This Week In Security: WebP, Cavium, Gitlab, And Asahi Lina

September 22, 2023 by Jonathan Bennett 15 Comments

Last week we covered the latest 0-day from NSO group, BLASTPASS. There’s more details about exactly how that works, and a bit of a worrying revelation for Android users. One of the vulnerabilities used was CVE-2023-41064, a buffer overflow in the ImageIO library. The details have not been confirmed, but the timing suggests that this is the same bug as CVE-2023-4863, a Webp 0-day flaw in Chrome that is known to be exploited in the wild.

The problem seems to be an Out Of Bounds write in the BuildHuffmanTable() function of libwebp. And to understand that, we have to understand libwebp does, and what a Huffman Table has to do with it. The first is easy. Webp is Google’s pet image format, potentially replacing JPEG, PNG, and GIF. It supports lossy and lossless compression, and the compression format for lossless images uses Huffman coding among other techniques. And hence, we have a Huffman table, a building block in the image compression and decompression.

What’s particularly fun about this compression technique is that the image includes not just Huffman compressed data, but also a table of statistical data needed for decompression. The table is rather large, so it gets Huffman compressed too. It turns out, there can be multiple layers of this compression format, which makes the vulnerability particularly challenging to reverse-engineer. The vulnerability is when the pre-allocated buffer isn’t big enough to hold one of these decompressed Huffman tables, and it turns out that the way to do that is to make maximum-size tables for the outer layers, and then malform the last one. In this configuration, it can write out of bounds before the final consistency check.

An interesting note is that as one of Google’s C libraries, this is an extensively fuzzed codebase. While fuzzing and code coverage are both great, neither is guaranteed to find vulnerabilities, particularly well hidden ones like this one. And on that note, this vulnerability is present in Android, and the fix is likely going to wait til the October security update. And who knows where else this bug is lurking. Continue reading “This Week In Security: WebP, Cavium, Gitlab, And Asahi Lina” →

Illustrated Kristina with an IBM Model M keyboard floating between her hands.

Keebin’ With Kristina: The One With The Busy Box Macro Pad

September 21, 2023 by Kristina Panos 7 Comments

Well, I must admit that Google Translate completely failed me here, and thus I have no real idea what the trick is to this beautiful, stunning transparent split keyboard by [illness072]. Allegedly, the older tweets (exes?) hold the key to this magic, but again, Google Translate.

Based on top picture, I assume that the answer lies in something like thin white PCB fingers bent to accommodate the row stagger and hiding cleverly behind the keys.

Anyone who can read what I assume is Japanese, please advise what is going on in the comments below.

Continue reading “Keebin’ With Kristina: The One With The Busy Box Macro Pad” →

Books You Should Read: David Macaulay’s Architecture Series

September 21, 2023 by Dan Maloney 31 Comments

For a lot of us, there’s a bright line separating the books we enjoyed as children from the “real” books of our more mature years. We all eventually age out of the thin, brightly illustrated picture books we enjoyed in our youth, replacing them with thicker, wordier volumes with fewer and fewer illustrations, until they become so dense with information that footnotes and appendices are needed to convey all the information, and a well-written index is a vital necessity to make use of any of it.

Such books seem like a lot less fun than kids’ books, and they probably are, but most of us adjust to the change and accept the fact that the children’s section of the library doesn’t hold much that’ll interest us anymore. But not all the books that get a “JUV” label on their spines are created equal. Some are far more than picture books, even if the pictures are the main attraction. The books of British-born American author David Macaulay come to mind, particularly the books comprising his Architecture Series.

Macaulay’s books were enormously influential in developing my engineering sensibilities, and are still a pleasure to thumb through these many years later. I still learn something about the history of construction and engineering when I pull one of these books off the shelf, which makes them Books You Should Read.

Continue reading “Books You Should Read: David Macaulay’s Architecture Series” →

Button, Button, Who’s Got The (Pico) Button?

September 20, 2023 by Al Williams 26 Comments

There is an episode of Ren and Stimpy with a big red “history eraser’ button that must not be pressed. Of course, who can resist the temptation of pressing the unpressable button? The same goes for development boards. If there is a button on there, you want to read it in your code, right? The Raspberry Pi Pico is a bit strange in that regard. The standard one lacks a reset button, but there is a big tantalizing button to reset in bootloader mode. You only use it when you power up, so why not read it in your code? Why not, indeed?

Turns out, that button isn’t what you think it is. It isn’t connected to a normal CPU pin at all. Instead, it connects to the flash memory chip. So does that mean you can’t read it at all? Not exactly. There’s good news, and then there’s bad news.

The Good News

The official Raspberry Pi examples show how to read the button (you have read all the examples, right?). You can convert the flash’s chip-select into an input temporarily and try to figure out if the pin is low, meaning that the button is pushed. Sounds easy, right?

Continue reading “Button, Button, Who’s Got The (Pico) Button?” →

You’ve Got Mail: Reading Addresses With OCR

September 20, 2023 by Kristina Panos 14 Comments

Last time I delivered on this column, I told you about the USPS’ attempts to fully automate a post office. Of course, that’s a bit of a misnomer, since it took 1,500 employees to actually operate the place on a daily basis. Although Project Turnkey in Rhode Island and Project Gateway in California were proving grounds for all kinds of mail sorting and processing equipment, the act of actually reading addresses and routing mail to its final destination still required human intervention and hand coding.

Today, the post office processes hundreds of millions of mail pieces each day using various pieces of equipment. One of those important pieces of equipment is the OCR address reader, which manages to make sense of all kinds of chicken scratch.

Continue reading “You’ve Got Mail: Reading Addresses With OCR” →

Hello, Halloween Hackfest!

September 19, 2023 by Elliot Williams 1 Comment

Halloween is possibly the hackiest of holidays. Think about it: when else do you get to add animatronic eyes to everyday objects, or break out the CNC machine to cut into squashes? Labor day? Nope. Proximity-sensing jump-scare devices for Christmas? We think not. But for Halloween, you can let your imagination run wild!

We’re happy to announce that DigiKey and Arduino have teamed up for this year’s Hackaday Halloween Contest. Bring us your best costume, your scariest spook, your insane home decorations, your wildest pumpkin, or your most kid-pleasing feat!

We’ll be rewarding the top three with a $150 gift certificate courtesy of DigiKey, plus some Arduino Halloween treats if you use a product from the Arduino Pro line to make your hair-raising fantasy happen.

We’ve also got five honorable mention categories to inspire you to further feats of fancy.

Costume: Halloween is primarily about getting into outrageous costumes and scoring candy. We don’t want to see the candy.
Pumpkin: Pumpkin carving could be as simple as taking a knife to a gourd, but that’s not what we’re after. Show us the most insane carving method, or the pumpkin so loaded with electronics that it makes Akihabara look empty in comparison.
Kid-Pleaser: Because a costume that makes a kid smile is what Halloween is really all about. But games or elaborate candy dispensers, or anything else that helps the little ones have a good time is fair game here.
Hallowed Home: Do people come to your neighborhood just to see your haunted house? Do you spend more on light effects than on licorice? Then show us your masterpiece!
Spooky: If your halloween build is simply scary, it belongs here.

Head on over to Hackaday.io for the full details. And get working on your haunts, costumes, and Rube Goldberg treat dispensers today.

What Is Killing Cursive? Ballpoints. Probably.

September 18, 2023 by Kristina Panos 226 Comments

I get it — you hate writing by hand. But have you ever considered why that is? Is it because typing is easier, faster, and more convenient here in 2023? Maybe so. All of those notwithstanding, I honestly think there’s an older reason: it’s because of the rise of ballpoint pens. And I’m not alone.

Bear with me here. Maybe you think you hate writing because you were forced to do it in school. While that may very well be, depending on your age, you probably used a regular wood-case pencil before graduating to the ballpoint pen, never experiencing the joys of the fountain pen. Well, it’s never too late.

Continue reading “What Is Killing Cursive? Ballpoints. Probably.” →