Slider

5118 Articles

Privacy Report: What Android Does In The Background

November 18, 2021 by 76 Comments

We’ve come a long way from the Internet of the 90s and early 00s. Not just in terms of technology, capabilities, and culture, but in the attitude most of us take when accessing the ‘net. In those early days most users had a militant drive to keep any personal or identifying information to themselves beyond the occasional (and often completely fictional) a/s/l, and before eBay and Amazon normalized online shopping it was unheard of to even type in a credit card number. On today’s internet we do all of these things with reckless abandon, and to make matters worse most of us carry around a device which not only holds all of our personal information but also reports everything about us, from our browsing habits to our locations, back to databases to be stored indefinitely.

It was always known that both popular mobile operating systems for these devices, iOS and Android, “phone home” or report data about us back to various servers. But just how much the operating systems themselves did was largely a matter of speculation, especially for Apple devices which are doing things that only Apple can really know for sure. While Apple keeps their mysteries to themselves and thus can’t be fully trusted, Android is much more open which paradoxically makes it easier for companies (and malicious users) to spy on users but also makes it easier for those users to secure their privacy on their own. Thanks to this recent privacy report on several different flavors of Android (PDF warning) we know a little bit more on specifically what the system apps are doing, what information they’re gathering and where they’re sending it, and exactly which versions of Android are best for those of us who take privacy seriously.

Continue reading “Privacy Report: What Android Does In The Background” →

Back of Rigol DS1104Z oscilloscope with the Ethernet and USB ports visible.

SCPI: On Teaching Your Devices The Lingua Franca Of Laboratories

November 17, 2021 by 31 Comments

One could be excused for thinking sometimes that the concept of connecting devices with other devices for automation purposes is a fairly recent invention. Yet for all the (relatively) recent hype of the Internet of Things and the ‘smart home’, laboratories have been wiring up their gear to run complicated measurement and test sequences for many decades now, along with factories doing much the same for automating production processes.

Much like the chaotic universe of IoT devices, lab equipment from different manufacturers feature a wide number of incompatible protocol and interface standards. Ultimately these would coalesce into IEEE-488.1 (GPIB) as the physical layer and by 1990 the first Standard Commands for Programmable Instruments (SCPI) standard was released that built on top of IEEE-488.

SCPI defines (as the name suggests) standard commands to interact with instruments. It has over the past decades gone on to provide remote interaction capabilities to everything from oscilloscopes and power supplies to exotic scientific equipment. Many off the shelf devices a hobbyist can buy today feature an SCPI interface via its Ethernet, USB or RS-232C port(s) that combined with software can be used to automate one’s home lab.

Even better is that it’s relatively straightforward to add SCPI functionality to one’s own devices as well, so long as it has at least an MCU and some way to communicate with the outside world.

Continue reading “SCPI: On Teaching Your Devices The Lingua Franca Of Laboratories” →

Microplastics Are Everywhere: Land, Sea And Air

November 16, 2021 by 65 Comments

Plastics took off in the 20th century, with the new class of materials finding all manner of applications that metal, wood and paper simply couldn’t deliver on. Every field from electronics to the packaging of food found that plastics could play a role.

Now, over 150 years since the development of Parkesine in 1867, we’re now realizing that plastics come with more than a few drawbacks. They don’t break down well in nature, and now microplastics are beginning to appear all over the Earth, even in places where humans rarely tread. It seems they may even spread via the air, so let’s take a look at this growing problem and what can be done about it.

Continue reading “Microplastics Are Everywhere: Land, Sea And Air” →

Tech In Plain Sight: Eyeglasses

November 16, 2021 by 47 Comments

Glasses wearers, try a little experiment. Take off your glasses and look at this page or, at least, at something you can’t see well without your glasses. Now imagine if you lived in a time where there was nothing to be done about your vision. If you wear contacts or you have good vision — perhaps you had surgery — then congratulations. But for most of us, vision changes with age are a fact of life. Even many young people need glasses or some other intervention to get good eyesight. At first glance, you might think eyeglasses are an obvious invention, but it turns out we didn’t get real glasses for quite some time and modern glasses are truly a piece of high tech that hides — quite literally — right in front of your face.

Continue reading “Tech In Plain Sight: Eyeglasses” →

Mining And Refining: Pure Silicon And The Incredible Effort It Takes To Get There

November 15, 2021 by 30 Comments

Were it not for the thin sheath of water and carbon-based life covering it, our home planet would perhaps be best known as the “Silicon World.” More than a quarter of the mass of the Earth’s crust is silicon, and together with oxygen, the silicate minerals form about 90% of the thin shell of rock that floats on the Earth’s mantle. Silicon is the bedrock of our world, and it’s literally as common as dirt.

But just because we have a lot of it doesn’t mean we have much of it in its pure form. And it’s only in its purest form that silicon becomes the stuff that brought our world into the Information Age. Elemental silicon is very rare, though, and so getting appreciable amounts of the metalloid that’s pure enough to be useful requires some pretty energy- and resource-intensive mining and refining operations. These operations use some pretty interesting chemistry and a few neat tricks, and when scaled up to industrial levels, they pose unique challenges that require some pretty clever engineering to deal with.

Continue reading “Mining And Refining: Pure Silicon And The Incredible Effort It Takes To Get There” →

Hackaday Links Column Banner

Hackaday Links: November 14, 2021

November 14, 2021 by 21 Comments

If you’re an infrastructure dweeb, it’s hard to drive past an electrical substation and not appreciate the engineering involved in building something like that. A moment’s thought will also make it hard to miss just how vulnerable a substation is to attack, especially those located way out in the hinterlands. And now we’re learning that late year, someone in Pennsylvania noticed this vulnerability and acted on it by attacking a substation with a commercial drone. Rather than trying to fly explosives over the substation fence, the attacker instead chose to dangle a copper wire tether under the drone, in an attempt to cause a short circuit. The attempt apparently failed when the drone crashed before contacting any conductors, and the attacker appears to have been ignorant of the extensive protective gear employed at substations that likely would have made a successful attack only a temporary outage. But it still points to the vulnerability of the grid to even low-skill, low-cost attacks.

We’ve probably all had the experience of using someone’s janky app and thinking, “Pfft! I could write something better than this!” That’s what a bunch of parents of school-age kids in Sweden thought, and they went ahead and did exactly that. Unfortunately, it didn’t turn out quite the way they expected. The problem app was called Skolplattform, which was supposed to make it easy for Stockholm’s parents to keep track of their kids’ progress at school. The app, which cost 1 billion Swedish Krona to develop, is by all accounts a disaster. But some frustrated parents managed to reverse engineer the API and build a new, better one on top of it. This resulted in Öppna Skolplattformen, an open-source app that actually works. Not to be upstaged, the city of Stockholm accused the parents of cyber crimes and data breaches. They also engaged the parents in an “API war”, constantly changing their system to nerf the new app and forcing the parents to rewrite it. In the end, the parents won, with Stockholm changing its position after a police report found that all data being accessed were voluntarily made public by the city. But it’s still a cautionary tale about the dangers of one-upping The Man.

Sam Battles is in a bit of a moral bind, and it’s something that others in our community may run into. Sam is perhaps better known as “Look Mum, No Computer” on YouTube, and as the proprietor of the “This Museum Is (Not) Obsolete” showcase of retro technology in England. He’s also an avid builder of analog synthesizers, including a world-record synth with a thousand oscillators called the “Megadrone.” He’d like to tackle another build to try to break his own records, but in a time of fragile supply chains and other woes too numerous to mention, doing so would likely require the world’s entire supply of some components. Hence the dilemma: do any of us as hobbyists have a moral obligation to tread lightly when it comes to component selection? It’s an interesting question, and one that’s sure to engender strong opinions, which of course we encourage you to share in the comments section. Please just try to keep it civil.

Continue reading “Hackaday Links: November 14, 2021” →

This Week In Security: Unicode Strikes, NPM Again, And First Steps To PS5 Crack

November 12, 2021 by 33 Comments

Maybe we really were better off with ASCII. Back in my day, we had space for 256 characters, didn’t even use 128 of them, and we took what we got. Unicode opened up computers to the languages of the world, but also opened an invisible backdoor. This is a similar technique to last week’s Trojan Source story. While Trojan Source used right-to-left encoding to manipulate benign-looking code, this hack from Certitude uses Unicode characters that appear to be whitespace, but are recognized as valid variable names.

const { timeout,ㅤ} = req.query;
Is actually:
const { timeout,\u3164} = req.query;

The extra comma might give you a clue that something is up, but unless you’re very familiar with a language, you might dismiss it as a syntax quirk and move on. Using the same trick again allows the hidden malicious code to be included on a list of commands to run, making a hard-to-spot backdoor.

The second trick is to use “confusable” characters like ǃ, U+01C3. It looks like a normal exclamation mark, so you wouldn’t bat an eye at if(environmentǃ=ENV_PROD){, but in this case, environmentǃ is a new variable. Anything in this development-only block of code is actually always enabled — imagine the chaos that could cause.

Neither of these are ground-breaking vulnerabilities, but they are definitely techniques to be wary of. The authors suggest that a project could mitigate these Unicode techniques by simply restricting their source code to containing only ASCII characters. It’s not a good solution, but it’s a solution. Continue reading “This Week In Security: Unicode Strikes, NPM Again, And First Steps To PS5 Crack” →