This Week In Security: ISNs, Patch Tuesday, And Clubhouse

February 19, 2021 by Jonathan Bennett 4 Comments

Let’s talk TCP. Specifically, how do the different TCP connections stay distinct, and how is a third party kept from interrupting a connection? One of the mechanisms that help accomplish this feat is the TCP sequence number. Each of the two endpoints of a TCP connection tracks an incrementing 32-bit number, corresponding to the bytes sent in the connection. It’s handy, because each side can use that value to track what parts of the data stream they have received. On missing packets, a message can be sent requesting bytes 7-15 to be resent, for instance.

Each side of the connection sets their own Initial Sequence Number (ISN), and it’s important that this number is unique, as collisions can cause stream confusion. That statement should make your security spidey sense tingle. If a collision can cause problems when it happens by chance, what can a hacker do with it intentionally? Potentially quite a bit. Knowing the current sequence number, as well as a couple other pieces of information, a third party can close a TCP stream or even inject data. The attack has been around for years, originally known as the Mitnick Attack. It was originally possible because TCP implementations used a simple counter to set the ISN. Once the security ramifications of this approach were understood, the major implementations moved to a random number generation for their ISNs.

Now to this week’s story: researchers at Forescout took the time to check 11 TCP/IP stacks for vulnerability to the old Mitnick Attack (PDF Whitepaper). Of the eleven embedded stacks texted, nine have serious weaknesses in their ISN generation. Most of the vulnerable implementations use a system time value as their ISN, while several use a predictable pseudorandom algorithm that can be easily reversed.

CVEs have been assigned, and vendors notified of “NUMBER:JACK”, Forescout’s name for the research. Most of the vulnerable software already has patches available. The problem with embedded systems is that they often never get security updates. The vulnerable network stacks are in devices like IP cameras, printers, and other “invisible” software. Time will tell if this attack shows up as part of a future IoT botnet.
Continue reading “This Week In Security: ISNs, Patch Tuesday, And Clubhouse” →

A Brief History Of Optical Communication

February 18, 2021 by Moritz v. Sivers 44 Comments

We live in the information age where access to the internet is considered a fundamental human right. Exercising this right does largely rely on the technological advances made in optical communication. Using light to send information has a long history: from ancient Greece, through Claude Chappe’s semaphore towers and Alexander Graham Bell’s photophone, to fiber optic networks and future satellite internet constellations currently developed by tech giants.

Let’s dive a little bit deeper into the technologies that were used to spread information with the help of light throughout history. Continue reading “A Brief History Of Optical Communication” →

NASA Selects SpaceX To Launch Lunar Gateway

February 18, 2021 by Tom Nardi 37 Comments

While not a Cabinet position, the NASA Administrator is nominated by the president of the United States and tasked with enacting their overall space policy. As such, a new occupant in the White House has historically resulted in a different long-term directive for the agency. Some presidents have wanted bold programs of exploration, while others have directed NASA to follow a more reserved and economical path, with the largest shifts traditionally happening when the administration changes hands between the parties.

So it’s no surprise that the fate of Artemis, a bold program initiated by the previous administration that aims to establish a sustainable human presence on the Moon, has been considered uncertain since the November election. But the recent announcement that SpaceX has been awarded a $331.8 million contract to launch the first two modules of the lunar Gateway station, an orbital outpost that will serve as a rallying point for astronauts coming and going to the Moon’s surface, should help quell some concerns. While the components still aren’t slated to fly until 2024 at the earliest, it’s a step in the right direction and strong indicator that the new administration plans on seeing Artemis through.

Continue reading “NASA Selects SpaceX To Launch Lunar Gateway” →

James West Began 40 Years At Bell Labs With World-Changing Microphone Tech

February 17, 2021 by Mike Szczys 27 Comments

I’d be surprised if you weren’t sitting within fifty feet of one of James Edward Maceo West’s most well-known inventions — the electret microphone. Although MEMS microphones have seen a dramatic rise as smartphone technology progresses, electret microphones still sit atop the throne of low-cost and high-performance when it comes to capturing audio. What’s surprising about this world-changing invention is that the collaboration with co-inventor Gerhard Sessler began while James West was still at university, with the final version of the electret springing to life at Bell Labs just four years after his graduation.

A Hacker’s Upbringing

James’ approach to learning sounds very familiar: “If I had a screwdriver and a pair of pliers, anything that could be opened was in danger. I had this need to know what was inside.” He mentions a compulsive need to understand how things work, and an inability to move on until he has unlocked that knowledge. Born in 1931, an early brush with mains voltage started him on his journey.

Continue reading “James West Began 40 Years At Bell Labs With World-Changing Microphone Tech” →

Minimal MQTT With Micropython

February 17, 2021 by Chris Lott 16 Comments

I have been meaning to play around with MQTT for some time now, and finally decided to take the plunge one evening last week. I had three cheap home temperature and humidity sensors, and was bothered that they often didn’t agree. Surprisingly, while the analog one had a calibration adjustment in the back, I have no idea how to calibrate the two digital ones. I took this as a sign that it was time to learn MQTT and be able to install my own, accurate sensors. Of course, I began by ordering the cheapest sensors I could find, but I can always upgrade later on.

While we have written quite a bit about MQTT in Hackaday, I had to go all the way back to 2016 to find this introductory four-part series by Elliot Williams. Five years is a long time in the tech world, but I decided to give it a try anyway. Continue reading “Minimal MQTT With Micropython” →

Trouble With The Texas Power Grid As Cold Weather Boosts Demand, Knocks Out Generators

February 16, 2021 by Jenny List 253 Comments

It comes as something of a shock that residents of the Lone Star State are suffering from rolling power blackouts in the face of an unusually severe winter. First off, winter in Texas? Second, isn’t it the summer heat waves that cause the rolling blackouts in that region?

Were you to mention Texas to a European, they’d maybe think of cowboys, oil, the hit TV show Dallas, and if they were European Hackaday readers, probably the semiconductor giant Texas Instruments. The only state of the USA with a secession clause also turns out to to have their own power grid independent of neighboring states.

An accurate and contemporary portrait of a typical Texan, as understood by Europeans. Carol M. Highsmith, Public domain.

Surely America is a place of such resourcefulness that this would be impossible, we cry as we watch from afar the red squares proliferating across the outage map. It turns out that for once the independent streak that we’re told defines Texas may be its undoing. We’re used to our European countries being tied into the rest of the continental grid, but because the Texan grid stands alone it’s unable to sip power from its neighbours in times of need.

Let’s dive into the mechanics of maintaining an electricity grid, with the unfortunate Texans for the moment standing in as the test subject.

Continue reading “Trouble With The Texas Power Grid As Cold Weather Boosts Demand, Knocks Out Generators” →

The Rotary-X Engine Is A Revolution In Thermodynamics

February 15, 2021 by Kristina Panos 119 Comments

If you’re running an army, chances are good that you need a lot of portable power for everything from communications to weapons control systems. When it comes to your generators, every ounce counts. The smaller and lighter you can get them, the better.

Connecticut-based company LiquidPiston is developing a high-powered generator for the US Army that uses the company’s own rotary x-engine — a small, light, and powerful beast that sounds like a dream come true. It can run on gasoline, diesel, natural gas, kerosene, or jet fuel, and is scalable from 1 to 1,000 horsepower (PDF).

Co-founder and CEO Alex Schkolnik describes the design as a combination of the best parts of the Otto and Atkinson cycle engines, the Diesel, and the Wankel rotary while solving the big problems of the latter two. That sounds impressive, but it doesn’t mean much unless you understand how each of these engines work and what their various advantages and disadvantages are. So let’s take a look under the hood, shall we?

Continue reading “The Rotary-X Engine Is A Revolution In Thermodynamics” →