Hackaday Links: May 6th 2018

Way back in the day, if you were exceptionally clever, you could just solder more RAM to your computer. You did this by taking a DIP, stacking it on top of an existing RAM chip, bending out the enable pin, and soldering everything down. Wire the enable pin to an address pin, and you have more RAM. [Eric] wanted to get a game running on a Tandy 1000A, but that computer just doesn’t have enough RAM. The solution was to stack the RAMs. It’s a human centipede of deadbugging skills.

We’ve mentioned this before, but I just received another copy of either the best or worst press release I’ve ever seen. Dateline George Town, Cayman Islands: Onstellar is a cryptocurrency-based social network focusing on the paranormal. Apparently, you can use a blockchain to talk about UFOs. It gets better, though: Onstellar will be exhibiting at the world’s largest UFO conference at the beginning of June, in the middle of the Mojave, where a bunch of Air Force and Navy planes are flying all the time. It seems like you would want to have a UFO conference where there’s a lower rate of false positives, right?

A Biohacker has died. Aaron Traywick was found dead in a sensory deprivation chamber in Washington DC this week. Traywick found fame as the CEO of Ascendance Biomedical and by skirting the FDA by self-medication; he recently injected himself with a ‘research compound’ that he said could cure herpes. He was planning CRISPR trials in Tijuana.

You’ve heard of Bad Obsession Motorsports, right? It’s a YouTube channel of two blokes in a shed stuffing a Celica into a Mini. It is the greatest fabrication channel on YouTube. They haven’t uploaded anything in six months, but don’t worry: the next episode is coming out on May 18th. Yes, this is newsworthy.

As further evidence that Apple hardware sucks, if you plug both ends of a USB-C PD cable into a MacBook, it charges itself.

Defcon China is this week. Let me set the scene for you. Last year, at the closing ceremonies for Defcon (the Vegas one), [DT] got up on stage and announced 2018 would see the first Defcon in China. The sound of four thousand raised eyebrows erupted. We’re interested to see how this one goes down. Here are the talks It’s a bit light, but then again this is only the first year.

The Swiss Guard is now 3D printing their helmets. The personal army of the Pope also wears funny hats, and they’re replacing their metal helmets with 3D printed ones. Of note: these helmets are printed in PVC. The use of PVC has been repeated in several high-profile publications, leading me to believe that yes, these actually are printed in PVC, or everyone is getting their information from an incorrect Vatican press release This is odd, because PVC will give everyone within a five mile radius cancer if used in a 3D printer, and you wouldn’t use PVC anyway if ABS and PLA are so readily available. If you’re wondering if injection molding makes sense, giving each new recruit their own helmet means producing about thirty per year; the economics probably don’t work.

Hackaday Links: April 22, 2018

Eagle 9 is out. Autodesk is really ramping up the updates to Eagle, so much so it’s becoming annoying. What are the cool bits this time? Busses have been improved, which is great because I’ve rarely seen anyone use busses in Eagle. There’s a new pin breakout thingy that automagically puts green lines on your pins. The smash command has been overhauled and now moving part names and values is somewhat automatic. While these sound like small updates, Autodesk is doing a lot of work here that should have been done a decade ago. It’s great.

Crypto! Bitcoin is climbing up to $9,000 again, so everyone is all-in on their crypto holdings. Here’s an Arduino bitcoin miner. Stats of note: 150 hashes/second for the assembly version, and at this rate you would need 10 billion AVRs to mine a dollar a day. This array of Arduinos would need 2 Gigawatts, and you would be running a loss of about $10 Million per day (minus that one dollar you made).

Are you going to be at Hamvention? Hamvention is the largest amateur radio meetup in the Americas, and this year is going to be no different. Unfortunately, I’ll be dodging cupcake cars that weekend, but there is something of note: a ‘major broadcaster’ is looking for vendors for a ‘vintage tech’ television series. This looks like a Canadian documentary, which adds a little bit of respectability to this bit of reality television (no, really, the film board of Canada is great). They’re looking for weird or wacky pieces of tech, and items that look unique, strange, or spark curiosity. Set your expectations low for this documentary, though; I think we’re all several orders of magnitude more nerd than what would be interesting to a production assistant. ‘Yeah, before there were pushbutton phones, they all had dials… No, they were all attached to the wall…”

The new hotness on Sparkfun is a blinky badge. What we have here is a PCB, coin cell holder, color changing LED, and a pin clasp. It’s really not that different from the Tindie Blinky LED Badge. There is, however, one remarkable difference: the PCB is multicolored. The flowing unicorn locks are brilliant shades of green, blue, yellow, pink, purple, and red. How did they do it? We know full-color PCBs are possible, but this doesn’t look like it’s using a UV printer. Pad printing is another option, but it doesn’t look like that, either. I have no idea how the unicorn is this colorful. Thoughts?

Defcon is canceled, but there’s still a call for demo labs. They’re looking for hackers to show off what they’ve been working on, and to coax attendees into giving feedback on their projects.

Hackaday Links: February 18, 2018

Hacker uses pineapple on unencrypted WiFi. The results are shocking! Film at 11.

Right on, we’ve got some 3D printing cons coming up. The first is MRRF, the Midwest RepRap Festival. It’s in Goshen, Indiana, March 23-25th. It’s a hoot. Just check out all the coverage we’ve done from MRRF over the years. Go to MRRF.

We got news this was going to happen last year, and now we finally have dates and a location. The East Coast RepRap Fest is happening June 22-24th in Bel Air, Maryland. What’s the East Coast RepRap Fest? Nobody knows; this is the first time it’s happening, and it’s not being produced by SeeMeCNC, the guys behind MRRF. There’s going to be a 3D printed Pinewood Derby, though, so that’s cool.

జ్ఞ‌ా. What the hell, Apple?

Defcon’s going to China. The CFP is open, and we have dates: May 11-13th in Beijing. Among the things that may be said: “Hello Chinese customs official. What is the purpose for my visit? Why, I’m here for a hacker convention. I’m a hacker.”

Intel hit with lawsuits over security flaws. Reuters reports Intel shareholders and customers had filed 32 class action lawsuits against the company because of Spectre and Meltdown bugs. Are we surprised by this? No, but here’s what’s interesting: the patches for Spectre and Meltdown cause a noticeable and quantifiable slowdown on systems. Electricity costs money, and companies (server farms, etc) can therefore put a precise dollar amount on what the Spectre and Meltdown patches cost them. Two of the lawsuits allege Intel and its officers violated securities laws by making statements or products that were false. There’s also the issue of Intel CEO Brian Krzanich selling shares after he knew about Meltdown, but before the details were made public. Luckily for Krzanich, the rule of law does not apply to the wealthy.

What does the Apollo Guidance Computer look like? If you think it has a bunch of glowey numbers and buttons, you’re wrong; that’s the DSKY — the user I/O device. The real AGC is basically just two 19″ racks. Still, the DSKY is very cool and a while back, we posted something about a DIY DSKY. Sure, it’s just 7-segment LEDs, but whatever. Now this project is a Kickstarter campaign. Seventy bucks gives you the STLs for the 3D printed parts, BOM, and a PCB. $250 is the base for the barebones kit.

We Are Now At DEFCON 2

If you had a working DEFCON meter that reported on real data, would it be cool or distressing?

Before we get ahead of ourselves: no, not that DEF CON. Instructables user [ArthurGuy] is a fan of the 1983 movie  War Games, and following a recent viewing –hacker senses a-tingling — he set to work building his own real-time display.

Making use of some spare wood, [ArthurGuy] glued and nailed together a 10x10x50cm box for the sign. Having been painted white already at some point, the paint brilliantly acted as a reflector for the lights inside each section. The five DEF CON level panels were cut from 3mm pieces of coloured acrylic with the numbers slapped on after a bit of work from a vinyl cutter.

Deviating from a proper, screen-accurate replica, [ArthurGuy] cheated a little and used WS2812 NeoPixel LED strips — 12 per level — and used a Particle Photon to control them. A quick bit of code polls the MI5 terrorism RSS feed and displays its current level — sadly, it’s currently at DEFCON 2.

Continue reading “We Are Now At DEFCON 2”

Smart Gun Beaten by Dumb Magnets

[Plore], a hacker with an interest in safe cracking, read a vehemently anti-smart-gun thread in 2015. With the words “Could you imagine what the guys at DEF CON could do with this?” [Plore] knew what he had to do: hack some smart guns. Watch the video below the break.

Armed with the Armatix IP1, [Plore] started with one of the oldest tricks in the book: an RF relay attack. The Armatix IP1 is designed to fire only when a corresponding watch is nearby, indicating that a trusted individual is the one holding the gun. However, by using a custom-built $20 amplifier to extend the range of the watch, [Plore] is able to fire the gun more than ten feet away, which is more than enough distance to be dangerous and certainly more than the few inches the manufacturers intended.

Not stopping there, [Plore] went to the other extreme, creating what he calls an “electromagnetic compatibility tester” (in other words, a jammer) that jams the signal from the watch, effectively preventing a legitimate gun owner from firing their gun at 10 to 20 feet!

Not one to call it quits, [Plore] realised that the gun prevented illicit firing with a simple metal pin which it moved out of the way once it sensed the watch nearby. However, this metal just happened to be ferrous, and you know what that means: [Plore], with the help of some strong magnets, was able to move the pin without any electrical trickery.

Now, we’ve already covered the many hurdles that smart guns face, and this specific investigation of the state of smart gun technology doesn’t make the picture look any brighter. We’re aware that hindsight is always 20/20, so let us know in the comments how you would fix the problems with the Armatix IP1.
Continue reading “Smart Gun Beaten by Dumb Magnets”

DEF CON Badgelife: The ESP Rules All

Badgelife is the celebration of independent hardware creators, working for months at a time to bring custom electronic badges to conferences around the world. This year at DEF CON, Badgelife is huge. It’s not just because this year was supposed to feature a non-electronic badge, and it’s not because the official badge imploded last month — Badgelife is all about people spending most of the year designing, and manufacturing hardware, culminating in one very special weekend.

[Garrett] owns Hacker Warehouse, a store providing all kinds of neat hacker tools ranging from software-defined radios to lock pick sets to side channel analysis toolkits. This year, [Garrett] decided he wanted to branch out his business and get involved in a little bit of hardware creation. He’s been curious about this for some time and figured a limited edition DEF CON badge made sense. What he wound up with is a beautiful little badge with games, blinkies, graphics, and potential to cause a lot of wireless mischief.

Would you look at that. RF design on an independent badge.

The design of the Hacker Warehouse badge is surprisingly simple compared to the Bender Badges and puzzling crypto badges that are also part of this year’s Badgelife hardware celebration. On board is an ESP8266 with a custom PCB implementation that includes a larger Flash chip. The other side of the board is loaded up with four tact switches in a D-pad arrangement. On top is a 96 x 64 pixel full-color OLED display, and blinkies are provided by fourteen mini WS2812 RGB LEDs. Power is provided by two AA cells and what looks to be a nice fancy switching regulator. This is real hardware, not just a few modules thrown together with a bunch of LEDs.

Oh, what wireless fun

This badge is built around the ESP8266, a very interesting WiFi-enabled microcontroller that has more features than it should. [Garrett] is using the ESP as a WiFi scanner of sorts, allowing anyone with this badge to monitor WiFi channels, APs, packets, and — this is important — deauth packets.

Over the last year, there have been a number of projects around the Internet that take an ESP8266 and spew deauthorization frames into the spectrum. These frames cause a WiFi client to stop using an access point, and basically shuts down all the WiFi in an area. It’s well documented, and people have been doing it for years, but the ESP8266 makes deauth attacks so very, very easy. We’re going to see a lot of deauth frames this year at DEF CON, and the Hacker Warehouse badge will be able to detect them. It can also generate these frames, but that capability is locked for now.

Blinking and glowing

An electronic conference badge isn’t cool unless it has obnoxiously bright and glowy LEDs, and the Hacker Warehouse badge is very cool.

Onboard the Hacker Warehouse badge are 14 RGB LEDs, programmed with 46 different patterns that are certainly bright enough to annoy someone. This is what you need for a badge, and it’s beautiful.

This is a truly fantastic badge that’s also a great development board for the ESP8266. Everything you need for portable WiFi gaming fun is already there — you have blinky LEDs, an OLED, what seems to be a fairly nice power supply, and enough buttons to do something interesting. All you need to do to program this badge is attach a USB to serial adapter to the pre-populated header and you really have something. It’s a great badge, and we can’t wait to see the hacks for this great piece of hardware next week at DEF CON.

Pwning With Sewing Needles

If you don’t have root, you don’t own a device, despite what hundreds of Internet of Things manufacturers would tell you. Being able to access and write to that embedded Linux system in your new flashy gadget is what you need to truly own a device, and unfortunately this is a relatively uncommon feature. At this year’s DEF CON, [Brad Dixon] unveiled a technique that pwns a device using only a sewing needle, multimeter probe, or a paperclip. No, it won’t work on every device, and the devices this technique will work with are poorly designed. That doesn’t mean it doesn’t work, and that doesn’t mean the Pin2Pwn technique isn’t useful, though.

The attack relies on how an embedded Linux device boots. All the software needed to load Linux and the rest of the peripheral magic is usually stored on a bit of Flash somewhere on the board. By using a pin, probe, or paperclip to short two data pins, or two of the latch pins on this memory chip, the bootloader will fail, and when that happens, it may fall back to a uboot prompt. This pwns the device.

There are a few qualifications for this Pwn using a pin. If the device has JTAG, it doesn’t matter – you can already own the device. If, however, a device has a locked-down JTAG, unresponsive serial ports, or even their own secure boot solution, this technique might work.

Two data pins on a TSSOP Flash shorted by a multimeter probe
Two data pins on a TSSOP Flash shorted by a multimeter probe

This exploit works on the property of the bootloader. This bit of code first looks at a piece of Flash or other memory separate from the CPU and loads whatever is there. [Brad] found a few devices (mostly LTE routers) that would try to load Linux from the Flash, fail, try to load Linux again, fail, and finally drop to a uboot prompt.

As with any successful exploit, an equally effective mitigation strategy must be devised. There are two ways to go about this, and in this case, the software side is much better at getting rid of this attack than the hardware side.

Since this attack relies on the software falling back to uboot after an unsuccessful attempt at whatever it should be booting, the simplest and most effective mitigation technique is simply rebooting the device if the proper firmware can’t be found. Having a silent serial console is great, but if the attack relies on falling back to uboot, simply not doing that will effectively prevent this attack.

The hardware side is a little simpler than writing good firmware. Instead of using TSSOP and SOIC packages for storing the device firmware, use BGAs. Hide the pins and traces on an inner layer of the board. While this isn’t a foolproof way of preventing the attack – there will always be someone with a hot air gun, magnet wire, and a steadier hand than you – it’s hard to glitch a data line with a sewing needle if you can’t see the data line.