Faxsploit – Exploiting A Fax With A Picture

Security researchers have found a way to remotely execute code on a fax machine by sending a specially crafted document to it. So… who cares about fax? Well apparently a lot of persons are still using it in many institutions, governments and industries, including the healthcare industry, legal, banking and commercial. Bureaucracy and old procedures tend to die hard.

This is one of those exploits that deserve proper attention, for many reasons. It is well documented and is a great piece of proper old school hacking and reverse engineering. [Eyal Itkin], [Yannay Livneh] and [Yaniv Balmas] show us their process in a nicely done article that you can read here. If you are into security hacks, it’s really worth reading and also worth watching the DEFCON video. They focused their attention in a all-in-one printer/scanner/fax and the results were as good as it gets.

Our research set out to ask what would happen if an attacker, with merely a phone line at his disposal and equipped with nothing more than his target`s fax number, was able to attack an all-in-one printer by sending a malicious fax to it.

In fact, we found several critical vulnerabilities in all-in-one printers which allowed us to ‘faxploit’ the all-in-one printer and take complete control over it by sending a maliciously crafted fax.

As the researchers note, once an all-in-one printer has been compromised, it could be used to a wide array of malicious activity, from infiltrating the internal network, to stealing printed documents even to mining Bitcoin. In theory they could even produce a fax worm, replicating via the phone line.

The attack summary video is bellow, demonstrating an exploit that allows an attacker to pivot into an internal network and taking over a Windows machine using Eternal Blue NSA exploit.

Continue reading “Faxsploit – Exploiting A Fax With A Picture”

Hackaday Links: April 7, 2019

It’s April, which means all the people responsible for doubling the number of badges at DEF CON are hard at work getting their prototypes ready and trying to fund the entire thing. The first one out of the gate is Da Bomb, by [netik] and his crew. This is the same team that brought you the Ides of DEF CON badge, a blinky wearable multiplayer game that’s SPQR AF. Da Bomb is now a Kickstarter campaign to get the funding for the run of 500, and you’re getting a wearable badge filled with puzzles, Easter eggs, and a radio-based sea battle game that obviously can’t be called Battleship, because the navy doesn’t have battleships anymore.

Speaking of badges and various badge paraphernalia, there’s a new standard for add-ons this year. The Shitty Add-On V.1.69bis standard adds two pins and a very secure shrouded connector that solves all the problems of last year’s standard. [AND!XOR] just released a Shitty Brooch that powers all Shitty Add-Ons with a CR2032 battery. All the files are up on the Gits, so have fun.

You can 3D print anything if you don’t mind dealing with supports. But how to remove supports? For that [CCecil] has a great tip: use Chap stick. This is a print that used supports and it’s perfectly clean, right off the bed. By inserting a suspend (M600) command at the z-height of the top of the interface layer, then adding Chap stick on the top layer, everything comes off clean. Neat.

Speaking of 3D printing, here’s a project for anyone with the patience to do some serious modeling. It’s a pocket Soviet record player, although I think it’s more properly called a gramophone. It’s crank powered, so there’s a spring in there somewhere, and it’s entirely acoustic with zero electronics. Yes, you’re going to need a needle, but I’d be very interested in seeing somebody remake this using modern tools and construction materials.

Down the Rabbit Hole of Electronics Manufacturing

If you want to build hundreds of a thing (and let’s face it, you do) now is a magical time to do it. Scale manufacturing has never been more accessible to the hardware hacker, but that doesn’t mean it’s turn-key with no question marks along the way. The path is there, but it’s not well marked and is only now becoming well-traveled. The great news is that yes, you can get hundreds of a thing manufactured, and Kerry Scharfglass proves that it’s a viable process for the lone-wolf electronics designer. He’s shared tips and tricks of the manufacturing process in a prefect level of detail during his talk at the 2018 Hackaday Superconference.

Kerry is the person behind the Dragonfly badge that was sold at DEF CON over the last two years. Yes, this is #badgelife, but it’s also a mechanism for him to test the waters for launching his own medium-run electronics business. And let’s face it, badge making can be a business. Kerry treats it as such in his talk.

Continue reading “Down the Rabbit Hole of Electronics Manufacturing”

Video Review: AND!XOR DEF CON 26 Badge

The AND!XOR team have somehow managed to outdo themselves once again this year. Their newest unofficial hardware badge for DEF CON 26 just arrived. It’s a delightful creation in hardware, software, and the interactive challenges built into both.

They call this the “Wild West of IoT”, a name that draws from the aesthetic as well as the badge-to-badge communications features. Built on the ESP32-WROVER module which brings both WiFi and Bluetooth to the party, the badges are designed to form a wireless botnet at the conference. Anyone with a badge can work to advance their level and take more and more control of the botnet as they do.

Check out the video overview and then join me below for a deeper dive into all this badge has to offer.

Continue reading “Video Review: AND!XOR DEF CON 26 Badge”

Hackaday Links: June 24, 2018

What do you do if you’re laying out a PCB, and you need to jump over a trace, but don’t want to use a via? The usual trick is using a zero Ohm resistor to make a bridge over a PCB trace. Zero Ohm resistors — otherwise known as ‘wire’ — are a handy tool for PCB designers who have backed themselves into a corner and don’t mind putting another reel on the pick and place machine. Here’s a new product from Keystone that is basically wire on a tape and reel. It’s designed to jump traces on a PCB where SMD zero ohm resistors and through-hole jumpers aren’t possible. I suppose you could also use it as a test point. They’re designed for high current applications, but before we get to that, let’s consider how much power is dissipated into a zero ohm resistor.

By the way, as of this writing, Mouser is showing 1,595 for Keystone’s 5100TR PCB jumpers in stock. They come on a reel of 1,000, and a full reel will cost you $280. This is significantly more expensive than any SMD zero ohm resistor, and it means someone bought four hundred of them. The electronic components industry is weird and you will never understand it.

There’s a new product from ODROID, and you want it. The ODROID-GO is a Game Boy and Sega Master System emulator running on an ESP-32, has a fantastic injection molded case, and looks phenomenal.  You can buy it now for $32. Does this sound familiar? Yes, a few months ago, the PocketSprite was released. The PocketSprite is the tiniest Game Boy ever, and a project [Sprite_TM] introduced to the world at the 2016 Hackaday Superconference.

This week, the speaker schedules for two awesome cons were announced. The first is HOPE, at the Hotel Penn on July 20th. Highlights of this year? [Mitch Altman] is talking about DSP, [Chelsea Manning] will be on stage, someone is talking about HAARP (have fun with the conspiracy theorists), and someone is presenting an argument that [Snowden] is an ideological turd. The speaker schedule for DEF CON was also announced. The main takeaway: god bless the CFP board for reigning in all the blockchain talks, the Nintendo Switch was broken wide open this year, but there’s only a talk on the 3DS, and there’s more than enough talks on election hacking, even though that was a success of propaganda instead of balaclava-wearing hackers.

The C.H.I.P. is no more, or at least that’s the rumor we’re running with until we get some official confirmation. When it was introduced, the C.H.I.P. was a Linux system on a chip with complete register documentation. It appears the end of C.H.I.P. is upon us, but have no fear: there’s a community building the PocketC.H.I.P., or the C.H.I.PBeagle. It’s a single board computer based around the OSD3358 from Octavo, the same system found in the PocketBeagle. Source in KiCAD, and people are working on it. Thanks [smerrett79] for the tip.

Hackaday Links: May 6th 2018

Way back in the day, if you were exceptionally clever, you could just solder more RAM to your computer. You did this by taking a DIP, stacking it on top of an existing RAM chip, bending out the enable pin, and soldering everything down. Wire the enable pin to an address pin, and you have more RAM. [Eric] wanted to get a game running on a Tandy 1000A, but that computer just doesn’t have enough RAM. The solution was to stack the RAMs. It’s a human centipede of deadbugging skills.

We’ve mentioned this before, but I just received another copy of either the best or worst press release I’ve ever seen. Dateline George Town, Cayman Islands: Onstellar is a cryptocurrency-based social network focusing on the paranormal. Apparently, you can use a blockchain to talk about UFOs. It gets better, though: Onstellar will be exhibiting at the world’s largest UFO conference at the beginning of June, in the middle of the Mojave, where a bunch of Air Force and Navy planes are flying all the time. It seems like you would want to have a UFO conference where there’s a lower rate of false positives, right?

A Biohacker has died. Aaron Traywick was found dead in a sensory deprivation chamber in Washington DC this week. Traywick found fame as the CEO of Ascendance Biomedical and by skirting the FDA by self-medication; he recently injected himself with a ‘research compound’ that he said could cure herpes. He was planning CRISPR trials in Tijuana.

You’ve heard of Bad Obsession Motorsports, right? It’s a YouTube channel of two blokes in a shed stuffing a Celica into a Mini. It is the greatest fabrication channel on YouTube. They haven’t uploaded anything in six months, but don’t worry: the next episode is coming out on May 18th. Yes, this is newsworthy.

As further evidence that Apple hardware sucks, if you plug both ends of a USB-C PD cable into a MacBook, it charges itself.

Defcon China is this week. Let me set the scene for you. Last year, at the closing ceremonies for Defcon (the Vegas one), [DT] got up on stage and announced 2018 would see the first Defcon in China. The sound of four thousand raised eyebrows erupted. We’re interested to see how this one goes down. Here are the talks It’s a bit light, but then again this is only the first year.

The Swiss Guard is now 3D printing their helmets. The personal army of the Pope also wears funny hats, and they’re replacing their metal helmets with 3D printed ones. Of note: these helmets are printed in PVC. The use of PVC has been repeated in several high-profile publications, leading me to believe that yes, these actually are printed in PVC, or everyone is getting their information from an incorrect Vatican press release This is odd, because PVC will give everyone within a five mile radius cancer if used in a 3D printer, and you wouldn’t use PVC anyway if ABS and PLA are so readily available. If you’re wondering if injection molding makes sense, giving each new recruit their own helmet means producing about thirty per year; the economics probably don’t work.

Hackaday Links: April 22, 2018

Eagle 9 is out. Autodesk is really ramping up the updates to Eagle, so much so it’s becoming annoying. What are the cool bits this time? Busses have been improved, which is great because I’ve rarely seen anyone use busses in Eagle. There’s a new pin breakout thingy that automagically puts green lines on your pins. The smash command has been overhauled and now moving part names and values is somewhat automatic. While these sound like small updates, Autodesk is doing a lot of work here that should have been done a decade ago. It’s great.

Crypto! Bitcoin is climbing up to $9,000 again, so everyone is all-in on their crypto holdings. Here’s an Arduino bitcoin miner. Stats of note: 150 hashes/second for the assembly version, and at this rate you would need 10 billion AVRs to mine a dollar a day. This array of Arduinos would need 2 Gigawatts, and you would be running a loss of about $10 Million per day (minus that one dollar you made).

Are you going to be at Hamvention? Hamvention is the largest amateur radio meetup in the Americas, and this year is going to be no different. Unfortunately, I’ll be dodging cupcake cars that weekend, but there is something of note: a ‘major broadcaster’ is looking for vendors for a ‘vintage tech’ television series. This looks like a Canadian documentary, which adds a little bit of respectability to this bit of reality television (no, really, the film board of Canada is great). They’re looking for weird or wacky pieces of tech, and items that look unique, strange, or spark curiosity. Set your expectations low for this documentary, though; I think we’re all several orders of magnitude more nerd than what would be interesting to a production assistant. ‘Yeah, before there were pushbutton phones, they all had dials… No, they were all attached to the wall…”

The new hotness on Sparkfun is a blinky badge. What we have here is a PCB, coin cell holder, color changing LED, and a pin clasp. It’s really not that different from the Tindie Blinky LED Badge. There is, however, one remarkable difference: the PCB is multicolored. The flowing unicorn locks are brilliant shades of green, blue, yellow, pink, purple, and red. How did they do it? We know full-color PCBs are possible, but this doesn’t look like it’s using a UV printer. Pad printing is another option, but it doesn’t look like that, either. I have no idea how the unicorn is this colorful. Thoughts?

Defcon is canceled, but there’s still a call for demo labs. They’re looking for hackers to show off what they’ve been working on, and to coax attendees into giving feedback on their projects.