are definitely techniques to be wary of. The authors suggest that a project could mitigate these Unicode techniques by simply restricting their source code to containing only ASCII characters. It’s not a good solution, but it’s a solution. Continue reading “This Week In Security: Unicode Strikes, NPM Again, And First Steps To PS5 Crack”

Quantum computer

Scientific Honesty And Quantum Computing’s Latest Theoretical Hurdle

Quantum computers are really in their infancy. If you created a few logic gates with tubes back in the 1930s, it would be difficult to predict all the ways we would use computers today. However, you could probably guess where at least some of the problems would lie in the future. One of the things we are pretty sure will limit quantum computer development is error correction.

As far as we know, every quantum qubit we’ve come up with so far is very fragile and prone to random errors. That’s why every practical design today incorporates some sort of QEC — quantum error correction. Of course, error correction isn’t news. We use it all the time on unreliable storage media or communication channels and high-reliability memory. The problem is, you can’t directly clone a qubit (a quantum bit), so it is hard to use traditional error correction techniques with qubits.

After all, the whole point to a qubit is we don’t measure it until the end of the computation which, like Schrödinger’s cat, seals its fate. So if you were to “read” a bunch of qubits to form a checksum or a CRC, you’d destroy their quantum nature in the process making your computer not very useful. You can’t even copy a bit to use something like triple redundancy, either. There seems to be no way to practically duplicate a qubit.

Continue reading “Scientific Honesty And Quantum Computing’s Latest Theoretical Hurdle”

Sulfur Hexafluoride: The Nightmare Greenhouse Gas That’s Just Too Useful To Stop Using

Sulfur hexafluoride (SF6) is not nearly as infamous as CO2, with the latter getting most of the blame for anthropogenic climate change. Yet while measures are being implemented to curb the release of CO2, for SF6 the same does not appear to be the case, despite the potentially much greater impact that SF6 has. This is because when released into the atmosphere, CO2 only has a global warming potential (GWP) of 1, whereas that of methane is about 28 over 100 years, and SF6 has a GWP of well over 22,000 over that same time period.

Also of note here is that while methane will last only about 12.4 years in the atmosphere, SF6 is so stable that it lasts thousands of years, currently estimated at roughly 3,200 years. When we touched upon sulfur hexafluoride back in 2019 in the context of greenhouse gases, it was noted that most SF6 is used for — and leaks from — high-voltage switchgear (mechanical switches), transformers and related, where the gas’ inert and stable nature makes it ideal for preventing and quenching electrical arcing.

With the rapid growth of highly distributed energy production in the form of mostly (offshore) wind turbines and PV solar parks, this also means that each of these is equipped with its own (gas-filled) switchgear. With SF6 still highly prevalent in this market, this seems like an excellent opportunity to look into how far SF6 usage has dropped, and whether we may be able to manage to avert a potential disaster.

Continue reading “Sulfur Hexafluoride: The Nightmare Greenhouse Gas That’s Just Too Useful To Stop Using”

NFC Performance: It’s All In The Antenna

NFC tags are a frequent target for experimentation, whether simply by using an app on a mobile phone to interrogate or write to tags, by incorporating them in projects by means of an off-the-shelf module, or by designing a project using them from scratch. Yet they’re not always easy to get right, and can often give disappointing results. This article will attempt to demystify what is probably the most likely avenue for an NFC project to have poor performance, the pickup coil antenna in the reader itself.

A selection of the NFC tags on my desk
A selection of the NFC tags on my desk

The tags contain chips that are energised through the RF field that provides enough power for them to start up, at which point they can communicate with a host computer for whatever their purpose is.

“NFC” stands for “Near Field Communication”, in which data can be exchanged between physically proximate devices without their being physically connected.  Both reader and tag achieve this through an antenna, which takes the form of a flat coil and a capacitor that together make a resonant tuned circuit. The reader sends out pulses of RF which is maintained once an answer is received from a card, and thus communication can be established until the card is out of the reader’s range. Continue reading “NFC Performance: It’s All In The Antenna”

Robot astronaut gazing at the moon

NASA’s New Moon Missions Are Happening Really Soon

NASA first landed a human on the moon back in 1969, and last achieved the feat in December 1972. In the intervening years, there have been few other missions to Earth’s primary natural satellite. A smattering of uncrewed craft have crashed into the surface, while a mere handful of missions have achieved a soft landing, with none successful from 1976 to 2013.

However, NASA aims to resume missions to the lunar surface, albeit in an uncrewed capacity at this stage. And you won’t have to wait very long, either. The world’s premier space agency aims to once again fly to the Moon beginning in February 2022.

Continue reading “NASA’s New Moon Missions Are Happening Really Soon”

Teardown: Analog Radionic Analyzer

Have you ever looked up a recipe online, and before you got to the ingredients, you had to scroll through somebody’s meandering life story? You just want to know how many cans of tomato paste to buy, but instead you’re reading about cozy winter nights at grandma’s house? Well, that’s where you are right now, friend. Except instead of wanting to know what goes in a lasagna, you just want to see the inside of some weirdo alternative medicine gadget. I get it, and wouldn’t blame you for skipping ahead, but I would be remiss to start this month’s teardown without a bit of explanation as to how it came into my possession.

So if you’ll indulge me for a moment, I’ll tell you a story about an exceptionally generous patron, and the incredible wealth of sham medical hokum that they have bestowed upon the Hackaday community…

Continue reading “Teardown: Analog Radionic Analyzer”