DMCA Review: Big Win For Right To Repair, Zero For Right To Tinker

October 26, 2018 by Elliot Williams 35 Comments

This year’s Digital Millennium Copyright Act (DMCA) triennial review (PDF, legalese) contained some great news. Particularly, breaking encryption in a product in order to repair it has been deemed legal, and a previous exemption for reverse engineering 3D printer firmware to use the filament of your choice has been broadened. The infosec community got some clarification on penetration testing, and video game librarians and archivists came away with a big win on server software for online games.

Moreover, the process to renew a previous exemption has been streamlined — one used to be required to reapply from scratch every three years and now an exemption will stand unless circumstances have changed significantly. These changes, along with recent rulings by the Supreme Court are signs that some of the worst excesses of the DMCA’s anti-circumvention clause are being walked back, twenty years after being enacted. We have to applaud these developments.

However, the new right to repair clause seems to be restricted to restoring the device in question to its original specifications; if you’d like to hack a new feature into something that you own, you’re still out of luck. And while this review was generally favorable of opening up technology to enable fair use, they didn’t approve Bunnie Huang’s petition to allow decryption of the encryption method used over HDMI cables, so building your own HDMI devices that display encrypted streams is still out. And the changes to the 3D printer filament exemption is a reminder of the patchwork nature of this whole affair: it still only applies to 3D printer filament and not other devices that attempt to enforce the use of proprietary feedstock. Wait, what?

Finally, the Library of Congress only has authority to decide which acts of reverse engineering constitute defeating anti-circumvention measures. This review does not address the tools and information necessary to do so. “Manufacture and provision of — or trafficking in — products and services designed for the purposes of circumvention…” are covered elsewhere in the code. So while you are now allowed decrypt your John Deere software to fix your tractor, it’s not yet clear that designing and selling an ECU-unlocking tool, or even e-mailing someone the decryption key, is legal.

Could we hope for more? Sure! But making laws in a country as large as the US is a balancing act among many different interests, and the Library of Congress’s ruling is laudably clear about how they reached their decisions. The ruling itself is worth a read if you want to dive in, but be prepared to be overwhelmed in apparent minutiae. Or save yourself a little time and read on — we’ve got the highlights from a hacker’s perspective.

Continue reading “DMCA Review: Big Win For Right To Repair, Zero For Right To Tinker” →

Building A Proof Of Concept Hardware Implant

October 24, 2018 by Tom Nardi 43 Comments

You’ve no doubt heard about the “hardware implants” which were supposedly found on some server motherboards, which has led to all sorts of hand-wringing online. There’s no end of debate about the capabilities of such devices, how large they would need to be, and quite frankly, if they even exist to begin with. We’re through the looking-glass now, and there’s understandably a mad rush to learn as much as possible about the threat these types of devices represent.

EEPROM (left) can be edited to enable SMBus access on this card (header to the right)

[Nicolas Oberli] of Kudelski Security wanted to do more than idly speculate, so he decided to come up with a model of how an implanted hardware espionage device could interact with the host system. He was able to do this with off the shelf hardware, meaning anyone who’s so inclined can recreate this “Hardware Implant Playset” in their own home lab for experimentation. Obviously this is not meant to portray a practical attack in terms of the hardware itself, but gives some valuable insight into how such a device might function.

One of the most obvious attack vectors for hardware implants is what’s known as the Baseboard Management Controller (BMC). This is a chip used on modern motherboards to allow for remote control and monitoring of the system’s hardware, and promises to be a ripe target for attackers. There are a few sideband channels which can be used by the BMC chip to talk to other chips. To keep things simple [Nicolas] focused on the older I2C-derived SMBus (rather than the newer and more complex NC-SI), demonstrating what can be done once you have control of that bus.

Only problem was, he didn’t have a motherboard with a BMC to experiment with. After a little research, the answer came in the form of the Intel EXPI9301CTBLK network card, which features the 82574L SMBus chip. This allows for experimenting with a subset of SMBus functionality on any machine with a PCI-E slot. Even better, the card has an SMBus header on the top to plug into. [Nicolas] describes in detail how he enabled the SMBus interface by modifying the card’s EEPROM, which then allowed him to detect it with his HydraBus.

With the hardware setup, the rest of the write-up focuses on what you can do with direct control of SMBus on the network card. [Nicolas] demonstrates not only creating and sending Ethernet packets, but also intercepting an incoming packet. In both cases, a running instance of tcpdump on the host computer fails to see the packets even exist.

He goes on to explain that since SMBus is very similar to I2C and only requires four wires, the techniques shown could easily be moved from the Hydrabus dev board used in the demo, to a small microcontroller like the ATtiny85. But you would still need to find a way to add that microcontroller directly onto the network card without it being obvious to the casual observer.

Our previous coverage of suspected hardware implants sparked considerable discussion, and it looks like no matter what side of the fence you’re on, the debate isn’t going away anytime soon.

GE’s Engine To Reignite Civil Supersonic Flight

October 24, 2018 by Tom Nardi 110 Comments

On October 24th, 2003 the last Concorde touched down at Filton Airport in England, and since then commercial air travel has been stuck moving slower than the speed of sound. There were a number of reasons for retiring the Concorde, from the rising cost of fuel to bad publicity following a crash in 2000 which claimed the lives of all passengers and crew aboard. Flying on Concorde was also exceptionally expensive and only practical on certain routes, as concerns about sonic booms over land meant it had to remain subsonic unless it was flying over the ocean.

The failure of the Concorde has kept manufacturers and the civil aviation industry from investing in a new supersonic aircraft for fifteen years now. It’s a rare example of commercial technology going “backwards”; the latest and greatest airliners built today can’t achieve even half the Concorde’s top speed of 1,354 MPH (2,179 km/h). In an era where speed and performance is an obsession, commercial air travel simply hasn’t kept up with the pace of the world around it. There’s a fortune to be made for anyone who can figure out a way to offer supersonic flight for passengers and cargo without falling into the same traps that ended the Concorde program.

With the announcement that they’ve completed the initial design of their new Affinity engine, General Electric is looking to answer that call. Combining GE’s experience developing high performance fighter jet engines with the latest efficiency improvements from their civilian engines, Affinity is the first new supersonic engine designed for the civil aviation market in fifty five years. It’s not slated to fly before 2023, and likely won’t see commercial use for a few years after that, but this is an important first step in getting air travel to catch up with the rest of our modern lives.

Continue reading “GE’s Engine To Reignite Civil Supersonic Flight” →

A Close Look At The Prusa I3 MK3

October 22, 2018 by Tom Nardi 63 Comments

The Prusa i3 MK3 is, for lack of a better word, inescapable. Nearly every hacker or tech event that I’ve attended in 2018 has had dozens of them humming away, and you won’t get long looking up 3D printing on YouTube or discussion forums without somebody singing its praises. Demand for Prusa’s latest i3 printer is so high that there’s a literal waiting list to get one.

At the time of this writing, over a year after the printer was officially put up for sale, there’s still nearly a month lead time on the assembled version. Even longer if you want to wait on the upgraded powder coated bed, which has unfortunately turned out to be a considerable production bottleneck. But the team has finally caught up enough that the kit version of the printer (minus the powder coated bed) is currently in stock and shipping next day.

I thought this was a good a time as any to pull the trigger on the kit and see for myself what all the excitement is about. Now that I’ve had the Prusa i3 MK3 up and running for a couple of weeks, I can say with confidence that it’s not just hype. It isn’t a revolution in desktop 3D printing, but it’s absolutely an evolution, and almost certainly represents the shape of things to come for the next few years.

That said, it isn’t perfect. There’s still a few elements of the design that left me scratching my head a bit, and some parts of the assembly weren’t quite as smooth as the rest. I’ve put together some of those observations below. This isn’t meant to be a review of the Prusa i3 MK3 printer, there’s more than enough of those already, but hopefully these assorted notes may be of use to anyone thinking of jumping on the Prusa bandwagon now that production has started really ramping up.

Continue reading “A Close Look At The Prusa I3 MK3” →

That Time Atari Cracked The Nintendo Entertainment System

October 22, 2018 by Drew Littrell 45 Comments

It was darkest hour for the video game industry following the holiday shopping season of 1982. The torrent of third party developed titles had flooded the home video game console market to the point of saturation. It incited a price war amongst retailers where new releases were dropped to 85% off MSRP after less than a month on the shelves. Mountains of warehouse inventory went unsold leaving a company like Atari choosing to dump the merchandise into the Chihuahuan desert rather than face the looming tax bill. As a result, the whole home video game industry receded seemingly overnight.

One company single-handedly revived video games to mainstream prominence. That company was Nintendo. They’re ostensibly seen as the “savior” of the video games industry, despite the fact that microcomputer games were still thriving (history tends to be written by the victors). Nevertheless their Nintendo Entertainment System (NES) was an innovative console featuring games with scrolling screens, arcade-like sprites. But the tactic they used to avoid repeating the 1983 collapse was to tightly control their market using the Nintendo Seal of Quality.

From the third party developer perspective, Nintendo’s Seal of Quality represented more than just another logo to throw on the box art. It represented what you could and couldn’t do with your business. Those third party licensing agreements dictated the types of games that could be made, the way the games were manufactured, the schedule on which the games shipped to retail, and even the number of games your company could make. From the customer side of things that seal stood for confidence in the product, and Nintendo would go to great lengths to ensure it did just that.

This is the story of how an Atari subsidiary company cracked the hardware security of the original Nintendo and started putting it into their unofficial cartridges.

Continue reading “That Time Atari Cracked The Nintendo Entertainment System” →

Teardown: Sony’s New Aibo Goes Under The Knife

October 22, 2018 by Drew Littrell 22 Comments

In a complete surprise, Sony has moved to release the latest version of their robotic dog series, Aibo, in North America. The device is already out in Japan, where there are a number of owner’s clubs that would rival any dedicated kennel club. Thanks to the [Robot Start] team, we now have a glimpse of what goes into making the robotic equivalent of man’s best friend in their teardown of an Aibo ERS-1000.

According to Yoshihiro of Robot Start, Aibo looks to be using a proprietary battery reminiscent of the Handycam camcorders. Those three gold contacts are used for charging on the rug shaped power base that Aibo will periodically return to in order to take a”nap”. There are a couple of square OLED screens behind those puppy dog eyes. They are full-color OLEDs somewhere in the one-inch ballpark. Between the screens is a capacitive touch sensor that wraps around to the top of the head that are also pressure sensitive.

According to Sony’s press release, the fish-eye camera housed in Aibo’s snout is used to identify faces as well as navigating spaces.

Laying out all the major parts out together certainly drives home the complexity of the latest Aibo. It’ll be interesting to see the progression of this device as all of them come equipped with 4G LTE and 802.11 b/g/n WiFi that connect to Sony’s servers for deep learning.

New behaviors are supposed to download automatically as long as the device is under the subscription plan. While Sony has no current plans to integrate with any voice-activated virtual assistant, we can still look forward to the possibility of some expanded functionality from the Hackaday community.

For the rest of the teardown photos make sure to head over to [Yoshihiro]’s write up on Robot Start. Also just in case anybody cared to see what happens when the first generation Aibo ERS-111 from 1999 meets the 2018 Aibo ERS-1000, you’ll find the answer in the video below:

Continue reading “Teardown: Sony’s New Aibo Goes Under The Knife” →

Blazing Fast Raspberry Pi Display Driver Will Melt Your Face Then Teach You How

October 21, 2018 by Brian Boucheron 20 Comments

Reader [poipoi] recently wrote into our tip line to tell us about an “amazingly fast” Raspberry Pi display driver with a README file that “is an actual joy to read”. Of course, we had to see for ourselves. The fbcp-ili9341 repo, by [juj], seems to live up to the hype! The software itself appears impressive, and the README is detailed, well-structured, educational, and dare we say entertaining?

The driver’s main goal is to produce high frame rates — up to around 60 frames per second — over an SPI bus, and it runs on various Raspberry Pi devices including the 2, 3 and Zero W. Any video output that goes to the Pi’s HDMI port will be mirrored to a TFT display over the SPI bus. It works with many of the popular displays currently out there, including those that use the ILI9341, ILI9340, and HX8357D chipsets.

The techniques that let [juj] coax such frame rates out of a not-terribly-fast serial bus are explained in detail in the README’s How it Works section, but much of it boils down to the fact that it’s only sending changed pixels for each frame, instead of the full screen. This cuts out the transmission of about 50% of the pixels in each update when you’re playing a game like Quake, claims the author. There are other interesting performance tweaks as well, so be sure to check out the repo for all the details.

There’s a video comparing the performance of fbcp-ili9341 to mainline SPI drivers after the break.

Continue reading “Blazing Fast Raspberry Pi Display Driver Will Melt Your Face Then Teach You How” →