Slider

5091 Articles

This Week In Security:Malicious Previews, VNC Vulnerabilities, Powerwall, And The 5th Amendment

November 30, 2019 by 29 Comments

Malware embedded in office documents has been a popular attack for years. Many of those attacks have been fixed, and essentially all the current attacks are unworkable when a document is opened in protected view. There are ways around this, like putting a notice at the top of a document, requesting that the user turn off protected view. [Curtis Brazzell] has been researching phishing, and how attacks can work around mitigations like protected view. He noticed that one of his booby-trapped documents phoned home before it was opened. How exactly? The preview pane.

The Windows Explorer interface has a built-in preview pane, and it helpfully supports Microsoft Office formats. The problem is that the preview isn’t generated using protected view, at least when previewing Word documents. Generating the preview is enough to trigger loading of remote content, and could feasibly be used to trigger other vulnerabilities. [Curtis] notified Microsoft about the issue, and the response was slightly disappointing. His discovery is officially considered a bug, but not a vulnerability.

VNC Vulnerabilities

Researchers at Kaspersky took a hard look at several VNC implementations, and uncovered a total of 37 CVEs so far. It seems that several VNC projects share a rather old code-base, and it contains a plethora of potential bugs. VNC should be treated similarly to RDP — don’t expose it to the internet, and don’t connect to unknown servers. The protocol wasn’t written with security in mind, and none of the implementations have been sufficiently security hardened.

Examples of flaws include: Checking that a message doesn’t overflow the buffer after having copied it into said buffer. Another code snippet reads a variable length message into a fixed length buffer without any length checks. That particular function was originally written at AT&T labs back in the late 90s, and has been copied into multiple projects since then.

There is a potential downside to open source that is highlighted here. Open source allows poorly written code to spread. This isn’t a knock against open source, but rather a warning to the reader. Just because code or a project uses an OSS license doesn’t mean it’s secure or high quality code. There are more vulnerabilities still in the process of being fixed, so watch out for the rest of this story. Continue reading “This Week In Security:Malicious Previews, VNC Vulnerabilities, Powerwall, And The 5th Amendment” →

DSP Spreadsheet: Talking To Yourself Using IQ

November 29, 2019 by 12 Comments

We’ve done quite a bit with Google Sheets and signal processing: we’ve generated signals, created filters, and computed quadrature signals. We can pull all that together into an educational model for two SDRs talking to each other, but it’s going to require two parts: modulation and demodulation. Guess what? We can do that with a spreadsheet.

The first step is to generate a reference clock for the carrier. You’ll need a cosine wave (I) and sine wave (Q). Of course, you also need the time base. That’s columns A-C in the spreadsheet and works like other signal generation we’ve seen.

Continue reading “DSP Spreadsheet: Talking To Yourself Using IQ” →

A Fantastic Frontier Of FPGA Flexibility Found In The 2019 Supercon Badge

November 29, 2019 by 7 Comments

We have just concluded a successful Hackaday Superconference where a highlight for many was digging into this year’s hardware badge. Shaped in the general form of a Game Boy handheld gaming console, the heart of the badge is a large FPGA opening up new and exciting potential for badge hacking.

Beyond our normal tools of compiling custom code or modifying hardware with a soldering iron, we now have the option to change core hardware behavior with Verilog. And people explored this new frontier to great effect, as seen at the badge hacking ceremony. (Video embedded below.)

FPGAs are not new, technically speaking, why are they exciting now? We can thank their recent growth in capability, their rapidly falling cost, and the relatively new availability of open source toolchains. These developments elevated FPGA into one of the most exciting trends in hardware today, so this year’s badge master [Sprite_TM] built an open FPGA playground for several hundred of his closest Supercon friends. Let’s take a look at what people were able to accomplish in just a few days using this unique and powerful hardware.

Continue reading “A Fantastic Frontier Of FPGA Flexibility Found In The 2019 Supercon Badge” →

A Division In Voltage Standards

November 28, 2019 by 152 Comments

During my recent trip to Europe, I found out that converters were not as commonly sold as adapters, and for a good reason. The majority of the world receives 220-240 V single phase voltage at 50-60 Hz with the surprisingly small number of exceptions being Canada, Colombia, Japan, Taiwan, the United States, Venezuela, and several other nations in the Caribbean and Central America.

While the majority of countries have one defined plug type, several countries in Latin America, Africa, and Asia use a collection of incompatible plugs for different wall outlets, which requires a number of adapters depending on the region traveled.

Although there is a fair degree of standardization among most countries with regards to the voltage used for domestic appliances, what has caused the rift between the 220-240 V standard and the 100-127 V standards used in the remaining nations?

Continue reading “A Division In Voltage Standards” →

Retrotechtacular: The Art Of The Foundry

November 27, 2019 by 19 Comments

Mention the term “heavy industry” and the first thing to come to mind might well be the metal foundry. With immense machines and cauldrons of molten metal being shuttled about by crane and rail, the image of the foundry is like a scene from Dante’s Inferno, with fumes filling a vast impersonal factory, and sparks flying through the air. It looks like a dangerous place, as much to the soul as to the body, as workers file in each day to suffer mindlessly at the hearths and ladles, consumed in dirty, exhausting work even as it consumes them.

Things are not always as they appear, of course. While there’s no doubting the risks associated with working in a foundry such as the sprawling Renfrew works of Babcock and Wilcox Ltd. in the middle of the previous century, as the video below shows the work there was anything but mindless, and the products churned out by the millions from this factory and places like it throughout the world were critical to today’s technology.

Continue reading “Retrotechtacular: The Art Of The Foundry” →

The Golden Age Of Ever-Changing Computer Architecture

November 27, 2019 by 32 Comments

Given the accuracy of Moore’s Law to the development of integrated circuits over the years, one would think that our present day period is no different from the past decades in terms of computer architecture design. However, during the 2017 ACM Turing Award acceptance speech, John L. Hennessy and David A. Patterson described the present as the “golden age of computer architecture”.

Compared to the early days of MS-DOS, when designing user- and kernel-space interactions was still an experiment in the works, it certainly feels like we’re no longer in the infancy of the field. Yet, as the pressure mounts for companies to acquire more computational resources for running expensive machine learning algorithms on massive swaths of data, smart computer architecture design may be just what the industry needs.

Moore’s law predicts the doubling of transistors in an IC, it doesn’t predict the path that IC design will take. When that observation was made in 1965 it was difficult or even impossible to envision where we are today, with tools and processes so closely linked and widely available that the way we conceive processor design is itself multiplying.

Continue reading “The Golden Age Of Ever-Changing Computer Architecture” →

The Young Engineers Guide To University Capstone Projects

November 26, 2019 by 8 Comments

Engineering degrees are as wide and varied as the potential careers on offer out in the real world. There’s plenty of maths to learn, and a cavalcade of tough topics, from thermodynamics to fluid mechanics. However, the real challenge is the capstone project. Generally taking place in the senior year of a four-year degree, it’s a chance for students to apply everything they’ve learned on a real-world engineering project.

Known for endless late nights and the gruelling effort required, it’s an challenge that is revered beforehand, and boasted about after the fact. During the project, everyone is usually far too busy to talk about it. My experience was very much along these lines, when I undertook the Submarine That Can Fly project back in 2012.  The project taught me a lot about engineering, in a way that solving problems out of textbooks never could. What follows are some of the lessons I picked up along the way. Continue reading “The Young Engineers Guide To University Capstone Projects” →