This Week In Security: Apache Nightmare, REvil Arrests? And The Ultimate RickRoll

October 8, 2021 by Jonathan Bennett 14 Comments

The Apache HTTP Server version 2.4.49 has a blistering vulnerability, and it’s already being leveraged in attacks. CVE-2021-41773 is a simple path traversal flaw, where the %2e encoding is used to bypass filtering. Thankfully the bug was introduced in 2.4.49, the latest release, and a hotfix has already been released, 2.4.50.

curl --data "echo;id" 'http://127.0.0.1:80/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh'

If that returns anything other than a 403 error, your server may be vulnerable. It’s worth pointing out that Apache is shipped with a configuration block that mitigates this vulnerability.

# Deny access to the entirety of your server's filesystem. You must # explicitly permit access to web content directories in other # blocks below. # <Directory /> AllowOverride none Require all denied </Directory>

The Day The Internet Stood Still

You might have noticed a bit of a kerfluffel on the Internet on Monday. Facebook dropped out for nearly six hours. While the break was nice for some, it was a major problem for others. What exactly happened? The most apparent cause was that the Facebook.com domain was returning nxdomain to DNS lookups. This led to some fun tweets, with screen caps showing Facebook.com for sale.
Continue reading “This Week In Security: Apache Nightmare, REvil Arrests? And The Ultimate RickRoll” →

Creating Methane From Captured Carbon Dioxide And The Future Of Carbon Capture

October 7, 2021 by Maya Posch 125 Comments

There’s something intrinsically simple about the concept of carbon (CO₂) capture: you simply have the CO₂ molecules absorbed or adsorbed by something, after which you separate the thus captured CO₂ and put it somewhere safe. Unfortunately, in physics and chemistry what seems easy and straightforward tends to be anything but simple, let alone energy efficient. While methods for carbon capture have been around for decades, making it economically viable has always been a struggle.

This is true both for carbon capture and storage/sequestration (CCS) as well as carbon capture and utilization (CCU). Whereas the former seeks to store and ideally permanently remove (sequester) carbon from the atmosphere, the latter captures carbon dioxide for use in e.g. industrial processes.

Recently, Pacific Northwest National Laboratory (PNNL) has announced a breakthrough CCU concept, involving using a new amine-based solvent (2-EEMPA) that is supposed to be not only more efficient than e.g. the previously commonly used MEA, but also compatible with directly creating methane in the same process.

Since methane forms the major component in natural gas, might this be a way for CCU to create a carbon-neutral source of synthetic natural gas (SNG)? Continue reading “Creating Methane From Captured Carbon Dioxide And The Future Of Carbon Capture” →

Decoding SMD Part Markings

October 6, 2021 by Chris Lott 29 Comments

You’ve probably encountered this before — you have a circuit board that is poorly documented, and want to know the part number of a tiny SMD chip. Retro computer enthusiast [JohnK] recently tweeted about one such database that he recently found, entitled The Ultimate SMD Marking Codes Database. This data base is only a couple of years old judging from the Wayback Machine, but seems to be fairly exhaustive and can be found referenced in quite a few electronics forums.

Unlike their larger SMD siblings, these chips in question are so small that there is no room to print the entire part number on the device. Instead, the standard practice is for manufacturers use an abbreviated code of just a few characters. These codes are only unique to each part or package, and aren’t necessarily unique across an entire product line. And just because it is standard practice does not imply the marking codes themselves follow any standard whatsoever. This seemingly hodgepodge system works just fine for the development, procurement and manufacturing phases of a product’s lifecycle. It’s during the repair, refurbishment, or just hacking for fun phases where these codes can leave you scratching your head.

Several sites like the one [JohnK] found have been around for years, and adding yet another database to your toolbox is a good thing. But none of them will ever be exhaustive. There’s a good reason for that — maintaining such a database would be a herculean task. Just finding the part marking information for a known chip can be difficult. Some manufacturers put it clearly in the data sheet, and some refer you to other documentation which may or may not be readily available. And some manufacturers ask you to contact them for this information — presumably because it is dynamic changes from time to time. Continue reading “Decoding SMD Part Markings” →

3D Printering: Corrugated Plastic For Cheaper & Easier Enclosures

October 6, 2021 by Donald Papp 37 Comments

Clear acrylic panels have long been a mainstay of 3D printer enclosure designs, but they can also add significant cost in terms of money, shipping, weight, and hassle. An alternative material worth looking at is corrugated plastic (also known by its trade name coroplast) which is cheap, light, an excellent insulator, and easy to work with. Many enclosure designs can be refitted to use it instead of acrylic, so let’s take a closer look at what it has to offer.

What’s Wrong With Acrylic?

It’s not just the purchase price that makes acrylic a spendy option. Acrylic is fairly heavy, and shipping pieces the size of enclosure panels can be expensive. Also, cutting acrylic without special tools can be a challenge because it cracks easily if mishandled. Acrylic cuts beautifully in a laser cutter, but most laser cutters accessible to a hobbyist are not big enough to make enclosure-sized panels. If you are stuck with needing to cut acrylic by hand, here are some tips on how to get by with the tools you have.

It is best to source acrylic from a local shop that can also cut it to size with the right tools for a reasonable price, but it is still far from being a cheap material. There’s another option: corrugated plastic has quite a few properties that make it worth considering, especially for a hobbyist.

Continue reading “3D Printering: Corrugated Plastic For Cheaper & Easier Enclosures” →

Yes, You Can Put Out A Burning Gas Well With A Nuclear Bomb

October 5, 2021 by Zoe Skyforest 30 Comments

Nuclear explosives were first developed as weapons of war in the pitched environment of World War II. However, after the war had passed, thoughts turned to alternative uses for this new powerful technology. Scientists and engineers alike dreamed up wild schemes to dig new canals or blast humans into space with the mighty power of the atom.

Few of these ever came to pass, with radiological concerns being the most common reason why. However, the Soviet Union did in fact manage to put nuclear explosions to good use for civilian ends. One of the first examples was using a nuke to plug an out-of-control gas well in the mid 1960s.

Continue reading “Yes, You Can Put Out A Burning Gas Well With A Nuclear Bomb” →

Need A New Programming Language? Try Zig

October 5, 2021 by Matthew Carlson 131 Comments

Maybe you’ve heard of it, maybe you haven’t. Zig is a new programming language that seems to be growing in popularity. Let’s do a quick dive into what it is, why it’s unique, and what sort of things you would use it for. (Ed Note: Other than “for great justice“, naturally.)

What Is It?

You’ve likely heard of Rust as it has made significant inroads in critical low-level infrastructures such as operating systems and embedded microcontrollers. As a gross oversimplification, it offers memory safety and many traditional runtime checks pushed to compile time. It has been the darling of many posts here at Hackaday as it offers some unique advantages. With Rust on the rise, it makes sense that there might be some space for some new players. Languages like Julia, Go, Swift, and even Racket are all relative newcomers vying for the highly coveted mindshare of software engineers everywhere.

So let’s talk Zig. In a broad sense, Zig is really trying to provide some of the safety of Rust with the simplicity and ease of C. It touts a few core features such as:

No hidden control flow
No hidden memory allocations
No preprocessor, no macros
First-class support for optional standard library
Interoperable by design
Adjustable Runtime Safety
Compile-time code-execution

Continue reading “Need A New Programming Language? Try Zig” →

Snails, Sensors, And Smart Dust: The Michigan Micro Mote

October 4, 2021 by Robin Kearey 17 Comments

If you want to track a snail, you need a tiny instrumentation package. How do you create an entire data acquisition system, including sensors, memory, data processing and a power supply, small enough to fit onto a snail’s shell?

Throughout history, humans have upset many ecosystems around the world by introducing invasive species. Australia’s rabbits are a famous example, but perhaps less well-known are the Giant African land snails (Lissachatina fulica) that were introduced to South Pacific islands in the mid-20th century. Originally intended as a food source (escargot africain, anyone?), they quickly turned out to be horrible pests, devouring local plants and agricultural crops alike.

Not to be deterred, biologists introduced another snail, hoping to kill off the African ones: the Rosy Wolfsnail (Euglandina rosea), native to the Southeastern United States. This predatory snail did not show great interest in the African intruders however, and instead went on to decimate the indigenous snail population, driving dozens of local species into extinction.

A snail with a solar sensor attached to its shell — A Rosy Wolfsnail carrying a light sensing Micro Mote on its back. Source: Cindy S. Bick et al., 2021

One that managed to survive the onslaught is a small white snail called Partula hyalina. Confined to the edges of the tropical forests of Tahiti, biologists hypothesized that it was able to avoid the predators by hiding in sunny places which were too bright for E. rosea. The milky-white shells of P. hyalina supposedly protected them from overheating by reflecting more sunlight than the wolf snails’ orange-brown ones.

This sounds reasonable, but biologists need proof. So a team from the University of Michigan set up an experiment to measure the amount of solar radiation experienced by both snail types. They attached tiny light sensors to the wolf snails’ shells and then released them again. The sensors measured the amount of sunlight seen by the animals and logged this information during a full day. The snails were then caught again and the data retrieved, and the results proved the original hypothesis.

So much for science, but exactly how did they pull this off? Continue reading “Snails, Sensors, And Smart Dust: The Michigan Micro Mote” →