Slider

5054 Articles

Reverse Engineering Ikea’s New Smart Bulbs

February 6, 2017 by 81 Comments

Over in Sweden, Czech, Italy, and Belgium, Ikea is launching a new line of ‘smart’ light bulbs. These countries are apparently the test market for these bulbs, and they’ll soon be landing on American shores. This means smart Ikea bulbs will be everywhere soon, and an Internet of Light Bulbs is a neat thing to explore. [Markus] got his hands on a few of these bulbs, and is now digging into their inner workings (German Make Magazine, with a Google Translate that includes the phrase, ‘capering the pear’).

There are currently four versions of these Ikea bulbs, ranging from a 400 lumen bulb designed for track lights to a 980 lumen bulb that will probably work in an American Edison lamp socket. These lights are controlled via a remote, with each individual bulb paired to the remote by turning the lamp on, holding the remote close to the bulb, and pressing a button.

Inside these bulbs is a Silicon Labs microcontroller with ZigBee support, twelve chip LEDs, and associated electronics that look like they might pass the bigclivedotcom smoke test. After tearing apart this bulb and planting the wireless module firmly in a breadboard, [Markus] found he could dim a pair of LEDs simply by clicking on the remote. Somewhere in these bulbs, there’s a possibility of doing something.

As with all Internet of Things, we must ask an important question: will it become part of Skynet and shut down the Internet, like webcams did last summer? These Ikea bulbs look pretty safe in that regard, as the bulb is inexorably tied to the remote and must be paired by holding it close to the bulb. We’re sure there are a few more interesting exploits for these bulbs, so once they’re released in the US we’ll take a look at them.

Olimex Announces Their Open Source Laptop

February 5, 2017 by 115 Comments

A few months ago at the Hackaday | Belgrade conference, [Tsvetan Usunov], the brains behind Olimex, gave a talk on a project he’s been working on. He’s creating an Open Source Hacker’s Laptop. The impetus for this project came to [Tsvetan] after looking at how many laptops he’s thrown away over the years. Battery capacity degrades, keyboards have a fight with coffee, and manufacturers seem to purposely make laptops hard to repair.

Now, this do it yourself, Open Source Hardware and hacker-friendly laptop is complete. The Olimex TERES I laptop has been built, plastic has been injected into molds, and all the mechanical and electronic CAD files are up on GitHub. This Open Source laptop is done, but you can’t buy it quite yet; for that, we’ll have to wait until Olimex comes back from FOSDEM.

The design of this laptop is completely Open Source. Usually when we hear this phrase, the Open Source part only means the electronics and firmware. Yes, there are exceptions, but the STL files for the PiTop, the ‘3D printable Raspberry Pi laptop’ are not available, rendering the ‘3D printable’ part of PiTop’s marketing splurge incongruent with reality. If you want to build a case for the Open Source laptop to date, [Bunnie]’s Novena, random GitHub repos are the best source. The Olimex TERES I is completely different; not only can you simply buy all the parts for the laptop, the hardware files are going up too. To be fair, this laptop is built with injection molded parts and will probably be extremely difficult to print on a standard desktop filament printer. The effort is there, though, and this laptop can truly be built from source.

As far as specs go, this should be a fairly capable laptop. The core PCB is built around an Allwinner ARM Cortex-A53, sporting 1GB of DDR3L RAM, 4GB of eMMC Flash, WiFi, Bluetooth, a camera, and an 11.6″ 1366×768 display. Compared to an off-the-shelf, bargain-basement consumer craptop, those aren’t great specs, but at least the price is consummate with performance: The TERES I will sell for only €225, or about $250 USD. That’s almost impulse buy territory, and we can’t wait to get our hands on one.

Grant Anyone Temporary Permissions To Your Computer With SSH

February 5, 2017 by 33 Comments

This is a super cute hack for you Linux users out there. If you have played around with SSH, you know it’s the most amazing thing since sliced bread. For tunneling in, tunneling out, or even just to open up a shell safely, it’s the bees knees. If you work on multiple computers, do you know about ssh-copy-id? We had been using SSH for years before stumbling on that winner.

Anyway, [Felipe Lavratti]’s ssh-allow-friend script is simplicity itself, but the feature it adds is easily worth the cost of admission. All it does is look up your friend’s public key (at the moment only from GitHub) and add it temporarily to your authorized_keys file. When you hit ctrl-C to quit the script, it removes the keys. As long as your friend has the secret key that corresponds to the public key, he or she will be able to log in as your user account.

Continue reading “Grant Anyone Temporary Permissions To Your Computer With SSH” →

33C3: Memory Deduplication, The Hacker’s Friend

February 4, 2017 by 11 Comments

At the 33rd annual Chaos Communications Congress, [Antonio Barresi] and [Erik Bosman] presented not one, not two, but three (3!!) great hacks that were all based on exploiting memory de-duplication in virtual machines. If you’re interested in security, you should definitely watch the talk, embedded below. And grab the slides too. (PDF)

Memory de-duplication is the forbidden fruit for large VM setups — obviously dangerous but so tempting. Imagine that you’re hosting VMs and you notice that many of the machines have the same things in memory at the same time. Maybe we’re all watching the same cat videos. They can save on global memory across the machines by simply storing one copy of the cat video and pointing to the shared memory block from each of the machines that uses it. Notionally separate machines are sharing memory. What could go wrong?

Continue reading “33C3: Memory Deduplication, The Hacker’s Friend” →

Popular Printers Pwned In Prodigious Page Prank

February 4, 2017 by 40 Comments

A new day dawns, and we have another story involving insecure networked devices. This time it is printers of all makes and descriptions that are causing the panic, as people are finding mystery printouts bearing messages such as this:

“Stackoverflowin has returned to his glory, your printer is part of a botnet, the god has returned“

Well that’s it then, you can’t argue with a deity, especially one who has apparently created a botnet from the world’s printing devices. Printer owners the world over are naturally worried about their unexpected arrival, and have appeared on support forums and the like to express their concern.

We are of course used to taking everything our printers tell us at face value. Low on ink? I hear you, my inanimate reprographic friend! But when our printer tells us it’s part of a botnet perhaps it’s time to have a little think. It is entirely possible that someone could assemble a botnet of compromised printers, but in this case we smell a rat. Only in farcical crime dramas do crooks announce their crimes in such a theatrical fashion, you might say it’s the point of a botnet not to be detected by its host. Reading some of the reports it seems that many of the affected systems have port 9100 open to the world, that’s the standard TCP printer port, so it seems much more likely that someone has written a little script that looks for IP addresses with port 9100 open, and trolls them with this message.

The real message here is one with which we expect Hackaday readers will be very familiar, and which we’ve covered before. Many network connected appliances have scant regard for security, and are a relative push-over for an attacker. The solution is relatively straightforward to those of a technical inclination, be aware of which services the devices is exposing, lock down services such as uPNP and close any open ports on your router. Unfortunately these steps are probably beyond many home users, whose routers remain with their default manufacturer’s settings for their entire lives. It’s a shame our printer troll didn’t add a link to basic router security tips.

If you want to have a little fun, some of the printed pages include an email address for ‘the god’. It would be fun to figure out who this is, right?

Jamming WiFi By Jumping On The ACK

February 3, 2017 by 27 Comments

As we fill our airwaves with more and more wirelessly connected devices the question of what could disrupt this systems becomes more and more important. Here’s a particularly interesting example because the proof of concept shows that you don’t need specialized hardware to pull it off. [Bastian Bloessl] found an interesting tweak to previous research that allows an Atheros WiFi card to jam WiFi by obscuring ACK frames.

The WiFi protocol specifies an Acknowledgement Frame (ACK) which is sent by the receiving device after error correction has been performed. It basically says: “yep, I got that data frame and it checks out”. This error correcting process turns out to be the key to [Bastian’s] technique as it provides time for the attack hardware to decide if it’s going to jam the ACK or not.

The jamming technique presented by [Mathy Vanhoef] at the end 2014 outlined both constant and selective jamming. The selective part involved listening for data packets and analyzing them to determine if they are headed to a MAC the attacker wishes to jam. The problem is that by the time your commodity hardware has decoded that address it’s too late to jam the packet. [Bastian] isn’t trying to jam the data frame, he’s jamming the ACK that the receiver sends back. Without that acknowledgement, the sender will not transmit any new data frames as it assumes there is a problem on the receiving end.

3D Printed Bicycle From Stainless Steel!

February 3, 2017 by 44 Comments

You wouldn’t 3D print a car, would you? That’d simply be impractical. However, if you’re a team of students attending the Delft University of Technology (TU Delft) in the Netherlands, you might be inclined to 3D print a stainless steel bicycle instead.

The TU Delft team collaborated with MX3D, a company that uses an articulated industrial robot arm with a welder for an effector, welding and building the Arc Bicycle, glob by molten glob. Printed in chunks, this process allows the practical construction of larger objects that are able to withstand the stresses and forces of everyday use. Weighing around 20kg, you might not want to spend much time carrying it up to an apartment anytime soon, so stick to the cobblestone streets — the Arc Bicycle can take it.

Continue reading “3D Printed Bicycle From Stainless Steel!” →