Slider

5172 Articles

Naenara

Messing Around With Naenara, North Korea’s Web Browser

January 10, 2015 by 35 Comments

[Robert] has been snooping around Naenara in order to learn more about how North Korea’s intranet might work. Naenara is the web browser that comes bundled with North Korea’s official Linux-based operating system known as Red Star OS. [Robert] once saw a screenshot of the browser and found it interesting that the browser seemed to automatically load a non-routable IP address immediately upon start-up. This made him curious about what other oddities one might uncover from the software.

Upon start-up, the browser tries to load a page located at IP address 10.76.1.11, which is a reserved IP address for private use. This indicated that North Korea’s “Internet” is actually more of in intranet. [Robert] suspects that the entire country may be running in private address space, similar to how your home or business likely runs.

[Robert’s] next thoughts were that the browser looks like a very old version of Mozilla Firefox, but with some default configuration changes. For one, all crashes are automatically transmitted to “the mothership”, as [Robert] calls it. He suspects this is to fix not only bugs, but also to find and repair any security vulnerabilities that may allow users more control.

There are some other interesting changes as well, such as the supported security certificates. The Naenara browser only accepts certificates issued by the DPRK, which would make it very easy for them to snoop on encrypted HTTPS traffic. there is also evidence suggesting that all traffic for the entire country is routed through a single government controlled proxy server.

None of these findings are all that surprising, but it’s still interesting to see what kind of information can be gleamed from poking around the browser and operating system. [Robert] has found more than just these few findings. You can check out the rest of his findings on his blog.

[via Reddit]

CES: Meetups, Augmented Reality, And Robots

January 9, 2015 by 3 Comments

Hackaday started off Thursday of the Consumer Electronics Show with an impromptu breakfast meetup. This turns out to be a wonderful thing as it lets you ease into a 16 hour day of standing, walking, talking, and getting lost trying to find your way from conference hall to conference hall. We had a great turnout and many brought their hacks and demos to show off. A big thanks to the Sambalatte staff who are awesome people and top tier baristas.

CastAR

DSC_0354

Before leaving for CES I was talking to [Ben Krasnow] about what we should try to see and he suggested looking for private showings that are given in the suites of the hotels at the conference. Turns out our friends at Technical Illusions are doing just that. [Jeri] and [Rick] were showing off CastAR in a suite during the week and were nice enough to make room in their booked schedule for a private Demo.

What you see above are the guts of the version they are currently shipping as part of their Kickstarter fulfillment. I also got a look at a rev2 prototype and will write a follow-up post with more information on the whole experience when I have more time.

Eureka, Startups!

There is a loop of aisles in the Sands that has startup booths and most of the interesting things I saw on Wednesday and Thursday are there. Here we have a jamming gripper robot arm. It’s designed for things like moving oddly shaped goods on a manufacturing line. Empire Robotics hit a homerun with their demo for the booth, a take on beer-bong: robot versus human. The scoreboard showed the robot winning an order of magnitude more than the humans.

[Todd] was at was at the Tinkerines booth showing off 3D printers aimed to augmented the STEM curriculum. We couldn’t help but notice his TIE fighter right and inquired about it. He modeled the design himself, send it off to be cast in silver, and inlaid the stone when the ring came back from the casting service. Sweet!

LVBots

[Sarah Petkus] clued me in and gave me a ride to the Pololu CES open house. The night coincided with the LVBots meetup which they support by providing space for the meetings. There were lots of cool robots being shown off. What you see here was just the pre-meeting warmup of line-followers and sumo robots. I shot some video of the show-and-tell which we’ll post once we’ve had a chance to edit the content.

Closing out CES

wpid-wp-1420824368323.jpegToday is the last day of the conference. I stopped by the Voltera PCB printer booth yesterday but they were nowhere to be found. Turns out they were being handed a $50k check by TechCrunch for winning the Battleground. I suppose we’ll give them a pass for not being at the table during that!

I’ll be headed over this afternoon to catch up with them. I’m also hoping to get a look at the Voxel8 printer. If you have any other “can’t-miss” suggestions let me know in the comments and I’ll try to add them to my CES dance card.

Moonpig

When Responsible Disclosure Isn’t Enough

January 8, 2015 by 37 Comments

Moonpig is a well-known greeting card company in the UK. You can use their services to send personalized greeting cards to your friends and family. [Paul] decided to do some digging around and discovered a few security vulnerabilities between the Moonpig Android app and their API.

First of all, [Paul] noticed that the system was using basic authentication. This is not ideal, but the company was at least using SSL encryption to protect the customer credentials. After decoding the authentication header, [Paul] noticed something strange. The username and password being sent with each request were not his own credentials. His customer ID was there, but the actual credentials were wrong.

[Paul] created a new account and found that the credentials were the same. By modifying the customer ID in the HTTP request of his second account, he was able to trick the website into spitting out all of the saved address information of his first account. This meant that there was essentially no authentication at all. Any user could impersonate another user. Pulling address information may not sound like a big deal, but [Paul] claims that every API request was like this. This meant that you could go as far as placing orders under other customer accounts without their consent.

[Paul] used Moonpig’s API help files to locate more interesting methods. One that stood out to him was the GetCreditCardDetails method. [Paul] gave it a shot, and sure enough the system dumped out credit card details including the last four digits of the card, expiration date, and the name associated with the card. It may not be full card numbers but this is still obviously a pretty big problem that would be fixed immediately… right?

[Paul] disclosed the vulnerability responsibly to Moonpig in August 2013. Moonpig responded by saying the problem was due to legacy code and it would be fixed promptly. A year later, [Paul] followed up with Moonpig. He was told it should be resolved before Christmas. On January 5, 2015, the vulnerability was still not resolved. [Paul] decided that enough was enough, and he might as well just publish his findings online to help press the issue. It seems to have worked. Moonpig has since disabled its API and released a statement via Twitter claiming that, “all password and payment information is and has always been safe”. That’s great and all, but it would mean a bit more if the passwords actually mattered.

CES: Building Booths And Simulating Reality

January 7, 2015 by 15 Comments

My first day on the ground at CES started with a somewhat amusing wait at the Taxi Stand of the McCarran International Airport. Actually I’m getting ahead of myself… it started with a surprisingly efficient badge-pickup booth in the baggage claim of the airport. Wait in line for about three minutes, and show them the QR code emailed to you from online registration and you’re ready to move to the 1/4 mile-long, six-switchback deep line for cabs. Yeah, there’s a lot of people here for this conference.

It’s striking just how huge this thing is. Every hotel on the strip is crawling with badge-wearing CES attendees. Many of the conference halls in the hotels are filled with booths, meaning the thing is spread out over a huge geographic area. We bought three-day monorail passes and headed to the convention center to get started.

Building the Booths

Emotive Insights headsets
Slot-car “brain racing” with scoreboard

[Sophi] knows [Ben Unsworth] who put his heart and soul into this year’s IEEE booth. His company, Globacore, builds booths for conferences and this one sounds like it was an exceptional amount of fun to work on. He was part of a tiny team that built a mind-controlled drag strip based on Emotive Insight brainwave measuring hardware shipped directly from the first factory production run. This ties in with the display screens above the track to form a leader board. We’ll have a keen eye out for hacks this week, but the story behind building these booths may be the best hack to be found.

Oculus

Oculus Gear VX uses a Galaxy Note 4 as the display
Sophi Kravitz trying out Oculus Gear VR

[Ben] told us hands-down the thing to see is the new Oculus hardware called Crescent Bay. He emphatically mentioned The Holodeck which is a comparison we don’t throw around lightly. Seems like a lot of people feel that way because the line to try it out is wicked long. We downloaded their app which allows you to schedule a demo but all appointments are already taken. Hopefully our Twitter plea will be seen by their crew.

In the meantime we tried out the Oculus Gear VR. It uses a Galaxy Note 4 as the screen along with lenses and a variety of motion tracking and user controls. The demo was a Zelda-like game where you view the scene from overhead. This used a handheld controller to command the in-game character with the headset’s motion tracking used to look around the playing area. It was a neat demo, I’m not quite sold on long gaming sessions with the hardware but maybe I just need to get used full-immersion first.

Window to another Dimension

DSC_0317

The midways close at six o’clock and we made our way to the Occipital booth just as they were winding done. I’ve been 3D scanned a few times before but those systems used turntables and depth cameras on motorized tracks to do the work. This uses a depth-camera add-on for an iPad which they call Structure Sensor.

It is striking how quickly the rig can capture a model. This high-speed performance is parlayed into other uses, like creating a virtual world inside the iPad which the user navigates by using the screen as if it were a magic window into another dimension. Their demo was something along the lines of the game Portal and has us thinking that the Wii U controller has the right idea for entertainment, but it needs the performance that Occipital offers. I liked this experience more than the Oculus demo because you are not shut off from the real world as you make your way through the virtual.

We shot some video of the hardware and plan to post more about it as soon as we get the time to edit the footage.

Find Us or Follow Us

josh-can-hardwareWe’re wearing our Hackaday shirts and that stopped [Josh] in his tracks. He’s here on business with his company Evermind, but like any good hacker he is carrying around one of his passion projects in his pocket. What he’s showing off are a couple of prototypes for a CANbus sniffer and interface device that he’s build.

We’ll be at CES all week. You can follow our progress through the following Twitter accounts: @Hackaday, @HackadayPrize, @Szczys, and @SophiKravitz. If you’re here in person you can Tweet us to find where we are. We’re also planning a 9am Thursday Breakfast meetup at SambaLatte in the Monte Carlo. We hope you’ll stop by and say hi. Don’t forget to bring your own hardware!

 

Trinket EDC Contest Winners

January 7, 2015 by 20 Comments

It’s time to announce the winners of the Trinket Everyday Carry Contest! We’ve had a great 5 weeks watching the projects come together. A team of Hackaday staffers spent their weekend watching videos and selecting their top entries based on the contest rules. We had a really hard time picking the top three – the competition was tight, and there were quite a few awesome projects.

Without further ado, here are the winners!

1337toolFirst Prize: 1337 3310 tool. [Mastro Gippo] really knocked this one out of the park. He built a swiss army knife of a tool out of the iconic Nokia 3310 candybar phone. 1337 3310 tool is a graphing voltage and current meter, an ohmmeter, a continuity tester that plays the original Nokia ringtone, and a gaming machine which can play Tetris.  [Mastro Gippo] is 99% there with TV-B-Gone functionality as well. Amazingly, [Mastro Gippo] kept the Nokia look and feel in his user interface. He spent quite a bit of time grabbing data and bitmaps from the 3310’s original ROM.  [Mastro Gippo] is getting a Rigol DS1054Z scope to help iron out the bugs in his future projects!

pavaproSecond Prize: Pavapro – portable AVR programmer. [Jaromir] built an incredible pocket-sized microcontroller programming tool. Pavapro can read and edit text files, handle serial I/O at 9600 baud, and burn AVR microcontrollers. If that’s not enough, it can actually assemble AVR binaries from source. That’s right, [Jaromir] managed to fit an entire assembler on the Pro Trinket’s ATmega328 processor. Pavapro’s 16 button keypad won’t allow for much in the way of touch typing, but it does get the job done with T9 style text entry. The device is also extensible, we’re hoping [Jaromir] adds a few other architectures! PIC and MSP430 modes would be awesome!  [Jaromir] will be receiving a Fluke 179 multimeter with a 6 piece industrial electronics tip kit! We’re sure he’ll put it to good use.

robohandThird Prize: Robotic 3rd Hand. Let’s face it. We can’t all be Tony Stark. But [Tim] gets us a little bit closer with his awesome wearable entry. Need a tool? Just press the button, and Robotic 3rd Hand will give you a … hand. [Tim’s] creation utilizes the Pro Trinket to drive a servo which moves an incredibly well designed and 3D printed mechanism that lifts a screwdriver off the wearer’s wrist and places it into their hand. [Tim] originally was going to go with Electromyography (EMG) sensors to drive the hand, however he switched to a simple button when they proved problematic. We absolutely think this was the right decision for the contest – it’s always better to have a simpler but working project rather than a complex yet unreliable one. That said, we’d love to see him circle back and give EMG another try! [Tim’s] next project will be soldered up with the help of a Hakko FX888D with a tip kit. If things get a bit wobbly, he can use his new Panavise 324 Electronic Work center to keep everything steady.

If you didn’t make the top three in this contest, don’t give up! We’re going to be having quite a few contests this year. The top 50 entrants will receive custom Hackaday EDC Contest T-shirts. Check out the full list of 50 on Hackday.io!

Genetic Algorithm Programmer Gets Functions

January 7, 2015 by 47 Comments

[Kory] has been writing genetic algorithms for a few months now. This in itself isn’t anything unique or exceptional, except for what he’s getting these genetic algorithms to do. [Kory] has been using genetic algorithms to write programs in Brainfuck. Yes, it’s a computer programming a computer. Be thankful Skynet is 18 years late.

When we first saw [Kory]’s work, he had programmed a computer to write and run its own programs in Brainfuck. Although the name of the language [Kory] chose could use some work, it’s actually the ideal language for computer-generated programs. With only eight commands, each consisting of a single character, it greatly reduces the overhead of what any genetic algorithm must produce and what a fitness function must evaluate.

There was one shortcoming to [Kory]’s initial efforts: functions. It’s relatively easy to get a program to say Hello World, but to do something complex, you’re going to need something like a macro or a function. Brainfuck, it its most simple form, doesn’t support functions. This throws a wrench in [Kory]’s plan to have his computer programming computer grow smarter and get over local minima in its genetic algorithms.

The solution to this problem was the creation of a new dialect of Brainfuck [Kory] calls BrainPlus. This takes the best parts of Extended Brainfuck and adds a command that basically serves as a break statement.

With this, [Kory]’s self programming computer can develop more complex programs. Already it has created a program to generate the first few numbers of the Fibonacci sequence. It only goes up to 233 because 255 is the maximum value for a byte, and the program itself took seven hours to generate. It does, however, work. Other programs generated with the new Brainplus functions include reciting 99 bottles on the wall and a program that multiples two values.

Even though [Kory]’s computer is spending a long time to generate these programs, given enough time, there’s really not much this program can’t do. Brainfuck, and [Kory]’s Brainplus, are Turing complete, so that given infinite memory and time it can compute anything. With the new addition of functions, it can compute anything faster.

All the code for [Kyle]’s GA is available on Github.

 

3D Printing Circuits Gets Rid Of The Box Altogether

January 6, 2015 by 84 Comments

Many think that the next big step in 3D printing is when we’ll be able to print in metal, well, at an affordable rate. But what about printing in metal and plastic at the same time?

The thing is, most electronics are typically two-dimensional. Layers upon layers of relatively flat PCBs make up the brains of every bit of technology we know and love. The funny thing is, we live in a three-dimensional world, and we like to shove these flat circuits into three-dimensional boxes. Well, what if we didn’t have to? What if the circuit could be embedded directly into whatever shape we want? It’d be pretty awesome — minus the whole servicing aspect of the product…

Anyway we’ve seen some great hacks over the years attempting this, like adding a copper wire strand into your 3D print, embedding components into your print by pausing the job, or even going old school and using the point-to-point Manhattan style circuit construction to add some electronic features to your part. But what if your printer could do it for you?

That’s exactly what Optomec is attempting with the Voxel8 3D printing electronics platform. It is your standard run of the mill FDM style 3D printer, but it has a 2nd extruder that is capable of squeezing out liquid silver ink that dries at room temperature. Just take a look at this quadrotor they were able to make.

Continue reading “3D Printing Circuits Gets Rid Of The Box Altogether” →