This Week In Security: VPNs, Patch Tuesday, And Plundervault

December 13, 2019 by Jonathan Bennett 11 Comments

An issue in Unix virtual private networks was disclosed recently, where an attacker could potentially hijack a TCP stream, even though that stream is inside the VPN. This attack affects OpenVPN, Wireguard, and even IPSec VPNs. How was this possible? Unix systems support all manner of different network scenarios, and oftentimes a misconfiguration can lead to problems. Here, packets sent to the VPNs IP address are processed and responded to, even though they are coming in over a different interface.

The attack initially sounds implausible, as an attacker has to know the Virtual IP address of the VPN client, the remote IP address of an active TCP connection, and the sequence and ACK numbers of that connection. That’s a lot of information, but an attacker can figure it out one piece at a time, making it a plausible attack. Continue reading “This Week In Security: VPNs, Patch Tuesday, And Plundervault” →

Supercon SMD Challenge Gets 3D Printed Probes: Build Your Own

December 12, 2019 by Al Williams 2 Comments

This year was the second SMD challenge at Supercon, so it stands to reason we probably learned a few things from last year. If you aren’t familiar with the challenge, you are served some pretty conventional tools and have to solder a board with LEDs getting progressively smaller until you get to 0201 components. Those are challenging even with proper tools, but a surprising number of people have managed to build them even using the clunky, large irons we provide.

During the first challenge, we did find one problem though. The LEDs are all marked for polarity. However, since we don’t provide super high power magnification, it was often difficult to determine the polarity, especially on the smaller parts. Last year, [xBeau] produced some quick LED testers to help overcome this problem. This year we refined them a bit.

As you can see, the 2018 model was a very clever use of what was on hand. A CR2032 holder powered the probes and the probes themselves were two resistors. If you can get the LED to light with the probes you know which lead is the anode and which is the cathode. A little red ink makes it even more obvious. Continue reading “Supercon SMD Challenge Gets 3D Printed Probes: Build Your Own” →

WWII Aircraft Radio Roars To Life: What It Takes To Restore A Piece Of History

December 12, 2019 by Gregory L. Charvat 59 Comments

I’ve been told all my life about old-timey Army/Navy surplus stores where you could buy buckets of FT-243 crystals, radio gear, gas masks, and even a Jeep boxed-up in a big wooden crate. Sadly this is no longer the case. Today surplus stores only have contemporary Chinese-made boots, camping gear, and flashlights. They are bitterly disappointing except for one surplus store that I found while on vacation in the Adirondacks: Patriot of Lake George.

There I found a unicorn of historical significance; an un-modified-since-WW2 surplus CBY-46104 receiver with dynamotor. The date of manufacture was early-war, February 1942. This thing was preserved as good as the day it was removed from its F4F Hellcat. No ham has ever laid a soldering iron or a drill bit to it. Could this unit have seen some action in the south Pacific? Imagine the stories it could tell!

My unconventional restoration of this radio followed strict rules so as to minimize the evidence of repair both inside and out yet make this radio perform again as though it came fresh off the assembly line. Let’s see how I did.

Continue reading “WWII Aircraft Radio Roars To Life: What It Takes To Restore A Piece Of History” →

Linux Fu: Debugging Bash Scripts

December 11, 2019 by Al Williams 23 Comments

A recent post about debugging constructs surprised me. There were quite a few comments about how you didn’t need a debugger, as long as you had printf. For that matter, we’ve all debugged systems where you had nothing but an LED to flash or otherwise turn on to communicate with the user. However, it is hard to deny that a debugger can help with complex code.

To say you only need printf would be like saying you only need machine language. Technically accurate — you can do anything in machine language. But it sure makes things easier to have an assembler or some language to help you work out your problem. If you write a simple bash script, you can use the equivalent to printf — maybe that’s the echo command, although there is usually a printf command on a typical system, if you want to use it. However, there are other things you can do with bash including a pretty cool debugger if you know how to find it.

I assume you already know how to use echo and printf, but let’s dig into how to use trace execution line by line without the need for echo statements on every other line. Along the way, you’ll learn how to get started with the bash debugger.

Continue reading “Linux Fu: Debugging Bash Scripts” →

Weird Substances: Hagfish Slime

December 10, 2019 by Kristina Panos 27 Comments

In the cold, dark recesses of ocean floors around the world, hagfish slither around like sea snakes, searching for food. When a hagfish finds a suitable carcass, it devours the dead fish in two different ways. As it burrows face-first through the tissue, eating with its jaw-less, tentacled mouth, the hagfish also absorbs nutrients through its skin.

Hagfish are not the unholy result of dumping toxic waste in the ocean. They’re one of the oldest creatures on Earth, having been around for more than 300 million years. How have they lasted this long?

A coiled hagfish reveals its slime ports. Image via Oregon Coast Aquarium

These ancient creatures have no eyes, no backbones, and no scales. They are often misidentified as eel, and often called ‘slime eels’, but they are definitely fish. They just don’t look like conventional fish. In fact, when conventional, gill-faced fish come after hagfish, those guys are in for a surprise, because hagfish have a disgusting but ingenious defense mechanism.

Whenever hagfish are attacked or even just stressed by nearby fish or curious grabby humans, they immediately emit amazing amounts of mucus at an alarming rate. At the same time, the hagfish shoots out silky strands of protein that hold the slime together in a cohesive blob. Any predator that tries to bite down on one of these velvety frankfurters of the deep sea will find its mouth and gills covered in a wad of suffocating slime.

How is it that hagfish haven’t slimed themselves out of existence? Whenever they get get a taste of their own medicine, these boneless noodles quickly twist themselves into a pretzel. In the same motion, they use their paddle-shaped tails to squeegee off the slime.

Continue reading “Weird Substances: Hagfish Slime” →

Patch, Or Your Solid State Drives Roll Over And Die

December 10, 2019 by Jenny List 117 Comments

Expiration dates for computer drives? That’s what a line of HP solid-state drives are facing as the variable for their uptime counter is running out. When it does, the drive “expires” and, well, no more data storage for you!

There are a series of stages in the evolution of a software developer as they master their art, and one of those stages comes in understanding that while they may have a handle on the abstracted world presented by their development environment they perhaps haven’t considered the moments in which the real computer that lives behind it intrudes. Think of the first time you saw an SQL injection attack on a website, for example, or the moment you realised that a variable type is linked to the physical constraints of the number of memory locations it has reserved for it. So people who write software surround themselves with an armoury of things they watch out for as they code, and thus endeavour to produce software less likely to break. Firmly in that arena is the size of the variables you use and what will happen when that limit is reached.

Your Drive Is Good For About 3 Years And 9 Months

Sometimes though even developers that should know better get it wrong, and this week has brought an unfortunate example for the enterprise wing of the hardware giant HP. Their manufacturer has notified them that certain models of solid-state disk drives supplied in enterprise storage systems contain an unfortunate bug, in which they stop working after 32,768 hours of uptime. That’s a familiar number to anyone working with base-2 numbers and hints at a 16-bit signed integer in use to log the hours of uptime. When it rolls over the value will then be negative and, rather than the drive believing itself to be in a renewed flush of youth, it will instead stop working.

Egg on the faces of the storage company then, and an urgently-released patch. We suspect that if you own a stack of these drives you will already know about the issue and be nervously pacing the racks of your data centre.

Continue reading “Patch, Or Your Solid State Drives Roll Over And Die” →

Teardown: 168-in-1 Retro Handheld Game

December 9, 2019 by Tom Nardi 33 Comments

The holidays are upon us, and that can mean many furrowed brows trying to figure out what token gift they can give out this year as stocking-stuffers. Something that’s a bit more interesting than a coupon book or a lotto scratcher, but also affordable enough that you can buy a few of them without having to take part in that other great holiday tradition: unnecessary credit debit.

Includes the NES classic *Super Militarized Police Bros 3*

Which is how I came to possess, at least temporarily, one of these cheap handheld multi-games that are all over Amazon and eBay. The one I ordered carries the brand name Weikin, but there are dozens of identical systems available, all being sold at around the same $20 USD price point. With the outward appearance of a squat Game Boy, these systems promise to provide precisely 168 games for your mobile enjoyment, and many even include a composite video out cable and external controller for the less ambulatory classic game aficionado.

At a glance, the average Hackaday reader will probably see right through this ploy. Invariably, these devices will be using some “NES on a Chip” solution to emulate a handful of legitimate classics mixed in with enough lazy ROM hacked versions of games you almost remember to hit that oddly specific number of 168 titles. It’s nearly a foregone conclusion that at the heart of this little bundle of faux-retro gaming lies a black epoxy blob, the bane of hardware tinkerers everywhere.

Of course, there’s only one way to find out. Let’s crack open one of these budget handhelds to see what cost reduction secrets are inside. Have the designers secured their place on the Nice List? Or have we been sold the proverbial lump of coal?

Continue reading “Teardown: 168-in-1 Retro Handheld Game” →