The Dark Arts: SQL Injection And Secure Passwords

March 9, 2016 by Will Sweatman 41 Comments

As the year of 2005 was drawing to a close, a website known as Myspace was basking in popularity. With millions of users, the site was the most popular social networking site in the world. It was unique in that it let users use HTML code to customize their Myspace page. Most of us, c’mon…admit it….had a Myspace page. The coding part was fun! But not everything was changeable with code. You could only upload up to 12 images and the Relationship Status drop-down menu only had a few options to choose from. These limitations did not sit well with [Samy Kamkar], a 19 year old hacker out of Los Angeles.

It didn’t take [Samy] long to figure out how to trick the site to let him upload more images and change his relationship status to a customized “in a hot relationship”. After hoodwinking the Myspace site with some simple hacks, he realized he could do just about anything he wanted to with it. And this is where things get interesting. It took just over a week to develop a script that would force people who visited his page to add him as a friend. But that wasn’t enough. He then programmed the script to copy itself onto the visitor’s page. [Samy] had developed a self-propagating worm.

The script went live as [Samy] went to bed. He woke up the next morning with 200 friends requests. An hour later the number had doubled. [Samy] got worried and sent an anonymous email to the webmaster warning of the worm. It was ignored. By 1:30PM that day, he had over 6,000 friends request. And like any good hacker worth his weight in floppy drives, his sense of humor had him program the script to also add his name to each visitor’s Heroes List. This angered many people, who deleted him from their page, only to get reinfected moments later when they visited another (infected) page.

[Samy’s] script was raging out of control. As the evening closed in, his friends count had reached 919,664. It would top the 1 million mark just before Myspace took their servers offline to figure out what was going on. Two hours later, the site was back up. [Samy’s] profile page had been deleted.

[Samy] had used a technique known as cross-site scripting (XSS) to pull off his hack. We’ll touch on XSS in a later article. For now, we’re going to stick to the basics – proper passwords and SQL Injection.

Continue reading “The Dark Arts: SQL Injection And Secure Passwords” →

How Low Can You Go? The World Of QRP Operation

March 8, 2016 by Dan Maloney 52 Comments

Newly minted hams like me generally find themselves asking, “What now?” after getting their tickets. Amateur radio has a lot of different sub-disciplines, ranging from volunteering for public service gigs to contesting, the closest thing the hobby has to a full-contact sport. But as I explore my options in the world of ham radio, I keep coming back to the one discipline that seems like the purest technical expression of the art and science of radio communication – low-power operation, or what’s known to hams as QRP. With QRP you can literally talk with someone across the planet on less power than it takes to run a night-light using a radio you built in an Altoids tin. Now that’s a challenge I can sink my teeth into.

Continue reading “How Low Can You Go? The World Of QRP Operation” →

Ask Hackaday: Is PLA Biodegradable?

March 8, 2016 by Brian Benchoff 79 Comments

The most popular plastic for 3D printers is PLA – polylactic acid – a plastic that’s either derived from corn starch, inedible plant detritus, or sugar cane, depending where in the world it was manufactured. Being derived from natural materials, PLA is marketed as being biodegradable. You don’t need to worry about low-poly Pokemon and other plastic trinkets filling landfills when you’re printing with PLA, all these plastic baubles will return to the Earth from whence it came.

3D printers have been around for a few years now, and now objects printed in PLA have been around the sun a few times. A few of these objects have been completely forgotten. How’s that claim of being biodegradable holding up? The results are mixed, and as always, more data is needed.

A few weeks ago, [LazyGecko] found one of his first experiments in 3D printing. In 2012, he was experimenting with tie dying PLA prints by putting his prints in a jar filled with water and blue dye. This jar was then placed in the back of his cupboard and quickly forgotten. 3.5 years later, [LazyGecko] remembered his experiment. Absolutely nothing happened, save for a little bit of blue dye turning the print a pastel baby blue. The print looks and feels exactly like the day it came off the printer.

[LazyGecko]’s blog post was noticed by [Bill Waters], and he has one datum that points to PLA being biodegradable. In 2015, [Bill] printed a filter basket for his fish tank. The first filter basket worked well, but made a small design change a week later, printed out another, and put the first print in storage. He now has two nearly identical prints, one in constant use in a biologically interesting environment, the other sitting on a shelf for a year.

[Bill]’s inadvertent experiment is very close to the best possible experimental design to make the case for PLA biodegradability. The 3D printed filter basket in constant use for a year suffered significant breakdown, and the honeycomb walls are starting to crumble. The ‘inert’ printed filter basket looks like it just came off the build plate.

If that’s not confusing enough, [Bill] also has another print that has spent a year in a fish tank. This end cap for a filter spray bar didn’t see any degradation, despite being underwater in a biologically active environment. The environment is a little different from a filter basket, though; an aquarium filter is designed to break down organics.

To answer the question, ‘is PLA biodegradable,’ the most accurate answer is, ‘maybe’. Three data points in uncontrolled environments isn’t enough to draw any conclusions. There are, undoubtedly, more forgotten 3D prints out there, and more data to back up the claim of PLA being biodegradable.

This is where you come in. Do you have some forgotten prints out there? Your input is needed, the fruits of your labors are evidence, your prints might be decaying and we want to know about it below.

It’s Time The Software People And Mechanical People Sat Down And Had A Talk.

March 7, 2016 by Gerrit Coetzee 131 Comments

With the advances in rapid prototyping, there’s been a huge influx of people in the physical realm of hacking. While my overall view of this development is positive, I’ve noticed a schism forming in the community. I’m going to have to call a group out. I think it stems from a fundamental refusal of software folks to change their ways of thinking to some of the real aspects of working in the physical realm, so-to-speak. The problem, I think, comes down to three things: dismissal of cost, favoring modularity over understanding, and a resulting insistence that there’s nothing to learn.

Continue reading “It’s Time The Software People And Mechanical People Sat Down And Had A Talk.” →

Reviving The Best Keyboard Ever

March 7, 2016 by Brian Benchoff 71 Comments

For the last few decades, the computer keyboard has been seen as just another peripheral. There’s no need to buy a quality keyboard, conventional wisdom goes, because there’s no real difference between the fancy, ‘enthusiast’ keyboards and ubiquitous Dell keyboards that inhabit the IT closets of offices the world over.

Just like the mechanic who will only buy a specific brand of wrenches, the engineer who has a favorite pair of tweezers, or the amateur woodworker who uses a hand plane made 150 years ago, some people who use keyboards eight or twelve hours a day have realized the older tools of the trade are better. Old keyboards, or at least ones with mechanical switches, aren’t gummy, they’re precise, you don’t have to hammer on them to type, and they’re more ergonomic. They sound better. Even if it’s just a placebo effect, it doesn’t matter: there’s an effect.

This realization has led to the proliferation of high-end keyboards and keyboard aficionados hammering away on boards loaded up with Cherry MX, Alps, Gateron, Topre, and other purely ‘mechanical’ key switches. Today, there are more options available to typing enthusiasts than ever before, even though some holdouts are still pecking away at the keyboard that came with the same computer they bought in 1989.

The market is growing, popularity is up, and with that comes a herculean effort to revive what could be considered the greatest keyboard of all time. This is the revival of the IBM 4704 terminal keyboard. Originally sold to banks and other institutions, this 62-key IBM Model F keyboard is rare and coveted. Obtaining one today means finding one behind a shelf in an IT closet, or bidding $500 on an eBay auction and hoping for the best.

Now, this keyboard is coming back from the dead, and unlike the IBM Model M that has been manufactured continuously for 30 years, the 62-key IBM Model F ‘Kishsaver’ keyboard is being brought back to life by building new molds, designing new circuit boards, and remanufacturing everything IBM did in the late 1970s.
Continue reading “Reviving The Best Keyboard Ever” →

Bullet-time Video Effect By Throwing Your Phone Around

March 7, 2016 by Bob Baddeley 43 Comments

Ski areas are setting formal policies for drones left and right, but what happens when your drone isn’t a drone but is instead a tethered iPhone with wings swinging around you like a ball-and-chain flail as you careen down a mountain? [nicvuignier] decided to explore the possibility of capturing bullet-time video of his ski runs by essentially swinging his phone around him on a tether. The phone is attached to a winged carrier of his own design, 3D printed in PLA.

One would think this would likely result in all kinds of disaster, but we haven’t seen the outtakes yet, and the making-of video has an interesting perspective on each of the challenges he encountered in perfecting the carrier, ranging from keeping it stable and upright, to reducing the motion sickness with the spinning perspective, and keeping it durable enough to withstand the harsh environment and protect the phone.

He has open sourced the design, which works for either iPhone or GoPro models, or it is available for preorder if you are worried about catastrophic delamination of your 3D printed model resulting in much more bullet-like projectile motion.

Continue reading “Bullet-time Video Effect By Throwing Your Phone Around” →

Google Contest Builds More Efficient Inverters

March 6, 2016 by Brian Benchoff 110 Comments

A few summers ago, Google and IEEE announced a one million dollar prize to build the most efficient and compact DC to AC inverter. It was called the Little Box Challenge, with the goal of a 2kW inverter with a power density greater than 50 Watts per cubic inch.

To put this goal into perspective, the DC inverter that would plug into a cigarette lighter in your car has a power density of about 1 or 2 Watts per cubic inch. Very expensive inverters meant for solar installations have a power density of about 5 Watts per cubic inch. This competition aimed to build an inverter with ten times the power density of what is available today.

Now, the results are in, and the results are extremely surprising. The best entry didn’t just meet the goal of 50 W/in³, it blew the goal out of the water.

The winning entry (PDF) comes from CE+T Power, and comes in a package with a volume of 13.77 in³. That’s a power density of 143 W/in³ for a unit you can hold in the palm of your hand. The biggest innovations come from the use of GaN transistors and an incredible thermal management solution.

Other finalists for this competition include Schneider Electric Team from France that managed a 100 W/in³ and a Virginia Tech team that managed a power density of 61.2 W/in³.

Thanks [wvdv2002] for the tip.